Risk control management method and device

Abstract

The embodiment of the present invention relates to the field of Internet technology, and discloses a risk control management method and device, the method comprising: determining the main dimension and the auxiliary dimension based on the preconfigured risk control rules; obtaining the corresponding main dimension value and auxiliary dimension value from the received risk control request according to the determined main dimension and auxiliary dimension; establishing a historical behavior linked list with the value of the main dimension as a keyword; obtaining historical behavior data according to the value of the main dimension, and automatically storing the historical behavior data into the historical behavior linked list with the value of the auxiliary dimension as a value; performing statistical operations on the historical behavior linked list to match the risk control rules and perform risk control management. Through the above manner, the embodiment of the present invention can self-inspire the storage and management of historical behavior data without external operations, the risk control system is simple, and can quickly and accurately respond to network attacks, greatly reducing the complexity and maintenance cost of the risk control system.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of Internet technology, and specifically to a risk control management method and device. Background Art

[0002] Mobile Internet has penetrated into every aspect of people's lives, and more and more black and gray industries have also targeted mobile Internet for malicious arbitrage. Therefore, there is an urgent need for a risk control engine that can quickly respond to network attacks. Currently, common solutions include Figure 1 As shown in the figure, it is divided into two parts. One part is that the business request reaches the business system, the business system generates logs, the business system puts the logs into the message queue, the stream computing engine extracts, cleans, transforms, and loads (ETL) logs and aggregates them, and sends the aggregated results to the risk control engine, which receives and caches the aggregated results. The other part is that the risk control administrator configures the risk control rules, pulls the aggregated results, and matches the risk control rules.

[0003] The existing technology uses stream computing to aggregate data outside the risk control engine and provide statistical results of historical risk control data. There are the following problems: 1. The risk control engine responds slowly and cannot quickly respond to network attacks. For example, if a new statistical rule about the user dimension is added, the aggregation operation rule of the user dimension must be added to the stream operation to take effect; 2. The accuracy of the risk control system is poor. From the generation of logs in the business system to the aggregation completion and sending to the risk control engine, the chain is long, the links are many, and the delay is large. There is a large error between the aggregation result reaching the risk control engine and the real result; 3. The risk control system is complex, with many components and high maintenance costs. Summary of the invention

[0004] In view of the above problems, an embodiment of the present invention provides a risk control management method and device, which overcome the above problems or at least partially solve the above problems.

[0005] According to one aspect of an embodiment of the present invention, a risk control management method is provided, the method comprising: determining a primary dimension and a secondary dimension based on preconfigured risk control rules; obtaining corresponding primary dimension values ​​and secondary dimension values ​​from a received risk control request according to the determined primary dimension and secondary dimension; establishing a historical behavior linked list with the primary dimension value as a keyword; obtaining historical behavior data according to the primary dimension value, and automatically storing the historical behavior data into the historical behavior linked list with the secondary dimension value as a value; performing statistical operations on the historical behavior linked list to match the risk control rules, and performing risk control management.

[0006] In an optional manner, before determining the primary dimension and the secondary dimension based on the preconfigured risk control rules, it includes: loading the risk control rules configured by the user; extracting the risk control dimensions according to the risk control rules and storing them in the memory, the risk control dimensions including the primary dimension and the secondary dimension.

[0007] In an optional manner, the loading of the risk control rules configured by the user also includes: loading a preset linked list length of the historical behavior linked list to be established; the method also includes: counting the number of historical behavior data stored starting from the header of the historical behavior linked list, and when the number reaches the preset linked list length, deleting from the historical behavior linked list all the historical behavior data stored after the historical behavior data whose number reaches the preset linked list length.

[0008] In an optional manner, the loading of the risk control rules configured by the user also includes: loading the preservation period of the historical behavior data in the historical behavior linked list to be established; the method also includes: traversing the historical behavior linked list from the tail of the historical behavior linked list, and if the result of subtracting the timestamp of the historical behavior data from the current timestamp exceeds the preservation period, deleting the historical behavior data from the historical behavior linked list.

[0009] In an optional manner, establishing a historical behavior linked list with the value of the main dimension as a keyword includes: searching in a cache whether the historical behavior linked list with the value of the main dimension as a keyword exists; if not, creating and returning the historical behavior linked list in the cache; if it exists, obtaining the historical behavior linked list stored in the cache.

[0010] In an optional manner, automatically storing the historical behavior data into the historical behavior linked list using the value of the auxiliary dimension as the value includes: creating a mapping table corresponding to the historical behavior data, wherein the first element in the mapping table is the value of the auxiliary dimension; storing the mapping table into the historical behavior linked list to store the historical behavior data.

[0011] In an optional manner, the creation of a mapping table corresponding to the historical behavior data further includes: if there are multiple risk control rules with the same value of the primary dimension, the secondary dimension of each risk control rule is added as an element to the mapping table corresponding to the historical behavior data.

