Information processing method, device, computer system, and computer-readable storage medium

Abstract

The present disclosure provides an information processing method, an information processing device, a computer system, a computer-readable storage medium, and a computer program product, which can be used in the fields of information security technology, financial technology, or other fields. The method comprises: obtaining an intervention measure demotion strategy table, wherein the intervention measure demotion strategy table includes multiple intervention measures of different priorities; if the acquired information to be processed is risk information, determining a primary intervention measure configured for the risk information; if the primary intervention measure fails to be executed, obtaining a target intervention measure from the intervention measure demotion strategy table; and processing the risk information using the target intervention measure.

Description

Technical Field

[0001] The present disclosure relates to the fields of information security technology and financial technology, and more specifically, to an information processing method, an information processing device, a computer system, a computer-readable storage medium, and a computer program product. Background Art

[0002] With the rapid development of Internet finance, Internet telecommunications fraud is rampant. Criminals use phishing websites, Trojan viruses, telephone scams and other methods to deceive customers. The external fraud situation is becoming more and more serious. Faced with this situation, it is inevitable to take some risk control measures to reduce the occurrence of fraud.

[0003] In the process of realizing the concept of the present disclosure, the inventors discovered that there are at least the following problems in the related art: risk control measures cannot be flexibly applied to different scenarios, resulting in the uncontrolled spread of a large amount of high-risk information. Summary of the Invention

[0004] In view of this, the present disclosure provides an information processing method, an information processing device, a computer system, a computer-readable storage medium, and a computer program product.

[0005] One aspect of the present disclosure provides an information processing method, including: obtaining an intervention measure demotion strategy table, wherein the intervention measure demotion strategy table includes multiple intervention measures of different priorities; when the acquired information to be processed is risk information, determining a primary intervention measure configured for the risk information; when the primary intervention measure fails to be executed, obtaining a target intervention measure from the intervention measure demotion strategy table; and processing the risk information using the target intervention measure.

[0006] According to an embodiment of the present disclosure, the intervention measure demotion strategy table includes first attribute information for characterizing whether each intervention measure is downgradable. In the event that the primary intervention measure fails to be executed, obtaining the target intervention measure from the intervention measure demotion strategy table includes: when it is judged that the primary intervention measure is downgradable according to the first attribute information of the intervention measure demotion strategy table, obtaining an intermediate intervention measure one level lower than the primary intervention measure from the intervention measure demotion strategy table; judging whether the intermediate intervention measure can be successfully executed; when the intermediate intervention measure can be successfully executed, using the intermediate intervention measure as the target intervention measure; and when the intermediate intervention measure cannot be successfully executed and it is judged that the intermediate intervention measure can be downgraded, obtaining the next-level intervention measure, until a target intervention measure that can be successfully executed is obtained or all the downgradable intervention measures in the intervention measure demotion strategy table are traversed.

[0007] According to an embodiment of the present disclosure, the intervention measure downgrade strategy table includes first attribute information for characterizing whether each intervention measure can be downgraded, and the method further includes: intercepting the risk information when it is determined that the primary intervention measure cannot be downgraded based on the first attribute information of the intervention measure downgrade strategy table.

[0008] According to an embodiment of the present disclosure, when the acquired information to be processed is risk information, determining the primary intervention measures configured for the risk information includes: using a risk control model to determine a target risk value obtained by scoring the risk information; obtaining a data dictionary, wherein the data dictionary stores a mapping relationship between different risk values ​​and different intervention measures; determining relevant intervention measures corresponding to the target risk value based on the data dictionary; and using the relevant intervention measures as the primary intervention measures.

[0009] According to an embodiment of the present disclosure, the above-mentioned information processing method also includes: inputting the information to be processed into a risk control model, wherein the information to be processed includes at least one second attribute information, the risk control model is pre-set with a risk characteristic variable, and the risk characteristic variable is used to characterize that a certain variable belongs to a risk variable; and when the risk control model recognizes that at least one second attribute information matches the risk characteristic variable, determining that the information to be processed is risk information.

[0010] According to an embodiment of the present disclosure, the above-mentioned information processing method also includes: obtaining second attribute information of the information to be processed; and determining that the information to be processed is risk information when the number of times the second attribute information appears within a preset time period is greater than a preset threshold.

[0011] According to an embodiment of the present disclosure, the above-mentioned information processing method also includes: obtaining the software and hardware conditions required to execute the intervention measures; if the device used to execute the intervention measures has the software and hardware conditions, determining that the intervention measures can be successfully executed; and if the device used to execute the intervention measures does not have the software and hardware conditions, determining that the intervention measures ultimately failed to execute.

[0012] Another aspect of the present disclosure provides an information processing device, including: a first acquisition module, used to obtain an intervention measure downgrade strategy table, wherein the intervention measure downgrade strategy table includes multiple intervention measures of different priorities; a first determination module, used to determine the primary intervention measures configured for the risk information when the acquired information to be processed is risk information; a second acquisition module, used to obtain target intervention measures from the intervention measure downgrade strategy table when the execution of the primary intervention measures fails; and a processing module, used to process the risk information using the target intervention measures.

[0013] Another aspect of the present disclosure provides a computer system, comprising: one or more processors; and a memory for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the information processing method described above.

[0014] Another aspect of the present disclosure provides a computer-readable storage medium having computer-executable instructions stored thereon, which are used to implement the above-mentioned information processing method when executed.

