Business system monitoring method and device and electronic equipment

Abstract

The invention discloses a monitoring method and device of a business system and electronic equipment, and relates to the field of financial science and technology or other related fields, and the monitoring method comprises the steps: receiving a command monitoring request sent by the business system, confirming command information carried by the command monitoring request, obtaining command confirmation information, and sending the command confirmation information to the business system; evaluating the command confirmation information to obtain an evaluation result, monitoring the command confirmation information based on the command initiation information to obtain a monitoring result, and authenticating the initiator indicated by the initiator identifier to obtain an authentication result when the evaluation result is a first risk level and the monitoring result is in a normal monitoring state; and returning an execution command response to the service system under the condition that the authentication result indicates that the initiating end is successfully authenticated. According to the method and the device, the technical problem that the security of monitoring the business system is relatively low in the related technology is solved.

Description

Technical Field

[0001] The present invention relates to the field of financial technology, and in particular to a monitoring method for a business system, a device thereof, and an electronic device. Background Art

[0002] Financial institution business refers to the business conducted by financial institutions. Based on the complexity of the business and the degree of reliance on branches, financial institution business can be divided into traditional business and complex business. Based on the composition of the balance sheet, financial institution business can be divided into liability business, asset business, and intermediary business. Liability business is the business that provides financial institutions with funding and is an important foundation for their intermediary and asset businesses.

[0003] With the continuous development of the Internet, business systems have become an important tool for handling financial institutions' business. Therefore, business systems need to be monitored to ensure the security of financial institutions' business.

[0004] However, current business system monitoring methods cannot detect and conduct risk assessment and analysis on commands input by users, nor can they locate the output commands, resulting in greater risks for financial institutions' business.

[0005] To the above problems, no effective solution has been proposed yet. Summary of the Invention

[0006] The embodiments of the present invention provide a method for monitoring a business system, an apparatus thereof, and an electronic device thereof, so as to at least solve the technical problem of low security in monitoring a business system in related technologies.

[0007] According to one aspect of an embodiment of the present invention, a monitoring method for a business system is provided, which is applied to the monitoring system and includes: receiving a command monitoring request sent by the business system, and confirming the command information carried by the command monitoring request to obtain command confirmation information, wherein the command monitoring request also carries an initiator identifier and command initiation information; evaluating the command confirmation information to obtain an evaluation result; monitoring the command confirmation information based on the command initiation information to obtain a monitoring result; when the evaluation result is a first risk level and the monitoring result is a normal monitoring state, authenticating the initiator indicated by the initiator identifier to obtain an authentication result, and when the authentication result indicates that the authentication of the initiator is successful, returning an execution command response to the business system.

[0008] Furthermore, before receiving the command monitoring request sent by the business system, it also includes: when the business system receives the command information input by the initiator, controlling the business system to collect the input time and input location when the initiator inputs the command information; controlling the business system to send a command monitoring request to the monitoring system based on the command information, input time and input location.

[0009] Furthermore, the step of confirming the command information carried by the command monitoring request and obtaining command confirmation information includes: extracting keywords in the command information to obtain a keyword set; returning the keyword set to the business system, wherein the business system displays the keyword set at the initiating end and returns a confirmation response to the monitoring system when the initiating end triggers a confirmation operation; when the confirmation response is received, command confirmation information is obtained based on the keyword set.

[0010] Furthermore, the step of evaluating the command confirmation information to obtain an evaluation result includes: extracting features from the command confirmation information to obtain a feature vector; processing the feature vector using a risk assessment model to obtain a risk score, wherein the risk assessment model is pre-connected with the monitoring system; when the risk score falls within a first preset range, determining that the evaluation result is a first type of risk level; when the risk score falls within a second preset range, determining that the evaluation result is a second type of risk level, wherein the risk indicated by the second type of risk level is higher than the risk indicated by the first type of risk level.

