A policy processing system and method

Abstract

Embodiments of the present application provide a policy processing system and method. The policy processing method is executed by a rule engine in the policy processing system. The policy processing system includes a rule engine and at least one service module. The rule engine is configured as a service connection point in the policy processing system. The at least one service module is connected to the rule engine and is called by the rule engine. The policy processing method may include: configuring a target security policy for a target business; determining the security services required during the lifecycle of the target security policy; and calling the security services provided by the service module to manage the target security policy. Embodiments of the present application can enhance the specialization and integration of the policy processing process and improve the efficiency of policy processing.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a policy processing system and a policy processing method. Background Art

[0002] Many business scenarios (for example, website login scenarios based on account or face recognition, various online payment scenarios, etc.) involve policy processing. The so-called strategy refers to various rules built on data features, which can solve certain business problems. Policy processing refers to the execution of corresponding security policies to decide whether to respond to the requested business when there is a business request, to avoid malicious registration, account theft, fraud and other problems in the business process, and to ensure business security. Practice has found that there are some problems with the policy processing process involved in the existing technology, such as: ① Insufficient specialization, unable to handle business security issues more comprehensively; ② Insufficient integration, the various services involved in the policy processing process cannot be organically combined, and policy developers need to manually assemble various service requests, which involves a lot of adaptation work; ③ Low efficiency. Summary of the Invention

[0003] The embodiments of the present application provide a policy processing system and method, which can improve the specialization and integration of the policy processing process and improve the efficiency of policy processing.

[0004] In one aspect, an embodiment of the present application provides a policy processing system, which integrates a rule engine and at least one service module; the rule engine is set as a service connection point in the policy processing system, and at least one service module is connected to the rule engine and called by the rule engine; wherein,

[0005] Service module, used to provide security services required during the life cycle of security policies;

[0006] The rule engine is used to configure target security policies for target businesses and manage target security policies by calling security services provided by the service module on demand during the lifecycle of the target security policies.

[0007] In one embodiment, the policy processing system includes a logic layer, in which a rule engine and at least one service module are both arranged; a plug-in set is provided in the rule engine, which includes multiple plug-ins, and one plug-in corresponds to one service module; the rule engine obtains the security service provided by the service module by calling the plug-in in the plug-in set.

[0008] In another embodiment, the target security policy is composed of at least one rule; the rule engine includes a rule data management module, and the rule data management module is used to configure at least one rule of the target security policy for the target service.

[0009] In another embodiment, the target security policy is composed of at least one rule; the rule engine includes a rule engine core module, and the rule engine core module is provided with a resource management submodule, a synchronous service submodule and an asynchronous service submodule;

[0010] The resource management submodule is used to call at least one test instance to test at least one rule of the target security policy, and release the target security policy when all rules of the target security policy pass the test;

[0011] The synchronization service submodule is used to match the target security policy for the target business when the management system receives the target business request;

[0012] The asynchronous service submodule is used to execute the target security policy;

[0013] Among them, the target security policy includes a first version identifier and a second version identifier. The first version identifier is used to identify the first version of the target security policy, and the first version refers to the latest version released by the resource management sub-module; the second version identifier is used to identify the second version of the target security policy; the second version refers to the version historically released by the resource management sub-module; the resource management sub-module is also used to perform version management on the target security policy, and version management includes any of the following: grayscale processing, interruption, and rollback.

[0014] In another embodiment, the service module includes a user feedback and policy evaluation service module, which is provided with a unified feedback interface. The user feedback and policy evaluation service module receives user feedback information related to the target business through the unified feedback interface, and evaluates the accuracy of the target security policy on the target business based on the user feedback information.

[0015] The rule engine calls the user feedback and policy evaluation service module through the plug-in to obtain the judgment accuracy and manage the target security policy based on the judgment accuracy.

[0016] In another embodiment, the service module includes a general security capability service module, which is used to extract general security processing logic from multiple business scenarios to form a general security capability service; the general security capability service includes at least one of the following: frequency service, keyword matching service, natural language processing service, image similarity judgment service, and anti-cheating detection service;

[0017] The rule engine calls the general security capability service provided by the general security capability service module through the plug-in to configure and execute the target security policy for the target business.

[0018] In another embodiment, the service module includes at least one of the following: a data warehouse service module, a machine learning platform service module, a streaming computing service module and a data analysis service module; the rule engine calls the data warehousing service provided by the data warehouse service module through a plug-in, calls the machine learning service provided by the machine learning platform service module through a plug-in, calls the streaming computing service provided by the streaming computing service module through a plug-in, and calls the data analysis service provided by the data analysis service module through a plug-in, and the rule engine calls the various security services obtained to configure the target security policy for the target business, and execute the target security policy.

[0019] In another embodiment, the policy processing system further includes a web operation module;

[0020] A web operation module is used to display a web page, obtain data features of the security policy configured for the target business in the web page, and transmit the data features to the rule engine so that the rule engine can use the data features to configure the target security policy for the target business; and

[0021] The web operation module is also used to receive various management data in the life cycle of the target security policy returned by the rule engine and display the various management data on the web page.

[0022] In another embodiment, a web page displays a first list including a plurality of business types;

[0023] When a target service type is selected in the first list, a second list is displayed on the web page, the second list including multiple service identifiers belonging to the target service type;

[0024] When the target business identifier is selected, a policy configuration window is displayed on the web page, and the web operation module obtains data features of the security policy configured for the target business from the policy configuration window.

[0025] In another embodiment, the policy processing system is connected to a service system, the service system is used to process multiple services requested by Internet users, and the target service is any one of the multiple services;

[0026] The policy processing system includes an access layer, which provides a unified access interface. Various services in the business system are connected to the policy processing system through the unified access interface.

[0027] When the business system detects a target business request, it forwards the target business request to the rule engine. The rule engine matches the target security policy for the target business and executes the target security policy to obtain the execution result. The rule engine returns the execution result of the target security policy to the business system, and the business system makes a decision response to the target business request based on the execution result of the target security policy.

[0028] In another embodiment, the policy processing system includes a storage layer, the storage layer includes a storage module, and the storage module is used to provide storage support for the rule engine and service module; the storage module includes at least one of the following modules: a data warehouse, a data analysis storage module, a policy rule storage module, and a request flow storage module.

[0029] In another aspect, an embodiment of the present application provides a policy processing method, which is executed by a rule engine in a policy processing system. The policy processing system includes a rule engine and at least one service module. The rule engine is configured as a service connection point in the policy processing system, and the at least one service module is connected to the rule engine and called by the rule engine. The policy processing method includes:

[0030] Configure target security policies for target businesses;

[0031] Identify the security services required during the lifecycle of the target security strategy;

[0032] Call the security services provided by the service module to manage the target security policy.

[0033] On the other hand, an embodiment of the present application provides a policy processing device, which is equipped with the policy processing system described above.

