Information processing method and related device

Abstract

The invention discloses an information processing method and a related device. The method comprises the following steps: acquiring a target information detection quantity corresponding to a target information processing link; and when the target information detection quantity is greater than the preset detection quantity, carrying out risk control on the target information processing link. On the basis of the target information detection quantity, a newly added target sample in the target sample library is verified, and a verification result of the newly added target sample is obtained; when the verification result shows that the newly added target sample comprises a non-target sample, deleting the non-target sample from the target sample library and relieving risk control; and when the verification result shows that the newly added target sample does not include the non-target sample, increasing the preset detection amount in a first preset time period and releasing risk control. According to the method, the situation that the non-target sample is mistakenly added to the target sample library can be accurately and timely found, the non-target sample is deleted from the target sample library to relieve risk control, normal information corresponding to the non-target sample is prevented from being mistakenly intercepted, and the interception accuracy of the target information is improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to an information processing method and related devices. Background Art

[0002] In information communication scenarios based on communication software, the amount of communication information is huge. In order to prevent malicious information and other target information from being sent to normal users in the information communication scenarios, it is necessary to intercept malicious information and other target information from the huge amount of communication information.

[0003] In related technologies, the desensitized features of historical malicious information are usually added as target samples to the target sample library to determine whether the similarity between the communication information and the target samples in the target sample library reaches a preset similarity. If so, the communication information is treated as target information such as malicious information and intercepted.

[0004] However, there is a certain probability that non-target samples are mistakenly added to the target sample library, which causes the normal information corresponding to the non-target sample to be mistakenly intercepted, reducing the interception accuracy of target information such as malicious information, thereby reducing the information communication experience. Summary of the invention

[0005] In order to solve the above technical problems, the present application provides an information processing method and related devices, which can accurately and timely detect the situation where non-target samples are mistakenly added to the target sample library, and delete the non-target samples from the target sample library in this case to avoid the normal information corresponding to the non-target samples from being mistakenly intercepted, thereby improving the interception accuracy of the target information and thus improving the information communication experience.

[0006] The embodiments of the present application disclose the following technical solutions:

[0007] On the one hand, an embodiment of the present application provides an information processing method, the method comprising:

[0008] Obtaining the target information detection amount corresponding to the target information processing link;

[0009] If the target information detection amount is greater than the preset detection amount, risk control is performed on the target information processing link;

[0010] Verifying the newly added target samples in the target sample library according to the target information detection amount to obtain the verification result of the newly added target samples;

[0011] If the verification result indicates that the newly added target samples include non-target samples, the non-target samples are deleted from the target sample library, and the risk control is released;

[0012] If the verification result indicates that the newly added target samples do not include the non-target samples, the preset detection amount is increased within a first preset time period and the risk control is released.

[0013] On the other hand, an embodiment of the present application provides an information processing device, the device comprising: an acquisition unit, a control unit, a verification unit, and a release unit;

[0014] The acquisition unit is used to acquire the target information detection amount corresponding to the target information processing link;

[0015] The control unit is used to perform risk control on the target information processing link if the target information detection amount is greater than a preset detection amount;

[0016] The verification unit is used to verify the newly added target sample in the target sample library according to the target information detection amount, and obtain the verification result of the newly added target sample;

[0017] The release unit is configured to delete the non-target sample from the target sample library and release the risk control if the verification result indicates that the newly added target sample includes a non-target sample;

[0018] The release unit is further configured to increase the preset detection amount within a first preset time period and release the risk control if the verification result indicates that the newly added target sample does not include the non-target sample.

[0019] On the other hand, an embodiment of the present application provides a computer device, the computer device comprising a processor and a memory:

[0020] The memory is used to store a computer program and transmit the computer program to the processor;

[0021] The processor is configured to execute the method described in any one of the preceding aspects according to instructions in the computer program.

[0022] On the other hand, an embodiment of the present application provides a computer-readable storage medium, which is used to store a computer program. When the computer program runs on a computer device, the computer device executes the method described in the above aspects.

[0023] On the other hand, an embodiment of the present application provides a computer program product, including a computer program, which, when executed on a computer device, enables the computer device to execute the method described in the above aspects.

[0024] It can be seen from the above technical solution that, first, the target information detection amount corresponding to the target information processing link is obtained; it is determined whether the target information detection amount is greater than the preset detection amount, and if so, risk control is performed on the target information processing link. This method can quickly and timely discover the situation where the target information processing link has an abnormal sudden increase in the target information detection amount by determining whether the target information detection amount corresponding to the target information processing link exceeds the preset detection amount, and in this case, risk control is performed on the target information processing link. Then, based on the target information detection amount, the newly added target samples in the target sample library are verified to obtain the verification results of the newly added target samples; when the verification results indicate that the newly added target samples include non-target samples, the non-target samples are deleted from the target sample library and the risk control is lifted; when the verification results indicate that the newly added target samples do not include non-target samples, the preset detection amount is increased within the first preset time period and the risk control is lifted. This method verifies whether the newly added target samples in the target sample library corresponding to the target information detection amount are non-target samples. This method can not only increase the threshold of the abnormal sudden increase in the target information detection amount in the target information processing link when the non-target samples are not mistakenly added to the target sample library, and promptly release the risk control to correctly add the target samples to the target sample library or correctly intercept the target information; it can also accurately and promptly discover the situation where non-target samples are mistakenly added to the target sample library, and in this case delete the non-target samples from the target sample library, release the risk control, so as to avoid the normal information corresponding to the non-target samples from being mistakenly intercepted, improve the interception accuracy of the target information, and thus enhance the information communication experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technical members in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0026] Figure 1 A schematic diagram of the system architecture of an information processing method provided in an embodiment of the present application;

[0027] Figure 2 A flowchart of an information processing method provided in an embodiment of the present application;

[0028] Figure 3 A schematic diagram of a malicious sample adding process provided in an embodiment of the present application;

[0029] Figure 4 A schematic diagram of a malicious information interception link provided in an embodiment of the present application;

[0030] Figure 5A configuration interface diagram of risk control based on target information processing provided in an embodiment of the present application;

[0031] Figure 6 A risk control interface diagram based on target information processing provided in an embodiment of the present application;

[0032] Figure 7 A risk processing flow chart of a malicious sample adding link and a malicious information interception link in an information communication scenario provided by an embodiment of the present application;

[0033] Figure 8 A structural diagram of an information processing device provided in an embodiment of the present application;

[0034] Fig. 9 A structural diagram of a server provided in an embodiment of the present application;

[0035] Fig.10 A structural diagram of a terminal provided in an embodiment of the present application. DETAILED DESCRIPTION

[0036] The embodiments of the present application are described below in conjunction with the accompanying drawings.

[0037] At present, in order to prevent malicious information and other target information from being sent to normal users in information communication scenarios, the desensitized features of historical malicious information are usually added to the target sample library as target samples, and it is determined whether the similarity between the communication information and the target samples in the target sample library reaches the preset similarity. If so, the communication information is treated as malicious information and other target information and intercepted.

[0038] However, after research, it was found that not 100% of the target sample library is the target sample. There is a certain probability that non-target samples are mistakenly added to the target sample library. This situation causes the normal information corresponding to the non-target sample to be mistakenly intercepted, reducing the interception accuracy of target information such as malicious information, thereby reducing the information communication experience.

[0039] An embodiment of the present application provides an information processing method. The method can quickly and timely discover the situation where the target information detection amount of the target information processing link has an abnormal sudden increase by judging whether the target information detection amount corresponding to the target information processing link exceeds the preset detection amount, and perform risk control on the target information processing link in this case; by verifying whether the newly added target sample in the target sample library corresponding to the target information detection amount is a non-target sample, not only can the threshold value of the abnormal sudden increase of the target information detection amount in the target information processing link be increased when the non-target sample is not mistakenly added to the target sample library, and the risk control can be released in time to correctly add the target sample to the target sample library or correctly intercept the target information; but also the situation where the non-target sample is mistakenly added to the target sample library can be accurately and timely discovered, and in this case, the non-target sample is deleted from the target sample library, and the risk control is released to avoid the normal information corresponding to the non-target sample from being mistakenly intercepted, thereby improving the interception accuracy of the target information, thereby improving the information communication experience.

