Risk control sample generation method and system and risk detection method and system

Abstract

The embodiment of the invention provides a risk control sample generation method and system, a risk detection method and system, electronic equipment, a storage medium and a computer program product. The risk control sample generation method comprises the following steps: in response to a risk control scanning request, carrying out sampling marking processing on the risk control scanning request based on a pre-configured sampling strategy; executing risk control scanning on application data corresponding to the risk control scanning request, and obtaining a risk scanning result corresponding to the risk control scanning request; and generating a risk control sample based on the application data and / or the risk scanning result corresponding to the risk control scanning request after the sampling marking processing. According to the method, the scene authenticity of the risk control sample is effectively improved, and the freshness of the generated risk control sample can be improved by sampling the online application data in real time.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a risk control sample generation method, a risk control sample generation system, a risk detection method, a risk detection system, an electronic device, a storage medium and a computer program product. Background Art

[0002] "Wind control" stands for risk control. In the field of cross-border e-commerce, risk control refers to the process of taking measures to manage, identify and reduce potential risks. Risk control includes but is not limited to the risk range of prohibited sales, intellectual property, false and fraud. The traditional risk control method is post-event passive prevention and control, and the risk level is optimized based on the evaluation of fixed risk samples. For example, e-commerce platforms manually maintain risk word packages offline and use risk word package matching to intercept risks. Online risk level assessment also relies on manual assessment of risk control samples maintained offline by operators. Since risk control samples rely on offline maintenance and accumulation by operators in various risk domains, the recognition accuracy and risk level assessment are heavily dependent on the professional ability of personnel, and risk control samples cannot be kept fresh in real time, and it is impossible to achieve global risk level assessment and governance.

[0003] With the development of science and technology, there has emerged a solution that uses artificial intelligence generation technology to train risk control models to identify risks. However, this solution requires a large number of risk control samples that fit the application scenarios for model training, and a steady stream of the latest risk control samples is required to continuously train the model. Artificially generated risk control samples cannot meet the needs of such solutions.

[0004] It can be seen that the risk control sample generation method in the existing technology still needs to be improved. Summary of the invention

[0005] The embodiment of the present application provides a risk control sample generation method, which can improve the timeliness and authenticity of risk control samples.

[0006] Correspondingly, the embodiments of the present application also provide a risk control sample generation system, a risk detection method, a risk detection system, an electronic device, a storage medium and a computer program product to ensure the implementation and application of the above-mentioned risk control sample generation method.

[0007] In order to solve the above problems, the present application discloses a method for generating risk control samples, which includes:

[0008] In response to the risk control scanning request, performing sampling marking processing on the risk control scanning request based on a pre-configured sampling strategy;

[0009] Performing a risk scan on the application data corresponding to the risk control scan request, and obtaining a risk scan result corresponding to the risk control scan request;

[0010] A risk control sample is generated based on the application data and / or the risk scanning result corresponding to the risk control scanning request after the sampling marking process.

[0011] The embodiment of the present application discloses a risk control sample generation system, including: a risk control system and a sample generation module, the risk control system further includes: a risk control gateway, at least one risk scanning engine, and a memory, wherein:

[0012] The risk control gateway is used to respond to the risk control scanning request and perform sampling marking processing on the risk control scanning request based on a pre-configured sampling strategy;

[0013] The risk scanning engine is used to perform a risk scan on the application data corresponding to the risk control scanning request, obtain a risk scanning result corresponding to the risk control scanning request, and store the application data and the risk scanning result in the memory in correspondence;

[0014] The sample generation module is used to obtain analysis data in the memory and generate risk control samples based on the analysis data, wherein the analysis data includes: the application data and / or the risk scanning result corresponding to the risk control scanning request after the sampling marking process.

[0015] The present application embodiment discloses a risk detection method, including:

[0016] In response to a first risk control scanning request sent by the application hitting a preset exercise strategy, modifying the first risk control scanning request based on a pre-generated risk control sample to generate a second risk control scanning request;

[0017] Sending the second risk control scanning request and the first risk control scanning request to a preset risk scanning engine for risk scanning, respectively, to obtain a risk scanning result;

[0018] Based on the obtained risk scanning result, risk information is obtained.

[0019] The embodiment of the present application discloses a risk detection system, including: a risk control system and a risk control exercise center, wherein the risk control system includes: a risk control gateway, at least one risk scanning engine, and a scanning record storage, wherein:

[0020] The risk control gateway is configured to send request data corresponding to the first risk control scanning request sent by the application to the risk control exercise center in response to the first risk control scanning request hitting a preset exercise strategy;

[0021] The risk control exercise center is used to modify the request data based on the preset exercise sample generation configuration and the sample data of the pre-generated risk control sample to generate a second risk control scanning request;

[0022] The risk control exercise center is further used to send the second risk control scanning request to the risk control gateway;

[0023] The risk control gateway is further configured to send the second risk control scanning request and the first risk control scanning request to the risk scanning engine for risk scanning to obtain risk scanning results;

[0024] The scan record storage is used to store the risk scan result;

[0025] The risk control drill center is also used to obtain risk information based on the risk scanning results obtained.

[0026] The embodiment of the present application also discloses an electronic device, comprising: a processor, and a memory communicatively connected to the processor;

[0027] The memory stores computer-executable instructions;

[0028] The processor executes the computer-executable instructions stored in the memory to implement the method described in the embodiment of the present application.

[0029] The embodiment of the present application further discloses a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the method described in the embodiment of the present application.

[0030] The embodiment of the present application also discloses a computer program product, including a computer program / computer executable instructions, characterized in that when the computer program / computer executable instructions are executed by a processor in an electronic device, the method described in the embodiment of the present application is implemented.

[0031] Compared with the prior art, the embodiments of the present application have the following advantages:

[0032] By responding to a risk control scanning request, sampling and marking the risk control scanning request based on a pre-configured sampling strategy, and then performing a risk control scan on the application data corresponding to the risk control scanning request, obtaining a risk scanning result corresponding to the risk control scanning request, and finally, generating a risk control sample based on the application data and / or the risk scanning result corresponding to the risk control scanning request after the sampling and marking processing, the scenario authenticity of the risk control sample is effectively improved, and by sampling the online application data in real time, the freshness of the generated risk control sample can be improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 It is a flowchart of the steps of the risk control sample generation method disclosed in the embodiment of the present application;

[0034] Figure 2 It is a structural diagram of the risk control sample generation system disclosed in the embodiment of the present application;

[0035] Figure 3 It is one of the step flow charts of the risk detection method disclosed in the embodiment of the present application;

[0036] Figure 4 is a schematic diagram of the structure of the risk detection system disclosed in the embodiment of the present application;

[0037] Figure 5 It is a schematic diagram of the structure of an exemplary device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0038] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, the present application is further described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0039] The risk control sample generation method disclosed in the embodiment of the present application can not only improve the authenticity of the risk control samples, but also improve the freshness of the generated risk control samples by automatically extracting risk control samples from online real-time application data during the operation of the risk control system or risk scanning application, and updating the risk control sample library. Furthermore, risk control confrontation drills can be conducted based on the automatically updated risk control samples, and the application risk level can be detected in real time, forming a closed loop of risk control prevention and evaluation, and moving from passive prevention and control to active prevention and control.

[0040] Reference Figure 1 The risk control sample generation method disclosed in the embodiment of the present application includes: steps 102 to 106.

[0041] Step 102: In response to the risk control scanning request, perform sampling marking processing on the risk control scanning request based on a pre-configured sampling strategy.

[0042] Taking the implementation of the risk control sample generation method in the risk control sample generation system as an example, refer to Figure 2 The risk control sample generation system includes but is not limited to: a risk control system 20 and a sample generation module 22, wherein the risk control system 20 further includes: a risk control gateway 202, at least one risk scanning engine 204, and a data storage device 206.

[0043] In some optional embodiments, the risk control scanning request is issued by an application. Taking the application scenario of releasing products on an e-commerce platform as an example, when a user releases a product through an e-commerce platform, the e-commerce platform detects the product release event and generates a risk control scanning request for the product to be released based on the product information and other data associated with the product release event. Optionally, the risk control scanning request carries application data that needs to be scanned for risk control. Taking the risk control scanning request triggered by the product release event as an example, the application data carried by the risk control scanning request includes but is not limited to one or more of the following: product name, product category, product description, sales location, etc.

