Risk prevention and control method and device

Abstract

The invention discloses a risk prevention and control method and device, relates to the technical field of artificial intelligence, can also be used in the financial field, and the method comprises the steps: determining the coding information of a target user initiating a business request, and the business request carries the identity information of the target user; comparing the coded information with a plurality of pieces of coded information in a high-risk area so as to judge whether the target user is in the high-risk area or not according to a comparison result; when the target user is in the high-risk area, performing risk assessment on the target user according to the behavior data of the target user; and when the target user is evaluated as a suspected risk user, performing risk prevention and control on the target user in combination with the identity information. According to the invention, risk prevention and control can be accurately and effectively carried out on risk users.

Description

Technical Field

[0001] The present invention relates to the field of artificial intelligence technology and can also be used in the financial field, and in particular to a risk prevention and control method and device. Background Art

[0002] With the continuous development of network technology, more and more risky users are initiating business requests online to handle business, which makes risk prevention and control more difficult. However, existing technologies cannot accurately and comprehensively identify the risks of users who initiate business requests, resulting in low risk prevention and control accuracy, making it difficult to effectively meet current risk prevention and control requirements.

[0003] To address the above problems, no effective solution has been proposed yet. Summary of the invention

[0004] The embodiments of this specification provide a risk prevention and control method and device to solve the problem that the existing technology cannot accurately and effectively perform risk prevention and control on risky users.

[0005] In a first aspect, an embodiment of this specification provides a risk prevention and control method, the method comprising:

[0006] Determine the encoding information of the target user who initiates the service request, wherein the service request carries the identity information of the target user;

[0007] Comparing the coded information with a plurality of coded information in a high-risk area, so as to determine whether the target user is in the high-risk area according to the comparison result;

[0008] When the target user is in a high-risk area, performing a risk assessment on the target user based on the behavior data of the target user;

[0009] When the target user is evaluated as a suspected risk user, risk prevention and control is performed on the target user in combination with the identity information.

[0010] In some embodiments, determining the coding information of the target user who initiates the service request includes:

[0011] Obtaining the geographic location of the target user, and converting the geographic location into longitude and latitude information;

[0012] The longitude and latitude information is position-encoded using a position coding algorithm to obtain the coding information of the target user.

[0013] In some embodiments, comparing the coded information with a plurality of coded information in a high-risk area to determine whether the target user is in a high-risk area according to the comparison result includes:

[0014] When the comparison result is that the coding information is consistent with at least one of the multiple coding information in the high-risk area, determining that the target user is in the high-risk area;

[0015] When the comparison result is that the coding information is inconsistent with multiple coding information in the high-risk area, it is determined that the target user is not in the high-risk area.

[0016] In some embodiments, the high risk area is determined by:

[0017] Determine a first target area having a plurality of risky users, wherein the first target area includes a plurality of first blocks, each of the plurality of first blocks corresponding to coded information of a unique risky user;

[0018] Obtaining the number of risky users having the same coding information and the behavior data of the risky users in each first block;

[0019] According to the number of risky users and the behavior data of the risky users, the risk level of each first block is divided;

[0020] One or more first blocks whose risk levels are greater than a preset risk level threshold are regarded as the high-risk areas.

[0021] In some embodiments, the target user's behavior data includes: the target user's service request frequency and service request times;

[0022] Accordingly, the risk assessment of the target user according to the behavior data of the target user includes:

[0023] Determine whether the service request frequency of the target user within a preset time is greater than a preset frequency threshold or whether the number of service requests is greater than a preset number threshold;

[0024] If so, it is determined that the target user is assessed as a suspected risk user.

[0025] In some embodiments, the target user's behavior data further includes: the target user's behavior data of the current cycle and the behavior data of the previous cycle;

[0026] Accordingly, the risk assessment of the target user according to the behavior data of the target user further includes:

[0027] Determine the difference between the target user's current cycle behavior data and the previous cycle behavior data;

[0028] Determine whether the difference result is greater than a preset difference threshold;

[0029] If so, it is determined that the target user is assessed as a suspected risk user.

[0030] In some embodiments, the performing risk prevention and control on the target user in combination with the identity information includes:

[0031] Verifying the identity information of the target user to determine whether the target user is a risky user according to the verification result;

[0032] If so, risk prevention and control is performed on the target user.

[0033] In some embodiments, the method further comprises:

[0034] Determine a second target area having multiple active users, the second target area includes multiple second blocks, each of the multiple second blocks corresponds to the coded information of a unique active user, and the risk value of the active user is less than a preset risk threshold;

[0035] comparing the coded information with the coded information corresponding to each second block in the second target area;

[0036] When the comparison result is that the coding information is consistent with the coding information corresponding to each second block in the second target area, the service request is processed.

[0037] In a second aspect, the embodiments of this specification also provide a risk prevention and control device, which includes:

[0038] A coding information determination module, used to determine the coding information of a target user initiating a service request, wherein the service request carries the identity information of the target user;

[0039] A judgment module, used for comparing the coded information with a plurality of coded information in a high-risk area, so as to judge whether the target user is in a high-risk area according to the comparison result;

[0040] A risk assessment module, used to perform risk assessment on the target user according to the behavior data of the target user when the target user is in a high-risk area;

[0041] The risk prevention and control module is used to perform risk prevention and control on the target user in combination with the identity information when the target user is evaluated as a suspected risk user.

