Risk control rule processing method and device, storage medium and electronic equipment

Abstract

The invention discloses a risk control rule processing method and device, a storage medium and electronic equipment. The method relates to the field of information processing, and comprises the following steps: obtaining a service flow, and carrying out mirroring processing on the service flow to obtain a simulation flow; performing risk control detection on the simulation traffic based on the risk control rule of which the validity is to be verified to obtain a detection result corresponding to the risk control rule, the detection result at least comprising a rule hit rate of the risk control rule; and determining whether the risk control rule passes validity verification based on the rule hit rate in the detection result, the risk control rule passing the validity verification being used for performing risk control detection on the service flow. The technical problem that the verification efficiency is low when the validity of the risk control rule is verified in the prior art is solved.

Description

Technical Field

[0001] The present invention relates to the field of information processing, and in particular to a risk control rule processing method, device, storage medium and electronic device. Background Art

[0002] In business scenarios (such as payment business scenarios), the risk control system needs to use risk control rules to perform risk control detection on user operations and transactions. The effectiveness of risk control rules needs to be verified before actual use. At present, the relevant technology is to divert a small part of the data from the real traffic for verification or build a set of laboratories. If the form of traffic diversion is adopted, the data used for verification will be small and a long time of verification will be required. If the form of building a laboratory is adopted, the verification of risk control rules will be affected by the time of laboratory construction and the labor cost will increase, resulting in low efficiency of risk control rule verification.

[0003] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0004] The embodiments of the present invention provide a method, device, storage medium and electronic device for processing risk control rules, so as to at least solve the technical problem of low verification efficiency when the relevant technology verifies the effectiveness of risk control rules.

[0005] According to one aspect of an embodiment of the present invention, a method for processing risk control rules is provided, including: obtaining business traffic, and mirroring the business traffic to obtain simulated traffic; performing risk control detection on the simulated traffic based on the risk control rules whose validity is to be verified, and obtaining detection results corresponding to the risk control rules, wherein the detection results at least include the rule hit rate of the risk control rules; determining whether the risk control rules have passed the validity verification based on the rule hit rate in the detection results, wherein the risk control rules that have passed the validity verification are used to perform risk control detection on the business traffic.

[0006] Furthermore, the method for processing risk control rules also includes: determining a policy set that matches the business traffic from multiple policy sets to obtain a target policy set, wherein the target policy set includes multiple first rule sets with a usage order, and the first rule set includes risk control rules whose validity is to be verified; according to the usage order between the multiple first rule sets in the target policy set, risk control detection is performed on the simulated traffic based on the risk control rules in the first rule set to obtain detection results corresponding to the risk control rules in the first rule set.

[0007] Furthermore, the multiple policy sets include policy sets corresponding to different business scenarios, wherein the risk control rule processing method also includes: determining the business scenario corresponding to the business traffic; and determining the policy set corresponding to the business scenario of the business traffic in the multiple policy sets as the target policy set.

[0008] Furthermore, the method for processing risk control rules also includes: obtaining multiple initial policy sets corresponding to different business scenarios, wherein the initial policy set includes multiple rule sets; for each rule set in each initial policy set, determining whether the rule set includes a target identifier, wherein the target identifier represents the risk control rules in the rule set whose validity is to be verified; determining the first rule set based on the rule set including the target identifier in the initial policy set, and determining the usage order between the first rule sets to obtain a policy set.

[0009] Furthermore, the risk control rule processing method also includes: determining a rule set including a target identifier in the initial policy set as a candidate first rule set; receiving a rule orchestration request from a target user for the candidate first rule set in the initial policy set, and determining a candidate first rule set selected for use by the target user from the candidate first rule set based on the rule orchestration request to obtain multiple first rule sets; determining a usage order among the multiple first rule sets based on the rule orchestration request, and orchestrating the multiple first rule sets in the initial policy set based on the usage order to obtain a policy set.

[0010] Furthermore, the target policy set also includes multiple second rule sets with a usage order, and the second rule sets include risk control rules whose validity has been verified, wherein the method for processing risk control rules also includes: after determining a policy set that matches the business traffic from multiple policy sets and obtaining the target policy set, performing risk control detection on the business traffic based on the risk control rules in the second rule set according to the usage order between the multiple second rule sets in the target policy set, and obtaining the detection results corresponding to the risk control rules in the second rule set.

[0011] Furthermore, the method for processing risk control rules also includes: determining whether the rule hit rate in the detection results is greater than a preset threshold; when the rule hit rate is greater than the preset threshold, determining that the risk control rule has passed the validity verification; when the rule hit rate is less than or equal to the preset threshold, determining that the risk control rule has not passed the validity verification.