[0012] According to another aspect of an embodiment of the present invention, a risk control management device is provided, comprising: a dimension determination unit, configured to determine a primary dimension and a secondary dimension based on preconfigured risk control rules; a value acquisition unit, configured to determine the value of the primary dimension and the value of the secondary dimension from a received risk control request according to the determined primary dimension and the secondary dimension; a linked list acquisition unit, configured to establish a historical behavior linked list with the value of the primary dimension as a keyword; a behavior storage unit, configured to acquire historical behavior data according to the value of the primary dimension, so as to automatically store the historical behavior data into the historical behavior linked list according to the value of the secondary dimension as a value; and a rule matching unit, configured to perform statistical operations on the historical behavior linked list to match the risk control rules and perform risk control management.

[0013] According to another aspect of an embodiment of the present invention, there is provided a computing device, comprising: a processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other via the communication bus;

[0014] The memory is used to store at least one executable instruction, and the executable instruction enables the processor to execute the steps of the above-mentioned risk control management method.

[0015] According to another aspect of an embodiment of the present invention, a computer storage medium is provided, wherein at least one executable instruction is stored in the storage medium, and the executable instruction enables the processor to execute the steps of the above-mentioned risk control management method.

[0016] The embodiment of the present invention determines the main dimension and the auxiliary dimension based on the preconfigured risk control rules; obtains the corresponding main dimension value and auxiliary dimension value from the received risk control request according to the determined main dimension and the auxiliary dimension; establishes a historical behavior linked list with the value of the main dimension as a keyword; obtains historical behavior data according to the value of the main dimension, and automatically stores the historical behavior data into the historical behavior linked list with the value of the auxiliary dimension as a value; performs statistical operations on the historical behavior linked list to match the risk control rules, and performs risk control management. The historical behavior data can be self-inspired to store and manage the historical behavior data without external operations. The risk control system is simple and can respond to network attacks quickly and accurately, greatly reducing the complexity and maintenance cost of the risk control system.

[0017] The above description is only an overview of the technical solution of the embodiment of the present invention. In order to more clearly understand the technical means of the embodiment of the present invention, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the embodiment of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present invention. Moreover, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0019] Figure 1 A schematic diagram of a risk control management method in the prior art is shown;

[0020] Figure 2 A schematic diagram of the process of the risk control management method provided by an embodiment of the present invention is shown;

[0021] Figure 3 A schematic diagram of the overall architecture of a risk control engine for implementing a risk control management method provided by an embodiment of the present invention is shown;

[0022] Figure 4 An example diagram of the implementation process of the risk control management method provided by an embodiment of the present invention is shown;

[0023] Figure 5 A schematic diagram of the structure of a risk control management device provided by an embodiment of the present invention is shown;

[0024] Figure 6 A schematic diagram of the structure of a computing device provided by an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0025] The exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present invention are shown in the accompanying drawings, it should be understood that the present invention can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided in order to enable a more thorough understanding of the present invention and to enable the scope of the present invention to be fully communicated to those skilled in the art.

[0026] Figure 2 FIG. 1 is a flow chart of a risk control management method provided by an embodiment of the present invention. The risk control management method is applied to a risk control engine on a server side, such as Figure 2 As shown, the risk management methods include:

[0027] Step S11: Determine the primary dimension and the secondary dimension based on the preconfigured risk control rules.

[0028] In an embodiment of the present invention, optionally, before step S11, the risk control engine is applied to load the risk control rules configured by the user; the risk control dimensions are extracted according to the risk control rules and stored in the memory, and the risk control dimensions include primary dimensions and secondary dimensions. At the same time, the preset linked list length of the historical behavior linked list to be established and the storage period of the historical behavior data in the historical behavior linked list to be established are also loaded. Among them, the risk control rules, the preset linked list length of the historical behavior linked list, and the storage period of the historical behavior data are pre-configured by the management personnel. For example, when extracting the risk control primary dimension and secondary dimension from the cumulative calculation of historical behavior data, such as the risk control rules include counting the number of logged-in users within 30 minutes of the IP, then the primary dimension is the IP and the secondary dimension is the user ID.

[0029] Step S12: According to the determined primary dimension and the secondary dimension, the corresponding primary dimension value and secondary dimension value are obtained from the received risk control request.

[0030] After receiving the risk control request, the risk control engine determines the value of the primary dimension and the value of the secondary dimension based on the risk control request. For example, according to the risk control rules, the primary dimension is determined to be IP, and the secondary dimension is user ID. After receiving the risk control request, the specific value of IP in the risk control request is used as the value of the primary dimension, and the specific value of user ID is used as the value of the secondary dimension.

[0031] Step S13: Establish a historical behavior list using the value of the main dimension as a keyword.

[0032] In an embodiment of the present invention, a historical behavior linked list is established with the value of the main dimension as a key. Optionally, a search is performed in a cache to determine whether the historical behavior linked list with the value of the main dimension as a key exists. If not, the historical behavior linked list is created and returned in the cache. If it exists, the historical behavior linked list stored in the cache is obtained.

