Risk warning method, device, equipment and storage medium

Abstract

The present invention relates to the fields of artificial intelligence and infrastructure operation and maintenance, and discloses a risk warning method, device, equipment, and storage medium for solving the technical problem that the existing technology cannot identify risks based on operation records, thereby issuing warnings for risky operations. The method includes: extracting the business system project to be prompted, the acquisition interface address, and the acquisition range; intercepting the received startup request of the business system project to be prompted, and pulling the probe code in the registration metadata; loading the system bytecode according to the acquisition interface address, and identifying the category field that meets the preset configuration rules; generating the probe bytecode based on the probe code and inserting it into the category field content, constructing the acquisition probe and starting the business system; collecting the operation data of the business system to obtain the operation record; and judging its operation type, and issuing a risk warning signal according to the calculated risk identification result. In addition, the present invention also relates to blockchain technology, and the relevant information of the risk warning can be stored in the blockchain.

Description

Technical Field

[0001] The present invention relates to the fields of artificial intelligence and infrastructure operation and maintenance, and in particular to a risk warning method, apparatus, device and storage medium. Background Art

[0002] With the rapid development of technology, more and more web pages and applications are providing countless conveniences to people's lives. Large enterprises often operate multiple applications simultaneously and typically monitor these applications through log collection, collecting log data to understand the working data of the application software.

[0003] In existing technologies, the monitoring of application risks mostly stops at data collection and retrospective accident tracing, usually after the loss occurs. It is impossible to identify risks based on operation records, and thus issue risk warnings for risky operations, resulting in poor risk warning effects. Summary of the Invention

[0004] The main purpose of the present invention is to solve the technical problem that the existing technology cannot identify risks based on operation records and thus issue risk warnings for risky operations.

[0005] The first aspect of the present invention provides a risk warning method, comprising: extracting the business system project to be prompted, the acquisition interface address and the acquisition scope of each business system project to be prompted based on a received risk warning request; when a startup request of a business system is received, determining whether the business system belongs to the business system project to be prompted; if so, intercepting the startup request of the business system, pulling pre-stored registration metadata from a preset project risk warning database, and extracting the probe code set in the registration metadata; loading the system bytecode of the business system according to the acquisition interface address, and identifying the category field that meets the preset configuration rules; generating a probe bytecode based on the probe code, inserting the probe bytecode into the category field, constructing a collection probe, and starting the business system; using the collection probe to collect the operation data generated by the business system to obtain the operation record of the business system; calling a preset operation classification model to determine the operation type to which the operation record belongs, calculating the risk identification result based on the operation type, and issuing a risk warning signal according to the risk identification result.

[0006] Optionally, in a first implementation method of the first aspect of the present invention, calling a preset operation classification model to determine the operation type to which the operation record belongs, calculating a risk identification result based on the operation type, and issuing a risk warning signal based on the risk identification result includes: calling a preset operation classification model to determine whether the business operation performed in the operation record is a known business operation; if so, issuing a first warning signal based on the risk identification result; if not, calling a preset business risk prediction model to perform risk prediction on the operation record, and issuing a second warning signal based on the risk prediction result.

[0007] Optionally, in a second implementation method of the first aspect of the present invention, the operation record includes file data uploaded to the system, and calling a preset business risk prediction model to perform risk prediction on the operation record, and issuing a second prompt signal based on the risk prediction result includes: classifying the file data according to the format of the file data to obtain the file data type; performing content identification on the content in the file data according to different file data types to obtain a file content identification result; inputting the file content identification result into a preset business risk prediction model for risk prediction to obtain a risk prediction index; marking the operation record whose risk prediction index exceeds a preset risk prediction threshold as a risk operation, and issuing a second prompt signal.

[0008] Optionally, in a third implementation of the first aspect of the present invention, the risk warning method further includes: extracting operation records identified as risky and operation record information of the risky operation records; displaying the operation record information in a risk behavior screen, and sorting all operation record information displayed in the risk behavior screen according to the risk rating of the operation records.

[0009] Optionally, in a fourth implementation of the first aspect of the present invention, before extracting the business system items to be prompted, the collection interface address and the collection scope of each business system item to be prompted based on the received risk warning request, it also includes: obtaining historical operation records marked as having risks, clustering analysis on the historical operation records based on the marked risk types, and obtaining multiple classified historical operation record sets; extracting risk data features related to the risk types from the multiple historical operation record sets, and labeling the classified historical operation record sets according to the risk data features to obtain a risk identification data set; training a classification tool pre-set with a k-means clustering algorithm based on the risk identification data set to obtain a risk identification model.

[0010] Optionally, in a fifth implementation of the first aspect of the present invention, the risk warning method further includes: extracting the operation records and the risk identification results to obtain an operation record data set; performing data cleaning and format conversion on the operation record data set to obtain a cleaned operation record data set; generating log data based on the cleaned operation record data set, and storing the cleaned log data in a database; regularly obtaining the saved cleaned log data set from the database, and backing up the saved cleaned log data set to an offline big data platform.

[0011] Optionally, in a sixth implementation method of the first aspect of the present invention, before extracting the business system projects to be prompted, the collection interface addresses and the collection scope of each business system project to be prompted based on the received risk warning request, it also includes: obtaining interface correspondence information between each business system project and the interface address in the project risk warning database; selecting the business system project to be prompted, and obtaining the collection interface address corresponding to the business system to be prompted according to the interface correspondence information; generating a collection configuration table based on the collection interface address and the collection scope of each business system project to be prompted; and generating a risk warning request based on the collection configuration table.

