Risk Detection Method, Device, Equipment and Medium

Abstract

The present disclosure provides a risk detection method, which can be applied to the fields of big data and the Internet. The risk detection method includes: determining a database risk detection result according to database abnormal event information of a platform system; processing system operation characteristics for characterizing the operation status of the platform system according to a preset rule to generate an operation risk detection result, where the operation risk detection result includes an online transaction risk detection result and a batch transaction risk detection result; determining a change risk detection result according to system change event information of the platform system; and processing the database risk detection result, the operation risk detection result, and the change risk detection result according to a preset risk detection rule to generate a risk detection result for the platform system. The present disclosure also provides a risk detection device, equipment, storage medium, and program product.

Description

Technical Field

[0001] The present disclosure relates to the fields of big data and the Internet, and particularly to a risk detection method, apparatus, device, medium, and program product. Background Art

[0002] With the development of science and technology, more and more organizations or institutions develop Internet platform systems to meet the needs of users in different application scenarios. In particular, financial institutions can develop Internet platform systems such as websites and applications to facilitate users' business processing needs such as consumption and account inquiries. Due to the continuous changes in user needs or the update of relevant regulations and other demand changes, it is necessary to develop and launch new Internet platform systems in a timely manner according to the new demand changes, or update the already launched Internet platform systems.

[0003] In the process of implementing the inventive concept of the present disclosure, the inventors found that the risk existing in the Internet platform system cannot be accurately detected during the launch of the Internet platform system, which affects the stable operation of the system. Summary of the Invention

[0004] In view of the above problems, the present disclosure provides a risk detection method, apparatus, device, medium, and program product.

[0005] According to a first aspect of the present disclosure, a risk detection method is provided, including:

[0006] Determining a database risk detection result according to the database abnormal event information of the platform system;

[0007] Processing the system operation characteristics for characterizing the operation status of the above platform system according to a preset rule to generate an operation risk detection result, where the above operation risk detection result includes an online transaction risk detection result and a batch transaction risk detection result;

[0008] Determining a change risk detection result according to the system change event information of the above platform system;

[0009] Processing the above database risk detection result, the above operation risk detection result, and the above change risk detection result according to a preset risk detection rule to generate a risk detection result for the above platform system.

[0010] According to an embodiment of the present disclosure, the above system operation characteristics include online transaction characteristics;

[0011] Processing the system operation characteristics for characterizing the operation status of the above platform system according to a preset rule to generate an operation risk detection result includes:

[0012] Evaluate the above online transaction characteristics according to the first risk level rule to determine the first risk level of the above online transaction characteristics;

[0013] Determine the above online transaction risk detection result according to the first risk level of each of the above online transaction characteristics.

[0014] According to an embodiment of the present disclosure, the above online transaction characteristics include at least one of the following:

[0015] Online transaction processing time characteristics, online transaction frequency characteristics, and online transaction attribute characteristics.

[0016] According to an embodiment of the present disclosure, the above system operation characteristics include batch transaction characteristics;

[0017] Processing the system operation characteristics used to characterize the operation status of the above platform system according to a preset rule, and generating the operation risk detection result further includes:

[0018] Evaluate the above batch transaction characteristics according to the second risk level rule to determine the second risk level of the above batch transaction characteristics;

[0019] Determine the above batch transaction risk detection result according to the second risk level of the above batch transaction characteristics.

[0020] According to an embodiment of the present disclosure, the above batch transaction characteristics include at least one of the following:

[0021] Batch transaction test characteristics, batch transaction execution duration characteristics, and batch transaction change characteristics.

[0022] According to an embodiment of the present disclosure, the above system change event information includes at least one of the following:

[0023] System change method information, system change time compliance information, change rollback information, associated change information.

[0024] According to an embodiment of the present disclosure, processing the above database risk detection result, the above operation risk detection result, and the above change risk detection result according to a preset risk detection rule to generate a risk detection result for the above platform system includes:

[0025] According to the above preset risk detection rule, respectively determine the first weight parameter of the above database risk detection result, the second weight parameter of the above operation risk detection result, and the third weight parameter of the above change risk detection result;

[0026] Process the above database risk detection result, the above operation risk detection result, and the above change risk detection result according to the above first weight parameter, the above second weight parameter, and the above third weight parameter to generate a risk detection result for the above platform system.

[0027] The second aspect of the present disclosure provides a risk detection device, including:

[0028] A first detection module, configured to determine a database risk detection result according to database exception event information of a platform system;

[0029] A second detection module, configured to process system operation characteristics for characterizing the operation status of the above platform system according to a preset rule to generate an operation risk detection result; wherein, the above operation risk detection result includes an online transaction risk detection result and a batch transaction risk detection result;

[0030] A third detection module, configured to determine a change risk detection result according to system change event information of the above platform system; and

[0031] A risk detection result generation module, configured to process the above database risk detection result, the above operation risk detection result and the above change risk detection result according to a preset risk detection rule to generate a risk detection result for the above platform system.

[0032] The third aspect of the present disclosure provides an electronic device, including: one or more processors; a memory for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors are caused to execute the above risk detection method.

[0033] The fourth aspect of the present disclosure further provides a computer-readable storage medium, on which executable instructions are stored, and when the instructions are executed by a processor, the processor is caused to execute the above risk detection method.

