User security level analysis method and device, equipment and storage medium

Abstract

The invention provides a user security level analysis method and device, equipment and a storage medium, and can be applied to the technical field of data storage and analysis. User data, namely, service data and behavior data, of multiple network access users are obtained in real time and written into a Dores database, a service data table and a behavior data table are obtained, then associated query is performed based on the two tables, and the security levels of the multiple network access users are determined in combination with a preset security level analysis strategy. According to the method, real-time monitoring and risk assessment of user activities are realized, the overall safety and user experience are effectively improved, and the reliability and stability of the system are enhanced.

Description

Technical Field

[0001] The present application relates to the technical field of data storage and analysis, and in particular to a method, device, equipment and storage medium for analyzing a user's security level. Background Art

[0002] In recent years, with the popularization of communication networks and the widespread use of intelligent devices, a large amount of user behavior data has been generated. This data not only includes basic information such as users' call records and traffic consumption, but also includes information in multiple dimensions such as users' behavioral habits, preferences, and geographic locations. Therefore, real-time analysis and processing of new user access data has become particularly important.

[0003] However, in existing research and practice, most of them focus on building offline user portraits based on big data. These methods usually rely on historical data and generate user portraits through offline algorithms, while the work on data processing of new users joining the network and the construction of real-time data warehouses is not perfect enough.

[0004] Current technical solutions often do not cover the use of Doris database to process real-time data streams, lack support for real-time data streams, and do not fully consider how to use multi-source heterogeneous data to enrich the profile of new network users. Therefore, a more real-time, convenient and fast user security level analysis method is needed. Summary of the invention

[0005] The present application provides a user security level analysis method, device, equipment and storage medium to solve the problems existing in the existing new network user security level analysis method, such as single data source and failure to build a real-time data warehouse.

[0006] In a first aspect, the present application provides a method for analyzing a user's security level, the method comprising:

[0007] Acquire user data of multiple network users in real time, the user data includes: business data and behavior data;

[0008] The business data and the behavior data are written into the Doris database respectively to obtain a business data table and a behavior data table, wherein the data stored in the business data table and the behavior data table are hot data;

[0009] In response to a security level analysis request of a target user, determining analysis data corresponding to the target user from the business data table and the behavior data table;

[0010] Based on the analysis data, a security level analysis result of the target user is determined.

[0011] Optionally, the real-time acquisition of user data of multiple network users includes: business data and behavior data, including:

[0012] Acquire the service data and behavior data of multiple network users in real time, including: traffic signaling of network users, location signaling of network users, call signaling of network users, and online logs of network users;

[0013] Performing data cleaning and preprocessing on the business data, and using the processed data as business data;

[0014] The traffic signaling of the network user, the location signaling of the network user, the call signaling of the network user and the online log of the network user are aggregated and the aggregated data is used as behavior data.

[0015] Optionally, the traffic signaling of the network user, the location signaling of the network user, the call signaling of the network user, and the online log of the network user are aggregated, and the aggregated data is used as the behavior data, including:

[0016] Respectively determine whether the data information of the traffic signaling, the location signaling, the call signaling and the Internet access log of the same network user is empty;

[0017] In the case where the data information of the traffic signaling, the location signaling, the call signaling, and the online log is not empty, the non-empty data information is replaced to obtain the traffic signaling of the new user, the location signaling of the new user, the call signaling of the new user, and the online log of the new user;

[0018] The traffic signaling of the new user, the location signaling of the new user, the call signaling of the new user and the Internet log of the new user are aggregated through the Doris aggregation model to obtain aggregated data, and the aggregated data is used as behavior data.

[0019] Optionally, the business data and the behavior data are written into the Doris database respectively to obtain a business data table and a behavior data table, wherein the data stored in the business data table and the behavior data table are hot data, including:

[0020] The business data is supplemented through the Paimon tag table, and based on the supplemented business data and the behavior data, it is written into the Doris database according to the preset storage strategy to obtain the business data table and the behavior data table, wherein the preset storage strategy is the tiered processing of hot and cold data.

[0021] The behavior data is written into the Doris database according to a preset storage strategy to obtain the behavior data table, wherein the data stored in the business data table and the behavior data table are hot data, the cold data is used to represent data with low access frequency, and the hot data is used to represent data with high access frequency.

[0022] Optionally, the business data table includes: a first mobile phone number, the behavior data table includes: a second mobile phone number, and the responding to the security level analysis request of the target user, determining the analysis data corresponding to the target user from the business data table and the behavior data table, includes:

[0023] According to the security level analysis request of the target user, determining whether the target mobile phone number corresponding to the target user is the same as the first mobile phone number and the second mobile phone number;

[0024] When the first mobile phone number and the second mobile phone number are the same as the target mobile phone number, the business data and behavior data corresponding to the first mobile phone number and the second mobile phone number are used as the analysis data.