[0044] The risk control system can pre-set one or more risk scanning engines 204. Generally, different risk scanning engines 204 have different risk scanning capabilities. Among them, the risk control gateway 202 is used to receive the risk control scanning request submitted by the application, and according to the matching relationship between the pre-configured risk control scanning request and the risk scanning engine 204, the risk control scanning request is scheduled to send the risk control scanning request to one or more matching risk scanning engines 204, and the corresponding risk scanning engine 204 performs risk scanning on the application data carried by the risk control scanning request. On the other hand, the risk control gateway 202 summarizes the risk scanning results output by each risk scanning engine 204 to obtain a comprehensive risk scanning result. The data storage 206 is used to store application data, comprehensive risk scanning results, etc.

[0045] In the process of the risk control system responding to the risk control scanning request, the risk control gateway assembles the request parameters of the risk control scanning request and converts the request parameters of the risk control scanning request into a data format that matches the risk scanning engine. In some optional embodiments, the risk control gateway can also add additional parameters to the request parameters of the risk control scanning request, thereby providing the risk scanning engine with richer information to obtain more accurate risk scanning results.

[0046] In some optional embodiments, the risk control gateway can assemble the request parameters of the risk control scanning request by executing a preset script. Taking the risk control system applied to the e-commerce platform as an example, the system developer can write a Groovy script (a dynamic type language script) according to the request parameter requirements of each risk scanning engine preset in the risk control system for the risk control scanning request, and implement the conversion of the request parameters of the risk control scanning request sent by the application layer to the request parameters required by each risk scanning engine in the Groovy script. At the same time, in the Groovy script, other parameters required by the risk scanning engine are completed through function calls.

[0047] For example, for a risk control scan request triggered by a product release event, the risk control scan request uses the product information to be released as a request parameter to submit a risk control scan request to the air defense gateway, and the risk control gateway executes a preset Groovy script to obtain additional merchant information. Then, the Groovy script is executed to assemble the request parameters based on the merchant information, and the request parameters are assembled into risk control scan requests in the request parameter format required by the intellectual property risk scanning engine, and risk control scan requests in the request parameter format required by the prohibited and restricted sales identification engine. Afterwards, the risk control gateway sends risk control scan requests to the prohibited and restricted sales identification engine based on the assembled request parameters.

[0048] In the embodiments of the present application, the sampling strategy is used to describe the rules for the risk control system to sample online application data. Optionally, the sampling strategy includes, but is not limited to: a random sampling strategy and a coverage word strategy. Among them, the random sampling strategy is used to describe the rules for random sampling of application data carried by the risk control scanning request, such as the sampling frequency of matching different risk control scanning requests, etc.; the coverage word strategy is used to describe risk words, risk word coverage judgment rules, etc. In the specific implementation process, the risk control system can be configured to execute which one or several sampling strategies according to the application scenario, and the specific content of each sampling strategy can be configured. For example, a random sampling strategy can be implanted in the risk control gateway, and the risk control scanning request type applicable to the random sampling strategy, as well as the sampling parameters of the random sampling strategy (such as sampling frequency), etc. can be configured. For another example, a risk word library can be mounted in the risk control system, a risk word library matching strategy can be implanted, and the risk control scanning request type applicable to the coverage word strategy can be configured.

[0049] In some optional embodiments, the sampling strategy can be embedded in the Groovy script, or in the risk scanning engine, or different sampling strategies can be embedded in the Groovy script and the risk scanning engine, respectively. In this way, the sampling strategy will be executed during the execution of the Groovy script, thereby implementing sampling processing of the application data.

[0050] In some optional embodiments, the sampling and marking processing of the risk control scanning request based on the pre-configured sampling strategy includes: matching the risk control scanning request with the pre-configured sampling strategy to obtain a matching result; in response to the matching result indicating that the risk control scanning request matches the random sampling strategy, implanting a sampling mark in the request parameter of the risk control scanning request; in response to the matching result indicating that the risk control scanning request matches the coverage word strategy, storing the request identifier matched by the risk control scanning request in a preset data storage device. After receiving the risk control scanning request, the risk control gateway first executes a preset script to convert the request parameters of the risk control scanning request. When the sampling strategy is configured, the script corresponding to the sampling strategy will be executed first to determine whether it is necessary to perform sampling processing on the application data corresponding to the current risk control scanning request. If necessary, further perform sampling marking processing, and then perform request parameter conversion; if not, directly perform request parameter conversion.

[0051] The following takes the example of pre-configuring the random sampling strategy and the covering word strategy for the risk control system, configuring the risk control scanning request triggered by the release product event (hereinafter referred to as "distributeReq") to apply the random sampling strategy and the covering word strategy, and configuring the risk vocabulary of the sampling frequency and covering word strategy for the risk control scanning request as an example to explain the specific implementation method of the sampling marking process. First, the risk control gateway executes a pre-written script (such as a Groovy script) to determine whether the current risk control scanning request distributeReq meets the sampling frequency. If it does, the matching result of the current risk control scanning request distributeReq matching the random sampling strategy is obtained. On the other hand, the risk control gateway executes the risk vocabulary matching strategy in the pre-written script to determine whether the application data in the current risk control scanning request distributeReq contains risk words in the preset risk vocabulary. If it does, the matching result of the current risk control scanning request distributeReq matching the covering word strategy is obtained.

[0052] Further, if it is determined through matching that the risk control scanning request distributeReq matches the random sampling strategy, the risk control gateway embeds a sampling tag in the request parameter of the risk control scanning request distributeReq. In some optional embodiments, embedding a sampling tag in the request parameter of the risk control scanning request includes: embedding a preset tag in the request parameter of the risk control scanning request by executing a preset script. For example, embedding a sampling tag key-value pair in the request parameter.

[0053] Take the request parameters of the risk control scanning request distributeReq as an example:

[0054] {"title":"Product title...",

[0055] "detail":"Product details...",

[0056] "brand":"Trademark information apple",

[0057] "...key...":"...value..."};

[0058] After adding the sampling marker to the request parameters, the request parameters are transformed into:

[0059] {"title":"Product title...",

[0060] "detail":"Product details...",

[0061] "brand":"Trademark information apple",

[0062] "drillTag":"Hit random sampling strategy",

[0063] "...key...":"...value..."}.

[0064] Among them, "drillTag" represents the sampling tag key, and "hit random sampling strategy" represents the sampling tag value. The sampling tag key-value pair is used as the sampling tag, which can be used for subsequent retrieval of application data.

[0065] After the risk control gateway executes the complete script, it completes the information and assembles the request parameters to obtain the risk control scanning request distributeReq that meets the request parameter requirements of the specified risk scanning engine. ‘ .

[0066] On the other hand, when the risk control gateway receives the risk control scanning request, it assigns a unique request identifier to the risk control scanning request. When executing the risk word library matching strategy, if it is determined that the current risk control scanning request distributeReq matches the coverage word strategy, the risk control gateway will send the request identifier of the current risk control scanning request distributeReq to the data storage device 206 for storage, for subsequent retrieval of the application data carried by the risk control scanning request. For example, the risk control gateway can store the request identifier of the current risk control scanning request distributeReq in an asynchronous message queue in the cloud. In the data retrieval stage, the sample generation module 22 can obtain the request identifier of the risk control scanning request from the message queue, and based on the obtained request identifier, further retrieve the application data carried by the corresponding risk control scanning request.

[0067] Step 104: Perform a risk scan on the application data corresponding to the risk control scan request to obtain a risk scan result corresponding to the risk control scan request.

[0068] After the request parameters are assembled, the risk control gateway will process the sampled tags, and the request parameters will meet the risk control scanning request required by the risk scanning engine (such as the risk control scanning request distributeReq in the previous article). ‘ ) is sent to the corresponding risk scanning engine, and the corresponding risk scanning engine performs risk scanning on the application data carried by the assembled risk control scanning request.

[0069] Taking the risk control system applied to the e-commerce platform as an example, the risk scanning engines pre-installed in the risk control system include but are not limited to: intellectual property risk scanning engine, sensitive content scanning engine, prohibited sale and restricted sale identification engine, etc. On the other hand, the risk control system can also provide a risk control scanning task configuration entry for users to configure the risk scanning engine that needs to be called for risk control scanning requests triggered by different application events. For example, the user can configure that the risk control scanning request corresponding to the product release event needs to call the intellectual property risk scanning engine and the prohibited sale and restricted sale identification engine. For another example, the risk control scanning request corresponding to the comment posting event needs to call the sensitive content scanning engine. The types and capabilities of the risk scanning engines pre-installed in the risk control system are determined according to the specific application requirements. What kind of risk scanning engine needs to be called by the risk control scanning request triggered by different application events is configured by the system user, and there is no restriction on this in the embodiments of the present application.

