User security level analysis method, device, equipment and storage medium

Abstract

The application provides a user security level analysis method, device, equipment and storage medium, which can be used in the technical field of data storage and analysis. The user data, i.e. business data and behavior data, of multiple network users is obtained in real time, and is written into a Doris database respectively to obtain a business data table and a behavior data table. Then, based on the two tables, an associated query is performed, and a preset security level analysis strategy is combined to determine the security level of the multiple network users. The method realizes real-time monitoring and risk assessment of user activities, effectively improves the overall security and user experience, and enhances the reliability and stability of the system.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data storage and analysis, and particularly relates to a user security level analysis method and device, equipment and a storage medium. BACKGROUND

[0002] In recent years, with the popularization of communication networks and the widespread use of intelligent devices, a large amount of user behavior data has been generated. These data not only include basic information such as user call records and traffic consumption, but also include user behavior habits, preferences, and geographic location information in multiple dimensions. Therefore, real-time analysis and processing of new user network data is particularly important.

[0003] However, in existing research and practice, most of the work is focused on offline user portrait construction based on big data. These methods usually rely on historical data and generate user portraits through offline algorithms, but the processing of new user network data and the construction of real-time data warehouses are not perfect.

[0004] Current technical solutions often do not cover the use of Doris databases to process real-time data streams, lack support for real-time data streams, and do not fully consider how to use multi-source heterogeneous data to enrich the portrait of new network users. Therefore, a more real-time and more convenient and efficient user security level analysis method is needed. SUMMARY

[0005] The present application provides a user security level analysis method, device, equipment and storage medium to solve the problems of single data source and no real-time data warehouse construction in existing new network user security level analysis methods.

[0006] In a first aspect, the present application provides a user security level analysis method, which comprises:

[0007] Real-time acquisition of user data of multiple network users, wherein the user data includes business data and behavior data;

[0008] The business data and the behavior data are respectively written into a Doris database to obtain a business data table and a behavior data table, wherein the data stored in the business data table and the behavior data table is hot data;

[0009] In response to a security level analysis request of a target user, analysis data corresponding to the target user is determined from the business data table and the behavior data table;

[0010] Based on the analysis data, a security level analysis result of the target user is determined.

[0011] Optionally, the user data of the plurality of network users is acquired in real time, and the user data includes service data and behavior data, including:

[0012] The service data and the behavior data of the plurality of network users are acquired in real time, and the behavior data includes traffic signaling of the network user, location signaling of the network user, call signaling of the network user, and online log of the network user.

[0013] The service data is subjected to data cleaning and preprocessing, and the processed data is taken as the service data.

[0014] The traffic signaling of the network user, the location signaling of the network user, the call signaling of the network user, and the online log of the network user are subjected to aggregation processing, and the aggregated data is taken as the behavior data.

[0015] Optionally, the traffic signaling of the network user, the location signaling of the network user, the call signaling of the network user, and the online log of the network user are subjected to aggregation processing, and the aggregated data is taken as the behavior data, including:

[0016] It is respectively judged whether the data information of the traffic signaling, the location signaling, the call signaling, and the online log of the same network user is empty.

[0017] In a case where the data information of the traffic signaling, the location signaling, the call signaling, and the online log is not empty, the non-empty data information is subjected to replacement processing, to obtain traffic signaling of a new network user, location signaling of the new network user, call signaling of the new network user, and online log of the new network user.

[0018] The traffic signaling of the new network user, the location signaling of the new network user, the call signaling of the new network user, and the online log of the new network user are subjected to aggregation processing through a Doris aggregation model, to obtain aggregated data, and the aggregated data is taken as the behavior data.

[0019] Optionally, the service data and the behavior data are respectively written into a Doris database, to obtain a service data table and a behavior data table, wherein the data stored in the service data table and the behavior data table is hot data, including:

[0020] The service data is subjected to data supplement processing through a Paimon label table, and based on the supplemented service data and the behavior data, the service data table and the behavior data table are obtained by being written into the Doris database according to a preset storage strategy, wherein the preset storage strategy is cold and hot data layering processing.

[0021] write the behavior data into a Doris database according to a preset storage strategy, to obtain a behavior data table, wherein data stored in the business data table and the behavior data table is hot data, the cold data is used to represent data with low access frequency, and the hot data is used to represent data with high access frequency.

[0022] Optionally, the business data table includes a first mobile phone number, the behavior data table includes a second mobile phone number, and the analysis data corresponding to the target user is determined from the business data table and the behavior data table in response to the security level analysis request of the target user, including:

[0023] According to the security level analysis request of the target user, it is judged whether the target mobile phone number corresponding to the target user is the same as the first mobile phone number and the second mobile phone number;

[0024] In the case where the first mobile phone number and the second mobile phone number are the same as the target mobile phone number, the business data and behavior data corresponding to the first mobile phone number and the second mobile phone number are taken as the analysis data.

[0025] Optionally, the analysis data includes: credit of the target user, wifi and traffic data usage amount of the target user within a week, activity of the target user within a week, distance and times of the location of the target user drifting within a preset time length, number of times and call duration of the target user calling the same number, and type and corresponding certificate number of the target user's certificate, and the security level analysis result of the target user is determined based on the analysis data, including:

[0026] Based on the analysis data, a preset reference value is determined, and a security level analysis strategy of the target user is determined according to the analysis data and the preset reference value, the preset reference value includes: a preset score, a preset traffic value, a preset activity value, a preset time length, a preset distance, a preset number of times, a preset number of calls, and a preset call duration;

[0027] According to the security level analysis strategy, the security level analysis result of the target user is determined.

