Business event risk identification method, device, equipment and computer readable medium

Abstract

The present application relates to a risk identification method, device, equipment and computer-readable medium for business events. The method includes: obtaining business events generated by a business system in a production environment, wherein the business event is generated after the target object issues a business request to the business system, and the business system is used to provide the target object with the service of the target business; extracting the event features of the business event, and constructing a gene map of the target business with the event features as the gene constituent elements, wherein the gene map is used to represent the feature association relationship between the business events of the target business; based on the gene map and the feature association relationship, determining the suspicious risk features of the target business; and determining the risk level of the business event based on the suspicious risk features. The present application solves the technical problem that single-dimensional statistical rules cannot respond to changing attack methods in a timely manner.

Description

Technical Field

[0001] The present application relates to the field of risk control technology, and in particular to a method, device, equipment and computer-readable medium for identifying risks of business events. Background Art

[0002] Risk control refers to the various measures and methods taken by risk managers to eliminate or reduce the possibility of risk events, or reduce the losses caused by risk events. Nowadays, risk control systems are widely used in various business systems to ensure the safe operation of business systems. After building a business risk control system and connecting it to the business, the business will request the risk control interface according to the agreement (such as by business and scenario classification) for the business request that needs to be judged, and the rule engine of the risk control system will judge the risk level of the current request and return it to the business.

[0003] At present, in the relevant technology, part of the judgment rules of the business risk control system are based on single-dimensional statistical rules, such as the number of accounts registered with the same device, the number of accounts registered with the same IP address, etc. However, the thresholds set by such statistical rules mainly rely on personal experience. If the threshold is set too high, missed judgments will occur, and if the threshold is set too low, misjudgments will occur. In addition, the defense capability of single-dimensional rules is extremely low. Suspicious persons with abnormal behavior can update their attack methods, such as modifying device parameters to forge new devices, which can make it difficult to hit the device where abnormal behavior occurs during device statistics. Therefore, single-dimensional statistical rules can no longer respond to the ever-changing attack methods in a timely manner, and it is difficult to meet the needs of quickly and accurately identifying abnormal behaviors.

[0004] Statistical rules targeting a single dimension cannot respond to the ever-changing attack methods in a timely manner, and no effective solution has been proposed so far. Summary of the invention

[0005] The present application provides a business event risk identification method, device, equipment and computer-readable medium to solve the technical problem that single-dimensional statistical rules cannot respond to changing attack methods in a timely manner.

[0006] According to one aspect of an embodiment of the present application, the present application provides a method for identifying risks of business events, including:

[0007] Obtaining business events generated by the business system in the production environment, wherein the business event is generated after the target object sends a business request to the business system, and the business system is used to provide the target business service to the target object;

[0008] Extracting event features of business events, and constructing a gene map of the target business with the event features as gene constituent elements, wherein the gene map is used to represent the feature association relationship between business events of the target business;

[0009] Determine suspicious risk characteristics of the target business based on the gene map and feature associations; and,

[0010] Determine the risk level of business events based on suspicious risk characteristics.

[0011] Optionally, extracting event features of the business event and constructing a gene map of the target business with the event features as gene constituent elements includes:

[0012] Determine the event type of the business event and extract the characteristic fields that constitute the business event;

[0013] Determine a field name matching the event type for each feature field at the field naming node corresponding to each feature field, wherein feature fields of the same category correspond to the same field naming node, and the field naming node is used to determine the definition of feature fields of the same category in different business events; and,

[0014] A gene map of the target business is constructed based on the field name and field value of the feature field, wherein the event feature includes the event type, the field name of the feature field, and the field value of the feature field.

[0015] Optionally, constructing a gene map of a target business based on a field name and a field value of a characteristic field includes:

[0016] According to the core field name and the associated field name pre-specified for each business event, the characteristic field of each business event is divided into a core field and an associated field;

[0017] Extract multiple target business events with the same field value of the core field;

[0018] Merge the core fields with the same field values ​​in multiple target business events, and add the merged core fields, the field values ​​of the core fields, and all other associated fields and corresponding field values ​​to the same gene cluster;

[0019] Establish connections between associated fields with the same field values ​​in different gene clusters; and,

[0020] A map consisting of multiple gene clusters is determined as a gene map.

[0021] Optionally, constructing a gene map of the target business based on the field name and field value of the feature field further includes:

[0022] According to the core field name and the associated field name pre-specified for each business event, the characteristic field of each business event is divided into a core field and an associated field;

[0023] When there are multiple core fields in the same business event, determine the priority of each core field;

[0024] Compare the field values ​​of core fields among multiple business events in order of priority;

[0025] Determine multiple business events with priorities greater than or equal to the target priority and with the same field value of the core field as target business events;

[0026] Merge the core fields with the same field values ​​in the target business events, and add the merged core fields, the field values ​​of the core fields, and all other associated fields and corresponding field values ​​to the same gene cluster;

[0027] Establish connections between associated fields with the same field values ​​in different gene clusters; and,

[0028] A map consisting of multiple gene clusters is determined as a gene map.

[0029] Optionally, constructing a gene map of the target business based on the field name and field value of the feature field further includes:

[0030] According to the core field name and the associated field name pre-specified for each business event, the characteristic field of each business event is divided into a core field and an associated field;

[0031] When there are multiple core fields in the same business event, assign a weight to each core field;

[0032] Compare the field values ​​of core fields between multiple business events;

[0033] Accumulate the weights corresponding to the core fields with the same field values ​​to obtain the core field similarity;

[0034] Determine multiple business events whose core field similarity is greater than or equal to a target threshold as target business events;

[0035] Merge the core fields with the same field values ​​in the target business events, and add the merged core fields, the field values ​​of the core fields, and all other associated fields and corresponding field values ​​to the same gene cluster;

[0036] Establish connections between associated fields with the same field values ​​in different gene clusters; and,

[0037] A map consisting of multiple gene clusters is determined as a gene map.

[0038] Optionally, based on the gene map and the feature association relationship, determining the suspicious risk features of the target business includes:

[0039] Determine the number of field values ​​of each characteristic field of each gene cluster in the gene map, wherein the number of field values ​​is the number of field values ​​corresponding to the characteristic field;

[0040] Extracting characteristic fields in sequence according to the sorting priorities configured in advance for the plurality of characteristic fields, and sorting the plurality of gene clusters in the order of the number of field values ​​of the characteristic fields from large to small;

[0041] Select the target gene cluster before the target sorting position from the sorting results;

[0042] When the number of field values ​​of the core field in the target gene cluster is greater than or equal to the first number threshold of the corresponding category, the field value of the core field is determined as a suspicious risk feature of the target business in the target gene cluster.

[0043] Optionally, after selecting the target gene cluster before the target ranking position from the ranking results, determining the suspicious risk features of the target business based on the gene map and the feature association relationship further includes:

[0044] In the target gene cluster, for each core field, the number of field values ​​of the associated fields that have a characteristic association relationship with the core field is counted;

[0045] When the number of field values ​​of the associated field is greater than or equal to the second number threshold of the corresponding category, obtaining all field values ​​of the associated field;

[0046] Divide the field value into multiple value segments;

[0047] Sort the value fragments in descending order according to the number of occurrences of each value fragment;

[0048] The target value fragment before the target sorting position is selected from the sorting results, and the target value fragment and the associated core field are determined as suspicious risk features of the target business in the target gene cluster.

[0049] Optionally, based on the gene map and the feature association relationship, determining the suspicious risk features of the target business also includes:

[0050] Compare the field value of the characteristic field of each gene cluster in the gene map with the existing field value in the case library to obtain the comparison result;

[0051] When the similarity of the comparison result is greater than the similarity threshold, the field value of the feature field is determined as a suspicious risk feature of the target business in the target gene map.

[0052] Optionally, the method further comprises:

[0053] Add the target business and the suspicious risk features of the target business to the case library, so as to use the suspicious risk features as the basic data for the graph analysis of the target business.

[0054] According to another aspect of an embodiment of the present application, the present application provides a risk identification device for a business event, including:

[0055] An event acquisition module is used to acquire business events generated by the business system in the production environment, wherein the business event is generated after the target object sends a business request to the business system, and the business system is used to provide the target business service to the target object;

[0056] A graph construction module is used to extract event features of business events and construct a gene graph of the target business with the event features as gene constituent elements, wherein the gene graph is used to represent the feature association relationship between business events of the target business;

[0057] A suspicious feature determination module, used to determine the suspicious risk features of the target business based on the gene map and feature association relationship; and

[0058] The risk identification module is used to determine the risk level of business events based on suspicious risk characteristics.

[0059] According to another aspect of an embodiment of the present application, the present application provides an electronic device, including a memory, a processor, a communication interface and a communication bus, wherein the memory stores a computer program that can be run on the processor, the memory and the processor communicate through the communication bus and the communication interface, and the steps of the above method are implemented when the processor executes the computer program.

