Security management system for online transaction

Abstract

The invention relates to the field of online transaction management, in particular to a security management system for online transactions, which is provided with a data storage module for storing historical security request characteristics of a user side; the request analysis module is connected with the data storage module and is used for determining a request security characterization value of the user side based on the security request features stored by the data storage module so as to analyze a transaction order request security category of the user side; and the security analysis module is respectively connected with the data storage module and the request analysis module and is used for adaptively identifying and processing the transaction order request submitted by the user side in response to an analysis result of the request analysis. The security degree of the transaction is identified according to the real-time state stage of the transaction order and the operation implemented by the user side on the transaction order, the online transaction risk is reduced, and the transaction security is ensured.

Description

Technical Field

[0001] The present invention relates to the field of online transaction management, and in particular to a security management system for online transactions. Background Art

[0002] With the development of the Internet and related technologies, online transactions have gradually become common. In order to protect transaction security, it is necessary to continuously update and strengthen safe transaction technologies, and require that the measures implemented to ensure transaction security can adapt to the changing market environment, protect the rights and interests of consumers and merchants, and the security of online transaction behaviors.

[0003] Chinese patent publication number: CN116228344A, discloses a two-way online transaction method and system, which includes: a deployment control unit determines whether the item required by the buyer is in the resource library, and when it is determined that it is in the resource library, the data operation unit determines whether the complete parameters of the item meet the standards based on the image of the acquired item, and corrects the screening accuracy of the item when it does not meet the standards. When it meets the standards, the data operation unit calculates the buyer's attention parameters for the item; the deployment control unit determines whether the matching degree of the pushed item information is qualified according to the buyer's browsing time, and adjusts the attention parameters when it does not meet the standards; the data operation unit calculates the seller's reputation value, and the deployment control unit determines whether to give priority to pushing the seller's items based on the comparison result of the reputation value and the preset reputation value, and sends a risk prompt when pushing the seller's items whose reputation value is less than the preset reputation value; further improves the efficiency and security of transactions between the two parties.

[0004] However, there are still the following problems in the prior art:

[0005] It only considers security issues such as account anomalies of the account that submits the transaction order application, but does not consider the operations performed by the user after the transaction order is confirmed. For example, frequent changes in order information may also affect the security of the transaction and create transaction risks. Summary of the invention

[0006] To this end, the present invention provides an online transaction security management system to overcome the problem in the prior art that only security issues such as account anomalies existing in the account that submits the transaction order application are considered, while not considering the operational behaviors performed by the user end after confirming the transaction order, which may also affect the security of the transaction and generate transaction risks.

[0007] To achieve the above object, the present invention provides a system for online transaction security management, which comprises:

[0008] A data storage module, used to store historical security request characteristics of the user terminal, wherein the security request characteristics include the number of requests for a single transaction order and the number of times the user terminal cancels the transaction order request within a predetermined time period;

[0009] A request analysis module connected to the data storage module, used to determine the request security characterization value of the user terminal based on the historical security request characteristics stored in the data storage module, so as to analyze the security category of the transaction order request of the user terminal;

[0010] A security analysis module, which is connected to the data storage module and the request analysis module respectively, is used to respond to the analysis result of the request analysis and identify and process the transaction order request submitted by the user end, including:

[0011] Acquire the status stage of the transaction order, set a corresponding level label for each status stage, parse the transaction abnormality characterization coefficient for a single transaction order according to the level importance corresponding to the level label of each status stage and the modification frequency of the transaction order in the status stage, determine whether the transaction order request meets the transaction security standard based on the transaction abnormality characterization coefficient, and determine whether to terminate the transaction;

[0012] Or, based on the transaction order request submitted by the user terminal, the corresponding security key is fed back to query the transaction order status stage.

[0013] Furthermore, the request analysis module is used to determine the request security characterization value of the user terminal based on the historical security request characteristics stored in the data storage module, including:

[0014] It is used to determine the ratio of the number of requests for a single transaction order to the request number threshold and assign a corresponding weight coefficient as the first security feature;

[0015] To determine the ratio of the number of times the user terminal cancels the transaction order request within a predetermined time period to the number threshold and assign a corresponding weight coefficient as the second security feature;

[0016] The method is used to determine a sum of the first security feature and the second security feature as a requested security characterization value.