[0040] Next, the system architecture of the information processing method will be introduced. Figure 1 , Figure 1 A schematic diagram of a system architecture of an information processing method provided in an embodiment of the present application, wherein the system architecture includes a server 100, and the server 100 is used to execute an information processing method provided in an embodiment of the present application, as shown below:

[0041] The server 100 obtains the target information detection amount corresponding to the target information processing link.

[0042] As an example, the target information processing link is the malicious sample adding link, and the target information detection amount corresponding to the malicious sample adding link obtained by the server 100 is the malicious sample adding amount.

[0043] As another example, the target information processing link is a malicious information interception link, and the target information detection amount corresponding to the malicious information interception link obtained by the server 100 is the malicious information interception amount.

[0044] If the target information detection amount is greater than the preset detection amount, the server 100 performs risk control on the target information processing link.

[0045] As an example, based on the above-mentioned target information processing link being a malicious sample adding link, when the preset detection amount is a first adding amount, it is determined whether the malicious sample adding amount is greater than the first adding amount. If so, the server 100 performs risk control on the malicious sample adding link to warn the malicious sample adding link in a preset warning manner; when the preset detection amount is a second adding amount, it is determined whether the malicious sample adding amount is greater than the second adding amount. If so, the server 100 performs risk control on the malicious sample adding link to control the malicious sample adding link to fail. The first adding amount is less than the second adding amount.

[0046] As another example, based on the above example target information processing link being the malicious information interception link, when the preset detection amount is the first interception amount, the server 100 determines whether the malicious information interception amount is greater than the first interception amount, and if so, performs risk control on the malicious information interception link by alerting the malicious information interception link in a preset alerting manner; when the preset detection amount is the second interception amount, the server 100 determines whether the malicious information interception amount is greater than the second interception amount, and if so, performs risk control on the malicious information interception link by controlling the malicious information interception link to fail. The first interception amount is less than the second interception amount.

[0047] The server 100 verifies the newly added target samples in the target sample library according to the target information detection amount, and obtains the verification results of the newly added target samples.

[0048] As an example, when the target sample library is a malicious sample library, the newly added target sample is a newly added malicious sample; for the above example, the target information processing link is the malicious sample adding link, and the server 100 verifies the newly added malicious sample in the malicious sample library based on the malicious sample addition amount, and obtains the verification result of the newly added malicious sample. For the above example, the target information processing link is the malicious information interception link, and the server 100 verifies the newly added malicious sample in the malicious sample library based on the malicious information interception amount, and obtains the verification result of the newly added malicious sample.

[0049] If the verification result indicates that the newly added target samples include non-target samples, the server 100 deletes the non-target samples from the target sample library to release the risk control.

[0050] As an example, based on the above example, when the verification result indicates that the newly added malicious samples include non-malicious samples, for the malicious sample adding link in the above example, the server 100 deletes the non-malicious samples from the malicious sample library, and the risk control is lifted to lift the alarm of the malicious sample adding link; for the above example, the control of the malicious sample adding link fails, the server 100 deletes the non-malicious samples from the malicious sample library, and the risk control is lifted to control the malicious sample adding link. For the malicious information interception link in the above example, the server 100 deletes the non-malicious samples from the malicious sample library, and the risk control is lifted to lift the alarm of the malicious information interception link; for the above example, the control of the malicious information interception link fails, the server 100 deletes the non-malicious samples from the malicious sample library, and the risk control is lifted to control the malicious information interception link.

[0051] If the verification result indicates that the newly added target samples do not include non-malicious samples, the server 100 increases the preset detection amount within the first preset time period and releases the risk control.

[0052] As an example, based on the above example, when the verification result indicates that the newly added malicious samples do not include non-malicious samples, for the malicious sample addition link in the above example, the server 100 increases the preset detection amount within the first preset time period to increase the first addition amount within the first preset time period, and the risk control is lifted to lift the alarm malicious sample addition link; for the above example, the malicious sample addition link fails to be controlled, the server 100 increases the preset detection amount within the first preset time period to increase the second addition amount within the first preset time period, and the risk control is lifted to control the malicious sample addition link. For the malicious information interception link in the above example, the server 100 increases the preset detection amount within the first preset time period to increase the first interception amount within the first preset time period, and the risk control is lifted to lift the alarm malicious information interception link; for the above example, the malicious information interception link fails to be controlled, the server 100 increases the preset detection amount within the first preset time period to increase the second interception amount within the first preset time period, and the risk control is lifted to control the malicious information interception link.

[0053] That is to say, the above method can quickly and timely discover the situation where the target information detection amount of the target information processing link exceeds the preset detection amount by judging whether the target information detection amount corresponding to the target information processing link exceeds the preset detection amount, and perform risk control on the target information processing link in this case; by verifying whether the newly added target sample in the target sample library corresponding to the target information detection amount is a non-target sample, it can not only increase the threshold of the abnormal sudden increase of the target information detection amount in the target information processing link when the non-target sample is not mistakenly added to the target sample library, and release the risk control in time to correctly add the target sample to the target sample library or correctly intercept the target information; but it can also accurately and timely discover the situation where the non-target sample is mistakenly added to the target sample library, and in this case delete the non-target sample from the target sample library, release the risk control, so as to avoid the normal information corresponding to the non-target sample from being mistakenly intercepted, improve the interception accuracy of the target information, and thus enhance the information communication experience.

[0054] It should be noted that in the embodiments of the present application, the computer device may be a server or a terminal, and the method provided in the embodiments of the present application may be executed by the terminal or the server alone, or by the terminal and the server in cooperation. Figure 1 The corresponding embodiments are mainly introduced by taking the server executing the method provided in the embodiments of the present application as an example.

[0055] In addition, when the method provided in the embodiment of the present application is executed by a terminal alone, its execution method is the same as Figure 1The corresponding embodiments are similar, mainly replacing the server with a terminal. In addition, when the terminal and the server cooperate to execute the method provided in the embodiment of the present application, the steps that need to be reflected on the front-end interface can be executed by the terminal, and some steps that require background calculation and do not need to be reflected on the front-end interface can be executed by the server.

[0056] Among them, the terminal can be a smart phone, a tablet computer, a laptop computer, a desktop computer, an intelligent voice interaction device, a vehicle terminal or an aircraft, etc., but is not limited to this. The server can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides cloud computing services, but is not limited to this. The terminal and the server can be directly or indirectly connected via wired or wireless communication, and this application does not limit this. For example, the terminal and the server can be connected via a network, which can be a wired or wireless network.

[0057] In addition, the embodiments of the present application can be applied to various scenarios, including but not limited to cloud technology, artificial intelligence, smart transportation, assisted driving, audio and video, etc.

[0058] It can be understood that in the specific implementation of the present application, target information, target samples, non-target samples, etc. involve relevant data such as user information and communication information. When the above embodiments of the present application are applied to specific products or technologies, it is necessary to obtain the permission or consent of the user in the information communication scenario, and the collection, use and processing of relevant data need to comply with the relevant laws, regulations and standards of relevant countries and regions.

[0059] Next, the information processing method provided by the embodiment of the present application will be described in detail by taking a terminal or a server executing the method provided by the embodiment of the present application as an example and combining the accompanying drawings. Figure 2 , Figure 2 A flowchart of an information processing method provided in an embodiment of the present application, the method comprising:

[0060] S201: Obtain the target information detection amount corresponding to the target information processing link.

[0061] In the related technology, in order to prevent malicious information and other target information from being sent to normal users in information communication scenarios, the desensitized features of historical malicious information are usually added as target samples to the target sample library, and the similarity between the communication information and the target sample in the target sample library is judged to be whether it reaches the preset similarity. If so, the communication information is regarded as malicious information and other target information, and the target information is intercepted. However, after research, it was found that not 100% of the target sample library is the target sample. There is a certain probability that non-target samples are mistakenly added to the target sample library, which causes the normal information corresponding to the non-target sample to be mistakenly intercepted, reducing the interception accuracy of malicious information and other target information, thereby reducing the information communication experience.