[0060] According to another aspect of an embodiment of the present application, the present application also provides a computer-readable medium having a non-volatile program code executable by a processor, and the program code enables the processor to execute the above method.

[0061] The above technical solution provided by the embodiment of the present application has the following advantages compared with the related art:

[0062] The technical solution of this application is to obtain the business events generated by the business system in the production environment, wherein the business event is generated after the target object sends a business request to the business system, and the business system is used to provide the target object with the service of the target business; extract the event features of the business event, and construct a gene map of the target business with the event features as the gene constituent elements, wherein the gene map is used to represent the characteristic association relationship between the business events of the target business; based on the gene map and the characteristic association relationship, determine the suspicious risk features of the target business; and determine the risk level of the business event based on the suspicious risk features. This application establishes a gene map of the target business based on multiple features of multiple business events, so as to use the gene map for multi-feature joint analysis to obtain the suspicious risk features in the target business, and finally use the suspicious risk features to determine the risk level of the business event, so that even if the suspicious person with abnormal behavior constantly updates his attack means, the technical solution of this application can quickly and accurately find the attack direction after the suspicious person with abnormal behavior uses his attack means to implement the attack behavior, and then accurately identify the risk, further improve the stability of business operation, and solve the technical problem that the statistical rules of a single dimension cannot respond to the changing attack methods in a timely manner. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0064] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related technologies, the drawings required for use in the embodiments or the related technical descriptions are briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0065] Figure 1 A schematic diagram of a hardware environment for an optional business event risk identification method provided according to an embodiment of the present application;

[0066] Figure 2 A schematic diagram of a flow chart of an optional business event risk identification method provided according to an embodiment of the present application;

[0067] Figure 3 A schematic diagram of an optional gene cluster 1 provided according to an embodiment of the present application;

[0068] Figure 4 A schematic diagram of an optional gene cluster 2 provided according to an embodiment of the present application;

[0069] Figure 5 This is a schematic diagram of an optional connection of associated features of gene clusters 1 and 2 provided according to an embodiment of the present application;

[0070] Figure 6 A schematic diagram of another optional gene cluster 1 provided according to an embodiment of the present application;

[0071] Figure 7 A schematic diagram of another optional gene cluster 2 provided according to an embodiment of the present application;

[0072] Figure 8 This is another optional schematic diagram of connecting the associated features of gene clusters 1 and 2 provided according to an embodiment of the present application;

[0073] Fig. 9 A schematic diagram of an optional gene cluster 3 and 4 provided according to an embodiment of the present application;

[0074] Fig.10 This is a schematic diagram of an optional connection of the associated features of gene clusters 3 and 4 provided according to an embodiment of the present application;

[0075] Fig.11 A schematic diagram of an optional three-dimensional gene map provided according to an embodiment of the present application;

[0076] Fig.12 A schematic diagram of another optional three-dimensional gene map provided according to an embodiment of the present application;

[0077] Fig.13 A schematic diagram of an optional value segment sorting provided according to an embodiment of the present application;

[0078] Fig.14 A block diagram of an optional risk identification device for business events provided according to an embodiment of the present application;

[0079] Fig.15 A schematic diagram of the structure of an optional business event risk identification device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0080] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0081] In the subsequent description, the suffixes such as "module", "component" or "unit" used to represent elements are only used to facilitate the description of the present application and have no specific meaning. Therefore, "module" and "component" can be used interchangeably.

[0082] In the related art, part of the judgment rules of the business risk control system are based on single-dimensional statistical rules, such as the number of accounts registered for the same device, the number of accounts registered for the same IP address, etc. However, the thresholds set by such statistical rules mainly rely on personal experience. If the threshold is set too high, missed judgments will occur, and if the threshold is set too low, misjudgments will occur. Not only that, the defense capability of single-dimensional rules is extremely low. Suspicious persons with abnormal behavior can update their attack methods, such as modifying device parameters to forge new devices, which can make it difficult to hit the device where the abnormal behavior occurs during device statistics. Therefore, single-dimensional statistical rules can no longer respond to the ever-changing attack methods in a timely manner, and it is difficult to meet the needs of quickly and accurately identifying abnormal behaviors.

[0083] In order to solve the problem mentioned in the background technology, according to one aspect of an embodiment of the present application, an embodiment of a method for identifying risks of a business event is provided.

[0084] Optionally, in the embodiment of the present application, the risk identification method of the business event can be applied to Figure 1 In the hardware environment composed of the terminal 101 and the server 103 shown in FIG. Figure 1 As shown, the server 103 is connected to the terminal 101 via a network, and can be used to provide services for the terminal or a client installed on the terminal (such as business services, feature field extraction services for business events, gene map construction services, risk identification services, and risk identification strategy generation services, etc.). A database 105 can be set on the server or independently of the server to provide data storage services for the server 103. The above-mentioned network includes but is not limited to: a wide area network, a metropolitan area network or a local area network, and the terminal 101 includes but is not limited to a PC, a mobile phone, a tablet computer, etc.

[0085] A risk identification method for a business event in an embodiment of the present application may be executed by the server 103, or may be executed jointly by the server 103 and the terminal 101, such as Figure 2 As shown, the method may include the following steps:

[0086] Step S202, obtaining a business event generated by the business system in the production environment, wherein the business event is generated after the target object sends a business request to the business system, and the business system is used to provide the target object with a target business service;

[0087] Step S204, extracting event features of the business events, and constructing a gene map of the target business with the event features as gene constituent elements, wherein the gene map is used to represent feature association relationships between business events of the target business;

[0088] Step S206, determining suspicious risk characteristics of the target business based on the gene map and the characteristic association relationship; and

[0089] Step S208: determining the risk level of the business event based on the suspicious risk characteristics.

[0090] Through the above steps S202 to S208, the present application establishes a genetic map of the target business based on multiple features of multiple business events, and then uses the genetic map to perform multi-feature joint analysis to obtain suspicious risk features in the target business. Finally, the suspicious risk features can be used to determine the risk level of the business event. Then, even if the suspicious person with abnormal behavior constantly updates his attack methods, the technical solution of the present application can quickly and accurately find the attack direction after the suspicious person with abnormal behavior uses his attack methods to carry out the attack behavior, and then accurately identify risks, further improve the stability of business operations, and solve the technical problem that the statistical rules of a single dimension cannot respond to the ever-changing attack methods in a timely manner.

[0091] In the technical solution provided in step S202, after the user sends a business request to the business system, the business system will create a corresponding task in response to the business request. The task is a business event. For example, if the user sends a registration request to the business system, a registration event is generated. If the user sends a login request to the business system, a login event is generated. For example, if the user sends a participation request to the business system for a new user activity, a participation event of the same nature as the registration event is generated. If the user sends a support request to the business system for a new user activity, a support event for the inviter is generated. The business system is used to provide users with registration services, login services, recharge services, new user activity services, etc. The above-mentioned production environment can be the working environment for the online operation of the business system.

[0092] In the technical solution provided in step S204, event features of the business event can be extracted by extracting feature fields, and a gene map of the target business can be constructed with the event features as gene constituent elements. Specifically, extracting event features of the business event and constructing a gene map of the target business with the event features as gene constituent elements includes:

[0093] Step 1: determine the event type of the business event and extract the characteristic fields that constitute the business event.

[0094] In the embodiment of the present application, business requests have different request types, such as registration requests, login requests, participation requests, and assistance requests, etc. Correspondingly, business events also have different event types, namely registration events, login events, recharge events, participation events, assistance events, and withdrawal events, etc. Different types of events can have the same characteristic fields, such as device number, mobile phone number, IP address, account number, etc. The description of a business event is such as: a user with mobile phone number 138 registered account 888 on device A at a certain time yesterday, and the IP used for networking is xxx, then it can be determined that the business event is a registration event, and the characteristic fields that can be extracted include: device A, IPxxx, account number 888, mobile phone number 138.

[0095] Furthermore, for each specific event, the association between various features can be determined according to the event type. For example, the above registration event has the following associations: [Device A registration association with account 888], [IPxxx registration association with account 888], [Mobile phone number 138 registration association with account 888], [Device A registration association with mobile phone number 138], [IPxxx registration association with mobile phone number 138], [Device A registration association with IPxxx]. The purpose of constructing the gene map of the target business is to jointly analyze the features of multiple business events of the target business, so as to explore the feature associations between the business events of the target business, such as one device number registering multiple accounts, one account logging in to multiple devices and multiple IP addresses, etc.

[0096] Step 2: Determine a field name that matches the event type for each feature field at the field naming node corresponding to each feature field, wherein feature fields of the same category correspond to the same field naming node, and the field naming node is used to determine the definition of feature fields of the same category in different business events.