[0012] According to another aspect of an embodiment of the present invention, a risk control rule processing device is also provided, including: a first acquisition module, used to acquire business traffic, and mirror the business traffic to obtain simulated traffic; a first detection module, used to perform risk control detection on the simulated traffic based on the risk control rule whose validity is to be verified, and obtain the detection result corresponding to the risk control rule, wherein the detection result at least includes the rule hit rate of the risk control rule; a first determination module, used to determine whether the risk control rule has passed the validity verification based on the rule hit rate in the detection result, wherein the risk control rule that has passed the validity verification is used to perform risk control detection on the business traffic.

[0013] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is provided, in which a computer program is stored, wherein the computer program is configured to execute the above-mentioned risk control rule processing method when running.

[0014] According to another aspect of an embodiment of the present invention, an electronic device is also provided, which includes one or more processors; a memory for storing one or more programs, which, when the one or more programs are executed by the one or more processors, enables the one or more processors to run the programs, wherein the programs are configured to execute the above-mentioned risk control rule processing method during operation.

[0015] In an embodiment of the present invention, the effectiveness of the risk control rules is verified based on the simulated traffic corresponding to the business traffic. The business traffic is obtained and mirrored to obtain the simulated traffic. Then, the simulated traffic is tested for risk control based on the risk control rules whose effectiveness is to be verified. The test results corresponding to the risk control rules are obtained, and then the risk control rules are determined to have passed the effectiveness verification based on the rule hit rate in the test results. The test results at least include the rule hit rate of the risk control rules, and the risk control rules that have passed the effectiveness verification are used to perform risk control tests on the business traffic.

[0016] In the above process, by mirroring the business traffic to obtain simulated traffic, it is possible to simply and quickly obtain a large amount of traffic for testing risk control rules. By performing risk control detection on the simulated traffic based on the risk control rules whose effectiveness is to be verified, the detection results corresponding to the risk control rules are obtained, and based on the rule hit rate in the detection results, it is determined whether the risk control rules pass the effectiveness verification. On the one hand, it realizes the effectiveness verification of the risk control rules using a large amount of traffic, thereby improving the verification efficiency. On the other hand, it realizes the effectiveness verification of the risk control rules using traffic with the same content as the real traffic, thereby improving the verification accuracy.

[0017] It can be seen that the solution provided in the present application achieves the purpose of verifying the effectiveness of risk control rules based on the simulated traffic corresponding to the business traffic, thereby achieving the technical effect of improving verification efficiency, and further solving the technical problem of low verification efficiency when the relevant technology verifies the effectiveness of risk control rules. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of this application. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0019] Figure 1 An optional method for processing risk control rules according to an embodiment of the present invention is shown in FIG. Figure 1 ;

[0020] Figure 2 An optional method for processing risk control rules according to an embodiment of the present invention is shown in FIG. Figure 2 ;

[0021] Figure 3 is a schematic diagram of an optional determination strategy set according to an embodiment of the present invention;

[0022] Figure 4 is a schematic diagram of an optional risk control rule processing device according to an embodiment of the present invention;

[0023] Figure 5 is a schematic diagram of an optional electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0024] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0025] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0026] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards in the relevant regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0027] Example 1

[0028] According to an embodiment of the present invention, an embodiment of a method for processing risk control rules is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0029] Figure 1 An optional method for processing risk control rules according to an embodiment of the present invention is shown in FIG. Figure 1 ,like Figure 1 As shown, the method comprises the following steps:

[0030] Step S101, obtain business traffic, and mirror the business traffic to obtain simulated traffic.

[0031] Optionally, electronic devices, application systems, servers and other devices can be used as the execution subject of this application. In this embodiment, the target processing system is used as the execution subject to execute the processing method of the risk control rule.

[0032] Optionally, the content of the business traffic may be different depending on the actual business scenario. For example, if the business scenario is a payment business scenario, the business traffic may be a user's transaction request, transaction data, etc. If the business scenario is a login scenario, the business traffic may be a user's login request, etc. Therefore, in this embodiment, the content of the business traffic is not specifically limited.

[0033] After obtaining the business traffic, the target processing system can mirror the business traffic to obtain simulated traffic. Optionally, the business traffic and simulated traffic have the same content but different purposes. Business traffic can be understood as real traffic, which is traffic actually sent by users and requires actual business processing. Simulated traffic is simulated traffic, which is traffic obtained by mirroring real traffic and does not require actual business processing. This traffic is only used to verify the effectiveness of risk control rules.

