Risk analysis interval determination method, electronic equipment and computer readable storage medium

Abstract

The invention relates to the technical field of data analysis, in particular to a risk analysis interval determination method, electronic equipment and a computer readable storage medium. The method is applied to a payment risk management server, the payment risk management server and a client are in a secure communication connection state, and the method comprises the following steps: obtaining a risk value and a preset risk analysis interval of the client, the risk value being a risk value carried by a previous risk analysis result corresponding to the client, the risk value being a weighted sum of a plurality of sub-risk values, the plurality of risk items are in one-to-one correspondence with the plurality of sub-risk values, and the plurality of risk items are different; and determining a target interval according to a preset risk analysis interval and the risk value, the target interval being negatively correlated with the risk value, and the target interval being positively correlated with a preset risk interval. The flexibility of risk analysis initiation time can be improved, so that the transaction risk is reduced, and the security of funds in the transaction process is improved.

Description

Technical Field

[0001] The present application relates to the technical field of data analysis, and in particular to a risk analysis interval determination method, an electronic device, and a computer-readable storage medium. Background Art

[0002] POS (Point of Sales) machines are indispensable terminal devices in modern commercial transactions, with fund processing and transaction functions. POS machines are widely used in supermarkets, department stores, catering companies, convenience stores and other commercial scenarios. While improving transaction convenience, POS machines also face a series of potential security risks, such as counterfeit card fraud, illegal transactions and illegal card swiping.

[0003] In order to effectively deal with these risks, the server can evaluate the current payment environment of the POS machine. Once the risk analysis results show that there are abnormal transactions, the POS machine will take corresponding preventive measures, such as suspending transactions, issuing warning pop-ups, etc., to block possible abnormal transactions, thereby protecting the funds of merchants and consumers. In traditional technical solutions, there is usually a preset risk analysis interval. The POS machine can regularly initiate risk analysis requests to the server to evaluate the current payment environment. However, within the preset risk analysis interval, abnormal transactions that require immediate intervention may also occur. The traditional risk analysis initiation method has low flexibility in the rapidly changing payment environment, and the security of funds during the transaction is not high. Summary of the invention

[0004] The embodiments of the present application provide a method for determining a risk analysis interval, an electronic device, and a computer-readable storage medium, which can improve the flexibility of the time for initiating risk analysis, thereby reducing transaction risks and improving the security of funds during transactions.

[0005] In the first aspect, an embodiment of the present application provides a method for determining a risk analysis interval, which is applied to a payment risk management server, and the payment risk management server and a client are in a secure communication connection state. The method includes: obtaining the risk value of the client and a preset risk analysis interval, the risk value is the risk value carried by the last risk analysis result corresponding to the client, the risk value is the weighted sum of multiple sub-risk values, multiple risk items correspond one-to-one to multiple sub-risk values, and multiple risk items are different; determining a target interval according to the preset risk analysis interval and the risk value, the target interval is negatively correlated with the risk value, and the target interval is positively correlated with the preset risk interval.

[0006] In some implementations, the risk value is the sum of multiple sub-risk values, the risk value is a positive number, the target interval is proportional to the preset risk interval, and the target interval is inversely proportional to the risk value.

[0007] In some embodiments, before obtaining the risk value of the client and the preset risk analysis interval, it also includes: sending a first risk analysis request to the client, the first risk analysis request is used to obtain the configuration information of the client; in response to the received configuration information, obtaining multiple risk items corresponding to the configuration information; sending a first risk collection request to the client, the first risk collection request carries multiple risk items, the first risk collection request is used to instruct the client to collect multiple analysis data corresponding to the multiple risk items, and the multiple analysis data are used to perform risk analysis on the client; in response to the received multiple analysis data, perform risk analysis on the client according to the multiple analysis data to obtain a risk analysis result, and the risk analysis result carries the risk value; send the risk analysis result to the client, and store the risk analysis result.

[0008] In some embodiments, if the risk value is greater than a preset maximum risk threshold, the risk analysis result carries a first termination instruction, which is used to instruct the client to terminate the current transaction; if the risk value is greater than a preset minimum risk threshold and is less than or equal to a preset maximum risk threshold, the risk analysis result carries a first prompt message, which is used to prompt the client that there is a transaction risk in the current transaction.

[0009] In some embodiments, sending a first risk analysis request to a client includes: sending the first risk analysis request to the client, and recording the moment when the first risk analysis request is sent as a first moment; after determining a target interval according to a preset risk analysis interval and a risk value, further including: sending a second risk analysis request to the client at a second moment, the second risk analysis request being used to obtain configuration information of the client, the second moment being separated from the first moment by a target interval, and the second moment being a moment after the first moment.

[0010] In some embodiments, after determining the target interval according to the preset risk analysis interval and the risk value, it also includes: determining whether the target interval is greater than the preset risk analysis interval; if the target interval is greater than the preset risk analysis interval, replacing the target interval with the preset risk analysis interval.

[0011] In some embodiments, the method further includes: sending a status request to the client at the end time of a preset connection cycle, the status request is used to obtain the transaction status of the client, the transaction status is a payment status or an idle status; receiving the transaction status sent by the client; if the transaction status indicates that the transaction status of the client is a payment status, sending a first risk analysis request to the client.

