Business risk control method, device, electronic device and storage medium

Abstract

The present invention discloses a business risk control method, device, electronic device and storage medium, and relates to the field of computer technology. A specific implementation of the method includes: receiving a risk control request sent by a business system, the risk control request includes business process information and user information; screening risk rules corresponding to the risk control request according to the business process information; determining risk control factors corresponding to the risk control request according to the risk rules, the risk control factors include user identity factors and user behavior factors; determining the risk control result of the risk control request according to the user information and the risk control factors. This implementation can solve the problem that due to the different risk control methods of each business, each business is equipped with a corresponding risk control system, and thus the maintenance cost of the architecture of the risk control system is high.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a business risk control method, device, electronic device and storage medium. Background Art

[0002] With the development of network technology, various businesses have been widely used on the Internet, and the types of services have been greatly enriched, such as: life services, travel, 3C consumer products, overseas virtual services, etc. In order to ensure the smooth operation of the business, a corresponding risk control system will be configured for the operation of each business.

[0003] In the process of implementing the present invention, the inventors found that there are at least the following problems in the prior art:

[0004] Because each business has a different risk control method, each business has a corresponding risk control system, so the maintenance cost of the risk control system architecture is relatively high. Summary of the invention

[0005] In view of this, an embodiment of the present invention provides a business risk control method, device, system and storage medium, which can solve the problem that due to the different risk control methods of each business, each business has a corresponding risk control system, resulting in high maintenance costs for the architecture of the risk control system.

[0006] To achieve the above objective, according to one aspect of an embodiment of the present invention, a business risk control method is provided.

[0007] A business risk control method according to an embodiment of the present invention includes: receiving a risk control request sent by a business system, the risk control request including business process information and user information; screening risk rules corresponding to the risk control request based on the business process information; determining risk control factors corresponding to the risk control request based on the risk rules, the risk control factors including user identity factors and user behavior factors; determining a risk control result of the risk control request based on the user information and the risk control factors.

[0008] In one embodiment, the user identity factor includes a user identity parameter and a standard value corresponding to the user identity parameter;

[0009] The determining, according to the user information and the risk control factor, a risk control result of the risk control request includes:

[0010] Acquire, from the user information, a parameter value corresponding to the user identity parameter in the user identity factor;

[0011] Determining whether a parameter value corresponding to the user identity parameter matches a standard value corresponding to the user identity parameter;

[0012] If not, determining that the risk control result is that the risk control request does not trigger risk control;

[0013] If so, the risk control result of the risk control request is determined according to the user information and the user behavior factor.

[0014] In yet another embodiment, the user behavior factor includes a user behavior parameter and a standard value corresponding to the user behavior parameter;

[0015] The determining, according to the user information and the user behavior factor, a risk control result of the risk control request includes:

[0016] According to the user information, obtaining a parameter value corresponding to the user behavior parameter;

[0017] Determining whether the parameter value corresponding to the user behavior parameter matches the standard value corresponding to the user behavior parameter;

[0018] If not, determining that the risk control result is that the risk control request does not trigger risk control;

[0019] If so, it is determined that the risk control result is that the risk control request triggers risk control.

[0020] In yet another embodiment, after determining that the risk control result is that the risk control request triggers risk control, the method further includes:

[0021] Determine whether to generate a risk event based on risk event parameters;

[0022] If so, a risk event is generated according to the risk control request and the risk control result.

[0023] In yet another embodiment, the business process information includes a business type identifier and a business process identifier;

[0024] The screening of risk rules corresponding to the risk control request according to the business process information includes:

[0025] According to the business type identifier and the business process identifier, the risk rule corresponding to the risk control request is screened.

[0026] To achieve the above objective, according to another aspect of the present invention, a business risk control device is provided.

[0027] A business risk control device of the present invention includes: a receiving unit, used to receive a risk control request sent by a business system, the risk control request including business process information and user information; a screening unit, used to screen risk rules corresponding to the risk control request according to the business process information; a determination unit, used to determine the risk control factor corresponding to the risk control request according to the risk rule, the risk control factor including a user identity factor and a user behavior factor; the determination unit is also used to determine the risk control result of the risk control request according to the user information and the risk control factor.

[0028] In one embodiment, the user identity factor includes a user identity parameter and a standard value corresponding to the user identity parameter;

[0029] The determining unit is further configured to:

[0030] Acquire, from the user information, a parameter value corresponding to the user identity parameter in the user identity factor;

[0031] Determining whether a parameter value corresponding to the user identity parameter matches a standard value corresponding to the user identity parameter;

[0032] If not, determining that the risk control result is that the risk control request does not trigger risk control;

[0033] If so, the risk control result of the risk control request is determined according to the user information and the user behavior factor.

[0034] In yet another embodiment, the user behavior factor includes a user behavior parameter and a standard value corresponding to the user behavior parameter;

[0035] The determining unit is further configured to:

[0036] According to the user information, obtaining a parameter value corresponding to the user behavior parameter;

[0037] Determining whether the parameter value corresponding to the user behavior parameter matches the standard value corresponding to the user behavior parameter;

[0038] If not, determining that the risk control result is that the risk control request does not trigger risk control;

[0039] If so, it is determined that the risk control result is that the risk control request triggers risk control.

[0040] In yet another embodiment, the apparatus further comprises:

[0041] A judgment unit, used to judge whether to generate a risk event according to risk event parameters;

[0042] A generating unit is configured to, if yes, generate a risk event according to the risk control request and the risk control result.

[0043] In yet another embodiment, the business process information includes a business type identifier and a business process identifier;

[0044] The screening unit is specifically configured to screen the risk rules corresponding to the risk control request according to the business type identifier and the business process identifier.

[0045] To achieve the above objective, according to another aspect of an embodiment of the present invention, an electronic device is provided.

[0046] An electronic device according to an embodiment of the present invention includes: one or more processors; a storage device for storing one or more programs, and when the one or more programs are executed by the one or more processors, the one or more processors implement the business risk control method provided by the embodiment of the present invention.

[0047] To achieve the above objective, according to another aspect of an embodiment of the present invention, a computer readable medium is provided.