[0062] Therefore, in the embodiment of the present application, in order to solve the problems in the related art, it is considered that there is a certain probability that a non-target sample is mistakenly added to the target sample library in the target sample adding link of adding the target sample to the target sample library, resulting in an abnormal sudden increase in the target sample addition amount in the target sample adding link; and in the target information interception link that intercepts the target information in this case, there is a situation that the normal information corresponding to the non-target sample is mistakenly intercepted, resulting in an abnormal sudden increase in the target information interception amount in the target information interception link; in order to be able to quickly and timely discover the situation that the target information processing links such as the target sample adding link and the target information interception link have an abnormal sudden increase in the target information detection amount, it is first necessary to obtain the target information detection amount corresponding to the target information processing link. Among them, the target information detection amount refers to the target information amount detected in the target information processing link.

[0063] S201 obtains the target information detection amount corresponding to the target information processing link to provide detection data for subsequent judgment on whether the target information detection amount corresponding to the target information processing link exceeds the preset detection amount, so as to quickly and timely discover the situation where the target information processing link has an abnormal sudden increase in the target information detection amount.

[0064] Among them, the target information processing link is the target sample adding link, which is specifically represented by the malicious sample adding link, see Figure 3 , Figure 3 A schematic diagram of a malicious sample adding link provided in an embodiment of the present application, the malicious sample adding link refers to: adding the desensitized features of historical malicious information as malicious samples to the malicious sample library, performing similarity identification on the malicious samples and historical communication information, obtaining similar samples of malicious sample diffusion, and adding similar samples as malicious samples to the malicious sample library. Based on this, as an example of S201, the target information detection amount corresponding to the malicious sample adding link obtained by the server is the malicious sample adding amount. Among them, the malicious sample adding amount refers to the amount of malicious samples added to the malicious sample library in the malicious sample adding link.

[0065] Among them, the target information processing link is the target information interception link, specifically the malicious information interception link, see Figure 4 , Figure 4 A schematic diagram of a malicious information interception link provided for an embodiment of the present application; in an information communication scenario where user A sends communication information to user B, user A sends the communication information, and the server performs a security check on the communication information to determine whether it hits the interception strategy, mainly to determine whether it hits the malicious sample interception strategy, that is, to determine whether the similarity between the communication information and the malicious samples in the malicious sample library reaches a preset similarity. If so, the communication information is treated as malicious information and intercepted, and user B does not receive the communication information. If not, user B receives the communication information; wherein the malicious information interception link refers to the link for determining whether the malicious sample interception strategy is hit. Based on this, as another example of S201, the target information detection amount corresponding to the malicious information interception link obtained by the server is the malicious information interception amount. Among them, the malicious information interception amount refers to the amount of malicious information intercepted in the malicious information interception link.

[0066] Specifically, it is determined whether the similarity between the communication information and the malicious samples in the malicious sample library reaches a preset similarity, which means determining whether the communication information is similar to the malicious sample. In the case where both the communication information and the malicious sample are image information, it is possible to determine whether the communication information is similar to the malicious sample from the following four levels:

[0067] (1) Pixel-level similarity: The corresponding pixel values ​​in the communication information and the malicious sample are exactly the same, which directly means that the image features of the communication information and the malicious sample are consistent.

[0068] (2) Global visual similarity: After image operations such as image scaling and image compression are performed on communication information and malicious samples with consistent image features, the image features of the communication information and malicious samples are not completely consistent, but the content of the corresponding positions in the visual sense is consistent.

[0069] (3) Local visual similarity: After globally visually consistent communication information and malicious samples undergo image operations such as image cropping and image stitching, the corresponding positions of the communication information and malicious samples are not completely consistent, but the local areas are basically consistent visually.

[0070] (4) Similarity at the semantic level: Communication information and malicious samples are visually different but similar in semantic content.

[0071] In addition, when similarity identification is performed on malicious samples and historical communication information, in the case where both malicious samples and historical communication information are image information, similarity identification can also be performed on malicious samples and historical communication information from the above four levels.

[0072] S202: If the target information detection amount is greater than the preset detection amount, risk control is performed on the target information processing link.

[0073] In the embodiment of the present application, in order to be able to quickly and timely discover the situation where the target information processing link has an abnormal sudden increase in the target information detection amount, after executing the above S201 to obtain the target information detection amount corresponding to the target information processing link, it is also necessary to determine whether the target information detection amount is greater than the preset detection amount, wherein the preset detection amount refers to the lower limit value of the target information processing link detecting the abnormal sudden increase in the target information amount; if so, it means that the target information processing link has an abnormal sudden increase in the target information detection amount. In this case, in order to accurately and timely discover the situation where non-target samples are mistakenly added to the target sample library in the future, so as to accurately and timely discover the situation where the normal information corresponding to the non-target samples is mistakenly intercepted, it is necessary to further perform risk control on the target information processing link.

[0074] S202 can quickly and timely discover the situation where the target information processing link has an abnormal surge in the target information detection amount by judging whether the target information detection amount corresponding to the target information processing link exceeds the preset detection amount, and perform risk control on the target information processing link in this case; laying the foundation for the subsequent accurate and timely discovery of the situation where non-target samples are mistakenly added to the target sample library.

[0075] As an example of S202, for the target information processing link in the above S201 example, the preset detection amount is the preset addition amount, and the server determines whether the malicious sample addition amount is greater than the preset addition amount. If so, risk control is performed on the malicious sample addition link; for the target information processing link in the above S201 example, the preset detection amount is the preset interception amount, and the server determines whether the malicious information interception amount is greater than the preset interception amount. If so, risk control is performed on the malicious information interception link. Among them, considering that the malicious sample corresponding to the malicious sample addition amount is used to intercept malicious information, in general, the malicious information interception amount is greater than the malicious sample addition amount, and the preset addition amount is less than the preset interception amount.

[0076] S203: Verify the newly added target samples in the target sample library according to the target information detection amount to obtain the verification result of the newly added target samples.

[0077] In the embodiment of the present application, in order to accurately and timely discover the situation where non-target samples are mistakenly added to the target sample library, and thus accurately and timely discover the situation where normal information corresponding to the non-target samples is mistakenly intercepted, when executing S202 to determine that the target information detection amount is greater than the preset detection amount, after risk control is performed on the target information processing link, it is also necessary to verify the newly added target samples in the target sample library based on the target information detection amount to determine whether the non-target samples are mistakenly added to the target sample library, thereby obtaining the verification result of the newly added target samples.

[0078] S203 can accurately and timely discover whether a non-target sample is added to the target sample library by verifying whether the newly added target sample in the target sample library corresponding to the target information detection amount is a non-target sample, so as to provide a processing basis for the subsequent correct interception of the target information and improving the interception accuracy of the target information.

[0079] As an example of S203, based on the above S201-S202 examples, the target sample library is a malicious sample library, and the newly added target samples are malicious samples; for the above S201-S202 examples, the target information processing link is the malicious sample adding link, and the server verifies whether the newly added malicious samples in the malicious sample library include non-malicious samples based on the amount of malicious sample addition, and obtains the verification result of the newly added malicious samples. For the above S201 example, the target information processing link is the malicious information interception link, and the server verifies whether the newly added malicious samples in the malicious sample library include non-malicious samples based on the amount of malicious information interception, and obtains the verification result of the newly added malicious samples.

[0080] S204: If the verification result indicates that the newly added target samples include non-target samples, the non-target samples are deleted from the target sample library and risk control is released.

[0081] In an embodiment of the present application, after executing the above-mentioned S203 verification to obtain the verification result of the newly added target sample, one verification result refers to the mistaken addition of a non-target sample to the target sample library, that is, the verification result indicates that the newly added target sample includes a non-target sample; in this case, in order to avoid the normal information corresponding to the non-target sample from being mistakenly intercepted, it is necessary to repair the vulnerability of mistakenly adding the non-target sample to the target sample library, and release the risk control in time, that is, delete the non-target sample from the target sample library, and release the risk control of the target information processing link.

[0082] S204 accurately and timely discovers the situation where non-target samples are mistakenly added to the target sample library, and in this case deletes the non-target samples from the target sample library, releasing risk control to avoid subsequent normal information corresponding to the non-target samples from being mistakenly intercepted, thereby improving the interception accuracy of target information and thus enhancing the information communication experience.

[0083] As an example of S204, based on the above S203 example, when the verification result indicates that the newly added malicious samples include non-malicious samples, for the target information processing link in the above S201-S203 examples is the malicious sample adding link, the server deletes the non-malicious samples from the malicious sample library and releases the risk control on the malicious sample adding link; for the target information processing link in the above S201-S203 examples is the malicious information intercepting link, the server deletes the non-malicious samples from the malicious sample library and releases the risk control on the malicious information intercepting link.