[0034] In some embodiments, the target processing system may acquire the service traffic in real time, and mirror the service traffic in real time to obtain simulated traffic.

[0035] Step S102: Perform risk control detection on the simulated traffic based on the risk control rules whose validity is to be verified, and obtain detection results corresponding to the risk control rules, wherein the detection results at least include the rule hit rate of the risk control rules.

[0036] Optionally, the risk control rules include conditions that must be met for traffic to be considered risk traffic. Therefore, the target processing system can perform risk control detection on the simulated traffic based on the risk control rules whose validity is to be verified, and obtain detection results corresponding to the risk control rules.

[0037] Optionally, the detection result includes at least the rule hit rate of the risk control rule, and may also include information on the traffic that hits the risk control rule.

[0038] In some embodiments, after obtaining the simulated traffic, the target processing system may add a target field to the simulated traffic, the target field being used to characterize the traffic as simulated traffic. The target processing system may identify the simulated traffic based on the target field, and then perform risk control detection on the simulated traffic based on the risk control rules whose validity is to be verified.

[0039] Step S103, determining whether the risk control rule has passed the validity verification based on the rule hit rate in the detection result, wherein the risk control rule that has passed the validity verification is used to perform risk control detection on the business traffic.

[0040] Optionally, the target processing system may compare the rule hit rate with a preset threshold value, thereby determining whether the risk control rule passes the validity verification based on the comparison result.

[0041] Optionally, when it is determined that the risk control rule has passed the validity verification, it is determined that the risk control rule can be applied to actual business scenarios. In this case, the target processing system can use the risk control rule to perform risk control detection on subsequent business traffic.

[0042] Optionally, if it is determined that the risk control rule has not passed the validity verification, it is determined that the risk control rule cannot be applied to the actual business scenario. In this case, the target processing system does not use the risk control rule to perform risk control detection on subsequent business traffic. The target processing system can feedback the risk control rule that has not passed the validity verification to the administrator, and then the administrator can modify the risk control rule.

[0043] Optionally, by using traffic with the same content as real traffic to verify the effectiveness of risk control rules, it is possible to fully verify the risk control rules, thereby avoiding incorrect penalties on users and merchants in the actual production environment due to insufficient rule verification, affecting the user and merchant experience, or causing financial losses due to untimely penalties.

[0044] Based on the scheme defined in the above steps S101 to S103, it can be known that in the embodiment of the present invention, the effectiveness of the risk control rules is verified based on the simulated traffic corresponding to the business traffic, by obtaining the business traffic and mirroring the business traffic to obtain the simulated traffic, and then the simulated traffic is subjected to risk control detection based on the risk control rules whose effectiveness is to be verified, and the detection results corresponding to the risk control rules are obtained, thereby determining whether the risk control rules pass the effectiveness verification based on the rule hit rate in the detection results. Among them, the detection results at least include the rule hit rate of the risk control rules, and the risk control rules that pass the effectiveness verification are used to perform risk control detection on the business traffic.

[0045] It is easy to notice that in the above process, by mirroring the business traffic to obtain simulated traffic, it is possible to simply and quickly obtain a large amount of traffic for testing risk control rules. By performing risk control detection on the simulated traffic based on the risk control rules whose effectiveness is to be verified, the detection results corresponding to the risk control rules are obtained, and based on the rule hit rate in the detection results, it is determined whether the risk control rules pass the effectiveness verification. On the one hand, it realizes the effectiveness verification of the risk control rules using a large amount of traffic, thereby improving the verification efficiency. On the other hand, it realizes the effectiveness verification of the risk control rules using traffic with the same content as the real traffic, thereby improving the verification accuracy.

[0046] It can be seen that the solution provided in the present application achieves the purpose of verifying the effectiveness of risk control rules based on the simulated traffic corresponding to the business traffic, thereby achieving the technical effect of improving verification efficiency, and further solving the technical problem of low verification efficiency when the relevant technology verifies the effectiveness of risk control rules.

[0047] In an optional embodiment, in the process of performing risk control detection on simulated traffic based on risk control rules whose validity is to be verified and obtaining detection results corresponding to the risk control rules, the target processing system can determine a policy set that matches the business traffic from multiple policy sets to obtain a target policy set, thereby performing risk control detection on simulated traffic based on the risk control rules in the first rule set according to the usage order between multiple first rule sets in the target policy set, and obtaining detection results corresponding to the risk control rules in the first rule set. The target policy set includes multiple first rule sets with a usage order, and the first rule set includes risk control rules whose validity is to be verified.