[0048] A computer-readable medium according to an embodiment of the present invention stores a computer program, which, when executed by a processor, implements the business risk control method provided by the embodiment of the present invention.

[0049] One embodiment of the above invention has the following advantages or beneficial effects: In the embodiment of the present invention, different risk control rules are set according to the business processes of different businesses, and risk control factors corresponding to the business processes are set, so that risk control is performed on each business based on the risk control factors corresponding to the different business processes. In this way, in the embodiment of the present invention, risk control of different businesses can be achieved without setting up a risk control system corresponding to each business, thereby reducing the maintenance cost of the risk control system.

[0050] The further effects of the above-mentioned non-conventional optional manner will be described below in conjunction with the specific implementation manner. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] The accompanying drawings are used to better understand the present invention and do not constitute an improper limitation of the present invention.

[0052] Figure 1 is a schematic diagram of a system architecture applicable to the business risk control method according to an embodiment of the present invention;

[0053] Figure 2 is a schematic diagram of a main process of a business risk control method according to an embodiment of the present invention;

[0054] Figure 3 is a schematic diagram of another main process of the business risk control method according to an embodiment of the present invention;

[0055] Figure 4 is a schematic diagram of another main process of the business risk control method according to an embodiment of the present invention;

[0056] Figure 5 is a schematic diagram of main units of a business risk control device according to an embodiment of the present invention;

[0057] Figure 6 is another exemplary system architecture diagram to which the embodiments of the present invention can be applied;

[0058] Figure 7 It is a schematic diagram of the structure of a computer system suitable for implementing the embodiment of the present invention. DETAILED DESCRIPTION

[0059] The following is a description of exemplary embodiments of the present invention in conjunction with the accompanying drawings, including various details of the embodiments of the present invention to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those of ordinary skill in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope and spirit of the present invention. Similarly, for clarity and conciseness, the description of well-known functions and structures is omitted in the following description.

[0060] It should be pointed out that the embodiments of the present invention and the features in the embodiments may be combined with each other if there is no conflict.

[0061] The relevant parameters in the embodiments of the present invention are described as follows.

[0062] The risk control factor is the most basic unit in the entire risk control process. It is a complete expression consisting of a comparison value, an operator, and a compared value. For example, "Jingxiang value>10000" is a complete risk control factor, where the comparison value is Jingxiang value, the operator is >, and the compared value is 10000.

[0063] The risk process is the risk control process in the business line, that is, the modeling of risk control scenarios in the business line, such as the order process, asset issuance process, asset usage process, seat reservation process, promotion process, etc. The risk process supports dynamic configuration.

[0064] Risk rules are configured for each risk control process under each business line, and may include corresponding risk user models and risk determination models.

[0065] The risk user model includes risk control factors related to pins, namely user identity factors, such as user name, user Jingxiang value, membership level and other user identity parameters that represent user identity.

[0066] The risk judgment model includes factors related to user behavior results, namely user behavior factors, such as the number of historical orders, the unpaid amount of historical orders, etc., and user behavior parameters.

[0067] Risk control results may include triggered risk control and untriggered risk control. Untriggered risk control can be expressed as PASS, which means that risk control is not triggered and passed. For risk control results that trigger risk control, they can also be divided into two types: VALIDATE and FORBID. VALIDATE means that risk control is triggered and there is a risk, that is, suspicious user behavior, which requires the business line to re-verify and warn, such as using verification codes, obtaining languages, and other operations for verification; FORBID means that risk control is triggered and the operation is prohibited.

[0068] The embodiment of the present invention provides a risk control system, which can be used for risk control scenarios of different business processes in different businesses. In the embodiment of the present invention, the business may include virtual business. Figure 1 As shown, Figure 1 The following is a system architecture diagram of a risk control system. Figure 1 As shown, the request risk escort component is the risk control system shown in the embodiment of the present invention, and the risk control system includes Figure 1 The virtual risk control component module and storage module shown in the figure. Among them, the virtual risk control component module is used to implement the functions of risk control configuration and risk control judgment, and the storage module is used to store the parameters of risk control configuration and read and write data for the risk control judgment process. Figure 1 The business lines shown in the figure are businesses that can be subject to risk control, including movie tickets, hotels, air tickets, recharges, etc. The systems corresponding to each business in the business line can call the risk control system through the interface to perform risk control judgment to determine whether the business process executed in the business triggers risk control.

[0069] The virtual risk control component module includes two parts: MAN (operation configuration management backend) operation configuration (MNA for short) and SOA (Service-Oriented Architecture) service. MAN operation configuration is executed by MAN, which may include factor configuration, process configuration, user model configuration, risk rule configuration, script configuration, implementation warning, judgment model configuration, risk event report, and risk event viewing. SOA services include rule filters, Groovy script engine, remote data batch jobs, factor expression calculation, rule factor matching, and risk strategy matching.

[0070] For the MAN side, factor configuration, process configuration, user model configuration, risk rule configuration, script configuration, and judgment model configuration are all configuration processes for implementing risk control for each business line. Real-time warning refers to the relevant configuration for warning based on risk control results, which can enable the work timer to scan offline data and analyze risk data to achieve early risk warning; risk event report refers to the relevant configuration for generating risk event report based on risk events, so as to facilitate operators to use it for risk data analysis and statistical reporting; risk event viewing refers to the relevant configuration for users to view risk events. The relevant configurations executed by the MAN side are all stored in the database of the storage module. Later in the operation process, the data of the above configurations can also be created, modified, and deleted, and synchronized to the database.

[0071] Risk rule configuration refers to configuring risk rules. In the embodiment of the present invention, risk rules corresponding to different businesses or different processes in the same business can be configured. The specific configuration method can be shown in Table 1. Table 1 shows the fields of risk rule configuration and the meanings of the fields.