[0084] S205: If the verification result indicates that the newly added target samples do not include non-target samples, the preset detection amount is increased within the first preset time period and the risk control is released.

[0085] In an embodiment of the present application, after executing the above-mentioned S203 to verify and obtain the verification result of the newly added target sample, another verification result refers to that the target sample library has not mistakenly added non-target samples, that is, the verification result indicates that the newly added target sample does not include non-target samples; in this case, in order for the target sample to be correctly added to the target sample library, or the target information to be correctly intercepted, it is necessary to temporarily increase the threshold of the abnormal surge in the target information detection amount in the target information processing link, and release the risk control in time, that is, increase the preset detection amount corresponding to the target information processing link within the first preset time period, and release the risk control of the target information processing link.

[0086] When it is determined that the target sample library has not mistakenly added non-target samples, S205 allows the target information processing link to have a large threshold of abnormal sudden increase in target information detection within a certain period of time, and releases risk control in time, so as to continue to correctly add target samples to the target sample library, or continue to correctly intercept target information.

[0087] As an example of S205, based on the above S203 example, when the verification result indicates that the newly added malicious samples do not include non-malicious samples, for the target information processing link in the above S201-S203 examples is the malicious sample adding link, the server increases the preset addition amount within the first preset time period, and releases the risk control on the malicious sample adding link; for the target information processing link in the above S201-S203 examples is the malicious information interception link, the server increases the preset interception amount within the first preset time period, and releases the risk control on the malicious information interception link.

[0088] It can be seen from the above technical solution that, first, the target information detection amount corresponding to the target information processing link is obtained; it is determined whether the target information detection amount is greater than the preset detection amount, and if so, risk control is performed on the target information processing link. This method can quickly and timely discover the situation where the target information processing link has an abnormal sudden increase in the target information detection amount by determining whether the target information detection amount corresponding to the target information processing link exceeds the preset detection amount, and in this case, risk control is performed on the target information processing link. Then, based on the target information detection amount, the newly added target samples in the target sample library are verified to obtain the verification results of the newly added target samples; when the verification results indicate that the newly added target samples include non-target samples, the non-target samples are deleted from the target sample library and the risk control is lifted; when the verification results indicate that the newly added target samples do not include non-target samples, the preset detection amount is increased within the first preset time period and the risk control is lifted. This method verifies whether the newly added target samples in the target sample library corresponding to the target information detection amount are non-target samples. This method can not only increase the threshold of the abnormal sudden increase of the target information detection amount in the target information processing link when the non-target samples are not mistakenly added to the target sample library, and release the risk control in time to correctly add the target samples to the target sample library or correctly intercept the target information; but also can accurately and timely discover the situation where the non-target samples are mistakenly added to the target sample library, and in this case delete the non-target samples from the target sample library, release the risk control, so as to avoid the normal information corresponding to the non-target samples from being mistakenly intercepted, and improve the interception accuracy of the target information with minimal human intervention, thereby improving the information communication experience.

[0089] In the embodiment of the present application, when the above S202 is specifically implemented, since the preset detection amount refers to the lower limit value of the abnormal sudden increase of the target information amount detected by the target information processing link, considering the different sudden increase degrees of the abnormal sudden increase of the target information detection amount in the target information processing link, the preset detection amount can be configured as a first detection amount and a second detection amount, and the sudden increase degree of the abnormal sudden increase of the target information detection amount corresponding to the first detection amount is less than the sudden increase degree of the abnormal sudden increase of the target information detection amount corresponding to the second detection amount, that is, the first detection amount is less than the second detection amount; based on this, for different situations where the target information detection amount is greater than the first detection amount and the target information detection amount is greater than the second detection amount, there are different implementation methods for risk control of the target information processing link, which are specifically as follows:

[0090] One implementation method is: when the preset detection amount is the first detection amount, after executing the above S201 to obtain the target information detection amount corresponding to the target information processing link, it is necessary to determine whether the target information detection amount is greater than the first detection amount. If so, it means that the target information processing link has an abnormal sudden increase in the target information detection amount but the sudden increase is small; based on this, there is no need to prevent the target information processing link from continuing to process the target information, then risk control of the target information processing link can be to alert the target information processing link in accordance with the preset alarm method. Therefore, the present application provides a possible implementation method, when the preset detection amount is the first detection amount, the above S202 is specifically S2021 (not shown in the figure): if the target information detection amount is greater than the first detection amount, alert the target information processing link in accordance with the preset alarm method.

[0091] By judging whether the target information detection amount corresponding to the target information processing link exceeds the smaller first detection amount, S2021 can quickly and timely discover that the target information processing link has an abnormal surge in the target information detection amount but the degree of surge is small, and in this case, an alarm is issued to the target information processing link to achieve risk control of the target information processing link; to a certain extent, the target information processing link is allowed to have an abnormal surge in the target information detection amount with a small degree of surge, which does not directly control the failure of the target information processing link, but provides prompt data through alarms for subsequent accurate and timely discovery of the situation where non-target samples are mistakenly added to the target sample library.

[0092] Among them, considering that the target information processing link is generally alerted through the internal office system, the preset alarm mode alarm includes the office alarm mode; in order to further improve the timeliness and availability of the alarm and to further highlight the alarm, the target information processing link can also be alerted through the reserved responsible phone, and the preset alarm mode alarm includes the telephone alarm mode. Therefore, the present application provides a possible implementation method, and the preset alarm mode alarm includes one or more of the office alarm mode and the telephone alarm mode.

[0093] As an example, if the target information processing link is a malicious sample adding link, the malicious sample adding link is alerted through a reserved responsible phone number, specifically: the malicious sample adding link is prompted through the reserved responsible phone number that there is alarm information that needs to be processed. As another example, if the target information processing link is a malicious information intercepting link, the malicious information intercepting link is alerted through a reserved responsible phone number, specifically: the malicious information intercepting link is prompted through the reserved responsible phone number that there is alarm information that needs to be processed.

[0094] Another implementation method refers to: when the preset detection amount is the second detection amount, after executing the above S201 to obtain the target information detection amount corresponding to the target information processing link, it is necessary to determine whether the target information detection amount is greater than the second detection amount. If so, it means that the target information processing link has an abnormal sudden increase in the target information detection amount and the sudden increase is large; based on this, in order to avoid the situation where a large number of non-target samples are mistakenly added to the target sample library, and to avoid a large amount of normal information corresponding to the non-target samples being mistakenly intercepted, it is necessary to immediately prevent the target information processing link from continuing to process the target information, so as to prevent the target information processing request in the target information processing link from taking effect, and then the risk control of the target information processing link is specifically to control the failure of the target information processing link. Therefore, the present application provides a possible implementation method, when the preset detection amount is the second detection amount greater than the first detection amount, the above S202 is specifically S2022 (not shown in the figure): if the target information detection amount is greater than the second detection amount, the target information processing link is controlled to fail.

[0095] By judging whether the target information detection amount corresponding to the target information processing link exceeds the larger second detection amount, S2022 can quickly and timely discover that the target information processing link has an abnormal surge in target information detection amount and the surge is large, and in this case directly control the target information processing link to fail, so as to achieve risk control of the target information processing link; in principle, the target information processing link is not allowed to have an abnormal surge in target information detection amount with a large surge, and directly prevent the target information processing link from continuing to process the target information, which can quickly and timely avoid the situation where a large number of non-target samples are mistakenly added to the target sample library, and quickly and timely avoid a large amount of normal information corresponding to non-target samples from being mistakenly intercepted.

[0096] Among them, the present application provides a possible implementation method. On the basis of the above S2021 and the above S2022, for the target information processing link being the target sample adding link, the target information detection amount is the target sample adding amount, the first detection amount is the first adding amount, the second detection amount is the second adding amount, and the first adding amount is less than the second adding amount; for the target information processing link being the target information intercepting link, the target information detection amount is the target information intercepting amount, the first detection amount is the first intercepting amount, the second detection amount is the second intercepting amount, and the first intercepting amount is less than the second intercepting amount. In addition, considering that the target sample corresponding to the target sample adding amount is used to intercept the target information, in general, the target information intercepting amount is greater than the target sample adding amount, then the first adding amount is less than the first intercepting amount, and the second adding amount is less than the second intercepting amount.

