Data processing method and device, equipment, medium and program product

Abstract

The embodiment of the invention provides a data processing method and device, equipment, a medium and a program product, and can relate to an information security technology, the method comprises the following steps: according to a criterion that each node comprises a minimum judgment condition, splitting nodes formed by a plurality of minimum judgment conditions in a first rule tree to obtain a second rule tree; reconstructing the second rule tree to obtain a reconstructed rule tree; wherein the occurrence frequency of each node in the reconstruction rule tree in the subordinate sub-tree is 1, and for any father node except the root node in the reconstruction rule tree, the occurrence frequency of the father node in the second rule tree is greater than or equal to the occurrence frequency of the sub-node of the father node in the second rule tree; and based on the reconstruction rule tree, determining a reason for the target object to hit or miss the first rule tree. Therefore, the reason that the target object hits or does not hit the rule tree can be quickly positioned.

Description

Technical Field

[0001] Embodiments of the present application relate to the field of information security technology, and in particular, to a data processing method, apparatus, device, medium, and program product. Background Art

[0002] Currently, in many scenarios, a rule tree is required to match a target object to detect whether the target object is secure, and the reason why the target object hits or misses the rule tree can be determined. For example, in a payment scenario, a rule tree can be used to detect whether a payment request is secure. When the payment request hits the rule tree, the reason why the payment request hits the rule tree is determined. When the payment request misses the rule tree, the reason why the payment request misses the rule tree is determined to adjust the rule tree or perform other operations, etc.

[0003] Currently, staff can analyze the reason why a target object hits or misses a rule tree based on the rule tree and all variable values involved in the target object. However, since the rule tree is constructed manually and is huge and complex, there may be cases where there are duplicate judgment conditions between different nodes, and even cases where there are duplicate nodes, resulting in the inability to quickly locate the reason why the target object hits or misses the rule tree. Summary of the Invention

[0004] Embodiments of the present application provide a data processing method, apparatus, device, medium, and program product, so that the reason why a target object hits or misses a rule tree can be quickly located.

[0005] In a first aspect, an embodiment of the present application provides a data processing method, including: splitting nodes in a first rule tree composed of multiple minimum judgment conditions according to the criterion that each node includes one minimum judgment condition to obtain a second rule tree; reconstructing the second rule tree to obtain a reconstructed rule tree, where the number of occurrences of each node in the reconstructed rule tree in its subtree is 1, and for any parent node other than the root node in the reconstructed rule tree, the number of occurrences of the parent node in the second rule tree is greater than or equal to the number of occurrences of the child node of the parent node in the second rule tree; determining the reason why the target object hits or misses the first rule tree based on the reconstructed rule tree.

[0006] In a second aspect, an embodiment of the present application provides a data processing device, including: a splitting module, a reconstructing module, and a determining module. Among them, the splitting module is used to split the nodes composed of multiple minimum judgment conditions in the first rule tree according to the criterion that each node includes one minimum judgment condition, so as to obtain a second rule tree; the reconstructing module is used to reconstruct the second rule tree to obtain a reconstructed rule tree; wherein, the number of occurrences of each node in the reconstructed rule tree in its affiliated subtree is 1, and for any parent node other than the root node in the reconstructed rule tree, the number of occurrences of the parent node in the second rule tree is greater than or equal to the number of occurrences of the child nodes of the parent node in the second rule tree; the determining module is used to determine the reason why the target object hits or does not hit the first rule tree based on the reconstructed rule tree.

[0007] In a third aspect, an embodiment of the present application provides an electronic device, including: a processor and a memory. The memory is used to store a computer program, and the processor is used to call and run the computer program stored in the memory to execute the method in the first aspect or its various implementation manners.

[0008] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium for storing a computer program, and the computer program enables a computer to execute the method in the first aspect or its various implementation manners.

[0009] In a fifth aspect, an embodiment of the present application provides a computer program product, including computer program instructions, and the computer program instructions enable a computer to execute the method in the first aspect or its various implementation manners.

[0010] In a sixth aspect, an embodiment of the present application provides a computer program, and the computer program enables a computer to execute the method in the first aspect or its various implementation manners.

[0011] Through the technical solution provided by the present application, on the one hand, since the reconstructed rule tree is the result of merging the repeated nodes in the first rule tree, the structure of the reconstructed rule tree is simple, so that the reason why the target object hits the first rule tree can be quickly located based on the reconstructed rule tree. On the other hand, since the nodes closer to the top layer in the reconstructed rule tree have a higher number of occurrences in the first rule tree, on the contrary, the nodes closer to the bottom layer have a lower number of occurrences in the first rule tree. In other words, the next node after the last node that the target object matches with the reconstructed rule tree is probably the reason why it does not hit the first rule tree, and since each node in the reconstructed rule tree only contains one minimum judgment condition, only by finding this next node can the reason why the target object does not hit the first rule tree be located. Description of the Drawings

[0012] To more clearly illustrate the technical solutions in the embodiments of the present invention, the following will briefly introduce the accompanying drawings required for the description of the embodiments. Obviously, the accompanying drawings in the following description are only some embodiments of the present invention. For those of ordinary skill in the art, without creative efforts, other accompanying drawings can also be obtained based on these drawings.

[0013] Figure 1 It is a schematic diagram of a system architecture related to the embodiments of the present application;

[0014] Figure 2 It is another schematic diagram of a system architecture related to the embodiments of the present application;

[0015] Figure 3 It is a flowchart of a data processing method provided by the embodiments of the present application;

[0016] Figure 4 It is a schematic diagram of a first rule tree provided by the embodiments of the present application;

[0017] Figure 5 It is a schematic diagram of a second rule tree provided by the embodiments of the present application;

[0018] Figure 6 It is a schematic diagram of the reconstruction process of a reconstructed rule tree provided by the embodiments of the present application;

[0019] Figures 7 to 14 It is a schematic diagram of the reconstruction process of a rule tree provided by the embodiments of the present application;

[0020] Figure 15 It is a schematic diagram of a data processing device 1500 provided by the embodiments of the present application;

[0021] Figure 16 It is a schematic block diagram of an electronic device provided by the embodiments of the present application. Detailed implementation manners

[0022] The following will clearly and completely describe the technical solutions in the embodiments of the present invention with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, rather than all embodiments. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without creative efforts belong to the scope of protection of the present invention.

[0023] It should be noted that the terms "first", "second", etc. in the description, claims and above-mentioned drawings of the present invention are used to distinguish similar objects, and do not necessarily need to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged under appropriate circumstances, so that the embodiments of the present invention described here can be implemented in an order other than those illustrated or described here. In addition, the terms "comprising" and "having" and any variations thereof are intended to cover non-exclusive inclusion. For example, a process, method, system, product or server comprising a series of steps or units does not necessarily have to be limited to those steps or units clearly listed, but may include other steps or units not clearly listed or inherent to these processes, methods, products or devices.

[0024] In the embodiments of the present application, the term "module" or "unit" refers to a computer program with a predetermined function or a part of a computer program, which works together with other related parts to achieve a predetermined goal, and can be fully or partially implemented by using software, hardware (such as a processing circuit or a memory), or a combination thereof. Similarly, one processor (or multiple processors or memories) can be used to implement one or more modules or units. In addition, each module or unit can be a part of an overall module or unit that includes the functions of that module or unit.

[0025] Before introducing the technical solution of the present application, the relevant knowledge involved in the present application will be elaborated below:

[0026] A rule tree is a rule set in a tree structure.

[0027] A reconstructed rule tree is a rule tree formed after reconstructing the original rule tree.

[0028] The minimum judgment condition is the minimum non-splittable judgment condition, and is also called the non-splittable judgment condition.

[0029] The top-level rule tree refers to the top-level rule tree in the entire rule set, which contains the entire rule set.

[0030] For a merged subtree, after merging each branch including a certain node under that node, the largest subtree with that node as the root node is called the merged subtree.

[0031] Next, the technical problems to be solved, the inventive concept and the system architecture of the embodiments of the present application will be elaborated:

[0032] As described above, currently, the staff can analyze the reason why the target object hits or does not hit the rule tree based on the rule tree and all variable values involved in the target object. However, since the rule tree is constructed manually and is huge and complex, there may be cases where there are duplicate judgment conditions between different nodes, and even duplicate nodes may exist, resulting in the inability to quickly locate the reason why the target object hits or does not hit the rule tree.