[0072] Table 1

[0073]

[0074]

[0075] In Table 1, order type indicates the business type corresponding to the risk rule, that is, various business types in the business line, such as hotels, movie tickets, air tickets, etc.; order subtype indicates the subtype of the specific division of the business type. In the embodiment of the present invention, the business may not set the subtype; process type indicates the type of business process to which the risk rule belongs. In the embodiment of the present invention, the order type and process type can be used as the index of the priority rule. levelsDecideId indicates the risk level index, which usually takes a value between 0-3. Different risk level indexes correspond to different risk determination model identifiers. For example: [{"levels":"0","decideId":"34"}] indicates that when the risk level index levels is 0, the corresponding risk determination model identifier is 34. Levels is another way to express the risk level, which can indicate the importance of the risk rule, and can also be used for the ranking of risk rules. Its value can be expressed as a value between 0-1000. userModelIds indicates the risk user model identifier corresponding to the risk rule. executeRule indicates the result after the risk rule is matched, that is, the result of the execution of the risk rule.

[0076] As can be seen from Table 1, the risk rules all include corresponding risk user models and risk determination models. The user model configuration in the MAN is used to configure the risk user model, and the determination model configuration is used to configure the risk determination model. In the embodiment of the present invention, risk user models and risk determination models corresponding to different services and different processes in the same service can be configured. Specifically, the risk user model configuration parameters can be shown in Table 2, and the risk determination model configuration parameters can be shown in Table 2.

[0077] Table 2

[0078]

[0079]

[0080] In Table 2, the order type indicates the business type corresponding to the risk rule, that is, the various business types in the business line, such as hotels, movie tickets, air tickets, etc.; the order subtype indicates the subtype of the specific division of the business type. In the embodiment of the present invention, the business may not set a subtype. Type indicates the user type used by the risk user model, such as ordinary user, IP user, and indistinguishable user.

[0081] Table 3

[0082]

[0083]

[0084] In Table 3, order type indicates the business type corresponding to the risk rule, that is, various business types in the business line, such as hotels, movie tickets, air tickets, etc.; order subtype indicates the subtype of the specific division of the business type. In the embodiment of the present invention, the business may not be set with a subtype. behaviorPeriod indicates the time period for counting the user's historical behavior, which can be set to one minute, indicating that the user's behavior data within the minute before the current time is counted. associateBusiness Types indicates the business type associated with the business type corresponding to this risk determination model, such as hotels, movie tickets, air tickets, etc. orderStatus indicates the status of the business type associated with the business type corresponding to this risk determination model, such as ordered, unordered, paid, canceled, etc.

[0085] The factor configuration in the MAN end is used to configure the risk control factor. Each risk control factor corresponds to a different risk user model and risk determination model. In the embodiment of the present invention, the risk control factor can be configured by the parameters in Table 4.

[0086] Table 4

[0087]

[0088]

[0089]

[0090] In Table 4, factorCode indicates the English name of the risk control factor. factorType indicates the factor type of the risk control factor, that is, whether it is a user identity factor or a user behavior factor. The user identity factor corresponds to the risk user model, and the user behavior factor corresponds to the risk behavior model. isPublic indicates whether the risk control factor is a public behavior factor. The public behavior factor indicates the factor corresponding to each business type. sourceType indicates the data source of the risk control factor, which can come from the business line parameter (receiving the parameters transmitted by the business line), the local groovy script, or the remote groovy script. groovyId indicates the script identifier when the data source of the risk control factor is a local groovy script.

[0091] It should be noted that in the configuration of the above-mentioned risk control factors, risk user models, risk determination models and risk rules, the risk control factors can be configured first, and then the corresponding risk user models and risk determination models can be configured according to the business processes of each business type, and at the same time, the corresponding relationship between the risk user model and the corresponding risk control factor, and the corresponding relationship between the risk determination model and the corresponding risk control factor can be established, and then the risk rules can be configured based on the business processes of each business type including the risk user model and the risk determination model, thereby establishing the corresponding relationship between the risk rules and the risk control factors. Through the configuration of the above process, it is possible to filter out the corresponding risk rules according to the business type and business process, and then determine the corresponding risk user model and risk determination model according to the risk rules, and determine the corresponding risk control factors according to the risk user model and the risk determination model respectively. Among them, the risk control factor corresponding to the risk user model is the user identity factor, and the risk determination model corresponds to the user behavior factor.

[0092] The script configuration in the MAN end is used for the configuration of the risk control factor using the groovy script. In the embodiment of the present invention, the groovy script can be configured by the parameters in Table 5.

[0093] Table 5

[0094]

[0095]

[0096] In Table 5, jfsId indicates the storage identifier of the script in OSS. factorCode indicates the English name of the risk control factor corresponding to the script. interfaceId indicates the full path of the interface called when the script is called. method indicates the name of the interface method called when the script is called. json indicates the transmission format of the parameters obtained when the script is called.

[0097] The MAN side may also configure the risk event when configuring the generated risk event. In the embodiment of the present invention, the risk event may be configured through the parameters in Table 6.

[0098] Table 6

[0099]

[0100]

[0101] In Table 6, uuid represents the risk event ID, which is a unique number. riskUserModelId represents the risk user model ID that triggers the risk event. decideModelId represents the risk decision model ID that triggers the risk event. Source represents the way to trigger the risk event, which can be a business call or a worker trigger.

[0102] Through the above-mentioned setting method, when executing the risk control process, the corresponding risk user model and risk determination model can be determined according to the risk rules, and then the corresponding user identity factors and user behavior factors can be determined according to the risk user model and risk determination model respectively, so that the user identity factors and user behavior factors can determine the risk control results.

[0103] Figure 1The SOA service shown is the process of executing risk control, and performs risk control on each business process through the pre-configured data stored in the cache. Specifically, the rule filter is used to filter the corresponding risk control rules for the risk control request; the remote data batch job represents the thread queue pool, which is a multi-threaded execution queue tool class; the rule factor matching is used to match the corresponding risk control factor according to the risk rule; the factor expression calculation is used to calculate whether the parameters in the risk control request match the risk control factor according to the risk control factor, and obtain the calculation result; the risk strategy matching is used to summarize the calculation results of each risk control factor and determine whether the risk control result is triggered; the Groovy script engine is used to obtain the parameters for risk control through the configured script, and is a factory class for executing the groovy pan-java language script; the SOA service can also include a JSF generalized call engine factory, which is used to call a third-party remote data interface, and includes triggering risk control to send MQ (message queue) risk events, which is used to send MQ messages when triggering risk control leave, and record the triggered risk control leave for subsequent statistics and analysis. The process of SOA service executing risk control can obtain the parameter value (factor data) of user risk control from remote or local.