[0033] Step S14: historical behavior data is obtained according to the value of the main dimension, and the historical behavior data is automatically stored in the historical behavior linked list with the value of the auxiliary dimension as the value.

[0034] In an embodiment of the present invention, optionally, historical behavior data whose value of the main dimension is the same as the value of the main dimension determined in the risk control rule is obtained, and each corresponding historical behavior data is obtained, and the historical behavior data is automatically stored in the historical behavior linked list with the value of the auxiliary dimension as the value. Optionally, a mapping table corresponding to the historical behavior data is created, wherein the first element in the mapping table is the value of the auxiliary dimension; if there are multiple risk control rules with the same value of the main dimension, the auxiliary dimension of each risk control rule is added as an element to the mapping table corresponding to the historical behavior data. For example, according to any risk control rule, the corresponding auxiliary dimension is determined to be the timestamp of the occurrence of the historical behavior data, and the timestamp of the occurrence of the historical behavior data is added as the second element to the mapping table corresponding to the historical behavior data. The mapping table is stored in the historical behavior linked list to store the historical behavior data. That is, after the historical behavior linked list is established, each time a historical behavior data that meets the value of the main dimension and the value of the auxiliary dimension occurs, a mapping table corresponding to the historical behavior data is created, and the historical behavior data is stored in the header of the historical behavior linked list by inserting the mapping table, so as to realize self-inspired storage of historical behavior data. In this way, the historical behavior data closer to the head of the historical behavior chain list occurs later, and the historical behavior data closer to the tail of the historical behavior chain list occurs earlier.

[0035] The embodiment of the present invention uses the extracted value of the main dimension as the key, stores the historical behavior linked list as the value in the memory, and stores the value of the auxiliary dimension according to the current risk control request as one historical behavior data in the header of the historical behavior linked list. It can self-inspiredly store and manage historical behavior data without external calculations, and does not need to store or aggregate historical behavior data outside the risk control system. The risk control system is simple and easy to maintain. Each element in the historical behavior linked list only stores necessary information, reducing the space complexity of maintaining historical behavior data.

[0036] In an embodiment of the present invention, the historical behavior chain list is also trimmed according to the preset chain list length of the historical behavior chain list and the storage period of the historical behavior data. Optionally, the historical behavior chain list is truncated to the preset chain list length, that is, the number of the stored historical behavior data is counted from the head of the historical behavior chain list, and when the number reaches the preset chain list length, all the historical behavior data stored after the historical behavior data whose number reaches the preset chain list length are deleted from the historical behavior chain list. At the same time, the historical behavior chain list is traversed from the tail of the historical behavior chain list. If the result of the current timestamp minus the timestamp of the occurrence of the historical behavior data exceeds the storage period, the historical behavior data is deleted from the historical behavior chain list. In the embodiment of the present invention, after each wind control request arrives, the wind control engine will store the historical behavior data of this time, delete the expired or timed-out historical behavior data, and store the new historical behavior data in the cache without delay, which provides a data basis for the accuracy of rule matching, deletes the overlong or timed-out historical behavior data from the tail of the chain list, and reduces the time complexity of historical behavior data maintenance.

[0037] Step S15: Perform statistical operations on the historical behavior chain list to match the risk control rules and perform risk control management.

[0038] Specifically, statistical calculations are performed based on the returned historical behavior chain table, and the main dimension that matches the risk control rules has the risk of network attacks. In this way, you only need to configure the risk control rules to quickly respond to network attacks without modifying the code.

[0039] The embodiment of the present invention does not require an Extract-Transform-Load (ETL) process and stream computing to output historical cumulative data statistics, and can quickly and accurately respond to network attacks, greatly reducing the complexity and maintenance cost of the risk control system.

[0040] The overall architecture of the risk control engine for implementing the above-mentioned risk control management method in the embodiment of the present invention is as follows: Figure 3 As shown in the figure, the risk control system only includes the risk control engine, and does not need to perform ETL and stream computing to output historical cumulative data statistics. The administrator configures the risk control rules, and the risk control engine parses the risk control rules, extracts the historical cumulative operation dimensions that need to be stored, and stores the historical behavior data according to the historical cumulative operation dimensions. For a more detailed description, the following example illustrates the implementation process of the risk control engine implementation method for self-inspired storage of historical behavior data. Figure 4 As shown, including:

[0041] Step 21: The administrator configures risk control rules.

[0042] For example, the administrator configures 2 risk control rules. Rule 1 is that the number of different users who log in with a mobile phone number within 10 days is greater than 3, and Rule 2 is that the number of different device IDs with a mobile phone number within 3 days is greater than 2. At the same time, the administrator configures the maximum length of the historical behavior chain list to be 100, and the time period of the saved historical behavior data is 3 days, that is, the preset chain length of the historical behavior chain list is 100, and the corresponding historical behavior data is saved for 3 days.

[0043] Step 22: The risk control engine loads the risk control rules, extracts the risk control dimensions that require accumulated historical behavior data, and stores them in memory.