[0012] In some implementations, sending the first risk analysis request to the client includes: receiving a risk analysis instruction input by a user, the risk analysis instruction carrying an identity identifier of the client; and sending the first risk analysis request to the client according to the identity identifier of the client in response to the risk analysis instruction.

[0013] In a second aspect, an embodiment of the present application provides a risk analysis interval determination device, which may be a payment risk management server, the payment risk management server and the client are in a secure communication connection state, and the device includes:

[0014] The acquisition module is used to obtain the client's risk value and the preset risk analysis interval. The risk value is the risk value carried by the previous risk analysis result corresponding to the client. The risk value is the weighted sum of multiple sub-risk values. Multiple risk items correspond to multiple sub-risk values ​​one by one, and multiple risk items are different.

[0015] The calculation module is used to determine the target interval according to the preset risk analysis interval and the risk value, the target interval is negatively correlated with the risk value, and the target interval is positively correlated with the preset risk interval.

[0016] In a third aspect, an embodiment of the present application provides an electronic device, comprising a processor and a memory, wherein the processor is used to execute a computer program stored in the memory to implement a method as described in any one of the first aspects above.

[0017] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, which stores a computer program, and is characterized in that when the computer program is executed by a processor, it implements the method as described in any one of the above-mentioned first aspects.

[0018] In the technical solution provided in the embodiment of the present application, the payment risk management server can obtain the risk value and the preset risk analysis interval carried by the last risk analysis result of the client, and determine the target interval according to the preset risk analysis interval and the risk value. Among them, the target interval is negatively correlated with the risk value, and the target interval is positively correlated with the preset risk interval. In the embodiment of the present application, the risk value can be used to characterize the risk of the client at the time of the last risk analysis, so as to determine the risk trend of the client. The payment risk management server can determine the target interval according to the preset risk analysis interval and the risk value based on the calculation principle that the target interval is negatively correlated with the risk trend of the client, and the target interval is positively correlated with the preset risk interval. Thereby improving the flexibility of the time of initiating risk analysis, reducing transaction risks, and improving the security of funds during transactions. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0020] Figure 1It is a schematic diagram of the system architecture of a risk analysis interval determination method provided in an embodiment of the present application;

[0021] Figure 2 This is a data interaction diagram of a risk analysis interval determination method provided by an embodiment of the present application;

[0022] Figure 3 This is a data interaction diagram of another risk analysis interval determination method provided by an embodiment of the present application;

[0023] Figure 4 It is a flow chart of a method for determining a risk analysis interval provided in an embodiment of the present application;

[0024] Figure 5 It is a functional relationship diagram of a risk analysis interval determination method provided in an embodiment of the present application;

[0025] Figure 6 It is another functional relationship diagram of a risk analysis interval determination method provided in an embodiment of the present application;

[0026] Figure 7 It is a structural schematic diagram of a risk analysis interval determination device provided in an embodiment of the present application;

[0027] Figure 8 It is a structural schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0028] In the following description, specific details such as specific system structures, technologies, etc. are provided for the purpose of illustration rather than limitation, so as to provide a thorough understanding of the embodiments of the present application. However, it should be clear to those skilled in the art that the present application may also be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to prevent unnecessary details from obstructing the description of the present application.

[0029] It should be understood that when used in the present specification and the appended claims, the term "comprising" indicates the presence of described features, wholes, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or combinations thereof.

[0030] It should also be understood that the term “and / or” used in the specification and appended claims refers to any and all possible combinations of one or more of the associated listed items, and includes these combinations.

[0031] As used in the specification and appended claims of this application, the term "if" can be interpreted as "when" or "uponce" or "in response to determining" or "in response to detecting", depending on the context. Similarly, the phrase "if it is determined" or "if [described condition or event] is detected" can be interpreted as meaning "uponce it is determined" or "in response to determining" or "uponce [described condition or event] is detected" or "in response to detecting [described condition or event]", depending on the context.

[0032] In addition, in the description of the present application specification and the appended claims, the terms "first", "second", "third", etc. are only used to distinguish the descriptions and cannot be understood as indicating or implying relative importance.

[0033] References to "one embodiment" or "some embodiments" etc. described in the specification of this application mean that one or more embodiments of the present application include specific features, structures or characteristics described in conjunction with the embodiment. Therefore, the statements "in one embodiment", "in some embodiments", "in some other embodiments", "in some other embodiments", etc. that appear in different places in this specification do not necessarily refer to the same embodiment, but mean "one or more but not all embodiments", unless otherwise specifically emphasized in other ways. The terms "including", "comprising", "having" and their variations all mean "including but not limited to", unless otherwise specifically emphasized in other ways.

[0034] The payment risk management server is one of the important infrastructures to ensure payment security. It can identify potential payment risks through real-time monitoring and analysis of multi-dimensional information such as transaction data, user behavior, payment environment, etc. of payment terminal devices such as POS and COTS (commercial off-the-shelf), and take corresponding measures to prevent and control risks to ensure the security and stability of the payment process.

[0035] In traditional technical solutions, POS, COTS and other payment terminal devices (hereinafter referred to as "clients") can periodically initiate risk analysis requests to the payment risk management server (hereinafter referred to as "servers"). After receiving the risk analysis request, the server conducts risk analysis on the client. According to the risk analysis results, corresponding risk defense measures and risk control measures are taken to improve the security of the transaction environment of POS, COTS and other payment terminal devices.