[0025] Optionally, the analysis data includes: the target user's credit rating, the target user's wifi and traffic data usage in a week, the target user's app activity in a week, the distance and number of times the target user's location drifts within a preset time, the number of times the target user calls the same number and the call duration, and the target user's ID type and corresponding ID number. The security level analysis result of the target user is determined based on the analysis data, including:

[0026] Based on the analysis data, a preset benchmark value is determined, and a security level analysis strategy for the target user is determined according to the analysis data and the preset benchmark value, wherein the preset benchmark value includes: a preset score, a preset traffic value, a preset activity value, a preset duration, a preset distance, a preset number of times, a preset number of calls, and a preset call duration;

[0027] According to the security level analysis strategy, a security level analysis result of the target user is determined.

[0028] Optionally, the security level analysis strategy includes:

[0029] Determining whether the credit rating of the target user is lower than the preset score;

[0030] Determine whether the target user's wifi and traffic data usage in a week is lower than the preset traffic value;

[0031] Determine whether the target user's app activity within a week is lower than the preset activity value;

[0032] Determine whether the position of the target user drifts by a distance greater than a preset distance and a number of times within the preset time period;

[0033] Determine whether the target user has dialed the same number more times than a preset number and whether the call duration after the call is connected is less than a preset duration;

[0034] Determine whether the target user's ID type and corresponding ID number are incorrect.

[0035] In a second aspect, the present application provides a user security level analysis device, the device comprising:

[0036] An acquisition module is used to acquire user data of multiple network users in real time, wherein the user data includes: business data and behavior data;

[0037] A processing module, used for writing the business data and the behavior data into the Doris database respectively, to obtain a business data table and a behavior data table, wherein the data stored in the business data table and the behavior data table are hot data;

[0038] The determination module is used to determine the analysis data corresponding to the target user from the business data table and the behavior data table in response to the security level analysis request of the target user; and determine the security level analysis result of the target user based on the analysis data.

[0039] Optionally, the acquisition module is further used to acquire the service data and behavior data of multiple network users in real time, and the behavior data includes: traffic signaling of network users, location signaling of network users, call signaling of network users, and online logs of network users;

[0040] The processing module is also used to clean and pre-process the business data, and use the processed data as business data; aggregate the traffic signaling of the networked user, the location signaling of the networked user, the call signaling of the networked user, and the Internet log of the networked user, and use the aggregated data as behavior data.

[0041] Optionally, the device further includes: a judgment module;

[0042] The judgment module is used to judge whether the data information of the traffic signaling, the location signaling, the call signaling and the Internet access log of the same network user is empty;

[0043] The processing module is also used to replace the data information of the traffic signaling, the location signaling, the call signaling and the Internet log when the data information of the traffic signaling, the location signaling, the call signaling and the Internet log is not empty, so as to obtain the traffic signaling of the new user, the location signaling of the new user, the call signaling of the new user and the Internet log of the new user; aggregate the traffic signaling of the new user, the location signaling of the new user, the call signaling of the new user and the Internet log of the new user through the Doris aggregation model to obtain aggregated data, and use the aggregated data as behavior data.

[0044] Optionally, the processing module is also used to perform data supplement processing on the business data through the Paimon tag table, and write the supplemented business data and the behavior data into the Doris database according to a preset storage strategy to obtain the business data table and the behavior data table, wherein the preset storage strategy is layered processing of hot and cold data; write the behavior data into the Doris database according to the preset storage strategy to obtain the behavior data table, wherein the data stored in the business data table and the behavior data table is hot data, the cold data is used to represent data with low access frequency, and the hot data is used to represent data with high access frequency.

[0045] Optionally, the judgment module is further used to judge whether the target mobile phone number corresponding to the target user is the same as the first mobile phone number and the second mobile phone number according to the security level analysis request of the target user;

[0046] The processing module is also used to use the business data and behavior data corresponding to the first mobile phone number and the second mobile phone number as the analysis data when the first mobile phone number and the second mobile phone number are the same as the target mobile phone number.

[0047] Optionally, the determination module is further used to determine a preset benchmark value based on the analysis data, and determine a security level analysis strategy for the target user based on the analysis data and the preset benchmark value, the preset benchmark value including: a preset score, a preset traffic value, a preset activity value, a preset duration, a preset distance, a preset number of times, a preset number of calls and a preset call duration, the analysis data including: the credit of the target user, the wifi and traffic data usage of the target user in a week, the app activity of the target user in a week, the distance and number of times the target user's location drifts within a preset duration, the number of times the target user calls the same number and the call duration, and the target user's ID type and corresponding ID number; according to the security level analysis strategy, the security level analysis result of the target user is determined.

[0048] Optionally, the judgment module is also used to judge whether the credit of the target user is lower than the preset score; judge whether the wifi and traffic data usage of the target user in a week is lower than the preset traffic value; judge whether the app activity of the target user in a week is lower than the preset activity value; judge whether the drift distance of the target user's location within the preset time period is greater than the preset distance and whether the number of times exceeds the preset number; judge whether the number of times the target user dials the same number is higher than the preset number and whether the call duration after the call is connected is lower than the preset duration; judge whether the ID type and corresponding ID number of the target user are incorrect.

[0049] In a third aspect, the present application provides a user security level analysis device, including:

[0050] Memory;

[0051] processor;

[0052] Wherein, the memory stores computer-executable instructions;

[0053] The processor executes the computer-executable instructions stored in the memory to implement the user security level analysis method as described in the first aspect and various possible implementations of the first aspect.