[0033] To solve the above technical problems, the embodiments of the present application propose to split the nodes in the first rule tree into minimum judgment conditions to obtain a second rule tree; then reconstruct the second rule tree based on the number of occurrences of each node in the second rule tree to obtain a reconstructed rule tree; and determine the reason why the target object hits or does not hit the first rule tree based on the reconstructed rule tree. Since the reconstructed rule tree is the result of merging duplicate nodes in the first rule tree, the structure of the reconstructed rule tree is simple, so that the reason for hitting the first rule tree can be quickly located based on the reconstructed rule tree. Since the nodes closer to the top layer in the reconstructed rule tree have a higher number of occurrences in the first rule tree, on the contrary, the nodes closer to the bottom layer have a lower number of occurrences in the first rule tree, so that the reason for not hitting the first rule tree can be quickly located.

[0034] In some implementable ways, the system architecture of the embodiments of the present application is as Figure 1 shown.

[0035] Figure 1 This is a schematic diagram of a system architecture involved in the embodiments of the present application. The system architecture includes an analysis background server 110. The analysis background server 110 can split the nodes composed of multiple minimum judgment conditions in the first rule tree according to the criterion that each node includes a minimum judgment condition to obtain a second rule tree; reconstruct the second rule tree to obtain a reconstructed rule tree; where the number of occurrences of each node in the reconstructed rule tree in its subtree is 1, and for any parent node other than the root node in the reconstructed rule tree, the number of occurrences of the parent node in the second rule tree is greater than or equal to the number of occurrences of the child nodes of the parent node in the second rule tree; based on the reconstructed rule tree, determine the reason why the target object hits or does not hit the first rule tree.

[0036] In some implementable ways, the analysis background server 110 can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, Content Delivery Network (CDN), and big data and artificial intelligence platforms.

[0037] Figure 2 This is another schematic diagram of the system architecture involved in the embodiments of the present application. Among them, the system architecture includes: a business background server 210, an analysis background server 220, a database 230, and a client 240 corresponding to the analysis background server 220.

[0038] In some implementable ways, the business background server 210 and the analysis background server 220 can be directly or indirectly connected through wired or wireless communication methods, and the present application does not limit this here.

[0039] In some implementable ways, the analysis background server 220 and the client 240 can be directly or indirectly connected through wired or wireless communication methods, and the present application does not limit this here.

[0040] In some implementable ways, the database 230 can be a database in the analysis background server 220 or a database in other devices, and the embodiments of the present application do not limit this.

[0041] It should be understood that the business background server 210 is used to implement the business corresponding to the target object. For example, it can receive a payment request sent by a payment client, detect whether the payment request is secure based on the first rule tree, and can send the payment request to the analysis background server 220 and inform the analysis background server 220 whether the payment request hits or does not hit the first rule tree.

[0042] It should be understood that the analysis background server 220 can split the nodes composed of multiple minimum judgment conditions in the first rule tree according to the criterion that each node includes a minimum judgment condition to obtain a second rule tree; reconstruct the second rule tree to obtain a reconstructed rule tree; where the number of occurrences of each node in the reconstructed rule tree in its subtree is 1, and for any parent node other than the root node in the reconstructed rule tree, the number of occurrences of the parent node in the second rule tree is greater than or equal to the number of occurrences of the child nodes of the parent node in the second rule tree; based on the reconstructed rule tree, determine the reason why the target object hits or does not hit the first rule tree.

[0043] In some implementable ways, the database 230 can be a relational database, a non-relational database, a key-value database, etc., but is not limited thereto.

[0044] In some implementable manners, both the service back-end server 210 and the analysis back-end server 220 can be independent physical servers, or a server cluster or a distributed system composed of multiple physical servers. They can also be cloud servers that provide basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, as well as big data and artificial intelligence platforms.

[0045] In some implementable manners, the client 240 can receive the reasons why the target object hits or does not hit the first rule tree sent by the analysis back-end server 220, and display the reasons why the target object hits or does not hit the first rule tree.

[0046] In some implementable manners, the client 240 can be a terminal device or a security control back-end server. The terminal device can be a smart phone, a tablet computer, a smart watch, virtual reality (VR), augmented reality (AR), etc., but is not limited thereto.

[0047] It should be noted that Figure 1 and Figure 2 are only schematic diagrams of two system architectures provided by the embodiments of the present application. The system architectures involved in the embodiments of the present application are not limited to Figure 1 and Figure 2 shown in the system architectures. For example, in some implementable manners, the service back-end server 210 and the analysis back-end server 220 can be the same device.

[0048] The embodiments of the present application will be elaborated in detail below:

[0049] Figure 3 is a flowchart of a data processing method provided by an embodiment of the present application. This method can be executed by the analysis back-end server, and the analysis back-end server can be Figure 1 the analysis back-end server 110 in Figure 2 or Figure 3 the analysis back-end server 220 in

[0050] S310: Split the nodes composed of multiple minimum judgment conditions in the first rule tree according to the criterion that each node includes one minimum judgment condition, to obtain a second rule tree;

[0051] In other words, for the nodes composed of multiple minimum judgment conditions in the first rule tree, the minimum judgment conditions in this node have an "AND" relationship. Based on this, the analysis back-end server can split the minimum judgment conditions in this node according to the "AND" relationship to obtain a second rule tree.

[0052] For example, assume that a node in the first rule tree is (a > b) && (b > c). Then, the analysis back-end server can split the node into two nodes: a > b and b > c. Here, && represents the "AND" operator.

[0053] As another example, assume that a node in the first rule tree is (a > b || b > c) && c > d. Then, the analysis back-end server can split the node into a > b || b > c and c > d. Here, && represents the "AND" operator, and || represents the "OR" operator.

[0054] In some implementable ways, when a node in the first rule tree is split into multiple nodes, these multiple nodes can form a chained branch in any form, and the relationship between the node before splitting and other nodes in the first rule tree remains unchanged.

[0055] For example, Figure 4 is a schematic diagram of a first rule tree provided for an embodiment of this application. Figure 5 is a schematic diagram of a second rule tree provided for an embodiment of this application. As Figure 4 shown, the nodes in the first rule tree composed of multiple minimum judgment conditions include: "Payment amount > 5000 && Payment time > 22:00", "(Payee's location = M || Y) && Payee's gender = 1", "Payment amount > 5000 && 22:00 < Payment time < 24:00", "15 < Payee's age < 65", "Payment amount > 10000 && Payment time > 22:00".

[0056] Further, the analysis back-end server can split "Payment amount > 5000 && Payment time > 22:00" into two nodes: "Payment amount > 5000" and "Payment time > 22:00". As Figure 5 shown, the node "Payment amount > 5000" can be used as the parent node of the node "Payment time > 22:00". Combining Figure 4 and Figure 5 shown, all the nodes below "Payment amount > 5000 && Payment time > 22:00" in the first rule tree continue to be below "Payment time > 22:00".

[0057] The analysis back-end server can split "(Payee's location = M || Y) && Payee's gender = 1" into two nodes: "Payee's location = M || Y" and "Payee's gender = 1". As Figure 5 shown, the node "Payee's location = M || Y" can be used as the parent node of the node "Payee's gender = 1". Combining Figure 4 and Figure 5As shown, all nodes below "(region where payee is located = M || Y) && gender of payee = 1" in the first rule tree continue to be below "gender of payee = 1", and as Figure 5 shown, the node "region where payee is located = M || Y" can be a child node of the node "payment time > 22:00".

[0058] The analysis backend server can split the node "payment amount > 5000 && 22:00 < payment time < 24:00" into three nodes: "payment amount > 5000", "payment time > 22:00", and "payment time < 24:00". As Figure 5 shown, the node "payment amount > 5000" can be the parent node of the node "payment time > 22:00", and the node "payment time > 22:00" is the parent node of the node "payment time < 24:00". Combining Figure 4 and Figure 5 shown, all nodes below "payment amount > 5000 && 22:00 < payment time < 24:00" in the first rule tree continue to be below "payment time < 24:00". As Figure 5 shown, the node "payment amount > 5000" can be a child node of the node "payee IP address = IP1 || IP2".