[0042] In a third aspect, an embodiment of the present specification also provides a computer device, including a memory, a processor, and a computer program / instructions stored in the memory, wherein the processor executes the computer program / instructions to implement the steps of the above-mentioned risk prevention and control method.

[0043] In a fourth aspect, the embodiments of this specification further provide a computer-readable storage medium having a computer program / instruction stored thereon, which implements the steps of the above-mentioned risk prevention and control method when the computer program / instruction is executed by a processor.

[0044] In a fifth aspect, the embodiments of this specification also provide a computer program product, and when the computer program / instructions are executed by a processor, the steps of the above-mentioned risk prevention and control method are implemented.

[0045] The embodiments of this specification provide a risk prevention and control method and device. First, the coding information of the target user who initiates the service request is determined, and the service request carries the identity information of the target user. Then, the coding information is compared with multiple coding information in the high-risk area to determine whether the target user is in the high-risk area according to the comparison result. When the target user is in the high-risk area, the target user is assessed for risk based on the behavior data of the target user. Finally, when the target user is assessed as a suspected risk user, the target user is risk controlled in combination with the identity information. In the embodiments of this specification, the coding information of the target user, the behavior data of the target user, and the identity information of the target user are comprehensively considered, so that the risk identification of the target user can be more accurate and comprehensive, so that the risk control of the target user can be accurately and effectively carried out, meeting the current risk control requirements. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the prior art descriptions. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. In the drawings:

[0047] Figure 1 It is a flow chart of a risk prevention and control method provided in the embodiments of this specification;

[0048] Figure 2 It is a schematic diagram of the structure of a risk prevention and control device provided in an embodiment of this specification;

[0049] Figure 3 It is a schematic diagram of the structural composition of an electronic device provided in an embodiment of this specification. DETAILED DESCRIPTION

[0050] In order to enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below in conjunction with the drawings in the embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this specification, not all of the embodiments. Based on the embodiments in this specification, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of this specification.

[0051] With the continuous development of network technology, more and more risky users are initiating business requests online to handle business, which makes risk prevention and control more difficult. However, existing technologies cannot accurately and comprehensively identify the risks of users who initiate business requests, resulting in low risk prevention and control accuracy, making it difficult to effectively meet current risk prevention and control requirements.

[0052] In view of the above-mentioned problems existing in the existing methods and the specific reasons for the above-mentioned problems, this application considers introducing a risk prevention and control method and device to accurately and effectively carry out risk prevention and control for risky users and meet the current risk prevention and control requirements.

[0053] Based on the above ideas, this specification proposes a risk prevention and control method. First, determine the coding information of the target user who initiates the service request, and the service request carries the identity information of the target user. Then, compare the coding information with multiple coding information in the high-risk area to determine whether the target user is in the high-risk area based on the comparison results. When the target user is in the high-risk area, perform a risk assessment on the target user based on the target user's behavior data. Finally, when the target user is assessed as a suspected risk user, perform risk prevention and control on the target user in combination with the identity information.

[0054] Figure 1 It is a flow chart of a risk prevention and control method provided in the embodiments of this specification. Although this specification provides the method operation steps or device structure shown in the following embodiments or drawings, the method or device may include more or fewer operation steps or module units after partial merger based on routine or no creative labor. In the steps or structures that do not logically have a necessary causal relationship, the execution order of these steps or the module structure of the device is not limited to the execution order or module structure shown in the embodiments of this specification or the drawings. When the method or module structure is applied in an actual device, server or terminal product, it can be executed sequentially or in parallel according to the method or module structure shown in the embodiments or drawings (for example, in an environment of parallel processors or multi-threaded processing, or even including distributed processing, server cluster implementation environment). For specific implementation, refer to Figure 1 As shown, the method may include the following contents.

[0055] S101: Determine coding information of a target user who initiates a service request, where the service request carries identity information of the target user.

[0056] In some embodiments, the target user is the user who initiates the service request, and the service request may be an online service request, such as an electronic card (such as a virtual card or a physical card) application request, a transaction request, a points redemption request, etc., which is not specifically limited in this specification. The target user may initiate the online service request through an application (APP) on the terminal device, and the service request may carry the identity information of the target user, which may be the account, password, mobile phone number, etc. manually entered by the user when the user logs into the application, which is not specifically limited in this specification. At the same time, when the user logs into an application, the user's current geographic location can also be located and obtained, such as the user's login address, residential address, etc., which is not specifically limited in this specification.

[0057] In some embodiments, the determining of the coding information of the target user initiating the service request in S101 above may include:

[0058] Obtaining the geographic location of the target user, and converting the geographic location into longitude and latitude information;

[0059] The longitude and latitude information is position-encoded using a position coding algorithm to obtain the coding information of the target user.

[0060] In some embodiments, a map service interface can be called to convert the target user's geographic location into longitude and latitude information. The longitude and latitude information is then encoded using a location encoding algorithm to ultimately obtain the user's encoding information. The location encoding algorithm may include, but is not limited to, Geohash location encoding algorithm, Google S2 location encoding algorithm, and UberH3 location encoding algorithm, all of which are open source algorithms. A suitable location encoding algorithm can be selected to position encode the longitude and latitude information according to actual needs, and this specification does not specifically limit this. When position encoding the longitude and latitude, the length of the encoding information can be pre-set, and the encoding information can consist of a character string. For example, if the length is set to 6, the encoding information obtained after the location encoding can be wtw40q, etc.