[0054] In a fourth aspect, the present application provides a computer storage medium having a computer program stored thereon, wherein the computer program is executed by a processor to implement the user security level analysis method as described in the first aspect and various possible implementations of the first aspect.

[0055] The present application provides a user security level analysis method, which obtains user data of multiple network users in real time and writes them into the Doris database respectively, obtains two Doris tables, namely the business data table and the behavior data table, and then performs a correlation query on the two tables, and combines the preset security level analysis strategy to determine the security level of multiple network users. This method realizes real-time monitoring and risk assessment of user activities, effectively improves the overall security and user experience, and enhances the reliability and stability of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0057] Figure 1 A process for analyzing the security level of a user provided in this application Figure 1 ;

[0058] Figure 2A process for analyzing the security level of a user provided in this application Figure 2 ;

[0059] Figure 3 A schematic diagram of the structure of a user security level analysis device provided by the present application;

[0060] Figure 4 A schematic diagram of the structure of a user security level analysis device provided in this application.

[0061] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0062] In order to make the purpose, technical solutions and advantages of this application clearer, the technical solutions in this application will be clearly and completely described below in conjunction with the drawings in this application. Obviously, the described embodiments are part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0063] The terms "first", "second", "third", "fourth", etc. (if any) in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the numbers used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in sequences other than those illustrated or described herein.

[0064] In the embodiments of the present application, the words "exemplary" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way.

[0065] First, the terms involved in this application are explained:

[0066] Doris: It is a high-performance, real-time analytical database based on the Massively Parallel Processing (MPP) architecture. It is well-known for its extremely fast and easy-to-use features. It can return query results for massive data in sub-second response time. It can not only support high-concurrency point query scenarios, but also support high-throughput complex analysis scenarios. Based on this, Apache Doris can better meet the use scenarios such as report analysis, ad hoc query, unified data warehouse construction, data lake federated query acceleration, etc. Users can build applications such as user behavior analysis, log retrieval analysis, user portrait analysis, order analysis, etc. on it.

[0067] In terms of storage models, Doris supports multiple storage models and has made targeted optimizations for different scenarios. In Doris, data is logically described in the form of a table. A table includes rows and columns. Row is a row of data of the user, and Column is used to describe the different fields in a row of data. Column can be divided into two categories: keywords and values. From a business perspective, Key and Value can correspond to dimension columns and indicator columns respectively. The Key column of Doris is the column specified in the table creation statement. The column following the keyword unique key or aggregate key or duplicate key in the table creation statement is the Key column, and the rest except the Key column is the Value column.

[0068] Apache Flink: It is an open source stream processing framework developed by the Apache Software Foundation. Its core is a distributed streaming data flow engine used for stateful computing of unbounded and bounded data streams. Flink can run in all common cluster environments and can perform calculations at memory speed and any scale; Flink runtime consists of two types of processes: a job manager (JobManager) and one or more task managers (TaskManager).

[0069] In recent years, with the popularization of communication networks and the widespread use of intelligent devices, a large amount of user behavior data has been generated. This data not only includes basic information such as users' call records and traffic consumption, but also includes information in multiple dimensions such as users' behavioral habits, preferences, and geographic locations. Therefore, real-time analysis and processing of new user access data has become particularly important.

[0070] However, in existing research and practice, most of them focus on building offline user portraits based on big data. These methods usually rely on historical data and generate user portraits through offline algorithms, while the work on data processing of new users joining the network and the construction of real-time data warehouses is not perfect enough.

[0071] Current technical solutions often do not cover the use of Doris database to process real-time data streams, lack support for real-time data streams, and do not fully consider how to use multi-source heterogeneous data to enrich the profiles of new users.

[0072] In view of the above problems, this application proposes a user security level analysis method.

[0073] This method obtains the user data of multiple network users in real time and writes them into the Doris database respectively, obtaining two Doris tables, namely the business data table and the behavior data table, and then performs a correlation query on the two tables, combined with the preset security level analysis strategy, to determine the security level of multiple network users. This method realizes real-time monitoring and risk assessment of user activities, effectively improves the overall security and user experience, and enhances the reliability and stability of the system.

[0074] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0075] Figure 1 This is a process of a user security level analysis method provided in an embodiment of the present application. Figure 1 .like Figure 1 As shown, the user security level analysis method provided in this embodiment includes:

[0076] S101: Acquire user data of multiple network users in real time, wherein the user data includes service data and behavior data.

[0077] Among them, the business data is the order business data of the network users. The fields in the business data may include, for example: order number, mobile phone number, processing area, order status, completion time, credit, customer points, certificate type and certificate number, etc. The behavioral data is the data generated by the network users when they go online, including: the traffic signaling of the network users, the location signaling of the network users, the call signaling of the network users and the Internet log of the network users.

[0078] By acquiring the business data and behavior data of multiple network users in real time, real-time monitoring of network users can be completed. Based on the analysis data obtained from the monitoring, the security level of each network user can be determined, and corresponding security measures can be taken, such as automatically adjusting access rights, triggering early warning mechanisms, or implementing further identity authentication. This real-time monitoring and analysis not only helps to quickly identify potential risks and threats, but also effectively prevents malicious activities, thereby ensuring the security and stability of the network environment.