[0059] The analysis backend server can split the node "15 < age of payee < 65" into two nodes: "age of payee > 15" and "age of payee < 65". As Figure 5 shown, the node "age of payee > 15" can be the parent node of the node "age of payee < 65". The node "age of payee > 15" can be a child node of the node "payment time < 24:00".

[0060] The analysis backend server can split the node "payment amount > 10000 && payment time > 22:00" into two nodes: "payment amount > 10000" and "payment time > 22:00". As Figure 5 shown, the node "100" can be a child node of the node "payment time > 22:00", and the node "payment amount > 10000" can be a child node of the root node.

[0061] S320: Reconstruct the second rule tree to obtain a reconstructed rule tree;

[0062] Among them, the number of occurrences of each node in the reconstructed rule tree is 1, and for any parent node other than the root node in the reconstructed rule tree, the number of occurrences of the parent node in the second rule tree is greater than or equal to the number of occurrences of the parent node's child nodes in the second rule tree.

[0063] Figure 6 A schematic diagram of the reconstruction process of a reconstructed rule tree provided by an embodiment of this application, as Figure 6 shown, this process includes:

[0064] S601: Use the second rule tree as the target rule tree;

[0065] S602: Determine whether the occurrence times of each node in the target rule tree are equal to 1; if there are nodes in the target rule tree with occurrence times greater than 1, execute S603, if the occurrence times of each node in the target rule tree are equal to 1, execute S604;

[0066] S603: Select the target node with the highest occurrence times in the target rule tree, merge each branch containing the target node in the target rule tree under the target node; and use the merged subtree with the target node as the root node as the new target rule tree, and continue to execute S602;

[0067] In some implementable ways, if there are multiple nodes with the highest occurrence times in the target rule tree, the analysis background server randomly selects one of these nodes as the target node.

[0068] For example, assume the target rule tree is Figure 5 the second rule tree shown. The nodes with the highest occurrence times in this rule tree include: "Payment amount > 5000", "Payment time > 22:00", and "Payee's location = M || Y", and their occurrence times are all 3. Based on this, the analysis background server can randomly select one of these three nodes. For example, if the randomly selected node is "Payment amount > 5000", further, the analysis background server can use this node as the target node.

[0069] In some implementable ways, if there are multiple nodes with the highest occurrence times in the target rule tree, the analysis background server selects one of these nodes as the target node according to a preset rule.

[0070] In some implementable ways, the preset rule is to select the node with the highest priority.

[0071] For example, assume the target rule tree is Figure 5 the second rule tree shown. The nodes with the highest occurrence times in this rule tree include: "Payment amount > 5000", "Payment time > 22:00", and "Payee's location = M || Y", and their occurrence times are all 3. Assume the priority order of these three nodes is "Payment amount > 5000" > "Payment time > 22:00" > "Payee's location = M || Y". Based on this, the analysis background server can use the node "Payment amount > 5000" as the target node.

[0072] In some implementable ways, the preset rule is to select the node with the minimum depth. If there are multiple nodes with the same depth, the analysis background server randomly selects one of these nodes as the target node.

[0073] In some implementable ways, for any node in the target rule tree, if the number of occurrences of the node in the target rule tree is greater than 1, the depth of the node can be the average of the multiple depths of the node, or the maximum value of the multiple depths of the node, or the maximum value of the multiple depths of the node. The embodiments of the present application do not limit this.

[0074] For example, assume that the target rule tree is Figure 5 the second rule tree shown. The nodes with the highest number of occurrences in this rule tree include: "Payment amount > 5000", "Payment time > 22:00", and "Payee location = M || Y", and their number of occurrences is 3 for each. The three depth values of the node "Payment amount > 5000" are: 2, 3, and 2. The three depth values of the node "Payment time > 22:00" are: 3, 4, and 3. The three depth values of the node "Payee location = M || Y" are: 4, 4, and 3. Assume that for any node in the target rule tree, if the number of occurrences of the node in the target rule tree is greater than 1, the depth of the node is the average of the multiple depths of the node. Based on this, the depth of the node "Payment amount > 5000" is 7 / 3, the depth of the node "Payment time > 22:00" is 10 / 3, and the depth of the node "Payee location = M || Y" is 11 / 3. The node with the minimum depth among the three is "Payment amount > 5000". Based on this, the analysis background server can use the node "Payment amount > 5000" as the target node.

[0075] For example, assume that the target rule tree is Figure 5The second rule tree shown. The nodes with the highest occurrence frequencies in this rule tree include: "Payment amount > 5000", "Payment time > 22:00", and "Payee location = M || Y", and their occurrence frequencies are all 3. The three depth values of the node "Payment amount > 5000" are: 2, 3, and 2. The three depth values of the node "Payment time > 22:00" are: 3, 4, and 3. The three depth values of the node "Payee location = M || Y" are: 4, 4, and 3. Assume that for any node in the target rule tree, if the occurrence frequency of this node in the target rule tree is greater than 1, then the depth of this node is the maximum value of the multiple depths of this node. Based on this, the depth of the node "Payment amount > 5000" is 3, the depth of the node "Payment time > 22:00" is 4, and the depth of the node "Payee location = M || Y" is 4. The node with the smallest depth among the three is "Payment amount > 5000". Based on this, the analysis back-end server can use the node "Payment amount > 5000" as the target node.

[0076] For example, assume the target rule tree is Figure 5 The second rule tree shown. The nodes with the highest occurrence frequencies in this rule tree include: "Payment amount > 5000", "Payment time > 22:00", and "Payee location = M || Y", and their occurrence frequencies are all 3. The three depth values of the node "Payment amount > 5000" are: 2, 3, and 2. The three depth values of the node "Payment time > 22:00" are: 3, 4, and 3. The three depth values of the node "Payee location = M || Y" are: 4, 4, and 3. Assume that for any node in the target rule tree, if the occurrence frequency of this node in the target rule tree is greater than 1, then the depth of this node is the minimum value of the multiple depths of this node. Based on this, the depth of the node "Payment amount > 5000" is 2, the depth of the node "Payment time > 22:00" is 3, and the depth of the node "Payee location = M || Y" is 3. The node with the smallest depth among the three is "Payment amount > 5000". Based on this, the analysis back-end server can use the node "Payment amount > 5000" as the target node.

[0077] It should be understood that the embodiments of the present application do not limit the selection method of the target node.

[0078] In some implementable ways, when the analysis back-end server merges each branch containing the target node in the target rule tree under the target node, if there is no node above the target node in the target rule tree, for the nodes below the target node in the target rule tree, maintain the relationships between these nodes and the relationship between the uppermost node among these nodes and the target node.

[0079] In some implementable manners, when the analysis background server merges each branch containing a target node in the target rule tree under the target node, if there are nodes above the target node in the target rule tree, for the nodes above the target node in the target rule tree, the uppermost node among these upper nodes is used as the child node of the target node, and the relationships between the remaining nodes among these upper nodes except the uppermost node and the uppermost node are maintained. For the nodes below the target node in the target rule tree, the relationships between these nodes are maintained, and the uppermost node among these nodes is connected below the last node among the original upper nodes of the target node.

[0080] It should be understood that the embodiments of the present application do not limit the branch merging method.

[0081] S604: Determine whether the target rule tree is the top-level rule tree; if the target rule tree is the top-level rule tree, execute S605; if the target rule tree is not the top-level rule tree, execute S606;

[0082] S605: Use the target rule tree as the reconstructed rule tree;

[0083] S606: Determine whether there are other nodes in the upper-level rule tree of the target rule tree except for the subtree to which the selected node belongs; if there are other nodes in the upper-level rule tree of the target rule tree except for the subtree to which the selected node belongs, execute S607; if there are no other nodes in the upper-level rule tree of the target rule tree except for the subtree to which the selected node belongs, execute S608;

[0084] S607: Use the subtree formed by the other nodes in the upper-level rule tree of the target rule tree except for the subtree to which the selected node belongs as the new target rule tree, and continue to execute S602;

[0085] S608: Determine whether the upper-level rule tree is the top-level rule tree; if the upper-level rule tree is the top-level rule tree, execute S609; if the upper-level rule tree

[0086] is not the top-level rule tree, use the upper-level rule tree as the new target rule tree, and continue to execute S606;

[0087] S609: Use the upper-level rule tree as the reconstructed rule tree.