[0036] However, there is also the risk of abnormal transactions within the preset risk analysis interval, and traditional technical solutions cannot prevent the risk of abnormal transactions occurring within the preset risk analysis interval. The flexibility of the risk analysis initiation method is low, and the security of the payment risk management server is not high.

[0037] In view of this, an embodiment of the present application provides a method for determining a risk analysis interval, which improves the flexibility of the time for initiating risk analysis, thereby reducing transaction risks and improving the security of funds during transactions and the security of the risk management server.

[0038] The technical solution of the embodiments of the present application is described below with reference to the examples in the accompanying drawings.

[0039] Figure 1 A schematic diagram of the system architecture of a risk analysis interval determination method provided in an embodiment of the present application. Figure 1 As shown, the system architecture of the risk analysis interval determination method may include two parts: a client and a server. The client and the server are in a communication connection state. Exemplarily, the client and the server may be connected through a secure channel. The client may be installed with an application that interacts with the server, and the application includes a development tool library, which is used to collect multiple analysis data and send the multiple analysis data to the server to facilitate the server to perform risk analysis.

[0040] The server may include a test module, a monitoring module, an application access module, a message proxy module, and an encryption module. The test module may be used to analyze multiple analysis data to determine the risk analysis results. The monitoring module is used to monitor multiple risk items and send the monitoring results of multiple risk items to the test module. The application access module is used to connect the application to the test module. The message proxy module is used to receive the risk analysis instructions sent by the test module and send the risk analysis instructions to the message queue. The encryption module is used to generate random numbers and asymmetric keys.

[0041] Figure 2 A data interaction diagram of a risk analysis interval determination method provided in an embodiment of the present application. Figure 2 As shown, the data interaction process of the risk analysis interval determination method provided by the present application can be a server, a client, and an application development end, and the user can execute the application development process through the application development end. The server can include a risk management system, a security management system, and a development system. The data interaction process of the risk analysis interval determination method provided by the present application can include the following process:

[0042] A1: The application developer sends an account registration request to the security management system on the server.

[0043] The account registration request is used to register the account for developing applications on the server to enable subsequent application development.

[0044] A2: The security management system on the server side responds to the received account registration request, executes the account registration process, sends the account registration success information to the application development side, and sends the resources required for developing the application to the development system.

[0045] The risk management system is used to execute the account registration process and realize the registration of application development accounts. The resources required for application development may include SDK (Software Development Kit).

[0046] A3: The application development end sends an application development request to the development system on the server side based on the successful account registration information.

[0047] In an embodiment of the present application, the application development end may send an application development request to the development system of the server end to instruct the development system to execute the application development process and obtain an application package.

[0048] A4: The development system on the server sends the application package to the security management system on the server.

[0049] In the embodiment of the present application, after obtaining the application package, the development system of the server sends the application package to the security management system so that the client can obtain and download the application package.

[0050] A5: The security management system on the server side records the application package in response to the received application package.

[0051] In the embodiment of the present application, the security management system of the server can execute the application package filing process through interaction with the risk management system.

[0052] A6: The risk management system on the server side sends a ciphertext to the security management system. The ciphertext is used to indicate that the application package has been successfully registered.

[0053] A7: The client sends an application acquisition request to the security management system on the server to obtain the application package.

[0054] A8: The security management system on the server side sends the application package to the client side in response to the received application acquisition request.

[0055] A9: In response to the received application package, the client installs the application package and sends an initialization verification request to the security management system of the server.

[0056] A10: The security management system on the server generates an identity identifier in response to the received initialization verification request, and sends the identity identifier to the client.

[0057] After receiving the initialization verification request, the server can determine whether the current application is a registered application based on the initialization verification request. If it is a registered application, the server generates a unique identity identifier, which is a random number. And sends the identity identifier to the client. After receiving the identity identifier, the client establishes a communication connection with the server based on the identity identifier. The server can perform risk analysis on the client in the communication connection state and generate risk analysis results.

[0058] Figure 3 A data interaction diagram of another risk analysis interval determination method provided in an embodiment of the present application. Figure 3 As shown, the process of establishing a secure communication connection between the client and the server may include the following steps:

[0059] B1: The client sends an access preparation request to the server. The access request is used to request to establish a communication connection with the server.

[0060] B2: The server performs access preparation processing in response to the received access preparation request.

[0061] In an embodiment of the present application, the server can determine whether the current access environment is in a secure state based on the access preparation request, and if the judgment result is that it is in a secure state, output secure access information.

[0062] B3: The server sends security access information to the client.

[0063] B4: The client generates a key pair in response to the received security access information.

[0064] The key pair may include a public key and a private key, and the key pair is used to mark the initialization verification request to establish a communication connection.

[0065] B5: The client signs the initialization verification request using the private key in the key pair.

[0066] B6: The client sends an initial verification request and public key to the server.

[0067] B7: In response to the received initialization verification request, the server determines whether the current application is a registered application according to the initialization verification request.

[0068] B8: If it is a registered application, the server verifies the received public key and initialization verification request.

[0069] B9: If the verification result of the public key and the initial verification request is verification passed, the server generates a certificate based on the public key and the initial verification request.

[0070] B10: If the verification result of the request to generate the certificate is passed, the server sends a request to generate the certificate to the client.

[0071] B11: The client generates a certificate in response to the received request, and uses the security configuration module to determine the validity of the request to generate the certificate. If it is determined to be a valid request to generate the certificate, the request to generate the certificate is saved to facilitate establishing a secure connection with the server.