[0017] Furthermore, the request analysis module is used to analyze the security category of the transaction order request of the user terminal, including:

[0018] If the requested security token value is greater than or equal to the requested security token threshold, the user's transaction order request is determined to be of the weak security category;

[0019] If the requested security token value is less than the requested security token threshold, the transaction order request from the user side is determined to be a strong security category.

[0020] Furthermore, the security analysis module is used to respond to the analysis result of the request analysis, and identify and process the transaction order request submitted by the user end, including:

[0021] If the request from the user end is of the weak security category, the status stage of the transaction order is obtained, and a corresponding level label is set for each of the status stages. According to the level importance corresponding to the level label of each status stage and the modification frequency of the transaction order in the status stage, the transaction abnormality characterization coefficient for a single transaction order is parsed, and based on the transaction abnormality characterization coefficient, it is determined whether the transaction order request meets the transaction security standard, so as to determine whether to terminate the transaction;

[0022] If the request from the user end is of the strong security category, the transaction order status stage is queried based on the transaction order request submitted by the user end to feedback the corresponding security key.

[0023] Furthermore, the security analysis module is used to set corresponding level labels for each state stage, including:

[0024] The status stages include the stage of waiting for payment, the stage of waiting for shipment and the stage of waiting for receipt;

[0025] The level labels of the status stages are arranged in ascending order.

[0026] Furthermore, the security analysis module is used to analyze the transaction anomaly characterization coefficient for a single transaction, including:

[0027] The ratio of the modification frequency of trading orders in the status stage to the modification frequency threshold is used as an abnormal feature;

[0028] The product of the abnormal feature and the level importance corresponding to the level label of the status stage is determined as the transaction abnormality characterization coefficient.

[0029] Furthermore, the security analysis module is used to determine whether the transaction order request meets the transaction security standard based on the transaction abnormality characterization coefficient, including:

[0030] If the transaction anomaly characterization coefficient is greater than or equal to the transaction anomaly characterization coefficient threshold, it is determined that the transaction order request does not meet the transaction security standard.

[0031] Furthermore, the security analysis module is used to determine whether to terminate the transaction, including:

[0032] If the transaction order request does not meet the transaction security standards, the transaction will be terminated.

[0033] Furthermore, the security key is generated randomly.

[0034] Furthermore, it also includes an abnormal marking module, which is connected to the security parsing module and is used to mark the user terminal as abnormal based on the parsing result of the security parsing module.

[0035] Compared with the prior art, the present invention provides a data storage module for storing historical security request features of the user end; a request analysis module, which is connected to the data storage module, for determining the request security characterization value of the user end based on the security request features stored in the data storage module, so as to analyze the security category of the transaction order request of the user end; a security parsing module, which is respectively connected to the data storage module and the request analysis module, for responding to the analysis results of the request analysis, and adaptively identifying and processing the transaction order request submitted by the user end. Under the premise of ensuring data reliability, the present invention identifies the security level of the transaction according to the real-time status stage of the transaction order and the operations performed by the user end on the transaction order, thereby reducing online transaction risks and ensuring transaction security.

[0036] In particular, the present invention determines the request security characterization value of the user terminal based on the historical security request characteristics. In actual situations, for a single transaction order, usually only one request needs to be submitted, and there may be situations where multiple requests are submitted. For example, the product specifications included in the order are selected incorrectly, the delivery address needs to be changed, etc., and there will not be too many requests for a single transaction order. Similarly, frequent cancellation of transaction orders in a short period of time is also an abnormal situation. The above situation indicates that the user terminal may be testing the payment system or making fraud attempts. Therefore, the present application identifies representative security request characteristics through the historical behavior data of the user terminal to determine the request security characterization value of the user terminal to characterize the abnormal tendency of the user terminal submitting the transaction order request and the security level of the pre-transaction behavior, so as to provide data support for the subsequent analysis of the transaction order request security category of the user terminal, and adaptively identify and process the transaction order request submitted by the user terminal. The present invention ensures the security of transactions through effective historical behavior data analysis and the risk level of transaction behaviors generated by the user terminal.