[0015] Another aspect of the present disclosure provides a computer program product, which includes computer-executable instructions. When the instructions are executed, the instructions are used to implement the information processing method described above.

[0016] According to an embodiment of the present disclosure, by adopting a table of intervention measure demotion strategies, wherein the table of intervention measure demotion strategies includes multiple intervention measures of different priorities; in a case where the acquired information to be processed is risk information, determining the primary intervention measures configured for the risk information; in a case where the execution of the primary intervention measures fails, obtaining the target intervention measures from the intervention measure demotion strategy table; and using the target intervention measures to process the risk information, due to the introduction of the intervention measure demotion strategy table, when a certain intervention measure cannot be executed during the processing of the risk information, a new intervention measure can be determined, thereby finding a suitable intervention method in different scenarios, thereby at least partially overcoming the technical problem that risk control measures cannot be flexibly applied to different scenarios, thereby achieving the technical effect of effectively controlling the spread of high-risk information. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The above and other objects, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0018] Figure 1 Schematically illustrates an exemplary system architecture to which the information processing method according to an embodiment of the present disclosure can be applied;

[0019] Figure 2 The flowchart of the information processing method according to the embodiment of the present disclosure is schematically shown;

[0020] Figure 3 Schematically shows a flow chart for determining target intervention measures according to an embodiment of the present disclosure;

[0021] Figure 4 The overall flow chart for processing information to be processed according to an embodiment of the present disclosure is schematically shown;

[0022] Figure 5 A block diagram schematically illustrates an information processing apparatus according to an embodiment of the present disclosure; and

[0023] Figure 6 The block diagram schematically shows a computer system suitable for implementing the above-described method according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0024] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are merely exemplary and are not intended to limit the scope of the present disclosure. In the detailed description below, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of well-known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0025] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise," "include," etc. used herein indicate the presence of the features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0026] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification and should not be interpreted in an idealized or overly rigid manner.

[0027] When expressions such as “at least one of A, B, and C, etc.” are used, they should generally be interpreted in accordance with the meaning commonly understood by those skilled in the art (e.g., “a system having at least one of A, B, and C” should include but is not limited to systems having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, and C, etc.). When expressions such as “at least one of A, B, or C, etc.” are used, they should generally be interpreted in accordance with the meaning commonly understood by those skilled in the art (e.g., “a system having at least one of A, B, or C” should include but is not limited to systems having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, and C, etc.).

[0028] In the field of electronic payment fraud prevention, banks and other non-financial payment institutions generally adopt an in-process control management approach. This approach primarily involves introducing fraudulent transaction identification models and multiple in-process control measures to implement real-time intervention in high-risk transactions. For example, during a transfer or B2C (Business-to-Customer) payment, the fraudulent transaction identification model is used to calculate the current intervention measures for the specific transaction information and then implement in-process intervention. The process typically proceeds as follows: a user initiates a transaction request using the online banking system to pay for a purchase; the online banking system forwards the transaction to the operational risk monitoring module; the operational risk monitoring module receives the transaction, identifies fraud, and returns a processing signal; the online banking system receives the processing signal; if the processing signal indicates a release, the transaction continues and the user is notified of the successful transaction; if the processing signal indicates an intervention signal, in-process intervention is implemented, including redirecting the user to the corresponding information verification page, verifying the user's input, and releasing the transaction if verification passes; otherwise, the transaction is released and the user is provided with the transaction results, which are then returned to the operational risk monitoring module.

[0029] In the process of realizing the disclosed concept, the inventors discovered that the current verification methods are limited by the conditions of the terminal equipment and the customer's reserved information. When a transaction cannot execute a certain intervention measure, the transaction will be released, which reduces the monitoring effect and the monitoring method is not flexible enough.

[0030] Embodiments of the present disclosure provide an information processing method, an information processing device, a computer system, a computer-readable storage medium, and a computer program product. The method includes obtaining an intervention measure de-escalation strategy table, wherein the intervention measure de-escalation strategy table includes multiple intervention measures of different priorities; when the acquired information to be processed is risk information, determining a primary intervention measure configured for the risk information; when the primary intervention measure fails to be executed, obtaining a target intervention measure from the intervention measure de-escalation strategy table; and processing the risk information using the target intervention measure.

[0031] Figure 1 The following schematically illustrates an exemplary system architecture 100 to which the information processing method according to an embodiment of the present disclosure can be applied. Figure 1 The examples shown are merely examples of system architectures to which the embodiments of the present disclosure may be applied, to help those skilled in the art understand the technical content of the present disclosure, but do not mean that the embodiments of the present disclosure may not be used in other devices, systems, environments or scenarios.

[0032] like Figure 1As shown, the system architecture 100 according to this embodiment may include terminal devices 101, 102, 103, a network 104, and a server 105. The network 104 is used as a medium for providing communication links between the terminal devices 101, 102, 103 and the server 105. The network 104 may include various connection types, such as wired and / or wireless communication links, etc.

[0033] Users can use terminal devices 101, 102, and 103 to interact with server 105 via network 104 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 101, 102, and 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, and / or social platform software (for example only).

[0034] The terminal devices 101 , 102 , and 103 may be various electronic devices having a display screen and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, and desktop computers.