[0088] For example, for Figure 5 the second rule tree shown below, the reconstruction process of the second rule tree is exemplarily described as follows:

[0089] Figures 7 to 14 This is a schematic diagram of the reconstruction process of a rule tree provided by the embodiments of the present application. First, Figure 5The second rule tree shown is used as the target rule tree; then it is determined whether the occurrence times of each node in the target rule tree are equal to 1; among them, the occurrence times of each node in the target rule tree are shown in Table 1:

[0090] Table 1

[0091] Node Occurrence times Payment amount > 5000 3 Payment time > 22:00 3 Payee's location = M || Y 3 Payment times > 2 2 Payee's gender = 1 1 100 1 200 1 Payment time < 24:00 1 Payee's age > 15 1 The age of the payee is < 65 1 300 1 400 1 500 1 600 1 Payee's IP address = IP1 || IP2 1 Payment amount > 10000 1

[0092] As can be seen from Table 1, Figure 5 in the second rule tree shown, that is, in the target rule tree, there are nodes with occurrence times greater than 1. Based on this, the analysis background server can select the target node with the highest occurrence time in the target rule tree. Among them, since the occurrence times of the nodes "Payment amount > 5000", "Payment time > 22:00", and "Payee location = M || Y" are all 3, therefore, the analysis background server can randomly select one of these three nodes as the target node. For example, the node "Payment amount > 5000" is randomly selected as the target node. In this case, Figure 5 each branch in the target rule tree shown that contains the node "Payment amount > 5000" is merged under the node "Payment amount > 5000", and the merging result is as Figure 7 shown. Among them, in the rule tree shown in Figure 5 the node "Payee IP address = IP1 || IP2" is the parent node of the node "Payment amount > 5000", and after the branch merging, the node "Payee IP address = IP1 || IP2" becomes the child node of the node "Payment amount > 5000", and the node "Payment time > 22:00" is the child node of the node "Payee IP address = IP1 || IP2".

[0093] Based on this, the analysis background server can use the merged subtree with the node "Payment amount > 5000" as the root node as the new target rule tree, and then determine whether the occurrence times of each node in the target rule tree are equal to 1; among them, the occurrence times of each node in the target rule tree are shown in Table 2:

[0094] Table 2

[0095] Node Occurrence times Payment amount > 5000 1 Payment time > 22:00 2 Payee's location = M || Y 3 Payment times > 2 2 Payee's gender = 1 1 100 1 200 1 Payment time < 24:00 1 Payee's age > 15 1 Payee age < 65 1 300 1 400 1 500 1 Payee's IP address = IP1 || IP2 1

[0096] As can be seen from Table 2, there are nodes with occurrence times greater than 1 in the target rule tree. Based on this, the analysis background server can select the target node with the highest occurrence time in the target rule tree, that is, the node "Payee location = M || Y" is used as the target node. In this case, each branch in the target rule tree that contains the node "Payee location = M || Y" is merged under the node "Payee location = M || Y", and the merging result is asFigure 8 As shown, in this target rule tree, the node "Payment time > 22:00" is the parent node of the node "Payee's location = M || Y". After branch merging, the node "Payment time > 22:00" becomes the child node of the node "Payee's location = M || Y". The node "Payee's gender = 1" is a child node of the node "Payment time > 22:00", and the node "200" is a child node of the node "Payment time > 22:00".

[0097] Based on this, the analysis backend server can use the merged subtree with the node "Payee's location = M || Y" as the root node as the new target rule tree, and then determine whether the occurrence count of each node in this target rule tree is equal to 1. The occurrence counts of the various nodes in this target rule tree are shown in Table 3 as follows:

[0098] Table 3

[0099] Node Occurrence times Payee's location = M || Y 1 Payment time > 22:00 2 Payee's gender = 1 1 Payment times > 2 1 100 1 200 1 500 1

[0100] As can be seen from Table 3, there are nodes in this target rule tree with an occurrence count greater than 1. Based on this, the analysis backend server can select the target node with the highest occurrence count in this target rule tree, that is, take the node "Payment time > 22:00" as the target node. In this case, each branch in this target rule tree that contains the node "Payment time > 22:00" is merged under the node "Payment time > 22:00", and the merger result is as Figure 9 shown.

[0101] Based on this, the analysis backend server can use the merged subtree with the node "Payment time > 22:00" as the root node as the new target rule tree, and then determine whether the occurrence count of each node in this target rule tree is equal to 1. The occurrence counts of the various nodes in this target rule tree are shown in Table 4 as follows:

[0102] Table 4

[0103] Node Occurrence times Payment time > 22:00 1 Payee's gender = 1 1 Payment times > 2 1 100 1 200 1

[0104] As can be seen from Table 4, the occurrence count of each node in this target rule tree is 1. Based on this, the analysis backend server can determine whether the target rule tree is the top-level rule tree. Since this target rule tree is not the top-level rule tree, the analysis backend server can determine whether there are other nodes in the upper-level rule tree of the target rule tree except for the subtree to which the selected node belongs. The upper-level rule tree of this target rule tree is Figure 9The subtree with the node "Payee's region = M || Y" as the root node, where, in this subtree, there are other nodes besides the merged subtree with the node "Payment time > 22:00" as the root node, and these other nodes are the node "500".

[0105] Based on this, the analysis backend server can use the subtree formed by the nodes in the upper-level rule tree of the target rule tree other than the subtree to which the selected node belongs as the new target rule tree, that is, as Figure 10 shown, use the subtree with the node "500" as the root node as the new target rule tree. Then, determine whether the occurrence count of each node in this target rule tree is equal to 1; among them, the occurrence counts of the various nodes in this target rule tree are shown in Table 5:

[0106] Table 5

[0107] Node Occurrence times 500 1

[0108] As can be seen from Table 5, there is only one node in this target rule tree, and the occurrence count of this node is 1. Based on this, the analysis backend server can determine whether the target rule tree is the top-level rule tree; since this target rule tree is not the top-level rule tree, the analysis backend server can determine whether there are other nodes in the upper-level rule tree of the target rule tree besides the subtree to which the selected node belongs; among them, the upper-level rule tree of this target rule tree is Figure 9 the subtree with the node "Payee's region = M || Y" as the root node, where, in this subtree, there are no other nodes besides the merged subtree with the node "Payment time > 22:00" as the root node and the subtree with the node "500" as the root node. Further, the analysis backend server can determine whether the upper-level rule tree is the top-level rule tree, that is, determine whether the subtree with the node "Payee's region = M || Y" as the root node is the top-level rule tree, and since this subtree is not the top-level rule tree, the analysis backend server can use this subtree as the new target rule tree and continue to determine whether there are other nodes in the upper-level rule tree of this target rule tree besides the subtree to which the selected node belongs; that is, determine whether there are other nodes in the subtree with the node "Payment amount > 5000" as the root node besides the subtree with the node "Payee's region = M || Y" as the root node, where, as Figure 11 shown, there are other nodes in the subtree with the node "Payment amount > 5000" as the root node besides the subtree with the node "Payee's region = M || Y" as the root node, and these nodes include: the node "Payee's IP address = IP1 || IP2", "Payment time > 22:00", "Payment time < 24:00", "Payee's age > 15", "Payee's age < 65", "300", "Payment times > 2", "400".

[0109] Further, the analysis background server may use the subtree formed by other nodes in the upper-layer rule tree of the target rule tree except for the subtree to which the selected node belongs as the new target rule tree, that is, as shown in Figure 11 it can use the subtree with the node "payee IP address = IP1 || IP2" as the root node as the new target rule tree, and then determine whether the occurrence times of each node in the target rule tree are equal to 1; among them, the occurrence times of each node in the target rule tree in the target rule tree are shown in Table 6:

[0110] Table 6

[0111] Node Occurrence times Payee's IP address = IP1 || IP2 1 Payment time > 22:00 1 Payment time < 24:00 1 Payee's age > 15 1 The age of the payee < 65 1 300 1

[0112] As can be seen from Table 6, the occurrence times of each node in the target rule tree are all 1. Based on this, the analysis background server can determine whether the target rule tree is the top-level rule tree; since the target rule tree is not the top-level rule tree, the analysis background server can determine whether there are other nodes in the upper-layer rule tree of the target rule tree except for the subtree to which the selected node belongs; among them, the upper-layer rule tree of the target rule tree is Figure 11 the subtree with the node "payment amount > 5000" as the root node in, among which, there are other nodes in the subtree except for the merged subtree with the node "payee location = M || Y" as the root node and the subtree with the node "payee IP address = IP1 || IP2" as the root node, and these nodes include: "payment times > 2", "400".