[0034] The fifth aspect of the present disclosure further provides a computer program product, including a computer program, and when the computer program is executed by a processor, the above risk detection method is implemented. Description of the Drawings

[0035] Through the following description of the embodiments of the present disclosure with reference to the drawings, the above content and other objects, features and advantages of the present disclosure will become clearer. In the drawings:

[0036] Figure 1 Schematically shows an application scenario diagram of a risk detection method and device according to an embodiment of the present disclosure;

[0037] Figure 2 Schematically shows a flowchart of a risk detection method according to an embodiment of the present disclosure;

[0038] Figure 3 Schematically shows a flowchart of generating a risk detection result for a platform system according to an embodiment of the present disclosure;

[0039] Figure 4 Schematically shows an application scenario diagram of a risk detection method according to an embodiment of the present disclosure;

[0040] Figure 5 Schematically shows a structural block diagram of a risk detection device according to an embodiment of the present disclosure; and

[0041] Figure 6 Schematically shows a block diagram of an electronic device suitable for implementing the risk detection method according to an embodiment of the present disclosure. Detailed implementation manners

[0042] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are merely exemplary and are not intended to limit the scope of the present disclosure. In the following detailed description, for the sake of explanation, many specific details are set forth to provide a thorough understanding of the embodiments of the present disclosure. However, it is obvious that one or more embodiments can also be implemented without these specific details. In addition, in the following description, descriptions of well-known structures and technologies are omitted to avoid unnecessarily confusing the concepts of the present disclosure.

[0043] The terms used herein are merely for describing specific embodiments and are not intended to limit the present disclosure. The terms "including", "comprising", etc. used herein indicate the presence of the described features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0044] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification and should not be interpreted in an idealized or overly rigid manner.

[0045] In the case of using expressions such as "at least one of A, B, and C, etc.", generally, it should be interpreted according to the meaning commonly understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include, but is not limited to, a system having only A, only B, only C, having A and B, having A and C, having B and C, and / or having A, B, and C, etc.).

[0046] With the development of science and technology, more and more financial institutions can develop Internet platform systems such as websites and applications to facilitate users' business processing needs such as consumption and account inquiries. Due to the continuous changes in user needs or the update of relevant specifications and other demand changes, it is necessary to develop and launch new Internet platform systems in a timely manner according to the new demand changes, or update the already launched Internet platform systems. At present, the online launch mode of Internet platform systems more often adopts the agile launch mode. Agile launch refers to simplifying the process steps for the online launch of Internet platform systems, reducing manual intervention for the launch, and realizing the automated online launch of Internet platform systems to improve the speed of the launch. However, what accompanies the agile launch is that the failure rate of Internet platform systems is relatively high and the types of failures are numerous, resulting in a decrease in the operational stability of Internet platform systems. Therefore, before the online launch of Internet platform systems, it is very important to accurately detect the risks of Internet platform systems so that relevant personnel can make decisions on the online launch of the platform system based on the risk detection results.

[0047] Embodiments of the present disclosure provide a risk detection method, including:

[0048] Determine the database risk detection result according to the database exception event information of the platform system; process the system operation characteristics used to characterize the operation status of the platform system according to a preset rule to generate an operation risk detection result; wherein, the operation risk detection result includes an online transaction risk detection result and a batch transaction risk detection result; determine the change risk detection result according to the system change event information of the platform system; process the database risk detection result, the operation risk detection result, and the change risk detection result according to a preset risk detection rule to generate a risk detection result for the platform system.

[0049] According to the embodiments of the present disclosure, determining the database risk detection result according to the database exception event information of the platform system can characterize the risk of the platform system at the database level through the database risk detection result. Processing the system operation characteristics according to a preset rule to generate an operation risk detection result including an online transaction risk detection result and a batch transaction risk detection result can make the operation risk detection result characterize the risk of the platform system at the operation level. Further determining the change risk detection result according to the system change event information of the platform system can characterize the risk of the change event information to the platform system through the change risk detection result. Processing the database risk detection result, the operation risk detection result, and the change risk detection result according to a preset risk detection rule can, on the basis of comprehensively considering the database risk detection result, the operation risk detection result, and the change risk detection result, determine the risk detection result for the platform system, thereby improving the accuracy rate of the operation risk detection for the platform system, and relevant personnel can make decisions on the online launch of the platform system based on the risk detection result to ensure the stable operation of the platform system after the online launch.

[0050] It should be noted that the platform system in this solution may include an Internet platform system for providing users with business processing requirements such as consumption, transfer, account query, etc.

[0051] In the technical solution of the present disclosure, the processing of the collection, storage, use, processing, transmission, provision, disclosure, and application of the user's personal information complies with the provisions of relevant laws and regulations, takes necessary confidentiality measures, and does not violate public order and good customs. In the technical solution of the present disclosure, before obtaining or collecting the user's personal information, the user's authorization or consent has been obtained.

[0052] Figure 1 Schematically shows an application scenario diagram of the risk detection method and device according to an embodiment of the present disclosure.

[0053] As Figure 1 shown, the application scenario 100 according to this embodiment may include terminal devices 101, 102, 103, a network 104, and a server 105. The network 104 is used to provide a medium for communication links between the terminal devices 101, 102, 103 and the server 105. The network 104 may include various connection types, such as wired, wireless communication links, or fiber optic cables, etc.