[0070] Taking the e-commerce platform pre-configured release of product events requiring intellectual property risk scanning and prohibited sales and restricted sales risk scanning as an example, after receiving the risk control scanning request distributeReq triggered by the product release event, the risk control gateway assembles the request parameters of the risk control scanning request distributeReq according to the pre-configuration, and converts the request parameters of the risk control scanning request distributeReq into the parameter formats required by the intellectual property risk scanning engine and the prohibited sales and restricted sales identification engine, and obtains the risk control scanning request distributeReq1. ‘ and distributeReq2 ‘ , and distribute the converted risk control scanning request to distributeReq1 ‘ and distributeReq2 ‘ The IP risk scanning engine sends the distributedReq1 request to the risk control scanning engine and the prohibited and restricted sales identification engine. ‘ The application data carried is scanned for intellectual property risks, and the risk scanning result result1 is obtained; on the other hand, the prohibited sale and restricted sale identification engine distributes the risk control scanning request distributeReq2‘ The application data carried is scanned for prohibited and restricted sales risks to obtain the risk scanning result result2. Then, the risk control gateway fuses the risk scanning results result1 and result2 to obtain the comprehensive risk scanning result result of the risk control scanning request distributeReq.

[0071] The risk scanning engine performs a risk scan on the application data corresponding to the risk control scanning request. The specific implementation method for obtaining the risk scanning result corresponding to the risk control scanning request refers to the prior art and will not be repeated in the embodiments of the present application.

[0072] During the specific implementation process, after obtaining the risk control scanning request, the risk control gateway of the risk control system generates a unique request identifier for each risk control scanning request, and further sends the risk control scanning request after the request parameters are converted to the corresponding risk scanning engine for risk identification based on the pre-configured correspondence between the risk control scanning request and the risk scanning engine.

[0073] After the risk scanning engine performs a risk scan on the application data carried in the risk control scanning request, it obtains the risk scanning result corresponding to the single risk scanning engine. Furthermore, the risk control gateway integrates the risk scanning results for the same risk control scanning request to obtain the comprehensive risk scanning result for each risk control scanning request, and makes a penalty judgment on the risk control scanning request based on the comprehensive risk scanning result.

[0074] In some optional embodiments, after performing a risk control scan on the application data corresponding to the risk control scan request and obtaining the risk scan result corresponding to the risk control scan request, the risk control system will store the executed risk control scan request and the comprehensive risk scan result obtained by executing the risk control scan request in the data storage 206 for subsequent query. The data storage 206 may be a data storage platform, a cloud database, etc.

[0075] Step 106: Generate a risk control sample based on the application data and / or the risk scanning result corresponding to the risk control scanning request after the sampling marking process.

[0076] After the risk control gateway stores the completed risk control scanning requests and the application data, risk scanning results and other data carried by each risk control scanning request in the cloud, the sample generation module 22 can further retrieve real online data from the data storage 206 for generating risk control samples.

[0077] In the embodiments of the present application, corresponding to different sampling and marking processing methods, different data acquisition methods can be used to obtain real online data of the application and generate risk control samples.

[0078] In some optional embodiments, a risk control sample is generated based on the application data and / or the risk scanning result corresponding to the risk control scanning request after the sampling marking process, including: retrieving the sampling mark in the request parameter to obtain the risk control scanning request after the sampling marking process as a first sampling risk control scanning request; and reviewing and marking the application data corresponding to the first sampling risk control scanning request to generate a risk control sample.

[0079] As mentioned above, after the risk control system completes the risk control scan for each risk control scan request, it will store the risk control scan request, the application data corresponding to the risk control scan request, and the risk scan results in the cloud database as a risk control scan log for subsequent queries. If a random sampling strategy is configured for a certain type of risk control scan request for a certain application, the executed risk control scan request can be retrieved based on the sampling mark embedded in the request parameter of the risk control scan request during the risk control scan process, thereby obtaining the corresponding application data.

[0080] Taking the data storage device 206 as a big data platform ODPS (Open Data Processing Service, massive data offline processing service) as an example, after the risk control system automatically uploads the risk control scanning request and the corresponding application data to the cloud and stores them in ODPS, it uses SQL statements (database query statements) on ODPS to filter and query the risk control scanning request with a sampling mark in the request parameter as the first sampling risk control scanning request. Then, the application data corresponding to the first sampling risk control scanning request that is queried is transferred to a new data table as sampling data, and the sampling data in the data table is used to periodically update the risk control sample. For example, the newly added sampling data in the data table is automatically flowed into the manual review platform periodically to perform operations such as sample validity review, black and white sample data classification, and unified processing of sample data to generate a risk control sample data. After that, a sample label is set for the risk control sample data to obtain a risk control sample and add it to the risk control sample library.

[0081] The risk control samples obtained by processing the sample data obtained by random sampling strategy according to the above method include: black samples and / or white samples.

[0082] By retrieving the sampling mark in the request parameters and obtaining the risk control scanning request after the sampling mark processing as a sampling risk control scanning request, the application data is sampled, and the target data can be quickly found in the massive risk control scanning logs, thereby improving the efficiency of generating risk control samples.

[0083] In other optional embodiments, the risk control sample is generated based on the application data and / or the risk scanning result corresponding to the risk control scanning request after the sampling marking process, including: obtaining the request identifier from the preset data storage device as a target request identifier; obtaining the risk control scanning request that matches the target request identifier and whose risk scanning result is risk-free as a second sampling risk control scanning request; and performing review and marking processing based on the application data corresponding to the second sampling risk control scanning request to generate a risk control sample.

[0084] As mentioned above, the risk control system will store the risk control scanning request, the application data corresponding to the risk control scanning request, and the risk scanning result to the data storage device 206 as a risk control scanning log for subsequent query. On the other hand, when the risk control system executes the coverage word strategy, for the risk control scanning request that matches the coverage word strategy, the request identifier of the risk control scanning request will be sent to the data storage device 206 for storage. In this way, the sample generation module 22 can obtain the risk control scanning request that matches the coverage word strategy from the data storage device 206. Further, for the risk control scanning request that matches the coverage word strategy, by querying the data storage device 206, the application data carried by the risk control scanning request and the risk scanning result corresponding to the risk control scanning request can be obtained. Then, the risk control scanning request corresponding to the risk scanning result indicating no risk is used as the second sampled risk control scanning request. Afterwards, the risk control sample is periodically updated based on the application data carried by the second sampled risk control scanning request.

[0085] For the specific implementation method of periodically updating the risk control samples based on the application data carried by the second sampled risk control scanning request, refer to the specific implementation method of periodically updating the risk control samples based on the application data carried by the first sampled risk control scanning request mentioned above, which will not be repeated here.

[0086] In the embodiment of the present application, for application data that matches the coverage word strategy but is identified as risk-free by the risk scanning engine, further review and judgment are performed, which helps to discover the risk of missed prevention samples and missed identification by the risk scanning engine running online in the risk control system. Furthermore, the risk control samples generated based on this type of application data are applied to the iterative update of the risk scanning engine's prevention and control strategy, which can effectively improve the risk control capability of the risk scanning engine after iteration.

[0087] At this point, automatic sampling of online application data has been achieved to generate risk control samples.

[0088] In summary, the risk control sample generation method disclosed in the embodiment of the present application responds to a risk control scanning request, performs sampling and marking processing on the risk control scanning request based on a pre-configured sampling strategy, and then performs a risk control scan on the application data corresponding to the risk control scanning request to obtain the risk scanning result corresponding to the risk control scanning request. Finally, based on the application data and / or the risk scanning result corresponding to the risk control scanning request after the sampling and marking processing, a risk control sample is generated, which effectively improves the scenario authenticity of the risk control sample. In addition, by sampling and processing online application data in real time, the freshness of the generated risk control sample can be improved.

[0089] Based on the above embodiment, the present application also discloses a risk control sample generation system for implementing the above risk control sample generation method. The structure of the risk control sample generation system is as follows: Figure 2 As shown. Among them,

[0090] The risk control gateway 202 is used to respond to the risk control scanning request and perform sampling marking processing on the risk control scanning request based on a pre-configured sampling strategy;

[0091] The risk scanning engine 204 is used to perform risk scanning on the application data corresponding to the risk control scanning request, obtain the risk scanning result corresponding to the risk control scanning request, and store the application data and the risk scanning result in the memory in correspondence;

[0092] The sample generation module 22 is used to obtain analysis data in the memory and generate risk control samples based on the analysis data, wherein the analysis data includes: the application data and / or the risk scanning result corresponding to the risk control scanning request after the sampling marking process.

[0093] Among them, the risk scanning engine 204 performs a risk scan on the application data corresponding to the risk control scanning request, and the specific implementation method of obtaining the risk scanning result corresponding to the risk control scanning request refers to the prior art, which will not be repeated in the embodiments of this application.