[0011] Furthermore, based on the command initiation information, the command confirmation information is monitored to obtain the monitoring result, including: detecting whether the command initiation library contains the target history command initiation information of the initiator, wherein the command initiation library includes: multiple historical command initiation information associated with the initiator; in the case that the command initiation library contains the target history command initiation information, obtaining the target history command initiation information, wherein the target history command initiation information includes at least: multiple target history input times, multiple target history input positions; in the case that the input time contained in the command initiation information belongs to multiple target history input times and the input position contained in the command initiation information belongs to multiple target history input positions, determining that the monitoring result is a normal monitoring state; in the case that the input time contained in the command initiation information does not belong to multiple target history input times, and / or the input position contained in the command initiation information does not belong to multiple target history input positions, determining that the monitoring result is an abnormal monitoring state.

[0012] Furthermore, after detecting whether the command initiation library contains the target historical command initiation information of the initiator, it also includes: if the command initiation library does not contain the target historical command initiation information, recording the command initiation information to the command initiation library; judging whether the input time contained in the command initiation information falls within the preset time range, and judging whether the input position contained in the command initiation information falls within the preset position range; if the input time contained in the command initiation information falls within the preset time range and the input position contained in the command initiation information falls within the preset position range, determining that the monitoring result is a normal monitoring state.

[0013] Furthermore, when the assessment result is the first risk level and the monitoring result is a normal monitoring state, the step of authenticating the initiator indicated by the initiator identifier includes: triggering the first authentication policy when the assessment result is the first risk level and the monitoring result is a normal monitoring state; authenticating the initiator based on the first authentication policy; and returning a lock command response to the business system when the authentication fails and the number of authentication failures reaches a preset number.

[0014] Furthermore, after monitoring the command confirmation information based on the command initiation information and obtaining the monitoring results, it also includes: triggering the second type of authentication strategy when the evaluation result is the second type of risk level, and / or the monitoring result is an abnormal monitoring state; and authenticating the initiator based on the second type of authentication strategy.

[0015] According to another aspect of an embodiment of the present invention, a monitoring device for a business system is also provided, which is applied to the monitoring system and includes: a confirmation unit for receiving a command monitoring request sent by the business system, and confirming the command information carried by the command monitoring request to obtain command confirmation information, wherein the command monitoring request also carries an initiator identifier and command initiation information; an evaluation unit for evaluating the command confirmation information to obtain an evaluation result; a monitoring unit for monitoring the command confirmation information based on the command initiation information to obtain a monitoring result; an authentication unit for authenticating the initiator indicated by the initiator identifier when the evaluation result is a first risk level and the monitoring result is a normal monitoring state to obtain an authentication result, and returning an execution command response to the business system when the authentication result indicates that the authentication of the initiator is successful.

[0016] Furthermore, the monitoring device also includes: a first acquisition module, which is used to control the business system to collect the input time and input position of the command information input by the initiator before receiving the command monitoring request sent by the business system, when the business system receives the command information input by the initiator; a first sending module, which is used to control the business system to send a command monitoring request to the monitoring system based on the command information, input time and input position.

[0017] Furthermore, the confirmation unit includes: a first extraction module, used to extract keywords from the command information to obtain a keyword set; a first return module, used to return the keyword set to the business system, wherein the business system displays the keyword set at the initiating end and returns a confirmation response to the monitoring system when the confirmation operation is triggered at the initiating end; when the confirmation response is received, command confirmation information is obtained based on the keyword set.

[0018] Furthermore, the evaluation unit includes: a second extraction module, used to extract features from the command confirmation information to obtain a feature vector; a first processing module, used to process the feature vector using a risk assessment model to obtain a risk score, wherein the risk assessment model is pre-connected with the monitoring system; a first determination module, used to determine that the evaluation result is a first type of risk level when the risk score falls within a first preset range; a second determination module, used to determine that the evaluation result is a second type of risk level when the risk score falls within a second preset range, wherein the risk indicated by the second type of risk level is higher than the risk indicated by the first type of risk level.