[0097] In an embodiment of the present application, the definition of the feature field of the same category in different business events can be determined at the field naming node, that is, a field name matching the event type is determined for each feature field. For example, in a registration event, the feature field device number can be named as the registration device number, in a login event, the device number can be named as the login device number, and in a recharge event, the device number can be named as the recharge device number. The above registration device number, login device number, recharge device number and other device number-related ones all belong to the same category, namely the device number category. Similarly, mobile phone number-related ones can be classified into the mobile phone number category, IP address-related ones can be classified into the IP address category, and account-related ones can be classified into the account category.

[0098] Step 3: construct a gene map of the target business based on the field name and field value of the feature field, wherein the event feature includes the event type, the field name of the feature field, and the field value of the feature field.

[0099] In the embodiment of the present application, in order to enable the gene map to represent the characteristic association relationship between the business events of the target business, the characteristic fields of the business events can be divided into core fields and associated fields, the core fields represent the core features of the business events, and the associated fields represent the features that have an association relationship with the core features. When constructing the gene map, all features of the business events with the same core features (i.e., the core features represented by the core fields and the associated features represented by the associated fields) are merged, and common ground is sought while reserving differences. Finally, a gene map reflecting the characteristic association relationship between events can be constructed based on all the business events that have occurred in the target business. The technical solution for constructing the gene map of the target business based on the field names and field values ​​of the characteristic fields is described in detail below.

[0100] Optionally, constructing a gene map of a target business based on a field name and a field value of a characteristic field includes:

[0101] Step 1: divide the characteristic fields of each business event into core fields and associated fields according to the core field names and associated field names pre-specified for each business event.

[0102] In an embodiment of the present application, the designation of core fields and associated fields can be set according to the specific circumstances of the business event. For example, in a registration event, the device number is designated as the core field, and the registered device number is the core field name. The mobile phone number and account number are designated as associated fields, and the registered mobile phone number and account number are the associated field names.

[0103] Step 2: extract multiple target business events with the same field value of the core field.

[0104] In an embodiment of the present application, if the designated core field is the device number, and there are the following events: event one, device A + mobile phone number B registered account b; event two, device C + mobile phone number D registered account d; event three, device A + mobile phone number D logged in to account d, then the field values ​​of the core fields of matching event one and event three are exactly the same (both are device A), then event one and event three are determined as the target business events of the features to be merged, and event 2 is taken as a target event alone.

[0105] Step 3: merge the core fields with the same field values ​​in multiple target business events, and add the merged core fields, the field values ​​of the core fields, and all other associated fields and corresponding field values ​​to the same gene cluster.

[0106] In the embodiment of the present application, merging the core fields with the same field values ​​in event one and event three means that only one of the same field values ​​is retained when adding to a gene cluster, and all other associated fields and corresponding field values ​​are added to the same gene cluster, such as Figure 3As shown in , device A, mobile phone number B, account b, mobile phone number D, and account d can be added to the same gene cluster (gene cluster 1), and Figure 4 As shown, the device C, mobile phone number D, and account number d of event 2 are added to another cluster (gene cluster 2).

[0107] Step 4: Establish connections between associated fields with the same field values ​​in different gene clusters.

[0108] In the embodiment of the present application, a connection can be established between associated fields with the same field values ​​in multiple gene maps, such as Figure 5 As shown, the mobile phone number D and the account number d are the same field values ​​in the two gene maps, so the associated fields of the two are connected. The connection form can be a method of finding the intersection, or other connection methods, such as connecting lines.

[0109] Step 5: determine the map composed of multiple gene clusters as a gene map.

[0110] In the embodiment of the present application, the gene map is composed of multiple gene clusters, which integrates the business events and characteristics of multiple businesses, thereby serving as the basis for feature analysis.

[0111] If there are multiple core fields specified, the gene map can be generated according to the following logic.

[0112] Optionally, constructing a gene map of the target business based on the field name and field value of the feature field further includes:

[0113] Step 1, according to the core field name and the associated field name pre-specified for each business event, the characteristic field of each business event is divided into a core field and an associated field;

[0114] Step 2: When there are multiple core fields in the same business event, determine the priority of each core field;

[0115] Step 3: compare the field values ​​of the core fields among multiple business events in order of priority;

[0116] Step 4, determining multiple business events whose priorities are greater than or equal to the target priority and whose core fields have the same field values ​​as target business events;

[0117] Step 5: merge the core fields with the same field values ​​in the target business events, and add the merged core fields, the field values ​​of the core fields, and all other associated fields and corresponding field values ​​to the same gene cluster;

[0118] Step 6, establishing connections between associated fields with the same field values ​​in different gene maps;

[0119] Step 7: determine the map composed of multiple gene clusters as a gene map.

[0120] In the embodiment of the present application, if the device number and the mobile phone number are specified as core fields, the priority of the device number is higher than the mobile phone number, and there are the following events: Event 1, device A + mobile phone number B registered account b; Event 2, device C + mobile phone number D registered account d; Event 3, device A + mobile phone number D logged in to account d; Event 4, device E + mobile phone number B logged in to account b. Figure 6 As shown, according to the priority of device number being greater than mobile phone number, we first match that the field values ​​of the core field of device number of event one and event three are exactly the same (both are device A), then event one and event three are determined as target business events and their features are added to one gene cluster. Then, we match that the field values ​​of the core field of mobile phone number of event one and event four are exactly the same (both are mobile phone number B), then event four is also determined as the target business event merged with event one and event three, and the features of event four are also added to the same gene cluster. Although event two has the same field value of the core field of mobile phone number as event three, the field values ​​of the two core fields of event two and event one are inconsistent, and the field values ​​of the two core fields of event four are also inconsistent. Therefore, event two can be identified as an event with a low correlation with the gene clusters where events one, three and four are located, and the features of event two are added separately to another gene cluster, as shown in FIG. Figure 7 Finally, in the above two gene clusters, a connection is established between the feature fields with the same field values ​​(mobile phone number D, account number d), as shown in Figure 8 shown.

[0121] If there are multiple core fields specified, the gene map can also be generated according to the following logic.

[0122] Optionally, constructing a gene map of the target business based on the field name and field value of the feature field further includes:

[0123] Step 1, according to the core field name and the associated field name pre-specified for each business event, the characteristic field of each business event is divided into a core field and an associated field;

[0124] Step 2: When there are multiple core fields in the same business event, assign a weight to each core field;

[0125] Step 3: compare the field values ​​of the core fields among multiple business events;

[0126] Step 4: Accumulate the weights corresponding to the core fields with the same field values ​​to obtain the core field similarity;

[0127] Step 5, determining multiple business events whose core field similarity is greater than or equal to the target threshold as target business events;

[0128] Step 6: merge the core fields with the same field values ​​in the target business events, and add the merged core fields, the field values ​​of the core fields, and all other associated fields and corresponding field values ​​to the same gene cluster;

[0129] Step 7, establishing connections between associated fields with the same field values ​​in different gene clusters;

[0130] Step 8: determine the map composed of multiple gene clusters as a gene map.

[0131] In the embodiment of the present application, if the device number, mobile phone number and account number are designated as core fields, the corresponding weights are assigned to 0.5, 0.3 and 0.2, and the target threshold is 0.5, then the situations in which the same gene cluster can be added include: the same device number, the same device number + mobile phone number and the same device number + account number, while only the same mobile phone number or the same account number cannot be added to the same gene cluster. The weights and target thresholds of the above core fields can be configured according to the actual business needs.

[0132] Furthermore, the business requests, business events, feature fields and the gene clusters constructed above can be associated and saved in the database, such as data one: registration request 1+device A+mobile phone number B+account b+gene cluster 1; data two: registration request 2+device C+mobile phone number D+account d+gene cluster 2; data three: login request 1+device A+mobile phone number D+account d+gene cluster 1; data four: login request 2+device E+mobile phone number B+account b+gene cluster 1.

[0133] The construction of the genetic map is explained again below using the new customer acquisition and cash withdrawal activities.

[0134] In the embodiment of the present application, the new customer withdrawal activities include participation events, support events, and withdrawal events. The characteristic fields of participation events include participating accounts and participating devices; the characteristic fields of support events include support accounts, support devices, inviter accounts, and inviter devices; the characteristic fields of withdrawal events include withdrawal accounts and withdrawal devices. If the following events exist and the specified core fields are device and account, the matching weight of the device is greater than the matching weight of the account, such as Fig. 9 As shown, the corresponding gene map is constructed:

[0135] Participation event 5, participation account A + participation device A, generates gene cluster 3;

[0136] Assistance event six: Assistance account B + Assistance device B + Inviter account A + Inviter device A. Device A and account A are successfully matched and added to gene cluster 3.