[0094] For the specific implementation of performing sampling and marking processing on the risk control scanning request based on the pre-configured sampling strategy, please refer to the relevant description in the above embodiment, which will not be repeated here.

[0095] For the specific implementation method of generating risk control samples based on the application data and / or the risk scanning result corresponding to the risk control scanning request after the sampling marking process, please refer to the relevant description in the previous embodiments and will not be repeated here.

[0096] In summary, the risk control sample generation system disclosed in the embodiment of the present application responds to a risk control scanning request, performs sampling and marking processing on the risk control scanning request based on a pre-configured sampling strategy, and then performs a risk control scan on the application data corresponding to the risk control scanning request to obtain the risk scanning result corresponding to the risk control scanning request. Finally, based on the application data and / or the risk scanning result corresponding to the risk control scanning request after the sampling and marking processing, a risk control sample is generated, which effectively improves the scenario authenticity of the generated risk control samples. In addition, by sampling online application data in real time, the freshness of the generated risk control samples can be improved.

[0097] Based on the above embodiments, the embodiments of the present application also discloses a risk detection method, which automatically copies the application data in the risk control scanning request sent by the application through an adversarial drill strategy, and simulates the real application data for risk adversarial assessment by injecting risk control sample data, thereby realizing active, objective, real-time and comprehensive risk prevention and control.

[0098] like Figure 3 As shown, the risk detection method includes: steps 302 to 306.

[0099] Step 302: in response to a first risk control scanning request sent by the application hitting a preset exercise strategy, modify the first risk control scanning request based on a pre-generated risk control sample to generate a second risk control scanning request.

[0100] Optionally, the risk control samples may be generated in any one or more of the following ways: manually created, generated according to real online request data using the method described in the previous embodiments, extracted based on a risk vocabulary, etc.

[0101] In some optional embodiments, the pre-generated risk control samples include: being produced based on online application data through the following method: in response to a risk control scanning request, performing sampling marking processing on the risk control scanning request based on a pre-configured sampling strategy; performing a risk scan on the application data corresponding to the risk control scanning request, and obtaining the risk scanning result corresponding to the risk control scanning request; generating a risk control sample based on the application data and / or the risk scanning result corresponding to the risk control scanning request after the sampling marking processing.

[0102] For the specific implementation method of generating risk control samples based on online application data, please refer to the description in the previous embodiment and will not be repeated here.

[0103] Optionally, the preset drill strategy is used to describe the hit conditions for rehearsing risk control scanning requests triggered by application events. In actual applications, different applications involve different risk types, the probability of involving risks is also different, and the applicable risk scanning engines are also different. Therefore, the requirements for risk control drills for risk control scanning requests triggered by application events are also different. For example, for some applications with higher risks, risk control drills can be focused on, while for some applications with lower risks, a loose drill strategy can be set, and for applications without risks, there is no need to conduct risk control drills. Among them, the preset drill strategy includes but is not limited to the frequency of sampling drills for risk control scanning requests. Taking the scenario of product release on an e-commerce platform as an example, the risk control scanning request triggered by the product release event can be configured to sample the risk control scanning request according to the sampling frequency F, which is used to generate risk control samples based on the sampled risk control scanning request, thereby performing risk control drills.

[0104] The preset drill strategy is determined according to the risk detection requirements and application characteristics. For example, the preset drill strategy can be to sample the risk control scanning requests triggered by the target application at a specified frequency, or to randomly sample the risk control scanning requests, or to randomly sample the risk control scanning requests triggered by the target application. The specific content of the preset drill strategy is not limited in the embodiments of the present application.

[0105] In some optional embodiments, a judgment script may be pre-set at the risk control gateway to read the configured preset exercise strategy and determine whether the first risk control scan request hits the preset exercise strategy. For example, the preset script may be executed to determine the sampling frequency of the first risk control scan request. If the sampling frequency matches the preset frequency, it is considered that the current first risk control scan request hits the preset exercise strategy. In the embodiments of the present application, there is no restriction on the judgment logic of whether the first risk control scan request hits the preset exercise strategy.

[0106] In some optional embodiments, the adversarial exercise script is further used to modify the first risk control scanning request based on a pre-generated risk control sample to generate a second risk control scanning request.

[0107] Taking the example of an application requesting an e-commerce platform to perform a risk scan, when the application performs operations such as publishing products and publishing information, it is necessary to send application data such as product information of the product to be released to the risk control gateway of the e-commerce platform through a risk control scan request, and perform risk scan scheduling through the risk control gateway, and schedule the risk control scan request to the corresponding one or more risk scanning engines for risk scanning. After receiving the risk control scan request sent by the application, the risk control gateway determines whether the risk control scan request hits the preset drill strategy, and when the risk control scan request sent by the application hits the preset drill strategy, the risk control scan request is modified based on the pre-generated risk control sample to generate a risk control scan request for attacking the risk scanning engine. In an embodiment of the present application, the risk control scan request sent by the application is recorded as a "first risk control scan request", and the risk control scan request generated based on the first risk control scan request is recorded as a "second risk control scan request".

[0108] In some optional embodiments, the preset drill strategy is determined according to specific risk prevention and control requirements and the performance of the risk control system. For example, if the risk control system has a strong processing capability, a higher sampling frequency can be configured for application events with higher risks.

[0109] In some optional embodiments, in response to a first risk control scanning request sent by an application hitting a preset rehearsal strategy, the first risk control scanning request is modified based on a pre-generated risk control sample to generate a second risk control scanning request, including: in response to the first risk control scanning request sent by the application hitting the preset rehearsal strategy, copying the request data corresponding to the first risk control scanning request; based on the sample data of the pre-generated risk control sample and the preset rehearsal sample generation configuration, modifying the request data to generate a second risk control scanning request.

[0110] Optionally, the preset drill strategy is pre-customized for the risk scenario corresponding to the first risk control scanning request, the pre-generated risk control sample is pre-selected for the risk scenario, and the preset drill sample generation configuration is pre-configured and generated for the risk scenario.

[0111] In some optional embodiments, in response to the first risk control scanning request sent by the application hitting a preset exercise strategy, modifying the first risk control scanning request based on a pre-generated risk control sample, and before generating a second risk control scanning request, it also includes: in response to a exercise configuration operation for a target risk scenario, obtaining the pre-generated risk control sample selected by the user for the target risk scenario, and generating a configuration for the exercise sample input by the user for the target risk scenario.

[0112] Among them, users can select corresponding risk control samples for different risk control management scenarios. For example, when it is necessary to conduct an intellectual property risk control capability drill on the intellectual property risk scanning engine, black samples and white samples related to intellectual property can be selected.

[0113] In actual applications, the types of risk scans that need to be performed in different application scenarios are directly related to the application scenarios, and the risk scanning engines suitable for different applications are also different. Before performing a risk scan on an application, you first need to configure the risk scanning strategies for different applications. Accordingly, when performing a risk control drill on the preset risk scanning engine, you first need to configure the drill sample generation strategy to generate a preset drill sample generation configuration. Optionally, the preset drill sample generation configuration includes but is not limited to: information such as parameters that need to be modified when the risk control scan request sent by the modified application, and the modification method.

[0114] Still taking the scenario of releasing products on an e-commerce platform as an example, you can configure the product name, product details, etc. of the risk control scanning request triggered by the product release event to be modified, inject risk control sample information, and thus generate a new risk control scanning request for the drill.

[0115] In some optional embodiments, the request data includes: the value of the request parameter, the sample data based on the pre-generated risk control sample and the preset rehearsal sample generation configuration, modifying the request data, and generating a second risk control scanning request, including: based on the preset rehearsal sample generation configuration, using the sample data of the pre-generated risk control sample to modify the value of at least one of the request parameters to generate a second risk control scanning request.

[0116] For example, when an application issues a real risk control scanning request, the real risk control scanning request issued by the application can be randomly sampled and the request data can be copied. Then, according to the risk control drill configuration information pre-configured for the application scenario, one or more risk control black sample data can be injected or replaced into the corresponding scanning field of the copied request data to regenerate a second risk control scanning request, and then risk scanning identification is performed on the second risk control scanning request.

[0117] In some optional embodiments, based on the preset drill sample generation configuration, the sample data of the pre-generated risk control sample is used to modify the value of at least one of the request parameters to generate a second risk control scanning request, including: based on the preset drill sample generation configuration, according to the request parameter correspondence, the sample data of the pre-generated risk control sample is used to replace the value of at least one corresponding request parameter to generate drill application data; setting a drill tag for the drill application data to generate a second risk control scanning request.