[0104] Figure 1 In the storage module, the database and cache are included. The database can be MYSQL and the cache can be redis. The data store stores various configured data and can be synchronized to the cache. The cache is used to provide data reading and writing for SOA services. JmiDB represents the components in the cache.

[0105] based on Figure 1 In the risk control system shown, a risk control process under a business line can be configured to include multiple risk control factors, and the risk control result is obtained by the union of the risk control factor calculation results. The calculation result of the risk control factor can be TRHE or FALSE. FALSE means that the risk control request did not trigger the risk control, which is PASS in the risk control result. TRHE means that the risk control request triggered the risk control, which is VALIDATE or FORBID in the risk control result. When the calculation result is TRHE, the corresponding risk rule is returned, and a risk control event MQ can be generated, and then the risk control event MQ is consumed and stored in the database, which can be used for risk data analysis.

[0106] The embodiment of the present invention provides a business risk control method, which can be Figure 1 SOA is implemented in the system architecture shown, such as Figure 2 As shown, the method includes the following steps.

[0107] S201: Receive a risk control request sent by a business system.

[0108] Among them, the risk control request includes business process information and user information.

[0109] In the business process of each business, when executing a process that requires risk control, a risk control request can be sent through an interface call. For example, in the order process, when a user submits an order application, a risk control request can be sent to determine whether the user's order behavior has risks and trigger risk control. The risk control request includes the corresponding business process information and user information. The business process information can specifically be a business type identifier and a business process identifier. The user information can be the user information corresponding to the business process. For example, in the order process, the user information is the information of the ordering user, usually the user identity information, such as user name, user level, etc.

[0110] S202: Filter risk rules corresponding to the risk control request according to the business process information.

[0111] The business process information may specifically include the identification of the business type and the identification of the business process. Figure 1 In the configuration method in the shown architecture, the corresponding business types and business processes are configured in the risk rules, so the risk rules corresponding to the risk control requests can be screened based on the business process information.

[0112] It should be noted that this step usually involves filtering the risk rules corresponding to the risk control request from the cache. If there are no corresponding risk rules in the cache, it is necessary to call the query rule interface provided by the MAN end to filter the risk rules corresponding to the risk control request and synchronize them to the cache. If the query rule interface provided by the MAN end is called but the corresponding risk rules are not filtered out, it means that the risk control system has not configured risk control for this business process, and it can be determined that the risk control result is not triggered, and the risk control result returned is PASS.

[0113] It should be noted that the risk rules that may be screened out in this step include risk rules that are disabled or not within the effective time. Therefore, after filtering out the risk rules based on the business process information, it is necessary to filter the risk rules to filter out the applicable risk rules, and then determine the corresponding risk control factors. If there are no applicable risk rules after filtering the risk rules, it can be determined that the risk control result is not triggered, and the risk control result returned is PASS.

[0114] Before executing this step, you can also determine whether the risk control switch is turned on based on the business process information. If it is not turned on, you can determine that the risk control result is not triggered, and the risk control result returned is PASS.

[0115] S203: Determine a risk control factor corresponding to the risk control request according to the risk rule.

[0116] Among them, risk control factors include user identity factors and user behavior factors.

[0117] based on Figure 1The configuration method in the shown architecture can filter out the corresponding risk rules based on the business process information, and then determine the corresponding risk user model and risk judgment model. Furthermore, the corresponding user identity factor can be determined based on the risk user model, and the corresponding user behavior factor can be determined based on the risk judgment model.

[0118] User identity factors are risk control factors based on user identity information, such as user name, user level, etc. User behavior factors are risk control factors based on user behavior information, such as the number of orders placed, the number of unpaid orders, etc.

[0119] S204: Determine the risk control result of the risk control request according to the user information and the risk control factor.

[0120] After the risk control factor is determined in step S203, the risk control result of the risk control request can be determined according to the user information and the risk control factor. In the embodiment of the present invention, after the risk control result is determined, the result can be returned to the business system so that the business system can perform corresponding processing.

[0121] It should be noted that, in the embodiment of the present invention, the risk rules are first screened and then the risk control factors are determined. Since the configured risk rules may include multiple ones, step S202 in the embodiment of the present invention can screen multiple risk rules. If there are multiple risk rules screened, it is necessary to perform the process of step S203 and step S204 for each risk rule in sequence. The specific method is: sort the risk rules according to the priority and creation time of the risk rules (the closer the creation time, the higher the priority), and then select a risk rule according to the order of arrangement, and determine the corresponding risk factor based on the selected risk rule, and then perform step S204, that is, determine the risk control result according to the risk factor; if the risk control result is to trigger the risk control, it can be directly determined that the final result is to trigger the risk control, and the process ends; if the risk control result is not to trigger the risk control, the corresponding risk control factor can be determined by obtaining the next risk rule, and step S204 is performed, and the cycle is repeated until the risk control result that triggers the risk control is determined or all risk control factors are judged to be not to trigger the risk control, and the process ends. However, if it is necessary to determine all risk controls triggered by the risk control request, it is necessary to determine the risk control factors corresponding to all the screened risk rules, and then determine the risk control results according to all the risk control factors in step S204.

[0122] In the embodiment of the present invention, when the risk control result is to trigger risk control, it can be specifically divided into VALIDATE and FORBID. VALIDATE means that risk control is triggered and the business system needs to verify it again. FORBID means that risk control is triggered and the corresponding process cannot be executed. Therefore, each risk rule in this step sequentially executes the process of step S203 and step S204. For each risk rule, after determining that the risk control result is to trigger risk control, it can be determined whether the triggering risk control is FORBID. If the triggering risk control is FORBID, the result of FORBID is directly returned to the business system; if the triggering risk control is not FORBID, the execution code corresponding to VALIDATE can be recorded first. If all risk rules are executed according to S204, all risk control results are VALIDATE, then the execution code corresponding to the recorded VALIDATE is sent back to the business system.