[0113] Further, the analysis background server may use the subtree formed by other nodes in the upper-layer rule tree of the target rule tree except for the subtree to which the selected node belongs as the new target rule tree, that is, as shown in Figure 12 it can use the subtree with the node "payment times > 2" as the root node as the new target rule tree, and then determine whether the occurrence times of each node in the target rule tree are equal to 1; among them, the occurrence times of each node in the target rule tree in the target rule tree are shown in Table 7:

[0114] Table 7

[0115] Node Occurrence times Payment times > 2 1 400 1

[0116] As can be seen from Table 7, the occurrence times of each node in the target rule tree are all 1. Based on this, the analysis background server can determine whether the target rule tree is the top-level rule tree; since the target rule tree is not the top-level rule tree, the analysis background server can determine whether there are other nodes in the upper-layer rule tree of the target rule tree except for the subtree to which the selected node belongs; among them, the upper-layer rule tree of the target rule tree is Figure 12The subtree with the node "Payment amount > 5000" as the root node, where there are no other nodes in this subtree except the merged subtree with the node "Recipient's region = M || Y" as the root node, the subtree with the node "Recipient's IP address = IP1 || IP2" as the root node, and the subtree with the node "Number of payments > 2" as the root node.

[0117] Further, the analysis background server can determine whether the upper-level rule tree is the top-level rule tree, that is, determine whether the subtree with the node "Payment amount > 5000" as the root node is the top-level rule tree. Since this subtree is not the top-level rule tree, the analysis background server can use this subtree as the new target rule tree and continue to determine whether there are other nodes in the upper-level rule tree of this target rule tree except for the subtree to which the selected node belongs; that is, determine whether there are other nodes in the tree with the node "Root node" as the root node except for the subtree with the node "Payment amount > 5000" as the root node. Among them, as Figure 12 shown, there are other nodes in the subtree with the node "Root node" as the root node except for the subtree with the node "Payment amount > 5000" as the root node. These nodes include: the node "Payment amount > 10000" and "600".

[0118] Further, the analysis background server can use the subtree formed by the other nodes in the upper-level rule tree of this target rule tree except for the subtree to which the selected node belongs as the new target rule tree. That is, as Figure 13 shown, the subtree with the node "Payment amount > 10000" as the root node can be used as the new target rule tree, and then determine whether the occurrence times of each node in this target rule tree are equal to 1; among them, the occurrence times of each node in this target rule tree are shown in Table 8:

[0119] Table 8

[0120] Node Occurrence times Payment amount > 10000 1 Payment time > 22:00 1 600 1

[0121] As can be seen from Table 8, the occurrence times of each node in this target rule tree are all 1. Based on this, the analysis background server can determine whether the target rule tree is the top-level rule tree; since this target rule tree is not the top-level rule tree, the analysis background server can determine whether there are other nodes in the upper-level rule tree of the target rule tree except for the subtree to which the selected node belongs; among them, the upper-level rule tree of this target rule tree is Figure 13 the tree with "Root node" as the root node in [document]. In this tree, there are no other nodes except the merged subtree with the node "Payment amount > 5000" as the root node and the subtree with the node "Payment amount > 10000" as the root node.

[0122] Further, the analysis backend server can determine whether the upper-level rule tree is the top-level rule tree; that is, to determine whether the tree with the "root node" as the root node is the top-level rule tree. Obviously, the tree with the "root node" as the root node is the top-level rule tree, then the analysis backend server can use the tree with the "root node" as the root node as the reconstructed rule tree, that is, Figure 14 the entire tree shown as the reconstructed rule tree.

[0123] It should be understood that the embodiments of the present application do not limit the reconstruction method for the second rule tree.

[0124] It should be understood that Figures 4 to 5 and Figures 7 to 14 the numbers in the leaf nodes in represent that the node is a leaf node, and these numbers have no actual meaning.

[0125] S330: Based on the reconstructed rule tree, determine the reason why the target object hits or does not hit the first rule tree.

[0126] In some implementable ways, when the target object hits the first rule tree, the analysis backend server can obtain the target leaf node that the target object hits in the first rule tree; determine the target path from the root node to the target leaf node in the reconstructed rule tree; based on the target path and the variable values carried in the target object corresponding to each variable in the target path, determine the reason why the target object hits the first rule tree.

[0127] For example, assume that the first rule tree is as Figure 4 shown. The target object is a payment request, and this payment request includes: payment amount = 6000, region where the payee is located = M, payment time = 23:00, gender of the payee = 1, number of payment times = 3. Based on this, this payment request matches four paths in the first rule tree where the leaf nodes are 100, 200, 400, and 500. Further, the analysis backend server can determine the path 1 from the root node to the leaf node 100, the path 2 from the root node to the leaf node 100, the path 4 from the root node to the leaf node 400, and the path 5 from the root node to the leaf node 500 in the reconstructed rule tree shown as Figure 14 shown.

[0128] The reason why the analysis backend server determines that the above payment request hits the first rule tree based on path 1 is: the payment amount is 6000, 6000 > 5000, region where the payee is located = M, payment time = 23:00, 23:00 > 22, gender of the payee = 1, number of payment times = 3, 3 > 2.

[0129] The reason why the analysis back-end server determines that the above payment request hits the first rule tree based on path 2 is: the payment amount is 6000, 6000 > 5000, the region where the payee is located = M, the payment time = 23:00, 23:00 > 22.

[0130] The reason why the analysis back-end server determines that the above payment request hits the first rule tree based on path 4 is: the payment amount is 6000, 6000 > 5000, the number of payment times = 3, 3 > 2.

[0131] The reason why the analysis back-end server determines that the above payment request hits the first rule tree based on path 5 is: the payment amount is 6000, 6000 > 5000, the region where the payee is located = M.

[0132] In some implementable ways, the analysis back-end server searches for the target path in the reconstructed rule tree to determine the target path.

[0133] In some other implementable ways, before the analysis back-end server determines the target path from the root node to the target leaf node in the reconstructed rule tree, the data processing method further includes: the analysis back-end server stores the paths from the root node to each leaf node of the reconstructed rule tree; correspondingly, the analysis back-end server determines the target path from the root node to the target leaf node in the reconstructed rule tree, including: the analysis back-end server searches for the target path based on the target leaf node in the stored paths.

[0134] For example, assuming the reconstructed rule tree is as Figure 14 shown, then the paths stored by the analysis back-end server include:

[0135] Path 1: Payment amount > 5000, region where the payee is located = M || Y, payment time > 22:00, payee gender = 1, number of payment times > 2, 100.

[0136] Path 2: Payment amount > 5000, payment time > 22:00, 200.

[0137] Path 3: Payment amount > 5000, payee IP address = IP1 || IP2, payment time > 22:00, payment time < 24:00, payee age > 15, payee age < 65, 300.

[0138] Path 4: Payment amount > 5000, 400.

[0139] Path 5: Payment amount > 5000, region where the payee is located = M || Y, 500.

[0140] Path 6: Payment amount > 10000, payment time > 22:00, number of payment times > 2, 600.

[0141] Further, the analysis background server respectively finds paths 1, 2, 4, and 5 based on leaf nodes 100, 200, 400, and 500.

[0142] In some implementable manners, the analysis background server may store the variable values corresponding to each variable in the target path and carried by the target object in the target path, so as to analyze the reason why the target object hits the first rule tree.

[0143] In some implementable manners, the analysis background server may store the variable values corresponding to each variable in the target path and carried by the target object in the target path, as well as the identifier of the target object, so as to analyze the reason why the target object hits the first rule tree.

[0144] It should be understood that in the related art, all variables involved in the first rule tree and the target object need to be stored so that the staff can analyze the reason why the target object hits the first rule tree. In the embodiments of the present application, however, it is only necessary to store the variable values corresponding to each variable in the target path and carried by the target object in the target path. Compared with the related art, the data processing method provided by the embodiments of the present application can reduce the storage cost.