[0072] Figure 4 A flow chart of a method for determining a risk analysis interval provided in an embodiment of the present application. Figure 4 As shown, the risk analysis interval determination method provided by the present application may include the following steps:

[0073] Step S401: Obtain the risk value of the client and the preset risk analysis interval. The risk value is the risk value carried by the last risk analysis result corresponding to the client. The risk value is the weighted sum of multiple sub-risk values. Multiple risk items correspond to multiple sub-risk values ​​one by one, and the multiple risk items are different.

[0074] The risk analysis interval determination method provided in the embodiment of the present application can be applied to a payment risk management server, that is, a server, and the server and the client are in a secure communication connection state. The client can be a payment terminal device such as POS, COTS, etc.

[0075] In the embodiment of the present application, the preset risk analysis interval can be a fixed value, for example, the preset risk analysis interval of payment terminal devices such as POS and COTS can be 5 minutes. The preset risk analysis interval can also be other time values, and the present application does not limit the specific value of the preset risk analysis interval.

[0076] The server can send a risk analysis request to a payment terminal device such as POS, COTS, etc. every 5 minutes to determine the risk value of the payment terminal device such as POS, COTS, etc. at the current moment. After calculating the current risk value of the payment terminal device such as POS, COTS, etc., it is stored, and multiple risk values ​​corresponding to multiple moments (time nodes) can be recorded. For example, for the first POS machine, the multiple risk values ​​corresponding to the first POS machine stored by the server may include: time node 17:25-risk value 9.5, time node 17:30-risk value 9.2, time node 17:35-risk value 9.7, time node 17:40-risk value 9.4...time node 19:35-risk value 9.5. If the current time is 19:40, the time when the server last initiated risk analysis was 19:35, and the risk value carried by the last risk analysis result obtained by the server is 9.5.

[0077] In some implementations, the initiator of the risk analysis request may also be a client (POS machine), and the embodiment of the present application does not limit the initiator of the risk analysis request.

[0078] This application takes the server as the initiator of the risk analysis request as an example to exemplify the process of calculating the risk analysis result on the server.

[0079] For example, taking the client as the first POS machine, when the server obtains the risk value of the first POS machine during the last risk analysis, the interaction process between the server and the client (the first POS machine) may include the following steps:

[0080] C1: The server sends a first risk analysis request to the client, where the first risk analysis request is used to obtain configuration information of the client.

[0081] In the embodiment of the present application, after sending the first risk analysis request to the client, the server can record the time when the first risk analysis request is successfully sent as the first time. The time when the first risk analysis request is sent to the client (first POS machine) can also be recorded as the first time, which is not limited in the present application.

[0082] C2: The client obtains configuration information in response to the received first risk analysis request, and sends the configuration information to the server.

[0083] After receiving the first risk analysis request, the client (first POS machine) obtains the configuration information of the current device (first POS machine). The configuration information may include one or more of the device model, software version, processor category, etc. of the first POS machine. This application does not limit the content of the configuration information.

[0084] In an embodiment of the present application, the client can be in a communication connection state with the external card reader and obtain configuration information through the external card reader. Exemplarily, the client can be in a Bluetooth communication connection state with the external card reader. In an embodiment of the present application, the process of establishing a communication connection state between the client and the external card reader can refer to the above steps B1 to B11, and this application will not be repeated here.

[0085] C3: The server obtains multiple risk items corresponding to the configuration information in response to the received configuration information.

[0086] In the embodiment of the present application, a preset risk item comparison table may be provided, and a plurality of different risk items may be provided in the preset risk item comparison table. The server may obtain a plurality of risk items corresponding to the configuration information from the preset risk item comparison table based on the received configuration information. Exemplarily, the server may determine a plurality of risk items corresponding to the device model based on the device model of the client in the configuration information.

[0087] For example, the preset risk item comparison table can be shown in Table 1, including the risk item name, collection specification, risk analysis method and equipment model. The risk item name corresponds to the collection specification and risk analysis method one by one. The collection specification is used to characterize the content of the data to be collected and analyzed corresponding to the risk item, and the risk analysis method is the method used by the server to analyze the risk item.

[0088]

[0089]

[0090]

[0091]

[0092] Table 1

[0093] As shown in Table 1, the server can determine the 18 risk items corresponding to model A based on the device model of the client in the configuration information, which are: whether it is rooted or jailbroken, whether it is an emulator, whether the device is cloned, whether there is an unsafe application, whether it is a low version system, whether the system is downgraded, whether the system is tampered with, whether the network is changed, central processing unit, memory, battery, whether the application is hooked, whether the application is registered, whether the application is tampered with, whether it is a risky application, whether unnecessary libraries are loaded, secure random number health check and application security key consistency.

[0094] C4: The server sends a first risk collection request to the client. The first risk collection request carries multiple risk items. The first risk collection request is used to instruct the client to collect multiple analysis data corresponding to the multiple risk items. The multiple analysis data are used to perform risk analysis on the client.

[0095] Exemplarily, multiple analysis data, as shown in Table 1, can be analysis data corresponding to the collection specification. For example, if multiple risk items include "whether root or jailbroken", in the corresponding collection specification, the data to be obtained is the device information, the data information corresponding to the root and jailbroken flags.

[0096] C5: In response to the received first risk collection request, the client collects a plurality of analysis data corresponding to the plurality of risk items, and sends the plurality of analysis data to the server.