[0048] Optionally, the multiple policy sets include policy sets corresponding to different business scenarios, and the target processing system may determine the business scenario of the business traffic, thereby determining the target policy set according to the business scenario of the business traffic.

[0049] In some embodiments, the target policy set includes multiple first rule sets in a usage order, the first rule set includes risk control rules whose validity is to be verified, and the first rule set may include multiple risk control rules.

[0050] In some embodiments, the risk control rules may reference multiple indicators to judge whether the conditions are met. When making the judgment, the operator function may be used, such as character function, number function, date function, code table function, etc. Among them, the aforementioned indicators may be determined by the risk control rules based on the business traffic. For example, in the login scenario, the business traffic may include data such as mobile phone number, login account, login password, etc. The indicator may refer to the first four digits of the mobile phone number, and the risk control rule may be "the first four digits of the mobile phone number are 1234".

[0051] In some embodiments, there is a usage order between multiple first rule sets. When performing risk control detection on simulated traffic, the target processing system can perform risk control detection according to the usage order between multiple first rule sets in the target policy set. For example, assuming that there are three first rule sets A, B, and C, and their usage order is B, A, and C, the target processing system first uses the risk control rules in the B rule set to perform risk control detection, and obtains the detection results of the B rule set, and then uses the risk control rules in the A rule set to perform risk control detection, and obtains the detection results of the A rule set, and finally uses the risk control rules in the C rule set to perform risk control detection, and obtains the detection results of the C rule set.

[0052] In some embodiments, the risk control rules in the first rule set may or may not have a usage order. If the risk control rules in the first rule set have a usage order, the usage order may be preset by an administrator, and when performing risk control detection, the target processing system may perform risk control detection in combination with the usage order between the risk control rules in the first rule set.

[0053] It should be noted that since the use of different rule sets may cause different memory usage for the system, and there may be dependencies between different rule sets, the flexibility and accuracy of risk control detection are improved by performing risk control detection on simulated traffic in the order of use of the first rule set, thereby improving the accuracy of risk control rule verification.

[0054] In an optional embodiment, multiple policy sets include policy sets corresponding to different business scenarios. In the process of determining a policy set that matches the business traffic from multiple policy sets to obtain a target policy set, the target processing system can determine the business scenario corresponding to the business traffic, thereby determining the policy set corresponding to the business scenario of the business traffic in the multiple policy sets as the target policy set.

[0055] Optionally, in this embodiment, different business scenarios correspond to different policy sets, so the target processing system can first determine the business scenario corresponding to the business traffic. For example, the target processing system receives business traffic of different business scenarios through different interfaces, and the target processing system has preset correspondences between multiple interfaces and business scenarios. The target processing system can determine the business scenario corresponding to the business traffic based on the identifier of the interface receiving the business traffic and the aforementioned correspondence.

[0056] Further, after determining the business scenario corresponding to the business traffic, the target processing system may determine the policy set corresponding to the business scenario of the business traffic among the multiple policy sets as the target policy set. Optionally, the target processing system has preset correspondences between multiple policy sets and business scenarios, and the target processing system may determine the target policy set based on the correspondences and the business scenario of the business traffic.

[0057] It should be noted that, through the above process, the target strategy set is accurately determined.

[0058] In an optional embodiment, the target processing system may generate multiple policy sets in the following manner: obtain multiple initial policy sets corresponding to different business scenarios, wherein the initial policy set includes multiple rule sets; for each rule set in each initial policy set, determine whether the rule set includes a target identifier, wherein the target identifier represents the risk control rules in the rule set whose validity is to be verified; determine the first rule set based on the rule set including the target identifier in the initial policy set, and determine the usage order between the first rule sets to obtain a policy set.

[0059] Optionally, multiple initial policy sets corresponding to different business scenarios may be pre-configured by an administrator.

[0060] Optionally, when configuring the initial policy set, the administrator can mark a target identifier in the rule set consisting of the risk control rules whose validity is to be verified. The target identifier represents the risk control rules in the rule set whose validity is to be verified.

[0061] Therefore, after acquiring multiple initial policy sets, for each rule set in each initial policy set, the target processing system can determine whether the rule set includes the target identifier, thereby distinguishing the rule sets in the initial policy set according to the determination result.

[0062] For example, if the rule set includes a target identifier, it is determined that the rule set can be used for a simulated link, that is, it can be used to perform risk control detection on simulated traffic. In this case, a first rule set can be determined based on this type of rule set. If the rule set does not include a target identifier, it is determined that the rule set can be used for a formal link, that is, it can be used to perform risk control detection on business traffic. In this case, a second rule set can be determined based on this type of rule set.