[0145] It should be understood that if the version of the first rule tree is updated relatively frequently, then in the related art, each version of the first rule tree and all variables involved in the target object need to be stored. In the embodiments of the present application, however, it is only necessary to store the variable values corresponding to each variable in the target path and carried by the target object in the target path. Compared with the related art, the data processing method provided by the embodiments of the present application can greatly reduce the storage cost.

[0146] From another perspective, for each target object, in the related art, all variables involved in the first rule tree and the target object need to be stored. However, in the embodiments of the present application, it is only necessary to store the target path corresponding to each target object and the variable values corresponding to each variable in the target path and carried by the target object. Therefore, compared with the related art, the data processing method provided by the embodiments of the present application can greatly reduce the storage cost.

[0147] In some implementable manners, when the target object does not hit the first rule tree, the analysis background server may match the target object through reconstructing the rule tree to obtain a matching result; and determine the reason why the target object does not hit the first rule tree based on the matching result.

[0148] In some implementable manners, the matching result includes: the last node that the target object hits in the reconstructed rule tree.

[0149] In some implementable ways, the analysis backend server may, based on the matching result, determine the last node hit by the target object in the reconstructed rule tree; determine the next node of the last node in the reconstructed rule tree; and determine the reason why the target object fails to hit the first rule tree based on the next node and the variable values carried in the target object corresponding to the variables involved in the next node.

[0150] For example, assume that the first rule tree is as Figure 4 shown, and the target object is a payment request, which includes: payment amount = 6000, payment times = 1. Based on this, this payment request fails to hit any path in the first rule tree. Further, the analysis backend server may re-match this payment request through the reconstructed rule tree as Figure 14 shown, and determine that the last node matched by this payment request in the reconstructed rule tree is payment amount > 5000, and the next nodes of this node include: recipient area = M || Y, recipient IP address = IP1 || IP2, payment times > 2. Based on this, the analysis backend server determines the reason why the target object fails to hit the first rule tree based on the next node and the variable values carried in the target object corresponding to the variables involved in the next node: payment times = 1, which does not meet the condition: payment times > 2.

[0151] In some implementable ways, the analysis backend server may store the next node and the variable values carried in the target object corresponding to the variables involved in the next node.

[0152] In some implementable ways, the analysis backend server may store the next node, the variable values carried in the target object corresponding to the variables involved in the next node, and the identifier of the target object, so as to analyze the reason why the target object fails to hit the first rule tree.

[0153] It should be understood that in the related art, it is necessary to store all variables involved in the first rule tree and the target object, so that the staff can analyze the reason why the target object fails to hit the first rule tree. However, in the embodiments of the present application, it is only necessary to store the next node and the variable values carried in the target object corresponding to the variables involved in the next node. Compared with the related art, the data processing method provided by the embodiments of the present application can reduce the storage cost.

[0154] It should be understood that if the version of the first rule tree is updated relatively frequently, then in the related art, it is necessary to store each version of the first rule tree and all variables involved in the target object, while in the embodiments of the present application, it is only necessary to store the next node and the variable values carried in the target object corresponding to the variables involved in the next node. Compared with the related art, the data processing method provided by the embodiments of the present application can greatly reduce the storage cost.

[0155] From another perspective, in the related art, for each target object, all variables involved in the first rule tree and the target object need to be stored. However, in the embodiments of the present application, it is only necessary to store the next node involved in each target object and the variable value corresponding to the variable involved in the next node carried in the target object. Therefore, compared with the related art, the data processing method provided by the embodiments of the present application can greatly reduce the storage cost.

[0156] In some implementable ways, if there are duplicate next nodes, the analysis background server can perform deduplication storage on the next node and the variable value corresponding to the variable involved in the next node carried in the target object.

[0157] For example, assume that the first rule tree is as Figure 4 shown, and the target object is a payment request, which includes: payment amount = 15000, payee IP address = IP1||IP2, payment time = 21:00, payment times = 1. Based on this, this payment request does not hit any path in the first rule tree. Further, the analysis background server can re-match this payment request through the Figure 14 reconstructed rule tree shown, and determine that the last nodes matched by this payment request in the reconstructed rule tree include: payee IP address = IP1||IP2, payment amount > 5000, payment amount > 10000. And the next node of the node: payee IP address = IP1||IP2 is: payment time > 22:00, the next node of the node: payment amount > 5000 is: payment times > 2, and the next node of the node: payment amount > 10000 is: payment time > 22:00. Among them, the node payment time > 22:00 appears twice. Therefore, the analysis background server can perform deduplication storage on this node, that is, the analysis background server can store the nodes: payment times > 2 and payment time > 22:00. Correspondingly, the variable values corresponding to the variables involved in the next node can also be deduplicated and stored, that is, the analysis background server can store payment time = 21:00 and payment times = 1.

[0158] It should be understood that by performing deduplication storage on the next node and the variable value corresponding to the variable involved in the next node carried in the target object by the analysis background server, the storage cost can be further reduced.

[0159] In some implementable ways, after the analysis background server determines the reason why the target object hits or does not hit the first rule tree based on the reconstructed rule tree, it can send the reason why the target object hits or does not hit the first rule tree to the client; so that the client can display the reason why the target object hits or does not hit the first rule tree.

[0160] An embodiment of the present application provides a data processing method, including: splitting nodes composed of multiple minimum judgment conditions in a first rule tree according to the criterion that each node includes one minimum judgment condition, to obtain a second rule tree; reconstructing the second rule tree based on the occurrence times of each node in the second rule tree in the second rule tree, to obtain a reconstructed rule tree; wherein, the occurrence times of each node in the reconstructed rule tree in the reconstructed rule tree is 1, and for any parent node other than the root node in the reconstructed rule tree, the occurrence times of the parent node in the second rule tree is greater than or equal to the occurrence times of the child nodes of the parent node in the second rule tree; determining the reason why the target object hits or does not hit the first rule tree based on the reconstructed rule tree.

[0161] Since the reconstructed rule tree is the result of merging duplicate nodes in the first rule tree, the structure of the reconstructed rule tree is simple, so that the reason why the target object hits the first rule tree can be quickly located based on the reconstructed rule tree.

[0162] Further, in the embodiment of the present application, it is only necessary to obtain the target leaf node hit by the target object in the first rule tree; determine the target path from the root node to the target leaf node in the reconstructed rule tree; determine the reason why the target object hits the first rule tree based on the target path and the variable values carried in the target object corresponding to the various variables in the target path. Thus, the reason why the target object hits the first rule tree can be quickly located based on the reconstructed rule tree.

[0163] In the related art, on the one hand, the first rule tree is very complex, and there are often duplicate judgment conditions or duplicate nodes, resulting in that the target object does not match a large number of nodes. On the other hand, since some nodes include multiple judgment conditions, even if such nodes are used as the nodes that the target object does not hit, it is still necessary to further determine which judgment condition causes the target object not to hit the first rule tree. Based on this, it is impossible to quickly locate the reason why the target object does not hit the first rule tree. However, in the embodiment of the present application, since the nodes closer to the top layer in the reconstructed rule tree have higher occurrence times in the first rule tree, on the contrary, the nodes closer to the bottom layer have lower occurrence times in the first rule tree. In other words, the next node of the last node that the target object matches with the reconstructed rule tree is probably the reason why it does not hit the first rule tree, and since each node in the reconstructed rule tree only contains one minimum judgment condition, it is only necessary to find this next node to locate the reason why the target object does not hit the first rule tree.

[0164] The preferred embodiments of the present application have been described in detail above in conjunction with the accompanying drawings. However, the present application is not limited to the specific details in the above embodiments. Within the scope of the technical concept of the present application, various simple modifications can be made to the technical solutions of the present application, and these simple modifications all fall within the protection scope of the present application. For example, in the various specific technical features described in the above specific embodiments, they can be combined in any appropriate manner without contradiction. To avoid unnecessary repetition, the present application will not separately describe various possible combination methods. Also, for example, any combination can be made between various different embodiments of the present application, as long as it does not violate the idea of the present application, it should also be regarded as the content disclosed by the present application.