[0097] Based on the above description, as an example of the above S2021 and the above S2022, on the basis of the above S202 example, for the target information processing link being the malicious sample adding link, when the preset detection amount is the first addition amount, the server determines whether the malicious sample adding amount is greater than the first addition amount, and if so, alerts the malicious sample adding link in a preset alerting manner; when the preset detection amount is the second addition amount, the server determines whether the malicious sample adding amount is greater than the second addition amount, and if so, controls the malicious sample adding link to fail. For the target information processing link being the malicious information intercepting link, when the preset detection amount is the first intercepting amount, the server determines whether the malicious information intercepting amount is greater than the first intercepting amount, and if so, alerts the malicious information intercepting link in a preset alerting manner; when the preset detection amount is the second intercepting amount, the server determines whether the malicious information intercepting amount is greater than the second intercepting amount, and if so, controls the malicious information intercepting link to fail.

[0098] In the embodiment of the present application, when S203 is specifically implemented, for different situations where the target information processing link is a target sample adding link and the target information processing link is a target information intercepting link, there are different implementation methods for verifying the newly added target samples in the target sample library based on the target information detection amount, as shown below:

[0099] One implementation method refers to: for the target information processing link being the target sample adding link, the target information detection amount is the target sample adding amount, and when the above S202 is executed to determine that the target sample adding amount is greater than the preset adding amount, after the target sample adding link is risk controlled; since the target sample adding amount exceeds the preset adding amount, it indicates that the target sample adding link has an abnormal sudden increase in the target sample adding amount, and it is also necessary to verify whether the newly added target samples corresponding to the target sample adding amount in the target sample library include non-target samples on the basis of the target sample adding amount, so as to determine whether the non-target samples are mistakenly added to the target sample library, thereby obtaining the verification result of the newly added target samples corresponding to the target sample adding amount in the target sample library. Therefore, the present application provides a possible implementation method, when the target information processing link is the target sample adding link and the target information detection amount is the target sample adding amount, the above S203 is specifically S2031 (not shown in the figure): verify the newly added target samples corresponding to the target sample adding amount in the target sample library to obtain the verification result.

[0100] Among them, the newly added target samples corresponding to the target sample addition amount include not only the target samples added in response to the sample addition operation in the target sample addition link, but also similar samples obtained by similarity identification and diffusion between the target samples and historical communication information.

[0101] In response to the situation where the target sample addition amount in the target sample adding link is greater than the preset addition amount, S2031 verifies whether the newly added target samples corresponding to the target sample addition amount in the target sample library include non-target samples, and can accurately and timely discover whether non-target samples are mistakenly added to the target sample library, providing a more accurate processing basis for the subsequent correct interception of target information and improving the interception accuracy of target information.

[0102] As an example of S2031, based on the above S203 example, for the target information processing link being the malicious sample adding link, the server verifies, based on the malicious sample adding amount, whether the newly added malicious samples corresponding to the malicious sample adding amount in the malicious sample library include non-malicious samples, and obtains the verification result of the newly added malicious samples corresponding to the malicious sample adding amount in the malicious sample library.

[0103] Another implementation method is: for the target information processing link being the target information interception link, the target information detection amount is the target information interception amount. When the above S202 is executed to determine that the target information interception amount is greater than the preset interception amount, after risk control is performed on the target information interception link; since the target information interception amount exceeds the preset interception amount, it indicates that the target information interception link has an abnormal sudden increase in the target information interception amount. On the basis of the target information interception amount, in order to speed up the verification speed and improve the verification efficiency, it is not necessary to verify each newly added target sample in the target sample library. The target information interception amount corresponding to each newly added target sample in the target sample library can be determined first, and multiple newly added target samples can be sorted from large to small to obtain the sorting results of multiple newly added target samples; then, it is verified whether the first N newly added target samples in the sorting results include non-target samples to determine whether non-target samples are mistakenly added to the target sample library, thereby obtaining the verification results of N newly added target samples in the sorting results of multiple newly added target samples. Therefore, the present application provides a possible implementation method. When the target information processing link is the target information interception link and the target information detection amount is the target information interception amount, the above S203 includes the following S2032-S2034 (not shown in the figure):

[0104] S2032: Determine the target information interception amount corresponding to each newly added target sample.

[0105] S2033: Sort the multiple newly added target samples from large to small according to the target information interception amount corresponding to each newly added target sample, and obtain the sorting results of the multiple newly added target samples.

[0106] S2034: Verify the first N newly added target samples in the sorting result to obtain the verification result; N is a positive integer.

[0107] Among them, when N=1, it means that the newly added target sample corresponding to the maximum target information interception amount is verified to obtain the verification result.

[0108] In the case where the target information interception amount in the target information interception link is greater than the preset interception amount, S2032-S2034 only needs to verify whether the N newly added target samples with a large amount of malicious information interception in the target sample library include non-target samples. It can quickly, effectively, accurately and timely discover whether non-target samples are mistakenly added to the target sample library, so as to quickly, effectively, accurately and timely provide a processing basis for the subsequent correct interception of target information and improve the interception accuracy of target information.

[0109] As an example of S2032-S2034, based on the above S203 example, for the target information processing link being the malicious information interception link, the server first determines the malicious information interception amount corresponding to each newly added target sample in the target sample library based on the malicious information interception amount, and sorts the multiple newly added malicious samples from large to small to obtain the sorting results of the multiple newly added malicious samples; then verifies whether the first N newly added malicious samples in the sorting results include non-malicious samples, and obtains the verification results of N newly added malicious samples in the sorting results of the multiple newly added malicious target samples.

[0110] In addition, in an embodiment of the present application, after executing the above S2022 to determine that the target information detection amount is greater than the second detection amount, and the control target information processing link fails, there may be a subsequent failure to timely verify the newly added target samples in the target sample library, thereby failing to timely determine whether the non-target samples are mistakenly added to the target sample library. In this case, considering that the target information processing link has been in a failed state, a large number of target samples cannot be correctly added to the target sample library, or a large amount of target information cannot be correctly intercepted; in order to solve this problem, it is also necessary to count the failure duration of the failure of the control target information processing link, and determine whether the failure duration is a preset failure time. The preset failure time refers to the upper limit of the duration of the failure of the control target information processing link. If so, it means that the failure duration of the failure of the control target information processing link is too long, and the control target information processing link needs to take effect, which is equivalent to automatically releasing the failure, so that the target sample is correctly added to the target sample library, or the target information is correctly intercepted. Therefore, the present application provides a possible implementation method, and the method may also include the following S1-S2 (not shown in the figure):

[0111] S1: The failure duration of the failure of the information processing link of the statistical control target.

[0112] S2: If the failure duration is the preset failure time, the control target information processing link takes effect.

[0113] When it is determined that the failure duration of the control target information processing link is too long, S1-S2 allows the failure to be automatically lifted so that the target samples can continue to be correctly added to the target sample library, or the target information can continue to be correctly intercepted, thereby avoiding the situation where a large number of target samples cannot be correctly added to the target sample library, or a large amount of target information cannot be correctly intercepted.

[0114] As an example of S1-S2, based on the above S2022, for the target information processing link being the malicious sample adding link, when the malicious sample adding amount is greater than the second adding amount and the malicious sample adding link is controlled to fail, the failure duration of controlling the malicious sample adding link to fail is counted, and when the failure duration is the preset failure time, the malicious sample adding link is controlled to take effect. For the target information processing link being the malicious information interception link, when the malicious information interception amount is greater than the second interception amount and the malicious information interception link is controlled to fail, the failure duration of controlling the malicious information interception link to fail is counted, and when the failure duration is the preset failure time, the malicious information interception link is controlled to take effect.

[0115] In the embodiment of the present application, when S201 is specifically implemented, since the magnitude of the target information detection amount corresponding to the target information processing link may be very large, in order to speed up the subsequent information processing speed and improve the subsequent information processing efficiency, the preset information granularity composed of the preset information scenario and the preset information type can be determined, and the target information detection amount under the preset information granularity corresponding to the target information processing link can be obtained in a targeted manner, so as to subsequently accurately control the risk of the target information detection amount under the preset information granularity corresponding to the target information processing link, thereby avoiding affecting the risk control of the target information detection amount under other information granularities corresponding to the target information processing link. Therefore, the present application provides a possible implementation method, S201 is specifically S2011 (not shown in the figure): obtain the target information detection amount under the preset information granularity corresponding to the target information processing link; the preset information granularity includes the preset information scenario and the preset information type; wherein the preset information scenario represents the preset business scenario of information generation, the preset information type represents the preset content type to which the information belongs, and the preset information type includes one or more of text type, image type and voice type.