[0063] Optionally, the target processing system may determine the first rule set according to the rule set including the target identifier in the initial policy set, and determine the order of use between the first rule sets to obtain the policy set. For example, the rule set including the target identifier in the initial policy set is directly determined as the first rule set, or for another example, the first rule set is determined from the rule set including the target identifier according to the rule arrangement request of the administrator.

[0064] Optionally, the order of use of the first rule sets may be determined randomly or according to a rule arrangement request of an administrator.

[0065] It should be noted that, through the above process, the first rule set in the policy set is accurately determined, thereby improving the accuracy of validity verification.

[0066] In an optional embodiment, in the process of determining the first rule set according to the rule set including the target identifier in the initial policy set, and determining the usage order between the first rule sets to obtain the policy set, the target processing system may determine the rule set including the target identifier in the initial policy set as a candidate first rule set, and then receive a rule orchestration request from the target user for the candidate first rule set in the initial policy set, and determine the candidate first rule set selected for use by the target user from the candidate first rule sets based on the rule orchestration request to obtain multiple first rule sets, thereby determining the usage order between the multiple first rule sets based on the rule orchestration request, and orchestrating the multiple first rule sets in the initial policy set based on the usage order to obtain the policy set.

[0067] Optionally, the target user is the above-mentioned administrator. The target processing system may determine the rule set including the target identifier in the initial policy set as the candidate first rule set, and then present the candidate first rule set to the target user.

[0068] Optionally, the target user may generate a rule arrangement request based on the candidate first rule set. For example, the rule arrangement request may include information (such as a rule set identifier, etc.) of the candidate first rule set that the target user expects to use (i.e., for performing risk control detection on simulated traffic) in the candidate first rule set, that is, information of the first rule set specified by the user, and the rule arrangement request may also include the order of use between the first rule sets that the user expects to use, for example, the order of arrangement of the rule set identifier is used to indicate the order of use between the first rule sets.

[0069] Optionally, the rule arrangement request may be generated by the target user dragging and dropping on the front-end interface of the target processing system, or may be generated by the target user through information input.

[0070] After receiving a rule orchestration request from a target user for a candidate first rule set in an initial policy set, the target processing system may determine, from the candidate first rule sets, a candidate first rule set selected for use by the target user according to a rule set identifier in the rule orchestration request, to obtain multiple first rule sets. For example, the candidate first rule set corresponding to the rule set identifier in the rule orchestration request may be determined as the first rule set, and a usage order among the multiple first rule sets may be determined according to an arrangement order of the rule set identifiers in the rule orchestration request.

[0071] Afterwards, the target processing system may arrange the multiple first rule sets in the initial policy set based on the usage order among the multiple first rule sets, for example, marking the usage order of the multiple first rule sets in the initial policy set to arrange the multiple first rule sets, thereby obtaining a policy set.

[0072] In some embodiments, the presence of multiple first rule sets in a policy set in a usage order can be understood as a simulation link for performing risk control detection on the simulation traffic.

[0073] In some embodiments, the policy set may include a candidate first rule set that is not selected by the target user. The target processing system may distinguish between the first rule set and the candidate first rule set based on the sequence mark of the first rule set.

[0074] In some embodiments, after obtaining the policy set, the target processing system can publish the policy set, and then assemble the rule logic in the policy set into the drools script language, and load it into the memory through broadcasting for use in risk control detection.

[0075] It should be noted that, through the above process, it is achieved to determine the first rule set and the order of using the first rule set according to the user request, thereby improving the flexibility of determining the policy set.

[0076] In an optional embodiment, the target policy set also includes multiple second rule sets with a usage order, and the second rule sets include risk control rules whose validity has been verified. After determining a policy set that matches the business traffic from the multiple policy sets and obtaining the target policy set, the target processing system can perform risk control detection on the business traffic based on the risk control rules in the second rule set according to the usage order between the multiple second rule sets in the target policy set, and obtain detection results corresponding to the risk control rules in the second rule set.

[0077] Optionally, since the business traffic is real traffic, it is necessary to perform risk control detection on the business traffic to identify risky traffic.

[0078] In some embodiments, the risk control rules in the rule set that does not include the target identifier in the initial policy set are risk control rules whose validity has been verified. Therefore, after obtaining the initial policy set, the target processing system can determine the rule set that does not include the target identifier in the initial policy set as a candidate second rule set, and then receive a target rule orchestration request from the target user for the candidate second rule set in the initial policy set, and determine the candidate second rule set selected by the target user from the candidate second rule set based on the target rule orchestration request to obtain multiple second rule sets, and then determine the order of use between the multiple second rule sets based on the target rule orchestration request, and orchestrate the multiple second rule sets in the initial policy set based on the order of use, so as to obtain a policy set after completing the orchestration of the multiple first rule sets and the orchestration of the multiple second rule sets in the initial policy set.