[0061] Among them, the Geohash location coding algorithm is a hierarchical data structure that divides the space into grids. The coding method uses the Z-filling method, with longitude in even-numbered positions and latitude in odd-numbered positions. The advantages of Geohash are local order preservation and simple implementation, but the disadvantages are the mutation of Z-shaped corners and the large span of different precisions. The principle of the Google S2 location coding algorithm is to map the three-dimensional earth to a two-dimensional plane, and then use the Hilbert curve for one-dimensional coding. This coding can identify the coverage of a certain area on the earth. The principle of the Uber H3 location coding algorithm is to use hexagons to index the simulated coverage of the earth. Compared with the Geohash method, it provides 16 precision ranges, and the span of each precision range is uniform. It supports direction calculation between grids and is more friendly to map data analysis.

[0062] By determining the coding information of the target user who initiates the business request, it is possible to accurately and quickly identify whether the target user is in a high-risk area, thereby providing a data basis for accurately and comprehensively identifying whether the target user is a risky user.

[0063] It should be noted that the user information (including but not limited to user identity information, coding information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved are all information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data comply with the relevant laws, regulations and standards of the relevant countries and regions, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0064] It should be noted that the terms "first", "second", etc. in the specification and claims of this application are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the numbers used in this way can be interchanged where appropriate, so as to describe the embodiments of the present application described herein.

[0065] S102: Compare the coded information with multiple coded information in the high-risk area to determine whether the target user is in the high-risk area according to the comparison result.

[0066] In some embodiments, the step of comparing the coded information with a plurality of coded information in a high-risk area in S102 to determine whether the target user is in a high-risk area according to the comparison result may include:

[0067] When the comparison result is that the coding information is consistent with at least one of the multiple coding information in the high-risk area, determining that the target user is in the high-risk area;

[0068] When the comparison result is that the coding information is inconsistent with multiple coding information in the high-risk area, it is determined that the target user is not in the high-risk area.

[0069] In some embodiments, the target user's coded information may be compared with multiple coded information in a high-risk area. If the target user's coded information is consistent with at least one of the multiple coded information in the high-risk area, it indicates that the target user is in the high-risk area. If the target user's coded information is inconsistent with any of the multiple coded information in the high-risk area, it indicates that the target user is not in the high-risk area.

[0070] In some embodiments, the high-risk areas may be determined by:

[0071] Determine a first target area having a plurality of risky users, wherein the first target area includes a plurality of first blocks, each of the plurality of first blocks corresponding to coded information of a unique risky user;

[0072] Obtaining the number of risky users having the same coding information and the behavior data of the risky users in each first block;

[0073] According to the number of risky users and the behavior data of the risky users, the risk level of each first block is divided;

[0074] One or more first blocks whose risk levels are greater than a preset risk level threshold are regarded as the high-risk areas.

[0075] In some embodiments, the geographic locations of multiple known risk users when initiating a service request can be first obtained, and then the geographic locations of each risk user among the multiple risk users can be converted into longitude and latitude information, and the longitude and latitude information of each risk user among the multiple risk users can be position-encoded using the above-mentioned position coding algorithm to obtain the coding information of each risk user among the multiple risk users. Among them, when using the position coding algorithm for position coding, the longitude and latitude information of the risk user can be segmented, and when the segmentation accuracy requirement is met, multiple blocks (i.e., the above-mentioned first blocks) can be obtained, and each block is represented by the coding information of a corresponding risk user. After obtaining the coding information of multiple risk users, a first target area composed of the coding information of multiple risk users can be determined. The first target area can include multiple first blocks, and each first block in the first block can correspond to the coding information of a unique risk user. Afterwards, the number of risk users with the same coding information and the behavior data of the risk users in each first block can be obtained, and then it is determined whether the number of risk users with the same coding information in each first block is greater than the preset total risk user threshold, and whether the behavior data of the risk users in each first block (such as the business request frequency and the number of business requests of the risk users) is greater than the preset behavior threshold. If the number of risk users in one or more first blocks is greater than the preset total risk user threshold and the business request frequency or the number of business requests of the risk users is greater than the preset behavior threshold, the risk level of one or more first blocks is classified as high (that is, the risk level is greater than the preset risk level threshold). If the number of risk users in one or more first blocks is greater than the preset total risk user threshold or the business request frequency or the number of business requests of the risk users is greater than the preset behavior threshold, the risk level of one or more first blocks is classified as medium. If the number of risk users in one or more first blocks is less than the preset total risk user threshold and the business request frequency or the number of business requests of the risk users is less than the preset behavior threshold, the risk level of one or more first blocks is classified as low. One or more first blocks with high risk levels can be used as high risk areas, and multiple risk users in the high risk area may be risk groups. Among them, the preset total risk user threshold, preset behavior threshold, preset risk level threshold, etc. can be set according to actual needs, and this specification does not make specific limitations on this.

[0076] By comprehensively considering the number of risky users and the behavior data of risky users to divide the risk level of each first block, the accuracy of risk level division can be improved. By determining the high-risk area, it can lay the foundation for accurately and quickly identifying whether the target user is in the high-risk area in the future.