[0019] Furthermore, the monitoring unit includes: a first detection module, used to detect whether the command initiation library contains the target history command initiation information of the initiator, wherein the command initiation library includes: multiple historical command initiation information associated with the initiator; a first acquisition module, used to acquire the target history command initiation information when the command initiation library contains the target history command initiation information, wherein the target history command initiation information includes at least: multiple target history input times and multiple target history input positions; a third determination module, used to determine that the monitoring result is a normal monitoring state when the input time contained in the command initiation information belongs to multiple target history input times and the input position contained in the command initiation information belongs to multiple target history input positions; a fourth determination module, used to determine that the monitoring result is an abnormal monitoring state when the input time contained in the command initiation information does not belong to multiple target history input times, and / or the input position contained in the command initiation information does not belong to multiple target history input positions.

[0020] Furthermore, the monitoring device also includes: a first recording module, which is used to record the command initiation information to the command initiation library after detecting whether the command initiation library contains the target historical command initiation information of the initiator, if the command initiation library does not contain the target historical command initiation information; a first judgment module, which is used to judge whether the input time contained in the command initiation information belongs to the preset time range, and judge whether the input position contained in the command initiation information belongs to the preset position range; a fifth determination module, which is used to determine that the monitoring result is a normal monitoring state when the input time contained in the command initiation information belongs to the preset time range and the input position contained in the command initiation information belongs to the preset position range.

[0021] Furthermore, the authentication unit includes: a first trigger module, used to trigger the first type of authentication policy when the assessment result is the first type of risk level and the monitoring result is a normal monitoring state; a first authentication module, used to authenticate the initiator based on the first type of authentication policy; a second return module, used to return a lock command response to the business system when the authentication fails and the number of authentication failures reaches a preset number.

[0022] Furthermore, the monitoring device also includes: a second trigger module, which is used to monitor the command confirmation information based on the command initiation information, and after obtaining the monitoring result, trigger the second type of authentication strategy when the evaluation result is the second type of risk level and / or the monitoring result is an abnormal monitoring state; a second authentication module, which is used to authenticate the initiator based on the second type of authentication strategy.

[0023] According to another aspect of an embodiment of the present invention, a computer program product is also provided, including a non-volatile computer-readable storage medium, the non-volatile computer-readable storage medium storing a computer program, and when the computer program is executed by a processor, implementing any of the above-mentioned business system monitoring methods.

[0024] According to another aspect of an embodiment of the present invention, an electronic device is also provided, comprising one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by one or more processors, the one or more processors implement any of the above-mentioned business system monitoring methods.

[0025] In the present invention, a command monitoring request sent by a business system is received, and the command information carried in the command monitoring request is confirmed to obtain command confirmation information, the command confirmation information is evaluated to obtain an evaluation result, and the command confirmation information is monitored based on the command initiation information to obtain a monitoring result. When the evaluation result is a first-class risk level and the monitoring result is a normal monitoring state, the initiator indicated by the initiator identifier is authenticated to obtain an authentication result, and when the authentication result indicates that the authentication of the initiator is successful, an execution command response is returned to the business system, thereby solving the technical problem of low security in monitoring the business system in related technologies.

[0026] In the present invention, the authenticity and accuracy of the command are ensured by extracting and confirming keywords from the command information. Then, the command confirmation information is evaluated using a risk assessment model, which can intelligently identify the potential risk level. By combining the command initiation information, the command confirmation information is monitored, which can further verify the rationality of the command, thereby achieving the technical effect of enhancing the ability of the business system to resist malicious attacks, reducing the misjudgment rate, and improving business continuity and user satisfaction. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0028] Figure 1 A hardware structure block diagram of a computer terminal (or mobile device) for implementing a method for monitoring a business system is shown;

[0029] Figure 2 is a flowchart of a method for monitoring a business system according to embodiment 1 of the present invention;

[0030] Figure 3 is a schematic diagram of a monitoring system according to embodiment 1 of the present invention;

[0031] Figure 4 is a schematic diagram of monitoring performed by the monitoring system according to Example 1 of the present invention;

[0032] Figure 5 is a schematic diagram of an optional monitoring device for a business system according to an embodiment of the present invention;

[0033] Figure 6 is a structural block diagram of an electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0034] In order to enable those skilled in the art to better understand the solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the embodiments described are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of the present invention.