[0054] Users can use the terminal devices 101, 102, 103 to interact with the server 105 through the network 104 to receive or send messages, etc. Various communication client applications may be installed on the terminal devices 101, 102, 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only as examples).

[0055] The terminal devices 101, 102, 103 may be various electronic devices with a display screen and supporting web browsing, including but not limited to smart phones, tablet computers, laptop portable computers, and desktop computers, etc.

[0056] The server 105 may be a server that provides various services, such as a background management server that supports the websites browsed by users using the terminal devices 101, 102, 103 (only as an example). The background management server may analyze and process data such as user requests received, and feedback the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal devices.

[0057] It should be noted that the risk detection method provided by the embodiments of the present disclosure can generally be executed by the server 105. Correspondingly, the risk detection device provided by the embodiments of the present disclosure can generally be set in the server 105. The risk detection method provided by the embodiments of the present disclosure can also be executed by a server or a server cluster different from the server 105 and capable of communicating with the terminal devices 101, 102, 103 and / or the server 105. Correspondingly, the risk detection device provided by the embodiments of the present disclosure can also be set in a server or a server cluster different from the server 105 and capable of communicating with the terminal devices 101, 102, 103 and / or the server 105.

[0058] It should be understood that Figure 1 the numbers of terminal devices, networks, and servers in

[0059] are merely illustrative. According to the implementation requirements, there can be any number of terminal devices, networks, and servers. Figure 1 Based on the Figures 2 to 4 scenario described below, the risk detection method of the embodiments of the present disclosure will be described in detail through

[0060] Figure 2 FIG. schematically shows a flowchart of the risk detection method according to an embodiment of the present disclosure.

[0061] As Figure 2 shown, the risk detection method may include operations S210 to S240.

[0062] In operation S210, according to the database exception event information of the platform system, a database risk detection result is determined.

[0063] According to an embodiment of the present disclosure, the database exception event information may include information used to characterize abnormal situations of events such as data tables, index statements, operations, etc. of the database. The database exception event information can be obtained by scanning the database script. The database risk detection result may include different database risk levels, for example, may include high risk, medium risk, and low risk.

[0064] According to an embodiment of the present disclosure, a corresponding risk level can be determined for each database exception event information, and by comprehensively considering the abnormal event risk levels of the database exception event information, the database risk level corresponding to the database risk detection result is determined. Or alternatively, the highest abnormal event risk level corresponding to the database exception event information in the platform system can be determined as the database risk level of the database risk detection result to clearly reflect the database operation situation of the platform system.

[0065] According to an embodiment of the present disclosure, database abnormal event information and the abnormal event risk level corresponding to the data abnormal event information can be determined through Table 1.

[0066] Table 1

[0067]

[0068]

[0069] It should be noted that large tables in the database can include, for example, data tables with a record count greater than 10 million, and can also include data tables with a capacity greater than 10G.

[0070] In operation S220, according to a preset rule, the system operation characteristics for characterizing the operation status of the platform system are processed to generate an operation risk detection result, where the operation risk detection result includes an online transaction risk detection result and a batch transaction risk detection result.

[0071] According to an embodiment of the present disclosure, the operation status of the platform system can include the operation conditions of online transactions and / or batch transactions implemented through the platform system. Therefore, the online transaction risk detection result and the batch transaction risk detection result can respectively characterize the operation risks of online transactions and batch transactions during the operation of the platform system. By comprehensively considering the operation risks of online transactions and batch transactions to determine the operation risk detection result, the operation risks related to batch transactions and online transactions can be truly detected, thereby improving the comprehensiveness of the operation risk detection result.

[0072] In operation S230, according to the system change event information of the platform system, a change risk detection result is determined.

[0073] According to an embodiment of the present disclosure, the change of the platform system can be an upgrade of the platform system, that is, by putting on line the platform system that needs to be risk-detected to replace the currently running platform system. The system change event information can include information describing events such as the change time and change method of the platform system. The system change event information can affect the user experience of using the platform system. For example, if the change time (i.e., upgrade time) of the platform system is a period with a large user transaction volume, then the change of the platform system will cause the user to be unable to complete transactions through the platform system, causing trouble to the user.

[0074] In operation S240, according to a preset risk detection rule, the database risk detection result, the operation risk detection result, and the change risk detection result are processed to generate a risk detection result for the platform system.

[0075] According to an embodiment of the present disclosure, based on the database exception event information of the platform system, a database risk detection result can be determined, and the database risk detection result can characterize the risk of the platform system at the database level. By processing the system operation characteristics according to a preset rule to generate an operation risk detection result including an online transaction risk detection result and a batch transaction risk detection result, the operation risk detection result can characterize the risk of the platform system at the operation level. Further, based on the change event information of the platform system, a change risk detection result can be determined, and the change risk detection result can characterize the risk of the change event information to the platform system. By processing the database risk detection result, the operation risk detection result, and the change risk detection result according to a preset risk detection rule, a risk detection result for the platform system can be determined on the basis of comprehensively considering the database risk detection result, the operation risk detection result, and the change risk detection result, thereby improving the accuracy of the operation risk detection for the platform system. Relevant personnel can make a decision on the online launch of the platform system according to the risk detection result to ensure the stable operation of the platform system after it is launched.