[0137] Assistance event seven: Assistance account C + Assistance device C + Inviter account A + Inviter device A. Device A and account A are successfully matched and added to gene cluster 3.

[0138] Participation event 8, participation account D + participation device D, does not match the core fields of the above events, generating gene cluster 4;

[0139] Assistance event nine, assisting account E + assisting device E + inviter account D + inviter device D, device D and account D are successfully matched and added to gene cluster 4;

[0140] Withdrawal event ten, withdrawal account A + withdrawal device A, device A and account A are successfully matched and added to gene cluster 3;

[0141] Withdrawal event eleven, withdrawal account D + withdrawal device A. Since the device weight is greater than the account weight, device A is matched first and added to gene cluster 3.

[0142] Finally, if Fig.10 As shown, in gene cluster 3 and gene cluster 4, a connection is established between associated fields with the same field values ​​(device A, account number D).

[0143] In the embodiment of the present application, the final gene map can be displayed in two dimensions or three dimensions, wherein the characteristic fields in the gene map are points and the associations between the characteristics are edges, and the following can be obtained: Fig.11 and Fig.12 The three-dimensional gene map shown. In the three-dimensional gene map, the larger and denser the clusters are, the greater the probability that the core features of the clusters are suspicious risk features. Therefore, the technical solution of the present application can also intuitively display the characteristic composition and suspicious risk features of the target business after constructing the gene map, thereby improving the decision-making efficiency and accuracy of decision-makers.

[0144] In the technical solution provided in step S206, based on the gene map and the feature association relationship, determining the suspicious risk features of the target business includes:

[0145] Step 1: determine the number of field values ​​of each characteristic field of each gene cluster in the gene map, where the number of field values ​​is the number of field values ​​corresponding to the characteristic field.

[0146] In the embodiment of the present application, in a gene cluster, there may be device A, device B and device C, and the number of fields in the "device number" feature field of the gene cluster is 3.

[0147] Step 2: extract the characteristic fields in sequence according to the sorting priorities configured in advance for the multiple characteristic fields, and sort the multiple gene clusters in the order of the number of field values ​​of the characteristic fields from large to small.

[0148] In the embodiment of the present application, if the characteristic fields of the business event of the target business include device number, mobile phone number, account number and generation time, the sorting priority is described as follows: device number is greater than mobile phone number, account number is greater than generation time. If the following gene map exists:

[0149] Gene cluster 5, the number of field values ​​for device number is 20, the number of field values ​​for mobile number is 1000, the number of field values ​​for account number is 2000, and the number of field values ​​for generation time is 2000;

[0150] Gene cluster 6, the number of field values ​​for device number is 18, the number of field values ​​for mobile number is 1000, the number of field values ​​for account number is 2000, and the number of field values ​​for generation time is 2000;

[0151] Gene cluster 7, the number of field values ​​for device number is 18, the number of field values ​​for mobile number is 1200, the number of field values ​​for account number is 2000, and the number of field values ​​for generation time is 2000;

[0152] For gene cluster 8, the number of field values ​​for device number is 15, the number of field values ​​for mobile number is 1200, the number of field values ​​for account number is 2000, and the number of field values ​​for generation time is 2000.

[0153] When sorting the above gene clusters, first sort by the number of fields in the device number to get: top1, gene cluster 5, top2, gene cluster 6, top2, gene cluster 7, top3, gene cluster 8. Then sort by the number of fields in the mobile phone number to get: top1, gene cluster 5, top2, gene cluster 7, top3, gene cluster 6, top4, gene cluster 8. And so on, until the final sorting of all gene clusters is obtained.

[0154] Step 3: Select the target gene cluster before the target ranking position from the ranking results.

[0155] Step 4: When the number of field values ​​of the core field in the target gene cluster is greater than or equal to the first quantity threshold of the corresponding category, the field value of the core field is determined as a suspicious risk feature of the target business in the target gene cluster.

[0156] In the embodiment of the present application, the above-mentioned target ranking position can be set according to actual needs, such as the top 10.

[0157] In an embodiment of the present application, a core field can be specified from the above-mentioned feature fields as the main analysis object. If the device number and account number are specified as core fields, corresponding quantity thresholds can be set for the device number and account number, respectively. When the field quantity of the core field is greater than or equal to the first quantity threshold of the corresponding category, the field value of the core field is determined as a suspicious risk feature of the target business in the target gene cluster. For example, when the field value quantity of the device number is greater than 10 (the number of devices included in the gene cluster is greater than 10), all device numbers in the gene cluster are confirmed as suspicious risk features.

[0158] In the embodiment of the present application, in order to make the location of suspicious risk features more accurate, the scope of suspicious risk features can be narrowed down based on the feature association relationship between business events represented by the gene map.

[0159] Optionally, after selecting the target gene map before the target ranking position from the ranking results, determining the suspicious risk features of the target business based on the gene map and the feature association relationship further includes:

[0160] Step 1: In the target gene cluster, for each core field, count the number of field values ​​of associated fields that have a characteristic association relationship with the core field.

[0161] In the embodiment of the present application, the core field represents the core feature of the business event, and the associated field represents the feature that has an associated relationship with the core feature. Taking the device number as the core field, and the account number and the mobile phone number as the associated fields as an example, when [1000 accounts associated with the registration relationship of device A] is counted, it means that 1000 accounts are registered on device A, which means that 1000 registration events have occurred on device A. When [1000 mobile phone numbers associated with the registration relationship of device A] is counted, it means that 1000 mobile phone numbers have been registered on device A.

[0162] Step 2: When the number of field values ​​of the associated field is greater than or equal to the second number threshold of the corresponding category, all field values ​​of the associated field are obtained.

[0163] In the embodiment of the present application, taking the second quantity threshold of the mobile phone numbers associated with the same device as 100 as an example, if the information [100 mobile phone numbers associated with the registration relationship of device A] is counted, all mobile phone numbers associated with device A are obtained. Here, the second quantity threshold can also be lower than the quantity threshold for directly judging suspicious risk features (that is, exceeding this threshold can determine that it is a risk feature) to achieve the judgment of features with lower field values. For example, the number of associated mobile phone numbers exceeding 100 can be directly determined as a suspicious risk feature, and the second quantity threshold can be set to 80, so as to judge the fund clusters with 80-100 associated mobile phone numbers.

[0164] Step 3: Divide the field value into multiple value segments.

[0165] In an embodiment of the present application, the field value is divided into multiple value segments in order to find similar features, such as dividing an eleven-digit mobile phone number into three value segments, namely, the first to third digits, the fourth to seventh digits, and the eighth to eleventh digits.

[0166] Step 4: Sort the value fragments in descending order according to the number of occurrences of each value fragment.

[0167] In the embodiment of the present application, after the field value is divided into multiple value segments, the value segments are sorted in descending order of the number of occurrences of each value segment, such as Fig.13 The following is a schematic diagram of sorting the first three digits of a mobile phone number. Other sortable fields include but are not limited to the location of the mobile phone number, device number, account number, IP address, etc.

[0168] Step 5: Select the target value fragment before the target sorting position from the sorting results, and determine the target value fragment and the associated core field as the suspicious risk feature of the target business in the target gene cluster.

[0169] In the embodiment of the present application, when the number of fields of a certain associated field associated with the core field is large, it indicates that the core field is abnormal, such as 1,000 accounts registered on one device. For value fragments that appear too many times, they can also be determined as suspicious risk features, such as a large number of mobile phone numbers in the 170 segment used by suspected illegal behavior personnel to register. After sorting the value fragments of the associated fields, the technical solution of the present application can find out the suspicious risk features of a large number of accounts registered by suspected illegal behavior personnel using the 170 segment, thereby strengthening the attention to the features related to the value fragments and providing a clear direction for risk identification.

[0170] Those skilled in the art can understand that the above-mentioned scheme of dividing value segments can be further combined with the judgment of suspicious risk characteristics of core fields (that is, when the number of field values ​​of the core field in the target gene cluster is greater than or equal to the first quantity threshold of the corresponding category, the field value of the core field is determined as a suspicious risk characteristic of the target business in the target gene cluster). At this time, the second quantity threshold needs to be set lower than the first quantity threshold, so as to judge the gene clusters with the number of field values ​​between the first and second thresholds.

[0171] In the technical solution provided in step S208, the risk level of the business event is determined based on the suspicious risk characteristics. Specifically, the risk level of the business event may be determined based on factors such as the number, type, distribution of the suspicious risk characteristics contained in the business event and the impact of these characteristics on business operations. The risk level may be general risk, serious risk, high risk, special risk, etc. Technical personnel in this field also classify the risk levels according to actual conditions, such as customizing category names, number of categories, etc.