[0037] In particular, the present invention analyzes the security category of the transaction order request of the user end, and selects different identification and processing methods for different security categories of the transaction order request. In the strong security category, since the historical operation behavior of the user end belongs to the normal transaction scope and there is no abnormal behavior, when the user end submits the transaction order request, the background responds to the received request and feeds back the corresponding security key, so that the user end can query the order status stage later; in the weak security category, since the operation behavior implemented by the user end is constantly changing, the order status may be in any stage during the time interval when the abnormal behavior occurs, that is, the user end at each order status stage has the probability of implementing frequent abnormal behaviors, and the risk coefficient has the possibility of increasing. Combined with the representative order modification frequency in different order status stages, the transaction abnormality characterization coefficient for a single transaction order is analyzed to characterize the abnormal degree of the transaction behavior at any stage and the degree of change of the risk coefficient, so as to provide data support for the subsequent determination of whether the above transaction order request meets the transaction security standard, so as to determine the continuation or immediate termination of the transaction behavior, and reduce the risk of online transactions and ensure the security of online transactions on the premise of ensuring data reliability.

[0038] In particular, the security key fed back to the user end in the present invention is randomly generated, which ensures the security of the key while increasing the difficulty of cracking. It can ensure that the real-time information of each stage of the transaction can only be queried by the user end and the background, thereby improving the security of the transaction and protecting the privacy information of the user end. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 A functional module diagram of an online transaction security management system according to an embodiment of the invention;

[0040] Figure 2 A logical decision diagram for analyzing the security category of a request from a user end for an embodiment of the invention;

[0041] Figure 3 A logical decision diagram for determining whether a transaction order request meets transaction security standards for an embodiment of the invention;

[0042] Figure 4 A logical decision diagram for determining whether to terminate a transaction according to an embodiment of the present invention. DETAILED DESCRIPTION

[0043] In order to make the objects and advantages of the present invention more clearly understood, the present invention is further described below in conjunction with embodiments; it should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0044] The preferred embodiments of the present invention are described below with reference to the accompanying drawings. It should be understood by those skilled in the art that these embodiments are only used to explain the technical principles of the present invention and are not intended to limit the protection scope of the present invention.

[0045] In addition, it should be noted that in the description of the present invention, unless otherwise clearly specified and limited, the term "connection" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection. For those skilled in the art, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0046] See also Figures 1 to 4 As shown, Figure 1 This is a functional module diagram of an online transaction security management system according to an embodiment of the present invention. Figure 2 A logical decision diagram for analyzing the security category of a request from a user terminal according to an embodiment of the present invention, Figure 3 A logical decision diagram for determining whether a transaction order request meets transaction security standards according to an embodiment of the present invention. Figure 4 This is a logic decision diagram for determining whether to terminate a transaction in an embodiment of the present invention. The online transaction security management system in an embodiment of the present invention includes:

[0047] A data storage module, used to store historical security request characteristics of the user terminal, wherein the security request characteristics include the number of requests for a single transaction order and the number of times the user terminal cancels the transaction order request within a predetermined time period;

[0048] A request analysis module connected to the data storage module, used to determine the request security characterization value of the user terminal based on the historical security request characteristics stored in the data storage module, so as to analyze the security category of the transaction order request of the user terminal;

[0049] A security analysis module, which is connected to the data storage module and the request analysis module respectively, is used to respond to the analysis result of the request analysis and identify and process the transaction order request submitted by the user end, including:

[0050] Acquire the status stage of the transaction order, set a corresponding level label for each status stage, parse the transaction abnormality characterization coefficient for a single transaction order according to the level importance corresponding to the level label of each status stage and the modification frequency of the transaction order in the status stage, determine whether the transaction order request meets the transaction security standard based on the transaction abnormality characterization coefficient, and determine whether to terminate the transaction;

[0051] Or, based on the transaction order request submitted by the user terminal, the corresponding security key is fed back to query the transaction order status stage.

[0052] Specifically, there is no limitation on the specific structures of the data storage module, request analysis module and security parsing module, and they themselves or each unit therein can be composed of logical components or a combination of logical components, and the logical components include a field programmable processor, a computer or a microprocessor in a computer.