[0123] In the embodiment of the present invention, different risk rules are set according to the business processes of different businesses, and risk control factors corresponding to the risk rules are set, so that risk control is performed on each business based on the risk control factors corresponding to different business processes. In this way, the embodiment of the present invention can realize risk control of different businesses, and there is no need to set up a risk control system corresponding to each business, thereby reducing the maintenance cost of the risk control system.

[0124] It should be noted that for each risk rule, a risk event parameter can be configured, and the risk event parameter is used to indicate whether a risk event needs to be generated. If the risk event parameter is yes, it means that a risk event needs to be generated; if the risk event parameter is no, it means that a risk event does not need to be generated. Therefore, after determining that the risk control result is to trigger risk control, it can be determined whether to generate a risk event based on the risk event parameters. If it is determined to generate a risk event based on the risk event parameters, a risk event can be generated based on the risk control request and the risk control result, and an MQ message can be sent to the MAN end so that the MAN end generates a risk event based on the configuration and the MQ message; if it is determined not to generate a risk event based on the risk event parameters, no processing is required. Under normal circumstances, a risk event will be generated when the risk control result is FORBID, but if the configured risk event parameters indicate that no risk event will be generated, it is not necessary to generate a risk event.

[0125] In the embodiment of the present invention, the risk control factor may include a user identity factor and a user behavior factor. The user identity factor includes a user identity parameter and a standard value corresponding to the user identity parameter. The user behavior factor includes a user behavior parameter and a standard value corresponding to the user behavior parameter. Figure 2 In the embodiment shown, the execution process of S204 can be as follows Figure 3 As shown, the following steps are included.

[0126] S301: Acquire a parameter value corresponding to a user identity parameter in a user identity factor according to user information in a user request.

[0127] Among them, when determining the risk control factor, the risk control can be judged based on the user identity factor first, so the list of user identity factors in the risk control factor can be determined first. The user identity factor includes the user identity parameter and the standard value corresponding to the user identity parameter. The process of judging each user identity factor is to obtain the parameter value of the user identity parameter corresponding to the risk control request, and then compare the parameter value of the user identity parameter with the user identity parameter to obtain the risk control result. The user identity parameter is usually the parameter carried by the user information in the risk control request, so it can be obtained from the interface input parameter when the risk control request is made, so in this step, the parameter value corresponding to the user identity parameter in the user identity factor can be obtained from the user information.

[0128] S302: Determine whether the parameter value corresponding to the user identity parameter matches the standard value corresponding to the user identity parameter. If not, determine that the risk control result is that the risk control is not triggered; if so, execute step S303.

[0129] After determining the parameter value of the user identity parameter in each user identity factor, the parameter value corresponding to the user identity parameter can be compared with the standard value corresponding to the user identity parameter to determine whether the parameter value corresponding to the user identity parameter matches the standard value corresponding to the user identity parameter, thereby determining the risk control result. The result of whether this step matches indicates the calculation result of the risk control factor. A calculation result of TRHE indicates a match, and a calculation result of FALSE indicates a mismatch.

[0130] When the standard value of the user identity parameter is a specific value, if the parameter value of the user identity parameter is the same as the standard value of the user identity parameter or is one of the values, the determination result can be determined to be a match; if the parameter value of the user identity parameter is different from the standard value of the user identity parameter, the determination result can be determined to be a mismatch. When the standard value of the user identity parameter is a value range, if the parameter value of the user identity parameter is within the standard value range of the user identity parameter, the determination result can be determined to be a match; if the parameter value of the user identity parameter is not within the standard value range of the user identity parameter, the determination result can be determined to be a mismatch.

[0131] Since the user identity factors include multiple ones, after matching the user identity parameters included in each user identity factor, the matching results can be summarized to obtain a union of matching results. If one of the matching results in the union is a mismatch, the risk control result is determined to be that the risk control is not triggered; if all the matching results in the union are matches, step S303 can be executed.

[0132] For example, for the business process of placing an order, the risk rule is that if the number of unpaid orders of Li Si the day before is less than 2, then risk control is triggered and the order cannot be placed. Therefore, the user identity factor in the configured risk factor includes the user name is Li Si, and the user behavior factor includes the order status is unpaid and the quantity is less than 2.

[0133] The risk control request includes the business type identifier and the business process identifier, as well as the user name "Li Si". The risk control factor is determined through steps S202 and 203, and the user identity parameter, that is, the parameter value corresponding to the user name, is obtained through step S301, which is Li Si. The expression calculation engine is called to compare and calculate the obtained parameter value Li Si with the standard value of the user identity parameter, that is, Li Si. If the calculation result is determined to be a match between the two, the subsequent steps can be executed to further determine the risk control result.

[0134] S303: Acquire parameter values ​​corresponding to the user behavior parameters according to the user information.

[0135] This step can first determine the list of user behavior factors in the risk control factors. The user behavior factors include user behavior parameters and standard values ​​corresponding to the user behavior parameters. The process of judging each user behavior factor is to obtain the parameter value of the user behavior parameter corresponding to the risk control request, and then compare the parameter value of the user behavior parameter with the standard value of the user behavior parameter to obtain the risk control result. If the risk control request carries the parameter value of the user behavior parameter due to user information, it can be obtained from the interface input parameter when the risk control request is made. If the risk control request does not carry the parameter value of the user behavior parameter due to user information, the parameter value corresponding to the user behavior parameter can be obtained from the cache or through a preset script.

[0136] S304: Determine whether the parameter value corresponding to the user identity parameter matches the standard value corresponding to the user identity parameter. If not, determine that the risk control result is that the risk control is not triggered; if so, determine that the risk control result is that the risk control is triggered.

[0137] After determining the parameter value of the user behavior parameter in each user behavior factor, the parameter value corresponding to the user behavior parameter can be compared with the standard value corresponding to the user behavior parameter to determine whether the parameter value corresponding to the user behavior parameter matches the standard value corresponding to the user behavior parameter, thereby determining the risk control result. The result of whether this step matches indicates the calculation result of the risk control factor. A calculation result of TRHE indicates a match, and a calculation result of FALSE indicates a mismatch.