[0034] In an embodiment of the present application, the policy processing system integrates a rule engine and at least one service module, wherein at least one service module includes a service module corresponding to each link in the policy life cycle, so that the policy processing system integrates all security services required in the life cycle of the security policy, improves the integration of the policy processing system, and thus improves the efficiency, effectiveness and quality of the policy processing system; the rule engine is set as a service connection point in the policy processing system, connecting the various service modules in the policy processing system together, and calling the security services provided by each service module to configure the target security policy for the target business, so that the rule engine can automatically generate and execute security policies by calling each service module, so that the security policy can be intelligently and automatically executed from each link of the configuration, implementation, and online process, thereby improving the professionalism and efficiency of the policy processing process. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the description of the embodiments. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0036] Figure 1 A schematic diagram of an analysis of a real-time policy life cycle provided by an exemplary embodiment of the present application is shown;

[0037] Figure 2 A schematic diagram illustrating implementation of various links in a life cycle of a real-time strategy provided by an exemplary embodiment of the present application is shown;

[0038] Figure 3 A schematic diagram of the architecture of a policy processing system provided by an exemplary embodiment of the present application is shown;

[0039] Figure 4a A schematic diagram of a web page provided by an exemplary embodiment of the present application is shown;

[0040] Figure 4b A schematic diagram of a web page provided by another exemplary embodiment of the present application is shown;

[0041] Figure 4c A schematic diagram of a web page provided by another exemplary embodiment of the present application is shown;

[0042] Figure 5 A schematic diagram of the structure of a rule engine provided by an exemplary embodiment of the present application is shown;

[0043] Figure 6 A schematic diagram showing a feedback information source provided by an exemplary embodiment of the present application is shown;

[0044] Figure 7 A schematic diagram showing the structure of a data analysis service module provided by an exemplary embodiment of the present application is shown;

[0045] Figure 8 A schematic diagram of the structure of a machine learning platform service module provided by an exemplary embodiment of the present application is shown;

[0046] Figure 9 A schematic structural diagram of a stream computing service module provided by an exemplary embodiment of the present application is shown;

[0047] Figure 10 A schematic structural diagram of a data warehouse service module provided by an exemplary embodiment of the present application is shown;

[0048] Figure 11 A flowchart illustrating the working principle of a policy processing system provided by an exemplary embodiment of the present application is shown;

[0049] Figure 12 A schematic diagram of importing a rule engine into a data warehouse table provided by an exemplary embodiment of the present application is shown;

[0050] Figure 13 A schematic diagram of a security policy online process provided by an exemplary embodiment of the present application is shown;

[0051] Figure 14 A schematic diagram showing a data analysis result provided by an exemplary embodiment of the present application is shown. DETAILED DESCRIPTION

[0052] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0053] The embodiments of the present application involve policies. The so-called policies (also known as security policies) refer to various rules built on data features, which can solve certain business problems. The so-called rules refer to the laws followed by the operation and action rules. Here, business problems may include but are not limited to malicious registration, account theft, fraud, etc. A business can correspond to one or more security policies. For example, the login business of an instant messaging application can correspond to security policy 1 and security policy 2. Security policy 1 is used to solve the problem of account theft; security policy 2 is used to solve the problem of fraud. A security policy consists of N (N is a positive integer) rules; for example, taking the above-mentioned security policy 1 as an example, security policy 1 includes a login location rule and a plug-in rule. The two rules can be executed separately or in parallel to obtain a decision result, or they can be executed in combination to obtain a decision result; specifically: the login location rule is executed to determine whether the location of the login device is a common login location. If it is, it can be determined that the risk of account theft is low; if the location of the login device is not a common login location, it can be determined that the risk of account theft is medium (or high). In addition, when the location of the login device is not a common login location, it can also be judged in combination with the plug-in rules. If the login device does not use plug-ins, it is determined to be a medium risk of account theft. If plug-ins are used, it is determined to be a high risk of account theft.

[0054] A strategy has a life cycle, which includes: problem -> analysis -> implementation -> implementation -> effect evaluation. The strategy life cycle will be continuously iterated as the problem changes or the evaluation effect is insufficient. Therefore, the strategy is also called a real-time strategy. Figure 1 , Figure 1 FIG. 1 shows an analysis diagram of a real-time policy life cycle provided by an exemplary embodiment of the present application; FIG. Figure 1 As shown in Figure 2, the lifecycle of a real-time strategy can be broken down into the following process steps: data feature collection, data analysis, model training and prediction, strategy formulation and implementation, strategy rollout, and evaluation and feedback. Each step is interconnected to form a closed loop, influencing each other and iterating continuously, and working cyclically. Figure 2 , Figure 2 The following is a schematic diagram illustrating the implementation of various links in the life cycle of a real-time policy provided by an exemplary embodiment of the present application; wherein: (1) Data feature collection: The collection and calculation of data features can be achieved by calling various services. The data features here include but are not limited to various business features required for the formulation of security policies (such as business volume features, business location features, business distribution features, etc.), user features (such as user name, password, user usage data features of the business), etc. The various services called here may include but are not limited to: a unified data collection service (this service can realize the data features configured by the policy developer collected uniformly from the web page), a data warehouse service (this service can provide historically stored business features or user features), a data feature calculation service (this service is used to provide calculation services or streaming calculation services on various data features), etc. (2) The data analysis link mainly analyzes the collected data features (such as basic data statistics, anomaly detection, etc.) to obtain analysis results to help formulate and implement rules or models; (3) The model training and prediction link mainly creates or trains some models by calling some general machine learning platforms to provide machine learning service capabilities for the policy processing process; (4) The policy formulation and implementation link, which can automatically generate and implement policies through the rule engine involved in the embodiment of this application; (5) The policy launch link, which publishes the generated security policy in accordance with the standard policy launch process; (6) The evaluation and feedback link, which can use user feedback to evaluate the rationality and execution effect of the security policy. The embodiment of this application provides a policy processing system (i.e., Figure 3The policy processing system organically connects and combines the various links in the life cycle of the above-mentioned real-time policy (1)-(6), and integrates them into the policy processing system; in addition, the common logic of each link is abstracted into a unified service, so that each business scenario can reuse the common service, effectively improving the efficiency of policy processing in the business scenario. In addition, the policy processing system also provides a unified access layer, which connects each business of different business scenarios to the policy processing system to make unified security policy decisions for each business; at the same time, the rule engine is optimized. The rule engine serves as the service connection point of each service and integrates the functional services of each link in the real-time policy life cycle; and the policy processing system also establishes a friendly web workbench, so that the overall process of the policy processing process can be managed visually. Through the policy processing system of the embodiment of the present application, the data and technology of each link in the policy life cycle can be deposited into a unified policy platform, and unified and standardized management can be carried out, effectively improving the efficiency and effect of policy processing.

[0055] The policy processing system proposed in the embodiment of the present application will be described in detail below with reference to the accompanying drawings.

[0056] Figure 3 FIG1 shows an architecture diagram of a policy processing system provided by an exemplary embodiment of the present application; the policy processing system can be called a policy processing platform, a policy platform, a real-time policy platform, etc. Figure 3 As shown in Figure 1, the policy processing system is mainly divided into multiple hierarchical structures, which are: access layer, logic layer and storage layer from top to bottom. In addition, the policy processing system also includes a web operation module;

[0057] 1. Web operation module:

[0058] The web operation module is used to establish a friendly web workbench for policy developers. Specifically, the web operation module can display a web page, which can provide at least one of the following functions: ① Security policy registration and editing functions; policy developers can configure or edit security policies for businesses in the web page; ② Functional plug-in management function. The web operation module provides policy developers with a variety of functional plug-ins. These functional plug-ins can, for example, be plug-ins that encapsulate various general services extracted from the policy processing system. Policy developers can call these functional plug-ins to obtain general services, thereby simplifying the configuration process of security policies; ③ Data warehouse feature management function. This function can provide policy developers with some data or features required in the policy development process to facilitate policy development; in addition, it can also collect data features of security policies configured by policy developers in the web page and manage these data features; ④ Data analysis visualization function, used to present policy ⑤ The interactive function of the machine learning process enables policy developers to clearly understand the machine learning methods (or models) used to generate or execute security policies, and also allows policy developers to input interactive information for the machine learning process; ⑥ The online process function provides an online confirmation component, such as an online interface. After completing the configuration of the security policy, the policy developer can submit a policy online request through the online confirmation component, and can browse the progress and specific process of the policy online on the web page; ⑦ Feedback and evaluation function, which is used to output user feedback information received by the policy processing system, and output the evaluation results of the policy management system on the effectiveness of the security policy; ⑧ The dashboard report function supports the output of security policy evaluation results in the form of reports, which is convenient for policy developers to intuitively view the effectiveness of the security policy and assist policy developers in modifying or optimizing the security policy based on the dashboard report. In summary, the web operation module is used to web-based all the displays and operations required in the policy life cycle, improving the usability and manageability of policy analysis, formulation and launch. For any new business connected to the policy processing system, policy developers can complete all the policy-related work corresponding to the new business (including data acquisition and analysis, policy formulation and launch, user feedback and evaluation, etc.) through the web pages provided by the web operation module.