[0012] The second aspect of the present invention provides a risk warning device, comprising: an extraction module, which is used to extract the business system projects to be prompted, the collection interface address and the collection scope of each business system project to be prompted based on the received risk warning request; a judgment module, which is used to judge whether the business system belongs to the business system project to be prompted when receiving a startup request of the business system; a pulling module, which is used to intercept the startup request of the business system, pull the pre-stored registration metadata from the preset project risk warning database, and extract the probe code set in the registration metadata; an identification module, which is used to load the system bytecode of the business system according to the collection interface address, and identify the category field that meets the preset configuration rules; a construction module, which is used to generate a probe bytecode based on the probe code, insert the probe bytecode into the category field, construct a collection probe, and start the business system; a collection module, which is used to use the collection probe to collect the operation data generated by the business system to obtain the operation record of the business system; a prompt module, which is used to call a preset operation classification model to determine the operation type to which the operation record belongs, calculate the risk identification result based on the operation type, and issue a risk warning signal according to the risk identification result.

[0013] Optionally, in a first implementation method of the second aspect of the present invention, the prompt module includes: a judgment unit, used to call a preset operation classification model to determine whether the business operation performed in the operation record is a known business operation; a first prompt unit, used to call a risk identification model to identify negative risks of the operation record, obtain a risk identification result, and issue a first prompt signal based on the risk identification result; a second prompt unit, used to call a preset business risk prediction model to perform risk prediction on the operation record, and issue a second prompt signal based on the risk prediction result.

[0014] Optionally, in a second implementation method of the second aspect of the present invention, the operation record includes file data uploaded to the system, and the second prompt unit also includes: a file classification subunit, used to classify the file data according to the format of the file data to obtain the file data type; a content identification subunit, used to perform content identification on the content in the file data according to different file data types to obtain a file content identification result; a prediction subunit, used to input the file content identification result into a preset business risk prediction model for risk prediction to obtain a risk prediction index; a prompt subunit, used to mark the operation record whose risk prediction index exceeds a preset risk prediction threshold as a risk operation, and issue a second prompt signal.

[0015] Optionally, in a third implementation of the second aspect of the present invention, the risk warning device also includes a risk display module, which includes: an operation record extraction unit, used to extract operation records identified as risky and operation record information of the risky operation records; an operation record display unit, used to display the operation record information in the risk behavior screen, and sort all operation record information displayed in the risk behavior screen according to the risk rating of the operation record.

[0016] Optionally, in a fourth implementation of the second aspect of the present invention, the risk warning device also includes a judgment model construction module, and the judgment model construction module includes: an operation record set generation unit, used to extract risk data features related to the risk type from the multiple historical operation record sets, and label the classified historical operation record sets according to the risk data features to obtain a risk identification data set; a training unit, used to train a classification tool pre-set with a k-means clustering algorithm based on the risk identification data set to obtain a risk identification model.

[0017] Optionally, in a fifth implementation of the second aspect of the present invention, the risk warning device further includes a log backup module, and the log backup module includes: a data set extraction unit, used to extract the operation records and the risk identification results to obtain an operation record data set; a data set cleaning unit, used to perform data cleaning and format conversion on the operation record data set to obtain a cleaned operation record data set; a log data generation unit, used to generate log data based on the cleaned operation record data set, and store the cleaned log data in a database; a backup unit, used to periodically obtain the saved cleaned log data set from the database, and back up the saved cleaned log data set to an offline big data platform.

[0018] Optionally, in a sixth implementation manner of the second aspect of the present invention, the risk warning device also includes a warning request generation module, and the warning request generation module includes: an interface information acquisition unit, used to obtain interface correspondence information between each business system project and the interface address in the project risk warning database; an interface address selection unit, used to select the business system project to be prompted, and obtain the collection interface address corresponding to the business system to be prompted according to the interface correspondence information; a table generation unit, used to generate a collection configuration table based on the collection interface address and the collection scope of each business system project to be prompted; and a request generation unit, used to generate a risk warning request based on the collection configuration table.

[0019] The third aspect of the present invention provides a risk warning device, comprising: a memory and at least one processor, wherein the memory stores instructions; the at least one processor calls the instructions in the memory so that the risk warning device executes the steps of the above-mentioned risk warning method.

[0020] A fourth aspect of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores instructions that, when executed on a computer, enable the computer to execute the steps of the above-mentioned risk warning method.

[0021] In the technical solution provided by the present invention, the business system project to be prompted, the acquisition interface address and the acquisition scope of each business system project to be prompted contained in the received risk warning request are extracted; when a business system startup request is received, it is determined whether the business system belongs to the business system project to be prompted; if so, the business system startup request is intercepted, the pre-stored registration metadata is pulled from the preset project risk warning database, and the probe code set in the registration metadata is extracted; the system bytecode of the business system is loaded according to the acquisition interface address, and the category field that meets the preset configuration rules is identified; based on the probe code, a probe bytecode is generated, the probe bytecode is inserted into the category field, a collection probe is constructed, and the business system is started; the operation data generated by the business system is collected using the collection probe to obtain the operation record of the business system; the preset operation classification model is called to determine the operation type to which the operation record belongs, the risk identification result is calculated based on the operation type, and a risk warning signal is issued according to the risk identification result. The technical solution in the embodiment of the present invention can identify risks for operation records and issue risk warnings for operation records that may be risky operations. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 This is a schematic diagram of a first embodiment of a risk warning method according to an embodiment of the present invention;

[0023] Figure 2 This is a schematic diagram of a second embodiment of the risk prompt method in an embodiment of the present invention;

[0024] Figure 3 Schematic diagram of a third embodiment of the risk prompt method according to an embodiment of the present invention;

[0025] Figure 4 Schematic diagram of a fourth embodiment of the risk prompt method according to an embodiment of the present invention;

[0026] Figure 5 This is a schematic diagram of an embodiment of a risk warning device in an embodiment of the present invention;

[0027] Figure 6 This is a schematic diagram of another embodiment of the risk warning device in an embodiment of the present invention;

[0028] Figure 7 This is a schematic diagram of an embodiment of a risk warning device in an embodiment of the present invention. DETAILED DESCRIPTION

[0029] The embodiment of the present invention provides a risk warning method, device, equipment and storage medium, which extracts the business system project to be prompted, the acquisition interface address and the acquisition scope of each business system project to be prompted; when receiving the startup request of the business system belonging to the business system project to be prompted, intercepts the startup request, pulls the registration metadata pre-stored in the configuration center, and finds the probe code; loads the system bytecode of the business system according to the acquisition interface address, identifies the category field that meets the preset configuration rules; generates probe bytecode based on the probe code, and inserts it into the category field content, builds the acquisition probe and starts the business system; collects the operation data generated by the business system to obtain the operation record; and calls the operation classification model to determine the operation type to which it belongs, calculates the risk identification result, and issues a risk warning signal based on the result. The technical solution in the embodiment of the present invention can identify risks for operation records and issue risk warnings for operation records that may be risky operations.