[0138] When the standard value of the user behavior parameter is a specific value, if the parameter value of the user behavior parameter is the same as the standard value of the user behavior parameter or is one of the values, the determination result can be determined to be a match; if the parameter value of the user behavior parameter is different from the standard value of the user behavior parameter, the determination result can be determined to be a mismatch. When the standard value of the user behavior parameter is a value range, if the parameter value of the user behavior parameter is within the standard value range of the user behavior parameter, the determination result can be determined to be a match; if the parameter value of the user behavior parameter is not within the standard value range of the user behavior parameter, the determination result can be determined to be a mismatch.

[0139] Since there are multiple user behavior factors, after matching the user behavior parameters included in each user behavior factor, the matching results can be summarized to obtain the union of matching results. If one of the matching results in the union is not a match, the risk control result is determined to be that risk control is not triggered; if all the matching results in the union are matches, the risk control result is determined to be that risk control is triggered.

[0140] For example, for the business process of placing an order, the risk rule is that if the number of unpaid orders of Li Si the day before is less than 2, then risk control is triggered and the order cannot be placed. Therefore, the user identity factor in the configured risk factor includes the user name is Li Si, and the user behavior factor includes the order status is unpaid and the quantity is less than 2.

[0141] The risk control request includes a business type identifier and a business process identifier, as well as the user name "Li Si". The risk control factor is determined through steps S202 and 203, and the parameter value of the user identity parameter, that is, the parameter value corresponding to the user name, is obtained through step S301. The expression calculation engine is called to compare and calculate the obtained parameter value Li Si with the standard value of the user identity parameter, that is, Li Si, and determine that the calculation result is a match between the two. Then, the user behavior factor can be obtained through step 303, including the parameter value corresponding to the user behavior parameter, that is, the number of orders with an unpaid order status and an unpaid order status on the previous day. After obtaining the parameter value of the user behavior parameter, the expression calculation engine can be called to compare and calculate the obtained parameter value of the user behavior parameter with the standard value of the user behavior parameter, that is, the number of unpaid orders is less than 2, and then determine the calculation result, that is, determine the risk control result.

[0142] It should be noted that when executing step S301, since there are more than one user identity parameters to be obtained, the parameter value of the user identity parameter can be directly obtained from the interface input parameter corresponding to the risk control request. If it cannot be obtained from the interface input parameter, it needs to be obtained from the scope of Request or Session. If it cannot be obtained from the scope of Request or Session, it is necessary to call the remote interface to obtain it through the groovy script. The groovy script means writing a groovy script for Rpc remote call input parameter assembly and output parameter cleaning. Similarly, the method of obtaining the parameter value of the user behavior parameter in step S303 is the same as the above process.

[0143] Request or Session indicates the scope of the request, that is, the local cache or server cache. For example, multiple risk rules are screened out during a risk control process, and the risk factors included in the multiple risk rules correspond to the same user identity parameter. Therefore, when obtaining the parameter value of the user identity parameter of the previous risk control factor, the remote interface is called through the script to obtain it. In order to avoid calling the remote interface again through the script and reduce the number of RPCs, the parameter value of the obtained user identity parameter is put into the request or Session so that it can be directly obtained from the request or Session for subsequent use.

[0144] Since it is relatively simple to directly obtain the parameter values ​​of the user identity parameters from the interface input corresponding to the risk control request, in order to improve performance, the user identity parameters can be grouped according to the method of obtaining the parameter values ​​of the user identity parameters. Specifically, the user identity parameters directly obtained from the interface input are represented as the CallerInput group as the first group; the user identity parameters obtained from the request or Session are represented as obtained from Request / Session as the second group; and the user identity parameters obtained from the Groovy script are the third group. Specifically, Figure 4As shown. After the user identity parameters are grouped, first obtain the corresponding parameter values ​​for the user identity parameters belonging to the CallerInput group (the first group), and determine whether they match the standard values ​​corresponding to the user identity parameters, that is, execute the calculation process of the risk control factor to obtain the calculation result, and then determine whether there are unmatched results in the matching results, that is, whether the calculation result of the risk control factor includes FALSE. If so, it can be directly determined that the risk control result is that the risk control is not triggered, and no further execution is required. If the corresponding matching results of all user identity parameters belonging to the CallerInput group are all matched, that is, the calculation results of the risk control factors are all TRHE, it means that the parameter values ​​of all user identity parameters belonging to the CallerInput group match the standard values ​​of the user identity parameters, and the user identity parameters obtained in the Request / Session (the second group) need to be processed later.

[0145] Process the user identity parameters belonging to the second group, first obtain the corresponding parameter values ​​from the Request / Session, and determine whether the corresponding parameter values ​​of the user identity parameters obtained in the Request / Session are all obtained from the Request / Session, that is, whether the obtained parameter values ​​are empty.

[0146] If the parameter values ​​corresponding to the user identity parameters are obtained from the Request / Session, it is determined whether the parameter values ​​obtained from the user identity parameters match the standard values ​​of the user identity parameters, that is, the calculation process of the risk control factor is executed to obtain the calculation result, and then it is determined whether there is a mismatched result in the matching result, that is, whether the calculation result of the risk control factor includes FALSE; if the calculation result includes FALSE, it can be directly determined that the risk control result is not triggered, and no further execution is required. If the calculation result does not include FALSE, that is, the calculation results of the risk control factors are all TRHE, the user identity parameters belonging to the third group are processed. At this time, for the user identity parameters belonging to the third group, the parameter values ​​of the user identity parameters are first obtained from the Groovy script, and after obtaining, these user identity parameters are processed as the user identity parameters of the second group, and the processing process of the user identity parameters obtained from the request or Session is executed. If after processing the user identity parameters belonging to the third group, it is determined that the calculation results of the risk control factors are all TRHE, the calculation results can be summarized and it is determined that the final takeover is to trigger the risk control.