[0097] For example, if the first risk item among the multiple risk items received by the client is "Whether Root or Jailbroken", the analysis data corresponding to the first risk item collected by the client includes: basic information of the device, such as device name, device model, serial number, manufacturer, date of manufacture, etc. Technical parameters of the device, such as device specifications, performance indicators, usage environment, etc. Use and management information of the device, such as purchase date, supplier information, use department, maintenance records, fault records, etc. Additional information of the device, such as device location, warranty period, software version, etc. And whether the device has obtained Root permission and whether the device is jailbroken.

[0098] C6: In response to the received multiple analysis data, the server performs risk analysis on the client according to the multiple analysis data to obtain a risk analysis result, which carries a risk value.

[0099] In an embodiment of the present application, the server may analyze the multiple analysis data one by one according to the multiple analysis data corresponding to the multiple risk items received, and obtain multiple risk sub-values ​​corresponding to the multiple analysis data, and the sum of the multiple risk sub-values ​​is the risk value of the risk analysis result.

[0100] Exemplarily, the calculation formula of the risk value f(r) may be Formula 1:

[0101] Where n represents the number of risk items, r i Represents the risk sub-value corresponding to the i-th analysis data.

[0102] For example, continuing to refer to Table 1, the number of multiple risk items is 18, then the server can receive 18 analysis data. The server can then analyze the 18 risk items one by one based on the 18 analysis data. For the first risk item "Is it Root or Jailbroken", the corresponding first analysis data contains Root=ture, jailbroken≠ture, then the server can determine that the client has obtained Root permissions, but the client has not been jailbroken, and the server can determine that the sub-risk value corresponding to the first analysis data is 1. For the second risk item "Is it a simulator", the corresponding second analysis data carries the information that the device is a simulator, then the server can determine that the sub-risk value corresponding to the second analysis data is 1...For the 18th risk item "Application security key consistency", the corresponding 18th analysis data carries the application security key fingerprint and system filing consistency information, then the server can determine that the sub-risk value corresponding to the 18th analysis data is 0. The server analyzes the 18 risk items one by one and adds up the 18 sub-risk values. It can be seen that the risk value The risk value f(r) is 9.5, so it can be determined that the risk value carried by the risk analysis result is 9.5.

[0103] C7: The server sends the risk analysis results to the client and stores the risk analysis results.

[0104] After the server sends the risk analysis results to the client, it can also store the risk analysis results to facilitate obtaining the risk value.

[0105] In the embodiment of the present application, a risk threshold interval can be preset. If the risk value is greater than the preset maximum risk threshold in the preset risk threshold interval, the risk analysis result carries a first termination instruction, which is used to instruct the client to terminate the current transaction; if the risk value is greater than the preset minimum risk threshold in the preset risk threshold interval, and is less than or equal to the preset maximum risk threshold, the risk analysis result carries a first prompt message, which is used to prompt the client that the current transaction has a transaction risk. If the risk value is less than or equal to the preset minimum risk threshold in the preset risk threshold interval, the risk analysis result does not carry any instruction or prompt message.

[0106] For example, the preset risk threshold interval is (7, 15]. If the risk value is 17, the risk analysis result carries the first termination instruction. If the risk value is 9.5, the risk analysis result carries the first prompt information. If the risk value is 6, the risk analysis result does not carry any instruction or prompt information.

[0107] Step S402: determining a target interval according to a preset risk analysis interval and a risk value, wherein the target interval is negatively correlated with the risk value and positively correlated with the preset risk interval.

[0108] In the embodiment of the present application, in order to ensure that when the risk trend of the POS machine increases, the interval time for risk analysis is shortened, that is, the risk analysis interval is shortened, so as to reduce the financial security of merchants and consumers in high-risk situations. When the risk trend of the POS machine decreases, the interval time for risk analysis is extended, that is, the risk analysis interval is extended to save computing power, reduce operation and maintenance costs, and improve risk analysis efficiency. It can be seen that the target interval (risk analysis interval) is negatively correlated with the risk trend of the POS machine. In the embodiment of the present application, the risk trend can be represented by the risk value of the client.

[0109] Then the calculation formula of the target interval f(x) can be Formula 2:

[0110] Among them, x represents the risk trend, that is, the risk value f(r) in Formula 1, b represents the preset risk analysis interval, and a is the preset value.

[0111] In the embodiment of the present application, when the risk value x is a positive number, the target interval f(x) is proportional to the preset risk analysis interval, and the target interval f(x) is inversely proportional to the risk value x.

[0112] For example, when the preset risk analysis interval b is 5 and the preset value a is 1, the functional relationship between the target interval f(x) and the risk value x can be as follows: Figure 5 As shown, Figure 5 A functional relationship diagram of a risk analysis interval determination method provided in an embodiment of the present application. The horizontal axis represents the risk value x, and the vertical axis represents the target interval f(x).

[0113] In the embodiment of the present application, when the risk value x is a positive number, the functional relationship between the target interval f(x) and the risk value x can be as follows: Figure 6 As shown, Figure 6 Another functional relationship diagram of a risk analysis interval determination method provided in an embodiment of the present application. The horizontal axis represents the risk value x, and the vertical axis represents the target interval f(x). Figure 6 As shown in the figure, the closer the risk value x is to 0, the closer the target interval f(x) is to the maximum value b, that is, the preset risk analysis interval. The larger the risk value x is, the smaller the target interval f(x) is. When the preset risk analysis interval b is 5 and the risk value x is 0, the target interval f(x) is the same as the preset risk analysis interval b.