[0035] It should be noted that the terms "first", "second", etc. in the description and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that the numbers used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0036] It should be noted that the relevant information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) collected and involved in the present invention are all information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data comply with the relevant laws, regulations and standards of the relevant regions, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entrances for users to choose to authorize or refuse. For example, an interface is set up between this system and the relevant users or institutions. Before obtaining relevant information, it is necessary to send an acquisition request to the aforementioned user or institution through the interface, and obtain relevant information after receiving the consent information fed back by the aforementioned user or institution.

[0037] In the present invention, a security monitoring method for a business system is proposed, which can solve the problem in related technologies that the commands input by the user cannot be detected and risk assessed and analyzed, and the input information cannot be located, which easily leads to greater business risks.

[0038] The present invention will be described in detail below with reference to various embodiments.

[0039] Example 1

[0040] According to an embodiment of the present application, an embodiment of a method for monitoring a business system is also provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0041] The method embodiment provided in the first embodiment of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Figure 1 The following is a hardware block diagram of a computer terminal (or mobile device) for implementing a monitoring method for a business system. Figure 1 As shown, the computer terminal 10 (or mobile device) may include one or more ( Figure 1102a, 102b, ..., 102n are used to illustrate) a processor 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 104 for storing data, and a transmission device 106 for communication functions. In addition, it may also include: a display, a keyboard, a cursor control device, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the BUS bus), a network interface, a power supply and / or a camera, wherein the network interface may be connected to a wired and / or wireless network. It will be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 1 More or fewer components than shown, or with Figure 1 Different configurations shown.

[0042] It should be noted that the one or more processors 102 and / or other data processing circuits described above may generally be referred to herein as "data processing circuitry". The data processing circuitry may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuitry may be a single independent processing module, or may be incorporated in whole or in part into any of the other components of the computer terminal 10 (or mobile device). As described in the embodiments of the present application, the data processing circuitry serves as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0043] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the monitoring method of the business system in the embodiment of the present application. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, that is, implementing the monitoring method of the business system described above. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include a memory remotely located relative to the processor 102, and these remote memories may be connected to the computer terminal 10 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0044] The transmission device 106 is configured to receive or transmit data via a network. A specific example of the aforementioned network may include a wireless network provided by the communications provider of the computer terminal 10. In one embodiment, the transmission device 106 includes a network interface controller (NIC), which can be connected to other network devices via a base station to enable communication with the Internet. In another embodiment, the transmission device 106 may be a radio frequency (RF) module, which is configured to communicate with the Internet wirelessly.

[0045] The display may be, for example, a touch screen liquid crystal display (LCD) that enables a user to interact with a user interface of the computer terminal 10 (or mobile device).

[0046] Under the above operating environment, this application provides Figure 2 The monitoring method of the business system shown. Figure 2 FIG. 1 is a flow chart of a method for monitoring a business system according to embodiment 1 of the present invention. Figure 2 As shown, the method includes the following steps:

[0047] Step S201: Receive a command monitoring request sent by a business system, and confirm the command information carried in the command monitoring request to obtain command confirmation information, wherein the command monitoring request also carries an initiator identifier and command initiation information.

[0048] In the embodiment of the present invention, a monitoring system may be applied to implement real-time monitoring of the business system.

[0049] In an embodiment of the present invention, the monitoring system can receive command monitoring requests from business systems (e.g., ATMs, online banking platforms, etc.). This request includes: specific command information, such as "transfer 1000 to account 123456"; an initiator identifier, i.e., a unique identifier for the specific device or user executing the command; and command initiation information, including but not limited to the initiation timestamp and geographic location.

[0050] In the embodiment of the present invention, the command initiator (ie, the person who uses the initiator to initiate the command on the business system) is required to confirm the command information on the business system to obtain command confirmation information for subsequent command evaluation and monitoring.

[0051] Step S202: Evaluate the command confirmation information to obtain an evaluation result.