[0147] If the corresponding parameter value of the user identity parameter belonging to the second group is not obtained from the Request / Session, it is necessary to obtain it through the Groovy script, that is, to add a batch job to asynchronously execute the Groovy script to obtain the parameter value corresponding to the user identity parameter. After obtaining it, it can be determined whether it needs to be stored in the scope and in which scope. If it needs to be stored, the obtained parameter value is stored in the corresponding scope and then the calculation process of the risk control factor is executed. If it does not need to be stored, the calculation process of the risk control factor is directly executed. After executing the calculation process of the risk control factor, it is determined whether the calculation result includes FALSE; if the calculation result includes FALSE, it can be directly determined that the risk control result is not triggered, and subsequent operations can no longer be executed; if the calculation result does not include FALSE, that is, the calculation results of the risk control factors are all TRHE, then the user identity parameters belonging to the third group are processed. At this time, for the user identity parameters belonging to the third group, first obtain the parameter value of the user identity parameter from the Groovy script. After obtaining it, it can be determined whether it needs to be stored in the scope and which scope to store it in. If it needs to be stored, the obtained parameter value is stored in the corresponding scope and then the calculation process of the risk control factor is executed. If it does not need to be stored, the calculation process of the risk control factor is directly executed. After executing the calculation process of the risk control factor, it is determined whether the calculation result includes FALSE; if the calculation result includes FALSE, it can be directly determined that the risk control result is not triggered, and subsequent operations can no longer be performed. If the calculation result does not include FALSE, that is, the calculation results of the risk control factors are all TRHE, the calculation results can be summarized and it can be determined that the final takeover is triggered risk control.

[0148] Combination Figure 4 The processing of user identity parameters shown and described above can also be used to process user behavior parameters, which will not be described in detail here.

[0149] In order to solve the problems existing in the prior art, an embodiment of the present invention provides a business risk control device 500, such as Figure 5 As shown, the device 500 includes:

[0150] The receiving unit 501 is used to receive a risk control request sent by a business system, where the risk control request includes business process information and user information;

[0151] A screening unit 502 is used to screen the risk rules corresponding to the risk control request according to the business process information;

[0152] A determination unit 503 is configured to determine a risk control factor corresponding to the risk control request according to the risk rule, wherein the risk control factor includes a user identity factor and a user behavior factor;

[0153] The determining unit 503 is further configured to determine a risk control result of the risk control request according to the user information and the risk control factor.

[0154] It should be understood that the manner of implementing the embodiments of the present invention is different from the Figure 2 The method of the illustrated embodiment is the same and will not be described again here.

[0155] In an implementation of the embodiment of the present invention, the user identity factor includes a user identity parameter and a standard value corresponding to the user identity parameter;

[0156] The determining unit 503 is further configured to:

[0157] Acquire, from the user information, a parameter value corresponding to the user identity parameter in the user identity factor;

[0158] Determining whether a parameter value corresponding to the user identity parameter matches a standard value corresponding to the user identity parameter;

[0159] If not, determining that the risk control result is that the risk control request does not trigger risk control;

[0160] If so, the risk control result of the risk control request is determined according to the user information and the user behavior factor.

[0161] In another implementation of the embodiment of the present invention, the user behavior factor includes a user behavior parameter and a standard value corresponding to the user behavior parameter;

[0162] The determining unit 503 is further configured to:

[0163] According to the user information, obtaining a parameter value corresponding to the user behavior parameter;

[0164] Determining whether the parameter value corresponding to the user behavior parameter matches the standard value corresponding to the user behavior parameter;

[0165] If not, determining that the risk control result is that the risk control request does not trigger risk control;

[0166] If so, it is determined that the risk control result is that the risk control request triggers risk control.

[0167] In another implementation of the embodiment of the present invention, the device 500 further includes:

[0168] A judgment unit, used to judge whether to generate a risk event according to risk event parameters;

[0169] A generating unit is configured to, if yes, generate a risk event according to the risk control request and the risk control result.

[0170] In another implementation of the embodiment of the present invention, the business process information includes a business type identifier and a business process identifier;

[0171] The screening unit 502 is specifically configured to screen the risk rules corresponding to the risk control request according to the business type identifier and the business process identifier.

[0172] It should be understood that the manner of implementing the embodiments of the present invention is different from the Figure 2 or Figure 3 The method of the illustrated embodiment is the same and will not be described again here.

[0173] In the embodiment of the present invention, different risk control rules are set according to the business processes of different businesses, and risk control factors corresponding to the business processes are set, so that risk control is performed on each business based on the risk control factors corresponding to the different business processes. In the embodiment of the present invention, risk control of different businesses can be achieved without setting up a risk control system corresponding to each business, thereby reducing the maintenance cost of the risk control system.

[0174] According to an embodiment of the present invention, the present invention also provides an electronic device and a readable storage medium.

[0175] The electronic device of the present invention comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the one processor, and the instructions are executed by the at least one processor so that the at least one processor executes the business risk control method provided in the embodiment of the present invention.

[0176] Figure 6 An exemplary system architecture 600 is shown to which the business risk control method or business risk control device according to the embodiment of the present invention can be applied.

[0177] like Figure 6 As shown, system architecture 600 may include terminal devices 601, 602, 603, network 604 and server 605. Network 604 is used to provide a medium for communication links between terminal devices 601, 602, 603 and server 605. Network 604 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0178] Users can use terminal devices 601, 602, and 603 to interact with server 605 through network 604 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 601, 602, and 603, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only examples).

[0179] The terminal devices 601 , 602 , and 603 may be various electronic devices having a display screen and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, and desktop computers, etc.

[0180] The server 605 may be a server that provides various services, such as a backend management server (only an example) that provides support for shopping websites browsed by users using the terminal devices 601, 602, and 603. The backend management server may analyze and process the received data such as product information query requests, and feed back the processing results (such as product information - only an example) to the terminal device.

[0181] It should be noted that the business risk control method provided in the embodiment of the present invention is generally executed by the server 605 , and accordingly, the business risk control device is generally set in the server 605 .

[0182] It should be understood that Figure 6 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0183] Reference below Figure 7 , which shows a schematic diagram of the structure of a computer system 700 suitable for implementing an embodiment of the present invention. Figure 7 The computer system shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0184] like Figure 7 As shown, the computer system 700 includes a central processing unit (CPU) 701, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 702 or a program loaded from a storage part 708 into a random access memory (RAM) 703. In the RAM 703, various programs and data required for the operation of the system 700 are also stored. The CPU 701, the ROM 702, and the RAM 703 are connected to each other via a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.