[0059] Figure 4a FIG. 1 shows a schematic diagram of a web page provided by an exemplary embodiment of the present application; FIG. Figure 4aAs shown, web page 400 displays a first list 4001, which includes multiple business types (e.g., business type 1, business type 2, etc. shown in the figure); business types here may include but are not limited to: account type, payment type, open platform type, etc. When the target business type in first list 4001 (e.g., business type 1 in the figure) is selected, web page 400 displays a second list 4002, which includes multiple business identifiers belonging to the target business type (e.g., business identifier 1, business identifier 2, etc. shown in the figure). Each business identifier is used to uniquely identify a scenario business under the target business type, for example: business identifier 1 is used to identify the login scenario business under the account type, business identifier 2 is used to identify the new account registration scenario business under the account type, and so on. When a target service identifier (e.g., service identifier 1 in the figure) is selected, a policy configuration window is displayed on web page 400. In this window, the policy developer can configure a security policy for the service scenario identified by service identifier 1. Specifically, the web operation module is used to obtain the data features of the security policy configured for the service scenario from the policy configuration window and transmit the data features to the rule engine, which then uses the data features to configure a target security policy for the target service. Furthermore, the web operation module is used to receive various management data from the rule engine during the lifecycle of the target security policy and display the management data on the web page.

[0060] Figure 4b and Figure 4c A schematic diagram of a web page provided by another exemplary embodiment of the present application is shown; Figure 4bAs shown, web page 400 displays a policy configuration window 4003, which can be divided into areas 4031, 4032, and 4033. Area 4031 includes a node list, which includes a basic node area and a plug-in node area. The basic node area includes a start node, a judgment node, and a return node. The plug-in node area includes plug-ins (such as test plug-ins and text type analysis plug-ins) formed by common services extracted by the policy processing system. It should be noted that for a rule, nodes in the basic node area are required nodes, while nodes in the plug-in node area are optional nodes. Since a business scenario can contain multiple rules, there are multiple start nodes. Multiple rules form multiple rule trees. When executing a security policy, each rule tree is executed. During execution, logical judgment is performed at the judgment node to obtain the execution result. The execution result is returned to the business system via the return node. Area 4032 is used to display the security policy rules. It supports displaying the rule tree list, expression display, layout display, rule source code, and fields within the rule. It also supports keyword search. Area 4033 is used to edit the properties of each node in the rule, such as creating a new node or sub-node, configuring and modifying node parameters, etc., and is also used to receive the logical conditions entered by the strategy developer. Figure 4b Configure the security policy in the policy configuration window 4003 shown, for example Figure 4b As shown in the example, the policy developer selects nodes in area 4031 in turn as needed, and can enter data features of the security policy (including node attributes and logical conditions) in area 4033; these data features will be collected by the web operation module and synchronized to the rule engine in the policy processing system, and the policy generated by the rule engine can be viewed in area 4032. Figure 4c The policy configuration window in Figure 4b The relevant description in is not repeated here.

[0061] 2. Access layer:

[0062] The access layer is the bridge between the policy processing system and the business system. Among them, the business system refers to the system that can provide business services to Internet users. The business system can include multiple businesses in various business scenarios, such as Figure 3In the example, the business system includes business A, business B, and business C. Business A can refer to the login service in the instant messaging application scenario; business B can refer to the payment service in the payment scenario; business C can refer to the virtual prop purchase service in the game scenario, and so on. The access layer provides a unified access interface that complies with the interface standard specifications of the policy processing system. The policy processing system can connect with the business system through the unified access interface provided by the access layer. Specifically, the policy processing system can provide access guidance to the business system. The business system can connect various services to the policy processing system through the unified access interface provided by the access layer in accordance with the access guidance. This can improve the efficiency of business access. In the specific implementation, the policy developer configures the security policy for the target business in the web workbench. The target business can be accessed to the policy processing system through the access layer. When the business system sends a request for the target business to the policy processing system, the policy processing system is triggered to execute the security policy corresponding to the target business and return the execution result of the security policy to the business system. The business system can then decide how to execute the target business based on the execution result of the security policy. For example, if the target business is a login scenario business, the user in the business system requests to log in to the business system, and the business system forwards the request for the login business to the policy processing system. The policy processing system executes the anti-theft security policy in the login request and returns the execution result of the security policy to the business system. If the security policy execution result indicates that the login request has a low risk of account theft, the business system can decide to respond to the user's login request; if the security policy execution result indicates that the login request has a high risk of account theft, the business system can decide to reject the user's login request.

[0063] 3. Logical layer:

[0064] The logic layer is the core of the policy processing system. It includes a rule engine and one or more service modules required for each phase of the policy lifecycle. These service modules provide the security services required throughout the security policy lifecycle. At the core of the logic layer is the rule engine, which configures target security policies for target businesses and manages them by invoking the security services provided by the service modules as needed during the target security policy lifecycle. The rule engine serves as the service connection point in the policy processing system. At least one of the service modules is connected to the rule engine and invoked by it to configure and manage security policies. The rule engine separates security policies from code, making it easier to change and modify security policies. The rule engine can be implemented using Lua (a scripting language), Drools (an open source rule engine written in Java), Groovy (an agile development language based on the JVM (Java Virtual Machine)), or Haskell (a standardized, general-purpose, purely functional programming language). All policies are inseparable from rules. From the perspective of the policy lifecycle, the prediction results obtained by the model trained by machine learning can also be converted into rules for processing. The objects of online launch, evaluation and feedback are policies, that is, N rules. It can be seen that rules are an indispensable factor in the policy lifecycle and can run through the entire policy lifecycle. Therefore, the policy processing system selects the rule engine as the service connection point to integrate various security services in the policy processing system.