[0116] As an example of S2011, the preset business scenario is a group communication scenario, and the preset information type is an image type. Based on the above S201 example, if the target information processing link is a malicious sample adding link, the server obtains the group communication scenario + the malicious sample addition amount of the image type corresponding to the malicious sample adding link; if the target information processing link is a malicious information interception link, the server obtains the group communication scenario + the malicious information interception amount of the image type corresponding to the malicious information interception link.

[0117] In addition, in the embodiment of the present application, considering that the magnitude of the target information detection amount under the preset information granularity corresponding to the target information processing link under the preset information granularity formed for the preset information scenario and the preset information type is still large, in order to further speed up the subsequent information processing speed and further improve the subsequent information processing efficiency, the preset information granularity can also be formed based on the preset information scenario and the preset information type in combination with a certain time period, i.e., the second preset time period. Therefore, the present application provides a possible implementation method, and the preset information granularity also includes the second preset time period.

[0118] As another example of S2011, the second preset time period is time period x. Based on the above S2011 example, when the target information processing link is the malicious sample adding link, the server obtains the malicious sample adding amount of the group communication scenario + image type + time period x corresponding to the malicious sample adding link; when the target information processing link is the malicious information interception link, the server obtains the malicious information interception amount of the group communication scenario + image type + time period x corresponding to the malicious information interception link.

[0119] In addition, in an embodiment of the present application, in order to be able to quickly and timely discover the situation where the target information processing link has an abnormal sudden increase in the target information detection amount, after executing the above S201 to obtain the target information detection amount corresponding to the target information processing link, it is also necessary to determine whether the target information detection amount is greater than the preset detection amount. If so, it indicates that the target information processing link has an abnormal sudden increase in the target information detection amount. In this case, considering that the target information detection amount corresponding to the target information processing link may have a false reporting problem, in order to avoid the problem of false reporting and directly performing risk control on the target information processing link, there is a risk of erroneous control, a confirmation request for risk control of the target information processing link may be sent to the preset responsible object; in response to the preset responsible object's determination operation on the confirmation request, the target information processing link is then risk controlled. Therefore, the present application provides a possible implementation method, and the method may also include the following S3-S4 (not shown in the figure):

[0120] S1: If the target information detection amount is greater than the preset detection amount, a confirmation request for risk control of the target information processing link is sent to the preset responsible object.

[0121] S2: In response to the confirmation operation of the preset responsible object on the confirmation request, risk control is performed on the target information processing link.

[0122] When determining whether the target information detection amount corresponding to the target information processing link exceeds the preset detection amount, S3-S4 sends a confirmation request for risk control of the target information processing link to the preset responsible object, and performs risk control on the target information processing link in response to the confirmation operation of the preset responsible object for the confirmation request. This can avoid the problem of erroneous risk control caused by possible false reporting of the target information detection amount corresponding to the target information processing link to a certain extent.

[0123] As an example of S3-S4, for the target information processing link in the above S201 example is the malicious sample adding link, the preset detection amount is the preset addition amount, the server determines whether the malicious sample adding amount is greater than the preset addition amount, and sends a confirmation request for risk control of the malicious sample adding link to the preset responsible object, and in response to the preset responsible object's determination operation on the confirmation request, the malicious sample adding link is risk controlled; for the target information processing link in the above S201 example is the malicious information intercepting link, the preset detection amount is the preset intercepting amount, the server determines whether the malicious information intercepting amount is greater than the preset intercepting amount, and sends a confirmation request for risk control of the malicious information intercepting link to the preset responsible object, and in response to the preset responsible object's determination operation on the confirmation request, the malicious information intercepting link is risk controlled.

[0124] Based on the above description, see Figure 5 , Figure 5 A configuration interface diagram of risk control based on a target information processing link is provided for an embodiment of the present application; wherein, a preset information scenario represents a preset business scenario for information generation, a preset information type represents a preset content type to which the information belongs, a preset information granularity includes a preset information scenario and a preset information type, and a remark refers to an explanation of the risk control of the target information processing link when the target information detection amount corresponding to the target information processing link is greater than the preset detection amount, so as to facilitate understanding by other personnel; the minute-level / hour-level threshold has the following three configuration items: a preset detection amount, a preset time interval and a preset expiration time, the preset detection amount refers to the lower limit value of the abnormal sudden increase in the target information amount detected by the target information processing link within the preset time interval, the preset time interval refers to the statistical time window of the target information detection amount, and the preset expiration time refers to the upper limit value of the duration of the failure of the target information processing link; specifically, when the preset expiration time is 0, risk control of the target information processing link is specifically to alert the target information processing link in a preset alarm manner. In addition, the preset statistical mode refers to the statistical method of the target information detection amount corresponding to the target information processing link. The PV mode means that the target information detection amount increases by 1 for each additional target information processing request in the target information processing link; the UV mode means that when multiple target information processing requests in the target information processing link correspond to the same target information, the target information detection amount increases by 1.

[0125] In addition, the preset responsible object refers to the object that receives the prompt information for risk control of the target information processing link, and has the authority to perform configuration operations based on the risk control of the target information processing link, including but not limited to: turning off or on the configuration, modifying the configuration data, etc.; the configuration status refers to whether the configuration is turned off or on, the threshold push refers to whether the prompt information includes the minute / hour threshold; the telephone alarm refers to turning on or off the telephone alarm target information processing link; the object confirmation refers to whether the target information detection amount corresponding to the target information processing link exceeds the preset detection amount, turning on or off the confirmation request for risk control of the target information processing link to the preset responsible object.

[0126] In addition, it is necessary to update the minute / hour thresholds from time to time based on the recent data fluctuations of the detection curve of the target information detection amount corresponding to the target information processing link.

[0127] exist Figure 5 Based on Figure 6 , Figure 6 A risk control interface diagram based on the target information processing link provided for the embodiment of the present application; wherein, the preset information scenario, preset information type, preset information granularity, remarks, minute-level / hour-level threshold and preset responsible object refer to the above description, the control start time refers to the start time of risk control on the target information processing link, the control end time refers to the end time of lifting the risk control, and the detection curve refers to the curve formed by the target information detection amount corresponding to the target information processing link. Click "Go to the new target sample verification page" to verify the newly added target samples in the target sample library on the basis of the target information detection amount to determine whether the non-target samples are mistakenly added to the target sample library, thereby obtaining the verification result of the newly added target samples; the verification result indicates that the newly added target samples include non-target samples, delete the non-target samples from the target sample library, and click "Do not modify the minute-level / hour-level threshold, lift risk control"; the verification result indicates that the newly added target samples do not include non-target samples, increase the preset detection amount of the target information processing link within the first preset time period, and click "Temporarily increase the minute-level / hour-level threshold, lift risk control".

[0128] The information processing method provided in the embodiment of the present application is applied to one or more of the malicious sample adding links and malicious information interception links in the information communication scenario; it can not only quickly and timely discover the situation that the malicious sample adding link has an abnormal sudden increase in the amount of malicious sample added, and in this case, perform risk control on the malicious sample adding link, or can quickly and timely discover the situation that the malicious information interception link has an abnormal sudden increase in the amount of malicious information intercepted, and in this case, perform risk control on the malicious information interception link; it can also accurately and timely discover the situation that non-malicious samples are mistakenly added to the malicious sample library, and in this case, delete the non-malicious samples from the malicious sample library, release the risk control, so as to avoid continuing to mistakenly add the non-malicious samples to the malicious sample library in the future, and avoid the normal information corresponding to the non-malicious samples from being mistakenly intercepted, improve the interception accuracy of malicious information, and thus improve the information communication experience. Based on this, there will no longer be a situation where "a large number of normal information corresponding to non-target samples are mistakenly intercepted, and the communication information security detection team in the information communication scenario is late to realize it."