[0172] Optionally, based on the gene map and the feature association relationship, determining the suspicious risk features of the target business also includes:

[0173] Step 1, compare the field value of the characteristic field of each gene cluster in the gene map with the existing field value in the case library to obtain the comparison result;

[0174] Step 2: When the similarity of the comparison result is greater than the similarity threshold, the field value of the feature field is determined as the suspicious risk feature of the target business in the target gene map.

[0175] In the embodiment of the present application, the field value of the characteristic field of each gene cluster can be directly compared with the field value of the existing field in the case library, so as to determine the suspicious risk characteristics in the current gene cluster according to the similarity of the field value. The similarity of the above field value can be the similarity of the specific content of the field value, such as the similarity of the mobile phone numbers 170****8836 and 170****8839 (the **** part of the two is the same) is 90.9%, or it can be the similarity of the number of field values. For example, the number of mobile phone numbers in the current gene cluster is 100, and the number of mobile phone numbers in a case is 125, then the similarity of the number of field values ​​is 80%.

[0176] Optionally, field name comparison and field value comparison may be combined, and when both field name similarity and field value similarity meet certain conditions, both the field names and field values ​​that meet the conditions are confirmed as suspicious risk features in the current gene cluster.

[0177] For example, the field name similarity can be determined in the following way: compare the field name of the characteristic field of each gene cluster in the gene map with the existing field name in the case library. For example, there are 4 fields in the current gene cluster, namely device number, mobile phone number, account number and IP address, and there are 3 fields in the cluster of a case, namely device number, mobile phone number and account number, then the field name similarity is 75%.

[0178] Optionally, the target business and the suspicious risk features of the target business may also be added to the case library, so that the suspicious risk features can be used as basic data for the graph analysis of the target business.

[0179] In the embodiment of the present application, the case library can be continuously updated and upgraded to record the characteristics of suspicious risks that have appeared in the past and provide basic data for graph analysis.

[0180] The present application establishes a genetic map of the target business based on multiple features of multiple business events, and then uses the genetic map to perform multi-feature joint analysis to obtain suspicious risk features in the target business. Finally, the suspicious risk features can be used to determine the risk level of the business event. Therefore, even if the suspicious person with abnormal behavior constantly updates his attack methods, the technical solution of the present application can quickly and accurately find the attack direction after the suspicious person with abnormal behavior uses his attack methods to carry out the attack behavior, and then accurately identify risks, further improve the stability of business operations, and solve the technical problem that the statistical rules of a single dimension cannot respond to the ever-changing attack methods in a timely manner.

[0181] Furthermore, after obtaining suspicious risk features based on the gene map, a risk identification strategy can be generated or updated for the suspicious risk features to assist in identifying the risk level of business events. For example, if the suspicious risk feature is device A+170 segment, both device A and 170 segment are used as screening fields for key inspection in the production environment. The screening results can be submitted to manual inspection, or a neural network can be used to determine the probability that the screening results are illegal behaviors.

[0182] For updating the risk identification strategy, this application also provides a strategy updating method, which specifically includes:

[0183] Step 1, when a first business event in a business system is identified as a first suspicious risk event based on a first risk identification strategy, data including a second business event previously identified as having no suspicious risk within a target time period is obtained as first backtest data, wherein the target time period is earlier than the time point when the first business event is identified as the first suspicious risk event;

[0184] Step 2, determining a specific second business event that matches the target feature of the first suspicious risk event in the first backtest data, and re-identifying the specific second business event as a second suspicious risk event with a suspicious risk; and

[0185] Step 3: Use the second suspicious risk event and the target feature to update the first risk identification strategy to obtain a second risk identification strategy.

[0186] In the above-mentioned strategy update scheme, the risk identification method of the business event described above can be used to determine the first suspicious risk event, that is, to complete the process of distinguishing the first business event in the business system as the first suspicious risk event based on the first risk identification strategy: evaluate the risk level of each business event, determine the suspicious risk features in the business event through the gene map and feature association relationship, and when the risk level of the business event determined by the suspicious risk features reaches the set risk level, the business event is distinguished as the first suspicious risk event. The strategy update scheme is further described below.

[0187] In the embodiment of the present application, when the first business event is found to be a suspicious risk event based on the first risk identification strategy, the backtest data can be retrieved, and the second business event can be analyzed in the backtest data to find a specific second business event with a feature matching relationship with the first business event, and the first risk identification strategy can be updated using the specific second business event and the matching features, so that the second risk identification strategy can be used to identify suspicious risk events that the first risk identification strategy fails to identify, and the update of the risk identification strategy is completed. For example, when a suspicious illegal behavior person registers multiple accounts, he uses different devices to register. The risk control system identifies these registration events as normal events. When the suspicious illegal behavior person later implements an attack, multiple accounts are logged in on the target device in a short period of time. When the number of logged-in accounts exceeds the judgment threshold of one day, the risk control system will identify the login event that exceeds the judgment threshold as the first suspicious risk event. At this time, it is found that the target device is a feature of the attack means implemented by the suspicious illegal behavior person, that is, the target device is determined to be a suspicious risk feature. The technical solution of the present application finds other events associated with the target device in the backtest data, such as login events using the target device and not exceeding the discrimination threshold and registration events using the target device to register an account, and then re-identifies these events as second suspicious risk events, and then analyzes whether there are other anomalies in these suspicious risk events, such as whether the account that has logged in on the target device, the IP address and mobile phone number associated with the target device, etc. are associated risk features associated with the suspicious risk features, and finally uses these second suspicious risk events, suspicious risk features and associated risk features to update the first risk identification strategy to obtain a second risk identification strategy.

[0188] The first business event may be a registration event, a login event, a payment event, a refund time, a new customer acquisition event, an invitation event, and a support event, etc. The target time period is the acquisition range of the backtest data determined after the risk control system identifies the first suspicious risk event.

[0189] Optionally, judging the first business event in the business system as a first suspicious risk event based on the first risk identification strategy includes at least one of the following methods:

[0190] First, when it is identified that the identification identifier carried in the first business request generating the first business event is inconsistent with the historical identification identifier stored in the database, the identification identifier is determined as a suspicious risk feature, and the first business event is distinguished as a first suspicious risk event.

[0191] In the embodiment of the present application, a business event is generated when a user sends a business request to a business system. The above identification identifier includes at least one of a hardware device identification identifier, a mobile phone number, a number location, and an Internet Protocol address, that is, when the device number in the first business event is inconsistent with the historically used device number stored in the database, it is determined that the user requested the event on an uncommon device; when the IP address in the first business event is inconsistent with the historically used IP address stored in the database, it is determined that the user requested the event in a different place; when the mobile phone number in the first business event is inconsistent with the historically used mobile phone number stored in the database, it is determined that the user requested the event using an uncommon mobile phone number; when the number location of the mobile phone number in the first business event is inconsistent with the historically used number location stored in the database, it is determined that the user requested the event in a different place. At this time, the risk control system will identify the first business event in which the above abnormal situation occurs as the first suspicious risk event, and determine the identification identifier used as a suspicious risk feature.

[0192] The second type is that when it is identified that the number of accounts associated with the identification identifier carried in the first business request during the current risk identification cycle is greater than or equal to the target number threshold, the identification identifier is determined as a suspicious risk feature, and the first business event is identified as a first suspicious risk event.

[0193] In an embodiment of the present application, the risk identification cycle is the cycle for resetting the threshold conditions of the risk control system. For example, it is stipulated that if more than 20 accounts are logged in to the same device in one day, it is abnormal. If 19 accounts are logged in to the target device today, these 19 login events are all judged as normal events. If 19 accounts are logged in to the target device the next day, they are also judged as normal events. If 21 accounts are logged in to the target device on the same day, when the 21st account is logged in, the current login event is judged as the first suspicious risk event, and the identification identifier used (such as the device number of the target device) is determined as a suspicious risk feature.

[0194] The third type is that when it is identified that the first feature of the first business event matches the risk feature stored in the preset case library, the first feature is determined as a suspicious risk feature, and the first business event is identified as a first suspicious risk event.

[0195] In an embodiment of the present application, the above-mentioned preset case library stores risk characteristics of suspicious risk events identified by the risk control system. During further identification, the risk control system may compare the business events with the risk characteristics in the preset case library. If, when it is identified that the first characteristic of the first business event matches the risk characteristic stored in the preset case library, the first characteristic may be determined as a suspicious risk characteristic, and the first business event may be identified as a first suspicious risk event.

[0196] In an embodiment of the present application, other judgment conditions can also be set. For example, if the number of accounts associated with the same device is greater than 40, it is considered an abnormality. At this time, the count is not performed according to the identification period, but is not cleared. If the total number of accounts associated with the same device exceeds the threshold, it is judged as an abnormality.