[0028] Optionally, the security level analysis strategy includes:

[0029] It is judged whether the credit of the target user is lower than the preset score;

[0030] It is judged whether the wifi and traffic data usage amount of the target user within a week is lower than the preset traffic value;

[0031] It is judged whether the activity of the target user within a week is lower than the preset activity value;

[0032] determine whether the distance of the position of the target user drifting within the preset time length is greater than a preset distance and whether the times are more than a preset number of times;

[0033] determine whether the number of times of the target user dialing the same number is higher than a preset number of times and whether the call time after connection is lower than a preset time length;

[0034] determine whether the type of the certificate of the target user and the corresponding certificate number are incorrect.

[0035] In a second aspect, the present application provides a security level analysis device of a user, which comprises:

[0036] an acquisition module, configured to acquire user data of a plurality of in-network users in real time, the user data comprising: business data and behavior data;

[0037] a processing module, configured to write the business data and the behavior data into a Doris database respectively, to obtain a business data table and a behavior data table, wherein the data stored in the business data table and the behavior data table is hot data;

[0038] a determination module, configured to determine analysis data corresponding to a target user from the business data table and the behavior data table in response to a security level analysis request of the target user, and determine a security level analysis result of the target user based on the analysis data.

[0039] Optionally, the acquisition module is further configured to acquire the business data and the behavior data of the plurality of in-network users in real time, and the behavior data comprises: traffic signaling of an in-network user, position signaling of the in-network user, call signaling of the in-network user, and online log of the in-network user.

[0040] The processing module is further configured to perform data cleaning and preprocessing on the business data, to take the processed data as the business data; and perform aggregation processing on the traffic signaling of the in-network user, the position signaling of the in-network user, the call signaling of the in-network user, and the online log of the in-network user, and take the aggregated data as the behavior data.

[0041] Optionally, the device further comprises a judgment module.

[0042] The judgment module is configured to respectively judge whether the data information of the traffic signaling, the position signaling, the call signaling, and the online log of the same in-network user is empty.

[0043] The processing module is further configured to, in a case where the data information of the traffic signaling, the location signaling, the call signaling, and the online log is not empty, replace the data information that is not empty to obtain traffic signaling of a new network user, location signaling of the new network user, call signaling of the new network user, and online log of the new network user; aggregate the traffic signaling of the new network user, the location signaling of the new network user, the call signaling of the new network user, and the online log of the new network user through a Doris aggregation model to obtain aggregated data, and use the aggregated data as behavior data.

[0044] Optionally, the processing module is further configured to perform data supplementing processing on the service data through a Paimon label table, and write the supplemented service data and the behavior data into a Doris database according to a preset storage strategy to obtain a service data table and a behavior data table, wherein the preset storage strategy is cold and hot data hierarchical processing; and write the behavior data into the Doris database according to the preset storage strategy to obtain the behavior data table, wherein the service data table and the behavior data table store hot data, the cold data is used to represent data with low access frequency, and the hot data is used to represent data with high access frequency.

[0045] Optionally, the judgment module is further configured to determine, according to a security level analysis request of a target user, whether a target mobile phone number corresponding to the target user is the same as the first mobile phone number and the second mobile phone number.

[0046] The processing module is further configured to, in a case where the first mobile phone number and the second mobile phone number are the same as the target mobile phone number, use the service data and the behavior data corresponding to the first mobile phone number and the second mobile phone number as the analysis data.

[0047] Optionally, the determination module is further configured to determine a preset reference value based on the analysis data, and determine a security level analysis strategy of the target user according to the analysis data and the preset reference value, wherein the preset reference value includes a preset score, a preset traffic value, a preset activity value, a preset time length, a preset distance, a preset number of times, a preset number of calls, and a preset call time length, the analysis data includes a credit degree of the target user, a wifi and traffic data usage amount of the target user within a week, an activity degree of an app of the target user within a week, a distance and a number of times of position drift of the target user within a preset time length, a number of times and a call time length of the target user calling the same number, and a type and a corresponding number of a certificate of the target user, and determine a security level analysis result of the target user according to the security level analysis strategy.

[0048] Optionally, the judging module is further configured to judge whether the credit degree of the target user is lower than the preset score; judge whether the data usage amount of the target user in a week is lower than the preset traffic value; judge whether the activity degree of the target user in a week is lower than the preset activity value; judge whether the distance of the target user's location drifts in the preset time length is greater than the preset distance and the number of times is more than the preset number of times; judge whether the number of times of the target user calling the same number is higher than the preset number of times and the call duration after connection is lower than the preset duration; and judge whether the type of the target user's certificate and the corresponding certificate number are incorrect.

[0049] In a third aspect, the present application provides a user security level analysis device, comprising:

[0050] a memory;

[0051] a processor;

[0052] The memory stores computer execution instructions.

[0053] The processor executes the computer execution instructions stored in the memory to implement the user security level analysis method as described in the first aspect and various possible implementation manners of the first aspect.

[0054] In a fourth aspect, the present application provides a computer storage medium having a computer program stored thereon, wherein the computer program is executed by a processor to implement the user security level analysis method as described in the first aspect and various possible implementation manners of the first aspect.