[0065] Figure 5 FIG. 1 shows a schematic diagram of a rule engine structure provided by an exemplary embodiment of the present application; FIG. Figure 5As shown, the rule engine 500 includes a rule data management module 5001 and a rule engine core module 5002. The rule data management module 5001 is used to configure at least one rule of the target security policy for the target business based on the data characteristics sent by the web operation module (i.e., the data characteristics of the target security policy configured by the policy developer in the web workbench). The rule data management module 5001 synchronizes the generated rules with the rule engine core module 5002. Furthermore, the rule data management module 5001 sends the generated rules to the rule storage module (located in the storage layer) for storage. The rule engine core module 5002 includes a resource management submodule 5021, a synchronous service submodule 5022, and an asynchronous service submodule 5023. The resource management submodule 5021 is used to receive at least one rule of the target security policy synchronously sent by the rule data management module 5001 and invoke at least one test instance (which can be obtained from the network or pre-existing in the policy processing system) to test the at least one rule of the target security policy. Once all rules of the target security policy pass the test, the target security policy is published (i.e., the target security policy is validated in the rule engine). Among them, the target security policy includes a first version identifier and a second version identifier. The first version identifier is used to identify the first version of the target security policy, and the first version refers to the latest version released by the resource management sub-module; the second version identifier is used to identify the second version of the target security policy; the second version refers to the version historically released by the resource management sub-module; then the resource management sub-module 5021 is also used to perform version management on the target security policy, and version management includes any of the following: grayscale processing, interruption, and rollback. Taking the resource management sub-module 5021 as an example, which performs rollback management on each version of the target security policy according to the version identifiers of the target security policy, the first version identifier of the target security policy is FSHshj8.3, and the second version identifier is FSHshj8.2; if an execution failure occurs after the target security policy of version FSHshj8.3 takes effect, or it is evaluated that its execution effect does not meet expectations, the target security policy of version FSHshj8.3 needs to be deactivated, and the version of the target security policy needs to be rolled back to FSHshj8.2. The means of rollback processing here can be to delete version FSHshj8.3, or to update and release the target security policy of version FSHshj8.2, so that the version identifier is updated from FSHshj8.2 to FSHshj8.4; through this update and release, the updated second version identifier (FSHshj8.4) becomes the new first version identifier.In addition, after the target security policy is released, the policy processing system can receive user feedback information. The resource management submodule 5021 is also used to obtain the target security policy's judgment accuracy for the target business and manage the target security policy based on the judgment accuracy, wherein the judgment accuracy can be in the form of a fraction (such as 1 / 3), a percentage (20%), or a ratio (2:3), etc., which is not limited in the embodiment of the present application. Among them, the synchronous service submodule 5022 is used to match the target security policy for the target business when the policy processing system receives a target business request (obtaining the latest version of the security policy that matches the target business from the resource management submodule 5021), and sending the latest version of the target security policy to the asynchronous service submodule 5023 for execution.

[0066] The rule engine 500 also includes a plug-in set, which contains multiple plug-ins, one for each service module. The rule engine invokes the plug-ins in the plug-in set to obtain security services provided by the service modules. These security services may include, but are not limited to, at least one of the following: data warehousing services, frequency services, keyword matching services, natural language processing services, image similarity determination services, anti-cheating detection services, data analysis services, streaming computing services, and machine learning services. A plug-in (also known as addin, add-in, addon, or add-on) is a program written using a standardized application programming interface (API) that allows access to service modules. Plug-ins (or functional plug-ins) can be of two types: logical operation plug-ins, which encapsulate data operation logic for solving common problems, such as a scorecard function that calculates the number of outliers; and RPC plug-ins, which encapsulate RPC inputs and outputs. Examples include data warehouse reading plug-ins, Zhuge ML plug-ins for calling machine learning modules, and keyword matching plug-ins. For example, when the rules under a policy require multiple data from the data warehouse, RPC plug-ins can concurrently access multiple data through multiple plug-ins, improving overall processing efficiency. The security services required for different stages in the policy life cycle are different. Specifically: (1) The security services required for the data feature collection stage may include data warehousing services, streaming computing services (data feature computing services, complex feature computing services), etc.; (2) The security services required for the data analysis stage may include image similarity judgment services, anti-cheating detection services, data analysis services, frequency services, keyword matching services, etc.; (3) The services required for the model training and prediction stage may include machine learning services, which can provide offline training and real-time prediction services; (4) The services required for the strategy formulation and implementation stage and the strategy online stage may include data warehousing services, data analysis services, etc.; (5) The services required for the feedback and evaluation stage may include user feedback and strategy evaluation services, strategy management services, etc., which can quickly discover the effectiveness of the strategy based on user feedback information.

[0067] As mentioned above, the rule engine uses plug-ins to access the security services provided by service modules to configure and enforce target security policies for target businesses, improving the management efficiency of these policies. The following sections use the user feedback and policy evaluation service module, data analysis service module, machine learning platform service module, streaming computing service module, data warehouse service module, and general security capability service module as examples to explain the security services provided by each service module.

[0068] 1) User feedback and strategy evaluation service module:

[0069] The user feedback and policy evaluation service module is used to provide user feedback services. Specifically, the user feedback and policy evaluation service module is provided with a unified feedback interface. The user feedback and policy evaluation service module receives user feedback information related to the target business through the unified feedback interface, and evaluates the judgment accuracy of the target security policy on the target business based on the user feedback information. Correspondingly, the resource management submodule 5021 included in the rule engine can call the judgment accuracy of the target business in the user feedback and policy evaluation service module through a plug-in, and perform version management on the target security policy based on the judgment accuracy. Among them, the feedback information may include: complaint feedback from users of the target business after being hit by security attacks, and user reporting feedback on some suspicious and malicious activities. See Figure 6 , Figure 6A schematic diagram of a feedback information source provided by an exemplary embodiment of the present application is shown. In addition, the user feedback and policy evaluation service module is also used to actively send feedback. The so-called active feedback means that when the policy processing system sends a strike message, the rule engine sends a notification message to the struck user; the user can view the reason for the strike through the notification message and fill in the feedback; and the feedback is returned to the policy processing system so that the policy processing system can determine whether the strike is a false positive. Taking the instant messaging security scenario as an example, in the web page displayed by the web operation module, the user can actively check whether to enable the policy processing system to actively send feedback in the instant messaging security scenario; if checked, when the rule engine strikes the target business, the rule engine sends a notification message to the struck user through the asynchronous service submodule 5023, wherein the notification message includes the reason for the strike and a feedback page link; the user can submit feedback (such as a feedback form) by clicking the feedback page link; accordingly, the policy processing system determines whether the strike is a false positive based on the feedback; if it is a false positive, the policy processing system can optimize the security policy to improve the accuracy of the strike and improve the user experience. In addition, the User Feedback and Policy Evaluation Service module also supports policy evaluation services. Policy evaluation includes: ① User feedback evaluation, which is conducted using data from the user feedback system. ② Manual sorting evaluation, which involves randomly sampling security policy rules for both offenses and omissions, and manually reviewing and confirming false positives and omissions. This process is supported by the sorting system. Due to limited manpower, manual sorting is typically performed on a dedicated basis or as a routine process at a preset interval (e.g., once a month). ③ Self-built audit model evaluation, in which security policy operators create their own audits for both malicious and benevolent actors. The policy processing system provides a standard for storing the resulting data. Once the results are stored, the policy processing system automatically calculates accuracy and coverage based on the offense data. Furthermore, the policy processing system can automatically generate security policy reports based on the policy evaluation results. These reports may include, but are not limited to, target business volume, offense volume for the target business, audit volume for the target business, user complaints, offense accuracy, and offense coverage. In addition, in addition to generating security policy reports, the policy processing system also supports generating reports on security policy rules. For example, a report is generated for a rule with the smallest granularity of the security policy. The rule report contains information including but not limited to: the number of strikes for this rule, the number of complaints, the accuracy of manual sorting, etc.

[0070] The user feedback and policy evaluation module can also receive feedback from the business system after executing the target business's security policy and analyze or manually evaluate the feedback to determine whether the execution result is a misjudgment. In this implementation, the policy processing system also involves user feedback, policy evaluation, and automatic report generation. For details, please refer to the relevant description of the above embodiment and will not be repeated here.