[0052] In embodiments of the present invention, the evaluation system module in the monitoring system can be used to evaluate command confirmation information, analyze its potential risks, determine whether the command may pose a security threat, and obtain an evaluation result. For example, the command type and the historical behavior of the initiator can be evaluated. For example, a "transfer" command may be assessed as having a higher risk than a "balance query" command because it involves capital flow.

[0053] Step S203: Based on the command initiation information, the command confirmation information is monitored to obtain a monitoring result.

[0054] In embodiments of the present invention, a monitoring system module within the monitoring system can be used to perform real-time or delayed monitoring of command confirmation information in conjunction with command initiation information (including the command input time and location at the initiating end), to check whether the command initiation environment, time, and geographic location meet expected security standards. For example, if a transfer command issued from an ATM machine has geographic location information that does not match the device's permanent location, or occurs outside of normal business hours, this may be considered abnormal behavior and the monitoring results will be marked as abnormal.

[0055] Step S204, when the assessment result is the first risk level and the monitoring result is the normal monitoring state, the initiator indicated by the initiator identifier is authenticated to obtain the authentication result, and when the authentication result indicates that the authentication of the initiator is successful, an execution command response is returned to the business system.

[0056] In this embodiment of the present invention, if the assessment results indicate that the command is of low risk (i.e., Category 1 risk level) and the monitoring results indicate no abnormal behavior, the system will trigger an authentication process for the initiator, such as fingerprint, facial recognition, SMS verification code, etc. If the authentication is successful, the initiator is deemed legitimate, and the system will send a response to the business system to execute the command. Otherwise, if the authentication fails, appropriate security measures will be taken, such as restricting access or initiating a self-locking command.

[0057] In summary, by extracting and confirming keywords from command information, the authenticity and accuracy of the command are ensured. Then, the risk assessment model is used to evaluate the command confirmation information, which can intelligently identify the potential risk level. By combining the command initiation information, the command confirmation information is monitored to further verify the rationality of the command, achieving the technical effect of enhancing the business system's ability to resist malicious attacks, reducing the misjudgment rate, and improving business continuity and user satisfaction, thereby solving the technical problem of low security in monitoring business systems in related technologies.

[0058] In order to achieve real-time monitoring of the business system, in the business system monitoring method provided in Example 1 of the present application, before receiving the command monitoring request sent by the business system, when the business system receives the command information input by the initiator, the business system is controlled to collect the input time and input location when the initiator inputs the command information; the business system is controlled to send a command monitoring request to the monitoring system based on the command information, input time and input location.

[0059] In an embodiment of the present invention, if the business system receives command information input by the initiating end (for example, the user enters it through a mobile phone, or enters it at an ATM machine), it can obtain the input time and input location when the command information is entered, and then use the input time and input location as the command initiation information, and combine it with the initiating end identifier and the command information entered by the user to generate a command monitoring request and send it to the monitoring system to execute the naming information after the monitoring system evaluates and monitors it normally.

[0060] For example, when a user enters a specific command (such as transfer money, balance inquiry, etc.) at an ATM or in a mobile app, the business system can record the time (accurate to the second) and the location (using GPS (Global Positioning System) or base station positioning) of the command. For example, if a user enters "transfer 5000 to account ABC123" on a mobile app, the business system must not only capture this command, but also obtain the current date and time stamp (such as 2:30 PM on April 1, 2023) and the user's specific location.

[0061] In this embodiment, by collecting the input time and input location, the context information when the command is initiated can be more comprehensively understood, which is conducive to monitoring the command and enhances the effectiveness and accuracy of the security monitoring mechanism.

[0062] In order to improve the accuracy of determining command confirmation information, in the monitoring method of the business system provided in Example 1 of the present application, keywords in the command information are extracted to obtain a keyword set; the keyword set is returned to the business system, wherein the business system displays the keyword set at the initiating end and returns a confirmation response to the monitoring system when a confirmation operation is triggered at the initiating end; when the confirmation response is received, command confirmation information is obtained based on the keyword set.