[0035] The server 105 may be a server that provides various services, such as a background management server (for example only) that supports websites browsed by users using the terminal devices 101, 102, and 103. The background management server may analyze and process received data such as user requests, and feed back processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal device.

[0036] It should be noted that the information processing method provided in the embodiments of the present disclosure can generally be executed by the server 105. Accordingly, the information processing apparatus provided in the embodiments of the present disclosure can generally be set in the server 105. The information processing method provided in the embodiments of the present disclosure can also be executed by a server or server cluster that is different from the server 105 and can communicate with the terminal devices 101, 102, 103 and / or the server 105. Accordingly, the information processing apparatus provided in the embodiments of the present disclosure can also be set in a server or server cluster that is different from the server 105 and can communicate with the terminal devices 101, 102, 103 and / or the server 105. Alternatively, the information processing method provided in the embodiments of the present disclosure can also be executed by the terminal devices 101, 102, or 103, or by other terminal devices different from the terminal devices 101, 102, or 103. Accordingly, the information processing apparatus provided in the embodiments of the present disclosure can also be set in the terminal devices 101, 102, or 103, or in other terminal devices different from the terminal devices 101, 102, or 103.

[0037] For example, the intervention measure degrading strategy table and / or the information to be processed may be originally stored in any one of the terminal devices 101, 102, or 103 (for example, the terminal device 101, but not limited thereto), or stored in an external storage device and imported into the terminal device 101. The terminal device 101 may then locally execute the information processing method provided by the embodiment of the present disclosure, or send the intervention measure degrading strategy table and / or the information to be processed to other terminal devices, servers, or server clusters, and the other terminal devices, servers, or server clusters that receive the intervention measure degrading strategy table and / or the information to be processed may execute the information processing method provided by the embodiment of the present disclosure.

[0038] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is merely illustrative. Any number of terminal devices, networks and servers may be provided as required.

[0039] It should be noted that the information processing method, information processing device, computer system, computer-readable storage medium and computer program product disclosed herein can be used in the fields of information security technology and financial technology, and can also be used in any field other than the fields of information security technology and financial technology. The application fields of the information processing method, information processing device, computer system, computer-readable storage medium and computer program product disclosed herein are not limited.

[0040] Figure 2 The flowchart of the information processing method according to the embodiment of the present disclosure is schematically shown.

[0041] like Figure 2 As shown, the method includes operations S201 to S204.

[0042] In operation S201 , an intervention measure degradation strategy table is obtained, wherein the intervention measure degradation strategy table includes multiple intervention measures of different priorities.

[0043] According to an embodiment of the present disclosure, the above-mentioned intervention measure downgrade strategy table can be constructed based on multiple intervention measures such as manual telephone verification, SMS verification code verification, uplink SMS verification, signature verification, problem verification, face recognition, fingerprint recognition, medium serial number, code scanning verification, card password verification, and Email verification. The above-mentioned priority can be determined, for example, according to the difficulty of implementing each intervention measure in the multiple intervention measures. For example, a higher priority can be set for dynamic intervention measures such as face verification, manual telephone verification, SMS verification, etc., and a lower priority can be set for static intervention measures such as card password verification, reserved problem verification, etc. The intervention measure downgrade strategy table thus obtained can be expressed as shown in Table 1 below:

[0044] Table 1

[0045] Interventions Priority Face verification 1 Manual telephone verification 2 SMS verification 3 …… …… Verification of reserved issues N-1 Card code verification N

[0046] It should be noted that the above-mentioned intervention measures are not limited to the methods listed above. Any other method that can achieve information security verification may constitute an intervention measure.

[0047] In operation S202 , when the acquired information to be processed is risk information, a primary intervention measure configured for the risk information is determined.

[0048] According to an embodiment of the present disclosure, the above-mentioned information to be processed may include, for example, transaction information such as personal online banking transfers, B2C, and payments. Each transaction information can be intelligently identified to determine whether it is risk information or normal information (i.e., risk-free information). For normal information, it can be released directly to complete the transmission of the information and the corresponding processing (such as completing the transaction). For risk information, for example, it needs to be further managed in combination with intervention measures (such as the above-mentioned primary intervention measures). The above-mentioned primary intervention measures can, for example, be one of the intervention measures in the above-mentioned intervention measure downgrade strategy table, or it can also be other intervention measures outside the above-mentioned intervention measure downgrade strategy table.

[0049] In operation S203 , when the primary intervention measure fails to be executed, a target intervention measure is obtained from the intervention measure de-escalation strategy table.

[0050] According to an embodiment of the present disclosure, if the primary intervention measure is one of the intervention measures in the intervention measure demotion strategy table, the target intervention measure may be, for example, another intervention measure in the intervention measure demotion strategy table that has a lower priority than the primary intervention measure. If the primary intervention measure is another intervention measure outside the intervention measure demotion strategy table, the target intervention measure may be, for example, an intervention measure obtained from the intervention measure demotion strategy table.

[0051] In operation S204 , the risk information is processed using target intervention measures.

[0052] According to an embodiment of the present disclosure, in the case that the initial intervention measure cannot be successfully executed, the risk information may be further managed according to the target intervention measure obtained from the intervention measure demotion strategy table, for example.

[0053] According to an embodiment of the present disclosure, the process and results of processing risk information using target intervention measures can be monitored and stored in the form of intervention details, so that when the details of the risk information need to be understood, they can be obtained by querying the intervention details.