[0044] The risk control engine loads these two rules and abstracts them into counting the number of differences in two dimensions under one dimension within a certain time period. In the two rules, the mobile phone number is the first dimension and the main dimension, the user ID in rule 1 is the second dimension and the auxiliary dimension, and the device ID in rule 2 is the second dimension and the auxiliary dimension. The main dimension extracted by the risk control engine is the mobile phone number, and the auxiliary dimensions are the user ID and the device ID. Then, the corresponding relationship between the main dimension (mobile phone number) and the auxiliary dimensions (user ID and device ID) is stored in the memory.

[0045] Step 23: The risk control engine receives the risk control request, uses the value of the primary dimension as the key, obtains the historical behavior linked list, and inserts the historical behavior data into the header of the historical behavior linked list in the cache using the value of the secondary dimension and the timestamp of the historical behavior data as the value.

[0046] The risk control engine receives a risk control request. The mobile phone number in the request is 13810001000, the user ID is 100001, and the device ID is dev100001. The risk control engine extracts the mobile phone number 13810001000, the user ID 100001, and the device ID dev100001 in the risk control request based on the primary and secondary dimensions extracted in step 22.

[0047] Use tel.13810001000 as the key to search the cache for the historical behavior of the mobile phone number 13810001000. If it does not exist, create a historical behavior linked list. Create a mapping table corresponding to each historical behavior data obtained based on the value of the primary dimension. The key value of mapping table element 1 is userid, and the value is 100001; the key value of mapping table element 2 is devid, and the value is dev100001; the key value of mapping element 3 is timestamp, and the value is the current time. Insert the mapping table corresponding to the historical behavior data into the created historical behavior linked list.

[0048] Step 24: Match risk control rules.

[0049] The risk control request matches rule 1 and rule 2, and uses the historical behavior chain table obtained in step 23 to calculate the number of user IDs within 10 days and the number of device IDs within 3 days. Determine whether the number of user IDs is greater than 3 and the number of device IDs is greater than 2. If the number of user IDs is greater than 3 or the number of device IDs is greater than 2, it means that the corresponding tel.13810001000 has a network attack risk.

[0050] Step 25: Trim away the historical behavior data at the tail of the linked list that exceeds the preset linked list length or times out.

[0051] If the length of the historical behavior linked list exceeds 100, the linked list will be truncated to 100, that is, the 100 historical behavior data starting from the head of the historical behavior linked list will be retained, and all historical behavior data after that will be deleted from the historical behavior linked list; the linked list will be traversed from the tail of the linked list, and if the result of the current timestamp minus the timestamp of the historical behavior data is more than 3 days, the historical behavior data will be deleted from the historical behavior linked list, otherwise the traversal will be terminated.

[0052] Through the above implementation process description, it can be seen that after configuring the risk control rules, the risk control engine can self-inspire and store historical behavior data according to the risk control rules. The method of the embodiment of the present invention can be used to manage historical behavior data in risk control scenarios, and can also be used for rule engines related to historical behavior data in non-risk control scenarios.

[0053] The embodiment of the present invention determines the main dimension and the auxiliary dimension based on the preconfigured risk control rules; obtains the corresponding main dimension value and auxiliary dimension value from the received risk control request according to the determined main dimension and the auxiliary dimension; establishes a historical behavior linked list with the value of the main dimension as a keyword; obtains historical behavior data according to the value of the main dimension, and automatically stores the historical behavior data into the historical behavior linked list with the value of the auxiliary dimension as a value; performs statistical operations on the historical behavior linked list to match the risk control rules, and performs risk control management. The historical behavior data can be self-inspired to store and manage the historical behavior data without external operations. The risk control system is simple and can respond to network attacks quickly and accurately, greatly reducing the complexity and maintenance cost of the risk control system.

[0054] Figure 5 FIG. 1 is a schematic diagram showing the structure of a risk control management device according to an embodiment of the present invention. Figure 5 As shown, the risk control management device includes: a dimension determination unit 501, a value acquisition unit 502, a linked list acquisition unit 503, a behavior storage unit 504, a rule matching unit 505 and a loading unit 506. Among them:

[0055] The dimension determination unit 501 is used to determine the primary dimension and the secondary dimension based on the preconfigured risk control rules; the value acquisition unit 502 is used to obtain the corresponding primary dimension value and the secondary dimension value from the received risk control request according to the determined primary dimension and the secondary dimension; the linked list acquisition unit 503 is used to establish a historical behavior linked list with the value of the primary dimension as the keyword; the behavior storage unit 504 is used to obtain historical behavior data according to the value of the primary dimension, so as to automatically store the historical behavior data into the historical behavior linked list according to the value of the secondary dimension as the value; the rule matching unit 505 is used to perform statistical operations on the historical behavior linked list to match the risk control rules and perform risk control management.

[0056] In an optional manner, the loading unit 506 is further used to: load the risk control rules configured by the user; extract risk control dimensions according to the risk control rules and store them into the memory, wherein the risk control dimensions include the main dimension and the auxiliary dimension.