[0071] 2) Data analysis service module:

[0072] The data analysis service module is used to provide data analysis services. Specifically, the data analysis service module is used to perform data analysis on information such as data or business requests in the policy processing system, and output the data analysis results to the web operation module, which is then displayed on the web page. The data analysis service module includes at least one data analysis method, and the data analysis service module uses the data analysis method to perform the above-mentioned data analysis, wherein the data analysis method may include but is not limited to statistics, analysis, trend changes, anomaly detection and other methods. In addition, the data analysis service module itself contains request and return data, certification data and other data. Therefore, the data analysis service module can also be used for daily operation complaint inquiries, etc. See Figure 7 , Figure 7 FIG. 1 shows a schematic diagram of a data analysis service module provided by an exemplary embodiment of the present application; FIG. Figure 7 As shown, the data analysis service module 700 can be used to support multiple services provided by the web operation module (pulling full data warehouse services, providing packaged analysis method services, visualization services, and SQL statement services). The data analysis service module includes an analysis logic submodule, a data storage MQ submodule, and an underlying storage submodule (such as Elasticsearch), wherein the analysis logic submodule is used to manage data analysis methods. Specifically, the analysis logic submodule can be used to continuously increase, precipitate, and share data analysis methods; the data storage MQ submodule is used to receive and store data features sent by the rule engine, wherein the data features can be configured and generated by the policy developer in the web page, or the data features are data features that are associated with the data features provided by the policy developer and pulled by the rule engine by calling the data warehouse service module, or the data features are data features that are associated with the data features provided by the policy developer and pulled by the data analysis service module from the data analysis storage module; the underlying submodule (such as Elasticsearch) is used for data query or statistics, which can achieve data query or statistics at a speed of seconds, thereby improving the data analysis rate.

[0073] 3) Machine Learning Platform Service Module:

[0074] The machine learning platform service module is used to provide machine learning services. Specifically, the machine learning platform service module is used to train sample data using multiple algorithms to obtain a training model. When data is input next time, the prediction results for the input data can be directly obtained based on the training model. Figure 8 , Figure 8 FIG. 1 shows a structural diagram of a machine learning platform service module provided by an exemplary embodiment of the present application; FIG. Figure 8 As shown, the machine learning platform service module 800 includes a sample system and a machine learning platform (such as the Zhuge machine learning platform), wherein the sample system is used to receive positive and negative samples provided by the data analysis service module, so that the machine learning platform can perform model training based on the positive and negative samples to obtain training results. The machine learning platform is used to receive requests sent by the rule engine, and make predictions based on the data carried in the request, obtain prediction results and return them to the rule engine, and the rule engine generates security policies based on the prediction results.

[0075] 4) Streaming computing service module:

[0076] The stream computing service module is used to provide stream computing services. For large regular behavior streams, it is necessary to count the frequency of data of various dimensions, perform feature calculations across different dimensional data, and identify certain behavior patterns. This requires stream computing. Specifically, the stream computing service module is used to analyze large-scale flow data in real time and capture potentially useful information. Figure 9 , Figure 9 FIG. 1 shows a structural diagram of a stream computing service module provided by an exemplary embodiment of the present application; FIG. Figure 9 As shown, the streaming computing service module 900 includes a data generation submodule, a data consumption submodule, a kafka submodule and a flink submodule. Among them, the production data submodule is used to receive the business request sent by the rule engine and the business data stream (such as MMData business data) sent by the data warehouse, and the production data submodule is also used to forward the business request and the business data stream to the kafka submodule. The kafka submodule is used to forward the business request and the business data stream to the flink submodule, and the kafka submodule is also used to send the calculation results from the flink submodule to the data consumption submodule. The flink submodule is used to calculate the business request and the business data stream, and write the calculation results to the kafka submodule. The data consumption submodule is used to call the rule engine to configure the security policy, and the data consumption submodule is also used to store the calculation results in the data warehouse for use by other service modules.

[0077] 5) Data warehouse service module:

[0078] The data warehouse service module is used to provide data warehouse services. For massive amounts of data, a reasonable data management specification is often needed to manage the data and its characteristics. This is to put all valuable data and its characteristics together using a unified data management specification. This requires data warehouse services. Figure 10 , Figure 10 FIG. 1 shows a schematic diagram of a data warehouse service module provided by an exemplary embodiment of the present application; FIG. Figure 10 As shown, the data warehouse service module 1000 is used to support multiple services provided by the web operation module (feature management service, feature query service and feature analysis service); the data warehouse service module includes an interface layer and a read-write layer, wherein the interface layer is used to standardize the format of data read into the data warehouse, or convert the data type of the data read into the data warehouse into the data type required by the data warehouse, and the read-write layer is used for real-time reading and writing or offline writing and real-time reading, which can realize standardized management of data and truly give play to the advantages of big data.

[0079] 6) General security capability service module:

[0080] The general security capability service module is used to provide general security capability services. If multiple business scenarios all require natural language processing, keyword matching processing and other processing logic, assuming that the general security processing logic is abstracted into a unified general security service, then the policy developer does not need to provide the above processing logic for each business scenario, which can reduce the workload of the policy developer and improve work efficiency. Based on this, the embodiment of the present application provides a general security capability service module, which is used to extract the general security processing logic in multiple business scenarios to form a general security capability service; wherein, the general security capability service includes at least one of the following: frequency service, keyword matching service, natural language processing service, image similarity judgment service, anti-cheating detection service, etc.

[0081] 4. Storage layer:

[0082] The storage layer is used to store data. Specifically, the storage layer includes multiple storage modules, each of which is used to store data of different data types. The storage modules in the storage layer may include, but are not limited to, a data warehouse, a data analysis storage module, a policy and rule storage module, and a request flow storage module. The data warehouse (DW or DWH) is the structured data component of decision support systems (DSSs) and online analytical application data sources. The data warehouse uses a set of data management specifications to categorize and manage the data in the data warehouse, which facilitates development and data sharing. The data in the data warehouse may include user information (account information, user friend address books, groups, etc.), device information (device identification), and other data. These storage modules in the storage layer provide storage support for the rule engine and service modules in the logic layer. Specifically, the rule engine can call the data warehouse service module through a plug-in and access data in the data warehouse through the data warehouse service module. The data analysis storage module can be used to store data output by the data analysis service module (such as data analysis results). The rule engine can call the data analysis service module through a plug-in and access data in the data analysis storage module through the data analysis service module. The policy and rule storage module can be used to store security policies, their individual rules, and so on. The rule engine can store successfully configured security policies in the policy and rule storage module. The request log storage module can be used to store historical service request information (e.g., service request time, device ID, etc.). When the rule engine's synchronization service submodule 5022 receives a service request, it can store the service request in the request log storage module.

[0083] Based on the aforementioned policy processing system, the following will be combined Figure 11 The working principle of the policy processing system is introduced in detail. Figure 11 A flowchart illustrating the working principle of a policy processing system provided by an exemplary embodiment of the present application is shown. The flowchart may include the following steps S1101-S1106, wherein the policy processing method described in steps S1103-S1105 may be executed by a rule engine in the policy processing system, wherein:

[0084] S1101, the web operation module displays a web page.

[0085] S1102: The web operation module obtains data features of the target security policy configured for the target business in the web page.

[0086] The policy processing system can open permissions to policy developers, allowing them to use the policy processing system. When a policy developer enters the policy processing system, he or she can see Figure 4a The web page shown in the following example. Figure 4aSelect the target business ID on the web page shown and enter Figure 4b In the policy configuration window shown, a target security policy is configured for a target business. The web operation module obtains the first data feature of the target security policy configured by the policy developer from the policy configuration window.