[0054] Through the above-mentioned embodiments of the present disclosure, since a new intervention measure downgrade strategy table is added, intervention measures are sorted by priority and a step-by-step downgrade method is adopted, thereby improving the flexibility of intervention measures during risk control and solving the problem of insufficient flexibility of monitoring means.

[0055] The following is combined with specific embodiments and reference Figures 3 and 4 ,right Figure 2 The method shown is further explained.

[0056] According to an embodiment of the present disclosure, the above-mentioned intervention measure demotion strategy table, for example, also includes first attribute information for characterizing whether each intervention measure is degradable. The above-mentioned operation S203, for example, may include: when it is judged that the primary intervention measure is degradable according to the first attribute information of the intervention measure demotion strategy table, obtaining an intermediate intervention measure that is one level lower than the primary intervention measure from the intervention measure demotion strategy table; judging whether the intermediate intervention measure can be successfully executed; when the intermediate intervention measure can be successfully executed, using the intermediate intervention measure as the target intervention measure; and when the intermediate intervention measure cannot be successfully executed and it is judged that the intermediate intervention measure is degradable, obtaining the next-level intervention measure, until a target intervention measure that can be successfully executed is obtained or all the degradable intervention measures in the intervention measure demotion strategy table are traversed.

[0057] According to an embodiment of the present disclosure, the above operation S203 may further include, for example: if it is determined according to the first attribute information of the intervention measure downgrade strategy table that the primary intervention measure cannot be downgraded, intercepting the risk information.

[0058] According to an embodiment of the present disclosure, the intervention measure downgrade strategy table containing the above-mentioned first attribute information can be expressed as shown in the following Table 2, wherein whether it can be downgraded is, for example, the above-mentioned first attribute information, "√" indicates that the corresponding intervention measure can be downgraded (such as face recognition verification, manual telephone verification, SMS verification, reserved question verification, etc.), and no mark indicates that the corresponding intervention measure cannot be downgraded (such as card password verification).

[0059] Table 2

[0060] Interventions Priority Can downgrade? Face verification 1 √ Manual telephone verification 2 √ SMS verification 3 √ …… …… …… Verification of reserved issues N-1 √ Card password verification N

[0061] It should be noted that, when the above-mentioned primary intervention measures are other intervention measures outside the above-mentioned intervention measure de-escalation strategy table, that is, for example, when the primary intervention measures do not belong to the intervention measures listed in Table 2, the above-mentioned intermediate intervention measures can be determined from the intervention measures listed in Table 2 in order of priority, or can also be randomly determined from multiple intervention measures listed in Table 2.

[0062] Figure 3 The flowchart of determining target intervention measures according to an embodiment of the present disclosure is schematically shown.

[0063] like Figure 3 As shown, the process includes operations S301 to S305.

[0064] In operation S301 , it is determined whether the intervention can be successfully performed.

[0065] According to an embodiment of the present disclosure, when a primary intervention measure configured for risk information is obtained, it is first determined whether the primary intervention measure can be successfully executed. If the determination result is that the primary intervention measure can be successfully executed, operation S302 is executed; if the determination result is that the primary intervention measure cannot be successfully executed, operation S303 is executed.

[0066] In operation S302 , target intervention measures are determined and executed.

[0067] According to an embodiment of the present disclosure, when it is determined that a certain intervention measure (which may include the above-mentioned primary intervention measures and intermediate intervention measures) can be successfully executed, the intervention measure can be determined as a target intervention measure for intervening in the risk information. By executing the target intervention measure, the management of the risk information can be completed.

[0068] In operation S303, it is determined whether the intervention measure is degradable.

[0069] According to an embodiment of the present disclosure, for intervention measures that cannot be successfully executed, such as the primary intervention measures described above, it is further determined whether the primary intervention measures can be downgraded. This determination process can be performed, for example, based on the intervention measure downgrade strategy table (such as Table 2 above). If the determination result is that the intervention measures can be downgraded, operation S304 is executed; if the determination result is that the intervention measures cannot be downgraded, operation S305 is executed.

[0070] In operation S304 , intermediate intervention measures are determined.

[0071] According to an embodiment of the present disclosure, when it is determined that a certain intervention measure (such as the above-mentioned primary intervention measure) is downgradable, the above-mentioned intermediate intervention measure can be determined from the priority order in the intervention measure downgrading strategy table, for example, when the primary intervention measure is face recognition verification, the intermediate intervention measure can be determined as manual telephone verification.

[0072] In operation S305, interception is performed.

[0073] According to an embodiment of the present disclosure, when it is determined that a certain intervention measure (which may include the above-mentioned primary intervention measures and intermediate intervention measures) cannot be successfully executed or downgraded, the corresponding risk information can be intercepted to block the spread of the risk information.

[0074] It should be noted that for the intermediate intervention measure determined in operation S304, the corresponding processes of operations S301 to S305 still need to be executed. If the intermediate intervention measure is manual telephone verification and cannot be successfully executed, the next-level intervention measure can be determined to be SMS verification. If no successful intervention measure is found after traversing all downgradable intervention measures in the intervention measure downgrade strategy table, such as if the final target intervention measure is card password verification but card password verification cannot be successfully executed, the risky transaction can be intercepted.

[0075] Through the above-mentioned embodiments of the present disclosure, the processing method for risk information can be finally determined, including intervention and interception, which effectively avoids the technical problem in the existing technology that the intervention measures introduced to avoid risk information are directly released when they cannot be successfully executed, resulting in the uncontrollable spread of risk information.