[0079] Optionally, the target processing system may determine the second rule set and the order of using the second rule set according to the manner of determining the first rule set and the order of using the first rule set, so it is not described in detail here.

[0080] In some embodiments, the presence of multiple second rule sets in a policy set in a usage order can be understood as a formal link for performing risk control detection on business traffic.

[0081] Optionally, when performing risk control detection on business traffic, the target processing system may perform risk control detection according to the order of use between multiple second rule sets in the target policy set. For example, assuming that there are three second rule sets A, B, and C, and their order of use is B, A, and C, the target processing system first uses the risk control rules in the B rule set to perform risk control detection, obtains the detection result of the B rule set, then uses the risk control rules in the A rule set to perform risk control detection, obtains the detection result of the A rule set, and finally uses the risk control rules in the C rule set to perform risk control detection, obtains the detection result of the C rule set.

[0082] In some embodiments, the risk control rules in the second rule set may or may not have a usage order. If the risk control rules in the second rule set have a usage order, the usage order may be preset by an administrator, and when performing risk control detection, the target processing system may perform risk control detection in combination with the usage order between the risk control rules in the second rule set.

[0083] Optionally, the detection results corresponding to the risk control rules in the second rule set include at least information about the business traffic that hits the risk control rules. After obtaining the detection results corresponding to the risk control rules in the second rule set, the target processing system can record the information about the business traffic in the detection results into the policy result table, and generate warning information based on the policy result table, for example, recording the identifier or content of the policy result table in the warning information, and then the warning information can be sent to the target user (i.e., administrator) so that the target user can determine the business traffic that hits the risk control rules based on the warning information, and blacklist, punish, restrict permissions, or otherwise process the user to whom the business traffic belongs.

[0084] It should be noted that since the use of different rule sets may cause different memory usage for the system, and there may be dependencies between different rule sets, the flexibility and accuracy of risk control detection are improved by performing risk control detection on business traffic according to the order of use of the second rule set.

[0085] In an optional embodiment, in the process of determining whether the risk control rule has passed the validity verification based on the rule hit rate in the detection results, the target processing system can determine whether the rule hit rate in the detection results is greater than a preset threshold, and then determine that the risk control rule has passed the validity verification when the rule hit rate is greater than the preset threshold; and determine that the risk control rule has not passed the validity verification when the rule hit rate is less than or equal to the preset threshold.

[0086] In some embodiments, the target processing system may record the detection results of the risk control rules in the first rule set into the simulation strategy result table.

[0087] Optionally, the target processing system may compare the rule hit rate with a preset threshold, thereby determining whether the risk control rule passes the validity verification based on the comparison result.

[0088] It should be noted that through the above process, the accuracy of risk control rule verification is improved.

[0089] Optional, Figure 2 An optional method for processing risk control rules according to an embodiment of the present invention is shown in FIG. Figure 2 ,according to Figure 2 An optional application process of this embodiment is described. Figure 2 As shown, the target processing system obtains business traffic, mirrors the business traffic, and obtains simulated traffic. Afterwards, the target processing system determines the target policy set from multiple policy sets according to the business scenario, and then uses the target policy set to process the business traffic and simulated traffic. During processing, the target processing system will determine whether the traffic is simulated traffic. If so, the simulated traffic is subjected to risk control detection through the first rule set in the simulated link, and then the simulation policy result table is obtained, thereby determining the validity of the risk control rules based on the simulation policy result table. If the traffic is not simulated traffic, the traffic is determined to be business traffic, and the business traffic is subjected to risk control detection through the second rule set in the formal link, and then the policy result table is obtained, thereby performing early warning processing based on the policy result table, for example, blacklisting, punishing, restricting permissions, or other processing of users to whom the business traffic that hits the risk control rules in the second rule set belongs.

[0090] Optional, Figure 3 FIG. 1 is a schematic diagram of an optional determination strategy set according to an embodiment of the present invention. Figure 3 As shown, in the process of determining the policy set, the target processing system may first receive the configuration operation of the target user to generate multiple initial policy sets. Then, the target processing system may receive the configuration operation of the user to mark the rule set in the initial policy set with the target identifier, that is, to configure the rule set. Afterwards, the target processing system may divide the rule set in the initial policy set into candidate first rule sets (i.e., Figure 3 The formal rule configuration in ) and the candidate second rule set (i.e. Figure 3 The simulation rule configuration in the process) then receives the user's rule arrangement request to perform rule arrangement, thereby obtaining a policy set after the arrangement is completed.