[0055] The present application provides a user security level analysis method, which obtains user data of multiple in-network users in real time, writes the user data into a Doris database respectively, obtains two Doris tables, i.e., a business data table and a behavior data table, performs associated query on the two tables, and determines the security level of the multiple in-network users in combination with a preset security level analysis strategy. The method realizes real-time monitoring and risk assessment of user activities, effectively improves the overall security and user experience, and enhances the reliability and stability of the system. BRIEF DESCRIPTION OF DRAWINGS

[0056] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and serve to explain the principles of the present application together with the specification.

[0057] Figure 1 The present application provides a user security level analysis method Figure One ;

[0058] Figure 2The flow of a user security level analysis method provided in the present application Figure Two ;

[0059] Figure 3 The structure diagram of a user security level analysis device provided in the present application

[0060] Figure 4 The structure diagram of a user security level analysis device provided in the present application

[0061] The specific embodiments of the present application have been shown in the above-described drawings, and will be described in more detail hereinafter. The drawings and the written description are not intended to restrict the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0062] In order to make the objects, technical solutions and advantages of the present application clearer, the technical solutions of the present application will be described clearly and completely below in conjunction with the drawings in the present application. Obviously, the described embodiments are only some of the embodiments of the present application, but not all the embodiments. Based on the embodiments in the present application, all the other embodiments obtained by those skilled in the art without any creative work fall within the scope of protection of the present application.

[0063] The terms "first", "second", "third", "fourth" and the like (if any) in the specification and claims of the present application and the above-described drawings are used to distinguish similar objects, and do not necessarily have to be used to describe a specific order or sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the present application described herein can be implemented in an order other than that illustrated or described herein.

[0064] In the embodiments of the present application, the words "exemplary" or "for example" are used to mean example, instance, or illustration. Any embodiment or design scheme described as "exemplary" or "for example" in the present application should not be interpreted as being more preferred or advantageous than other embodiments or design schemes. Rather, the words "exemplary" or "for example" are used to present the relevant concept in a specific manner.

[0065] First, the terms involved in the present application are explained:

[0066] Doris: A high-performance, real-time analytical database based on the Massively Parallel Processing (MPP) architecture, known for its speed and ease of use. It can return query results for massive data in sub-second response time, supporting not only high-concurrency point query scenarios but also high-throughput complex analysis scenarios. Based on this, Apache Doris can better meet the use scenarios of report analysis, ad hoc query, unified data warehouse construction, data lake federation query acceleration, etc. Users can build user behavior analysis, log retrieval analysis, user portrait analysis, order analysis, etc. on top of it.

[0067] In terms of storage model, Doris supports multiple storage models and optimizes them for different scenarios. In Doris, data is logically described in the form of tables. A table includes rows and columns. Row is a row of user data, and Column is used to describe different fields in a row of data. Column can be divided into two categories: Key and Value. From a business perspective, Key and Value can correspond to dimension columns and indicator columns, respectively. Doris Key column is the column specified in the table creation statement. The column after the keyword unique key or aggregate key or duplicate key in the table creation statement is the Key column, and the remaining columns are Value columns.

[0068] Apache Flink: An open-source stream processing framework developed by the Apache Software Foundation. Its core is a distributed stream data flow engine for stateful computation on unbounded and bounded data streams. Flink can run in all common cluster environments and perform in-memory computation at speed and scale. Flink runtime consists of two types of processes: a job manager (JobManager) and one or more task managers (TaskManager).

[0069] In recent years, with the popularization of communication networks and the widespread use of intelligent devices, a large amount of user behavior data has been generated. These data not only include basic information such as user call records and traffic consumption, but also include user behavior habits, preferences, and geographic location information in multiple dimensions. Therefore, real-time analysis and processing of new user network data becomes particularly important.

[0070] However, in existing research and practice, most of them are focused on offline user portrait construction based on big data. These methods usually rely on historical data and generate user portraits through offline algorithms, and the work of data processing for new user network entry and real-time data warehouse construction is not perfect.

[0071] The current technical solution does not cover the use of Doris database to process real-time data stream, lacks support for real-time data stream, and does not fully consider how to use multi-source heterogeneous data to enrich the portrait of new network users.

[0072] In view of the above problems, the present application provides a user security level analysis method.

[0073] The method obtains user data of multiple network entry users in real time, and writes the user data into a Doris database respectively to obtain two Doris tables, i.e. a business data table and a behavior data table, then performs an associated query on the two tables, and determines the security level of the multiple network entry users in combination with a preset security level analysis strategy. The method realizes real-time monitoring and risk assessment of user activities, effectively improves the overall security and user experience, and enhances the reliability and stability of the system.

[0074] The technical solutions of the present application and how the technical solutions of the present application solve the above technical problems will be described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of the present application will be described below with reference to the accompanying drawings.

[0075] Figure 1 is a flow of a user security level analysis method provided by an embodiment of the present application Figure One . As shown in Figure 1 , the user security level analysis method provided by the embodiment includes:

[0076] S101: Real-time acquisition of user data of multiple network entry users, the user data including: business data and behavior data.

[0077] The business data is order business data of the network entry user, and the fields in the business data may include, for example: order number, mobile phone number, region handled, order status, completion time, credit, customer points, certificate type and certificate number, etc. The behavior data is data generated by the network entry user when accessing the network, including: traffic signaling of the network entry user, location signaling of the network entry user, call signaling of the network entry user, and online log of the network entry user.