[0087] S1103: The rule engine configures a target security policy for the target business.

[0088] Specifically, the rule engine configures the target security policy for the target business based on the data features. The data features include a first data feature and a second data feature. The first data feature is the data feature carried in the request sent by the web operation module to the rule engine (obtained by the web operation module from the policy configuration window); the second data feature is a data feature obtained from the storage module in the storage layer (such as a data warehouse) and has an associated relationship with the first data feature. The request sent by the web operation module to the rule engine mentioned above is composed of a basic request (such as baserequest) and a computer command (such as map). Baserequest includes basic fields such as uin, touin, clientip, deviceid, etc. The key in the map is the variable name, and the value is the variable value. Common data types are supported, including integer, floating point, string, etc.

[0089] In one implementation, a rule engine may configure a target security policy for a target business by: receiving a first data feature of the target security policy configured for the target business, collected by a web operations module via a web page; the rule engine may invoke a streaming computing service module via a plug-in to perform streaming computing on the first data feature, obtaining a streaming computing result; the rule engine may invoke a data warehouse service module via a plug-in to obtain a second data feature of the target security policy; and the rule engine may generate the target security policy based on the streaming computing result and the second data feature. The rule engine may generate the target security policy based on the streaming computing result and the second data feature by, but is not limited to, forming a feature vector from the streaming computing result and the second data feature; and invoking a machine learning platform service module via a plug-in to perform predictive processing on the feature vector to obtain the target security policy.

[0090] S1104: The rule engine determines the security services required in the life cycle of the target security policy.

[0091] It should be noted that the security services required during the lifecycle of the target security policy are provided by the various service modules included in the policy processing system. The rule engine can call the security services of each service module through the plug-ins in the plug-in set, including:

[0092] (1) The rule engine calls the data warehouse service provided by the data warehouse service module. Figure 12 A schematic diagram of a rule engine importing a data warehouse table provided by an exemplary embodiment of the present application is shown; see Figure 12 When configuring the target security policy on the web page, the policy developer only needs to fill in the variable name (key) and table identifier (table ID); the key and table ID will be transmitted to the rule engine as the first data feature. The rule engine can then obtain all the fields of this table from the data warehouse based on the table ID to generate the rules for the target security policy, which is very convenient.

[0093] (2) The rule engine calls the streaming computing service provided by the streaming computing service module. Specifically, the rule engine sends the first data feature carried in the request sent by the web operation module to the streaming computing service module. This sending is automatically performed by the rule engine and does not require configuration by the policy developer. At the same time, the MMData business data stream and the business data stream of the relevant second data feature stored in the data warehouse can also be configured to be forwarded to the streaming computing service module. After Flink (open source stream processing framework) in the streaming computing service module calculates the result, it rewrites the result to Kafka (open source stream processing platform). The streaming data agent module pulls the result from Kafka for processing. The processing here may include: writing all data stream features involved in the result to the data warehouse for the entire policy processing system to call; or returning the result to the rule engine so that the rule engine generates the target security policy based on this result.

[0094] (3) The rule engine calls the machine learning service provided by the machine learning platform service module. Although the machine learning platform service module is already a one-stop service, the machine learning platform service module has an inconvenient detail, which is the lack of ability to collect data feature samples. In the embodiment of the present application, the rule engine performs a streaming calculation on the first data feature carried in the request sent by the web operation module and the second data feature obtained from the data warehouse to form a feature vector. This feature vector can be used as sample data for model training and prediction. Combined Figure 8Specifically, the rule engine sends this feature vector to the data analysis service module, which selects positive and negative samples. The rule engine then imports the positive and negative samples into the machine learning platform service module, which then trains the model. During the process of configuring the target security policy with the rule engine, the trained model can predict the feature vector composed of the stream computing result and the second data feature obtained from the data warehouse, and return the prediction result to the rule engine. The rule engine can then generate the target security policy based on the prediction result. In short, the policy processing system can obtain the first data feature of the target security policy from a web page. The stream computing result obtained after the first data feature is stream computed and the feature vector composed of the related second data feature in the data warehouse will be analyzed as positive and negative samples and returned to the web page for display. The policy processing system can select positive and negative samples on the web page and jump to the machine learning platform in the machine learning platform service module for training. The rule engine can obtain the prediction result by turning on the switch to call the machine learning platform, and generate the target security policy based on the prediction result. The entire process is visual and very convenient to operate.

[0095] S1105: The rule engine calls the security service provided by the service module to manage the target security policy.

[0096] The method for a rule engine to manage a target security policy may include: testing the target security policy before the target security policy takes effect, and optimizing the target security policy based on the test results; and after the target security policy takes effect, executing the target security policy when a target business request is received, and optimizing the target security policy based on the execution results.

[0097] In one implementation, the rule engine tests the target security policy before it takes effect; and uses the plug-in to call the data analysis service module to analyze the data analysis results obtained during the test process, and optimizes the target security policy based on the data analysis results. It is understandable that a new version of the target security policy needs to be tested before it is released. Only when the test results meet the expected conditions will the new version of the target security policy be released and take effect. Figure 13 , Figure 13FIG1 shows a schematic diagram of a security policy online process provided by an exemplary embodiment of the present application; as shown in FIG13, the online process of the security policy of the policy processing system is as follows: (1) After a new version of the security policy is configured, the rule engine reviews the rules in the new version of the security policy (such as checking whether the format of the rules is correct or the integrity of the rules, etc.); the review here can also be conducted manually, that is, by the policy developer; if the review fails, it returns to the policy configuration stage, and the policy developer optimizes the rules of the new version of the security policy; (2) If the review passes, the rule engine performs a dry run on the rules of the new version of the security policy. The so-called policy dry run is actually the process of testing the new version of the security policy, by obtaining business data from the storage layer or external device, executing the security policy based on the business data, and obtaining dry run data; the rule engine will call the data analysis service module to analyze the dry run data, and the analysis mainly includes: analyzing the differences between the old and new versions of the security policy (for example, for the same business request, a new The difference between the attack results of the new version of the security policy and the old version of the security policy, such difference includes that the new version of the security policy did not attack while the old version of the security policy did, or the new version of the security policy attacked while the old version of the security policy did not attack); and analyze whether the new version of the security policy hits the whitelist during the dry run (different levels of whitelists are set according to the user's credit level. When hitting the level 1 whitelist (the level 1 whitelist includes users with higher credit levels), manual screening can be performed to determine whether it is a false positive); through the above analysis, it is judged whether the new version of the security policy meets the expectations; (3) If the performance of the new version of the security policy is better than that of the old version of the security policy, and the new version of the security policy did not hit the whitelist during the dry run (or hit the whitelist but was excluded by manual screening), it is determined that the new version of the security policy meets the full launch conditions, and the rule engine will fully launch the new version of the security policy, including taking effect on the new version of the security policy in the rule engine and assigning a new version number to the new version of the security policy.