[0079] In a possible implementation, Flink can be used to read and calculate multi-source heterogeneous data in real time, where the multi-source heterogeneous data sources include MySQL tables, Kafka data, and Paimon data lake data. Flink CDCStream API is a function in the Apache Flink framework for capturing database change events. Flink SQL is part of the Apache Flink framework, which can use the SQL language to process data in Flink. You can read the MySQL table through the Flink CDCStream Api to obtain the business data of multiple users on the network, and you can also read Kafka data through FlinkSQL to obtain the behavior data of multiple users on the network.

[0080] S102: Write the business data and the behavior data into the Doris database respectively to obtain a business data table and a behavior data table.

[0081] Among them, Doris database is a high-performance, real-time analytical database based on MPP architecture. At the same time, Doris provides hot and cold data tiering technology, which can put part of the data on object storage to save costs without sacrificing functionality. The data stored in the business data table and behavior data table is hot data.

[0082] Business data and behavior data are written into the Doris database to obtain business data tables and behavior data tables. This is done to efficiently organize and manage different types of data and ensure clear classification and targeted analysis of data. Business data tables are mainly used to store data related to specific business processes, such as order number, mobile phone number, processing area, order status, completion time, credit, customer points, certificate type and certificate number, etc.; while behavior data tables focus on recording user behavior trajectories, such as the traffic of network users, the location of network users, the calls of network users, and the Internet logs of network users. In this way, we can optimize queries and analyses for different types of business needs, improve the efficiency and accuracy of data processing, and also facilitate subsequent data mining and business decision support.

[0083] In a possible implementation, the Mysql table can be read through the Flink CDC Stream Api to obtain the business data of multiple users in real time, and the obtained business data can be written into Doris to obtain the Doris1 business data table; Kafka data can also be read in real time through FlinkSQL to obtain the behavior data of multiple users in the network, and the obtained behavior data can be written into Doris to obtain the Doris2 behavior data table.

[0084] It is understandable that when Doris database stores data, it can also store data in a tiered manner of hot and cold data. For example, cloud object storage service (S3 RESOURCE) is used to store cold data, that is, data with low access frequency. When creating S3 RESOURCE, S3 remote link verification will be performed to ensure the correctness and reliability of RESOURCE creation. At the same time, the retention period of hot data can be set to 30 days, that is, active data within the last 30 days will be retained in high-performance storage, and data exceeding this period will be automatically migrated to lower-cost object storage, so as to balance storage costs and access performance. Therefore, the data stored in the Doris1 business data table and the Doris2 behavior data table are both hot data with high access frequency.

[0085] S103: In response to a security level analysis request of the target user, determining analysis data corresponding to the target user from the business data table and the behavior data table.

[0086] The target user refers to the user who needs to undergo security level verification among multiple network users obtained in real time and specified in the security level analysis request. The analysis data is the data used for target user security level analysis obtained by performing a correlation query on the Doris1 business data table and the Doris2 behavior data table.

[0087] The purpose of identifying the target user and combining the Doris1 business data table and the Doris2 behavior data table to obtain the target user's analysis data is to help the system comprehensively evaluate the user's activities and potential risks in the future. By integrating business data and behavior data, it is possible to more accurately judge the user's behavior pattern and the security threats they may face, so as to dynamically adjust the security strategy, provide personalized security protection measures, ensure the security of user accounts, and respond to potential unsafe behaviors in a timely manner.

[0088] In a possible implementation, both the Doris1 business data table and the Doris2 behavior data table contain the target user's mobile phone number. The Doris1 business data table and the Doris2 behavior data table can be associated with each other based on the target user's mobile phone number to determine the analysis data of the target user for safety officer level analysis.

[0089] S104: Determine a security level analysis result of the target user based on the analysis data.

[0090] Among them, the security level is divided into three levels, namely risk level one, risk level two and risk level three. The security level analysis result is used to indicate the security level of the target user.

[0091] The purpose of determining the target user's security level analysis results based on the analysis data is to assess the user's potential security risks based on their behavior patterns and business activities, so as to formulate a reasonable security strategy. By real-time monitoring and analysis of the user's specific activity data, abnormal behavior can be discovered in a timely manner, early warning can be given, and corresponding protective measures can be taken to ensure the security of users and systems.

[0092] In a possible implementation, a simple rule-based algorithm can be used to determine the risk level of the target user. The specific rules include: the credit in the order business data is low, lower than the passing score; the use of wifi and traffic data within a week is very little, and the app activity within a week is very low; the user's location is long-distance and drifts more than n times in a short period of time; the caller calls the same number multiple times, and the call duration after the call is connected is very short; the certificate type and the corresponding certificate number are wrong. If the target user's analysis data hits two of the above, the target user's security level is risk level one. If the target user's analysis data hits three of the above, the target user's security level is risk level two. If the target user's analysis data hits four of the above, the target user's security level is risk level three. It should be noted that each value used for comparison, such as the passing score, is a standard value preset based on the overall user data, which can be directly extracted from the Doris database.