[0078] By acquiring the service data and behavior data of multiple network users in real time, real-time monitoring of network users can be achieved. According to the analysis data obtained by monitoring, the security level of each network user can be determined, and then corresponding security measures can be taken, such as automatically adjusting access permissions, triggering an early warning mechanism, or implementing further identity verification. This real-time monitoring and analysis not only helps to quickly identify potential risks and threats, but also effectively prevents malicious activities, thereby ensuring the security and stability of the network environment.

[0079] In one possible implementation, Flink can be used for real-time reading and computing of multi-source heterogeneous data, where the sources of multi-source heterogeneous data include Mysql tables, Kafka data, and Paimon data lake data. Flink CDCStream API is a function in the Apache Flink framework for capturing database change events, and Flink SQL is part of the Apache Flink framework, which can use SQL language to process data in Flink. Mysql tables can be read through Flink CDCStream Api to obtain the service data of multiple network users, and Kafka data can be read through Flink SQL to obtain the behavior data of multiple network users.

[0080] S102: Write the service data and the behavior data into a Doris database respectively to obtain a service data table and a behavior data table.

[0081] The Doris database is a high-performance, real-time analytical database based on MPP architecture, and Doris provides cold and hot data layering technology, which can put part of the data on object storage to save costs without sacrificing functionality. The data stored in the service data table and the behavior data table is hot data.

[0082] Writing the service data and the behavior data into the Doris database respectively to obtain the service data table and the behavior data table is done to efficiently organize and manage different types of data, ensuring clear classification and targeted analysis of data. The service data table is mainly used to store data related to specific business processes, such as order number, mobile number, handling area, order status, completion time, credit, customer points, certificate type, and certificate number, etc. The behavior data table focuses on recording user behavior tracks, such as network user traffic, network user location, network user calls, and network user online logs, etc. In this way, different types of business requirements can be optimized for query and analysis, improving data processing efficiency and accuracy, and facilitating subsequent data mining and business decision support.

[0083] In a possible implementation, the Mysql table can be read through the Flink CDC Stream Api, and the business data of multiple users is obtained in real time. At the same time, the obtained business data is written into Doris, and the Doris1 business data table is obtained. The Kafka data can also be read in real time through FlinkSQL, and the behavior data of multiple users is obtained. At the same time, the obtained behavior data is written into Doris, and the Doris2 behavior data table is obtained.

[0084] It can be understood that when the Doris database stores data, the cold and hot data layering method can also be used to store data. For example, the cloud object storage service (S3 RESOURCE) is used to store cold data, that is, data with low access frequency. When creating S3 RESOURCE, S3 remote link verification is performed to ensure the correctness and reliability of RESOURCE creation. At the same time, the retention period of hot data can be set to 30 days, that is, the active data in the last 30 days will be retained in the high-performance storage, and the data exceeding this period will be automatically migrated to the object storage with lower cost, so as to balance the storage cost and access performance. Therefore, the data stored in the Doris1 business data table and the Doris2 behavior data table are all hot data with high access frequency.

[0085] S103: In response to the security level analysis request of the target user, determining the analysis data corresponding to the target user from the business data table and the behavior data table.

[0086] Among them, the target user refers to the user in the real-time obtained multiple users who needs to be verified in the security level analysis request. The analysis data is the data used for the security level analysis of the target user obtained by associating the Doris1 business data table and the Doris2 behavior data table.

[0087] Determining the target user and obtaining the analysis data of the target user in combination with the Doris1 business data table and the Doris2 behavior data table aims to help the system comprehensively evaluate the activity situation and potential risks of the user subsequently. By integrating business data and behavior data, the behavior pattern of the user and the possible security threats he may face can be more accurately judged, so as to dynamically adjust the security strategy, provide personalized security protection measures, ensure the security of the user account, and timely respond to potential unsafe behaviors.

[0088] In a possible implementation, the Doris1 business data table and the Doris2 behavior data table both contain the mobile phone number of the target user. The Doris1 business data table and the Doris2 behavior data table can be associated according to the mobile phone number of the target user to determine the analysis data of the target user for security level analysis.

[0089] S104: Determine the security level analysis result of the target user based on the analysis data.

[0090] The security level is divided into three levels, namely, risk level one, risk level two, and risk level three, and the security level analysis result is used to indicate which level the security level of the target user is in.

[0091] The security level analysis result of the target user is determined based on the analysis data, which is to evaluate the potential security risk of the user according to the behavior pattern and business activity of the user, so as to develop a reasonable security strategy. By monitoring and analyzing the specific activity data of the user in real time, abnormal behavior can be found in time, early warning and corresponding protection measures can be taken, and the security of the user and the system can be ensured.

[0092] In one possible implementation, a simple rule-based algorithm can be used to determine the risk level of the target user, and the specific rules include: the credit in the order business data is lower than the passing score; the wifi and traffic data usage is very low within a week, and the app activity is very low within a week; the user location drifts more than n times in a short time; the number of calls to the same number is multiple, and the call duration is very short after connection; the certificate type and the corresponding certificate number are incorrect. If the analysis data of the target user hits two of the above, the security level of the target user is risk level one, if the analysis data of the target user hits three of the above, the security level of the target user is risk level two, and if the analysis data of the target user hits four of the above, the security level of the target user is risk level three. It should be noted that each value used for comparison, such as the passing score, is a standard value preset according to the overall user data, which can be directly obtained in the Doris database.

[0093] The security level analysis method for users provided by the embodiment of the application obtains two Doris tables by obtaining user data of multiple network users in real time and writing the user data into the Doris database respectively, and determines the security level of the multiple network users based on the developed security level analysis strategy by associating and querying the two Doris tables. The method realizes real-time monitoring and risk assessment of user activities, and ensures that potential security threats can be identified and responded to in the first time.