[0076] According to an embodiment of the present disclosure, the system change event information includes at least one of the following:

[0077] System change method information, system change time compliance information, change rollback information, associated change information.

[0078] According to an embodiment of the present disclosure, the system change method information may include an automatic change method, a manual change method, and a semi-automatic change method. Among them, the semi-automatic change method may be to make a change according to the change requirements of the platform system after being authorized by relevant personnel.

[0079] According to an embodiment of the present disclosure, the system change time compliance information can be determined according to the operation specifications of the platform system. For example, when the set transaction time period of the platform system is from 9:00 to 18:00 and the change time of the platform system is set to 17:00, the system change time compliance information can be determined as non-compliant. Different change risk attention levels can be set for the compliance and non-compliance of the system change time compliance information to facilitate prompting relevant personnel to pay attention to whether the change time of the platform system is compliant.

[0080] According to an embodiment of the present disclosure, the change rollback information can characterize whether the changed platform system can be rolled back to the previous version of the platform system that was replaced, and can also characterize the specific change method of the rollback change.

[0081] According to an embodiment of the present disclosure, the associated change information may include the number of other platform systems that need to cooperate in change for the platform system that needs to be changed and have an associated relationship. For example, when platform system A needs to go online, other platform systems C that have an associated relationship with platform system A need to cooperate in change, and the associated change information for platform system A may be 2.

[0082] It should be noted that the system change event information may also include the impact mode of the change process on the business. The impact mode may include, for example, interrupting business operations, delaying business operations, potential unknown impacts, etc., and those skilled in the art can set it according to the actual situation.

[0083] According to an embodiment of the present disclosure, the corresponding change risk attention level may be determined according to different system change time information, and the change risk detection result may be determined according to the obtained change risk attention level.

[0084] For example, the change risk attention level of each system change event information and the change event weight parameter corresponding to each system change event information may be determined through Table 2. According to the change risk attention level of each system change event information and the change event weight parameter corresponding to each change event information, the change risk score of each system change event information is determined. Among them, the change risk score may be determined by formula (1).

[0085] Change risk score = ∑(A i *P i ); (1)

[0086] In formula (1), A represents the score of the change risk attention level of the system change event information, and P represents the change event weight parameter corresponding to the system change event information.

[0087] After calculating the change risk score, the change risk detection result may be determined according to the change risk threshold. For example, when the change risk score is greater than or equal to 30, the change risk detection result may be determined as high risk; when the change risk score is less than 30 and greater than or equal to 10, the change risk detection result may be determined as medium risk; when the change risk score is less than 10, the change risk detection result may be determined as low risk.

[0088] Table 2

[0089]

[0090] According to an embodiment of the present disclosure, by determining a corresponding change risk concern level based on different system change event information and determining a change risk detection result based on the change risk concern level, the change situation of the platform system can be clearly characterized, providing a reliable basis for detecting the risks of the platform system.

[0091] According to an embodiment of the present disclosure, the system operation characteristics may include online transaction characteristics.

[0092] Operation S220, processing the system operation characteristics used to characterize the operation status of the platform system according to a preset rule to generate a running risk detection result may include the following operations.

[0093] Evaluate the online transaction characteristics according to the first risk level rule to determine the first risk level of the online transaction characteristics; determine the online transaction risk detection result according to the first risk level of each online transaction characteristic.

[0094] According to an embodiment of the present disclosure, online transactions may include transactions directly provided by the platform system to the outside, such as withdrawal transactions, transfer transactions, account query transactions, etc. Online transaction characteristics may include characteristics related to the type, volume, and time of online transactions used to characterize online transactions.

[0095] According to an embodiment of the present disclosure, the online transaction characteristics include at least one of the following:

[0096] Online transaction processing time characteristics, online transaction frequency characteristics, and online transaction attribute characteristics.

[0097] According to an embodiment of the present disclosure, the online transaction attribute characteristics may include characteristics indicating the importance of the online transaction. For example, in the case where the online transaction is a transfer transaction, the online transaction attribute characteristics of the transfer transaction may be important financial transactions. In the case where the online transaction is to change the user name, the online transaction attribute characteristics of changing the user name may be general non-financial transactions. It should be noted that those skilled in the art can set the online transaction attribute characteristics according to the actual situation.

[0098] According to an embodiment of the present disclosure, the online transaction processing time characteristics may include, for example, the average processing duration of daily online transactions, the change rate of the average processing duration of online transactions on adjacent two days, etc.

[0099] According to an embodiment of the present disclosure, the online transaction frequency characteristics may include, for example, the ratio of the online transaction frequency of the same type of online transactions per day to the total online transaction frequency, the change rate of the online transaction frequency of the same type of online transactions on adjacent two days, etc.

[0100] According to an embodiment of the present disclosure, a corresponding first risk level may be determined based on different online transaction characteristics, and an online transaction risk detection result may be determined based on the first risk level.

[0101] For example, for an online transaction that is a transfer transaction, the first risk level rule may be characterized by Table 3 to evaluate the online transaction characteristics of the transfer transaction and determine the first risk level of the online transaction characteristics of the transfer transaction.