[0077] In some embodiments, the number of risk users in the high-risk area of ​​the next cycle can also be predicted, and the number of risk users in the high-risk area of ​​the current cycle and the number of risk users in the high-risk area of ​​the next cycle are processed to obtain the difference between the number of risk users in the high-risk area of ​​the current cycle and the number of risk users in the high-risk area of ​​the next cycle. Then determine whether the difference result is greater than the difference threshold set in advance according to actual needs. If so, it means that the number of risk users in the high-risk area is greatly reduced during the period from the current cycle to the next cycle. At this time, the migration addresses of these reduced risk users or migration risk users can be obtained, and the migration addresses are geographically encoded to obtain the coding information of the migration risk users. These coding information can constitute a risk area, and then determine whether the behavior data of the migration risk users in the risk area is abnormal (such as: the migration risk users frequently initiate the same or similar business requests during this period, that is, the frequency and number of initiations of one or a class of business requests are high). If there is an abnormality, the risk area to which the migration user migrates is used as a new high-risk area. Subsequently, the coding information of the target user can be compared with multiple coding information in the new high-risk area, so that it can be accurately determined whether the target user is in the high-risk area. For example: the number of risky users in high-risk area A in the current cycle is 10, and the predicted number of risky users in high-risk area A in the next cycle is 3. The difference threshold is set to 5. The difference result of the two is 7, which is greater than the difference threshold 5. This means that a large number of risky users have migrated in high-risk area A. At this time, the coding information of these migrated risk users after migration can be determined. The coding information of the migrated risk users can constitute the risk area B. If the behavior data of these migrated risk users who migrated to the risk area B is abnormal, the risk area B can be used as a new high-risk area.

[0078] Among them, the long short-term memory network (long short-term memory network is a special RNN (Recurrent Neural Networks, recurrent neural network architecture, suitable for solving the gradient vanishing problem encountered by RNN when processing long sequence data) can be continuously trained based on the number of risk users in the current cycle and the influencing factors of the next cycle of the current cycle (the influencing factors are factors that affect the number of risk users, such as institutional data, etc., and this specification does not make specific limitations on this) until the loss value of the trained model is minimized, and finally a risk prediction model is obtained, and the number of risk users in the high-risk area of ​​the next cycle can be predicted based on the risk prediction model. It is also possible to use a time series prediction method (such as a moving average method, a Holt index method, etc., and specifically, a suitable time series prediction method can be selected according to the changes in the number of risk users) according to the number of risk users in the previous cycle of the current cycle, the influencing factors of the previous cycle, the number of risk users in the current cycle, the influencing factors of the current cycle, etc., to predict the number of risk users in the high-risk area of ​​the next cycle.

[0079] It should be noted that the method of predicting the number of risky users in the high-risk area in the next cycle is not limited to the above examples. Technical personnel in the relevant field may make other changes under the inspiration of the technical essence of the embodiments of this specification. However, as long as the functions and effects achieved are the same or similar to the embodiments of this specification, they should be covered within the protection scope of the embodiments of this specification.

[0080] S103: When the target user is in a high-risk area, a risk assessment is performed on the target user according to the behavior data of the target user.

[0081] In some embodiments, if the target user is in a high-risk area, the target user's behavioral data can be further obtained, and then the target user's risk assessment can be performed based on the target user's behavioral data, so that risky users can be accurately and comprehensively identified and precise prevention and control of risky users can be achieved.

[0082] In some embodiments, the behavior data of the target user in S103 may include: the service request frequency and the service request times of the target user; accordingly, the risk assessment of the target user according to the behavior data of the target user in S103 may include:

[0083] Determine whether the service request frequency of the target user within a preset time is greater than a preset frequency threshold or whether the number of service requests is greater than a preset number threshold;

[0084] If so, it is determined that the target user is assessed as a suspected risk user.

[0085] In some embodiments, the target user's behavior data may include: the target user's service request frequency, the number of service requests, etc. Correspondingly, if the target user's service request frequency within a preset time is greater than a preset frequency threshold or the target user's service request number is greater than a preset number threshold (the preset frequency threshold, the preset number threshold, and the preset time can be set according to actual needs, and this specification does not specifically limit this, such as the preset time can be set to 5 minutes), then it can be regarded as a suspected risk user first.

[0086] In some embodiments, the behavior data of the target user in S103 may further include: the behavior data of the target user in the current cycle and the behavior data of the previous cycle; accordingly, the risk assessment of the target user according to the behavior data of the target user in S103 may also include:

[0087] Determine the difference between the target user's current cycle behavior data and the previous cycle behavior data;

[0088] Determine whether the difference result is greater than a preset difference threshold;

[0089] If so, it is determined that the target user is assessed as a suspected risk user.

[0090] In some embodiments, the behavior data of the target user in the current cycle and the behavior data of the previous cycle can be processed to obtain the difference result of the behavior data of the target user in the current cycle and the behavior data of the previous cycle. Then, it is determined whether the difference result is greater than a preset difference threshold (the preset difference threshold can also be set according to actual needs, and this specification does not specifically limit this). If it is greater than the preset difference threshold, it means that the behavior data of the target user in the current cycle and the behavior data of the previous cycle are quite different, such as: the target user initiates a large transaction request in the current cycle, and initiates a small transaction request in the previous cycle, etc., then the target user can be regarded as a suspected risk user.