[0165] It should also be understood that in various method embodiments of the present application, the magnitudes of the sequence numbers of the above processes do not mean the order of execution is prior or subsequent. The order of execution of each process should be determined according to its function and internal logic, and should not constitute any limitation to the implementation process of the embodiments of the present application.

[0166] The method provided by the embodiments of the present application has been described above. Next, the data processing device provided by the embodiments of the present application will be described.

[0167] Figure 15 It is a schematic diagram of a data processing device 1500 provided by an embodiment of the present application. As Figure 15 shown, the device 1500 includes: a splitting module 1510, a reconstructing module 1520, and a determining module 1530. Among them, the splitting module 1510 is used to split the nodes composed of multiple minimum judgment conditions in the first rule tree according to the criterion that each node includes one minimum judgment condition, so as to obtain a second rule tree; the reconstructing module 1520 is used to reconstruct the second rule tree to obtain a reconstructed rule tree; wherein, the number of occurrences of each node in the reconstructed rule tree in its affiliated subtree is 1, and for any parent node other than the root node in the reconstructed rule tree, the number of occurrences of the parent node in the second rule tree is greater than or equal to the number of occurrences of the child node of the parent node in the second rule tree; the determining module 1530 is used to determine the reason why the target object hits or does not hit the first rule tree based on the reconstructed rule tree.

[0168] In some implementable ways, the reconstruction module 1520 is specifically configured to: use the second rule tree as the target rule tree; determine whether the occurrence times of each node in the target rule tree is equal to 1; if there is a node in the target rule tree whose occurrence times is greater than 1, select the target node with the highest occurrence times in the target rule tree, merge each branch in the target rule tree that contains the target node under the target node; and use the merged subtree with the target node as the root node as the new target rule tree, and continue to execute: determine whether the occurrence times of each node in the target rule tree is equal to 1; if the occurrence times of each node in the target rule tree is equal to 1, determine whether the target rule tree is the top-level rule tree; if the target rule tree is the top-level rule tree, use the target rule tree as the reconstructed rule tree; if the target rule tree is not the top-level rule tree, determine whether there are other nodes in the upper-level rule tree of the target rule tree except for the subtree to which the selected node belongs; if there are other nodes in the upper-level rule tree of the target rule tree except for the subtree to which the selected node belongs, use the subtree formed by the other nodes in the upper-level rule tree of the target rule tree except for the subtree to which the selected node belongs as the new target rule tree, and continue to execute: determine whether the occurrence times of each node in the target rule tree is equal to 1; if there are no other nodes in the upper-level rule tree of the target rule tree except for the subtree to which the selected node belongs, determine whether the upper-level rule tree is the top-level rule tree; if the upper-level rule tree is the top-level rule tree, use the upper-level rule tree as the reconstructed rule tree; if the upper-level rule tree is not the top-level rule tree, use the upper-level rule tree as the new target rule tree, and continue to execute: determine whether there are other nodes in the upper-level rule tree of the target rule tree except for the subtree to which the selected node belongs.

[0169] In some implementable ways, the determination module 1530 is specifically configured to: when the target object hits the first rule tree, obtain the target leaf node that the target object hits in the first rule tree; determine the target path from the root node to the target leaf node in the reconstructed rule tree; and determine the reason why the target object hits the first rule tree based on the target path and the variable values carried in the target object corresponding to the variables in the target path.

[0170] In some implementable ways, the data processing device 1500 further includes: a storage module 1540, configured to store the paths from the root node to each leaf node of the reconstructed rule tree before the determination module 1530 determines the target path from the root node to the target leaf node in the reconstructed rule tree; correspondingly, the determination module 1530 is specifically configured to: search for the target path based on the target leaf node in the stored paths.

[0171] In some implementable ways, the storage module 1540 is further configured to: store the target path and the variable values carried in the target object corresponding to the variables in the target path.

[0172] In some implementable manners, the determining module 1530 is specifically configured to: when the target object does not hit the first rule tree, match the target object through reconstructing the rule tree to obtain a matching result; and determine the reason why the target object does not hit the first rule tree based on the matching result.

[0173] In some implementable manners, the determining module 1530 is specifically configured to: based on the matching result, determine the last node that the target object hits in the reconstructed rule tree; determine the next node of the last node in the reconstructed rule tree; and determine the reason why the target object does not hit the first rule tree based on the next node and the variable value carried in the target object corresponding to the variable involved in the next node.

[0174] In some implementable manners, the storage module 1540 is further configured to: store the next node and the variable value carried in the target object corresponding to the variable involved in the next node.

[0175] In some implementable manners, the storage module 1540 is specifically configured to: if there are duplicate next nodes, perform deduplication storage on the next node and the variable value carried in the target object corresponding to the variable involved in the next node.

[0176] In some implementable manners, the data processing device 1500 further includes: a sending module 1550, configured to send, to the client, the reason why the target object hits or does not hit the first rule tree after the determining module 1530 determines the reason why the target object hits or does not hit the first rule tree based on the reconstructed rule tree; so that the client can display the reason why the target object hits or does not hit the first rule tree.

[0177] In some implementable manners, the target object is a target payment request.

[0178] It should be understood that the device embodiments and the method embodiments can correspond to each other, and similar descriptions can refer to the method embodiments. To avoid repetition, they will not be elaborated here. Specifically, Figure 15 the illustrated device 1500 can execute Figure 3 the corresponding method embodiments, and the foregoing and other operations and / or functions of each module in the device 1500 respectively serve to implement Figure 3 the corresponding processes in each method therein. For the sake of brevity, they will not be elaborated here.

[0179] In the foregoing, the apparatus 1500 according to the embodiments of the present application has been described from the perspective of functional modules with reference to the accompanying drawings. It should be understood that these functional modules can be implemented in the form of hardware, or in the form of instructions in software, or in a combination of hardware and software modules. Specifically, the steps of the method embodiments in the present application can be completed by the integrated logic circuit in the hardware in the processor and / or instructions in the form of software. The steps of the method disclosed in combination with the embodiments of the present application can be directly embodied as being executed and completed by a hardware decoding processor, or executed and completed by a combination of the hardware and software modules in the decoding processor. Optionally, the software module can be located in a mature storage medium in the art such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, an electrically erasable programmable memory, a register, etc. This storage medium is located in the memory, and the processor reads the information in the memory and combines its hardware to complete the steps in the foregoing method embodiments.

[0180] Figure 16 It is a schematic block diagram of an electronic device provided by an embodiment of the present application.

[0181] As Figure 16 shown, the electronic device may include:

[0182] A memory 1610 and a processor 1620. The memory 1610 is used to store a computer program and transmit the program code to the processor 1620. In other words, the processor 1620 can call and run the computer program from the memory 1610 to implement the method in the embodiments of the present application.

[0183] For example, the processor 1620 can be used to execute the foregoing method embodiments according to the instructions in the computer program.

[0184] In some embodiments of the present application, the processor 1620 may include, but is not limited to:

[0185] A general-purpose processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, and so on.

[0186] In some embodiments of the present application, the memory 1610 includes, but is not limited to:

[0187] Volatile memory and / or non-volatile memory. Among them, the non-volatile memory can be a Read-Only Memory (ROM), a Programmable ROM (PROM), an Erasable PROM (EPROM), an Electrically Erasable PROM (EEPROM), or a flash memory. The volatile memory can be a Random Access Memory (RAM), which is used as an external cache. By way of example but not limitation, many forms of RAM are available, such as Static RAM (SRAM), Dynamic RAM (DRAM), Synchronous DRAM (SDRAM), Double Data Rate SDRAM (DDR SDRAM), Enhanced SDRAM (ESDRAM), synch link DRAM (SLDRAM), and Direct Rambus RAM (DR RAM).

[0188] In some embodiments of the present application, the computer program may be divided into one or more modules, and the one or more modules are stored in the memory 1610 and executed by the processor 1620 to complete the method provided by the present application. The one or more modules may be a series of computer program instruction segments capable of performing specific functions, and the instruction segments are used to describe the execution process of the computer program in the electronic device.

[0189] As Figure 16 shown, the electronic device may further include:

[0190] A transceiver 1630, which may be connected to the processor 1620 or the memory 1610.