[0076] According to an embodiment of the present disclosure, the above-mentioned operation S202 may, for example, include: using a risk control model to determine a target risk value obtained by scoring risk information; obtaining a data dictionary, wherein the data dictionary stores a mapping relationship between different risk values ​​and different intervention measures; determining relevant intervention measures corresponding to the target risk value based on the data dictionary; and using the relevant intervention measures as primary intervention measures.

[0077] According to an embodiment of the present disclosure, the risk control model can, for example, score risk information and configure appropriate intervention measures for the risk information based on the scoring results. The data dictionary can, for example, be expressed in the form shown in Table 3 below:

[0078] Table 3

[0079] Value at Risk Interventions 10～20 Email verification …… …… 80～90 Face Recognition 90～100 Card password verification

[0080] According to an embodiment of the present disclosure, for example, if the score of a certain risk information is 83 (i.e., the target risk value is 83) using the above risk control model, it can be determined according to the above Table 3 that the primary intervention measure that needs to be configured for the risk information is face recognition.

[0081] It should be noted that there may be multiple intervention measures corresponding to the same risk value range. For example, when the risk value is 90-100, the intervention measures may be facial recognition and card password verification. In this case, the risk information may be released only after both facial recognition and card password verification are passed.

[0082] Through the above-mentioned embodiments of the present disclosure, appropriate intervention measures can be configured for risk information with different risk levels, and targeted intervention can be carried out to maximize the security of information transmission.

[0083] According to an embodiment of the present disclosure, the method for determining the above-mentioned risk information may, for example, include: inputting the information to be processed into a risk control model, wherein the information to be processed includes at least one second attribute information, the risk control model is pre-set with a risk characteristic variable, and the risk characteristic variable is used to characterize that a certain variable belongs to a risk variable; and when the risk control model recognizes that at least one second attribute information matches the risk characteristic variable, determining that the information to be processed is risk information.

[0084] According to an embodiment of the present disclosure, the above-mentioned risk control model can, for example, also perform risk identification on the information to be processed, and the identification results can include, for example, risk (including risk value information) and no risk. In the case where the information to be processed is B2C or transfer information, the above-mentioned second attribute information can, for example, be expressed as a customer payment card number, mobile phone number, ID number, order amount, merchant code or account number, etc., and the above-mentioned risk characteristic variables can, for example, be expressed as a blacklist (such as information including mobile phone numbers, high-risk areas, etc.), credit reporting system information, etc. The method of determining risk information can, for example, be expressed as follows: when the mobile phone number contained in the information to be processed is in the blacklist, or when the account number contained in the information to be processed is set as a blacklist in the credit reporting system, the information to be processed can be determined to be risk information.

[0085] According to an embodiment of the present disclosure, in order to reasonably score risk information, for example, different scoring weights can be set for different second attribute information. When it is determined that certain second attribute information is a risk attribute, the risk value of the information to be processed with these risk attributes can be calculated based on the weights set for it.

[0086] According to an embodiment of the present disclosure, the method for determining the above-mentioned risk information may also include, for example: obtaining the second attribute information of the information to be processed; and determining that the information to be processed is risk information when the number of times the second attribute information appears within a preset time period is greater than a preset threshold.

[0087] According to embodiments of the present disclosure, if the pending information cannot be determined to be risky based on a blacklist or credit reporting system, for example, if the second attribute information associated with the pending information is not on the blacklist, the riskiness of the pending information can be determined based on, for example, the number of occurrences of a certain attribute information in the pending information. For example, if the risk control model detects that a payment card number in a pending information item has been used for more than 10 transactions in a single day, the pending information can be determined to be risky.

[0088] Through the above-mentioned embodiments of the present disclosure, various possible risk information can be effectively monitored and the spread of risk information can be effectively reduced.

[0089] According to an embodiment of the present disclosure, a method for determining whether the above-mentioned intervention measures can be successfully executed may, for example, include: obtaining the software and hardware conditions required for executing the intervention measures; if the device used to execute the intervention measures has the software and hardware conditions, determining that the intervention measures can be successfully executed; if the device used to execute the intervention measures does not have the software and hardware conditions, determining that the intervention measures ultimately failed to execute.

[0090] According to the embodiments of the present disclosure, the process of determining whether the intervention measures can be successfully executed can be implemented, for example, by a preset intelligent algorithm. The intelligent algorithm can be constructed based on the customer information collected in the transaction scenario, and can ultimately act on each frame of intervention measures. For example, for face-scanning intervention measures, it can be determined based on the customer's submission method whether it is a mobile client and whether the face-scanning conditions (i.e., the above-mentioned hardware and software conditions) are met. If not, it can be determined that the intervention measures cannot be successfully executed; for media intervention measures, it can be queried based on the customer's payment card number whether the customer has applied for a U-shield (i.e., the above-mentioned hardware and software conditions). If not, it can be determined that the intervention measures cannot be successfully executed; and so on.

[0091] Figure 4 The overall flow chart for processing information to be processed according to an embodiment of the present disclosure is schematically shown.