[0091] S104: When the target user is evaluated as a suspected risk user, risk prevention and control is performed on the target user in combination with the identity information.

[0092] In some embodiments, the risk prevention and control of the target user in combination with the identity information in S104 may include:

[0093] Verifying the identity information of the target user to determine whether the target user is a risky user according to the verification result;

[0094] If so, risk prevention and control is performed on the target user.

[0095] In some embodiments, after determining that the target user is a suspected risk user, it is necessary to further authenticate the target user to prevent the identity information of a normal user from being misused, that is, there may be a risk user who uses the identity information of a normal user to initiate a business request, resulting in some risky behaviors, etc., that is, the identity information of the target user may be misused identity information. When the verification result is that the identity authentication fails, the target user is determined to be a risk user. At this time, risk prevention and control can be performed on the target user, thereby achieving accurate prevention and control of risk users. When the verification result is that the verification is successful, the business request initiated by the target user is processed, that is, the target user is allowed to handle the business. The above method can effectively reduce the impact on the business handling of normal users.

[0096] In some embodiments, the above verification of the target user's identity information can be: obtaining the facial feature data of the target user who initiated the service request and the facial feature data corresponding to the above identity information, and calculating the similarity between the two (such as using the cosine similarity calculation method, etc.), when the similarity calculation result is less than the preset similarity threshold (that is, the similarity between the two is small, the preset similarity threshold can be set according to actual needs, and this specification does not make specific restrictions on this), the identity authentication fails, and the target user is a risky user. By further verifying the suspected risky user in combination with the identity information, the risk identification of the target user can be more accurately and comprehensively carried out, so that the risk prevention and control of the target user can be accurately and effectively carried out, meeting the current risk prevention and control requirements.

[0097] In some embodiments, the above-mentioned method of risk prevention and control for the target user can be: adding the target user to the list of prohibited business processing, rejecting the business request initiated by the target user and prohibiting the target user from performing related business processing based on the business request. It should be noted that the risk prevention and control method is not limited to the above examples. Technical personnel in the relevant field may make other changes under the inspiration of the technical essence of the embodiments of this specification, but as long as the functions and effects achieved are the same or similar to the embodiments of this specification, they should be covered within the protection scope of the embodiments of this specification.

[0098] In some embodiments, before comparing the coded information with the plurality of coded information in the high-risk area, the specific implementation may further include:

[0099] Determine a second target area having multiple active users, the second target area includes multiple second blocks, each of the multiple second blocks corresponds to the coded information of a unique active user, and the risk value of the active user is less than a preset risk threshold;

[0100] comparing the coded information with the coded information corresponding to each second block in the second target area;

[0101] When the comparison result is that the coding information is consistent with the coding information corresponding to each second block in the second target area, the service request is processed.

[0102] In some embodiments, a second target area with multiple active users can also be determined. The second target area can include multiple second blocks. Each second block in the multiple second blocks corresponds to the coding information of a unique active user. The active user can be a user without risk, that is, the risk value of the active user is less than the preset risk threshold. It can be considered that the credibility of users who initiate business requests in the second target area is high and the risk is extremely low. It should be noted that the second target area will also change with the change of the number of active users, etc., and the number of active users in the next cycle can also be predicted. The number of active users in the current cycle is subtracted from the number of active users in the next cycle to determine whether the number of active users has been greatly reduced, etc., and then the second target area is updated. The specific method is the same as the update method of the high-risk area, and this manual will not elaborate on this.

[0103] The target user's coding information can be compared with the coding information corresponding to each second block in the second target area. When the comparison result is that the target user's coding information is consistent with the coding information corresponding to each second block in the second target area, it means that the target user is also in the second target area as an active user, and the credibility is high. At this time, the service request initiated by the target user can be processed. If the comparison result is that the target user's coding information is inconsistent with the coding information corresponding to each second block in the second target area, it means that the target user is not in the second target area. At this time, the above-mentioned method can be adopted, that is, the target user's coding information is compared with multiple coding information in the high-risk area, so as to judge whether the target user is in the high-risk area according to the comparison result, etc., to judge whether the target user is a risky user, and this manual will not elaborate on this.

[0104] By determining the second target area with multiple active users, it is possible to accurately and quickly identify whether they are active users or trusted users, thereby speeding up the business processing progress.

[0105] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. For details, please refer to the description of the above-mentioned related processing related embodiments, and no further description is given here.

[0106] The above is an explanation of the present invention, however, it is worth noting that the specific embodiment is only for the purpose of better illustrating the present application and describing a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0107] The above method is described below in conjunction with a specific embodiment. However, it should be noted that this specific embodiment is only for better illustrating the present application and does not constitute an improper limitation on the present application.

[0108] Before specific implementation, a first target area with multiple risky users may be determined, wherein the first target area includes multiple first blocks, and each of the multiple first blocks corresponds to the coding information of a unique risky user. Then, the number of risky users with the same coding information and the behavior data of the risky users in each first block are obtained, and the risk level of each first block is divided according to the number of risky users and the behavior data of the risky users. Finally, one or more first blocks with a risk level greater than a preset risk level threshold are regarded as the high-risk area.