[0093] The user security level analysis method provided in the embodiment of the present application obtains the user data of multiple network users in real time and writes them into the Doris database respectively, obtains two Doris tables, performs a correlation query on the two Doris tables, and determines the security levels of multiple network users based on the formulated security level analysis strategy. The method realizes real-time monitoring and risk assessment of user activities, ensuring that potential security threats can be identified and responded to in the first place.

[0094] Figure 2 The process of the user security level analysis method provided in the embodiment of the present application Figure 2 This embodiment is in Figure 1 Based on the embodiment, the user's security level analysis method is described in detail. Figure 1 As shown, the user security level analysis method provided in this embodiment includes:

[0095] S201: Acquire the service data and behavior data of multiple network users in real time, wherein the behavior data includes: traffic signaling of network users, location signaling of network users, call signaling of network users, and online logs of network users.

[0096] Among them, step S201 is similar to the above-mentioned step S101, and this application will not repeat them here.

[0097] S202: Clean and pre-process the business data, and use the processed data as business data.

[0098] The purpose of processing the business data in this step is to convert the data into a format suitable for further analysis, thereby improving the quality of the business data and the accuracy of the analysis results.

[0099] In a possible implementation, the Mysql table is first read through the Flink CDC Stream API to obtain the business data of multiple users, and then the business data is cleaned to exclude data with empty fields such as order numbers in the business data, and integrate data with fields such as order numbers that are not empty. At the same time, the mobile phone number field can be standardized into a format starting with +86 for subsequent analysis and processing. After completing the data cleaning and preprocessing of the business data, the processed business data is the latest business data.

[0100] S203: Aggregate the traffic signaling of the network user, the location signaling of the network user, the call signaling of the network user, and the online log of the network user, and use the aggregated data as behavior data.

[0101] The aggregation process is performed using the Doris aggregation model.

[0102] The purpose of aggregating the traffic signaling, location signaling, call signaling, and online logs of network users is to integrate multi-dimensional data to fully understand the user's activity patterns and behavior habits. This aggregation process can help identify the user's real-time location, communication behavior, network usage, and other information, thereby supporting refined user management and decision-making.

[0103] In a possible implementation, after reading Kafka data through FlinkSQL to obtain the behavior data of network users, that is, the traffic signaling of network users, the location signaling of network users, the call signaling of network users, and the online logs of network users, it can be input into the Doris database, and the traffic signaling of network users, the location signaling of network users, the call signaling of network users, and the online logs of network users are aggregated by non-empty replacement through Doris's aggregation model. When processing table data, the columns in the table can be divided into Key (dimension column) and Value (indicator column) according to whether the aggregation type is set. Specifically, if the aggregation type is not set for a column, then this column is regarded as a Key, for example, a mobile phone number may exist as a dimension column that identifies the user's identity; on the contrary, if the aggregation type is set, the column is Value, indicating an indicator column that needs to be aggregated. When data is stored, the system will merge rows with the same Key column (such as the same mobile phone number) into one row, and the Value column will perform corresponding aggregation operations according to the set aggregation type (such as sum, average, etc.) to generate summary results and finally obtain aggregated behavioral data.

[0104] It can be understood that the non-empty replacement aggregation method means that in the process of real-time collection of behavioral data of the same user, if a certain data of the user, such as the traffic signaling of the network user, is empty, the traffic signaling of the network user does not need to be replaced; if the traffic signaling of the network user is not empty, it will be replaced with the latest traffic signaling.

[0105] S204: The business data is supplemented through the Paimon tag table, and based on the supplemented business data and the behavior data, the supplemented business data and the behavior data are written into the Doris database according to a preset storage strategy to obtain the business data table and the behavior data table.

[0106] The Paimon tag table is used to supplement the data not included in the business data, and the preset storage strategy may be, for example, tiered storage for hot and cold data.

[0107] The purpose of further processing business data and behavior data and storing them in the Doris database according to the hot and cold data tiered storage strategy is to optimize data access performance and storage costs. Hot data, that is, frequently accessed data, will be stored in a high-performance storage layer to ensure the speed of real-time queries; while cold data, that is, historical data that is rarely accessed, will be stored in a lower-cost storage layer, which can ensure fast access to key data and effectively control storage costs, thereby improving the efficiency and economy of the overall system.

[0108] In a possible implementation, since the business data read from the Mysql table may not be complete, the Paimon tag table can be associated to complete the missing values ​​in the business data, such as the user's province, city, gender, age, credit rating, etc. The supplemented business data is then written into the Doris database to obtain the Doris1 business data table. The table generated by the processed behavior data is the Doris2 behavior data table.

[0109] S205: Write the behavior data into the Doris database according to a preset storage strategy to obtain the behavior data table, wherein the business data table includes: a first mobile phone number, and the behavior data table includes: a second mobile phone number.

[0110] Among them, step S205 is similar to the above-mentioned step S102, and this application will not repeat them here.

[0111] S206: Determine whether the target mobile phone number corresponding to the target user is the same as the first mobile phone number and the second mobile phone number; if so, execute step S207, if not, execute step S208.

[0112] Among them, the first mobile phone number is the mobile phone number corresponding to multiple network users in the business data table, and each first mobile phone number has corresponding business data. The second mobile phone number is the mobile phone number corresponding to multiple network users in the behavior data table, and each second mobile phone number has corresponding behavior data. The target mobile phone number is the mobile phone number corresponding to all network users who need to perform security level identification according to the security level analysis request.