[0030] The terms "first," "second," "third," "fourth," and the like (if any) in the description and claims of the present invention and in the accompanying drawings are used to distinguish similar objects and are not necessarily used to describe a particular order or precedence. It should be understood that the terms used in this manner are interchangeable where appropriate so that the embodiments described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "including" or "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product, or apparatus that includes a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units that are not explicitly listed or that are inherent to these processes, methods, products, or apparatus.

[0031] For ease of understanding, the specific process of the embodiment of the present invention is described below. Figure 1 An embodiment of the risk warning method in the embodiment of the present invention includes:

[0032] 101. Based on the received risk warning request, extract the business system items to be warned, the collection interface address, and the collection scope of each business system item to be warned;

[0033] It is understandable that the execution subject of the present invention may be a risk warning device, or a terminal or a server, which is not limited here. The embodiment of the present invention is described by taking the server as the execution subject as an example.

[0034] In this embodiment, a risk warning request is first received, and risk warning related information is extracted based on the received risk warning request, wherein the risk warning related information may specifically include the business system project to be prompted, the collection interface address and the collection scope of each business system project to be prompted.

[0035] When there is only one business system item to be prompted in this embodiment, operation records can be collected for one business system. When there are multiple business system items to be prompted in this embodiment, operation records can be collected for multiple business systems at the same time. Specifically, the business system item to be prompted, the collection interface address, and the collection scope of each business system item to be prompted can be obtained by extracting the risk warning related information filled in the collection configuration form pre-configured in the risk warning request. The collection configuration form specifically includes the business system item to be prompted, the collection interface address, and the collection scope of each business system item to be prompted, as well as the corresponding relationship between them; wherein, the business system item to be prompted is determined based on the business system number and business system name to be collected.

[0036] In addition, the collection interface address of the corresponding business system to be alerted is found in the database based on the business system number and business system name. The collection configuration table also includes the collection scope of each business system item to be alerted. The collection scope is pre-configured based on the specific level of risk alert and saved in the collection configuration table. For example, if certain business systems to be alerted involve confidential content such as user personal information, the desensitization configuration of the business system can be pre-configured, and the collection scope is determined based on the specific content of the desensitization configuration.

[0037] The collection configuration table also includes configuration information such as the business line, service type, and secret key of the business system. When determining the collection scope, the business system items contained in the database can also be classified according to the above business line, service type and other information to obtain the business system items to be prompted; in this embodiment, the secret key information of the business system will also be obtained in order to obtain access rights to the business system.

[0038] 102. When receiving a business system startup request, determine whether the business system belongs to a business system project to be prompted;

[0039] The risk warning method of this embodiment obtains the working status of each business system to be prompted. After receiving the startup request of the business system to be prompted, the business system number and business system name are obtained according to the startup request. Based on the business system number and business system name, it is determined whether the business system corresponding to the received business system startup request belongs to the business system project to be prompted.

[0040] 103. If yes, intercept the startup request of the business system, pull the pre-stored registration metadata from the preset project risk warning database, and extract the probe code set in the registration metadata;

[0041] If the business system corresponding to the received business system startup request belongs to the business system project to be prompted, the business system startup request is intercepted and the Java Virtual Machine (JVM) is started. After the Java Virtual Machine is started and before the Java class bytecode of the business system to be collected is loaded, the Java agent is called to pull the registration metadata pre-stored in the LogPlus configuration center from the database and find the probe code in the registration metadata. If the business system corresponding to the received business system startup request does not belong to the business system project to be prompted, no operation is performed.

[0042] The registration metadata of this embodiment refers to data that is not an object to be processed in the program, but changes the behavior of the program by changing its value. It plays a role in controlling the behavior of the program in an interpretive manner during the running process.

[0043] 104. Load the system bytecode of the business system according to the acquisition interface address and identify the category fields that meet the preset configuration rules;

[0044] After obtaining the acquisition interface address, the system bytecode of the business system is loaded according to the acquisition interface address, the loaded system bytecode is identified, and the category field of the preset configuration rule is identified and found, wherein the preset configuration rule can be the user category or other rules for collecting all data.

[0045] 105. Generate probe bytecode based on the probe code, insert the probe bytecode into the category field, build the collection probe, and start the business system;

[0046] After finding the corresponding category field, a probe bytecode is generated based on the probe code obtained in the previous step. The probe bytecode is then inserted into the content of the identified category field that meets the preset configuration rules, thereby constructing a collection probe for subsequent operation data collection in this embodiment. In this step, the technology of embedding the probe bytecode into the bytecode of the business system can achieve non-invasive point embedding. Specifically, a Java agent or attach (pid) method can be used to import the probe bytecode package into the business system to complete the embedding and obtain the collection probe.

[0047] 106. Use the collection probe to collect the operation data generated by the business system and obtain the operation record of the business system;

[0048] After the collection probe is implanted, it can be called according to the collection scope to collect the operation data of the business system during operation.

[0049] Because the collection method used in this embodiment embeds a collection probe into the code of the business system to be collected, the probe can collect all the business system's operational information while the business system is running. This includes the user token used by the user when performing operations in the business system, the user's personal information context contained in the user token, and the user's full business operation data. It also includes the user ID, name, local IP address, operation data, backend interface response data, and file upload records. The collection probe in this embodiment collects the operation records of the business system in real time.

[0050] In addition, after obtaining the operation data, the sensitive data in the collected operation records will be processed to generate operation records according to the collection scope or desensitization configuration, and the operation records will be reported to the operation data warehouse in real time.