[0102] Table 3

[0103]

[0104] It should be noted that each online transaction characteristic of the transfer transaction may determine a corresponding first risk level, and different first risk levels may have corresponding scores. The scores corresponding to all the online transaction characteristics of the transfer transaction may be accumulated to obtain the first risk level score of the online transaction characteristics of the transfer transaction. By a similar method, the first risk level score for each online transaction characteristic may be obtained. The online transaction risk detection result may be determined according to the first risk level score of the online transaction characteristics of any online transaction.

[0105] For example, after obtaining the first risk level score, the online transaction risk detection result may be determined according to the first risk threshold. For example, when the first risk level score is greater than or equal to 20, the online transaction risk detection result may be determined as high risk. When the first risk level score is less than 20 and greater than or equal to 10, the online transaction risk detection result may be determined as medium risk. When the first risk level score is less than 10, the online transaction risk detection result may be determined as low risk.

[0106] Evaluating the online transaction characteristics according to the first risk level rule, determining the first risk level, and determining the online transaction risk detection result according to the first risk level can clearly reflect the operation of the online transactions of the platform system, timely detect risks for online transactions, so that the generated online transaction risk detection result can provide a strong reference for the generation of the risk detection result of the platform system.

[0107] According to an embodiment of the present disclosure, the system operation characteristics may include batch transaction characteristics.

[0108] Operation S220 of processing the system operation characteristics for characterizing the operation status of the platform system according to a preset rule and generating a running risk detection result may further include the following operations.

[0109] Evaluating the batch transaction characteristics according to the second risk level rule, determining the second risk level of the batch transaction characteristics; determining the batch transaction risk detection result according to the second risk level of the batch transaction characteristics.

[0110] According to an embodiment of the present disclosure, a batch transaction may include serial transactions based on batch processing rules, such as reconciliation transactions and the like.

[0111] According to an embodiment of the present disclosure, the batch transaction characteristics may include at least one of the following:

[0112] Batch transaction test characteristics, batch transaction execution duration characteristics, and batch transaction change characteristics.

[0113] According to an embodiment of the present disclosure, for the case where the batch transaction is a reconciliation transaction, the second risk level rule may be characterized by Table 4 to evaluate the batch transaction characteristics and determine the second risk level of the batch transaction characteristics.

[0114] According to an embodiment of the present disclosure, the batch transaction test characteristics may characterize the characteristics of the batch transaction test for the platform system, such as whether the batch transaction has been tested. The batch transaction execution duration transaction characteristics may characterize the feature that the batch transaction execution duration of the platform system is greater than a preset execution duration threshold. The batch transaction change characteristics may characterize the change situation of the batch transaction to be launched.

[0115] Table 4

[0116]

[0117] It should be noted that each online transaction characteristic of the reconciliation transaction can determine the corresponding second risk level, and different second risk levels can have corresponding scores. The scores corresponding to the batch transaction characteristics of the reconciliation transaction can be accumulated to obtain the second risk level score for the batch transaction characteristics of the reconciliation transaction. By the same or similar method, the second risk level score of the batch transaction characteristics of each batch transaction can be determined, and the batch transaction risk detection result can be determined according to the second risk level score of the batch transaction characteristics of any batch transaction.

[0118] For example, after obtaining the second risk level score, the batch transaction risk detection result can be determined according to the second risk threshold. When the second risk level score is greater than 15, the batch transaction risk detection result can be determined as high risk. When the second risk level score is less than or equal to 15 and greater than or equal to 10, the batch transaction risk detection result can be determined as medium risk. When the second risk level score is less than 10, the batch transaction risk detection result can be determined as low risk.

[0119] Evaluating the batch transaction characteristics according to the second risk level rule, determining the second risk level, and determining the batch transaction risk detection result according to the second risk level can clearly reflect the operation of the batch transactions in the platform system, detect risks against batch transactions in a timely manner, so that the generated batch transaction risk detection result can provide a strong reference for the generation of the risk detection result of the platform system.

[0120] Figure 3 Schematically shows a flowchart for generating a risk detection result for a platform system according to an embodiment of the present disclosure.

[0121] As Figure 3 shown, in operation S240, according to the preset risk detection rule, processing the database risk detection result, the operation risk detection result, and the change risk detection result to generate a risk detection result for the platform system may include operations S301 to S302.

[0122] In operation S301, according to the preset risk detection rule, respectively determine the first weight parameter of the database risk detection result, the second weight parameter of the operation risk detection result, and the third weight parameter of the change risk detection result.

[0123] In operation S302, according to the first weight parameter, the second weight parameter, and the third weight parameter, process the database risk detection result, the operation risk detection result, and the change risk detection result to generate a risk detection result for the platform system.

[0124] According to an embodiment of the present disclosure, the database risk detection result may include high risk, medium risk, and low risk. For the risk levels corresponding to the database risk detection results, different scores may be used to represent them. Similarly, different scores may also be used to represent different risk levels of the change risk detection results.

[0125] For the operation risk detection result, since the operation risk detection result includes the online transaction risk detection result and the batch transaction risk detection result, corresponding scores may be determined respectively for the risk levels of the online transaction risk detection result and the batch transaction risk detection result, and the second weight parameter is used as the common weight parameter for the online transaction risk detection result and the batch transaction risk detection result.

[0126] For example, Table 5 may be used to represent the preset risk detection rule, and respectively determine the first weight parameter of the database risk detection result, the second weight parameter of the operation risk detection result, and the third weight parameter of the change risk detection result. Since the operation risk detection result includes the online transaction risk detection result and the batch transaction detection result, the second weight parameter may be determined as the weight parameter for the online transaction risk detection result and the batch transaction detection result.