[0114] When the time of the last risk analysis initiation is N, the time of the next risk analysis initiation is f(x) + N. For example, when the time of the last risk analysis initiation is 19:35, and the target interval f(x) = 4, it can be determined that the time of the next risk analysis initiation is 19:39, that is, the first time is 19:35 and the second time is 19:39.

[0115] In the embodiment of the present application, the preset value a can also be other values, that is, when the risk value x and the preset risk analysis interval b are determined values, the value of the target interval f(x) depends on the preset value a. Setting preset values ​​according to risk scenarios and POS In the embodiment of the present application, the server can set different preset values ​​a according to the actual risk analysis scenario and / or different types of payment terminals such as POS, COTS, etc. The present application does not limit the specific value of the preset value a.

[0116] In the technical solution provided in the embodiment of the present application, the payment risk management server can obtain the risk value and the preset risk analysis interval carried by the last risk analysis result of the client, and determine the target interval according to the preset risk analysis interval and the risk value. Among them, the target interval is negatively correlated with the risk value, and the target interval is positively correlated with the preset risk interval. In the embodiment of the present application, the risk value can be used to characterize the risk of the client at the time of the last risk analysis, so as to determine the risk trend of the client. The payment risk management server can determine the target interval according to the preset risk analysis interval and the risk value based on the calculation principle that the target interval is negatively correlated with the risk trend of the client, and the target interval is positively correlated with the preset risk interval. Thereby improving the flexibility of the time of initiating risk analysis, reducing transaction risks, and improving the security of funds during transactions.

[0117] In an embodiment of the present application, after determining the target interval according to the preset risk analysis interval and the risk value, it can also be determined whether the target interval is greater than the preset risk analysis interval. If the target interval is greater than the preset risk analysis interval, the preset risk analysis interval is used to replace the target interval.

[0118] Exemplarily, according to the calculation formula of the target interval f(x) If the preset value a is a negative number and the absolute value of the preset value a is less than x, the target interval f(x) is greater than the preset risk analysis interval b, and the server can replace the target interval f(x) with the preset risk analysis interval b. For example, if the target interval f(x) is 8 and the preset risk analysis interval b is 5, the target interval f(x) can be set to 5.

[0119] In the technical solution provided in the embodiment of the present application, when the target interval is greater than the preset risk analysis interval, the preset risk analysis interval is used to replace the target interval, which can avoid the situation where the preset risk analysis interval is too long, resulting in excessive transaction risks, thereby further improving the security of funds.

[0120] In the embodiment of the present application, the payment risk management server and the client are in a secure communication connection state, the payment risk management server can monitor the transaction status of the client in real time, and initiate a first risk analysis request according to the transaction status of the client. The specific interaction process between the payment risk management server and the client may include the following steps:

[0121] D1: The payment risk management server sends a status request to the client at the end of the preset connection cycle. The status request is used to obtain the transaction status of the client. The transaction status is a payment status or an idle status.

[0122] D2: The client obtains the transaction status in response to the received status request and sends the transaction status to the payment risk management server.

[0123] D3: The payment risk management server receives the transaction status sent by the client, and determines whether the transaction status is a payment status. If the transaction status is a payment status, the payment risk management server sends a first risk analysis request to the client.

[0124] In the embodiment of the present application, if the payment risk management server determines that the transaction status is a non-payment status, the first risk analysis request is not sent to the client.

[0125] In the technical solution provided by the embodiment of the present application, the payment risk management server (server) can monitor the transaction status of the client in real time, and send a first risk analysis request to the client when the transaction status of the client is a payment status, evaluate the current payment environment, obtain the risk analysis result, and issue a first termination instruction or a first prompt message when the risk analysis result is abnormal, to block possible abnormal transactions, thereby protecting the financial security of merchants and consumers.

[0126] In the technical solution provided in the embodiment of the present application, the user can also send a first risk analysis request to any client that has established a secure communication connection with the payment risk management server through the payment risk management server to evaluate the payment environment in front of the client. Specifically, the user can initiate a risk analysis instruction to the payment risk management server by inputting the client's identity identifier on the payment risk management server (server). After receiving the risk analysis instruction input by the user, the payment risk management server responds to the risk analysis instruction and sends a first risk analysis request to the client based on the client's identity identifier. The technical solution provided by the present application can enhance the flexibility of the risk analysis initiation method, thereby further improving the security of the payment environment.

[0127] It should be understood that, under the premise of no logical conflict, the above-mentioned various application embodiments can be implemented in combination with each other to meet actual application requirements. The specific embodiments or implementation plans obtained after these combinations still fall within the protection scope of this application.

[0128] Corresponding to the risk analysis interval determination method in the above-mentioned embodiment, an embodiment of the present application provides a risk analysis interval determination device 70. The risk analysis interval determination device 70 can be implemented by software, hardware, or a combination of both to become part or all of a computer device, and is used to execute the steps in the risk analysis interval determination method in the above-mentioned embodiment.

[0129] Figure 7 A structural schematic diagram of a risk analysis interval determination device provided in an embodiment of the present application is shown. The risk analysis interval determination device may be a payment risk management server. The payment risk management server and the client are in a secure communication connection state. For ease of explanation, only the parts related to the embodiment of the present application are shown.