[0091] It can be seen that the solution provided in the present application achieves the purpose of verifying the effectiveness of risk control rules based on the simulated traffic corresponding to the business traffic, thereby achieving the technical effect of improving verification efficiency, and further solving the technical problem of low verification efficiency when the relevant technology verifies the effectiveness of risk control rules.

[0092] Example 2

[0093] According to an embodiment of the present invention, an embodiment of a device for processing risk control rules is provided, wherein: Figure 4 is a schematic diagram of an optional risk control rule processing device according to an embodiment of the present invention, such as Figure 4 As shown, the device comprises:

[0094] The first acquisition module 401 is used to acquire service traffic and mirror the service traffic to obtain simulated traffic;

[0095] The first detection module 402 is used to perform risk control detection on the simulated traffic based on the risk control rule whose validity is to be verified, and obtain a detection result corresponding to the risk control rule, wherein the detection result at least includes a rule hit rate of the risk control rule;

[0096] The first determination module 403 is used to determine whether the risk control rule has passed the validity verification based on the rule hit rate in the detection result, wherein the risk control rule that has passed the validity verification is used to perform risk control detection on the business traffic.

[0097] It should be noted that the above-mentioned first acquisition module 401, first detection module 402 and first determination module 403 correspond to steps S101 to S103 in the above-mentioned embodiment, and the examples and application scenarios implemented by the three modules and the corresponding steps are the same, but are not limited to the contents disclosed in the above-mentioned embodiment 1.

[0098] Optionally, the first detection module 402 also includes: a first determination submodule, used to determine a policy set that matches the business traffic from multiple policy sets to obtain a target policy set, wherein the target policy set includes multiple first rule sets in an order of use, and the first rule set includes risk control rules whose validity is to be verified; a detection submodule, used to perform risk control detection on the simulated traffic based on the risk control rules in the first rule set according to the order of use between the multiple first rule sets in the target policy set, and obtain detection results corresponding to the risk control rules in the first rule set.

[0099] Optionally, the first determination submodule also includes: a first determination unit, used to determine the business scenario corresponding to the business traffic; and a second determination unit, used to determine a policy set corresponding to the business scenario of the business traffic from among multiple policy sets as a target policy set.

[0100] Optionally, the risk control rule processing device also includes: a second acquisition module, used to acquire multiple initial policy sets corresponding to different business scenarios, wherein the initial policy set includes multiple rule sets; a judgment module, used to judge whether each rule set in each initial policy set includes a target identifier, wherein the target identifier represents the risk control rule in the rule set to be verified for validity; a second determination module, used to determine the first rule set based on the rule set including the target identifier in the initial policy set, and determine the usage order between the first rule sets to obtain the policy set.

[0101] Optionally, the second determination module also includes: a second determination submodule, used to determine the rule set including the target identifier in the initial policy set as a candidate first rule set; a first processing submodule, used to receive a rule orchestration request from the target user for the candidate first rule set in the initial policy set, and determine the candidate first rule set selected for use by the target user from the candidate first rule set based on the rule orchestration request to obtain multiple first rule sets; a second processing submodule, used to determine a usage order among the multiple first rule sets based on the rule orchestration request, and orchestrate the multiple first rule sets in the initial policy set based on the usage order to obtain a policy set.

[0102] Optionally, the risk control rule processing device also includes: a second detection module, which is used to perform risk control detection on business traffic based on the risk control rules in the second rule set according to the usage order between multiple second rule sets in the target policy set, and obtain detection results corresponding to the risk control rules in the second rule set.

[0103] Optionally, the first determination module 403 also includes: a judgment submodule, used to determine whether the rule hit rate in the detection result is greater than a preset threshold; a third determination submodule, used to determine that the risk control rule has passed the validity verification when the rule hit rate is greater than the preset threshold; a fourth determination submodule, used to determine that the risk control rule has not passed the validity verification when the rule hit rate is less than or equal to the preset threshold.

[0104] Example 3

[0105] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is further provided, in which a computer program is stored, wherein the computer program is configured to execute the above-mentioned risk control rule processing method when running.

[0106] Example 4

[0107] According to another aspect of an embodiment of the present invention, there is also provided an electronic device, wherein: Figure 5 is a schematic diagram of an optional electronic device according to an embodiment of the present invention, such as Figure 5As shown, the electronic device includes one or more processors; a memory for storing one or more programs, which, when the one or more programs are executed by the one or more processors, enables the one or more processors to implement the method for running the programs, wherein the programs are configured to execute the above-mentioned risk control rule processing method during operation.