[0057] In an optional manner, the loading unit 506 is also used to: load the preset linked list length of the historical behavior linked list to be established; the behavior storage unit 504 counts the number of the stored historical behavior data starting from the header of the historical behavior linked list, and when the number reaches the preset linked list length, deletes from the historical behavior linked list all the historical behavior data stored after the historical behavior data whose number reaches the preset linked list length.

[0058] In an optional manner, the loading unit 506 is also used to: load the preservation period of the historical behavior data in the historical behavior linked list to be established; the behavior storage unit 504 traverses the historical behavior linked list from the tail of the historical behavior linked list, and if the result of subtracting the timestamp of the historical behavior data from the current timestamp exceeds the preservation period, the historical behavior data is deleted from the historical behavior linked list.

[0059] In an optional manner, the linked list acquisition unit 503 is used to: search in the cache whether the historical behavior linked list with the main dimension value as the keyword exists; if not, create and return the historical behavior linked list in the cache; if it exists, obtain the historical behavior linked list stored in the cache.

[0060] In an optional manner, the behavior storage unit 504 is used to: create a mapping table corresponding to the historical behavior data, wherein the first element in the mapping table is the value of the auxiliary dimension; store the mapping table in the historical behavior linked list to store the historical behavior data.

[0061] In an optional manner, the behavior storage unit 504 is also used to: if there are multiple risk control rules with the same value of the main dimension, add the secondary dimension of each risk control rule as an element to the mapping table corresponding to the historical behavior data.

[0062] The embodiment of the present invention determines the main dimension and the auxiliary dimension based on the preconfigured risk control rules; obtains the corresponding main dimension value and auxiliary dimension value from the received risk control request according to the determined main dimension and the auxiliary dimension; establishes a historical behavior linked list with the value of the main dimension as a keyword; obtains historical behavior data according to the value of the main dimension, and automatically stores the historical behavior data into the historical behavior linked list with the value of the auxiliary dimension as a value; performs statistical operations on the historical behavior linked list to match the risk control rules, and performs risk control management. The historical behavior data can be self-inspired to store and manage the historical behavior data without external operations. The risk control system is simple and can respond to network attacks quickly and accurately, greatly reducing the complexity and maintenance cost of the risk control system.

[0063] An embodiment of the present invention provides a non-volatile computer storage medium, wherein the computer storage medium stores at least one executable instruction, and the computer executable instruction can execute the risk control management method in any of the above method embodiments.

[0064] The executable instructions may be specifically used to cause the processor to perform the following operations:

[0065] Determine the primary and secondary dimensions based on pre-configured risk control rules;

[0066] According to the determined primary dimension and the secondary dimension, obtaining a corresponding primary dimension value and a corresponding secondary dimension value from the received risk control request;

[0067] Establishing a historical behavior linked list with the value of the main dimension as a keyword;

[0068] Acquire historical behavior data according to the value of the primary dimension, and automatically store the historical behavior data into the historical behavior linked list using the value of the secondary dimension as a value;

[0069] Perform statistical operations on the historical behavior chain list to match the risk control rules and perform risk control management.

[0070] In an optional manner, the executable instruction causes the processor to perform the following operations:

[0071] Loading the risk control rules configured by the user;

[0072] The risk control dimension is extracted according to the risk control rule and stored in the memory, wherein the risk control dimension includes the main dimension and the auxiliary dimension.

[0073] In an optional manner, the executable instruction causes the processor to perform the following operations:

[0074] Loading a preset linked list length of the historical behavior linked list to be established;

[0075] The number of the historical behavior data stored is counted starting from the header of the historical behavior linked list. When the number reaches the preset linked list length, all the historical behavior data stored after the historical behavior data whose number reaches the preset linked list length are deleted from the historical behavior linked list.

[0076] In an optional manner, the executable instruction causes the processor to perform the following operations:

[0077] Loading the preservation period of the historical behavior data in the historical behavior linked list to be established;

[0078] The historical behavior chain list is traversed from the tail of the historical behavior chain list, and if the result of subtracting the timestamp of the occurrence of the historical behavior data from the current timestamp exceeds the preservation period, the historical behavior data is deleted from the historical behavior chain list.

[0079] In an optional manner, the executable instruction causes the processor to perform the following operations:

[0080] Searching in the cache whether the historical behavior linked list with the main dimension value as a key exists;

[0081] If it does not exist, create and return the historical behavior linked list in the cache;

[0082] If it exists, the historical behavior linked list stored in the cache is obtained.

[0083] In an optional manner, the executable instruction causes the processor to perform the following operations:

[0084] Creating a mapping table corresponding to the historical behavior data, wherein the first element in the mapping table is the value of the auxiliary dimension;

[0085] The mapping table is stored in the historical behavior linked list to store the historical behavior data.

[0086] In an optional manner, the executable instruction causes the processor to perform the following operations:

[0087] If there are multiple risk control rules with the same value of the primary dimension, the secondary dimension of each risk control rule is added as an element to the mapping table corresponding to the historical behavior data.