[0185] The following components are connected to the I / O interface 705: an input section 706 including a keyboard, a mouse, etc.; an output section 707 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 708 including a hard disk, etc.; and a communication section 709 including a network interface card such as a LAN card, a modem, etc. The communication section 709 performs communication processing via a network such as the Internet. A drive 710 is also connected to the I / O interface 705 as needed. A removable medium 711, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 710 as needed, so that a computer program read therefrom is installed into the storage section 708 as needed.

[0186] In particular, according to the embodiments disclosed in the present invention, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present invention include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 709, and / or installed from the removable medium 711. When the computer program is executed by the central processing unit (CPU) 701, the above-mentioned functions defined in the system of the present invention are executed.

[0187] It should be noted that the computer-readable medium shown in the present invention may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present invention, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present invention, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

[0188] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present invention. In this regard, each box in the flow chart or block diagram can represent a unit, a program segment, or a part of a code, and the above-mentioned unit, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0189] The units involved in the embodiments of the present invention may be implemented by software or hardware. The units described may also be set in a processor, for example, it may be described as: a processor includes a receiving unit, a screening unit, and a determining unit. The names of these units do not constitute a limitation on the units themselves in some cases, for example, the receiving unit may also be described as a "unit of the function of the receiving unit".

[0190] As another aspect, the present invention further provides a computer-readable medium, which may be included in the device described in the above embodiment; or may exist independently without being assembled into the device. The above computer-readable medium carries one or more programs, and when the above one or more programs are executed by a device, the device executes the business risk control method provided by the present invention.

[0191] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions may occur depending on design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A business risk control method, characterized in that: include: Receive a risk control request sent by a business system, wherein the risk control request includes business process information and user information; Filtering risk rules corresponding to the risk control request according to the business process information; Determine, according to the risk rule, a risk control factor corresponding to the risk control request, wherein the risk control factor includes a user identity factor and a user behavior factor, and the user identity factor includes a user identity parameter; Determining the risk control result of the risk control request according to the user information and the risk control factor, including: obtaining parameter values ​​of user identity parameters from interface input parameters, scopes, and scripts corresponding to the risk control request according to the user information, grouping the parameter values ​​according to the acquisition sources, matching the grouped parameter values ​​with the risk control factors in turn, and summarizing the calculation results to determine the risk control result of the risk control request; If there are multiple risk rules screened out, then for each risk rule, a risk control factor corresponding to the risk control request and a risk control result of the risk control request are determined in turn.

2. The method according to claim 1, characterized in that The user identity factor includes a standard value corresponding to the user identity parameter; The determining, according to the user information and the risk control factor, a risk control result of the risk control request includes: Acquire, from the user information, a parameter value corresponding to the user identity parameter in the user identity factor; Determining whether a parameter value corresponding to the user identity parameter matches a standard value corresponding to the user identity parameter; If not, determining that the risk control result is that the risk control request does not trigger risk control; If so, the risk control result of the risk control request is determined according to the user information and the user behavior factor.

3. The method according to claim 2, characterized in that The user behavior factor includes a user behavior parameter and a standard value corresponding to the user behavior parameter; The determining, according to the user information and the user behavior factor, a risk control result of the risk control request includes: According to the user information, obtaining a parameter value corresponding to the user behavior parameter; Determining whether the parameter value corresponding to the user behavior parameter matches the standard value corresponding to the user behavior parameter; If not, determining that the risk control result is that the risk control request does not trigger risk control; If so, it is determined that the risk control result is that the risk control request triggers risk control.

4. The method according to claim 3, characterized in that After determining that the risk control result is that the risk control request triggers risk control, the method further includes: Determine whether to generate a risk event based on risk event parameters; If so, a risk event is generated according to the risk control request and the risk control result.

5. The method according to claim 1, characterized in that The business process information includes a business type identifier and a business process identifier; The screening of risk rules corresponding to the risk control request according to the business process information includes: According to the business type identifier and the business process identifier, the risk rule corresponding to the risk control request is screened.

6. A business risk control device, characterized in that: include: A receiving unit, configured to receive a risk control request sent by a business system, wherein the risk control request includes business process information and user information; A screening unit, configured to screen risk rules corresponding to the risk control request according to the business process information; a determining unit, configured to determine, according to the risk rule, a risk control factor corresponding to the risk control request, wherein the risk control factor includes a user identity factor and a user behavior factor, and the user identity factor includes a user identity parameter; The determining unit is further configured to determine a risk control result of the risk control request according to the user information and the risk control factor; The determining unit is specifically configured to obtain a parameter value of a user identity parameter from an interface input parameter, a scope, and a script corresponding to the risk control request according to the user information, group the parameter values ​​according to the acquisition source, match the grouped parameter values ​​with the risk control factors in turn, and summarize the calculation results to determine the risk control result of the risk control request; If there are multiple risk rules screened out, then for each risk rule, a risk control factor corresponding to the risk control request and a risk control result of the risk control request are determined in turn.

7. The device according to claim 6, characterized in that The user identity factor includes a standard value corresponding to the user identity parameter; The determining unit is further configured to: Acquire, from the user information, a parameter value corresponding to the user identity parameter in the user identity factor; Determining whether a parameter value corresponding to the user identity parameter matches a standard value corresponding to the user identity parameter; If not, determining that the risk control result is that the risk control request does not trigger risk control; If so, the risk control result of the risk control request is determined according to the user information and the user behavior factor.

8. The device according to claim 7, characterized in that The user behavior factor includes a user behavior parameter and a standard value corresponding to the user behavior parameter; The determining unit is further configured to: According to the user information, obtaining a parameter value corresponding to the user behavior parameter; Determining whether the parameter value corresponding to the user behavior parameter matches the standard value corresponding to the user behavior parameter; If not, determining that the risk control result is that the risk control request does not trigger risk control; If so, it is determined that the risk control result is that the risk control request triggers risk control.

9. An electronic device, characterized in that: include: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 5.

10. A computer readable medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 5 is implemented.

Images