[0197] In an embodiment of the present application, the risk identification strategy may include a single condition or a combination of multiple conditions. The discrimination condition may be a threshold discrimination type, such as if the number of accounts logged into the same device in one day is greater than 20, it is an abnormality; it may be a feature discrimination type, such as if the appearance of certain specific fields is an abnormality.

[0198] After the first business event is identified as the first suspicious risk event, in order to find a specific second business event that has a feature matching relationship with the first suspicious risk event among the second business events that have been previously identified as having no suspicious risk, it is necessary to first determine the acquisition scope of the first backtest data, that is, the above-mentioned target time period. The acquisition scope of the first backtest data is related to the identification type and the activity to which the first suspicious risk event belongs, which is explained below.

[0199] Optionally, before obtaining data within the target time period that includes the second business event that was previously determined to have no suspicious risk as the first backtest data, the method further includes determining the target time period in the following manner:

[0200] Determine the activity start time of the business activity to which the first business event belongs, and determine the range from the activity start time to the current time as the target time period; and / or,

[0201] Determining a discrimination type for discriminating the first business event as a first suspicious risk event;

[0202] When the discrimination type is a threshold discrimination type, the range from the start time of the current risk identification cycle to the current time is determined as the target time period;

[0203] When the discrimination type is a feature discrimination type, the occurrence cycle of the associated events of the first suspicious risk event is determined, and the occurrence time of the first suspicious risk event is taken as the latest node of the current occurrence cycle, and the period from the earliest node to the latest node of the current occurrence cycle is determined as the target time period.

[0204] In the embodiment of the present application, the above-mentioned business activities may include various promotional activities (such as following the merchant's self-media account to receive coupons, etc.), new customer acquisition activities (such as registration and acquisition of new customers for community group purchase applications, new game pre-registration registration, etc.), popularization and promotion activities, and public welfare activities, etc. If the first business event is caused by a certain business activity, the range from the activity start time of the business activity to which the first business event belongs to to the current time is determined as the target time period.

[0205] In the embodiment of the present application, for the threshold discrimination type, the range from the start time of the current risk identification cycle to the current time can be determined as the target time period. For example, if the discrimination condition for triggering the first suspicious risk event is that the number of accounts logged in by the same device in one day exceeds 20 and reports an abnormality, and in the first suspicious risk event, it is monitored that the target device is logging in to the 21st account at this moment today, then after discrimination according to the above discrimination condition, the time period from zero o'clock today to the current moment is determined as the acquisition range of the backtest data. For the feature discrimination type, it is necessary to first check whether there is an associated event for the first suspicious risk event. If there is an associated event, determine the occurrence cycle of the associated event, and use the occurrence time point of the first suspicious risk event as the latest node of the current occurrence cycle, and determine the period from the earliest node to the latest node of the current occurrence cycle as the target time period. For example, the payment event and the refund event are mutually related events, and the refund event is only allowed to be carried out within 24 hours after the payment event occurs. If the risk control system finds an abnormality in the current refund event, it is necessary to reverse 24 hours as the starting point to obtain the backtest data.

[0206] Optionally, the scope of backtest data acquisition can also be determined based on the suspicious risk characteristics and other characteristics of the first suspicious risk event. Specifically, the second characteristic that is the same as the suspicious risk characteristic in the first suspicious risk event is determined as the associated risk characteristic; the earliest time when the associated risk characteristic appears in other business events is determined; and the range from the earliest time to the current time is determined as the target time period. The above-mentioned other business events include the second business event. After the above-mentioned associated risk characteristics are determined, the range from the earliest time when the associated risk characteristic appears in the second business event to the current time can be determined as the target time period.

[0207] In the embodiment of the present application, the first backtest data may include the second business event identified as having no suspicious risk within the target time period, so that when backtesting, a specific second business event having a feature matching relationship with the first suspicious risk event can be found more quickly and more specifically. It may also include all business events generated within the target time period, so that when the updated second risk identification strategy is tested, it can be better compared with the identification result of the first risk identification strategy, so as to determine whether to replace the first risk identification strategy with the second risk event identification strategy.

[0208] After obtaining the backtest data according to the above target time period, you can perform backtesting.

[0209] Optionally, determining in the first backtest data a specific second business event that matches a target feature of the first suspicious risk event includes:

[0210] Determine the suspicious risk feature of the first suspicious risk event identified by the first risk identification strategy as the target feature, and determine the second business event with the same target feature in the first backtest data as the specific second business event; and / or,

[0211] Other features that are the same as the suspicious risk feature in the first suspicious risk event are determined as associated risk features as target features, and a second business event with the target feature in the first backtest data is determined as a specific second business event.

[0212] In the embodiment of the present application, when some business events occur, the suspicious risk characteristics have not shown abnormalities and have not been marked as suspicious risk characteristics (for example, the number of accounts logged into the same device in one day is less than the discrimination threshold), so the backtest is to find out the events that have the suspicious risk characteristics but have not shown abnormalities in the previous period. That is, in the embodiment of the present application, the purpose of the backtest is to find a specific second business event that has a feature matching relationship with the first suspicious risk event, and the feature matching relationship is that there is a match with the target feature, and the target feature includes the suspicious risk feature identified by the first risk identification strategy in the first suspicious risk event, and can also include other associated risk features in the first suspicious risk event that are the same as the suspicious risk feature.

[0213] Optionally, after re-identifying the specific second business event as a second suspicious risk event with suspicious risks, the method further includes:

[0214] The suspicious risk characteristics, the associated risk characteristics, and the event characteristics of the second suspicious risk event are added to a preset case library, so that the suspicious risk characteristics, the associated risk characteristics, and the event characteristics of the second suspicious risk event are used as basic data for analyzing attack behaviors.

[0215] In the embodiment of the present application, in order to more accurately and comprehensively analyze the attack behavior of the suspected illegal behavior person, the identified suspicious risk characteristics, associated risk characteristics and event characteristics of the second suspicious risk event can be added to the preset case library, so that the suspicious risk characteristics, associated risk characteristics, and / or event characteristics of the second suspicious risk event are used as the basic data for analyzing the attack behavior, and at the same time, comparative data is provided when the risk control system identifies other business events. During the implementation process, those skilled in the art can select part or all of the suspicious risk characteristics, associated risk characteristics and event characteristics of the second suspicious risk event to analyze the attack behavior according to different businesses.

[0216] Optionally, after obtaining the second risk identification strategy, the second risk identification strategy needs to be tested to determine whether the second risk identification strategy meets the online requirements. The method further includes:

[0217] Step 1: performing risk identification on second backtest data based on a second risk identification strategy, wherein the second backtest data does not completely overlap with the first backtest data;

[0218] Step 2: Count the accuracy and missed rate of the second risk identification strategy for suspicious risk events;

[0219] Step 3: When the accuracy of the second risk identification strategy is less than or equal to the accuracy of the first risk identification strategy, and / or the missed detection rate of the second risk identification strategy is greater than or equal to the missed detection rate of the first risk identification strategy, continue to update the second risk identification strategy using the second suspicious risk event and target characteristics, and use the second backtest data to re-verify the accuracy and missed detection rate of the updated second risk identification strategy in identifying suspicious risk events until the test passes.

[0220] In the embodiment of the present application, the second backtest data does not completely overlap with the first backtest data, which may be non-overlapping in time or data. For example, the second backtest data may be data before the current time point that does not completely overlap with the first backtest data. Preferably, there may be no overlap at all, that is, the second backtest data may select data from the last backtest (a backtest after an abnormal event B is found when an abnormal related event A is found) to the current time point. In this way, using the second backtest data to test the second risk identification strategy is of the greatest significance.

[0221] In the embodiment of the present application, when the accuracy of the second risk identification strategy is greater than the accuracy of the first risk identification strategy, and the missed detection rate of the second risk identification strategy is less than the missed detection rate of the first risk identification strategy, it is determined that the second risk identification strategy has passed the inspection.

[0222] In the embodiment of the present application, the accuracy rate can be calculated as follows: the ratio of the number of true abnormal events to the total number of abnormal events identified among the abnormal events identified by the current rule. The missed rate can be calculated as follows: the ratio of the number of unidentified abnormal events to the number of true abnormal events in the backtest data.