[0088] The embodiment of the present invention determines the main dimension and the auxiliary dimension based on the preconfigured risk control rules; obtains the value of the main dimension and the value of the auxiliary dimension from the received risk control request according to the determined main dimension and the auxiliary dimension; establishes a historical behavior linked list with the value of the main dimension as a keyword; obtains historical behavior data according to the value of the main dimension, and automatically stores the historical behavior data into the historical behavior linked list with the value of the auxiliary dimension as a value; performs statistical operations on the historical behavior linked list to match the risk control rules, and performs risk control management. The historical behavior data can be self-inspired to store and manage the historical behavior data without external operations. The risk control system is simple and can respond to network attacks quickly and accurately, greatly reducing the complexity and maintenance cost of the risk control system.

[0089] An embodiment of the present invention provides a computer program product, which includes a computer program stored on a computer storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer executes the risk control management method in any of the above method embodiments.

[0090] The executable instructions may be specifically used to cause the processor to perform the following operations:

[0091] Determine the primary and secondary dimensions based on pre-configured risk control rules;

[0092] According to the determined primary dimension and the secondary dimension, obtaining a corresponding primary dimension value and a corresponding secondary dimension value from the received risk control request;

[0093] Establishing a historical behavior linked list with the value of the main dimension as a keyword;

[0094] Acquire historical behavior data according to the value of the primary dimension, and automatically store the historical behavior data into the historical behavior linked list using the value of the secondary dimension as a value;

[0095] Perform statistical operations on the historical behavior chain list to match the risk control rules and perform risk control management.

[0096] In an optional manner, the executable instruction causes the processor to perform the following operations:

[0097] Loading the risk control rules configured by the user;

[0098] The risk control dimension is extracted according to the risk control rule and stored in the memory, wherein the risk control dimension includes the main dimension and the auxiliary dimension.

[0099] In an optional manner, the executable instruction causes the processor to perform the following operations:

[0100] Loading a preset linked list length of the historical behavior linked list to be established;

[0101] The number of the historical behavior data stored is counted starting from the header of the historical behavior linked list. When the number reaches the preset linked list length, all the historical behavior data stored after the historical behavior data whose number reaches the preset linked list length are deleted from the historical behavior linked list.

[0102] In an optional manner, the executable instruction causes the processor to perform the following operations:

[0103] Loading the preservation period of the historical behavior data in the historical behavior linked list to be established;

[0104] The historical behavior chain list is traversed from the tail of the historical behavior chain list, and if the result of subtracting the timestamp of the occurrence of the historical behavior data from the current timestamp exceeds the preservation period, the historical behavior data is deleted from the historical behavior chain list.

[0105] In an optional manner, the executable instruction causes the processor to perform the following operations:

[0106] Searching in the cache whether the historical behavior linked list with the main dimension value as a key exists;

[0107] If it does not exist, create and return the historical behavior linked list in the cache;

[0108] If it exists, the historical behavior linked list stored in the cache is obtained.

[0109] In an optional manner, the executable instruction causes the processor to perform the following operations:

[0110] Creating a mapping table corresponding to the historical behavior data, wherein the first element in the mapping table is the value of the auxiliary dimension;

[0111] The mapping table is stored in the historical behavior linked list to store the historical behavior data.

[0112] In an optional manner, the executable instruction causes the processor to perform the following operations:

[0113] If there are multiple risk control rules with the same value of the primary dimension, the secondary dimension of each risk control rule is added as an element to the mapping table corresponding to the historical behavior data.

[0114] The embodiment of the present invention determines the main dimension and the auxiliary dimension based on the preconfigured risk control rules; obtains the corresponding main dimension value and auxiliary dimension value from the received risk control request according to the determined main dimension and the auxiliary dimension; establishes a historical behavior linked list with the value of the main dimension as a keyword; obtains historical behavior data according to the value of the main dimension, and automatically stores the historical behavior data into the historical behavior linked list with the value of the auxiliary dimension as a value; performs statistical operations on the historical behavior linked list to match the risk control rules, and performs risk control management. The historical behavior data can be self-inspired to store and manage the historical behavior data without external operations. The risk control system is simple and can respond to network attacks quickly and accurately, greatly reducing the complexity and maintenance cost of the risk control system.

[0115] Figure 6 A schematic diagram of the structure of a computing device provided by an embodiment of the present invention is shown, and the specific embodiment of the present invention does not limit the specific implementation of the device.

[0116] like Figure 6 As shown, the computing device may include: a processor (processor) 602 , a communications interface (Communications Interface) 604 , a memory (memory) 606 , and a communication bus 608 .

[0117] The processor 602, the communication interface 604, and the memory 606 communicate with each other via the communication bus 608. The communication interface 604 is used to communicate with other devices such as a client or other server network elements. The processor 602 is used to execute the program 610, which can specifically execute the relevant steps in the above-mentioned risk control management method embodiment.