[0051] 107. Call a preset operation classification model to determine the operation type to which the operation record belongs, calculate a risk identification result based on the operation type, and issue a risk warning signal based on the risk identification result.

[0052] After acquiring real-time operation records of business data, the system uses a pre-configured operation classification model to extract operational features from these records, generating a feature sequence. Based on the specific content in the feature sequence, the system then classifies each operation record into its corresponding operation type, generating a classification result. The system then determines the risk level based on the resulting operation type classification, and issues a risk warning signal based on the risk assessment result.

[0053] The operation classification model is pre-trained based on annotated historical business operation records.

[0054] The technical solution of the embodiment of the present invention can identify risks for operation records and issue risk warnings for operation records that may be risky operations.

[0055] See also Figure 2 The second embodiment of the risk warning method in the embodiment of the present invention includes:

[0056] 201. Obtain historical operation records marked as having risks, perform cluster analysis on the historical operation records based on the marked risk types, and obtain multiple classified historical operation record sets;

[0057] In this embodiment, a risk identification model needs to be established in advance. Specifically, a plurality of historical operation records marked as having risks are first obtained. After data cleaning of the marked historical operation records, each historical operation record is clustered and analyzed according to the risk type marked by each historical operation record. In other words, the plurality of historical operation records are grouped into a plurality of classified historical operation record sets according to their risk type.

[0058] 202. Extract risk data features related to risk types from multiple historical operation record sets, and label the classified historical operation record sets according to the risk data features to obtain a risk identification data set;

[0059] A pre-established feature extraction algorithm is used to extract risk data features from each classified historical operation record set, and the classified historical operation record set is labeled according to the risk data features to obtain a risk identification data set.

[0060] 203. Based on the risk identification data set, a classification tool pre-installed with the k-means clustering algorithm is trained to obtain a risk identification model;

[0061] Subsequently, a classification tool with a preset k-means clustering algorithm is trained based on the risk identification dataset. The k-means clustering algorithm is an iterative cluster analysis algorithm. Its steps are as follows: pre-dividing the data into K groups, randomly selecting K objects as initial cluster centers, and then calculating the distance between each object and each seed cluster center, and assigning each object to the cluster center closest to it. The cluster centers and the objects assigned to them represent a cluster. Each time a sample is assigned, the cluster center is recalculated based on the existing objects in the cluster. This process will be repeated until the preset termination condition is met. After training is completed, the risk identification model is obtained.

[0062] 204. Obtain the interface correspondence information of each business system project and interface address from the project risk warning database;

[0063] In this embodiment, a request is made in advance to obtain information on all business systems that can provide risk warnings based on this warning request in the database, and the interface correspondence information between each business system project and the interface address is obtained, wherein the interface between each business system project and the interface address is one-to-one corresponding, and the running source program address of each business system project can be found according to the interface address. In addition, when the business system is updated, the content stored in the database must also be updated accordingly.

[0064] 205. Select the business system project to be prompted, and obtain the collection interface address corresponding to the business system to be prompted according to the interface corresponding information;

[0065] 206. Generate a collection configuration table based on the collection interface address and the collection scope of each business system item to be prompted;

[0066] 207. Generate a risk warning request based on the collection configuration form;

[0067] When users want to monitor a business system, they can select the business system to be prompted based on their current needs. Specifically, they select the business system project to be prompted on the monitoring system configuration interface and then find the corresponding collection interface address of the business system to be prompted based on the interface corresponding information obtained in the previous steps. When selecting the business system project to be prompted on the monitoring system configuration interface, users can select multiple business system projects at the same time. After selecting the business system project to be monitored, they can further configure the collection scope of the monitoring project. After configuration is completed, a collection configuration table is generated based on this information, and finally, a risk warning request is generated based on the collection configuration table.

[0068] 208. Based on the received risk warning request, extract the business system project to be warned, the collection interface address, and the collection scope of each business system project to be warned;

[0069] 209. When receiving a business system startup request, determine whether the business system belongs to a business system project to be prompted;

[0070] 210. If yes, intercept the startup request of the business system, pull the pre-stored registration metadata from the preset project risk warning database, and extract the probe code set in the registration metadata;

[0071] 211. Load the system bytecode of the business system according to the acquisition interface address and identify the category fields that meet the preset configuration rules;

[0072] 212. Generate probe bytecode based on the probe code, insert the probe bytecode into the category field, build the collection probe, and start the business system;

[0073] 213. Use the collection probe to collect the operation data generated by the business system and obtain the operation record of the business system;

[0074] The specific contents of steps 208 to 213 in this embodiment are substantially the same as those of steps 101 to 106 in the aforementioned embodiment, and therefore are not described again here.

[0075] 214. Calling a preset operation classification model to determine whether the business operation performed in the operation record is a known business operation;

[0076] After obtaining the real-time operation records of the business data, the preset operation classification model is called to judge the operation records to determine whether the business operation is a known business operation type. The operation classification model is pre-trained based on the annotated historical business operation records.

[0077] 215. If yes, call the risk identification model to identify negative risks in the operation record, obtain a risk identification result, and issue a first prompt signal based on the risk identification result;

[0078] If the result of the judgment is that the operation record is a known business operation, the risk calculation model is called to determine which type of known operation type the known operation record belongs to, and its negative risk is judged based on the specific content in the operation record to obtain the risk judgment result, and a first prompt signal is issued based on the risk judgment result.

[0079] Specifically, before determining risky behavior, existing operation records are pre-acquired and categorized, labeled with their risk types, and the labeled existing operation records are assembled into a feature engineering dataset. This feature engineering dataset is used to train an unsupervised algorithm tool to obtain a risk calculation model, wherein the unsupervised algorithm tool includes a built-in clustering algorithm. This risk calculation model is pre-installed in a real-time computing platform such as the risk warning device established in this embodiment. The operation records obtained in the previous step are input into the real-time computing platform, and a risk behavior determination is performed on the operation records. If the determination result is risky, a first prompt signal is issued based on the risk prediction result and displayed on the real-time computing platform.