[0063] In an embodiment of the present invention, when the business system receives command information input from the initiating end, the monitoring system can first perform a pre-processing task, namely, extracting key words or phrases from the command information to form a keyword set. For example, if the received command is "Transfer 1000 from account 123456 to account 789012," the system will identify and extract keywords such as "transfer," "1000," "123456," and "789012" to form a keyword set. The monitoring system will then feed the extracted keyword set back to the business system. The business system then displays these keywords on the initiating end (the user interface) and asks the user to confirm the accuracy and completeness of the information. For example, the system may list keywords such as "Transfer 1000 to account 789012" on the ATM display or mobile app interface, prompting the user to check. If the user confirms that the information is correct, a confirmation action will be triggered by the initiating end (such as pressing a confirmation key or a confirmation button on the screen), generating a confirmation response and sending it back to the monitoring system.

[0064] In an embodiment of the present invention, if the monitoring system receives a confirmation response triggered by the user, it can generate "command confirmation information" based on the previously extracted keyword set. This ensures that the monitoring system can accurately understand the user's intention and has the user's clear confirmation as the basis for executing the command.

[0065] In this embodiment, by displaying keyword sets, users can intuitively review command information, reducing issues caused by system parsing errors or careless user input. Requiring user confirmation of keyword sets also increases user involvement in the security process, helping to prevent unauthorized transactions and fraud. Furthermore, the extraction and confirmation of keyword sets provides a more accurate and reliable data foundation for subsequent monitoring systems, facilitating a more precise assessment of command risk levels.

[0066] In order to improve the accuracy of evaluating command confirmation information, in the monitoring method of the business system provided in Example 1 of the present application, features are extracted from the command confirmation information to obtain a feature vector; the feature vector is processed using a risk assessment model to obtain a risk score, wherein the risk assessment model is pre-connected to the monitoring system; when the risk score falls within a first preset range, the assessment result is determined to be a first type of risk level; when the risk score falls within a second preset range, the assessment result is determined to be a second type of risk level, wherein the risk indicated by the second type of risk level is higher than the risk indicated by the first type of risk level.

[0067] In an embodiment of the present invention, after receiving command confirmation information sent by the business system, the monitoring system can parse and extract features from this information to form a multidimensional dataset describing the risk characteristics of the command, namely a feature vector. The feature vector may contain data points on various aspects such as command type, amount, input time, input location, and user historical behavior. For example, for "transfer 5000 to account XYZ123", the system will extract "transfer", "5000", "XYZ123" and the specific input time and location information related to it, and convert this information into digital features to form a feature vector. Then, the feature vector is processed using a pre-trained risk assessment model to calculate a risk score.

[0068] Here, a risk assessment model can be pre-connected to the monitoring system. This model uses machine learning algorithms to predict the potential risk level of a command based on historical data and real-time features. For example, the model might assign a score between 0 and 100 based on factors such as the user's transfer frequency, amount, timing, and degree of location anomaly. Higher scores indicate greater risk.

[0069] In an embodiment of the present invention, the monitoring system will set a threshold range for the risk score (such as a first preset range (such as 0 to 30), a second preset range (such as 31 to 100)). For example, a score of 0 to 30 is considered to be low risk, that is, the first type of risk level. If the received score falls within this range, the system will determine that the command is at the first type of risk level, that is, the risk is relatively low, and it can enter the preliminary detection process. If the risk score is higher, such as falling in the range of 31 to 100, the system will determine it as the second type of risk level, which means that the command has a higher security risk and requires more stringent identity authentication and in-depth detection, such as face recognition and voice recognition.

[0070] In this embodiment, the use of feature vectors and risk scores can quantify the risk of commands based on data, avoiding the limitations of subjective judgment or rule matching. In addition, the preset risk score range enables the system to dynamically adjust the risk level of commands and take different security measures for commands with different risk levels, thus ensuring a balance between security and user experience.

[0071] In order to improve the accuracy of monitoring command confirmation information, in the monitoring method of the business system provided in Example 1 of the present application, it is detected whether the command initiation library contains the target historical command initiation information of the initiator, wherein the command initiation library includes: multiple historical command initiation information associated with the initiator; when the command initiation library contains the target historical command initiation information, the target historical command initiation information is obtained, wherein the target historical command initiation information includes at least: multiple target historical input times and multiple target historical input positions; when the input time contained in the command initiation information belongs to multiple target historical input times and the input position contained in the command initiation information belongs to multiple target historical input positions, it is determined that the monitoring result is a normal monitoring state; when the input time contained in the command initiation information does not belong to multiple target historical input times, and / or the input position contained in the command initiation information does not belong to multiple target historical input positions, it is determined that the monitoring result is an abnormal monitoring state.