[0092] like Figure 4 As shown, after the user initiates a B2C or transfer transaction (pending information), the transaction is forwarded to the operational risk monitoring module through the account movement transaction. The model, for example, pre-sets the above-mentioned risk control model, which can make a risk judgment on the transaction. When it is judged to be a risk-free transaction, it can be directly released and completed; when the pad is a risky transaction (i.e., the above-mentioned risky transaction), the intervention measures configured for the transaction can be further determined. After determining the intervention measures, for example, it is possible to judge whether the intervention measures can be successfully executed and / or whether they can be downgraded. And finally, if it can be successfully executed, the corresponding intervention measures are executed and the transaction is completed; if it cannot be successfully executed but can be downgraded, new intervention measures are determined; and if it cannot be successfully executed and cannot be downgraded, the transaction is intercepted.

[0093] Through the above-mentioned embodiments of the present disclosure, the level of financial transaction risk monitoring can be greatly improved, the security of customer funds can be protected, the risk of fraud of customer funds and transaction funds and customer complaints can be reduced, and customer satisfaction with financial services can be improved.

[0094] Figure 5 A block diagram schematically shows an information processing device according to an embodiment of the present disclosure.

[0095] like Figure 5As shown, the information processing device 500 includes a first acquisition module 510 , a first determination module 520 , a second acquisition module 530 and a processing module 540 .

[0096] The first acquisition module 510 is configured to acquire an intervention measure degradation strategy table, wherein the intervention measure degradation strategy table includes multiple intervention measures of different priorities.

[0097] The first determining module 520 is configured to determine a primary intervention measure configured for the risk information when the acquired information to be processed is risk information.

[0098] The second acquisition module 530 is configured to acquire a target intervention measure from the intervention measure de-escalation strategy table when the primary intervention measure fails to be executed.

[0099] The processing module 540 is used to process the risk information using target intervention measures.

[0100] According to the above-mentioned embodiment of the present disclosure, due to the addition of an intervention measure downgrade strategy table, intervention measures are sorted by priority and a step-by-step downgrade method is adopted to improve the flexibility of intervention measures during risk control and solve the problem of insufficient flexibility of monitoring means.

[0101] According to an embodiment of the present disclosure, the intervention measure downgrade strategy table includes first attribute information for characterizing whether each intervention measure is downgradeable, and the second acquisition module includes a first acquisition unit, a judgment unit, a first definition unit, and a second acquisition unit.

[0102] The first obtaining unit is configured to obtain an intermediate intervention measure one level lower than the primary intervention measure from the intervention measure demotion strategy table when it is determined that the primary intervention measure is degradable according to the first attribute information of the intervention measure demotion strategy table.

[0103] The judgment unit is used to judge whether the intermediate intervention measures can be successfully implemented.

[0104] The first definition unit is used to target intermediate-level interventions if they can be successfully implemented.

[0105] The second acquisition unit is used to acquire the next-level intervention measure when the intermediate intervention measure cannot be successfully executed and it is determined that the intermediate intervention measure can be downgraded, until a target intervention measure that can be successfully executed is acquired or the downgradeable intervention measures in the intervention measure downgrade strategy table are traversed.

[0106] According to an embodiment of the present disclosure, the above-mentioned information processing device further includes an interception unit.

[0107] The interception unit is used to intercept the risk information when it is determined that the primary intervention measure cannot be downgraded according to the first attribute information of the intervention measure downgrade strategy table.

[0108] According to an embodiment of the present disclosure, the first determining module includes a first determining unit, a third acquiring unit, a second determining unit and a second defining unit.

[0109] The first determining unit is configured to determine a target risk value obtained by scoring the risk information using a risk control model.

[0110] The third acquisition unit is configured to acquire a data dictionary, wherein the data dictionary stores mapping relationships between different risk values ​​and different intervention measures.

[0111] The second determining unit is used to determine relevant intervention measures corresponding to the target risk value according to the data dictionary.

[0112] The second definition unit is used to identify the relevant interventions as primary interventions.

[0113] According to an embodiment of the present disclosure, the above-mentioned information processing device further includes an input module and a second determination module.

[0114] The input module is used to input the information to be processed into the risk control model, wherein the information to be processed includes at least one second attribute information. The risk control model is preset with a risk characteristic variable, and the risk characteristic variable is used to characterize that a certain variable is a risk variable.

[0115] The second determination module is configured to determine that the information to be processed is risk information when the risk control model identifies that at least one second attribute information matches the risk characteristic variable.

[0116] According to an embodiment of the present disclosure, the above-mentioned information processing device further includes a third acquisition module and a third determination module.

[0117] The third acquisition module is used to acquire second attribute information of the information to be processed.

[0118] The third determination module is configured to determine that the information to be processed is risk information when the number of times the second attribute information appears within a preset time period is greater than a preset threshold.

[0119] According to an embodiment of the present disclosure, the above-mentioned information processing device further includes a fourth acquisition module, a fourth determination module and a fifth determination module.

[0120] The fourth acquisition module is used to obtain the software and hardware conditions required to implement intervention measures.

[0121] The fourth determining module is used to determine whether the intervention measure can be successfully executed if the device for executing the intervention measure has the software and hardware conditions.

[0122] The fifth determining module is configured to determine that the intervention measure has ultimately failed to be executed if the device for executing the intervention measure does not have the hardware or software conditions.