[0191] Among them, the processor 1620 can control the transceiver 1630 to communicate with other devices. Specifically, it can send information or data to other devices, or receive information or data sent by other devices. The transceiver 1630 may include a transmitter and a receiver. The transceiver 1630 may further include an antenna, and the number of antennas may be one or more.

[0192] It should be understood that the various components in the electronic device are connected through a bus system. Among them, the bus system includes not only a data bus, but also a power bus, a control bus, and a status signal bus.

[0193] This application also provides a computer storage medium, on which a computer program is stored. When the computer program is executed by a computer, the computer can execute the methods in the above method embodiments. Or rather, the embodiments of this application also provide a computer program product containing instructions. When the instructions are executed by a computer, the computer executes the methods in the above method embodiments.

[0194] When implemented using software, it can be fully or partially implemented in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the processes or functions according to the embodiments of this application are fully or partially generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from a website, a computer, a server, or a data center to another website, computer, server, or data center in a wired manner (such as coaxial cable, optical fiber, digital subscriber line (DSL)) or a wireless manner (such as infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or a data center that integrates one or more available media. The available medium can be a magnetic medium (such as a floppy disk, a hard disk, a magnetic tape), an optical medium (such as a digital video disc (DVD)), or a semiconductor medium (such as a solid state disk (SSD)), etc.

[0195] Those of ordinary skill in the art can realize that the modules and algorithm steps of each example described in combination with the embodiments disclosed in this article can be implemented by electronic hardware, or by a combination of computer software and electronic hardware. Whether these functions are executed in a hardware or software manner depends on the specific application and design constraints of the technical solution. Professional technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of this application.

[0196] In several embodiments provided in the present application, it should be understood that the disclosed systems, devices, and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For example, the division of the modules is only a logical function division. In actual implementation, there may be other division methods. For example, multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the displayed or discussed coupling or direct coupling or communication connection between each other can be through some interfaces. The indirect coupling or communication connection of the device or module can be in electrical, mechanical, or other forms.

[0197] The modules described as separate components may or may not be physically separated. The components shown as modules may or may not be physical modules, that is, they can be located in one place or distributed to multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment. For example, in each embodiment of the present application, the various functional modules can be integrated in a processing module, or each module can exist physically alone, or two or more modules can be integrated in one module.

[0198] The above content is only the specific implementation manner of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art within the technical scope disclosed in the present application can easily think of changes or substitutions, which should all be covered by the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A data processing method, characterized in that, Including: Splitting nodes in the first rule tree composed of a plurality of the minimum judgment conditions according to the criterion that each node includes a minimum judgment condition to obtain a second rule tree; Reconstructing the second rule tree to obtain a reconstructed rule tree; wherein, the number of occurrences of each node in the reconstructed rule tree in its subtree is 1, and for any parent node other than the root node in the reconstructed rule tree, the number of occurrences of the parent node in the second rule tree is greater than or equal to the number of occurrences of the child nodes of the parent node in the second rule tree; Based on the reconstructed rule tree, determining the reason why the target object hits or does not hit the first rule tree.

2. The method according to claim 1, characterized in that, The reconstructing the second rule tree to obtain a reconstructed rule tree includes: Taking the second rule tree as the target rule tree; Judging whether the number of occurrences of each node in the target rule tree is equal to 1; If there is a node with the number of occurrences greater than 1 in the target rule tree, selecting the target node with the highest number of occurrences in the target rule tree, merging each branch containing the target node in the target rule tree under the target node; and taking the merged subtree with the target node as the root node as the new target rule tree, and continue to execute: judging whether the number of occurrences of each node in the target rule tree is equal to 1; If the number of occurrences of each node in the target rule tree is equal to 1, judging whether the target rule tree is the top-level rule tree; If the target rule tree is the top-level rule tree, taking the target rule tree as the reconstructed rule tree; If the target rule tree is not the top-level rule tree, judging whether there are other nodes in the upper-level rule tree of the target rule tree except for the subtree to which the selected node belongs; If there are other nodes in the upper-level rule tree of the target rule tree except for the subtree to which the selected node belongs, taking the subtree composed of the other nodes in the upper-level rule tree of the target rule tree except for the subtree to which the selected node belongs as the new target rule tree, and continue to execute: judging whether the number of occurrences of each node in the target rule tree is equal to 1; If there are no other nodes in the upper-level rule tree of the target rule tree except for the subtree to which the selected node belongs, judging whether the upper-level rule tree is the top-level rule tree; If the upper-level rule tree is the top-level rule tree, taking the upper-level rule tree as the reconstructed rule tree; If the upper-level rule tree is not the top-level rule tree, taking the upper-level rule tree as the new target rule tree, and continue to execute: judging whether there are other nodes in the upper-level rule tree of the target rule tree except for the subtree to which the selected node belongs.

3. The method according to claim 1 or 2, characterized in that, The determining, based on the reconstructed rule tree, the reason why the target object hits or does not hit the first rule tree includes: When the target object hits the first rule tree, obtaining the target leaf node hit by the target object in the first rule tree; Determining the target path from the root node to the target leaf node in the reconstructed rule tree; Determine the reason why the target object hits the first rule tree based on the target path and the variable values carried in the target object corresponding to each variable in the target path.

4. The method according to claim 3, characterized in that Before determining the target path from the root node to the target leaf node in the reconstructed rule tree, it further includes: Store the paths from the root node to each leaf node of the reconstructed rule tree; Determining the target path from the root node to the target leaf node in the reconstructed rule tree includes: Search for the target path based on the target leaf node in the stored paths.

5. The method according to claim 3, characterized in that It further includes: Store the target path and the variable values carried in the target object corresponding to each variable in the target path.

6. The method according to claim 1 or 2, characterized in that, Based on the reconstructed rule tree, determining the reason why the target object hits or does not hit the first rule tree includes: In the case where the target object does not hit the first rule tree, match the target object through the reconstructed rule tree to obtain a matching result; Determine the reason why the target object does not hit the first rule tree based on the matching result.

7. The method according to claim 6, characterized in that, Based on the matching result, determining the reason why the target object does not hit the first rule tree includes: Based on the matching result, determine the last node hit by the target object in the reconstructed rule tree; Determine the next node of the last node in the reconstructed rule tree; Based on the next node and the variable values carried in the target object corresponding to the variables involved in the next node, determine the reason why the target object does not hit the first rule tree.

8. The method according to claim 7, wherein It further includes: Store the next node and the variable values carried in the target object corresponding to the variables involved in the next node.

9. The method according to claim 8, wherein Storing the next node and the variable values carried in the target object corresponding to the variables involved in the next node includes: If there are duplicate next nodes, perform deduplication storage on the next node and the variable values carried in the target object corresponding to the variables involved in the next node.

10. The method according to claim 1 or 2, characterized in that, After determining the reason why the target object hits or does not hit the first rule tree based on the reconstructed rule tree, it further includes: Send the reason why the target object hits or does not hit the first rule tree to the client; so that the client can display the reason why the target object hits or does not hit the first rule tree.

11. The method according to claim 1 or 2, characterized in that, The target object is a target payment request.

12. A data processing device, characterized in that, It includes: A splitting module for splitting the nodes composed of multiple minimum judgment conditions in the first rule tree according to the criterion that each node includes one minimum judgment condition to obtain a second rule tree; A reconstruction module for reconstructing the second rule tree to obtain a reconstructed rule tree; wherein, the number of occurrences of each node in the reconstructed rule tree in its sub-tree is 1, and for any parent node other than the root node in the reconstructed rule tree, the number of occurrences of the parent node in the second rule tree is greater than or equal to the number of occurrences of the child nodes of the parent node in the second rule tree; A determination module, configured to determine, based on the reconstructed rule tree, the reason why the target object hits or does not hit the first rule tree.

13. An electronic device, characterized in that, Comprising: A processor and a memory, the memory is used for storing a computer program, and the processor is used for calling and running the computer program stored in the memory to execute the method according to any one of claims 1 to 11.

14. A computer-readable storage medium, characterized in that: For storing a computer program, the computer program causes a computer to execute the method according to any one of claims 1 to 11.

15. A computer program product, comprising a computer program / instructions, characterized in that, When the computer program / instructions are executed by a processor, the method according to any one of claims 1 to 11 is implemented.

Images