[0094] Figure 2 The flow of the security level analysis method for users provided by the embodiment of the application Figure Two The embodiment is based on Figure 1 the embodiment, and the security level analysis method for users is described in detail. As Figure 1 shown, the security level analysis method for users provided by the embodiment includes:

[0095] S201: Real-time acquisition of service data and behavior data of multiple network users, the behavior data including: traffic signaling of the network user, location signaling of the network user, call signaling of the network user, and online log of the network user.

[0096] Among them, step S201 is similar to the above step S101, and the present application will not be repeated here.

[0097] S202: Data cleaning and preprocessing of the service data, and the processed data is used as service data.

[0098] Among them, the purpose of processing the service data is to convert the data into a format suitable for further analysis, so as to improve the quality of service data and the accuracy of analysis results.

[0099] In one possible implementation, first, the Mysql table is read through Flink CDC Stream Api to obtain the service data of multiple network users, and then the service data is cleaned and processed, so as to exclude the data with empty order number and other fields in the service data, and integrate the data with non-empty order number and other fields. At the same time, the mobile phone number field can also be standardized to the format starting with +86, so as to facilitate subsequent analysis and processing. After completing the data cleaning and preprocessing of the service data, the processed service data is used as the latest service data.

[0100] S203: Aggregating the traffic signaling of the network user, the location signaling of the network user, the call signaling of the network user, and the online log of the network user, and using the aggregated data as behavior data.

[0101] Among them, the aggregation processing is aggregated by using Doris aggregation model.

[0102] The purpose of aggregating the traffic signaling of the network user, the location signaling of the network user, the call signaling of the network user, and the online log of the network user is to integrate multi-dimensional data to fully understand the activity patterns and behavior habits of users. Such aggregation processing can help identify the real-time location, communication behavior, network usage, and other information of users, so as to support fine user management and decision making.

[0103] In a possible implementation, the behavior data of the on-network user, i.e., the traffic signaling of the on-network user, the location signaling of the on-network user, the call signaling of the on-network user, and the online log of the on-network user, is obtained by reading the Kafka data through FlinkSQL, and then the behavior data of the on-network user is input into the Doris database, and the traffic signaling of the on-network user, the location signaling of the on-network user, the call signaling of the on-network user, and the online log of the on-network user are aggregated by using the non-empty replacement method of the aggregation model of Doris. When processing table data, the columns in the table can be divided into Key (dimension column) and Value (index column) according to whether an aggregation type is set. Specifically, if no aggregation type is set for a column, the column is regarded as Key, for example, a mobile phone number can exist as a dimension column for identifying the identity of a user; in contrast, if an aggregation type is set, the column is Value, indicating an index column that needs to be aggregated. When the data is stored, for rows with the same Key column (such as the same mobile phone number), the system combines the rows into one row, and the Value column is aggregated according to the set aggregation type (such as sum, average, etc.), thereby generating the aggregated result, and finally obtaining the aggregated behavior data.

[0104] It can be understood that the non-empty replacement aggregation method means that, in the process of collecting the behavior data of the same user in real time, if the traffic signaling of the on-network user is empty, the traffic signaling of the on-network user does not need to be replaced, and if the traffic signaling of the on-network user is not empty, the traffic signaling of the on-network user is replaced by the latest traffic signaling.

[0105] S204: The business data is subjected to data supplementing processing through a Paimon label table, and based on the supplemented business data and the behavior data, the business data table and the behavior data table are obtained by writing into a Doris database according to a preset storage strategy.

[0106] The Paimon label table is used to supplement the data that is not in the business data, and the preset storage strategy can be, for example, cold and hot data hierarchical storage.

[0107] The purpose of further processing the business data and the behavior data and storing the business data and the behavior data in the Doris database according to the cold and hot data hierarchical storage strategy is to optimize the data access performance and the storage cost. The hot data, i.e., frequently accessed data, is stored in a high-performance storage layer to ensure the speed of real-time query, and the cold data, i.e., less frequently accessed historical data, is stored in a storage layer with lower cost, so that the fast access of key data is ensured, the storage cost is effectively controlled, and the efficiency and economy of the overall system are improved.

[0108] In a possible implementation, since the business data read from the Mysql table can be incomplete, the Paimon label table can be associated to supplement the missing values in the business data, such as the province, city, gender, age, and credit of the user. The supplemented business data is then written into the Doris database to obtain the Doris1 business data table. The table generated by processing the behavior data is the Doris2 behavior data table.

[0109] S205: write the behavior data into the Doris database according to a preset storage strategy to obtain the behavior data table, wherein the business data table includes a first mobile phone number, and the behavior data table includes a second mobile phone number.

[0110] The step S205 is similar to the step S102, and details are not described herein.

[0111] S206: determine whether the target mobile phone number corresponding to the target user is the same as the first mobile phone number and the second mobile phone number; if yes, perform the step S207, and if no, perform the step S208.

[0112] The first mobile phone number is a mobile phone number corresponding to a plurality of in-network users in the business data table, and each first mobile phone number has corresponding business data. The second mobile phone number is a mobile phone number corresponding to a plurality of in-network users in the behavior data table, and each second mobile phone number has corresponding behavior data. The target mobile phone number is a mobile phone number corresponding to all in-network users that need to be authenticated according to a security level analysis request.