[0113] The purpose of this step of determining whether the target mobile phone number of the target user is the same as the first mobile phone number and the second mobile phone number is to align the business data and behavior data of the target user so as to obtain analysis data later.

[0114] S207: When the first mobile phone number and the second mobile phone number are the same as the target mobile phone number, the business data and behavior data corresponding to the first mobile phone number and the second mobile phone number are used as the analysis data.

[0115] Among them, when the first mobile phone number, the second mobile phone number and the target mobile phone number are the same, it means that the service data and behavior data of the network user can be directly extracted from the service data table and the behavior data table, so that the service data and behavior data corresponding to the target user can be determined. Then, the data related to the preset security level analysis strategy in the service data and behavior data corresponding to the target user can be integrated to finally obtain the analysis data of the target user.

[0116] S208: When the first mobile phone number and the second mobile phone number are different from the target mobile phone number, the security level of the target user cannot be analyzed.

[0117] Among them, when the first mobile phone number, the second mobile phone number and the target mobile phone number are different, it means that the business data and behavior data of the network user cannot be directly extracted from the business data table and the behavior data table, that is, the business data and behavior data of the network user cannot be found. At this time, the security level of the target user cannot be analyzed, and the data needs to be re-verified and analyzed.

[0118] S209: Determine a preset reference value based on the analysis data, and determine a security level analysis strategy for the target user according to the analysis data and the preset reference value.

[0119] Among them, the analysis data may include: the credit of the target user, the wifi and traffic data usage of the target user in a week, the activity of the target user's app in a week, the distance and number of times the target user's location drifts within a preset time period, the number of times the target user calls the same number and the call duration, and the ID type and corresponding ID number of the target user. The preset benchmark values ​​may include: preset score, preset traffic value, preset activity value, preset duration, preset distance, preset number of times, preset number of calls and preset call duration.

[0120] Based on the analysis data and the preset benchmark values ​​that can be directly extracted from the Doris table, a security level analysis strategy for a target user can be determined. The specific security level analysis strategy is as follows:

[0121] Determining whether the credit rating of the target user is lower than the preset score;

[0122] Determine whether the target user's wifi and traffic data usage in a week is lower than the preset traffic value;

[0123] Determine whether the target user's app activity within a week is lower than the preset activity value;

[0124] Determine whether the position of the target user drifts by a distance greater than a preset distance and a number of times within the preset time period;

[0125] Determine whether the target user has dialed the same number more times than a preset number and whether the call duration after the call is connected is less than a preset duration;

[0126] Determine whether the target user's ID type and corresponding ID number are incorrect.

[0127] S210: Determine a security level analysis result of the target user according to the security level analysis strategy.

[0128] Among them, according to the security level analysis strategy, a simple rule-based algorithm can be used to determine the risk level of the target user. For example: if the target user judges that two of the security level analysis strategies are "yes" based on the analysis data, then the security level of the target user is risk level one; if the target user judges that three of the security level analysis strategies are "yes" based on the analysis data, then the security level of the target user is risk level two; if the target user judges that four of the security level analysis strategies are "yes" based on the analysis data, then the security level of the target user is risk level three.

[0129] Optionally, the final target user security level analysis results, namely, risk level identification and field data such as mobile phone number and order number, can also be stored in MySQL to support subsequent processing.

[0130] The user security level analysis method provided in the embodiment of the present application obtains the business data and behavior data of multiple network users, further processes and supplements the business data, and then writes them into the Doris database respectively, to obtain the Doris1 business data table and the Doris2 behavior data table. While obtaining the Doris2 behavior data table, the behavior data can also be aggregated to obtain a real-time updated Doris2 behavior data table. According to the user analysis data in the Doris1 business data table and the Doris2 behavior data table, the network users are analyzed according to the preset security level analysis rules, and the security level analysis results of the network users can be obtained. This method realizes real-time monitoring and risk assessment of user activities, effectively improving the overall security and user experience.

[0131] Figure 3 This is a schematic diagram of the structure of the user security level analysis device provided by this application. Figure 3 As shown, the user security level analysis device 300 provided in this embodiment includes:

[0132] The acquisition module 301 is used to acquire user data of multiple network users in real time, wherein the user data includes: service data and behavior data;

[0133] The processing module 302 is used to write the business data and the behavior data into the Doris database respectively to obtain a business data table and a behavior data table, wherein the data stored in the business data table and the behavior data table are hot data;

[0134] The determination module 303 is used to determine the analysis data corresponding to the target user from the business data table and the behavior data table in response to the security level analysis request of the target user; and determine the security level analysis result of the target user based on the analysis data.

[0135] Optionally, the acquisition module 301 is further used to acquire the service data and behavior data of multiple network users in real time, wherein the behavior data includes: traffic signaling of network users, location signaling of network users, call signaling of network users, and online logs of network users;

[0136] The processing module 302 is also used to clean and pre-process the business data, and use the processed data as business data; aggregate the traffic signaling of the network-connected user, the location signaling of the network-connected user, the call signaling of the network-connected user, and the Internet log of the network-connected user, and use the aggregated data as behavior data.