[0130] Reference Figure 7 The risk analysis interval determination device 70 includes an acquisition module 710 and a calculation module 720 .

[0131] The acquisition module 710 is used to obtain the risk value of the client and the preset risk analysis interval. The risk value is the risk value carried by the previous risk analysis result corresponding to the client. The risk value is the weighted sum of multiple sub-risk values. Multiple risk items correspond to multiple sub-risk values ​​one by one, and multiple risk items are different.

[0132] The calculation module 720 is used to determine the target interval according to the preset risk analysis interval and the risk value, wherein the target interval is negatively correlated with the risk value and positively correlated with the preset risk interval.

[0133] In some implementations, the risk value is the sum of multiple sub-risk values, the risk value is a positive number, the target interval is proportional to the preset risk interval, and the target interval is inversely proportional to the risk value.

[0134] The calculation module 720 is also used to: send a first risk analysis request to the client, the first risk analysis request is used to obtain the configuration information of the client; in response to the received configuration information, obtain multiple risk items corresponding to the configuration information; send a first risk collection request to the client, the first risk collection request carries multiple risk items, the first risk collection request is used to instruct the client to collect multiple analysis data corresponding to the multiple risk items, the multiple analysis data are used to perform risk analysis on the client; in response to the received multiple analysis data, perform risk analysis on the client according to the multiple analysis data to obtain a risk analysis result, the risk analysis result carries a risk value; send the risk analysis result to the client, and store the risk analysis result.

[0135] The calculation module 720 is also used for: if the risk value is greater than the preset maximum risk threshold, the risk analysis result carries a first termination instruction, and the first termination instruction is used to instruct the client to terminate the current transaction; if the risk value is greater than the preset minimum risk threshold and is less than or equal to the preset maximum risk threshold, the risk analysis result carries a first prompt information, and the first prompt information is used to prompt the client that there is a transaction risk in the current transaction.

[0136] The calculation module 720 is also used to: send a first risk analysis request to the client, and record the moment of sending the first risk analysis request as the first moment; after determining the target interval according to the preset risk analysis interval and the risk value, it also includes: sending a second risk analysis request to the client at a second moment, the second risk analysis request is used to obtain the configuration information of the client, the second moment is separated from the first moment by the target interval, and the second moment is the moment after the first moment.

[0137] The calculation module 720 is further used to: determine whether the target interval is greater than the preset risk analysis interval; if the target interval is greater than the preset risk analysis interval, replace the target interval with the preset risk analysis interval.

[0138] The calculation module 720 is also used to: send a status request to the client at the end time of the preset connection cycle, the status request is used to obtain the transaction status of the client, the transaction status is a payment status or an idle status; receive the transaction status sent by the client; if the transaction status indicates that the transaction status of the client is a payment status, then send a first risk analysis request to the client.

[0139] The calculation module 720 is further configured to: receive a risk analysis instruction input by a user, the risk analysis instruction carrying an identity identifier of the client; and send a first risk analysis request to the client according to the identity identifier of the client in response to the risk analysis instruction.

[0140] It should be noted that the information interaction, execution process, etc. between the above-mentioned devices / units are based on the same concept as the method embodiment of the present application. Their specific functions and technical effects can be found in the method embodiment part and will not be repeated here.

[0141] It should be understood that the size of the serial numbers of the steps in the above embodiments does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0142] Based on the same inventive concept, an embodiment of the present application also provides an electronic device.

[0143] Figure 8 Schematic diagram of the structure of the electronic device provided in the embodiment of the present application. Figure 8 As shown, the electronic device 80 of this embodiment includes: at least one processor 810 ( Figure 8 Only one is shown in the figure), a memory 820, and a communication module 840, wherein the memory 820 stores a computer program 830 that may be run on the processor 810. When the processor 810 executes the computer program 830, the steps in the above-mentioned risk analysis interval determination method embodiment are implemented, such as Figure 4 Alternatively, when the processor 810 executes the computer program 830, the functions of each module / unit in the above-mentioned device embodiments are implemented, for example Figure 7 The functions of modules 710 to 720 are shown, and the communication module 840 can be a separate communication unit for communicating with an external server or terminal device.

[0144] The electronic device 80 may include, but is not limited to: a processor 810 and a memory 820. Those skilled in the art will appreciate that Figure 8 It is only an example of the electronic device 80 and does not constitute a limitation of the electronic device 80. It may include more or fewer components than shown in the figure, or a combination of certain components, or different components. For example, the electronic device 80 may also include an input sending device, a network access device, a bus, etc.

[0145] The processor 810 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or the processor may be any conventional processor, etc.

[0146] In some embodiments, the memory 820 may be an internal storage unit of the electronic device 80, such as a hard disk or memory of the electronic device 80. The memory 820 may also be an external storage device of the electronic device 80, such as a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc. equipped on the electronic device 80. The memory 820 may also include both an internal storage unit of the electronic device 80 and an external storage device. The memory 820 is used to store an operating system, an application program, a boot loader (BootLoader), data, and other programs, such as program codes of a computer program 830, etc. The memory 820 may also be used to temporarily store data that has been sent or is to be sent.

[0147] In addition, those skilled in the art can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example. In actual applications, the above-mentioned functions can be assigned to different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units in each embodiment of the present application can be integrated into a processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units.