[0118] Specifically, the program 610 may include program codes, which include computer operation instructions.

[0119] The processor 602 may be a central processing unit (CPU), or an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present invention. The one or more processors included in the device may be processors of the same type, such as one or more CPUs; or may be processors of different types, such as one or more CPUs and one or more ASICs.

[0120] The memory 606 is used to store the program 610. The memory 606 may include a high-speed RAM memory, and may also include a non-volatile memory (non-volatile memory), such as at least one disk memory.

[0121] The program 610 may be specifically configured to enable the processor 602 to perform the following operations:

[0122] Determine the primary and secondary dimensions based on pre-configured risk control rules;

[0123] According to the determined primary dimension and the secondary dimension, obtaining a corresponding primary dimension value and a corresponding secondary dimension value from the received risk control request;

[0124] Establishing a historical behavior linked list with the value of the main dimension as a keyword;

[0125] Acquire historical behavior data according to the value of the primary dimension, and automatically store the historical behavior data into the historical behavior linked list using the value of the secondary dimension as a value;

[0126] Perform statistical operations on the historical behavior chain list to match the risk control rules and perform risk control management.

[0127] In an optional manner, the program 610 enables the processor to perform the following operations:

[0128] Loading the risk control rules configured by the user;

[0129] The risk control dimension is extracted according to the risk control rule and stored in the memory, wherein the risk control dimension includes the main dimension and the auxiliary dimension.

[0130] In an optional manner, the program 610 enables the processor to perform the following operations:

[0131] Loading a preset linked list length of the historical behavior linked list to be established;

[0132] The number of the historical behavior data stored is counted starting from the header of the historical behavior linked list. When the number reaches the preset linked list length, all the historical behavior data stored after the historical behavior data whose number reaches the preset linked list length are deleted from the historical behavior linked list.

[0133] In an optional manner, the program 610 enables the processor to perform the following operations:

[0134] Loading the preservation period of the historical behavior data in the historical behavior linked list to be established;

[0135] The historical behavior chain list is traversed from the tail of the historical behavior chain list, and if the result of subtracting the timestamp of the occurrence of the historical behavior data from the current timestamp exceeds the preservation period, the historical behavior data is deleted from the historical behavior chain list.

[0136] In an optional manner, the program 610 enables the processor to perform the following operations:

[0137] Searching in the cache whether the historical behavior linked list with the main dimension value as a key exists;

[0138] If it does not exist, create and return the historical behavior linked list in the cache;

[0139] If it exists, the historical behavior linked list stored in the cache is obtained.

[0140] In an optional manner, the program 610 enables the processor to perform the following operations:

[0141] Creating a mapping table corresponding to the historical behavior data, wherein the first element in the mapping table is the value of the auxiliary dimension;

[0142] The mapping table is stored in the historical behavior linked list to store the historical behavior data.

[0143] In an optional manner, the program 610 enables the processor to perform the following operations:

[0144] If there are multiple risk control rules with the same value of the primary dimension, the secondary dimension of each risk control rule is added as an element to the mapping table corresponding to the historical behavior data.

[0145] The embodiment of the present invention determines the main dimension and the auxiliary dimension based on the preconfigured risk control rules; obtains the corresponding main dimension value and auxiliary dimension value from the received risk control request according to the determined main dimension and the auxiliary dimension; establishes a historical behavior linked list with the value of the main dimension as a keyword; obtains historical behavior data according to the value of the main dimension, and automatically stores the historical behavior data into the historical behavior linked list with the value of the auxiliary dimension as a value; performs statistical operations on the historical behavior linked list to match the risk control rules, and performs risk control management. The historical behavior data can be self-inspired to store and manage the historical behavior data without external operations. The risk control system is simple and can respond to network attacks quickly and accurately, greatly reducing the complexity and maintenance cost of the risk control system.

[0146] The algorithm or display provided herein is not inherently related to any particular computer, virtual system or other equipment. Various general purpose systems can also be used together with the teachings based on this. According to the above description, it is obvious to construct the structure required for this type of system. In addition, the embodiment of the present invention is not directed to any specific programming language yet. It should be understood that various programming languages ​​can be utilized to realize the content of the present invention described herein, and the description made to specific languages ​​above is for disclosing the best mode of the present invention.

[0147] In the description provided herein, a large number of specific details are described. However, it is understood that embodiments of the present invention can be practiced without these specific details. In some instances, well-known methods, structures and techniques are not shown in detail so as not to obscure the understanding of this description.

[0148] Similarly, it should be understood that in order to streamline the present invention and aid in understanding one or more of the various inventive aspects, in the above description of exemplary embodiments of the present invention, various features of the embodiments of the present invention are sometimes grouped together into a single embodiment, figure, or description thereof. However, this method of disclosure should not be interpreted as reflecting an intention that the claimed invention requires more features than those expressly recited in each claim.