[0137] Optionally, the device further includes: a judgment module 304;

[0138] The judging module 304 is used to respectively judge whether the data information of the traffic signaling, the location signaling, the call signaling and the online log of the same network user is empty;

[0139] The processing module 302 is also used to replace the data information of the traffic signaling, the location signaling, the call signaling and the Internet log when the data information of the traffic signaling, the location signaling, the call signaling and the Internet log is not empty, so as to obtain the traffic signaling of the new user, the location signaling of the new user, the call signaling of the new user and the Internet log of the new user; aggregate the traffic signaling of the new user, the location signaling of the new user, the call signaling of the new user and the Internet log of the new user through the Doris aggregation model to obtain aggregated data, and use the aggregated data as behavior data.

[0140] Optionally, the processing module 302 is also used to perform data supplementation processing on the business data through the Paimon tag table, and write the supplemented business data and the behavior data into the Doris database according to a preset storage strategy to obtain the business data table and the behavior data table based on the supplemented business data and the behavior data, wherein the preset storage strategy is layered processing of hot and cold data; write the behavior data into the Doris database according to the preset storage strategy to obtain the behavior data table, wherein the data stored in the business data table and the behavior data table is hot data, the cold data is used to represent data with low access frequency, and the hot data is used to represent data with high access frequency.

[0141] Optionally, the judgment module 304 is further configured to judge, according to the security level analysis request of the target user, whether the target mobile phone number corresponding to the target user is the same as the first mobile phone number and the second mobile phone number;

[0142] The processing module 302 is also used to use the business data and behavior data corresponding to the first mobile phone number and the second mobile phone number as the analysis data when the first mobile phone number and the second mobile phone number are the same as the target mobile phone number.

[0143] Optionally, the determination module 303 is further used to determine a preset benchmark value based on the analysis data, and determine the security level analysis strategy of the target user according to the analysis data and the preset benchmark value, the preset benchmark value including: a preset score, a preset traffic value, a preset activity value, a preset duration, a preset distance, a preset number of times, a preset number of calls and a preset call duration, the analysis data including: the credit of the target user, the wifi and traffic data usage of the target user within a week, the app activity of the target user within a week, the distance and number of times the target user's location drifts within a preset duration, the number of times the target user calls the same number and the call duration, and the target user's ID type and corresponding ID number; according to the security level analysis strategy, the security level analysis result of the target user is determined.

[0144] Optionally, the judgment module 304 is also used to judge whether the credit of the target user is lower than the preset score; judge whether the wifi and traffic data usage of the target user in a week is lower than the preset traffic value; judge whether the app activity of the target user in a week is lower than the preset activity value; judge whether the drift distance of the target user's location within the preset time period is greater than the preset distance and whether the number of times exceeds the preset number; judge whether the number of times the target user dials the same number is higher than the preset number and whether the call duration after the call is connected is lower than the preset duration; judge whether the ID type and corresponding ID number of the target user are incorrect.

[0145] Figure 4 This is a schematic diagram of the structure of the user security level analysis device provided by this application. Figure 4 As shown, the present application provides a user security level analysis device, and the user security level analysis device 400 includes: a receiver 401, a transmitter 402, a processor 403 and a memory 404.

[0146] Receiver 401, used for receiving instructions and data;

[0147] A transmitter 402, used for sending instructions and data;

[0148] Memory 404, for storing computer-executable instructions;

[0149] The processor 403 is used to execute the computer-executable instructions stored in the memory 404 to implement the various steps performed by the user security level analysis method in the above embodiment. For details, please refer to the relevant description in the above embodiment of the user security level analysis method.

[0150] Optionally, the memory 404 may be independent or integrated with the processor 403 .

[0151] When the memory 404 is independently provided, the electronic device further includes a bus for connecting the memory 404 and the processor 403 .

[0152] The present application also provides a computer storage medium, in which computer execution instructions are stored. When a processor executes the computer execution instructions, a user security level analysis method as performed by the user security level analysis device described above is implemented.

[0153] It will be appreciated by those skilled in the art that all or some of the steps, systems, and functional modules / units in the methods disclosed above may be implemented as software, firmware, hardware, and appropriate combinations thereof. In hardware implementations, the division between the functional modules / units mentioned in the above description does not necessarily correspond to the division of physical nodes; for example, a physical node may have multiple functions, or a function or step may be performed by several physical nodes in cooperation. Some physical nodes or all physical nodes may be implemented as software executed by a processor, such as a central processing unit, a digital signal processor, or a microprocessor, or implemented as hardware, or implemented as an integrated circuit, such as an application-specific integrated circuit. Such software may be distributed on a computer-readable medium, which may include a computer storage medium (or non-transitory medium) and a communication medium (or temporary medium). As known to those skilled in the art, the term computer storage medium includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information and can be accessed by a computer. In addition, it is well known to those of ordinary skill in the art that communication media typically contain computer-readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media.

[0154] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the invention disclosed herein. The present application is intended to cover any modification, use or adaptation of the present application, which follows the general principles of the present application and includes common knowledge or customary techniques in the art that are not disclosed in the present application. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present application are indicated by the following claims.