[0098] As mentioned above, the rule engine calls the data analysis service module through the plug-in to analyze the data analysis results obtained during the test, which may include: analysis of dry run data and analysis of execution result data and feedback information during the effective execution phase. Figure 7 Specifically, the essence of the target security policy's attack on the target business is to discover malicious requests or users from the data, which is essentially data analysis. Therefore, the present application embodiment introduces a data analysis service module, which has the following characteristics: ① Fast speed: analysis results for statistical data can be obtained within minutes; analysis results for algorithmic data can also be returned within 10 minutes. ② Visualization: Figure 14FIG. 1 shows a schematic diagram of a data analysis result provided by an exemplary embodiment of the present application; FIG. Figure 14 As shown, the data analysis results can be displayed on the web page in the form of curves, pie charts, bar charts or cluster charts. ③ Automation: semi-automatic or automatic data analysis, for example, in the process of anomaly detection, anomalies and maliciousness can be automatically discovered; ④ Data analysis methods can be precipitated or shared: the data analysis methods here include statistics, distribution, trend changes and unsupervised anomaly detection methods. The analysis of supervised algorithms can interact and share with the machine learning platform service module; In addition, the data analysis service module has a wide range of services and can be used for daily operation complaint inquiries, unified management of various data analyses, etc. ⑤ Using Elasticsearch as the underlying storage can achieve data query and statistics at the second level, improving the speed of data analysis; it can also generate large-scale data reports for different business scenarios and visualize them on the web page. In summary, the rule engine calls the data analysis service of the data analysis service module through the plug-in. The data analysis service can include but is not limited to: (1) analyzing the differences between the new and old versions of the target security policy; the rule engine can optimize the new version of the target security policy based on the differences and improve the quality of the target security policy. In the specific implementation, when the same target business acts on the new and old versions of the target security policy, the impact of the new version of the target security policy on the target business and the impact of the old version of the target security policy on the target business can be obtained. For example, the new version of the target security policy can have a strike rate of 45% on the target business - stolen accounts, and the old version of the target security policy has a strike rate of 50% on stolen accounts. Then the rule engine can optimize the new version of the target security policy based on the difference in the strike rate of stolen accounts between the new and old versions of the target security policy, thereby improving the performance of the new version of the target security policy in terms of strike rate. (2) Analyze user feedback information; when the interception volume soars, the rule engine can immediately stop executing the target security policy to avoid large-scale misjudgment or missed judgment of the rule engine. (3) Request replay. The rule system can obtain historical business requests of a certain historical time period from the data analysis service module to replay the data analysis process and results; etc.; (4) Multiple analysis confirmations, including the aforementioned whitelist hit confirmation, user feedback confirmation, etc.

[0099] In another implementation, after the new version of the target security policy takes effect, the rule engine executes the new version of the target security policy when it receives a target business request; the rule engine calls the user feedback and policy evaluation service module through the plug-in to obtain the target security policy's judgment accuracy for the target business, and performs version management on the target security policy based on the judgment accuracy. Among them, the target business request comes from the business system, and the target business request can carry the identifier of the target security policy that matches the target business (such as the version number of the target security policy, etc.); the rule engine matches the target security policy for the target business. In detail, after the synchronous service submodule in the rule engine receives the target business request sent by the business system, it will obtain the target security policy corresponding to the policy identifier from the storage layer according to the policy identifier carried in the target business request; and the target security policy will be executed by the asynchronous service submodule in the rule engine to obtain the execution result; the synchronous service submodule returns the execution result to the business system, and the business system makes a decision response to the target business request based on the execution result. The user feedback and policy evaluation service module of the logic layer in the policy processing system is equipped with a unified feedback interface to receive feedback information. After the business system makes a decision on the target business request based on the execution result of the target security policy, it will also receive feedback information sent by the user requesting the target business. For example, in the account theft security policy scenario of the login business, the rule engine executes the account theft security policy and the execution result is that there is a high risk of account theft. The business system rejects the user's login business based on the execution result. The user can file a complaint with the business system, and the business system will forward the user's complaint as feedback information to the policy processing system. The feedback information is used to prompt the target security policy that may have misjudged or missed the target business, etc. The user feedback and policy evaluation service module in the policy processing system can determine the judgment accuracy of the target security policy on the target business based on the feedback information. Accordingly, the rule engine calls the judgment accuracy and performs version management (optimization) on the target security policy based on the judgment accuracy.

[0100] S1106: The web operation module displays the target security policy, the execution process of the target security policy, and the execution result of the target security policy on the web page.

[0101] The rule engine returns the target security policy, the execution process of the target security policy, and the execution results of the target security policy to the web operation module for display. The target security policy needs to be clearly displayed, for example, the semantics and expressions of each rule in the target security policy must be clearly presented, not just a string of code. The display of the target security policy's execution process includes: the display of various security services used during the execution of the target security policy, such as the display of data analysis results, the display of positive and negative samples in the machine learning service process, etc. The display of the target security policy's execution results includes whether a strike was initiated, the strike rate, etc.

[0102] To summarize, in an embodiment of the present application, the policy processing system integrates a rule engine and at least one service module, wherein at least one service module includes a service module corresponding to each link in the policy life cycle. In this way, the policy processing system integrates all security services required in the life cycle of the security policy, improves the integration of the policy processing system, and thus improves the efficiency, effectiveness and quality of the policy processing system; the rule engine is set as a service connection point in the policy processing system, connecting the various service modules in the policy processing system together, and calling the security services provided by each service module to configure the target security policy for the target business. In this way, the rule engine can automatically generate and execute security policies by calling each service module, so that the security policy can be intelligently and automatically executed from each link of the configuration, implementation, and online process, thereby improving the professionalism and efficiency of the policy processing process.

[0103] In actual applications, the policy processing system provided in the embodiment of the present application is compared with the mainstream policy processing solution in the prior art. The comparison items are shown in Table 1 below, where the old system represents the mainstream policy processing system in the prior art, and the new policy processing system represents the policy processing system provided in the embodiment of the present application:

[0104] Table 1: Comparison list of new and old policy processing systems

[0105] Comparison items (generally) Old system New strategy processing system Improvement rate (times) New services are added and security policies are initialized 16 hours 4 hours 3 Data analysis is time-consuming 2 hours 1 hour 1 Daily modification of security policies 40 minutes 10 minutes 3 Security policy testing and effectiveness verification are time-consuming 30 minutes 10 minutes 2 Time-consuming security policy rollout 40 minutes 30 minutes 0.33 Daily operational data extraction 30 minutes 5 minutes 5 Analysis of misjudgment complaints 10 minutes 2 minutes 5

[0106] It can be seen from the data of the various comparison items shown in Table 1 that the policy processing system provided in the embodiment of the present application has obvious improvements in various comparison items. Compared with the old system, the new policy processing system proposed in the embodiment of the present application achieves high efficiency improvement through integrated and professional policy processing.

[0107] The embodiment of the present application also provides a policy processing device, which is equipped with the policy processing system as described above; the policy processing device can be a hardware entity device, for example, the policy processing device can be a server. That is to say, the policy processing system described above can be encapsulated into a hardware device (such as a server) to form the policy processing device of the embodiment of the present application. The policy processing device can be set in various business scenarios. The policy processing devices in various business scenarios can provide policy services for various businesses in various business scenarios based on the policy processing system they are equipped with, and in the process of providing policy services, the data and technology of each link in the policy life cycle are deposited into a unified policy platform, and unified and standardized management is carried out, which effectively improves the efficiency and effectiveness of policy processing.

[0108] It should be noted that the collection and processing of relevant data that may involve user privacy, such as "user characteristics", in this application should be strictly in accordance with the requirements of relevant national laws and regulations when applied in instances, and should have a legal basis or obtain the informed consent or separate consent of the personal information subject, and carry out subsequent data use and processing within the scope of authorization of laws and regulations and / or the personal information subject.

[0109] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any modifications or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in the present invention should be included in the scope of protection of the present application. Therefore, the scope of protection of the present application should be based on the scope of protection of the claims.