[0080] 216. If not, call a preset business risk prediction model to perform risk prediction on the operation record, and issue a second prompt signal based on the risk prediction result.

[0081] In addition, the real-time computing platform in this embodiment also has a risk prediction model. If the result of the judgment is that the operation record is an unknown business operation, the preset business risk prediction model is called to perform risk prediction on the operation record and obtain the risk prediction result. If the prediction result is risky, a second prompt signal is issued.

[0082] Specifically, when predicting risky behavior, this embodiment calls the k-means clustering algorithm included in the preset risk identification model to extract features of the operation records obtained during the operation of the business system, and classifies the operation records based on the features of the extracted operation records to determine whether the operation records are risky. If the operation record is determined to be risky, the operation record is marked as risky, and a second prompt signal is sent to the administrator of the business system so that the administrator can pay attention to the potentially risky operation to prevent major losses.

[0083] The technical solution in the embodiment of the present invention can identify risks for operation records and issue risk warnings for operation records that may be risky operations.

[0084] See also Figure 3 The third embodiment of the risk warning method in the embodiment of the present invention includes:

[0085] 301. Based on the received risk warning request, extract the business system items to be warned, the collection interface address, and the collection scope of each business system item to be warned;

[0086] 302. When receiving a business system startup request, determine whether the business system belongs to a business system project to be prompted;

[0087] 303. If yes, intercept the startup request of the business system, pull the pre-stored registration metadata from the preset project risk warning database, and extract the probe code set in the registration metadata;

[0088] 304. Load the system bytecode of the business system according to the acquisition interface address and identify the category fields that meet the preset configuration rules;

[0089] 305. Generate probe bytecode based on the probe code, insert the probe bytecode into the category field, build the collection probe, and start the business system;

[0090] 306. Using a collection probe to collect operation data generated by the business system to obtain an operation record of the business system;

[0091] The specific contents of steps 301 to 306 in this embodiment are substantially the same as those of steps 101 to 106 in the aforementioned embodiment, and thus will not be described in detail here.

[0092] 307. Calling a preset operation classification model to determine whether the business operation performed in the operation record is a known business operation;

[0093] 308. If yes, call the risk identification model to identify negative risks in the operation record, obtain a risk identification result, and issue a first prompt signal based on the risk identification result;

[0094] The specific contents of step 307-step 308 in this embodiment are substantially the same as those of step 214-step 215 in the aforementioned embodiment, and thus will not be described in detail here.

[0095] 309. If not, classify the file data according to the format of the file data to obtain the file data type;

[0096] 310. Perform content recognition on the content in the file data according to different file data types to obtain a file content recognition result;

[0097] 311. Input the document content recognition result into a preset business risk prediction model to perform risk prediction and obtain a risk prediction index;

[0098] 312. Mark the operation record whose risk prediction index exceeds the preset risk prediction threshold as a risky operation and issue a second prompt signal;

[0099] In this embodiment, the content of the file data is identified and judged according to different file data types, and the file data containing information that does not comply with the business system rules is marked as abnormal; when the collection probe is called to collect operation records of the business system, the specific content of the file data uploaded by the user to the business system is also included. The collection probe is specifically called to collect the file data uploaded to the system when the business system is running, and the file data is classified according to the format of the file data to the file data type, and the content of the file data is identified and judged according to the file data type.

[0100] Specifically, if the file data type is tabular data such as an Excel file, the format of the collected tabular data is converted, the content contained therein is identified, and a pre-established file identification tool is used to determine whether there is data that does not comply with the business system rules. If there is data that does not comply with the business system rules, the corresponding operation records are searched based on the collected tabular data and the corresponding operation records are marked.

[0101] In addition, the file data type can also be image data. The image data is also identified according to the pre-established file recognition tool to determine whether there are image files that do not comply with the business system rules. If there are image data that do not comply with the business system rules, the corresponding operation records are searched based on the collected image data and the operation records are marked.

[0102] 313. Extract the marked risky operation records and the operation record information of the risky operation records;

[0103] 314. Display the operation record information on the risk behavior screen, and sort all the operation record information displayed on the risk behavior screen according to the risk rating of the operation record.

[0104] After the operation records are marked with risks in the aforementioned steps, the marked risky operation records and the operation record information of the risky operation records are extracted, and risk rating is performed based on the obtained operation record information.

[0105] Among them, the risk warning device provided in this embodiment has a preset risk rating rule, in which risks are marked into multiple levels according to the consequences of risk operations, the operation record information is risk rated according to the preset risk rating rule, and the operation records judged to be risky are sorted according to the risk rating. The operation record information is displayed on the risk behavior screen according to the sorting, so that the administrator of the business system can promptly discover and handle high-risk operations.

[0106] The technical solution in the embodiment of the present invention can identify risks for operation records and issue risk warnings for operation records that may be risky operations.

[0107] See also Figure 4 The fourth embodiment of the risk warning method in the embodiment of the present invention includes:

[0108] 401. Obtain historical operation records marked as having risks, perform cluster analysis on the historical operation records based on the marked risk types, and obtain multiple classified historical operation record sets;

[0109] 402. Extract risk data features related to risk types from multiple historical operation record sets, and label the classified historical operation record sets according to the risk data features to obtain a risk identification data set;

[0110] 403. Based on the risk identification data set, a classification tool pre-installed with a k-means clustering algorithm is trained to obtain a risk identification model;

[0111] 404. Obtain the interface correspondence information of each business system project and interface address from the project risk warning database;

[0112] 405. Select the business system project to be prompted, and obtain the collection interface address corresponding to the business system to be prompted according to the interface corresponding information;

[0113] 406. Generate a collection configuration table based on the collection interface address and the collection scope of each business system item to be prompted;

[0114] 407. Generate risk warning request based on the collection configuration form;

[0115] The specific contents of steps 401 to 407 in this embodiment are substantially the same as those of steps 201 to 207 in the aforementioned embodiment, and thus will not be described in detail here.