[0129] In summary, see Figure 7 , Figure 7 A risk management flow chart for a malicious sample adding link and a malicious information intercepting link in an information communication scenario provided in an embodiment of the present application, the risk management process includes: determining a preset information granularity according to a preset information scenario and a preset information type; obtaining the malicious sample addition amount at the preset information granularity corresponding to the malicious sample adding link, and the malicious information interception amount at the preset information granularity corresponding to the malicious information intercepting link; obtaining a first addition amount, a second addition amount, a first interception amount, and a second interception amount at the preset information granularity.

[0130] If the amount of malicious samples added is greater than the first amount of addition, the malicious sample addition link is alerted according to the preset alarm method, and it is verified whether the newly added malicious samples corresponding to the amount of malicious samples added in the malicious sample library include non-malicious samples to obtain a verification result; based on the verification result, it is determined whether the newly added malicious samples include non-malicious samples. If so, the non-malicious samples are deleted from the malicious sample library and the malicious sample addition link is canceled; if not, the first amount of addition is increased within the first preset time period, and the malicious sample addition link is canceled.

[0131] If the amount of malicious samples added is greater than the second amount of addition, the malicious sample addition link is controlled to be invalid; the malicious sample addition link is alerted according to the preset alarm method, and it is verified whether the newly added malicious samples corresponding to the malicious sample addition amount in the malicious sample library include non-malicious samples to obtain the verification result; according to the verification result, it is determined whether the newly added malicious samples include non-malicious samples; if so, the non-malicious samples are deleted from the malicious sample library, and the malicious sample addition link is controlled to take effect; if not, the second amount of addition is increased within the first preset time period, and the malicious sample addition link is controlled to take effect.

[0132] If the malicious information interception amount is greater than the first interception amount, the malicious information interception link is alerted according to the preset alarm method, and it is verified whether the newly added malicious samples corresponding to the largest malicious information interception amount are non-malicious samples to obtain a verification result; based on the verification result, it is determined whether the newly added malicious samples are non-malicious samples. If so, the non-malicious samples are deleted from the malicious sample library and the malicious information interception link is released; if not, the first interception amount is increased within the first preset time period, and the malicious information interception link is released.

[0133] If the malicious information interception amount is greater than the second interception amount, the malicious information interception link is controlled to be invalid, and it is verified whether the newly added malicious samples corresponding to the largest malicious information interception amount are non-malicious samples to obtain a verification result; based on the verification result, it is determined whether the newly added malicious samples are non-malicious samples. If so, the non-malicious samples are deleted from the malicious sample library and the malicious information interception link is controlled to take effect; if not, the second interception amount is increased within the first preset time period, and the malicious information interception link is controlled to take effect.

[0134] It should be noted that, based on the implementation methods provided in the above aspects, this application can also be further combined to provide more implementation methods.

[0135] based on Figure 2 Corresponding to the information processing method provided in the embodiment, the embodiment of the present application also provides an information processing device, see Figure 8 , Figure 8 This is a structural diagram of an information processing device provided in an embodiment of the present application. The information processing device 800 includes: an acquisition unit 801, a control unit 802, a verification unit 803, and a release unit 804;

[0136] An acquisition unit 801 is used to acquire a target information detection amount corresponding to a target information processing link at a preset information granularity;

[0137] A control unit 802 is used to perform risk control on a target information processing link if the target information detection amount is greater than a preset detection amount;

[0138] A verification unit 803 is used to verify the newly added target sample in the target sample library according to the target information detection amount, and obtain the verification result of the newly added target sample;

[0139] A release unit 804 is configured to delete the non-target sample from the target sample library and release the risk control if the verification result indicates that the newly added target sample includes the non-target sample;

[0140] The release unit 804 is further used to increase a preset detection amount within a first preset time period and release risk control if the verification result indicates that the newly added target samples do not include non-target samples.

[0141] In a possible implementation, when the preset detection amount is the first detection amount, the control unit 802 is specifically configured to:

[0142] If the target information detection amount is greater than the first detection amount, the target information processing link is alerted according to a preset alarm method.

[0143] In a possible implementation, when the preset detection amount is a second detection amount greater than the first detection amount, the control unit 802 is specifically configured to:

[0144] If the target information detection amount is greater than the second detection amount, the target information processing link is controlled to fail.

[0145] In a possible implementation, when the target information processing link is the target sample adding link, the target information detection amount is the target sample adding amount, the first detection amount is the first adding amount, the second detection amount is the second adding amount, and the first adding amount is less than the second adding amount; when the target information processing link is the target information intercepting link, the target information detection amount is the target information intercepting amount, the first detection amount is the first intercepting amount, the second detection amount is the second intercepting amount, and the first intercepting amount is less than the second intercepting amount; the first adding amount is less than the first intercepting amount, and the second adding amount is less than the second intercepting amount.

[0146] In a possible implementation, when the target information processing link is a target sample adding link and the target information detection amount is a target sample adding amount, the verification unit 803 is specifically used to:

[0147] The newly added target samples corresponding to the target sample addition amount in the target sample library are verified to obtain the verification results.

[0148] In a possible implementation, when the target information processing link is the target information interception link and the target information detection amount is the target information interception amount, the verification unit 803 is specifically used to:

[0149] Determine the target information interception amount corresponding to each newly added target sample;

[0150] According to the target information interception amount corresponding to each newly added target sample, the multiple newly added target samples are sorted from large to small to obtain the sorting results of the multiple newly added target samples;

[0151] Verify the first N newly added target samples in the sorting results to obtain verification results; N is a positive integer.

[0152] In a possible implementation, the device further includes: a statistical unit;

[0153] A statistical unit, used to statistically control the failure duration of the failure of the target information processing link;

[0154] The control unit 802 is also used to control the target information processing link to take effect if the failure duration is a preset failure time.

[0155] In a possible implementation, the acquiring unit 801 is specifically configured to:

[0156] Obtain the target information detection amount at the preset information granularity corresponding to the target information processing link; the preset information granularity includes a preset information scenario and a preset information type; the preset information scenario represents a preset business scenario for information generation, and the preset information type represents a preset content type to which the information belongs, and the preset information type includes one or more of a text type, an image type, and a voice type.

[0157] In a possible implementation manner, the preset information granularity further includes a second preset time period.

[0158] In a possible implementation, the preset alarm mode alarm includes one or more of an office alarm mode and a telephone alarm mode.

[0159] In a possible implementation, the device further includes: a sending unit;

[0160] A sending unit, configured to send a confirmation request for risk control of the target information processing link to a preset responsible object if the target information detection amount is greater than a preset detection amount;

[0161] The control unit 802 is further used to perform risk control on the target information processing link in response to the confirmation operation of the preset responsible object on the confirmation request.

[0162] It can be seen from the above technical solution that the target information detection amount corresponding to the target information processing link is obtained; it is determined whether the target information detection amount is greater than the preset detection amount, and if so, risk control is performed on the target information processing link. By determining whether the target information detection amount corresponding to the target information processing link exceeds the preset detection amount, it is possible to quickly and timely discover that the target information processing link has an abnormal sudden increase in the target information detection amount, and in this case, risk control is performed on the target information processing link. On the basis of the target information detection amount, the newly added target samples in the target sample library are verified to obtain the verification results of the newly added target samples; when the verification results indicate that the newly added target samples include non-target samples, the non-target samples are deleted from the target sample library and the risk control is lifted; when the verification results indicate that the newly added target samples do not include non-target samples, the preset detection amount is increased within the first preset time period and the risk control is lifted. By verifying whether the newly added target samples in the target sample library corresponding to the target information detection amount are non-target samples, it is possible not only to increase the threshold of the abnormal sudden increase in the target information detection amount in the target information processing link when no non-target samples are mistakenly added to the target sample library, and to release the risk control in time to correctly add the target samples to the target sample library or correctly intercept the target information; but it is also possible to accurately and timely discover the situation where non-target samples are mistakenly added to the target sample library, and in this case delete the non-target samples from the target sample library, release the risk control, and avoid the normal information corresponding to the non-target samples from being mistakenly intercepted, thereby improving the interception accuracy of the target information and thus enhancing the information communication experience.