[0223] In an embodiment of the present application, if the accuracy of the second risk identification strategy is greater than the accuracy of the first risk identification strategy, and the missed detection rate of the second risk identification strategy is less than the missed detection rate of the first risk identification strategy, then it is determined that the second risk identification strategy meets the online requirements and passes the inspection; otherwise, the inspection fails and it is necessary to continue to use the second suspicious risk event and target features to update the second risk identification strategy until the inspection passes. The situation where the accuracy of the above-mentioned second risk identification strategy is greater than the accuracy of the first risk identification strategy can be regarded as an ideal situation. However, in actual applications, since the judgment range of the second risk identification strategy is larger than that of the first risk identification strategy, more events are judged to be risky. For example, the first risk identification strategy can judge that 100 events out of 1000 events are risky, and the second risk identification strategy can judge that 200 events out of 1000 events are risky. Therefore, the restriction conditions on the accuracy of the second risk identification strategy can be appropriately relaxed in actual applications. For example, if the accuracy of the first risk identification strategy is 95%, then when the accuracy of the second risk identification strategy is 90%, the second risk identification strategy can also be put into use online, that is, the accuracy of the second risk identification strategy can be allowed to be slightly lower than that of the first risk identification strategy.

[0224] In an embodiment of the present application, the update of the first risk identification strategy, in addition to adding more detailed screening rules for suspicious risk characteristics, associated risk characteristics and second suspicious risk events, can also include eliminating characteristics containing misjudgment events in the first risk identification strategy, thereby further improving the accuracy of the second risk identification strategy and reducing the misjudgment rate.

[0225] Optionally, after determining that the second risk identification strategy has passed the test, the method further includes:

[0226] In a production environment, a second risk identification strategy is used to replace the first risk identification strategy, so that when a third business event having a feature matching relationship with the first suspicious risk event and / or the second suspicious risk event is identified using the second risk identification strategy, the third business event is identified as a third suspicious risk event with a suspicious risk.

[0227] In the embodiment of the present application, after the second risk identification strategy is launched, the second risk identification strategy can be used to identify attack behaviors with dispersed early features.

[0228] According to another aspect of the embodiment of the present application, Fig.14 As shown, a risk identification device for a business event is provided, comprising:

[0229] The event acquisition module 1401 is used to acquire business events generated by the business system in the production environment, wherein the business event is generated after the target object sends a business request to the business system, and the business system is used to provide the target business service to the target object;

[0230] A map construction module 1403 is used to extract event features of business events and construct a gene map of the target business with the event features as gene constituent elements, wherein the gene map is used to represent feature association relationships between business events of the target business;

[0231] A suspicious feature determination module 1405 is used to determine the suspicious risk features of the target business based on the gene map and the feature association relationship; and

[0232] The risk identification module 1407 is used to determine the risk level of the business event based on the suspicious risk characteristics.

[0233] It should be noted that the event acquisition module 1401 in this embodiment can be used to execute step S202 in the embodiment of the present application, the graph construction module 1403 in this embodiment can be used to execute step S204 in the embodiment of the present application, the suspicious feature determination module 1405 in this embodiment can be used to execute step S206 in the embodiment of the present application, and the risk identification module 1407 in this embodiment can be used to execute step S208 in the embodiment of the present application.

[0234] It should be noted that the examples and application scenarios implemented by the above modules and corresponding steps are the same, but are not limited to the contents disclosed in the above embodiments. It should be noted that the above modules as part of the device can be run in Figure 1 In the hardware environment shown, it can be implemented by software or by hardware.

[0235] Optionally, the graph construction module is specifically used to:

[0236] Determine the event type of the business event and extract the characteristic fields that constitute the business event;

[0237] Determine a field name matching the event type for each feature field at the field naming node corresponding to each feature field, wherein feature fields of the same category correspond to the same field naming node, and the field naming node is used to determine the definition of feature fields of the same category in different business events; and,

[0238] A gene map of the target business is constructed based on the field name and field value of the feature field, wherein the event feature includes the event type, the field name of the feature field, and the field value of the feature field.

[0239] Optionally, the graph construction module is further used to:

[0240] According to the core field name and the associated field name pre-specified for each business event, the characteristic field of each business event is divided into a core field and an associated field;

[0241] Extract multiple target business events with the same field value of the core field;

[0242] Merge the core fields with the same field values ​​in multiple target business events, and add the merged core fields, the field values ​​of the core fields, and all other associated fields and corresponding field values ​​to the same gene cluster;

[0243] Establish connections between associated fields with the same field values ​​in different gene clusters; and,

[0244] A map consisting of multiple gene clusters is determined as a gene map.

[0245] Optionally, the graph construction module is further used to:

[0246] According to the core field name and the associated field name pre-specified for each business event, the characteristic field of each business event is divided into a core field and an associated field;

[0247] When there are multiple core fields in the same business event, determine the priority of each core field;

[0248] Compare the field values ​​of core fields among multiple business events in order of priority;

[0249] Determine multiple business events with priorities greater than or equal to the target priority and with the same field value of the core field as target business events;

[0250] Merge the core fields with the same field values ​​in the target business events, and add the merged core fields, the field values ​​of the core fields, and all other associated fields and corresponding field values ​​to the same gene cluster;

[0251] Establish connections between associated fields with the same field values ​​in different gene clusters; and,

[0252] A map consisting of multiple gene clusters is determined as a gene map.

[0253] Optionally, the graph construction module is further used to:

[0254] According to the core field name and the associated field name pre-specified for each business event, the characteristic field of each business event is divided into a core field and an associated field;

[0255] When there are multiple core fields in the same business event, assign a weight to each core field;

[0256] Compare the field values ​​of core fields between multiple business events;

[0257] Accumulate the weights corresponding to the core fields with the same field values ​​to obtain the core field similarity;

[0258] Determine multiple business events whose core field similarity is greater than or equal to a target threshold as target business events;

[0259] Merge the core fields with the same field values ​​in the target business events, and add the merged core fields, the field values ​​of the core fields, and all other associated fields and corresponding field values ​​to the same gene cluster;

[0260] Establish connections between associated fields with the same field values ​​in different gene clusters; and,

[0261] A map consisting of multiple gene clusters is determined as a gene map.

[0262] Optionally, the suspicious feature determination module is specifically used to:

[0263] Determine the number of field values ​​of each characteristic field of each gene cluster in the gene map, wherein the number of field values ​​is the number of field values ​​corresponding to the characteristic field;

[0264] Extracting characteristic fields in sequence according to the sorting priorities configured in advance for the plurality of characteristic fields, and sorting the plurality of gene clusters in the order of the number of field values ​​of the characteristic fields from large to small;

[0265] Select the target gene cluster before the target sorting position from the sorting results;

[0266] When the number of field values ​​of the core field in the target gene cluster is greater than or equal to the first number threshold of the corresponding category, the field value of the core field is determined as a suspicious risk feature of the target business in the target gene cluster.

[0267] Optionally, the suspicious feature determination module is further used to:

[0268] In the target gene cluster, for each core field, the number of field values ​​of the associated fields that have a characteristic association relationship with the core field is counted;

[0269] When the number of field values ​​of the associated field is greater than or equal to the second number threshold of the corresponding category, obtaining all field values ​​of the associated field;

[0270] Divide the field value into multiple value segments;

[0271] Sort the value fragments in descending order according to the number of occurrences of each value fragment;

[0272] The target value fragment before the target sorting position is selected from the sorting results, and the target value fragment and the associated core field are determined as suspicious risk features of the target business in the target gene cluster.

[0273] Optionally, the risk identification device for business events further includes a case library comparison module, which is used to:

[0274] Compare the field value of the characteristic field of each gene cluster in the gene map with the existing field value in the case library to obtain the comparison result;

[0275] When the similarity of the comparison result is greater than the similarity threshold, the field value of the feature field is determined as a suspicious risk feature of the target business in the target gene map.

[0276] Optionally, the risk identification device for business events further includes a case adding module, which is used to:

[0277] Add the target business and the suspicious risk features of the target business to the case library, so as to use the suspicious risk features as the basic data for the graph analysis of the target business.

[0278] The technical solution implemented by the above device is consistent with the method described above. For the sake of brevity, the specific details of the solution will not be expanded here.

[0279] According to another aspect of the embodiment of the present application, the present application provides a risk identification strategy update device to implement the above-mentioned risk strategy update method, which specifically includes:

[0280] A data acquisition module, configured to, when a first business event in the business system is identified as a first suspicious risk event based on a first risk identification strategy, acquire data containing a second business event previously identified as having no suspicious risk within a target time period as first backtest data, wherein the target time period is earlier than a time point when the first business event is identified as the first suspicious risk event;

[0281] an event backtesting module, configured to determine in the first backtesting data a specific second business event that matches a target feature of the first suspicious risk event, and re-identify the specific second business event as a second suspicious risk event with a suspicious risk; and

[0282] The strategy updating module is used to update the first risk identification strategy by using the second suspicious risk event and the target feature to obtain a second risk identification strategy.

[0283] The technical solution implemented by the updating device of the above risk identification strategy is consistent with the corresponding method described above. For the sake of brevity, the specific details of the solution will not be expanded here.