[0072] In an embodiment of the present invention, the user's historical command initiation information associated with the current initiator (the device or platform operated by the user, such as a mobile banking application or ATM machine) can be first searched in the command initiation library. The command initiation library is a database maintained by the system, which stores all command operation records performed by the user through different initiators in the past, including but not limited to the specific details of operations such as transfers, inquiries, and withdrawals. For example, the library may contain all operation records performed by the user through mobile banking in the past week, and each record has detailed information such as input time, input location, and operation type. If it is detected that there is user historical command information related to the current initiator in the library, the system will further extract this historical information, including multiple target historical input times and multiple target historical input locations.

[0073] In an embodiment of the present invention, the system can compare the input time and input location of the current command initiation information with the extracted user history information. If the time and location of the current operation both appear in the user's history records, that is, they match the user's previous behavior patterns, the monitoring result is determined to be a normal monitoring state, indicating that the user's current operation is consistent with their historical behavior patterns and the risk is low. If the time or location of the current operation does not match the pattern that appears in the user's history records, such as initiating a transaction during a time period that the user has never operated, or performing an operation in a geographical location that has never been used, the system will determine that the monitoring result is an abnormal monitoring state, indicating that there is a potential risk and further security testing or verification is required.

[0074] In this embodiment, by comparing it with historical user behavior patterns, the system can more effectively identify abnormal operations and prevent potential fraud. Furthermore, only when an anomaly is detected does the system trigger further security verification, minimizing disruption to regular operations and improving the user experience. Furthermore, by using historical data as a reference, risk assessment no longer relies solely on single-dimensional analysis, but instead draws on the temporal and spatial patterns of user behavior, enabling more comprehensive and accurate decision-making.

[0075] In order to further accurately monitor command confirmation information, in the monitoring method of the business system provided in Example 1 of the present application, after detecting whether the command initiation library contains the target historical command initiation information of the initiator, it also includes: if the command initiation library does not contain the target historical command initiation information, recording the command initiation information to the command initiation library; judging whether the input time contained in the command initiation information falls within the preset time range, and judging whether the input position contained in the command initiation information falls within the preset position range; if the input time contained in the command initiation information falls within the preset time range and the input position contained in the command initiation information falls within the preset position range, determining that the monitoring result is a normal monitoring state.

[0076] In this embodiment of the present invention, when the system detects a command executed by a user through a specific initiator (such as mobile banking or an ATM), if this initiator has not yet left any historical command initiation information in the system, the system will automatically record the current command initiation information, including the input time and location, in a command initiation database. This ensures that even for new users or new devices, the system can begin to accumulate their behavior patterns, providing a data foundation for subsequent monitoring.

[0077] In an embodiment of the present invention, a preset time range can be set, that is, a time range determined based on the user's historical behavior pattern and normal business operation time. For example, if the user usually performs business operations between 9:00 and 17:00 on weekdays, then this time period can be defined as a preset time range. The system will compare in real time whether the input time of the current command falls within this preset time range as part of the monitoring process. In addition, a preset location range can be set, that is, a location range determined based on the user's common operation location, such as home address, workplace, frequently visited business outlets, etc. The system will check whether the input location of the current command falls within this preset location range to further evaluate the normality of the operation.

[0078] In this embodiment of the present invention, if the input time and location of the current command fall within both the preset time and location ranges, the system will determine that the monitoring result is normal, indicating that the operation is consistent with the user's historical behavior patterns and expectations and is low risk. In this case, the system may skip some more stringent security check steps and quickly enter the preliminary check phase to improve the user experience.