[0053] Specifically, the request analysis module is used to determine the request security representation value of the user terminal based on the historical security request characteristics stored in the data storage module, including:

[0054] It is used to determine the ratio of the number of requests for a single transaction order to the request number threshold and assign a corresponding weight coefficient as the first security feature;

[0055] To determine the ratio of the number of times the user terminal cancels the transaction order request within a predetermined time period to the number threshold and assign a corresponding weight coefficient as the second security feature;

[0056] The method is used to determine a sum of the first security feature and the second security feature as a requested security characterization value.

[0057] In this embodiment, when performing weighted summation, the weight of the first security feature is set to 0.55, and the weight of the second security feature is set to 0.45;

[0058] The request number threshold Q0 for a single transaction order and the number threshold X0 for the number of transaction order cancellation requests by the user end within a predetermined time period are preset, and the relevant data of several completed online transactions are obtained, and the request number data of a single transaction order and the number of transaction order cancellation requests within a predetermined time period are called to solve the average number of requests and the average number of transaction order cancellation requests. The request number threshold is set to between 1.01 and 1.07 times the average number of requests, and the transaction order cancellation request threshold is set to between 1.08 and 1.14 times the average number of transaction order cancellation requests.

[0059] It is understandable that the predetermined time period can be determined based on the frequency of the user's order transaction request behavior, the average time for completing several transaction request behaviors of the user, and the frequency of updating the goods that need to be traded, which will not be elaborated here.

[0060] The present invention determines the request security characterization value of the user terminal based on the historical security request characteristics. In actual situations, for a single transaction order, usually only one request needs to be submitted, and there may be situations where multiple requests are submitted. For example, the product specifications included in the order are selected incorrectly, the delivery address needs to be changed, etc., and there will not be too many requests for a single transaction order. Similarly, frequent cancellation of transaction orders in a short period of time is also an abnormal situation. The above situation indicates that the user terminal may be testing the payment system or making fraud attempts. Therefore, the present application identifies representative security request characteristics through the historical behavior data of the user terminal to determine the request security characterization value of the user terminal to characterize the abnormal tendency of the user terminal submitting the transaction order request and the security level of the pre-occurring transaction behavior, so as to provide data support for the subsequent analysis of the transaction order request security category of the user terminal, adaptively identify and process the transaction order request submitted by the user terminal, and provide data support. The present invention ensures the security of transactions through effective historical behavior data analysis and the risk level of transaction behaviors generated by the user terminal.

[0061] Specifically, the request analysis module is used to analyze the security category of the transaction order request of the user terminal, including:

[0062] If the requested security token value is greater than or equal to the requested security token threshold, the user's transaction order request is determined to be of the weak security category;

[0063] If the requested security token value is less than the requested security token threshold, the transaction order request from the user side is determined to be a strong security category.

[0064] The security characterization threshold S0 is requested to be selected in the interval [1.21,1.34].

[0065] Specifically, the security parsing module is used to respond to the analysis result of the request analysis and identify the transaction order request submitted by the user end, including:

[0066] If the request from the user end is of the weak security category, the status stage of the transaction order is obtained, and a corresponding level label is set for each of the status stages. According to the level importance corresponding to the level label of each status stage and the modification frequency of the transaction order in the status stage, the transaction abnormality characterization coefficient for a single transaction order is parsed, and based on the transaction abnormality characterization coefficient, it is determined whether the transaction order request meets the transaction security standard, so as to determine whether to terminate the transaction;

[0067] If the request from the user end is of the strong security category, the transaction order status stage is queried based on the transaction order request submitted by the user end to feedback the corresponding security key.

[0068] Specifically, the security parsing module is used to set corresponding level labels for each state stage, including:

[0069] The status stages include the stage of waiting for payment, the stage of waiting for shipment and the stage of waiting for receipt;

[0070] The level labels of the status stages are arranged in ascending order.

[0071] In this embodiment, the level labels are set in the following manner:

[0072] There are three status stages, and three level labels are set in ascending order based on the status stages;

[0073] The stage of waiting for payment is the third-level label 3; the stage of waiting for delivery is the second-level label 2; the stage of waiting for receipt is the third-level label 1;

[0074] Among them, the level importance corresponding to the third-level label is 30%; the level importance corresponding to the second-level label is 50%; and the level importance corresponding to the first-level label is 70%.