[0113] The step of determining whether the target mobile phone number of the target user is the same as the first mobile phone number and the second mobile phone number is to match the business data and the behavior data of the target user, so as to obtain analysis data subsequently.

[0114] S207: in the case where the first mobile phone number and the second mobile phone number are the same as the target mobile phone number, the business data and the behavior data corresponding to the first mobile phone number and the second mobile phone number are taken as the analysis data.

[0115] In the case where the first mobile phone number and the second mobile phone number are the same as the target mobile phone number, the business data and the behavior data of the in-network user can be directly extracted from the business data table and the behavior data table, so that the business data and the behavior data corresponding to the target user can be determined. Then, the data related to the preset security level analysis strategy in the business data and the behavior data corresponding to the target user can be integrated to finally obtain the analysis data of the target user.

[0116] S208: In the case that the first mobile phone number and the second mobile phone number are not the same as the target mobile phone number, the security level of the target user cannot be analyzed.

[0117] In the case that the first mobile phone number and the second mobile phone number are not the same as the target mobile phone number, the business data and the behavior data of the access user cannot be directly extracted from the business data table and the behavior data table, that is, the business data and the behavior data of the access user cannot be found, and at this time, the security level of the target user cannot be analyzed, and data verification and analysis need to be performed again.

[0118] S209: Based on the analysis data, a preset reference value is determined, and a security level analysis strategy of the target user is determined according to the analysis data and the preset reference value.

[0119] The analysis data can include: credit of the target user, wifi and traffic data usage of the target user within a week, activity of the target user within a week, distance and times of the location of the target user drifting within a preset time length, times and call duration of the target user calling the same number, and type and corresponding number of the certificate of the target user. The preset reference value can include: preset score, preset traffic value, preset activity value, preset time length, preset distance, preset times, preset call times, and preset call duration.

[0120] Based on the analysis data and the preset reference value that can be directly extracted from the Doris table, a security level analysis strategy of a target user can be determined, and the specific security level analysis strategy is as follows:

[0121] whether the credit of the target user is lower than the preset score;

[0122] whether the wifi and traffic data usage of the target user within a week is lower than the preset traffic value;

[0123] whether the activity of the target user within a week is lower than the preset activity value;

[0124] whether the distance of the location of the target user drifting within the preset time length is greater than the preset distance and the times exceed the preset times;

[0125] whether the times of the target user calling the same number is higher than the preset times and the call duration after connection is lower than the preset time length;

[0126] whether the type and corresponding number of the certificate of the target user are incorrect.

[0127] S210: According to the security level analysis strategy, the security level analysis result of the target user is determined.

[0128] According to the security level analysis strategy, a simple rule-based algorithm can be used to determine the risk level of the target user, for example: if the target user determines that two of the security level analysis strategies are "yes" based on the analysis data, the security level of the target user is risk level one, if the target user determines that three of the security level analysis strategies are "yes" based on the analysis data, the security level of the target user is risk level two, and if the target user determines that four of the security level analysis strategies are "yes" based on the analysis data, the security level of the target user is risk level three.

[0129] Optionally, the final target user security level analysis result, i.e. the risk level identifier and the mobile phone number and order number field data, can also be stored in Mysql to support subsequent processing.

[0130] The security level analysis method for users provided by the embodiments of the application obtains the business data and behavior data of multiple network users, further processes and supplements the business data, and writes the business data and behavior data into a Doris database respectively to obtain a Doris1 business data table and a Doris2 behavior data table. The behavior data is aggregated to obtain a real-time updated Doris2 behavior data table while obtaining the Doris2 behavior data table. According to the user analysis data in the Doris1 business data table and the Doris2 behavior data table, the network users are analyzed according to a preset security level analysis rule, and the security level analysis result of the network users can be obtained. The method realizes real-time monitoring and risk assessment of user activities, and effectively improves the overall security and user experience.

[0131] Figure 3 The structure diagram of the security level analysis device for users provided by the application is shown in FIG. 1. As shown in FIG. 1, the security level analysis device 300 provided by the embodiments of the application comprises: Figure 3 The acquisition module 301 is configured to acquire user data of multiple network users in real time, wherein the user data comprises business data and behavior data.

[0132] The processing module 302 is configured to write the business data and the behavior data into a Doris database respectively to obtain a business data table and a behavior data table, wherein the data stored in the business data table and the behavior data table is hot data.

[0133] The determination module 303 is configured to determine analysis data corresponding to a target user from the business data table and the behavior data table in response to a security level analysis request of the target user, and determine a security level analysis result of the target user based on the analysis data.

[0134] The security level analysis device for users provided by the embodiments of the application comprises:

[0135] Optionally, the acquisition module 301 is further configured to acquire, in real time, service data and behavior data of a plurality of network users, the behavior data including traffic signaling of the network users, location signaling of the network users, call signaling of the network users, and online log of the network users.

[0136] The processing module 302 is further configured to perform data cleaning and preprocessing on the service data, and take the processed data as the service data; perform aggregation processing on the traffic signaling of the network users, the location signaling of the network users, the call signaling of the network users, and the online log of the network users, and take the aggregated data as the behavior data.

[0137] Optionally, the apparatus further includes a judgment module 304.

[0138] The judgment module 304 is configured to judge whether the data information of the traffic signaling, the location signaling, the call signaling, and the online log of the same network user is empty or not.