[0284] According to another aspect of the embodiments of the present application, the present application provides an electronic device, such as Fig.15As shown, it includes a memory 1501, a processor 1503, a communication interface 1505 and a communication bus 1507. The memory 1501 stores a computer program that can be run on the processor 1503. The memory 1501 and the processor 1503 communicate through the communication interface 1505 and the communication bus 1507. When the processor 1503 executes the computer program, the steps of the above method are implemented.

[0285] The memory and processor in the above electronic device communicate via a communication bus and a communication interface. The communication bus may be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus may be divided into an address bus, a data bus, a control bus, etc.

[0286] The memory may include a random access memory (RAM) or a non-volatile memory, such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0287] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0288] According to another aspect of the embodiments of the present application, a computer program product or a computer program is provided, the computer program product or the computer program includes computer instructions, and the computer instructions are stored in a computer-readable storage medium. The processor of the computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device performs the steps of any of the above embodiments.

[0289] Optionally, in an embodiment of the present application, the computer-readable medium is configured to store program codes for the processor to perform the following steps:

[0290] Obtaining business events generated by the business system in the production environment, wherein the business event is generated after the target object sends a business request to the business system, and the business system is used to provide the target business service to the target object;

[0291] Extracting event features of business events, and constructing a gene map of the target business with the event features as gene constituent elements, wherein the gene map is used to represent the feature association relationship between business events of the target business;

[0292] Determine suspicious risk characteristics of the target business based on the gene map and feature associations; and,

[0293] Determine the risk level of business events based on suspicious risk characteristics.

[0294] Optionally, the specific examples in this embodiment may refer to the examples described in the above embodiments, and this embodiment will not be described in detail here.

[0295] When the embodiments of the present application are specifically implemented, reference may be made to the above-mentioned embodiments, which have corresponding technical effects.

[0296] It is understood that the embodiments described herein may be implemented in hardware, software, firmware, middleware, microcode, or a combination thereof. For hardware implementation, the processing unit may be implemented in one or more application specific integrated circuits (ASIC), digital signal processors (DSP), digital signal processing devices (DSPD), programmable logic devices (PLD), field programmable gate arrays (FPGA), general purpose processors, controllers, microcontrollers, microprocessors, other electronic units for performing the functions described in the present application, or a combination thereof.

[0297] For software implementation, the technology described herein can be implemented by a unit that performs the functions described herein. The software code can be stored in a memory and executed by a processor. The memory can be implemented in the processor or outside the processor.

[0298] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0299] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0300] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the modules is only a logical function division. There may be other division methods in actual implementation, such as multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0301] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0302] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0303] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on such an understanding, the technical solution of the embodiment of the present application is essentially or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium, including several instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a ROM, a RAM, a magnetic disk or an optical disk. It should be noted that, in this article, relational terms such as "first" and "second" are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply that there is any such actual relationship or order between these entities or operations. Moreover, the term "include", "include" or any other variant thereof is intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements includes not only those elements, but also includes other elements that are not explicitly listed, or also includes elements inherent to such a process, method, article or device. Without more constraints, an element defined by the phrase "comprising a..." does not exclude the existence of other identical elements in the process, method, article or apparatus comprising the element.

[0304] The above description is only a specific implementation of the present application, so that those skilled in the art can understand or implement the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein can be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest range consistent with the principles and novel features applied for herein.

Claims

1. A method for identifying risks of business events, characterized in that: include: Acquire a business event generated by the business system in a production environment, wherein the business event is generated after a target object issues a business request to the business system, and the business system is used to provide a target business service to the target object; Extracting event features of the business events, and constructing a gene map of the target business with the event features as gene constituent elements, wherein the gene map is used to represent feature association relationships between the business events of the target business; Determining suspicious risk characteristics of the target business based on the gene map and the characteristic association relationship; and, Determining the risk level of the business event based on the suspicious risk characteristics; The method of extracting the event features of the business event and constructing a genetic map of the target business with the event features as genetic constituent elements includes: determining the event type of the business event and extracting the feature fields constituting the business event; determining a field name matching the event type for each feature field at a field naming node corresponding to each feature field, wherein the feature fields of the same category correspond to the same field naming node, and the field naming node is used to determine the definition of the feature fields of the same category in different business events; and constructing the genetic map of the target business based on the field names and field values ​​of the feature fields, wherein the event features include the event type, the field names of the feature fields, and the field values ​​of the feature fields; The method of constructing the gene map of the target business based on the field name and field value of the characteristic field includes: dividing the characteristic field of each business event into a core field and an associated field according to the core field name and the associated field name pre-specified for each business event; extracting multiple target business events with the same field value of the core field; merging the core fields with the same field value in multiple target business events, and adding the merged core fields, the field value of the core fields, and all the remaining associated fields and the corresponding field values ​​to the same gene cluster; establishing a connection between the associated fields with the same field value in different gene clusters; and determining the map formed by multiple gene clusters as the gene map; Alternatively, the gene map of the target business constructed based on the field name and field value of the characteristic field also includes: dividing the characteristic field of each business event into core fields and associated fields according to the core field name and associated field name pre-specified for each business event; determining the priority of each core field when there are multiple core fields in the same business event; comparing the field values ​​of the core fields in turn among the multiple business events according to the priority; determining multiple business events whose priorities are greater than or equal to the target priority and whose field values ​​of the core fields are the same as target business events; merging the core fields with the same field values ​​in the target business events, and adding the merged core fields, the field values ​​of the core fields, and all the remaining associated fields and the corresponding field values ​​to the same gene cluster; establishing a connection between the associated fields with the same field values ​​in different gene clusters; and determining the map composed of multiple gene clusters as the gene map; Alternatively, the gene map of the target business constructed based on the field name and field value of the characteristic field also includes: dividing the characteristic field of each business event into core fields and associated fields according to the core field name and associated field name pre-specified for each business event; when there are multiple core fields in the same business event, assigning a weight to each core field; comparing the field values ​​of the core fields between multiple business events; accumulating the weights corresponding to the core fields with the same field values ​​to obtain the core field similarity; determining multiple business events whose core field similarity is greater than or equal to the target threshold as target business events; merging the core fields with the same field values ​​in the target business events, and adding the merged core fields, the field values ​​of the core fields, and all the remaining associated fields and the corresponding field values ​​to the same gene cluster; establishing a connection between the associated fields with the same field values ​​in different gene clusters; and determining the map composed of multiple gene clusters as the gene map; The method of determining the suspicious risk feature of the target business based on the gene map and the feature association relationship includes: determining the number of field values ​​of each feature field of each gene cluster in the gene map, wherein the number of field values ​​is the number of field values ​​corresponding to the feature field; extracting the feature fields in sequence according to the sorting priorities pre-configured for the multiple feature fields, and sorting the multiple gene clusters in descending order of the number of field values ​​of the feature fields; selecting the target gene cluster before the target sorting position from the sorting results; and when the number of field values ​​of the core field in the target gene cluster is greater than or equal to the first quantity threshold of the corresponding category, determining the field value of the core field as the suspicious risk feature of the target business in the target gene cluster.

2. The method according to claim 1, characterized in that: After selecting the target gene cluster before the target ranking position from the ranking result, determining the suspicious risk feature of the target business based on the gene map and the feature association relationship further includes: In the target gene cluster, for each of the core fields, the number of field values ​​of the associated fields having the characteristic association relationship with the core field is counted; When the number of the field values ​​of the associated field is greater than or equal to a second number threshold of the corresponding category, obtaining all field values ​​of the associated field; Dividing the field value into a plurality of value segments; Sorting the value fragments in descending order according to the number of occurrences of each value fragment; A target value segment before a target sorting position is selected from the sorting result, and the target value segment and the associated core field are determined as the suspicious risk feature of the target business in the target gene cluster.

3. A risk identification device for business events, characterized in that: The device is applicable to the risk identification method for business events according to any one of claims 1 to 2, and the device comprises: An event acquisition module is used to acquire business events generated by a business system in a production environment, wherein the business event is generated after a target object issues a business request to the business system, and the business system is used to provide a target business service to the target object; A graph construction module, used to extract event features of the business events, and construct a gene graph of the target business with the event features as gene constituent elements, wherein the gene graph is used to represent feature association relationships between the business events of the target business; a suspicious feature determination module, used to determine the suspicious risk features of the target business based on the gene map and the feature association relationship; and The risk identification module is used to determine the risk level of the business event based on the suspicious risk characteristics.

4. A risk identification device for business events, comprising a memory, a processor, a communication interface and a communication bus, wherein the memory stores a computer program that can be run on the processor, and the memory and the processor communicate through the communication bus and the communication interface, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 2 are implemented.

5. A computer-readable medium having a non-volatile program code executable by a processor, characterized in that: The program code enables the processor to execute the method according to any one of claims 1 to 2.

Images