[0123] According to the modules and units of the embodiments of the present invention, any multiple or at least part of the functions of any multiple thereof can be implemented in one module. According to the modules and units of the embodiments of the present invention, any one or more can be split into multiple modules for implementation. According to the modules and units of the embodiments of the present invention, any one or more can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application specific integrated circuit (ASIC), or can be implemented by hardware or firmware of any other reasonable way of integrating or packaging the circuit, or implemented in any one of the three implementation methods of software, hardware and firmware or in an appropriate combination of any several thereof. Alternatively, according to the modules and units of the embodiments of the present invention, one or more can be at least partially implemented as a computer program module, which can perform the corresponding function when the computer program module is run.

[0124] For example, any multiple of the first acquisition module 510, the first determination module 520, the second acquisition module 530, and the processing module 540 can be combined into one module / unit for implementation, or any one of the modules / units can be split into multiple modules / units. Alternatively, at least part of the functions of one or more of these modules / units can be combined with at least part of the functions of other modules / units and implemented in one module / unit. According to an embodiment of the present disclosure, at least one of the first acquisition module 510, the first determination module 520, the second acquisition module 530, and the processing module 540 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or implemented in any one of the three implementation methods of software, hardware, and firmware, or in an appropriate combination of any of them. Alternatively, at least one of the first acquisition module 510 , the first determination module 520 , the second acquisition module 530 and the processing module 540 may be at least partially implemented as a computer program module, which may perform corresponding functions when executed.

[0125] It should be noted that the information processing device part in the embodiment of the present disclosure corresponds to the information processing method part in the embodiment of the present disclosure. The description of the information processing device part specifically refers to the information processing method part and will not be repeated here.

[0126] Figure 6 The block diagram schematically shows a computer system suitable for implementing the above-described method according to an embodiment of the present disclosure. Figure 6 The computer system shown is only an example and should not limit the functions and scope of use of the embodiments of the present disclosure.

[0127] like Figure 6 As shown, the computer system 600 according to an embodiment of the present disclosure includes a processor 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage part 608 into a random access memory (RAM) 603. The processor 601 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or a related chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 601 may also include an onboard memory for caching purposes. The processor 601 may include a single processing unit or multiple processing units for executing different actions of the method flow according to an embodiment of the present disclosure.

[0128] Various programs and data required for the operation of the system 600 are stored in the RAM 603. The processor 601, ROM 602, and RAM 603 are connected to each other via a bus 604. The processor 601 executes the programs in the ROM 602 and / or RAM 603 to perform various operations of the method flow according to the embodiment of the present disclosure. It should be noted that the programs may also be stored in one or more memories other than the ROM 602 and RAM 603. The processor 601 may also execute the programs stored in the one or more memories to perform various operations of the method flow according to the embodiment of the present disclosure.

[0129] According to an embodiment of the present disclosure, system 600 may further include an input / output (I / O) interface 605, which is also connected to bus 604. System 600 may also include one or more of the following components connected to I / O interface 605: an input section 606 including a keyboard, a mouse, etc.; an output section 607 including devices such as a cathode ray tube (CRT), a liquid crystal display (LCD), and speakers; a storage section 608 including a hard disk; and a communication section 609 including a network interface card such as a LAN card or a modem. Communication section 609 performs communication processing via a network such as the Internet. Drive 610 is also connected to I / O interface 605 as needed. Removable media 611, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed in drive 610 as needed, so that computer programs read from the removable media can be installed into storage section 608 as needed.

[0130] According to an embodiment of the present disclosure, the method flow according to an embodiment of the present disclosure can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a computer-readable storage medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 609, and / or installed from the removable medium 611. When the computer program is executed by the processor 601, the above-mentioned functions defined in the system of the embodiment of the present disclosure are executed. According to an embodiment of the present disclosure, the system, equipment, device, module, unit, etc. described above can be implemented by a computer program module.

[0131] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments, or may exist independently and not be incorporated into the device / apparatus / system. The computer-readable storage medium carries one or more programs, and when executed, implements the method according to the embodiments of the present disclosure.

[0132] According to an embodiment of the present disclosure, a computer-readable storage medium may be a non-volatile computer-readable storage medium. For example, it may include, but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0133] For example, according to an embodiment of the present disclosure, the computer-readable storage medium may include the ROM 602 and / or the RAM 603 described above and / or one or more memories other than the ROM 602 and the RAM 603 .

[0134] An embodiment of the present disclosure also includes a computer program product, which includes a computer program, and the computer program contains program code for executing the method provided by the embodiment of the present disclosure. When the computer program product runs on an electronic device, the program code is used to enable the electronic device to implement the information processing method provided by the embodiment of the present disclosure.

[0135] When the computer program is executed by the processor 601, the above functions defined in the system / device of the embodiment of the present disclosure are performed. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0136] In one embodiment, the computer program may be stored on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may be transmitted and distributed in the form of a signal on a network medium, downloaded and installed via the communication portion 609, and / or installed from a removable medium 611. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to wireless, wired, or any suitable combination thereof.

[0137] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computer programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, python, "C" or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect via the Internet).