Claims

1. A policy processing system, characterized in that: The policy processing system integrates a rule engine and at least one service module; the rule engine is set as a service connection point in the policy processing system, and the at least one service module is connected to the rule engine and called by the rule engine; the rule engine is provided with a plug-in set, which includes multiple plug-ins, and one plug-in corresponds to one service module; wherein, The service module is used to provide security services required during the life cycle of the security policy; the life cycle of the security policy includes multiple stages, and the at least one service module includes a service module corresponding to each stage in the life cycle of the security policy; different stages in the life cycle of the security policy require different security services, and the security services provided by the service module include general services abstracted for corresponding stages of the life cycle; The rule engine is used to configure a target security policy for a target business and to call plug-ins in the plug-in set as needed during the life cycle of the target security policy to obtain security services provided by corresponding service modules to manage the target security policy; The policy processing system also includes a web operation module; The web operation module is configured to display a web page, wherein the web page displays a first list including a plurality of business types; When a target service type is selected in the first list, a second list is displayed on the web page, wherein the second list includes multiple service identifiers belonging to the target service type; When the target business identifier is selected, a policy configuration window is displayed in the web page, and the web operation module obtains data features of the security policy configured for the target business from the policy configuration window, and transmits the data features to the rule engine, so that the rule engine uses the data features to configure the target security policy for the target business.

2. The policy processing system according to claim 1, wherein: The policy processing system includes a logic layer, and the rule engine and the at least one service module are both arranged in the logic layer.

3. The policy processing system according to claim 1, wherein: The target security policy is composed of at least one rule; the rule engine includes a rule data management module, and the rule data management module is used to configure at least one rule of the target security policy for the target business.

4. The policy processing system according to claim 1, wherein: The target security policy is composed of at least one rule; the rule engine includes a rule engine core module, and the rule engine core module is provided with a resource management submodule, a synchronous service submodule and an asynchronous service submodule; The resource management submodule is used to call at least one test instance to test at least one rule of the target security policy, and when all rules of the target security policy pass the test, release the target security policy; The synchronization service submodule is used for matching the target security policy for the target service when the policy processing system receives a target service request; The asynchronous service submodule is used to execute the target security policy; Among them, the target security policy includes a first version identifier and a second version identifier, the first version identifier is used to identify the first version of the target security policy, and the first version refers to the latest version released by the resource management sub-module; the second version identifier is used to identify the second version of the target security policy; the second version refers to the version historically released by the resource management sub-module; the resource management sub-module is also used to perform version management on the target security policy, and the version management includes any one of the following: grayscale processing, interruption and rollback.

5. The policy processing system according to claim 1, wherein: The service module includes a user feedback and policy evaluation service module, which is provided with a unified feedback interface. The user feedback and policy evaluation service module receives user feedback information related to the target business through the unified feedback interface, and evaluates the accuracy of the target security policy's determination of the target business based on the user feedback information; The rule engine calls the user feedback and policy evaluation service module through a plug-in to obtain the determination accuracy, and manages the target security policy according to the determination accuracy.

6. The policy processing system according to claim 1, wherein: The service module includes a general security capability service module, which is used to extract general security processing logic from multiple business scenarios to form a general security capability service; the general security capability service includes at least one of the following: frequency service, keyword matching service, natural language processing service, image similarity judgment service, and anti-cheating detection service; The rule engine calls the general security capability service provided by the general security capability service module through a plug-in to configure and execute the target security policy for the target business.

7. The policy processing system according to claim 1, wherein: The service module includes at least one of the following: a data warehouse service module, a machine learning platform service module, a streaming computing service module and a data analysis service module; the rule engine calls the data warehousing service provided by the data warehouse service module through a plug-in, calls the machine learning service provided by the machine learning platform service module through a plug-in, calls the streaming computing service provided by the streaming computing service module through a plug-in, and calls the data analysis service provided by the data analysis service module through a plug-in, and the rule engine uses the various security services obtained by calling to configure the target security policy for the target business, and executes the target security policy.

8. The policy processing system according to claim 1, wherein: The web operation module is further configured to receive various management data in the life cycle of the target security policy returned by the rule engine, and display the various management data on the web page.

9. The policy processing system according to claim 1, wherein: The policy processing system is connected to a business system, the business system is used to process multiple services requested by Internet users, and the target service is any one of the multiple services; The policy processing system includes an access layer, which provides a unified access interface, and each service in the service system is connected to the policy processing system through the unified access interface; When the business system detects a target business request, it forwards the target business request to the rule engine. The rule engine matches the target security policy for the target business and executes the target security policy to obtain an execution result. The rule engine returns the execution result of the target security policy to the business system, and the business system makes a decision response to the target business request based on the execution result of the target security policy.

10. The policy processing system according to claim 1, wherein: The policy processing system includes a storage layer, which includes a storage module. The storage module is used to provide storage support for the rule engine and the service module; the storage module includes at least one of the following modules: a data warehouse, a data analysis storage module, a policy rule storage module, and a request flow storage module.

11. A policy processing method, characterized in that: The policy processing method is executed by a rule engine in a policy processing system, the policy processing system comprising a web operation module, the rule engine, and at least one service module; the rule engine is configured as a service connection point in the policy processing system, and the at least one service module is connected to the rule engine and invoked by the rule engine; The rule engine is provided with a plug-in set, which includes multiple plug-ins, and one plug-in corresponds to one service module; The policy processing method includes: receiving data features of a security policy configured for a target business transmitted by the web operation module; wherein the web operation module is configured to display a web page, the web page displaying a first list including a plurality of business types; when a target business type is selected from the first list, the web page displays a second list including a plurality of business identifiers belonging to the target business type; when the target business identifier is selected, the web page displays a policy configuration window, and the web operation module obtains the data features from the policy configuration window; Configuring a target security policy for the target business according to the data characteristics; Determining security services required during the lifecycle of the target security policy; the lifecycle of the target security policy includes multiple stages, and the at least one service module includes a service module corresponding to each stage in the lifecycle of the target security policy; different stages in the lifecycle of the target security policy require different security services, and the security services include general services abstracted for corresponding stages of the lifecycle; The plug-in in the plug-in set is called to obtain the security service provided by the corresponding service module to manage the target security policy.

12. The method according to claim 11, wherein The service module includes a data warehouse service module and a stream computing service module; the policy processing system also includes a web operation module; the target security policy configured for the target business includes: Receiving a first data feature of a target security policy configured for a target business collected by a web operation module through a web page; Calling the streaming computing service module through the plug-in to perform streaming computing on the first data feature to obtain a streaming computing result; Calling the data warehouse service module through the plug-in to obtain the second data feature of the target security policy; The target security policy is generated according to the stream computing result and the second data feature.

13. The method according to claim 12, wherein: The service module further includes a machine learning platform service module; and generating the target security policy according to the stream computing result and the second data feature includes: Combining the stream computing result and the second data feature into a feature vector; The machine learning platform service module is called through a plug-in to perform prediction processing on the feature vector to obtain the target security policy.

14. The method according to claim 11, wherein The service module includes a data analysis service module and a user feedback and policy evaluation service module; calling the security service provided by the service module to manage the target security policy includes: Testing the target security policy before the target security policy takes effect; Calling the data analysis service module through the plug-in to analyze the data analysis results obtained during the test process, and optimizing the target security policy according to the data analysis results; After the target security policy takes effect, executing the target security policy when a target service request is received; and The user feedback and policy evaluation service module is called through a plug-in to obtain the determination accuracy of the target security policy on the target business, and version management is performed on the target security policy according to the determination accuracy.

Images