[0075] Specifically, the security analysis module is used to analyze the transaction anomaly characterization coefficient for a single transaction, including:

[0076] The ratio of the modification frequency of trading orders in the status stage to the modification frequency threshold is used as an abnormal feature;

[0077] The product of the abnormal feature and the level importance corresponding to the level label of the status stage is determined as the transaction abnormality characterization coefficient.

[0078] The transaction order modification frequency in the status stage is pre-set. The transaction order modification frequency data of the user-side order transaction behaviors that have been completed several times are called to solve the average transaction order modification frequency. The transaction order modification frequency threshold is set to between 1.01 and 1.05 times the average transaction order modification frequency.

[0079] Specifically, the security parsing module is used to determine whether the transaction order request meets the transaction security standard based on the transaction abnormality characterization coefficient, including:

[0080] If the transaction abnormality characterization coefficient is greater than or equal to the transaction abnormality characterization coefficient threshold, it is determined that the transaction order request does not meet the transaction security standard;

[0081] If the transaction anomaly characterization coefficient is less than the transaction anomaly characterization coefficient threshold, it is determined that the transaction order request meets the transaction security standard.

[0082] It can be understood that the transaction abnormality characterization coefficient threshold is determined according to the state stage of the transaction order, where:

[0083] If the status stage of the transaction order is in the stage of waiting for payment, the transaction abnormality characterization coefficient threshold C0 is selected in the interval [0.36, 0.47];

[0084] If the status stage of the transaction order is in the stage of waiting for delivery, the transaction abnormality representation coefficient threshold C0 is selected in the interval [0.54, 0.69];

[0085] If the status stage of the transaction order is in the stage of waiting for receipt, the transaction abnormality characterization coefficient threshold C0 is selected in the interval [0.78, 0.96].

[0086] Specifically, the security parsing module is used to determine whether to terminate the transaction, including:

[0087] If the transaction order request does not meet the transaction security standards, the transaction will be terminated;

[0088] If the transaction order request meets the transaction security standards, there is no need to terminate the transaction.

[0089] The present invention analyzes the security category of the transaction order request of the user end, and selects different identification and processing methods for different security categories of the transaction order request. In the strong security category, since the historical operation behavior of the user end belongs to the normal transaction scope and there is no abnormal behavior, when the user end submits the transaction order request, the background responds to the received request and feeds back the corresponding security key, so that the user end can query the order status stage later; in the weak security category, since the operation behavior implemented by the user end is constantly changing, the order status may be in any stage during the time interval when the abnormal behavior occurs, that is, the user end in each order status stage has the probability of implementing frequent abnormal behaviors, and the risk coefficient has the possibility of increasing. In combination with the representative order modification frequency in different order status stages, the transaction abnormality characterization coefficient for a single transaction order is analyzed to characterize the abnormal degree of the transaction behavior in any stage and the degree of change of the risk coefficient, so as to provide data support for the subsequent determination of whether the above-mentioned transaction order request meets the transaction security standard, so as to determine the continuation or immediate termination of the transaction behavior, reduce the risk of online transactions and ensure the security of online transactions on the premise of ensuring data reliability.

[0090] Specifically, it also includes that the security key is randomly generated.

[0091] Specifically, there is no limitation on the specific method of randomly generating security keys, and random security keys can be generated through relevant password generation tools, for example, through Keepass. It can be understood that since the security keys are randomly generated, the difficulty of key cracking can be increased to ensure the security of transaction information.

[0092] Specifically, it also includes an abnormal marking module, which is connected to the security parsing module and is used to mark the user terminal as abnormal based on the parsing result of the security parsing module.

[0093] It is understandable that there is no limitation on the specific method of marking the user terminal as abnormal. The user terminal may be labeled as a "suspected risk user" through the background. Of course, other forms may also be used, which will not be elaborated here.

[0094] The security key fed back to the user end in the present invention is randomly generated, which ensures the security of the key while increasing the difficulty of cracking. It can ensure that the real-time information of each stage of the transaction can only be queried by the user end and the background, thereby improving the security of the transaction and protecting the privacy information of the user end.

[0095] So far, the technical solutions of the present invention have been described in conjunction with the preferred embodiments shown in the accompanying drawings. However, it is easy for those skilled in the art to understand that the protection scope of the present invention is obviously not limited to these specific embodiments. Without departing from the principle of the present invention, those skilled in the art can make equivalent changes or substitutions to the relevant technical features, and the technical solutions after these changes or substitutions will fall within the protection scope of the present invention.