[0148] An embodiment of the present application provides a computer-readable storage medium, which stores a computer program. When the computer program runs on an electronic device, the electronic device executes the steps in the above-mentioned method embodiments.

[0149] An embodiment of the present application provides a chip, which includes a processor and a memory. The memory stores a computer program, and when the computer program is executed by the processor, the steps in the above-mentioned method embodiments are implemented.

[0150] An embodiment of the present application provides a computer program product. When the computer program product is run on an electronic device, the electronic device executes the steps in the above-mentioned method embodiments.

[0151] It should be understood that the processor mentioned in the embodiments of the present application may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or the processor may be any conventional processor, etc.

[0152] It should also be understood that the memory mentioned in the embodiments of the present application may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct memory bus random access memory (Direct Rambus RAM, DR RAM).

[0153] The technicians in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In practical applications, the above-mentioned function allocation can be completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiment can be integrated in a processing unit, or each unit can exist physically separately, or two or more units can be integrated in one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the units and modules in the above-mentioned system can refer to the corresponding process in the aforementioned method embodiment, which will not be repeated here.

[0154] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0155] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0156] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the system embodiments described above are merely schematic. For example, the division of the modules or units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0157] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0158] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0159] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present application implements all or part of the processes in the above-mentioned embodiment method, which can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned various method embodiments when executed by the processor. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may at least include: any entity or device capable of carrying the computer program code to a large-screen device, a recording medium, a computer memory, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), an electric carrier signal, a telecommunication signal, and a software distribution medium. For example, a USB flash drive, a mobile hard disk, a magnetic disk or an optical disk. In some jurisdictions, according to legislation and patent practice, computer-readable media cannot be electric carrier signals and telecommunication signals.

[0160] Finally, it should be noted that the above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A method for determining a risk analysis interval, characterized in that: The method is applied to a payment risk management server, the payment risk management server and a client are in a secure communication connection state, and the method includes: Obtaining a risk value of the client and a preset risk analysis interval, wherein the risk value is a risk value carried by a previous risk analysis result corresponding to the client, the risk value is a weighted sum of multiple sub-risk values, multiple risk items correspond to the multiple sub-risk values ​​one by one, and the multiple risk items are different from each other; A target interval is determined according to the preset risk analysis interval and the risk value, wherein the target interval is negatively correlated with the risk value and positively correlated with the preset risk interval.

2. The method according to claim 1, characterized in that The risk value is the sum of the multiple sub-risk values, the risk value is a positive number, the target interval is proportional to the preset risk interval, and the target interval is inversely proportional to the risk value.

3. The method according to claim 1, characterized in that Before obtaining the risk value of the client and the preset risk analysis interval, the method further includes: Sending a first risk analysis request to the client, where the first risk analysis request is used to obtain configuration information of the client; In response to the received configuration information, acquiring the plurality of risk items corresponding to the configuration information; Sending a first risk collection request to the client, the first risk collection request carrying the multiple risk items, the first risk collection request being used to instruct the client to collect multiple analysis data corresponding to the multiple risk items, the multiple analysis data being used to perform risk analysis on the client; In response to the received multiple analysis data, performing risk analysis on the client according to the multiple analysis data to obtain a risk analysis result, wherein the risk analysis result carries a risk value; The risk analysis result is sent to the client and stored.

4. The method according to claim 3, characterized in that If the risk value is greater than a preset maximum risk threshold, the risk analysis result carries a first termination instruction, and the first termination instruction is used to instruct the client to terminate the current transaction; If the risk value is greater than a preset minimum risk threshold and less than or equal to a preset maximum risk threshold, the risk analysis result carries a first prompt information, and the first prompt information is used to prompt the client that there is a transaction risk in the current transaction.

5. The method according to claim 3, characterized in that: The sending a first risk analysis request to the client includes: Sending the first risk analysis request to the client, and recording the time when the first risk analysis request is sent as the first time; After determining the target interval according to the preset risk analysis interval and the risk value, the method further includes: A second risk analysis request is sent to the client at a second moment, where the second risk analysis request is used to obtain configuration information of the client, the second moment is separated from the first moment by the target interval, and the second moment is a moment after the first moment.

6. The method according to claim 1, characterized in that After determining the target interval according to the preset risk analysis interval and the risk value, the method further includes: Determining whether the target interval is greater than the preset risk analysis interval; If the target interval is greater than the preset risk analysis interval, the preset risk analysis interval is used to replace the target interval.

7. The method according to any one of claims 1 to 6, characterized in that: The method further comprises: Sending a status request to the client at the end time of a preset connection cycle, wherein the status request is used to obtain the transaction status of the client, wherein the transaction status is a payment status or an idle status; Receiving the transaction status sent by the client; If the transaction status indicates that the transaction status of the client is the payment status, a first risk analysis request is sent to the client.

8. The method according to claim 7, characterized in that The sending a first risk analysis request to the client includes: receiving a risk analysis instruction input by a user, wherein the risk analysis instruction carries an identity identifier of the client; In response to the risk analysis instruction, the first risk analysis request is sent to the client according to the identity identifier of the client.

9. An electronic device, characterized in that: The method comprises a processor and a memory, wherein the processor is configured to execute a computer program stored in the memory to implement the method as claimed in any one of claims 1 to 8.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the method as described in any one of claims 1 to 8 is implemented.

Images