[0138] The flowcharts and block diagrams in the accompanying drawings illustrate the possible architectures, functions, and operations of the systems, methods, and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flowchart or block diagram may represent a module, program segment, or portion of code, which contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the boxes may occur in an order different from that marked in the accompanying drawings. For example, two boxes shown in succession may actually be executed substantially in parallel, or they may sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flowchart, as well as the combination of boxes in the block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or may be implemented using a combination of dedicated hardware and computer instructions. It will be understood by those skilled in the art that the features described in the various embodiments and / or claims of the present disclosure may be combined and / or coupled in various ways, even if such combinations or couplings are not explicitly described in the present disclosure. In particular, without departing from the spirit and teachings of the present disclosure, the features described in the various embodiments and / or claims of the present disclosure may be combined and / or coupled in various ways, and all such combinations and / or couplings fall within the scope of the present disclosure.

[0139] The embodiments of the present disclosure are described above. However, these embodiments are for illustrative purposes only and are not intended to limit the scope of the present disclosure. Although each embodiment has been described separately above, this does not mean that the measures in each embodiment cannot be used in combination to advantage. The scope of the present disclosure is defined by the appended claims and their equivalents. Without departing from the scope of the present disclosure, those skilled in the art may make various substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. An information processing method, applied to a server, comprising: In response to receiving information to be processed, inputting the information to be processed into a risk control model, wherein the information to be processed includes at least one second attribute information, the risk control model is pre-set with a risk characteristic variable, and the risk characteristic variable is used to indicate that a certain variable is a risk variable; and When the risk control model identifies that at least one of the second attribute information matches the risk characteristic variable, determining that the information to be processed is risk information; Obtaining an intervention measure demotion strategy table, wherein the intervention measure demotion strategy table includes a plurality of intervention measures of different priorities and first attribute information used to characterize whether each intervention measure is degradable; In the case where the acquired information to be processed is risk information, determining primary intervention measures configured for the risk information; In the event that the primary intervention fails to be implemented, obtaining a target intervention from the intervention de-escalation strategy table; Processing the risk information using the target intervention measures; Obtain the hardware and software necessary to implement the interventions; If the device for performing the intervention measure has the software and hardware conditions, determining that the intervention measure can be successfully performed; If the device used to execute the intervention measure does not have the software and hardware conditions, determining that the intervention measure has ultimately failed to execute; In a case where it is determined according to the first attribute information of the intervention measure downgrade strategy table that the primary intervention measure cannot be downgraded, the risk information is intercepted.

2. The method according to claim 1, wherein The intervention measure demotion strategy table includes first attribute information for characterizing whether each intervention measure is degradable. When the primary intervention measure fails to be executed, obtaining the target intervention measure from the intervention measure demotion strategy table includes: When it is determined according to the first attribute information of the intervention measure demotion strategy table that the primary intervention measure can be degraded, obtaining an intermediate intervention measure one level lower than the primary intervention measure from the intervention measure demotion strategy table; Determine whether the intermediate interventions can be successfully implemented; If the intermediate intervention can be successfully implemented, using the intermediate intervention as the target intervention; and If the intermediate intervention measure cannot be successfully executed and it is determined that the intermediate intervention measure can be downgraded, the next level intervention measure is obtained until a target intervention measure that can be successfully executed is obtained or the downgradeable intervention measures in the intervention measure downgrade strategy table are traversed.

3. The method according to claim 1, wherein When the information to be processed is risk information, the primary intervention measures configured for the risk information include: Determining a target risk value obtained by scoring the risk information using a risk control model; Obtaining a data dictionary, wherein the data dictionary stores mapping relationships between different risk values ​​and different intervention measures; Determining relevant intervention measures corresponding to the target risk value according to the data dictionary; and The relevant interventions were considered as the primary interventions.

4. The method according to claim 1, further comprising: Acquiring second attribute information of the information to be processed; as well as When the number of times the second attribute information appears within a preset time period is greater than a preset threshold, the information to be processed is determined to be risk information.

5. An information processing device, applied to a server, comprising: an input module, in response to receiving information to be processed, inputting the information to be processed into a risk control model, wherein the information to be processed includes at least one second attribute information, the risk control model is preset with a risk characteristic variable, and the risk characteristic variable is used to indicate that a certain variable is a risk variable; and a second determining module, configured to determine that the information to be processed is risk information if the risk control model identifies that at least one of the second attribute information matches the risk characteristic variable; A first acquisition module is configured to acquire an intervention measure degradation strategy table, wherein the intervention measure degradation strategy table includes a plurality of intervention measures of different priorities and first attribute information used to characterize whether each intervention measure is degradable; A first determination module is configured to determine, when the acquired information to be processed is risk information, a primary intervention measure configured for the risk information; A second acquisition module is configured to acquire a target intervention measure from the intervention measure de-escalation strategy table if the primary intervention measure fails to be executed; a processing module, configured to process the risk information using the target intervention measure; A fourth acquisition module is used to obtain the software and hardware conditions required to implement the intervention measures; A fourth determining module is configured to determine that the intervention measure can be successfully executed if the device for executing the intervention measure has the software and hardware conditions; a fifth determining module configured to determine that the intervention measure has ultimately failed to be executed if the device used to execute the intervention measure does not have the software and hardware conditions; The interception unit is configured to intercept the risk information when it is determined that the primary intervention measure cannot be downgraded according to the first attribute information of the intervention measure downgrade strategy table.

6. A computer system comprising: one or more processors; a memory for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors are enabled to implement the method according to any one of claims 1 to 4.

7. A computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, causes the processor to implement the method according to any one of claims 1 to 4.

8. A computer program product comprising computer executable instructions, wherein the instructions are used to implement the method according to any one of claims 1 to 4 when executed.

Images