Claims

1. A security management system for online transactions, characterized in that: include: A data storage module, used to store historical security request characteristics of the user terminal, wherein the security request characteristics include the number of requests for a single transaction order and the number of times the user terminal cancels the transaction order request within a predetermined time period; A request analysis module connected to the data storage module, used to determine the request security characterization value of the user terminal based on the historical security request characteristics stored in the data storage module, so as to analyze the security category of the transaction order request of the user terminal; A security analysis module, which is connected to the data storage module and the request analysis module respectively, is used to respond to the analysis result of the request analysis and identify and process the transaction order request submitted by the user end, including: Acquire the status stage of the transaction order, set a corresponding level label for each status stage, parse the transaction abnormality characterization coefficient for a single transaction order according to the level importance corresponding to the level label of each status stage and the modification frequency of the transaction order in the status stage, determine whether the transaction order request meets the transaction security standard based on the transaction abnormality characterization coefficient, and determine whether to terminate the transaction; Or, based on the transaction order request submitted by the user terminal, the corresponding security key is fed back to query the transaction order status stage.

2. The online transaction security management system according to claim 1, characterized in that: The request analysis module is used to determine the request security characterization value of the user terminal based on the historical security request characteristics stored in the data storage module, including: It is used to determine the ratio of the number of requests for a single transaction order to the request number threshold and assign a corresponding weight coefficient as the first security feature; To determine the ratio of the number of times the user terminal cancels the transaction order request within a predetermined time period to the number threshold and assign a corresponding weight coefficient as the second security feature; The method is used to determine a sum of the first security feature and the second security feature as a requested security characterization value.

3. The online transaction security management system according to claim 1, characterized in that: The request analysis module is used to analyze the security category of the transaction order request of the user terminal, including: If the requested security token value is greater than or equal to the requested security token threshold, the user's transaction order request is determined to be of the weak security category; If the requested security token value is less than the requested security token threshold, the transaction order request from the user side is determined to be a strong security category.

4. The online transaction security management system according to claim 1, characterized in that: The security analysis module is used to respond to the analysis result of the request analysis and identify and process the transaction order request submitted by the user end, including: If the request from the user end is of the weak security category, the status stage of the transaction order is obtained, and a corresponding level label is set for each of the status stages. According to the level importance corresponding to the level label of each status stage and the modification frequency of the transaction order in the status stage, the transaction abnormality characterization coefficient for a single transaction order is parsed, and based on the transaction abnormality characterization coefficient, it is determined whether the transaction order request meets the transaction security standard, so as to determine whether to terminate the transaction; If the request from the user end is of the strong security category, the transaction order status stage is queried based on the transaction order request submitted by the user end to feedback the corresponding security key.

5. The online transaction security management system according to claim 1, characterized in that: The security analysis module is used to set corresponding level labels for each state stage, including: The status stages include the stage of waiting for payment, the stage of waiting for shipment and the stage of waiting for receipt; The level labels of the status stages are arranged in ascending order.

6. The online transaction security management system according to claim 1, characterized in that: The security analysis module is used to analyze the transaction anomaly characterization coefficient for a single transaction, including: The ratio of the modification frequency of trading orders in the status stage to the modification frequency threshold is used as an abnormal feature; The product of the abnormal feature and the level importance corresponding to the level label of the status stage is determined as the transaction abnormality characterization coefficient.

7. The online transaction security management system according to claim 1, characterized in that: The security analysis module is used to determine whether the transaction order request meets the transaction security standard based on the transaction abnormality characterization coefficient, including: If the transaction anomaly characterization coefficient is greater than or equal to the transaction anomaly characterization coefficient threshold, it is determined that the transaction order request does not meet the transaction security standard.

8. The online transaction security management system according to claim 1, characterized in that: The security analysis module is used to determine whether to terminate the transaction, including: If the transaction order request does not meet the transaction security standards, the transaction will be terminated.

9. The online transaction security management system according to claim 1, characterized in that: It also includes that the security key is randomly generated.

10. The online transaction security management system according to claim 1, characterized in that: It also includes an abnormal marking module, which is connected to the security parsing module and is used to mark the user terminal as abnormal based on the parsing result of the security parsing module.

Images