[0139] The processing module 302 is further configured to, in a case where the data information of the traffic signaling, the location signaling, the call signaling, and the online log is not empty, perform replacement processing on the non-empty data information, to obtain traffic signaling of a new network user, location signaling of the new network user, call signaling of the new network user, and online log of the new network user; perform aggregation processing on the traffic signaling of the new network user, the location signaling of the new network user, the call signaling of the new network user, and the online log of the new network user through a Doris aggregation model, to obtain aggregated data, and take the aggregated data as the behavior data.

[0140] Optionally, the processing module 302 is further configured to perform data supplement processing on the service data through a Paimon label table, and write, based on the supplemented service data and the behavior data, into a Doris database according to a preset storage strategy, to obtain a service data table and a behavior data table, wherein the preset storage strategy is cold and hot data hierarchical processing; write the behavior data into the Doris database according to the preset storage strategy, to obtain the behavior data table, wherein the data stored in the service data table and the behavior data table is hot data, the cold data is used to represent data with low access frequency, and the hot data is used to represent data with high access frequency.

[0141] Optionally, the judgment module 304 is further configured to judge, according to a security level analysis request of a target user, whether a target mobile phone number corresponding to the target user is the same as the first mobile phone number and the second mobile phone number.

[0142] The processing module 302 is further configured to, in a case where the first mobile phone number and the second mobile phone number are the same as the target mobile phone number, take the service data and the behavior data corresponding to the first mobile phone number and the second mobile phone number as the analysis data.

[0143] Optionally, the determining module 303 is further configured to determine a preset reference value based on the analysis data, and determine a security level analysis strategy of the target user according to the analysis data and the preset reference value, the preset reference value including a preset score, a preset traffic value, a preset activity value, a preset time length, a preset distance, a preset number of times, a preset number of calls, and a preset call time length, the analysis data including a credit of the target user, a wifi and traffic data usage amount of the target user in a week, an activity of an app of the target user in the week, a distance and a number of times of position drift of the target user in a preset time length, a number of times of calling a same number and a call time length of the target user, and a type of certificate and a corresponding certificate number of the target user; and determine a security level analysis result of the target user according to the security level analysis strategy.

[0144] Optionally, the determining module 304 is further configured to determine whether the credit of the target user is lower than the preset score; determine whether the wifi and traffic data usage amount of the target user in the week is lower than the preset traffic value; determine whether the activity of the app of the target user in the week is lower than the preset activity value; determine whether the distance of the position drift of the target user in the preset time length is greater than a preset distance and the number of times of the position drift is more than a preset number of times; determine whether the number of times of calling the same number by the target user is higher than a preset number of times and a call time length after the call is lower than a preset time length; and determine whether the type of certificate and the corresponding certificate number of the target user are incorrect.

[0145] Figure 4 A structural schematic diagram of a user security level analysis device is provided in the present application. As shown in the figure, the present application provides a user security level analysis device, which comprises a receiver 401, a transmitter 402, a processor 403, and a memory 404. Figure 4 The receiver 401 is configured to receive instructions and data.

[0146] The transmitter 402 is configured to transmit instructions and data.

[0147] The memory 404 is configured to store computer execution instructions.

[0148]

[0149] ​The processor 403 is configured to execute the computer-executable instructions stored in the memory 404 to implement each step of the user security level analysis method described above. For details, refer to the related description in the user security level analysis method embodiments described above.

[0150] Optionally, the memory 404 can be independent or integrated with the processor 403.

[0151] When the memory 404 is independent, the electronic device further includes a bus for connecting the memory 404 and the processor 403.

[0152] The present application further provides a computer storage medium, which stores computer-executable instructions. When the processor executes the computer-executable instructions, the user security level analysis method performed by the user security level analysis device described above is implemented.

[0153] Those skilled in the art can understand that all or some of the steps in the method disclosed above, the functions of the modules / units in the system and the device can be implemented as software, firmware, hardware or a suitable combination thereof. In the hardware implementation, the division between the functional modules / units mentioned in the above description does not necessarily correspond to the division of physical nodes; for example, one physical node can have multiple functions, or one function or step can be performed by several physical nodes in cooperation. Some or all of the physical nodes can be implemented as software executed by a processor such as a central processing unit, a digital signal processor or a microprocessor, or as hardware, or as an integrated circuit such as an application-specific integrated circuit. Such software can be distributed on a computer-readable medium, which can include computer storage media (or non-transitory media) and communication media (or transitory media). As known to those skilled in the art, the term computer storage media includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and can be accessed by a computer. In addition, as known to those skilled in the art, communication media generally includes computer readable instructions, data structures, program modules or other data in modulated data signals such as carrier waves or other transmission mechanisms, and can include any information delivery medium.

[0154] Other embodiments of the application will be apparent to those skilled in the art from consideration of the specification and practice of the application disclosed herein. It is intended that the specification and examples be considered as exemplary only, with the true scope and spirit of the application being indicated by the following claims.

[0155] It is to be understood that the application is not limited to the precise construction herein disclosed and shown in the drawings, and that various changes in shape, size and arrangements of parts can be made without departing from the scope of the application. The scope of the application is limited only by the claims that follow.