[0109] In a specific implementation, the geographic location of the target user can be obtained and converted into longitude and latitude information. The longitude and latitude information is then position-encoded using a position coding algorithm to obtain the coding information of the target user. Then, the coding information of the target user is compared with multiple coding information in the high-risk area to determine whether the target user is in the high-risk area based on the comparison result. When the target user is in the high-risk area, a risk assessment is performed on the target user based on the behavior data of the target user. When the target user is assessed as a suspected risk user, the identity information of the target user is verified to determine whether the target user is a risk user based on the verification result. If the target user is a risk user, risk prevention and control is performed on the target user.

[0110] The above method comprehensively considers the target user's coding information, target user's behavioral data and target user's identity information, which can more accurately and comprehensively identify the risks of the target user, thereby accurately and effectively preventing and controlling the risks of the target user and meeting the current risk prevention and control requirements.

[0111] Although this specification provides examples such as the following embodiments or the attached Figure 2The method operation steps or device structure shown in the figure, but based on routine or no creative labor, the method or device may include more or fewer operation steps or module units after partial merger. In the steps or structures that do not logically have a necessary causal relationship, the execution order of these steps or the module structure of the device is not limited to the execution order or module structure shown in the embodiments of this specification or the drawings. When the method or module structure is applied to an actual device, server or terminal product, it can be executed sequentially or in parallel according to the method or module structure shown in the embodiments or drawings (for example, in an environment of parallel processors or multi-threaded processing, or even in an implementation environment of distributed processing and server clusters). Based on the above-mentioned risk prevention and control method, the embodiments of this specification also propose an embodiment of a risk prevention and control device. As Figure 2 As shown, the risk prevention and control device may specifically include the following modules:

[0112] The coding information determination module 201 may be used to determine the coding information of a target user initiating a service request, wherein the service request carries the identity information of the target user;

[0113] The judgment module 202 may be used to compare the coded information with a plurality of coded information in a high-risk area, so as to judge whether the target user is in a high-risk area according to the comparison result;

[0114] The risk assessment module 203 may be used to perform risk assessment on the target user according to the behavior data of the target user when the target user is in a high-risk area;

[0115] The risk prevention and control module 204 may be used to perform risk prevention and control on the target user in combination with the identity information when the target user is assessed as a suspected risk user.

[0116] In some embodiments, the coding information determination module 201 can be specifically used to obtain the geographic location of the target user, convert the geographic location into longitude and latitude information; perform position coding on the longitude and latitude information using a position coding algorithm to obtain the coding information of the target user.

[0117] In some embodiments, the above-mentioned judgment module 202 can be specifically used to determine that the target user is in a high-risk area when the comparison result is that the coding information is consistent with at least one of the multiple coding information in the high-risk area; when the comparison result is that the coding information is inconsistent with multiple coding information in the high-risk area, determine that the target user is not in the high-risk area.

[0118] In some embodiments, the high-risk area in the above-mentioned judgment module 202 is determined in the following manner: determine a first target area with multiple risky users, the first target area includes multiple first blocks, and each first block in the multiple first blocks corresponds to the coding information of a unique risky user; obtain the number of risky users with the same coding information in each first block and the behavior data of the risky users; divide the risk level of each first block according to the number of risky users and the behavior data of the risky users; and use one or more first blocks with a risk level greater than a preset risk level threshold as the high-risk area.

[0119] In some embodiments, the behavior data of the target user in the above-mentioned risk assessment module 203 may include: the target user's business request frequency and the number of business requests; accordingly, the above-mentioned risk assessment module 203 can be specifically used to determine whether the business request frequency of the target user within a preset time is greater than a preset frequency threshold or whether the number of business requests is greater than a preset number threshold; if so, it is determined that the target user is assessed as a suspected risk user.

[0120] In some embodiments, the behavior data of the target user in the above-mentioned risk assessment module 203 may also include: the behavior data of the target user in the current cycle and the behavior data of the previous cycle; accordingly, the above-mentioned risk assessment module 203 may also be used to determine the difference result between the behavior data of the target user in the current cycle and the behavior data of the previous cycle; judge whether the difference result is greater than a preset difference threshold; if so, determine that the target user is assessed as a suspected risk user.

[0121] In some embodiments, the risk prevention and control module 204 may be specifically used to verify the identity information of the target user to determine whether the target user is a risky user according to the verification result; if so, perform risk prevention and control on the target user.

[0122] In some embodiments, the above-mentioned judgment module 202 can also be used to determine a second target area with multiple active users, wherein the second target area includes multiple second blocks, each of the multiple second blocks corresponds to the coding information of a unique active user, and the active user risk value is less than a preset risk threshold; the coding information is compared with the coding information corresponding to each second block in the second target area; accordingly, the above-mentioned risk prevention and control module 204 can also be used to process the business request when the comparison result is that the coding information is consistent with the coding information corresponding to each second block in the second target area.

[0123] It can be seen from the above that a risk prevention and control device provided in the embodiments of this specification can accurately and effectively perform risk prevention and control on risky users.