[0118] For example, if the preset drill sample generation configuration requires the replacement of the product title, a black sample can be selected from the pre-generated risk control samples, and then the value of the parameter "product title" in the request parameters of the first risk control scan request is replaced by the product title corresponding to the black sample to generate a new risk control scan request, recorded as the "second risk control scan request". For example, if the request parameters of the obtained risk control scan request are: {"product title":"title1..","details":"details...","brand":"brand2..."}, and the product title corresponding to the selected black sample is: "title2", then after replacing the value of the corresponding target parameter of the first risk control scan request with the sample data of the pre-generated risk control sample, the generated second risk control scan request is: {"product title":"title2..","details":"details...","brand":"brand2..."}".

[0119] In some optional embodiments, based on the preset drill sample generation configuration, the sample data of the pre-generated risk control sample is used to modify the value of at least one of the request parameters to generate a second risk control scanning request, including: based on the preset drill sample generation configuration, according to the corresponding relationship between the request parameters, the sample data of the pre-generated risk control sample is inserted into the value of the corresponding parameter of the first risk control scanning request to generate drill application data; setting a drill tag for the drill application data to generate a second risk control scanning request.

[0120] In some optional embodiments, the pre-generated risk control sample is a black sample, that is, a sample with risks. For example, if the preset drill sample generation configuration is configured to insert product details, a black sample can be selected from the pre-generated risk control samples, and then the product details corresponding to the black sample are injected into the value of the newly added request parameter "details" of the first risk control scan request to generate a new risk control scan request, which is recorded as the "second risk control scan request". For example, if the request parameters of the obtained risk control scan request are: {"Product Title":"title1..","Details":"details...","Brand":"brand2..."}, the product details corresponding to the selected black sample are: "XXXX", where "XXXX" represents a prohibited speech, then after replacing the value of the corresponding target parameter of the first risk control scan request based on the sample data of the pre-generated risk control sample, the generated second risk control scan request is: {"Product Title":"title1..","Details":"details...XXXX","Brand":"brand2..."}".

[0121] During the risk scanning process, sometimes a single content appears without risk, but when multiple contents appear at the same time, there will be risks. In the embodiment of the present application, during the risk confrontation drill, it supports the injection or replacement of risk control samples by configuring multiple request parameters, thereby enhancing the comprehensiveness and accuracy of risk detection. Still taking the risk control scanning request triggered by the release of a product event as an example, assuming that the request parameters of the risk control scanning request include: title, details, trademark brand, etc., then the content of one or more parameters in the title, details, trademark brand of the risk control scanning request that need to be modified can be configured, so that the content of the corresponding parameters can be modified according to the above configuration later, thereby injecting data in the risk control sample.

[0122] In some other optional embodiments, the values ​​of multiple parameters of the first risk control scanning request may be configured to be modified simultaneously, and different methods may be configured to be used to modify the values ​​of different parameters of the first risk control scanning request. For example, parameter 1 of the first risk control scanning request may be modified by replacement, and parameter 2 of the first risk control scanning request may be modified by injecting data.

[0123] Accordingly, based on the preset drill sample generation configuration, the sample data of the pre-generated risk control sample is used to modify the value of at least one of the request parameters to generate a second risk control scan request, including: based on the preset drill sample generation configuration, the sample data of the pre-generated multiple risk control samples are used to modify the values ​​of multiple request parameters to generate a second risk control scan request. For example, risk control samples can be classified and stored according to the targeted risk categories. When configuring the drill samples, the user can select risk control samples involving intellectual property rights to modify request parameters related to intellectual property risks, and select risk control samples involving violence to modify request parameters related to violence risks. By injecting risk control samples of multiple risk types into a drill sample, the comprehensiveness of risk confrontation drills is greatly improved.

[0124] The modification method of the first risk control scanning request and the parameters that need to be modified are configured in the preset exercise strategy, and can be pre-configured according to the needs of risk exercise and application needs. In the embodiment of the present application, there is no restriction on the modification method of the first risk control scanning request and the parameters that need to be modified, and they are not listed one by one here.

[0125] In the embodiment of the present application, only the parameter values ​​in the first risk control scanning request are modified according to the configuration in the preset drill strategy, and the other contents of the first risk control scanning request remain unchanged, thereby simulating the most realistic request data and improving the reliability of the adversarial drill results. By selecting a black sample to modify the first risk control scanning request and thus generating drill data, a more comprehensive attack drill can be performed on the risk scanning engine.

[0126] In the embodiment of the present application, the preset drill sample generation configuration is determined according to specific risk control requirements, and the specific content of the preset drill sample generation configuration is not limited in the embodiment of the present application.

[0127] In some embodiments of the present application, a user can configure a drill strategy, select a risk control sample for generating a drill sample, and perform a drill sample generation configuration through a client interface of a risk control drill center. The risk control drill center generates an adversarial drill script based on the drill sample generation configuration configured by the user and the selected risk control sample. During the operation of the risk control system, for applications pre-configured with a drill strategy, the risk control gateway executes the pre-generated adversarial drill script, samples the risk control scan request, and sends the sampled data to the risk control drill center, which modifies it, injects the risk control sample, and generates a second risk control scan request.

[0128] In some embodiments of the present application, the risk control drill center generates a configuration based on the preset drill sample, uses the sample data of the pre-generated risk control sample to modify the value of at least one of the request parameters, and generates a second risk control scan request, which also includes: setting a drill tag for the second risk control scan request. Afterwards, the risk control drill center sends the generated second risk control scan request to the risk control gateway, simulates the behavior of the application sending the risk control scan request, and performs a risk control identification drill on the preset risk scanning engine.

[0129] Step 304: Send the second risk control scanning request and the first risk control scanning request to a preset risk scanning engine for risk scanning to obtain a risk scanning result.

[0130] In some optional embodiments, the risk control gateway sends the first risk control scanning request sent by the application to the corresponding risk scanning engine for risk scanning in accordance with the preset risk scanning configuration, and obtains the risk scanning results corresponding to each first risk control scanning request; on the other hand, the risk control gateway sends the second risk control scanning request sent by the risk control drill center to the corresponding risk scanning engine for risk scanning in accordance with the preset risk scanning configuration, and obtains the risk scanning results corresponding to each second risk control scanning request.

[0131] Step 306: Obtain risk information based on the risk scanning result obtained.

[0132] During the operation of the risk control system, the risk control gateway sends the received risk control scanning request to the risk scanning engine for risk scanning. The risk scanning engine performs a risk scan on each air defense received, and then obtains the risk control scanning request and application data corresponding to the risk scanning result, and stores them in a specified location, such as a cloud database. The risk scanning result includes but is not limited to: intercepted application data, and the risk category matched by the application data. Furthermore, the risk control gateway or other applications can perform risk prevention and control operations based on the risk scanning result.

[0133] In some optional embodiments, the acquiring risk information based on the obtained risk scanning result includes: detecting the risk coverage of the risk scanning engine based on the obtained risk scanning result. The risk coverage can be used to guide the strategy optimization of the risk scanning engine.

[0134] Optionally, the risk scanning result includes: currently intercepted application data and currently unintercepted application data. Based on the obtained risk scanning result, the risk coverage of the risk scanning engine is detected, including: obtaining the number of correctly intercepted application data by reviewing the currently intercepted application data; performing a sample review of the currently unintercepted application data to obtain the proportion of missed application data; estimating the number of missed application data based on the proportion of application data and the number of currently unintercepted application data; and calculating the risk coverage of the risk scanning engine based on the number of correctly intercepted application data and the number of missed application data.

[0135] Take the case of 1 million application data for risk control scanning. Assuming that the risk scanning engine performs risk control scanning and the risk control gateway summarizes the data, the currently intercepted application data is equal to 1,000, of which 600 are correctly intercepted and 400 are incorrectly intercepted. Sample 2,000 application data from the remaining 999,000 application data. Assuming that 10 of the 2,000 application data should be intercepted but are missed through manual review, it can be determined that the percentage of missed application data is equal to 10 / 2,000. Further, the number of missed application data in the 999,000 application data restored in proportion is: (10 / 2,000) × 999,000, which is approximately equal to 5,000. The risk coverage of the risk scanning engine can be expressed as: the ratio of the amount of correctly intercepted application data to the amount of correctly intercepted application data inferred, where the amount of correctly intercepted application data inferred is equal to the sum of the amount of correctly intercepted application data and the amount of missed application data restored in proportion.

[0136] The risk detection method disclosed in the embodiment of the present application can improve the comprehensiveness and authenticity of adversarial drills for risk scanning engines by introducing drill samples generated based on online real data, help improve the accuracy of risk coverage detection, and provide more accurate data support for risk prevention and control.