[0108] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0109] In the above embodiments of the present invention, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0110] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0111] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed over multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0112] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0113] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk and other media that can store program codes.

[0114] The above are only preferred embodiments of the present invention. It should be pointed out that, for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A method for processing risk control rules, characterized in that: include: Acquire business traffic, and mirror the business traffic to obtain simulated traffic; Performing risk control detection on the simulated traffic based on the risk control rule whose validity is to be verified, and obtaining a detection result corresponding to the risk control rule, wherein the detection result at least includes a rule hit rate of the risk control rule; Based on the rule hit rate in the detection result, it is determined whether the risk control rule passes the validity verification, wherein the risk control rule that passes the validity verification is used to perform risk control detection on the business traffic.

2. The method according to claim 1, characterized in that Performing risk control detection on the simulated traffic based on the risk control rule whose validity is to be verified, and obtaining a detection result corresponding to the risk control rule, including: Determining a policy set matching the service traffic from multiple policy sets to obtain a target policy set, wherein the target policy set includes multiple first rule sets in a usage order, and the first rule sets include risk control rules whose validity is to be verified; According to the usage order among the multiple first rule sets in the target policy set, risk control detection is performed on the simulated traffic based on the risk control rules in the first rule set to obtain detection results corresponding to the risk control rules in the first rule set.

3. The method according to claim 2, characterized in that The multiple policy sets include policy sets corresponding to different business scenarios, wherein determining a policy set matching the business traffic from the multiple policy sets to obtain a target policy set includes: Determine the business scenario corresponding to the business traffic; A policy set corresponding to the service scenario of the service traffic among the multiple policy sets is determined as the target policy set.

4. The method according to claim 2, characterized in that: The multiple policy sets are generated in the following manner: Acquire multiple initial policy sets corresponding to different business scenarios, wherein the initial policy set includes multiple rule sets; For each rule set in each initial policy set, determine whether the rule set includes a target identifier, wherein the target identifier represents the validity of the risk control rule in the rule set to be verified; The first rule set is determined according to the rule set including the target identifier in the initial policy set, and the use order of the first rule sets is determined to obtain the policy set.

5. The method according to claim 4, characterized in that Determining the first rule set according to the rule set including the target identifier in the initial policy set, and determining the order of use between the first rule sets to obtain the policy set, including: Determine a rule set including a target identifier in the initial policy set as a candidate first rule set; receiving a rule arrangement request from a target user for a candidate first rule set in the initial policy set, and determining a candidate first rule set selected by the target user from the candidate first rule sets according to the rule arrangement request, to obtain a plurality of first rule sets; The use order of the multiple first rule sets is determined according to the rule arrangement request, and the multiple first rule sets are arranged based on the use order to obtain the policy set.

6. The method according to claim 2, characterized in that The target policy set also includes a plurality of second rule sets in a usage order, wherein the second rule sets include risk control rules whose validity has been verified, wherein after determining a policy set matching the service traffic from the plurality of policy sets and obtaining the target policy set, the method further includes: According to the usage order among the multiple second rule sets in the target policy set, risk control detection is performed on the business traffic based on the risk control rules in the second rule set to obtain the detection results corresponding to the risk control rules in the second rule set.

7. The method according to claim 1, characterized in that Determining whether the risk control rule passes the validity verification based on the rule hit rate in the detection result includes: Determine whether the rule hit rate in the detection result is greater than a preset threshold; When the rule hit rate is greater than the preset threshold, determining that the risk control rule passes the validity verification; When the rule hit rate is less than or equal to the preset threshold, it is determined that the risk control rule has failed the validity verification.

8. A risk control rule processing device, characterized in that: include: A first acquisition module is used to acquire service traffic and mirror the service traffic to obtain simulated traffic; A first detection module, configured to perform a risk control detection on the simulated traffic based on the risk control rule whose validity is to be verified, and obtain a detection result corresponding to the risk control rule, wherein the detection result at least includes a rule hit rate of the risk control rule; The first determination module is used to determine whether the risk control rule has passed the validity verification based on the rule hit rate in the detection result, wherein the risk control rule that has passed the validity verification is used to perform risk control detection on the business traffic.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, wherein the computer program is configured to execute the method for processing the risk control rules described in any one of claims 1 to 7 when running.

10. An electronic device, characterized in that: The electronic device includes one or more processors; A memory for storing one or more programs, which, when executed by the one or more processors, enables the one or more processors to run the programs, wherein the program is configured to execute the method for processing the risk control rules described in any one of claims 1 to 7 during runtime.

Images