[0116] 408. Based on the received risk warning request, extract the business system items to be warned, the collection interface address, and the collection scope of each business system item to be warned;

[0117] 409. When receiving a business system startup request, determine whether the business system belongs to a business system project to be prompted;

[0118] 410. If yes, intercept the startup request of the business system, pull the pre-stored registration metadata from the preset project risk warning database, and extract the probe code set in the registration metadata;

[0119] 411. Load the system bytecode of the business system according to the acquisition interface address and identify the category fields that meet the preset configuration rules;

[0120] 412. Generate probe bytecode based on the probe code, insert the probe bytecode into the category field, build the collection probe, and start the business system;

[0121] 413. Use the collection probe to collect the operation data generated by the business system and obtain the operation record of the business system;

[0122] The specific contents of steps 408 to 413 in this embodiment are substantially the same as those of steps 101 to 106 in the aforementioned embodiment, and thus will not be described in detail here.

[0123] 414. Calling a preset operation classification model to determine whether the business operation performed in the operation record is a known business operation;

[0124] 415. If yes, call the risk identification model to identify negative risks in the operation record, obtain a risk identification result, and issue a first prompt signal based on the risk identification result;

[0125] The specific contents of step 414-step 415 in this embodiment are substantially the same as those of step 214-step 215 in the aforementioned embodiment, and thus will not be repeated here.

[0126] 416. If not, classify the file data according to the format of the file data to obtain the file data type;

[0127] 417. Perform content recognition on the content in the file data according to different file data types to obtain a file content recognition result;

[0128] 418. Input the document content recognition result into a preset business risk prediction model to perform risk prediction and obtain a risk prediction index;

[0129] 419. Mark the operation record whose risk prediction index exceeds the preset risk prediction threshold as a risky operation and issue a second prompt signal;

[0130] The specific contents of steps 416 to 419 in this embodiment are substantially the same as those of steps 309 to 312 in the aforementioned embodiment, and therefore are not described again here.

[0131] 420. Extract the marked risky operation records and the operation record information of the risky operation records;

[0132] 421. Display the operation record information on the risk behavior screen and sort all the operation record information displayed on the risk behavior screen according to the risk rating of the operation record;

[0133] The specific contents of step 420 and step 421 in this embodiment are substantially the same as those of step 313 and step 314 in the aforementioned embodiment, and thus will not be described in detail here.

[0134] 422. Extract the operation records and risk identification results to obtain an operation record data set;

[0135] 423. Perform data cleaning and format conversion on the operation record data set to obtain a cleaned operation record data set;

[0136] 424. Generate log data based on the cleaning operation record data set, and store the cleaning log data in a database;

[0137] 425. Regularly obtain the saved cleaning log data set from the database, and back up the saved cleaning log data set to the offline big data platform.

[0138] Extract the operation records, operation records determined to be risky, and the marked risk identification results contained in the log data collected in the above steps, and form a log record data set with the extracted information;

[0139] The log record dataset is cleaned to remove useless or duplicate data. The data is then converted to a natural language format, resulting in a cleaned log dataset. This cleaned log dataset is then stored in a database. The saved cleaned log dataset is periodically retrieved from the database and backed up to an offline big data platform. This cleaned log data was backed up to the offline big data platform this week, allowing for easy retrieval of specific operation information in the offline big data platform. This ensures that logs are not lost and allows for long-term log tracing.

[0140] The technical solution in the embodiment of the present invention can identify risks for operation records and issue risk warnings for operation records that may be risky operations, so that users can take preventive measures in advance or during the process based on the risk warnings; further, the technical solution in this embodiment can also generate logs for operation records for backup, which is convenient for subsequent tracing.

[0141] The above describes the risk warning method in the embodiment of the present invention. The following describes the risk warning device in the embodiment of the present invention. Figure 5 In one embodiment of the present invention, a risk warning device includes:

[0142] Extraction module 501, for extracting the business system items to be prompted, the collection interface address, and the collection scope of each business system item to be prompted based on the received risk warning request;

[0143] The judgment module 502 is used to judge whether the business system belongs to the business system project to be prompted when receiving a business system startup request;

[0144] The pulling module 503 is used to intercept the startup request of the business system, pull pre-stored registration metadata from a preset project risk warning database, and extract the probe code set in the registration metadata;

[0145] Identification module 504, used to load the system bytecode of the business system according to the acquisition interface address and identify the category field that meets the preset configuration rules;

[0146] A construction module 505 is configured to generate a probe bytecode based on the probe code, insert the probe bytecode into the category field, construct a collection probe, and start the business system;

[0147] The collection module 506 is configured to use the collection probe to collect the operation data generated by the business system to obtain the operation record of the business system;

[0148] The prompt module 507 is used to call a preset operation classification model to determine the operation type to which the operation record belongs, calculate a risk identification result based on the operation type, and issue a risk prompt signal according to the risk identification result.

[0149] The technical solution in the embodiment of the present invention can identify risks for operation records and issue risk warnings for operation records that may be risky operations.

[0150] See also Figure 6Another embodiment of the risk warning device in the embodiment of the present invention includes: an extraction module 501, which is used to extract the business system project to be prompted, the acquisition interface address and the acquisition range of each business system project to be prompted based on the received risk warning request; a judgment module 502, which is used to judge whether the business system belongs to the business system project to be prompted when a startup request of the business system is received; a pulling module 503, which is used to intercept the startup request of the business system, pull the pre-stored registration metadata from the preset project risk warning database, and extract the probe code set in the registration metadata; an identification module 504, which is used to determine the business system project to be prompted according to the acquisition interface address. The system bytecode of the business system is loaded according to the port address, and the category field that meets the preset configuration rules is identified; the construction module 505 is used to generate the probe bytecode based on the probe code, insert the probe bytecode into the category field, build the collection probe, and start the business system; the collection module 506 is used to use the collection probe to collect the operation data generated by the business system to obtain the operation record of the business system; the prompt module 507 is used to call the preset operation classification model to determine the operation type to which the operation record belongs, calculate the risk identification result based on the operation type, and issue a risk warning signal according to the risk identification result.