[0137] In some optional embodiments, after detecting the risk coverage of the risk scanning engine based on the obtained risk scanning results, it also includes: obtaining the risk level of the application based on the risk coverage. For example, the risk level of the application can be calculated based on the product of the calculated risk coverage and the total amount of application data that has undergone risk scanning. The risk level of an application is an important indicator for risk prevention and control. The risk control system can use the above method to detect the risk level of an application in real time, and when the risk level reaches a preset risk threshold, trigger a risk warning mechanism, or trigger the optimization of a risk prevention and control strategy.

[0138] In some optional embodiments, after obtaining the risk information based on the risk scanning results, it also includes: reporting the risk information to a preset information receiving channel; and / or generating a risk control exercise report based on the risk information. For example, the risk control system can report the risk coverage rate of the risk scanning engine, the risk level of the application and other risk information obtained to the risk control manager in the form of a notification. For another example, the risk control system can generate a risk report based on the preset requirements based on the risk coverage rate of the risk scanning engine, the risk level of the application and other risk information obtained, and send it to the risk control manager or display it on the client of the risk control system.

[0139] In summary, the risk detection method disclosed in the embodiment of the present application, in response to the first risk control scanning request sent by the application hitting the preset drill strategy, modifies the first risk control scanning request based on the pre-generated risk control sample, and generates a second risk control scanning request; then, the second risk control scanning request and the first risk control scanning request are respectively sent to the preset risk scanning engine for risk scanning to obtain risk scanning results; based on the obtained risk scanning results, risk information is obtained, and in the process of risk scanning of the application, risk detection is performed in the form of adversarial drills, and risk adversarial assessment is performed by simulating real application data by injecting risk control samples through sampling online real application data, thereby realizing active, objective, real-time and comprehensive risk detection of applications and / or risk scanning engines, providing effective data support for risk control management, and solving the problems of real risk levels relying on estimation, governance relying on personal experience, and no global risk assessment mechanism in the risk governance process.

[0140] Furthermore, the risk detection method disclosed in the embodiment of the present application injects a continuously fresh stream of risk control samples into real application data to conduct risk control confrontation drills, which can not only obtain the risk level of the application in a timely manner, but also the detected risk level can accurately reflect the actual global risk level of the application.

[0141] In order to implement the above embodiment, the present application also discloses a risk detection system. Figure 4 As shown, the risk detection system includes: a risk control system 40 and a risk control exercise center 42, the risk control system 40 includes: a risk control gateway 402, at least one risk scanning engine 404, and a scanning record storage 406, wherein:

[0142] The risk control gateway 402 is configured to send request data corresponding to the first risk control scanning request sent by the application to the risk control exercise center in response to the first risk control scanning request hitting a preset exercise strategy;

[0143] The risk control exercise center 42 is used to modify the request data based on the preset exercise sample generation configuration and the sample data of the pre-generated risk control sample to generate a second risk control scanning request;

[0144] The risk control exercise center 42 is further used to send the second risk control scanning request to the risk control gateway 402;

[0145] The risk control gateway 402 is further used to send the second risk control scanning request and the first risk control scanning request to the risk scanning engine 404 for risk scanning to obtain risk scanning results;

[0146] The scan record storage 406 is used to store the risk scan result;

[0147] The risk control exercise center 42 is also used to obtain risk information based on the obtained risk scanning results.

[0148] The pre-generated risk control samples include: obtained based on online application data through the following methods:

[0149] In response to the risk control scanning request, performing sampling marking processing on the risk control scanning request based on a pre-configured sampling strategy;

[0150] Performing a risk scan on the application data corresponding to the risk control scan request, and obtaining a risk scan result corresponding to the risk control scan request;

[0151] A risk control sample is generated based on the application data and / or the risk scanning result corresponding to the risk control scanning request after the sampling marking process.

[0152] The specific implementation of the risk scanning engine can be found in the prior art and will not be described here. Optionally, the risk scanning engine sends the application data and risk scanning results corresponding to each risk control scanning request to a preset memory for storage, so that the risk control exercise center can read the risk control scanning results from the preset memory for risk control exercise analysis.

[0153] The preset exercise strategy is determined according to risk detection requirements and application characteristics. The specific content of the preset exercise strategy is not limited in the embodiment of the present application.

[0154] The specific implementation of the risk control gateway 402 is as described above. The specific implementation of the risk control gateway 402 determining whether the first risk control scanning request hits the preset exercise strategy is as described in the previous embodiment, which will not be repeated here.

[0155] The request data includes: the value of the request parameter, the sample data of the pre-generated risk control sample based on the preset drill sample generation configuration and the modified request data to generate the second risk control scanning request, including: based on the preset drill sample generation configuration, using the sample data of the pre-generated risk control sample to modify at least one value of the request parameter to generate the second risk control scanning request. The generation method and content of the preset drill sample generation configuration refer to the relevant description in the previous embodiment, which will not be repeated here.

[0156] Based on the preset rehearsal sample generation configuration, the sample data of the pre-generated risk control sample is used to modify the value of at least one of the request parameters to generate a second risk control scanning request. For the specific implementation method, please refer to the relevant description in the previous embodiment and will not be repeated here.

[0157] For a specific implementation method of obtaining risk information based on the risk scanning results, please refer to the relevant description in the above embodiments, which will not be repeated here.

[0158] In summary, the risk detection system disclosed in the embodiment of the present application includes: a risk control system and a risk control rehearsal center, the risk control system further includes: a risk control gateway, at least one risk scanning engine, the risk detection system responds to the first risk control scanning request sent by the application through the risk control gateway to hit the preset rehearsal strategy, and sends the request data corresponding to the first risk control scanning request to the risk control rehearsal center; thereafter, the risk control rehearsal center modifies the request data based on the preset rehearsal sample generation configuration and the sample data of the pre-generated risk control sample, generates a second risk control scanning request, and sends the second risk control scanning request to the risk control gateway; the risk control gateway sends the second risk control scanning request and the first risk control scanning request to the risk scanning engine for risk scanning, respectively, to obtain risk scanning results; finally, the risk control rehearsal center obtains risk information based on the risk scanning results obtained. During the process of risk detection system scanning the application, risk detection is performed in the form of adversarial drills, and risk adversarial assessment is performed by simulating real application data by sampling real online application data and injecting it into risk control samples. This achieves active, objective, real-time and comprehensive risk detection of applications and / or risk scanning engines, provides effective data support for risk control management, and solves the problems of real risk levels relying on estimates, governance relying on personal experience, and no global risk assessment mechanism in the risk governance process.

[0159] Furthermore, the risk detection system disclosed in the embodiment of the present application injects a continuous stream of fresh risk control samples into real application data to conduct risk control confrontation drills, which can not only obtain the risk level of the application in a timely manner, but also the detected risk level can accurately reflect the actual global risk level of the application.

[0160] It should be noted that, for the method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the embodiments of the present application are not limited by the described order of actions, because according to the embodiments of the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present application.

[0161] On the basis of the above embodiment, this embodiment further provides a risk control sample generation device, the device comprising:

[0162] A sampling processing module, configured to respond to a risk control scanning request and perform sampling marking processing on the risk control scanning request based on a pre-configured sampling strategy;

[0163] A scanning result acquisition module, used to perform risk scanning on the application data corresponding to the risk control scanning request, and obtain the risk scanning result corresponding to the risk control scanning request;

[0164] The risk control sample generation module is used to generate a risk control sample based on the application data and / or the risk scanning result corresponding to the risk control scanning request after the sampling marking process.

[0165] In some optional embodiments, the sampling processing module is further used to:

[0166] Matching the risk control scanning request with a pre-configured sampling strategy to obtain a matching result;

[0167] In response to the matching result indicating that the risk control scanning request matches the random sampling strategy, embedding a sampling tag in a request parameter of the risk control scanning request;

[0168] In response to the matching result indicating that the risk control scanning request matches the coverage word policy, a request identifier matched by the risk control scanning request is stored in a preset data storage device.

[0169] In some optional embodiments, the step of embedding a sampling mark in a request parameter of the risk control scanning request includes:

[0170] By executing a preset script, a preset tag is embedded in the request parameter of the risk control scanning request.

[0171] In some optional embodiments, generating a risk control sample based on the application data and / or the risk scanning result corresponding to the risk control scanning request after the sampling marking process includes:

[0172] By retrieving the sampling mark in the request parameter, the risk control scanning request after the sampling mark processing is obtained as the first sampling risk control scanning request;

[0173] The application data corresponding to the first sampling risk control scanning request is audited and marked to generate a risk control sample.

[0174] In some optional embodiments, generating a risk control sample based on the application data and / or the risk scanning result corresponding to the risk control scanning request after the sampling marking process includes:

[0175] Acquire the request identifier from the preset data storage as a target request identifier;

[0176] Acquire the risk control scanning request that matches the target request identifier and for which the risk scanning result is risk-free, as a second sampled risk control scanning request;

[0177] The application data corresponding to the second sampling risk control scanning request is audited and marked to generate a risk control sample.