[0155] It should be understood that the present application is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.

Claims

1. A method for analyzing a user's security level, characterized in that: include: Acquire user data of multiple network users in real time, the user data includes: business data and behavior data; The business data and the behavior data are written into the Doris database respectively to obtain a business data table and a behavior data table, wherein the data stored in the business data table and the behavior data table are hot data; In response to a security level analysis request of a target user, determining analysis data corresponding to the target user from the business data table and the behavior data table; Based on the analysis data, a security level analysis result of the target user is determined.

2. The method according to claim 1, characterized in that: The real-time acquisition of user data of multiple network users includes: business data and behavior data, including: Acquire the service data and behavior data of multiple network users in real time, including: traffic signaling of network users, location signaling of network users, call signaling of network users, and online logs of network users; Performing data cleaning and preprocessing on the business data, and using the processed data as business data; The traffic signaling of the network user, the location signaling of the network user, the call signaling of the network user and the online log of the network user are aggregated and the aggregated data is used as behavior data.

3. The method according to claim 2, characterized in that Aggregating the traffic signaling of the network user, the location signaling of the network user, the call signaling of the network user, and the online log of the network user, and using the aggregated data as behavior data, including: Respectively determine whether the data information of the traffic signaling, the location signaling, the call signaling and the Internet access log of the same network user is empty; In the case where the data information of the traffic signaling, the location signaling, the call signaling, and the online log is not empty, the non-empty data information is replaced to obtain the traffic signaling of the new user, the location signaling of the new user, the call signaling of the new user, and the online log of the new user; The traffic signaling of the new user, the location signaling of the new user, the call signaling of the new user and the Internet log of the new user are aggregated through the Doris aggregation model to obtain aggregated data, and the aggregated data is used as behavior data.

4. The method according to claim 1, characterized in that The business data and the behavior data are written into the Doris database respectively to obtain a business data table and a behavior data table, wherein the data stored in the business data table and the behavior data table are hot data, including: The business data is supplemented through the Paimon tag table, and based on the supplemented business data and the behavior data, the supplemented business data and the behavior data are written into the Doris database according to a preset storage strategy to obtain the business data table and the behavior data table, wherein the preset storage strategy is a tiered processing of hot and cold data; The behavior data is written into the Doris database according to a preset storage strategy to obtain the behavior data table, wherein the data stored in the business data table and the behavior data table are hot data, the cold data is used to represent data with low access frequency, and the hot data is used to represent data with high access frequency.

5. The method according to claim 1, characterized in that The business data table includes: a first mobile phone number, the behavior data table includes: a second mobile phone number, and the response to the security level analysis request of the target user, determining the analysis data corresponding to the target user from the business data table and the behavior data table, includes: According to the security level analysis request of the target user, determining whether the target mobile phone number corresponding to the target user is the same as the first mobile phone number and the second mobile phone number; When the first mobile phone number and the second mobile phone number are the same as the target mobile phone number, the business data and behavior data corresponding to the first mobile phone number and the second mobile phone number are used as the analysis data.

6. The method according to claim 5, characterized in that The analysis data includes: the target user's credit rating, the target user's wifi and traffic data usage in a week, the target user's app activity in a week, the distance and number of times the target user's location drifts within a preset time, the number of times the target user calls the same number and the call duration, and the target user's ID type and corresponding ID number. The security level analysis result of the target user is determined based on the analysis data, including: Based on the analysis data, a preset benchmark value is determined, and a security level analysis strategy for the target user is determined according to the analysis data and the preset benchmark value, wherein the preset benchmark value includes: a preset score, a preset traffic value, a preset activity value, a preset duration, a preset distance, a preset number of times, a preset number of calls, and a preset call duration; According to the security level analysis strategy, a security level analysis result of the target user is determined.

7. The method according to claim 6, characterized in that The security level analysis strategy includes: Determining whether the credit rating of the target user is lower than the preset score; Determine whether the target user's wifi and traffic data usage in a week is lower than the preset traffic value; Determine whether the app activity of the target user in a week is lower than the preset activity value; Determine whether the position of the target user drifts by a distance greater than a preset distance and a number of times within the preset time period; Determine whether the target user has dialed the same number more times than a preset number and whether the call duration after the call is connected is less than a preset duration; Determine whether the target user's ID type and corresponding ID number are incorrect.

8. A user security level analysis device, characterized in that: The device comprises: An acquisition module is used to acquire user data of multiple network users in real time, wherein the user data includes: business data and behavior data; A processing module, used for writing the business data and the behavior data into the Doris database respectively, to obtain a business data table and a behavior data table, wherein the data stored in the business data table and the behavior data table are hot data; The determination module is used to determine the analysis data corresponding to the target user from the business data table and the behavior data table in response to the security level analysis request of the target user; and determine the security level analysis result of the target user based on the analysis data.

9. A user security level analysis device, characterized in that: include: Memory; processor; Wherein, the memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory to implement the user security level analysis method according to any one of claims 1 to 7.

10. A computer storage medium, characterized in that: The computer storage medium stores computer execution instructions, which, when executed by a processor, are used to implement the user security level analysis method according to any one of claims 1 to 7.

Images