[0151] Optionally, the prompt module 507 includes: a judgment unit 5071, used to call a preset operation classification model to determine whether the business operation performed in the operation record is a known business operation; a first prompt unit 5072, used to call a risk identification model to identify negative risks of the operation record, obtain a risk identification result, and issue a first prompt signal based on the risk identification result; a second prompt unit 5073, used to call a preset business risk prediction model to perform risk prediction on the operation record, and issue a second prompt signal based on the risk prediction result.

[0152] Optionally, the operation record includes file data uploaded to the system, and the second prompt unit 5073 also includes: a file classification subunit, used to classify the file data according to the format of the file data to obtain the file data type; a content identification subunit, used to perform content identification on the content in the file data according to different file data types to obtain a file content identification result; a prediction subunit, used to input the file content identification result into a preset business risk prediction model for risk prediction to obtain a risk prediction index; a prompt subunit, used to mark the operation record whose risk prediction index exceeds a preset risk prediction threshold as a risk operation, and issue a second prompt signal.

[0153] Optionally, the risk warning device also includes a risk display module, which includes: an operation record extraction unit, used to extract operation records identified as risky and operation record information of the risky operation records; an operation record display unit, used to display the operation record information in the risk behavior screen, and sort all operation record information displayed in the risk behavior screen according to the risk rating of the operation record.

[0154] Optionally, the risk warning device also includes a judgment model construction module, which includes: an operation record set generation unit, used to extract risk data features related to the risk type from the multiple historical operation record sets, and label the classified historical operation record sets according to the risk data features to obtain a risk identification data set; a training unit, used to train a classification tool pre-installed with a k-means clustering algorithm based on the risk identification data set to obtain a risk identification model.

[0155] Optionally, the risk warning device also includes a log backup module, which includes: a data set extraction unit, used to extract the operation records and the risk identification results to obtain an operation record data set; a data set cleaning unit, used to perform data cleaning and format conversion on the operation record data set to obtain a cleaned operation record data set; a log data generation unit, used to generate log data based on the cleaned operation record data set, and store the cleaned log data in a database; a backup unit, used to periodically obtain the saved cleaned log data set from the database, and back up the saved cleaned log data set to an offline big data platform.

[0156] Optionally, the risk warning device also includes a warning request generation module, which includes: an interface information acquisition unit, used to obtain interface correspondence information between each business system project and the interface address in the project risk warning database; an interface address selection unit, used to select the business system project to be prompted, and obtain the collection interface address corresponding to the business system to be prompted according to the interface correspondence information; a table generation unit, used to generate a collection configuration table based on the collection interface address and the collection scope of each business system project to be prompted; and a request generation unit, used to generate a risk warning request based on the collection configuration table.

[0157] The technical solution of the embodiment of the present invention can identify risks for operation records and issue risk warnings for operation records that may be risky operations, so that users can take preventive measures in advance or during the process based on the risk warnings; further, the technical solution of this embodiment can also generate logs for operation records for backup, which is convenient for subsequent tracing.

[0158] above Figure 5 and Figure 6 The risk warning device of this embodiment is described in detail from the perspective of modular functional entities, and the risk warning device of this embodiment is described in detail from the perspective of hardware processing.

[0159] Figure 7 It is a structural diagram of a risk warning device provided by an embodiment of the present invention. The risk warning device 700 may have relatively large differences due to different configurations or performances, and may include one or more processors (central processing units, CPU) 710 (for example, one or more processors) and a memory 720, and one or more storage media 730 (for example, one or more massive storage devices) for storing application programs 733 or data 732. Among them, the memory 720 and the storage medium 730 can be short-term storage or persistent storage. The program stored in the storage medium 730 may include one or more modules (not shown in the figure), and each module may include a series of instruction operations on the risk warning device 700. Furthermore, the processor 710 can be configured to communicate with the storage medium 730 to execute a series of instruction operations in the storage medium 730 on the risk warning device 700.

[0160] The risk warning device 700 may also include one or more power supplies 740, one or more wired or wireless network interfaces 750, one or more input and output interfaces 760, and / or one or more operating systems 731, such as Windows Server, Mac OS X, Unix, Linux, FreeBSD, etc. It will be understood by those skilled in the art that Figure 7 The risk warning device structure shown does not constitute a limitation on the risk warning device, and may include more or fewer components than shown in the figure, or a combination of certain components, or a different arrangement of components.

[0161] The present invention also provides a computer device, which can be any device capable of executing the risk warning method described in the above embodiments. The computer device includes a memory and a processor, and the memory stores computer-readable instructions. When the computer-readable instructions are executed by the processor, the processor executes the steps of the risk warning method in the above embodiments.

[0162] Blockchain, as used in this article, refers to a novel application model for computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanisms, and encryption algorithms. Blockchain is essentially a decentralized database, a series of data blocks generated using cryptographic methods. Each block contains information about a batch of online transactions, used to verify the validity of this information (to prevent counterfeiting) and generate the next block. Blockchain can include the underlying blockchain platform, the platform product service layer, and the application service layer.

[0163] The present invention also provides a computer-readable storage medium, which may be a non-volatile computer-readable storage medium or a volatile computer-readable storage medium. Instructions are stored in the computer-readable storage medium. When the instructions are executed on a computer, the computer executes the steps of the risk warning method.

[0164] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0165] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), magnetic disk or optical disk, etc., various media that can store program code.

[0166] As described above, the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that the technical solutions described in the above embodiments can still be modified, or some of the technical features thereof can be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A risk warning method, characterized in that: The risk warning methods include: Generate a risk warning request based on the collection configuration form, and extract the business system project to be prompted, the collection interface address, and the collection scope of each business system project to be prompted by extracting the risk warning related information filled in the collection configuration form pre-configured in the risk warning request. The collection configuration form specifically includes the business system project to be prompted, the collection interface address, and the collection scope of each business system project to be prompted, as well as the corresponding relationship between them; When receiving a business system startup request, determining whether the business system belongs to the business system project to be prompted; If so, intercept the startup request of the business system, pull pre-stored registration metadata from a preset project risk warning database, and extract the probe code set in the registration metadata; Loading the system bytecode of the business system according to the acquisition interface address, and identifying the category fields that meet the preset configuration rules; Generate a probe bytecode based on the probe code, insert the probe bytecode into the category field, build a collection probe, and start the business system; Using the acquisition probe to collect the operation data generated by the business system to obtain the operation record of the business system; A preset operation classification model is called to extract the operation features of the operation records to obtain a feature sequence; the operation type to which each operation record belongs is classified according to the specific content in the feature sequence, and the risk level is judged based on the classification result, and a risk warning signal is issued, wherein the operation classification model is pre-trained based on the annotated historical business operation records.