[0178] The risk control sample generation device disclosed in the embodiment of the present application is used to implement the above-mentioned risk control sample generation method. The specific implementation methods of each module of the device refer to the specific implementation methods of the corresponding steps in the above-mentioned method embodiment, which will not be repeated here.

[0179] In summary, the risk control sample generating device disclosed in the embodiment of the present application responds to a risk control scanning request, performs sampling and marking processing on the risk control scanning request based on a pre-configured sampling strategy, and then performs a risk control scan on the application data corresponding to the risk control scanning request to obtain the risk scanning result corresponding to the risk control scanning request. Finally, based on the application data and / or the risk scanning result corresponding to the risk control scanning request after the sampling and marking processing, a risk control sample is generated, which effectively improves the scenario authenticity of the risk control sample. In addition, by sampling and processing online application data in real time, the freshness of the generated risk control sample can be improved.

[0180] Based on the above embodiment, this embodiment further provides a risk detection device, which includes:

[0181] A second risk control scanning request generating module, configured to modify the first risk control scanning request based on a pre-generated risk control sample to generate a second risk control scanning request in response to the first risk control scanning request sent by the application hitting a preset exercise strategy;

[0182] a risk scanning result acquisition module, used to send the second risk control scanning request and the first risk control scanning request to a preset risk scanning engine for risk scanning, and obtain a risk scanning result;

[0183] The risk information acquisition module is used to acquire risk information based on the risk scanning result obtained.

[0184] Optionally, in response to the first risk control scanning request sent by the application hitting a preset exercise strategy, modifying the first risk control scanning request based on a pre-generated risk control sample to generate a second risk control scanning request includes:

[0185] In response to a first risk control scanning request sent by the application hitting a preset drill strategy, copying request data corresponding to the first risk control scanning request;

[0186] Based on the sample data of the pre-generated risk control sample and the preset drill sample generation configuration, the request data is modified to generate a second risk control scanning request.

[0187] In some optional embodiments, the request data includes: the value of the request parameter, the sample data based on the pre-generated risk control sample and the preset drill sample generation configuration, modifying the request data, and generating the second risk control scanning request, including:

[0188] Based on the preset rehearsal sample generation configuration, the sample data of the pre-generated risk control sample is used to modify the value of at least one of the request parameters to generate a second risk control scanning request.

[0189] In some optional embodiments, the preset drill strategy is pre-customized for the risk scenario corresponding to the first risk control scanning request, the pre-generated risk control sample is pre-selected for the risk scenario, and the preset drill sample generation configuration is pre-configured and generated for the risk scenario.

[0190] Optionally, the risk information acquisition module is further used to:

[0191] Based on the obtained risk scanning result, the risk coverage of the risk scanning engine is detected.

[0192] In some optional embodiments, the pre-generated risk control samples include: obtaining based on online application data by the following method:

[0193] In response to the risk control scanning request, performing sampling marking processing on the risk control scanning request based on a pre-configured sampling strategy;

[0194] Performing a risk scan on the application data corresponding to the risk control scan request, and obtaining a risk scan result corresponding to the risk control scan request;

[0195] A risk control sample is generated based on the application data and / or the risk scanning result corresponding to the risk control scanning request after the sampling marking process.

[0196] In some optional embodiments, the device further comprises:

[0197] The risk information output module is used to report the risk information to a preset information receiving channel; and / or generate a risk control exercise report based on the risk information.

[0198] The risk detection device disclosed in the embodiment of the present application is used to implement the above-mentioned risk detection method. The specific implementation of each module of the device refers to the specific implementation of the corresponding steps in the above-mentioned method embodiment, which will not be repeated here.

[0199] In summary, the risk detection device disclosed in the embodiment of the present application responds to the first risk control scanning request sent by the application hitting the preset drill strategy, modifies the first risk control scanning request based on the pre-generated risk control sample, and generates a second risk control scanning request; then, the second risk control scanning request and the first risk control scanning request are respectively sent to the preset risk scanning engine for risk scanning to obtain risk scanning results; based on the obtained risk scanning results, risk information is obtained, and in the process of risk scanning of the application, risk detection is performed in the form of adversarial drills, and risk adversarial assessment is performed by simulating real application data by injecting risk control samples through sampling online real application data, thereby realizing active, objective, real-time and comprehensive risk detection of applications and / or risk scanning engines, providing effective data support for risk control management, and solving the problems of real risk levels relying on estimates, governance relying on personal experience, and no global risk assessment mechanism in the risk governance process.

[0200] Furthermore, the risk detection device disclosed in the embodiment of the present application injects a continuously fresh risk control sample into real application data to conduct risk control confrontation drills, which can not only obtain the risk level of the application in a timely manner, but also the detected risk level can accurately reflect the actual global risk level of the application.

[0201] The embodiment of the present application also provides a non-volatile readable storage medium, which stores one or more modules (programs). When the one or more modules are applied to a device, the device can execute instructions (instructions) of each method step in the embodiment of the present application.

[0202] The embodiment of the present application further provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the method described in the embodiment of the present application.

[0203] The embodiment of the present application also provides an electronic device, comprising: a processor, and a memory connected to the processor; the memory stores computer-executable instructions; the processor executes the computer-executable instructions stored in the memory to implement the method described in the embodiment of the present application. In the embodiment of the present application, the electronic device includes a server, a terminal device, and other devices.

[0204] The embodiment of the present application also discloses a computer program product, including a computer program / computer executable instructions, characterized in that when the computer program / computer executable instructions are executed by a processor in an electronic device, the method described in the embodiment of the present application is implemented.

[0205] The embodiments of the present disclosure may be implemented as a device configured as desired using any appropriate hardware, firmware, software, or any combination thereof, and the device may include electronic devices such as a server (cluster), a terminal, etc. Figure 5 An exemplary apparatus 500 that can be used to implement various embodiments described in this application is schematically shown.

[0206] For one embodiment, Figure 5 An exemplary apparatus 500 is shown having one or more processors 502, a control module (chip set) 504 coupled to at least one of the processor(s) 502, a memory 506 coupled to the control module 504, a non-volatile memory (NVM) / storage device 508 coupled to the control module 504, one or more input / output devices 510 coupled to the control module 504, and a network interface 512 coupled to the control module 504.

[0207] The processor 502 may include one or more single-core or multi-core processors, and the processor 502 may include any combination of general-purpose processors or special-purpose processors (such as graphics processors, application processors, baseband processors, etc.). In some embodiments, the device 500 can be used as a server, terminal, or other device described in the embodiments of the present application.

[0208] In some embodiments, the apparatus 500 may include one or more computer-readable media (e.g., memory 506 or NVM / storage device 508) having instructions 514 and one or more processors 502 configured in conjunction with the one or more computer-readable media to execute the instructions 514 to implement a module to perform the actions described in the present disclosure.

[0209] For one embodiment, control module 504 may include any suitable interface controller to provide any suitable interface to at least one of processor(s) 502 and / or any suitable device or component in communication with control module 504 .

[0210] The control module 504 may include a memory controller module to provide an interface to the memory 506. The memory controller module may be a hardware module, a software module, and / or a firmware module.

[0211] The memory 506 may be used, for example, to load and store data and / or instructions 514 for the device 500. For one embodiment, the memory 506 may include any suitable volatile memory, such as a suitable DRAM. In some embodiments, the memory 506 may include double data rate type four synchronous dynamic random access memory (DDR4 SDRAM).

[0212] For one embodiment, control module 504 may include one or more input / output controllers to provide an interface to NVM / storage device 508 and input / output device(s) 510 .

[0213] For example, NVM / storage 508 may be used to store data and / or instructions 514. NVM / storage 508 may include any suitable non-volatile memory (e.g., flash memory) and / or may include any suitable non-volatile storage device(s) (e.g., one or more hard disk drives (HDDs), one or more compact disk (CD) drives, and / or one or more digital versatile disk (DVD) drives).

[0214] NVM / storage device 508 may include storage resources that are part of the device on which apparatus 500 is installed, or it may be accessible to the device without being part of the device. For example, NVM / storage device 508 may be accessed via (one or more) input / output devices 510 over a network.

[0215] (One or more) input / output devices 510 may provide an interface for the apparatus 500 to communicate with any other appropriate device, and the input / output device 510 may include a communication component, an audio component, a sensor component, etc. The network interface 512 may provide an interface for the apparatus 500 to communicate through one or more networks, and the apparatus 500 may wirelessly communicate with one or more components of a wireless network according to any of one or more wireless network standards and / or protocols, for example, accessing a wireless network based on a communication standard, such as Bluetooth, WiFi, 2G, 3G, 4G, 5G, etc., or a combination thereof for wireless communication.