[0124] The embodiment of this specification also provides an electronic device based on the above-mentioned risk prevention and control method, including a processor and a memory for storing programs / instructions executable by the processor. When the processor is implemented, it can perform the following steps according to the program / instructions: determine the coding information of the target user who initiates the service request, and the service request carries the identity information of the target user; compare the coding information with multiple coding information in the high-risk area to determine whether the target user is in the high-risk area according to the comparison result; when the target user is in the high-risk area, perform risk assessment on the target user according to the behavior data of the target user; when the target user is assessed as a suspected risk user, perform risk prevention and control on the target user in combination with the identity information.

[0125] In order to complete the above instructions more accurately, refer to Figure 3 As shown, the embodiment of this specification also provides another specific electronic device, wherein the electronic device includes a network communication port 301, a processor 302 and a memory 303, and the above structures are connected through internal cables so that each structure can perform specific data interaction.

[0126] The network communication port 301 may be used to determine the coding information of the target user who initiates the service request, and the service request carries the identity information of the target user;

[0127] The processor 302 may be specifically configured to compare the coded information with a plurality of coded information in a high-risk area, so as to determine whether the target user is in a high-risk area according to the comparison result; when the target user is in a high-risk area, perform risk assessment on the target user according to the behavior data of the target user; when the target user is assessed as a suspected risk user, perform risk prevention and control on the target user in combination with the identity information;

[0128] The memory 303 may be specifically used to store corresponding instruction programs.

[0129] In this embodiment, the network communication port 301 can be a virtual port that is bound to different communication protocols so that different data can be sent or received. For example, the network communication port can be a port responsible for web data communication, a port responsible for FTP data communication, or a port responsible for email data communication. In addition, the network communication port can also be a physical communication interface or communication chip. For example, it can be a wireless mobile network communication chip, such as GSM, CDMA, etc.; it can also be a Wifi chip; it can also be a Bluetooth chip.

[0130] In this embodiment, the processor 302 may be implemented in any appropriate manner. For example, the processor may take the form of a microprocessor or processor and a computer-readable medium storing a computer-readable program code (such as software or firmware) executable by the (micro)processor, a logic gate, a switch, an application specific integrated circuit (ASIC), a programmable logic controller, and an embedded microcontroller, etc. This specification does not limit this.

[0131] In this embodiment, the memory 303 may include multiple levels. In a digital system, anything that can store binary data can be a memory; in an integrated circuit, a circuit with a storage function but no physical form is also called a memory, such as RAM, FIFO, etc.; in a system, a storage device with a physical form is also called a memory, such as a memory stick, TF card, etc.

[0132] The embodiments of this specification also provide a computer storage medium based on the above-mentioned risk prevention and control method, wherein the computer storage medium stores a computer program / instruction, which, when executed, implements: determining the coding information of a target user who initiates a business request, wherein the business request carries the identity information of the target user; comparing the coding information with multiple coding information in a high-risk area to determine whether the target user is in a high-risk area based on the comparison result; when the target user is in the high-risk area, performing a risk assessment on the target user based on the target user's behavior data; when the target user is assessed as a suspected risk user, performing risk prevention and control on the target user in combination with the identity information.

[0133] In this embodiment, the storage medium includes, but is not limited to, a random access memory (RAM), a read-only memory (ROM), a cache, a hard disk (HDD), or a memory card. The memory may be used to store computer program instructions. The network communication unit may be an interface for network connection communication set in accordance with the standard specified by the communication protocol.

[0134] In this embodiment, the functions and effects specifically implemented by the program instructions stored in the computer storage medium can be explained in comparison with other implementations and will not be described in detail here.

[0135] The embodiments of this specification also provide a computer program product based on the above-mentioned risk prevention and control method, including a non-transitory computer-readable storage medium storing a computer program / instruction, wherein the computer program / instruction is operable to cause a computer to perform the following steps: determine the coding information of a target user who initiates a business request, wherein the business request carries the identity information of the target user; compare the coding information with multiple coding information in a high-risk area to determine whether the target user is in a high-risk area based on the comparison result; when the target user is in a high-risk area, perform a risk assessment on the target user based on the target user's behavior data; when the target user is assessed as a suspected risk user, perform risk prevention and control on the target user in combination with the identity information.

[0136] Although the present specification provides method operation steps as described in the embodiments or flow charts, more or less operation steps may be included based on conventional or non-creative means. The order of steps listed in the embodiments is only one way of executing the order of many steps, and does not represent a unique execution order. When the device or client product in practice is executed, it can be executed in sequence or in parallel according to the method shown in the embodiments or the drawings (for example, a parallel processor or a multi-threaded processing environment, or even a distributed data processing environment). The term "include", "include" or any other variant thereof is intended to cover non-exclusive inclusion, so that the process, method, product or device including a series of elements includes not only those elements, but also includes other elements that are not explicitly listed, or also includes elements inherent to such a process, method, product or device. In the absence of more restrictions, it is not excluded that there are other identical or equivalent elements in the process, method, product or device including the elements. The first, second, etc. words are used to represent the name, and do not represent any particular order.

[0137] Those skilled in the art also know that, in addition to implementing the controller in a purely computer-readable program code, the controller can be made to implement the same function in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers by logically programming the method steps. Therefore, such a controller can be considered as a hardware component, and the devices for implementing various functions included therein can also be considered as structures within the hardware component. Or even, the devices for implementing various functions can be considered as both software modules for implementing the method and structures within the hardware component.