Claims

1. A method for analyzing user security levels, characterized in that, include: The system acquires user data from multiple new users in real time. This user data includes business data and behavioral data. The business data consists of the new user's order data, including order number, mobile number, processing region, order status, completion time, credit score, customer points, document type, and document number. The behavioral data includes the new user's data traffic signaling, location signaling, call signaling, and internet access logs. The business data and the behavior data are written into the Doris database respectively to obtain a business data table and a behavior data table; In response to a security level analysis request from a target user, analyze data corresponding to the target user is determined from the business data table and the behavior data table. Based on the analyzed data, the security level analysis results for the target user are determined; The real-time acquisition of user data from multiple registered users includes: The Flink CDC Stream API is used to read business data from MySQL tables for multiple new users; and Flink SQL is used to read behavioral data from Kafka tables for multiple new users. The step of writing the business data and the behavioral data into the Doris database to obtain a business data table and a behavioral data table includes: The business data is supplemented using the Paimon tag table, and based on the supplemented business data and the behavior data, it is written into the Doris database according to a preset storage strategy to obtain the business data table and the behavior data table. The preset storage strategy is to process cold and hot data in a hierarchical manner. Cold data is used to represent data with low access frequency, and hot data is used to represent data with high access frequency. The data stored in the business data table and the behavior data table is hot data. The hot data is stored in a high-performance storage object and has a retention period. Hot data that exceeds the retention period will be automatically migrated to a low-cost storage object.

2. The method according to claim 1, characterized in that, The real-time acquisition of user data from multiple registered users includes: The business data is cleaned and preprocessed, and the processed data is used as the business data. The network traffic signaling, location signaling, call signaling, and internet access logs of the network users are aggregated and processed, and the aggregated data is used as behavioral data.

3. The method according to claim 2, characterized in that, The network traffic signaling, location signaling, call signaling, and internet access logs of the new user are aggregated, and the aggregated data is used as behavioral data, including: Determine whether the data information of the traffic signaling, location signaling, call signaling, and internet access log of the same user is empty; If the data information of the traffic signaling, the location signaling, the call signaling, and the internet access log is not empty, the non-empty data information is replaced to obtain the traffic signaling, location signaling, call signaling, and internet access log of the new user. The traffic signaling, location signaling, call signaling, and internet access logs of the newly registered user are aggregated using the Doris aggregation model to obtain aggregated data, which is then used as behavioral data.

4. The method according to claim 1, characterized in that, The business data table includes a first mobile phone number, and the behavior data table includes a second mobile phone number. The step of determining the analysis data corresponding to the target user from the business data table and the behavior data table in response to the target user's security level analysis request includes: Based on the security level analysis request of the target user, determine whether the target mobile phone number corresponding to the target user is the same as the first mobile phone number and the second mobile phone number; If the first mobile number and the second mobile number are the same as the target mobile number, the business data and behavioral data corresponding to the first mobile number and the second mobile number are used as the analysis data.

5. The method according to claim 4, characterized in that, The analysis data includes: the target user's credit score, the target user's Wi-Fi and mobile data usage within a week, the target user's app activity within a week, the distance and number of times the target user's location drifted within a preset time period, the number of times the target user dialed the same number and the call duration, and the target user's identification type and corresponding identification number. The step of determining the target user's security level analysis result based on the analysis data includes: Based on the analysis data, a preset benchmark value is determined, and a security level analysis strategy for the target user is determined according to the analysis data and the preset benchmark value. The preset benchmark value includes: preset score, preset traffic value, preset activity value, preset duration, preset distance, preset number of times, preset number of calls, and preset call duration. Based on the security level analysis strategy, the security level analysis results for the target user are determined.

6. The method according to claim 5, characterized in that, The security level analysis strategy includes: Determine whether the target user's credit score is lower than the preset score; Determine whether the target user's Wi-Fi and mobile data usage within one week is lower than the preset data usage value; Determine whether the target user's app activity level within one week is lower than the preset activity value; Determine whether the distance the target user's location drifts within the preset time period is greater than a preset distance and whether the number of drifts exceeds a preset number; Determine whether the number of times the target user dials the same number is higher than a preset number and whether the call duration after connection is lower than a preset duration; Determine whether the target user's document type and corresponding document number are incorrect.

7. A user security level analysis device, characterized in that, The device includes: The acquisition module is used to acquire user data from multiple registered users in real time. The user data includes business data and behavioral data. The business data is the order business data of the registered users, including: order number, mobile phone number, processing region, order status, completion time, credit score, customer points, document type, and document number. The behavioral data includes: the registered users' data traffic signaling, location signaling, call signaling, and internet access logs. The processing module is used to write the business data and the behavior data into the Doris database respectively to obtain a business data table and a behavior data table; The determination module is used to respond to a security level analysis request from a target user, determine the analysis data corresponding to the target user from the business data table and the behavior data table, and determine the security level analysis result of the target user based on the analysis data. The acquisition module is specifically used for: The Flink CDC Stream API is used to read business data from MySQL tables for multiple new users; and Flink SQL is used to read behavioral data from Kafka tables for multiple new users. The processing module is specifically used for: The business data is supplemented using the Paimon tag table, and based on the supplemented business data and the behavior data, it is written into the Doris database according to a preset storage strategy to obtain the business data table and the behavior data table. The preset storage strategy is to process cold and hot data in a hierarchical manner. Cold data is used to represent data with low access frequency, and hot data is used to represent data with high access frequency. The data stored in the business data table and the behavior data table is hot data. The hot data is stored in a high-performance storage object and has a retention period. Hot data that exceeds the retention period will be automatically migrated to a low-cost storage object.

8. A user security level analysis device, characterized in that, include: Memory; processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory to implement the user security level analysis method as described in any one of claims 1-6.

9. A computer storage medium, characterized in that, The computer storage medium stores computer execution instructions, which, when executed by a processor, are used to implement the user security level analysis method as described in any one of claims 1-6.

Images