[0127] When the database risk detection result is high risk, the online transaction risk detection result is medium risk, the batch transaction risk detection result is high risk, and the change risk detection result is low risk, the risk detection result of the platform system can be obtained as: ∑(database risk detection result * first weight parameter + online transaction risk detection result * second weight parameter + batch transaction risk detection result * second weight parameter + change risk detection result * third weight parameter). Thus, the risk detection result of the platform system can be expressed as a score of 27.

[0128] Table 5

[0129]

[0130] By setting the risk detection threshold, the risk level corresponding to the risk detection result of the platform system can be determined. For example, when the score of the risk detection result of the platform system is greater than 20, it can be determined that the risk level corresponding to the risk detection result of the platform system is high risk. When the score of the risk detection result of the platform system is less than or equal to 20 and greater than 10, it can be determined that the risk level corresponding to the risk detection result of the platform system is medium risk. When the score of the risk detection result of the platform system is less than 10, it can be determined that the risk level corresponding to the risk detection result of the platform system is low risk.

[0131] For the platform system whose risk level corresponding to the risk detection result is high risk, the online of the platform system can be automatically blocked to avoid the platform system going online with problems.

[0132] For the platform system whose risk level corresponding to the risk detection result is medium risk, corresponding approval procedures can be added to prompt relevant personnel to make decisions on the continued online of the platform system.

[0133] For the platform system whose risk level corresponding to the risk detection result is low risk, the detailed database risk detection result, online transaction risk detection result, batch transaction risk detection result, and system change risk detection result can be displayed to relevant personnel to facilitate relevant personnel to eliminate corresponding risk events or optimize the platform system.

[0134] Figure 4 An application scenario diagram of the risk detection method according to an embodiment of the present disclosure is schematically shown.

[0135] As Figure 4As shown in the figure, according to the preset risk detection rules, the database risk detection result 410, the operation risk detection result 420, and the change risk detection result 430 are processed to generate the risk detection result 440 for the platform system. The operation risk detection result 420 may include the online transaction risk detection result 421 and the batch transaction risk detection result 422. The risk levels corresponding to the risk detection result 440 may include high risk 441, medium risk 442, and low risk 443.

[0136] For the platform system with a high-risk level corresponding to the risk detection result 440, the online of the platform system can be automatically blocked to avoid the platform system going online with problems.

[0137] For the platform system with a medium-risk level corresponding to the risk detection result 440, corresponding approval procedures can be added to prompt relevant personnel to make decisions on the continued online of the platform system.

[0138] For the platform system with a low-risk level corresponding to the risk detection result 440, the detailed database risk detection result 410, the online transaction risk detection result 421, the batch transaction risk detection result 422, and the system change risk detection result 430 can be displayed to relevant personnel to facilitate the relevant personnel to eliminate the corresponding risk events or optimize the platform system.

[0139] Based on the above risk detection method, the present disclosure also provides a risk detection device. The following will be combined with Figure 5 to describe this device in detail.

[0140] Figure 5 The structural block diagram of the risk detection device according to an embodiment of the present disclosure is schematically shown.

[0141] As Figure 5 shown, the risk detection device 500 of this embodiment includes a first detection module 510, a second detection module 520, a third detection module 530, and a risk detection result generation module 540.

[0142] The first detection module 510 is used to determine the database risk detection result according to the database exception event information of the platform system.

[0143] The second detection module 520 is used to process the system operation characteristics representing the operation status of the platform system according to the preset rules to generate an operation risk detection result; wherein, the operation risk detection result includes an online transaction risk detection result and a batch transaction risk detection result.

[0144] The third detection module 530 is used to determine the change risk detection result according to the system change event information of the platform system.

[0145] The risk detection result generation module 540 is used to process the database risk detection result, the operation risk detection result, and the change risk detection result according to the preset risk detection rules, and generate a risk detection result for the platform system.

[0146] According to an embodiment of the present disclosure, the system operation characteristics include online transaction characteristics;

[0147] Processing the system operation characteristics used to characterize the operation status of the platform system according to the preset rules, and generating the operation risk detection result includes:

[0148] Evaluating the online transaction characteristics according to the first risk level rule to determine the first risk level of the online transaction characteristics;

[0149] Determining the online transaction risk detection result according to the first risk level of each online transaction characteristic.

[0150] According to an embodiment of the present disclosure, the online transaction characteristics include at least one of the following:

[0151] Online transaction processing time characteristics, online transaction frequency characteristics, and online transaction attribute characteristics.

[0152] According to an embodiment of the present disclosure, the system operation characteristics include batch transaction characteristics;

[0153] Processing the system operation characteristics used to characterize the operation status of the platform system according to the preset rules, and generating the operation risk detection result further includes:

[0154] Evaluating the batch transaction characteristics according to the second risk level rule to determine the second risk level of the batch transaction characteristics;

[0155] Determining the batch transaction risk detection result according to the second risk level of the batch transaction characteristics.

[0156] According to an embodiment of the present disclosure, the batch transaction characteristics include at least one of the following:

[0157] Batch transaction test characteristics, batch transaction execution duration characteristics, and batch transaction change characteristics.