[0216] For one embodiment, at least one of the processor(s) 502 may be packaged together with the logic of one or more controllers (e.g., a memory controller module) of the control module 504. For one embodiment, at least one of the processor(s) 502 may be packaged together with the logic of one or more controllers of the control module 504 to form a system-in-package (SiP). For one embodiment, at least one of the processor(s) 502 may be integrated on the same die with the logic of one or more controllers of the control module 504. For one embodiment, at least one of the processor(s) 502 may be integrated on the same die with the logic of one or more controllers of the control module 504 to form a system-on-chip (SoC).

[0217] In various embodiments, the apparatus 500 may be, but is not limited to, a terminal device such as a server, a desktop computing device, or a mobile computing device (e.g., a laptop computing device, a handheld computing device, a tablet computer, a netbook, etc.). In various embodiments, the apparatus 500 may have more or fewer components and / or a different architecture. For example, in some embodiments, the apparatus 500 includes one or more cameras, a keyboard, a liquid crystal display (LCD) screen (including a touch screen display), a non-volatile memory port, multiple antennas, a graphics chip, an application-specific integrated circuit (ASIC), and a speaker.

[0218] Among them, the main control chip can be used as a processor or control module in the detection device, sensor data, location information, etc. are stored in a memory or NVM / storage device, the sensor group can be used as an input / output device, and the communication interface may include a network interface.

[0219] The embodiment of the present application also provides an electronic device, including: a processor; and a memory, on which executable code is stored, and when the executable code is executed, the processor executes one or more methods as described in the embodiment of the present application. In the embodiment of the present application, the memory can store various data, such as target files, file and application association data, and user behavior data, so as to provide a data basis for various processing.

[0220] The embodiments of the present application also provide one or more machine-readable media on which executable codes are stored. When the executable codes are executed, the processor executes one or more methods described in the embodiments of the present application.

[0221] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0222] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0223] The embodiments of the present application are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0224] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0225] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable terminal device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0226] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present application.

[0227] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the elements.

[0228] The above is a detailed introduction to a risk control sample generation method, a risk control sample generation system, a risk detection method, a risk detection system, an electronic device, a storage medium and a computer program product provided by the present application. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea; at the same time, for general technical personnel in this field, according to the idea of ​​the present application, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A method for generating risk control samples, characterized in that: The method comprises: In response to the risk control scanning request, performing sampling marking processing on the risk control scanning request based on a pre-configured sampling strategy; Performing a risk scan on the application data corresponding to the risk control scan request, and obtaining a risk scan result corresponding to the risk control scan request; A risk control sample is generated based on the application data and / or the risk scanning result corresponding to the risk control scanning request after the sampling marking process.

2. The method according to claim 1, characterized in that The performing sampling and marking processing on the risk control scanning request based on a pre-configured sampling strategy includes: Matching the risk control scanning request with a pre-configured sampling strategy to obtain a matching result; In response to the matching result indicating that the risk control scanning request matches the random sampling strategy, embedding a sampling tag in a request parameter of the risk control scanning request; In response to the matching result indicating that the risk control scanning request matches the coverage word policy, a request identifier matched by the risk control scanning request is stored in a preset data storage device.

3. The method according to claim 2, characterized in that The step of embedding a sampling mark in a request parameter of the risk control scanning request includes: By executing a preset script, a preset tag is embedded in the request parameter of the risk control scanning request.

4. The method according to claim 2, characterized in that: The generating a risk control sample based on the application data and / or the risk scanning result corresponding to the risk control scanning request after the sampling marking process comprises: By retrieving the sampling mark in the request parameter, the risk control scanning request after the sampling mark processing is obtained as the first sampling risk control scanning request; The application data corresponding to the first sampling risk control scanning request is audited and marked to generate a risk control sample.

5. The method according to claim 2, characterized in that: The generating a risk control sample based on the application data and / or the risk scanning result corresponding to the risk control scanning request after the sampling marking process comprises: Acquire the request identifier from the preset data storage as a target request identifier; Acquire the risk control scanning request that matches the target request identifier and for which the risk scanning result is risk-free, as a second sampled risk control scanning request; The application data corresponding to the second sampling risk control scanning request is audited and marked to generate a risk control sample.

6. A risk detection method, characterized in that: The method comprises: In response to a first risk control scanning request sent by the application hitting a preset exercise strategy, modifying the first risk control scanning request based on a pre-generated risk control sample to generate a second risk control scanning request; Sending the second risk control scanning request and the first risk control scanning request to a preset risk scanning engine for risk scanning, respectively, to obtain a risk scanning result; Based on the obtained risk scanning result, risk information is obtained.

7. The method according to claim 6, characterized in that In response to the first risk control scanning request sent by the application hitting a preset exercise strategy, modifying the first risk control scanning request based on a pre-generated risk control sample to generate a second risk control scanning request, including: In response to a first risk control scanning request sent by the application hitting a preset drill strategy, copying request data corresponding to the first risk control scanning request; Based on the sample data of the pre-generated risk control sample and the preset drill sample generation configuration, the request data is modified to generate a second risk control scanning request.

8. The method according to claim 7, characterized in that The request data includes: the value of the request parameter, the sample data based on the pre-generated risk control sample and the preset drill sample generation configuration, modifying the request data, and generating a second risk control scanning request, including: Based on the preset rehearsal sample generation configuration, the sample data of the pre-generated risk control sample is used to modify the value of at least one of the request parameters to generate a second risk control scanning request.

9. The method according to claim 7, characterized in that: The preset drill strategy is pre-customized for the risk scenario corresponding to the first risk control scanning request, the pre-generated risk control sample is pre-selected for the risk scenario, and the preset drill sample generation configuration is pre-configured and generated for the risk scenario.

10. The method according to claim 6, characterized in that The obtaining of risk information based on the obtained risk scanning result includes: Based on the obtained risk scanning result, the risk coverage of the risk scanning engine is detected.

11. The method according to claim 6, characterized in that The pre-generated risk control samples include: obtained based on online application data through the following methods: In response to the risk control scanning request, performing sampling marking processing on the risk control scanning request based on a pre-configured sampling strategy; Performing a risk scan on the application data corresponding to the risk control scan request, and obtaining a risk scan result corresponding to the risk control scan request; A risk control sample is generated based on the application data and / or the risk scanning result corresponding to the risk control scanning request after the sampling marking process.

12. The method according to claim 6, characterized in that After obtaining risk information based on the risk scanning result, the method further includes: Report the risk information to a preset information receiving channel; and / or, A risk control drill report is generated based on the risk information.

13. The method according to claim 6, characterized in that The pre-generated risk control samples are black samples.

14. A risk control sample generation system, characterized in that: The system includes: a risk control system and a sample generation module, and the risk control system further includes: a risk control gateway, at least one risk scanning engine, and a memory, wherein: The risk control gateway is used to respond to the risk control scanning request and perform sampling marking processing on the risk control scanning request based on a pre-configured sampling strategy; The risk scanning engine is used to perform a risk scan on the application data corresponding to the risk control scanning request, obtain a risk scanning result corresponding to the risk control scanning request, and store the application data and the risk scanning result in the memory in correspondence; The sample generation module is used to obtain analysis data in the memory and generate risk control samples based on the analysis data, wherein the analysis data includes: the application data and / or the risk scanning result corresponding to the risk control scanning request after the sampling marking process.

15. A risk detection system, characterized in that: The system includes: a risk control system and a risk control exercise center. The risk control system includes: a risk control gateway, at least one risk scanning engine, and a scanning record storage, wherein: The risk control gateway is configured to send request data corresponding to the first risk control scanning request sent by the application to the risk control exercise center in response to the first risk control scanning request hitting a preset exercise strategy; The risk control exercise center is used to modify the request data based on the preset exercise sample generation configuration and the sample data of the pre-generated risk control sample to generate a second risk control scanning request; The risk control exercise center is further used to send the second risk control scanning request to the risk control gateway; The risk control gateway is further used to send the second risk control scanning request and the first risk control scanning request to the risk scanning engine for risk scanning to obtain risk scanning results; The scan record storage is used to store the risk scan result; The risk control drill center is also used to obtain risk information based on the risk scanning results obtained.

16. An electronic device, characterized in that: include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory to implement the method according to any one of claims 1 to 13.

17. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 13 when executed by a processor.

18. A computer program product comprising a computer program / computer executable instructions, characterized in that: When the computer program / computer executable instructions are executed by a processor in an electronic device, the method according to any one of claims 1 to 13 is implemented.

Images