[0149] Those skilled in the art will appreciate that the modules in the devices in the embodiments may be adaptively changed and arranged in one or more devices different from the embodiments. The modules or units or components in the embodiments may be combined into one module or unit or component, and in addition they may be divided into a plurality of submodules or subunits or subcomponents. Except that at least some of such features and / or processes or units are mutually exclusive, all features disclosed in this specification (including the accompanying claims, abstracts and drawings) and all processes or units of any method or device disclosed in this manner may be combined in any combination. Unless otherwise expressly stated, each feature disclosed in this specification (including the accompanying claims, abstracts and drawings) may be replaced by an alternative feature providing the same, equivalent or similar purpose.

[0150] It should be noted that the above embodiments illustrate the present invention rather than limit it, and that those skilled in the art may devise alternative embodiments without departing from the scope of the appended claims. In the claims, any reference symbol between brackets shall not be construed as a limitation on the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "one" or "an" preceding an element does not exclude the presence of a plurality of such elements. The present invention may be implemented by means of hardware comprising a number of different elements and by means of a suitably programmed computer. In a unit claim enumerating a number of devices, several of these devices may be embodied by the same hardware item. The use of the words first, second, and third, etc. does not indicate any order. These words may be interpreted as names. The steps in the above embodiments, unless otherwise specified, should not be understood as limitations on the order of execution.

Claims

1. A risk control management method, characterized in that: The method comprises: Determine the primary and secondary dimensions based on pre-configured risk control rules; According to the determined primary dimension and the secondary dimension, obtaining a corresponding primary dimension value and a corresponding secondary dimension value from the received risk control request; A historical behavior linked list is established with the value of the main dimension as a keyword, wherein the historical behavior linked list with the value of the main dimension as a keyword is searched in a cache to see whether it exists; if not, the historical behavior linked list is created in the cache and returned; if it exists, the historical behavior linked list stored in the cache is obtained; Acquire historical behavior data whose primary dimension value is the same as the primary dimension value determined in the risk control rule, create a mapping table corresponding to the historical behavior data, wherein the first element in the mapping table is the value of the secondary dimension; store the mapping table in the historical behavior linked list, and store the historical behavior data; Perform statistical operations on the historical behavior chain list to match the risk control rules and perform risk control management.

2. The method according to claim 1, characterized in that Before determining the primary dimension and the secondary dimension based on the preconfigured risk control rules, the following steps are included: Loading the risk control rules configured by the user; The risk control dimension is extracted according to the risk control rule and stored in the memory, wherein the risk control dimension includes the main dimension and the auxiliary dimension.

3. The method according to claim 2, characterized in that The loading of the risk control rules configured by the user further includes: loading a preset chain table length of the historical behavior chain table to be established; The method also includes: starting from the header of the historical behavior linked list, counting the number of the historical behavior data stored, and when the number reaches the preset linked list length, deleting from the historical behavior linked list all the historical behavior data stored after the historical behavior data whose number reaches the preset linked list length.

4. The method according to claim 2, characterized in that: The loading of the risk control rules configured by the user further includes: loading a storage period of the historical behavior data in the historical behavior chain table to be established; The method further includes: traversing the historical behavior linked list from the tail of the historical behavior linked list, and if the result of subtracting the timestamp of the occurrence of the historical behavior data from the current timestamp exceeds the preservation period, deleting the historical behavior data from the historical behavior linked list.

5. The method according to claim 1, characterized in that The creating of a mapping table corresponding to the historical behavior data further includes: If there are multiple risk control rules with the same value of the primary dimension, the secondary dimension of each risk control rule is added as an element to the mapping table corresponding to the historical behavior data.

6. A risk control management device, characterized in that: The device comprises: A dimension determination unit, used to determine the primary dimension and the secondary dimension based on preconfigured risk control rules; A value acquisition unit, configured to acquire a value of the corresponding primary dimension and a value of the secondary dimension from the received risk control request according to the determined primary dimension and the secondary dimension; a linked list acquisition unit, configured to establish a historical behavior linked list with the value of the main dimension as a keyword, wherein the historical behavior linked list with the value of the main dimension as a keyword is searched in a cache to determine whether it exists; if not, the historical behavior linked list is created in the cache and returned; if it exists, the historical behavior linked list stored in the cache is acquired; a behavior storage unit, configured to obtain historical behavior data whose primary dimension value is the same as the primary dimension value determined in the risk control rule, create a mapping table corresponding to the historical behavior data, wherein the first element in the mapping table is the value of the secondary dimension; store the mapping table in the historical behavior linked list, and store the historical behavior data; A rule matching unit is used to perform statistical operations on the historical behavior chain list to match the risk control rules and perform risk control management.

7. A computing device, characterized in that include: A processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other via the communication bus; The memory is used to store at least one executable instruction, and the executable instruction enables the processor to execute the steps of the risk control management method according to any one of claims 1-5.

8. A computer storage medium, characterized in that The storage medium stores at least one executable instruction, and the executable instruction enables the processor to execute the steps of the risk control management method according to any one of claims 1-5.

Images