[0158] According to an embodiment of the present disclosure, the system change event information includes at least one of the following:

[0159] System change method information, system change time compliance information, change rollback information, associated change information.

[0160] According to an embodiment of the present disclosure, processing the database risk detection result, the operation risk detection result, and the change risk detection result according to the preset risk detection rules, and generating the risk detection result for the platform system includes:

[0161] According to the preset risk detection rules, determine the first weight parameter of the database risk detection result, the second weight parameter of the running risk detection result, and the third weight parameter of the change risk detection result respectively;

[0162] Process the database risk detection result, the running risk detection result, and the change risk detection result according to the first weight parameter, the second weight parameter, and the third weight parameter to generate a risk detection result for the platform system.

[0163] According to an embodiment of the present disclosure, any plurality of modules among the first detection module 510, the second detection module 520, the third detection module 530, and the risk detection result generation module 540 may be combined and implemented in one module, or any one of them may be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules may be combined with at least part of the functions of other modules and implemented in one module. According to an embodiment of the present disclosure, at least one of the first detection module 510, the second detection module 520, the third detection module 530, and the risk detection result generation module 540 may be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application specific integrated circuit (ASIC), or any other reasonable manner that can integrate or package circuits, etc., implemented by hardware or firmware, or implemented in any one of the three implementation manners of software, hardware, and firmware, or in any appropriate combination of several of them. Alternatively, at least one of the first detection module 510, the second detection module 520, the third detection module 530, and the risk detection result generation module 540 may be at least partially implemented as a computer program module, which can execute corresponding functions when the computer program module is run.

[0164] Figure 6 Schematically shows a block diagram of an electronic device suitable for implementing the risk detection method according to an embodiment of the present disclosure.

[0165] As Figure 6 shown, the electronic device 600 according to an embodiment of the present disclosure includes a processor 601, which can perform various appropriate actions and processes according to a program stored in a read only memory (ROM) 602 or a program loaded from a storage section 608 into a random access memory (RAM) 603. The processor 601 may include, for example, a general microprocessor (such as a CPU), an instruction set processor, and / or a related chipset, and / or a dedicated microprocessor (such as an application specific integrated circuit (ASIC)), etc. The processor 601 may also include on-board memory for caching purposes. The processor 601 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0166] In the RAM 603, various programs and data required for the operation of the electronic device 600 are stored. The processor 601, the ROM 602, and the RAM 603 are connected to each other via a bus 604. The processor 601 performs various operations of the method flow according to the embodiments of the present disclosure by executing the programs in the ROM 602 and / or the RAM 603. It should be noted that the programs may also be stored in one or more memories other than the ROM 602 and the RAM 603. The processor 601 may also perform various operations of the method flow according to the embodiments of the present disclosure by executing the programs stored in the one or more memories.

[0167] According to an embodiment of the present disclosure, the electronic device 600 may further include an input / output (I / O) interface 605, and the input / output (I / O) interface 605 is also connected to the bus 604. The electronic device 600 may further include one or more of the following components connected to the I / O interface 605: an input portion 606 including a keyboard, a mouse, etc.; an output portion 607 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc. and a speaker, etc.; a storage portion 608 including a hard disk, etc.; and a communication portion 609 including a network interface card such as a LAN card, a modem, etc. The communication portion 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to the I / O interface 605 as needed. A removable medium 611, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 610 as needed so that a computer program read from it can be installed into the storage portion 608 as needed.

[0168] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or may exist separately without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the one or more programs are executed, the method according to the embodiments of the present disclosure is implemented.

[0169] According to an embodiment of the present disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, it may include but is not limited to: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the above. In the present disclosure, the computer-readable storage medium may be any tangible medium that contains or stores a program, and this program can be used by or in combination with an instruction execution system, apparatus, or device. For example, according to an embodiment of the present disclosure, the computer-readable storage medium may include one or more memories other than the above-described ROM 602 and / or RAM 603 and / or ROM 602 and RAM 603.

[0170] An embodiment of the present disclosure also includes a computer program product, which includes a computer program that contains program code for executing the method shown in the flowchart. When the computer program product runs in a computer system, the program code is used to enable the computer system to implement the risk detection method provided by the embodiment of the present disclosure.

[0171] When the computer program is executed by the processor 601, it executes the above functions defined in the system / apparatus of the embodiment of the present disclosure. According to an embodiment of the present disclosure, the above-described systems, apparatuses, modules, units, etc. can be implemented by computer program modules.

[0172] In one embodiment, the computer program can rely on tangible storage media such as optical storage devices and magnetic storage devices. In another embodiment, the computer program can also be transmitted and distributed in the form of a signal on a network medium, and be downloaded and installed through the communication part 609, and / or be installed from the removable medium 611. The program code contained in the computer program can be transmitted by any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0173] In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 609, and / or be installed from the removable medium 611. When the computer program is executed by the processor 601, it executes the above functions defined in the system of the embodiment of the present disclosure. According to an embodiment of the present disclosure, the above-described systems, devices, apparatuses, modules, units, etc. can be implemented by computer program modules.

[0174] In accordance with embodiments of the present disclosure, program code for executing the computer programs provided by the embodiments of the present disclosure may be written in any combination of one or more programming languages. Specifically, these computing programs may be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. The programming languages include, but are not limited to, programming languages such as Java, C++, Python, the "C" language, or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, partially on a remote computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., by connecting through the Internet using an Internet service provider).