2. The risk warning method according to claim 1, characterized in that: The step of classifying the operation type of each operation record according to the specific content in the feature sequence, determining the risk level based on the classification result, and issuing a risk warning signal includes: Determining whether the business operation performed in each operation record is a known business operation based on the specific content in the feature sequence; If yes, calling the risk identification model to identify negative risks of the operation record, obtaining a risk identification result, and issuing a first prompt signal according to the risk identification result; If not, calling a preset business risk prediction model to perform risk prediction on the operation record, and issuing a second prompt signal according to the risk prediction result; Among them, when predicting risky behavior, the k-means clustering algorithm included in the preset risk identification model is called to extract features of the operation records obtained during the operation of the business system, and the operation records are classified based on the features of the extracted operation records. Based on the classification results, it is judged whether the operation records are risky. If it is judged that the operation records are risky, the operation records are marked as risky, and a second prompt signal is sent to the administrator of the business system.

3. The risk warning method according to claim 2, characterized in that: The operation record includes file data uploaded to the system, and calling a preset business risk prediction model to perform risk prediction on the operation record, and issuing a second prompt signal according to the risk prediction result includes: Classifying the file data according to the format of the file data to obtain the file data type; Performing content recognition on the file data according to different file data types to obtain a file content recognition result; Inputting the file content recognition result into a preset business risk prediction model to perform risk prediction and obtain a risk prediction index; The operation record whose risk prediction index exceeds a preset risk prediction threshold is marked as a risky operation, and a second prompt signal is issued.

4. The risk warning method according to claim 2 or 3, characterized in that: The risk warning method also includes: extracting operation records identified as risky and operation record information of the risky operation records; The operation record information is displayed in a risk behavior screen, and all the operation record information displayed in the risk behavior screen is sorted according to the risk rating of the operation record.

5. The risk warning method according to claim 4, characterized in that: Before generating a risk warning request based on the collection configuration form and extracting the business system items to be prompted, the collection interface address, and the collection scope of each business system item to be prompted by extracting the risk warning related information filled in the collection configuration form pre-configured in the risk warning request, the method further includes: Acquire historical operation records marked as having risks, and perform cluster analysis on the historical operation records based on the marked risk types to obtain multiple classified historical operation record sets; extracting risk data features related to the risk type from the multiple historical operation record sets, and marking the classified historical operation record sets according to the risk data features to obtain a risk identification data set; A classification tool preset with a k-means clustering algorithm is trained based on the risk identification data set to obtain a risk identification model.

6. The risk warning method according to claim 5, characterized in that: The risk warning method also includes: Extracting the operation records and the risk identification results to obtain an operation record data set; Performing data cleaning and format conversion on the operation record data set to obtain a cleaned operation record data set; generating log data based on the cleaning operation record data set, and storing the cleaning log data in a database; The saved cleaning log data set is obtained from the database at regular intervals, and the saved cleaning log data set is backed up to the offline big data platform.

7. The risk warning method according to claim 6, characterized in that: Before generating a risk warning request based on the collection configuration form and extracting the business system items to be prompted, the collection interface address, and the collection scope of each business system item to be prompted by extracting the risk warning related information filled in the collection configuration form pre-configured in the risk warning request, the method further includes: Obtaining interface correspondence information between each business system project and interface address in the project risk warning database; Select the business system project to be prompted, and obtain the collection interface address corresponding to the business system to be prompted according to the interface corresponding information; Generate a collection configuration table based on the collection interface address and the collection scope of each business system item to be prompted; A risk warning request is generated based on the collection configuration form.

8. A risk warning device, characterized in that: The risk warning device includes: An extraction module is configured to generate a risk warning request based on a collection configuration form, and extract the business system items to be prompted, the collection interface address, and the collection scope of each business system item to be prompted by using the risk warning related information filled in the collection configuration form pre-configured in the risk warning request, wherein the collection configuration form specifically includes the business system items to be prompted, the collection interface address, and the collection scope of each business system item to be prompted, as well as the corresponding relationships between them; A judgment module, configured to, upon receiving a request to start a business system, judge whether the business system belongs to the business system project to be prompted; A pulling module, configured to intercept the startup request of the business system, pull pre-stored registration metadata from a preset project risk warning database, and extract the probe code set in the registration metadata; An identification module, configured to load the system bytecode of the business system according to the acquisition interface address and identify the category fields that comply with the preset configuration rules; A construction module, configured to generate a probe bytecode based on the probe code, insert the probe bytecode into the category field, construct a collection probe, and start the business system; A collection module, configured to use the collection probe to collect the operation data generated by the business system and obtain the operation record of the business system; The prompt module is used to call a preset operation classification model to extract the operation features of the operation record to obtain a feature sequence; classify the operation type to which each operation record belongs according to the specific content in the feature sequence, and judge the risk level based on the classification result, and issue a risk warning signal, wherein the operation classification model is pre-trained based on the annotated historical business operation records.

9. A risk warning device, characterized in that: The risk prompt device includes: a memory and at least one processor, wherein instructions are stored in the memory; The at least one processor calls the instructions in the memory to enable the risk prompting device to execute the steps of the risk prompting method according to any one of claims 1 to 7.

10. A computer-readable storage medium having instructions stored thereon, characterized in that: When the instructions are executed by the processor, the steps of the risk prompt method according to any one of claims 1 to 7 are implemented.

Images