[0163] The present application also provides a computer device, which may be a server. Fig. 9 , Fig. 9 A structural diagram of a server provided in an embodiment of the present application, the server 900 may have relatively large differences due to different configurations or performances, and may include one or more processors, such as a CPU 922, and a memory 932, one or more storage media 930 (such as one or more mass storage devices) storing application programs 942 or data 944. Among them, the memory 932 and the storage medium 930 can be short-term storage or permanent storage. The program stored in the storage medium 930 may include one or more modules (not shown in the figure), and each module may include a series of instruction operations in the server. Furthermore, the central processing unit 922 can be configured to communicate with the storage medium 930 and execute a series of instruction operations in the storage medium 930 on the server 900.

[0164] The server 900 may also include one or more power supplies 926, one or more wired or wireless network interfaces 950, one or more input and output interfaces 958, and / or one or more operating systems 941, such as Windows Server 2000. TM, Mac OS X TM , Unix TM ,Linux TM , FreeBSD TM etc.

[0165] In this embodiment, the central processor 922 in the server 900 can execute the methods provided in various optional implementations of the above embodiments.

[0166] The computer device provided in the embodiment of the present application may also be a terminal. Fig.10 , Fig.10 A structural diagram of a terminal provided in an embodiment of the present application. Taking a smartphone as an example, the smartphone includes: a radio frequency (RF) circuit 1010, a memory 1020, an input unit 1030, a display unit 1040, a sensor 1050, an audio circuit 1060, a wireless fidelity (WiFi) module 1070, a processor 1080, and a power supply 10120 and other components. The input unit 1030 may include a touch panel 1031 and other input devices 1032, the display unit 1040 may include a display panel 1041, and the audio circuit 1060 may include a speaker 1061 and a microphone 1062. Those skilled in the art will understand that Fig.10 The structure of the smartphone shown in the figure does not constitute a limitation of the smartphone, and may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently.

[0167] The memory 1020 can be used to store software programs and modules. The processor 1080 executes various functional applications and data processing of the smartphone by running the software programs and modules stored in the memory 1020. The memory 1020 may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.), etc.; the data storage area may store data created according to the use of the smartphone (such as audio data, a phone book, etc.), etc. In addition, the memory 1020 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0168] The processor 1080 is the control center of the smartphone, which uses various interfaces and lines to connect various parts of the entire smartphone, and executes various functions of the smartphone and processes data by running or executing software programs and / or modules stored in the memory 1020, and calling data stored in the memory 1020. Optionally, the processor 1080 may include one or more processing units; preferably, the processor 1080 may integrate an application processor and a modem processor, wherein the application processor mainly processes the operating system, user interface, and application programs, and the modem processor mainly processes wireless communications. It is understandable that the above-mentioned modem processor may not be integrated into the processor 1080.

[0169] In this embodiment, the processor 1080 in the smart phone can execute the methods provided in various optional implementations of the above embodiments.

[0170] According to one aspect of the present application, a computer-readable storage medium is provided, wherein the computer-readable storage medium is used to store a computer program. When the computer program is executed on a computer device, the computer device executes the methods provided in various optional implementations of the above embodiments.

[0171] According to one aspect of the present application, a computer program product is provided, the computer program product comprising a computer program, the computer program being stored in a computer-readable storage medium. A processor of a computer device reads the computer program from the computer-readable storage medium, and the processor executes the computer program, so that the computer device executes the method provided in various optional implementations of the above-mentioned embodiments.

[0172] The descriptions of the processes or structures corresponding to the above-mentioned figures have different emphases. For parts that are not described in detail in a certain process or structure, please refer to the relevant descriptions of other processes or structures.

[0173] The terms "first", "second", etc. in the specification of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchangeable in appropriate circumstances, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein, for example. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, the process, method, system, product or equipment comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or equipment.

[0174] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0175] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0176] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0177] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), RAM, disk or optical disk and other media that can store computer programs.

[0178] As described above, the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, ordinary technical members in the art should understand that they can still modify the technical solutions recorded in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. An information processing method, characterized in that: The method comprises: Obtaining the target information detection amount corresponding to the target information processing link; If the target information detection amount is greater than the preset detection amount, risk control is performed on the target information processing link; Verifying the newly added target samples in the target sample library according to the target information detection amount to obtain the verification result of the newly added target samples; If the verification result indicates that the newly added target samples include non-target samples, the non-target samples are deleted from the target sample library, and the risk control is released; If the verification result indicates that the newly added target samples do not include the non-target samples, the preset detection amount is increased within a first preset time period and the risk control is released.

2. The method according to claim 1, characterized in that When the preset detection amount is the first detection amount, the risk control of the target information processing link is specifically: Alert the target information processing link according to a preset alarm method.

3. The method according to claim 2, characterized in that When the preset detection amount is a second detection amount greater than the first detection amount, the risk control of the target information processing link is specifically: Control the target information processing link to fail.

4. The method according to claim 3, characterized in that When the target information processing link is a target sample adding link, the target information detection amount is a target sample adding amount, the first detection amount is a first adding amount, the second detection amount is a second adding amount, and the first adding amount is less than the second adding amount; When the target information processing link is a target information interception link, the target information detection amount is a target information interception amount, the first detection amount is a first interception amount, the second detection amount is a second interception amount, and the first interception amount is less than the second interception amount; The first addition amount is smaller than the first interception amount, and the second addition amount is smaller than the second interception amount.

5. The method according to claim 4, characterized in that When the target information processing link is the target sample adding link and the target information detection amount is the target sample adding amount, verifying the newly added target sample in the target sample library according to the target information detection amount to obtain the verification result of the newly added target sample includes: The newly added target samples corresponding to the target sample addition amount in the target sample library are verified to obtain the verification result.

6. The method according to claim 4, characterized in that When the target information processing link is the target information interception link and the target information detection amount is the target information interception amount, verifying the newly added target sample in the target sample library according to the target information detection amount to obtain the verification result of the newly added target sample includes: Determine the target information interception amount corresponding to each newly added target sample; According to the target information interception amount corresponding to each of the newly added target samples, the multiple newly added target samples are sorted from large to small to obtain a sorting result of the multiple newly added target samples; The first N newly added target samples in the sorting result are verified to obtain the verification result; N is a positive integer.

7. The method according to claim 3, characterized in that The method further comprises: Counting the failure duration of the failure of controlling the target information processing link; If the expiration duration is the preset expiration time, the target information processing link is controlled to take effect.

8. The method according to any one of claims 1 to 7, characterized in that: The step of obtaining the target information detection amount corresponding to the target information processing link includes: Obtain the target information detection amount at the preset information granularity corresponding to the target information processing link; the preset information granularity includes a preset information scenario and a preset information type; the preset information scenario represents a preset business scenario for information generation, and the preset information type represents a preset content type to which the information belongs, and the preset information type includes one or more of a text type, an image type, and a voice type.

9. The method according to claim 8, characterized in that The preset information granularity also includes a second preset time period.

10. The method according to claim 2, characterized in that The preset alarm mode alarm includes one or more of an office alarm mode and a telephone alarm mode.

11. The method according to claim 1, characterized in that The method further comprises: If the target information detection amount is greater than the preset detection amount, sending a confirmation request for risk control of the target information processing link to a preset responsible object; In response to the determination operation of the preset responsible object on the confirmation request, risk control is performed on the target information processing link.

12. An information processing device, characterized in that: The device comprises: an acquisition unit, a control unit, a verification unit and a release unit; The acquisition unit is used to acquire the target information detection amount corresponding to the target information processing link; The control unit is used to perform risk control on the target information processing link if the target information detection amount is greater than a preset detection amount; The verification unit is used to verify the newly added target sample in the target sample library according to the target information detection amount, and obtain the verification result of the newly added target sample; The release unit is configured to delete the non-target sample from the target sample library and release the risk control if the verification result indicates that the newly added target sample includes a non-target sample; The release unit is further configured to increase the preset detection amount within a first preset time period and release the risk control if the verification result indicates that the newly added target sample does not include the non-target sample.

13. A computer device, characterized in that: The computer device comprises a processor and a memory: The memory is used to store a computer program and transmit the computer program to the processor; The processor is configured to execute the method according to any one of claims 1 to 11 according to the instructions in the computer program.

14. A computer-readable storage medium, characterized in that: The computer-readable storage medium is used to store a computer program, and when the computer program is executed on a computer device, the computer device executes the method according to any one of claims 1 to 11.

15. A computer program product comprising a computer program, characterized in that When the computer program is executed on a computer device, the computer device is caused to execute the method according to any one of claims 1 to 11.

Images