[0175] The flowcharts and block diagrams in the accompanying drawings illustrate the possible architectures, functions, and operations of systems, methods, and computer program products according to various embodiments of the present disclosure. In this regard, each block in the flowchart or block diagram may represent a module, a program segment, or a part of code that contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than marked in the accompanying drawings. For example, two consecutive blocks shown may actually be executed substantially in parallel, and they may sometimes be executed in the reverse order, depending on the functions involved. It should also be noted that each block in the block diagram or flowchart, and combinations of blocks in the block diagram or flowchart, may be implemented by a dedicated hardware-based system for performing the specified functions or operations, or may be implemented by a combination of dedicated hardware and computer instructions.

[0176] Those skilled in the art can understand that the features recited in the various embodiments and / or claims of the present disclosure can be combined or / and combined in various ways, even if such combinations or combinations are not explicitly recited in the present disclosure. In particular, without departing from the spirit and teachings of the present disclosure, the features recited in the various embodiments and / or claims of the present disclosure can be combined and / or combined in various ways. All such combinations and / or combinations fall within the scope of the present disclosure.

[0177] The embodiments of the present disclosure have been described above. However, these embodiments are for illustrative purposes only and are not intended to limit the scope of the present disclosure. Although the embodiments have been described separately above, this does not mean that the measures in each embodiment cannot be used advantageously in combination. The scope of the present disclosure is defined by the appended claims and their equivalents. Without departing from the scope of the present disclosure, those skilled in the art can make various substitutions and modifications, and these substitutions and modifications should fall within the scope of the present disclosure.

Claims

1. A risk detection method, comprising: Determining a database risk detection result according to database abnormal event information of a platform system; Processing system operation characteristics for characterizing the operation status of the platform system according to a preset rule to generate an operation risk detection result, wherein the operation risk detection result includes an online transaction risk detection result and a batch transaction risk detection result; Determining a change risk detection result according to system change event information of the platform system; Processing the database risk detection result, the operation risk detection result and the change risk detection result according to a preset risk detection rule to generate a risk detection result for the platform system; Wherein, processing system operation characteristics for characterizing the operation status of the platform system according to a preset rule to generate an operation risk detection result includes: Evaluating online transaction characteristics in the system operation characteristics according to a first risk level rule to determine a first risk level of the online transaction characteristics, where the online transaction characteristics include at least one of an online transaction processing time characteristic, an online transaction frequency characteristic, and an online transaction attribute characteristic; Determining the online transaction risk detection result according to the first risk level of each online transaction characteristic.

2. The method according to claim 1, wherein The system operation characteristics include batch transaction characteristics; Processing system operation characteristics for characterizing the operation status of the platform system according to a preset rule to generate an operation risk detection result further includes: Evaluating the batch transaction characteristics according to a second risk level rule to determine a second risk level of the batch transaction characteristics; Determining the batch transaction risk detection result according to the second risk level of the batch transaction characteristics.

3. The method according to claim 2, wherein The batch transaction characteristics include at least one of the following: Batch transaction test characteristics, batch transaction execution duration characteristics, and batch transaction change characteristics.

4. The method according to claim 1, wherein The system change event information includes at least one of the following: System change method information, system change time compliance information, change rollback information, and associated change information.

5. The method according to claim 1, wherein, Processing the database risk detection result, the operation risk detection result and the change risk detection result according to a preset risk detection rule to generate a risk detection result for the platform system includes: Determining a first weight parameter of the database risk detection result, a second weight parameter of the operation risk detection result, and a third weight parameter of the change risk detection result respectively according to the preset risk detection rule; Processing the database risk detection result, the operation risk detection result and the change risk detection result according to the first weight parameter, the second weight parameter and the third weight parameter to generate a risk detection result for the platform system.

6. A risk detection device, comprising: A first detection module, configured to determine a database risk detection result according to database abnormal event information of a platform system; A second detection module, configured to process system operation characteristics for characterizing the operation status of the platform system according to a preset rule to generate an operation risk detection result; wherein the operation risk detection result includes an online transaction risk detection result and a batch transaction risk detection result; A third detection module, configured to determine a change risk detection result according to system change event information of the platform system; and A risk detection result generation module, configured to process the database risk detection result, the operation risk detection result, and the change risk detection result according to a preset risk detection rule, and generate a risk detection result for the platform system; Wherein, the second detection module is configured to: Evaluate the online transaction feature in the system operation features according to a first risk level rule, and determine a first risk level of the online transaction feature, where the online transaction feature includes at least one of an online transaction processing time feature, an online transaction frequency feature, and an online transaction attribute feature; Determine the online transaction risk detection result according to the first risk level of each of the online transaction features.

7. An electronic device, comprising: One or more processors; A storage device for storing one or more programs, Wherein, when the one or more programs are executed by the one or more processors, the one or more processors are caused to execute the method according to any one of claims 1 to 5.

8. A computer-readable storage medium, having executable instructions stored thereon, which when executed by a processor cause the processor to execute the method according to any one of claims 1 to 5.

9. A computer program product, comprising a computer program, which when executed by a processor implements the method according to any one of claims 1 to 5.

Images