[0138] This specification may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, classes, etc. that perform specific tasks or implement specific abstract data types. This specification may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media including storage devices.

[0139] Through the description of the above embodiments, it can be known that those skilled in the art can clearly understand that the present specification can be implemented by means of software plus a necessary general hardware platform. Based on such an understanding, the technical solution of the present specification can essentially be embodied in the form of a software product, which can be stored in a storage medium such as ROM / RAM, a disk, an optical disk, etc., and includes a number of instructions for enabling a computer device (which can be a personal computer, a mobile terminal, a server, or a network device, etc.) to execute the methods described in each embodiment of the present specification or some parts of the embodiments.

[0140] The various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. This specification can be used in many general or special computer system environments or configurations. For example: personal computers, server computers, handheld devices or portable devices, tablet devices, multi-processor systems, microprocessor-based systems, set-top boxes, programmable electronic devices, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, etc.

[0141] Although the present specification is described through embodiments, persons skilled in the art will appreciate that there are many variations of the present specification without departing from the spirit of the present specification, and it is intended that the appended claims include these variations without departing from the spirit of the present specification.

Claims

1. A risk prevention and control method, characterized in that: include: Determine the encoding information of the target user who initiates the service request, wherein the service request carries the identity information of the target user; Comparing the coded information with a plurality of coded information in a high-risk area, so as to determine whether the target user is in the high-risk area according to the comparison result; When the target user is in a high-risk area, performing a risk assessment on the target user based on the behavior data of the target user; When the target user is evaluated as a suspected risk user, risk prevention and control is performed on the target user in combination with the identity information.

2. The method according to claim 1, characterized in that The determining of the coding information of the target user initiating the service request includes: Obtaining the geographic location of the target user, and converting the geographic location into longitude and latitude information; The longitude and latitude information is position-encoded using a position coding algorithm to obtain the coding information of the target user.

3. The method according to claim 1, characterized in that The comparing the coded information with a plurality of coded information in the high-risk area to determine whether the target user is in the high-risk area according to the comparison result includes: When the comparison result is that the coding information is consistent with at least one of the multiple coding information in the high-risk area, determining that the target user is in the high-risk area; When the comparison result is that the coding information is inconsistent with multiple coding information in the high-risk area, it is determined that the target user is not in the high-risk area.

4. The method according to claim 1, characterized in that: The high risk areas are determined by: Determine a first target area having a plurality of risky users, wherein the first target area includes a plurality of first blocks, each of the plurality of first blocks corresponding to coded information of a unique risky user; Obtaining the number of risky users having the same coding information and the behavior data of the risky users in each first block; According to the number of risky users and the behavior data of the risky users, the risk level of each first block is divided; One or more first blocks whose risk levels are greater than a preset risk level threshold are regarded as the high-risk areas.

5. The method according to claim 1, characterized in that The target user's behavior data includes: the target user's service request frequency and service request times; Accordingly, the risk assessment of the target user according to the behavior data of the target user includes: Determine whether the service request frequency of the target user within a preset time is greater than a preset frequency threshold or whether the number of service requests is greater than a preset number threshold; If so, it is determined that the target user is assessed as a suspected risk user.

6. The method according to claim 5, characterized in that The target user's behavior data also includes: the target user's current cycle behavior data and the previous cycle behavior data; Accordingly, the risk assessment of the target user according to the behavior data of the target user further includes: Determine the difference between the target user's current cycle behavior data and the previous cycle behavior data; Determine whether the difference result is greater than a preset difference threshold; If so, it is determined that the target user is assessed as a suspected risk user.

7. The method according to claim 1, characterized in that The performing risk prevention and control on the target user in combination with the identity information includes: Verifying the identity information of the target user to determine whether the target user is a risky user according to the verification result; If so, risk prevention and control is performed on the target user.

8. The method according to claim 1, characterized in that: The method further comprises: Determine a second target area having multiple active users, the second target area includes multiple second blocks, each of the multiple second blocks corresponds to the coded information of a unique active user, and the risk value of the active user is less than a preset risk threshold; comparing the coded information with the coded information corresponding to each second block in the second target area; When the comparison result is that the coding information is consistent with the coding information corresponding to each second block in the second target area, the service request is processed.

9. A risk prevention and control device, characterized in that: include: A coding information determination module, used to determine the coding information of a target user initiating a service request, wherein the service request carries the identity information of the target user; A judgment module, used for comparing the coded information with a plurality of coded information in a high-risk area, so as to judge whether the target user is in a high-risk area according to the comparison result; A risk assessment module, used to perform risk assessment on the target user according to the behavior data of the target user when the target user is in a high-risk area; The risk prevention and control module is used to perform risk prevention and control on the target user in combination with the identity information when the target user is evaluated as a suspected risk user.

10. A computer device comprising a memory, a processor and a computer program / instruction stored in the memory, characterized in that: The processor executes the computer program / instructions to implement the steps of the method according to any one of claims 1 to 8.

11. A computer-readable storage medium having a computer program / instruction stored thereon, characterized in that: When the computer program / instructions are executed by a processor, the steps of the method according to any one of claims 1 to 8 are implemented.

12. A computer program product comprising a computer program / instructions, characterized in that: When the computer program / instructions are executed by a processor, the steps of the method according to any one of claims 1 to 8 are implemented.

Images