[0079] This embodiment enhances security monitoring for new users or devices. Even for first-time or infrequent users of a specific initiator, the system can begin to build a behavioral profile by recording and setting preset ranges. Furthermore, monitoring accuracy and efficiency are improved. By setting preset time and location ranges, the monitoring process can quickly determine the legitimacy of commands, reducing unnecessary security checks and improving system efficiency.

[0080] In order to improve the accuracy of authentication of the initiator, in the monitoring method of the business system provided in Example 1 of the present application, when the assessment result is the first type of risk level and the monitoring result is a normal monitoring state, the first type of authentication strategy is triggered; based on the first type of authentication strategy, the initiator is authenticated; when the authentication fails and the number of authentication failures reaches a preset number, a lock command response is returned to the business system.

[0081] In this embodiment of the present invention, when a user initiates a command in a business system, the system, through its risk assessment model and monitoring process, determines that the command's risk level is Class I (i.e., low risk), and the monitoring results show that the operation time and location are consistent with the user's historical behavior (normal monitoring status). In this case, Class I authentication strategies (such as fingerprint authentication) are triggered. This is a simpler authentication process designed for low-risk transactions, aiming to balance security and user experience.

[0082] In an embodiment of the present invention, the monitoring system can execute an authentication process that matches the first risk level to authenticate the initiator (the device or interface operated by the user). This first-class authentication strategy includes simple user identity verification, such as entering a password, answering security questions, or performing a preliminary biometric check (such as a fingerprint). This confirms user identity and ensures that only authorized users can perform operations, while simultaneously reducing the inconvenience caused by high-risk authentication and maintaining a good user experience.

[0083] In this embodiment of the present invention, if authentication fails during the execution of the first type of authentication policy, and the number of such failures continues to reach a preset threshold, the monitoring system will immediately return a lock command response to the business system. This means that the business system will not accept further commands from the initiator until the system is reset or the user unlocks the lock state through offline authentication. The preset number of times is set to prevent malicious attackers from repeatedly attempting to bypass simple authentication policies, ensuring that the system can promptly protect itself in the event of repeated low-risk authentication failures.

[0084] In some optional embodiments, after the command is locked, offline authentication is required, and unlocking is performed after authentication is passed, for example, going to a nearby business outlet to unlock the system.

[0085] In this embodiment, under low-risk and normal monitoring conditions, the first type of authentication policy is triggered to simplify the authentication process, reduce frequent interruptions to users, and improve the convenience of daily operations. Furthermore, even in low-risk operations, a limit on the number of authentication failures is established. Once the preset number is reached, a lock-down response is immediately implemented, effectively preventing potential attacks and misoperations and ensuring system security. Furthermore, by flexibly adjusting authentication policies, the system can dynamically adapt to and respond to various security threats without sacrificing user experience, maintaining a good balance between security and convenience.

[0086] In order to further improve the monitoring accuracy of the business system, in the monitoring method of the business system provided in Example 1 of the present application, after monitoring the command confirmation information based on the command initiation information and obtaining the monitoring result, it also includes: when the evaluation result is a second type of risk level, and / or the monitoring result is an abnormal monitoring state, triggering a second type of authentication strategy; based on the second type of authentication strategy, authenticating the initiator.

[0087] In this embodiment of the present invention, if the monitoring system assesses a command's risk level as Category II (i.e., high risk) or detects a significant deviation between the command's initiation time and / or location and the user's historical behavior patterns (an abnormal monitoring state), the system will determine that the current operation presents a potential security risk. At this point, the system will immediately activate Category II authentication, a multi-tiered authentication process designed to address high-risk situations. This strategy is designed to fully verify the initiating user's identity and operational intent to prevent fraud and misuse.

[0088] In an embodiment of the present invention, during the execution of the second type of authentication strategy, the user may first be required to perform an in-depth biometric detection, such as face recognition or iris scanning, and then a one-time verification code may be sent to the user's pre-registered mobile phone number or email address to confirm the source of the operation request. In addition, the user may be required to answer questions related to personal information, or the user's identity may be further verified through a third-party authentication service.

[0089] In this embodiment, for commands assessed as Category II risk or with abnormal monitoring status, the system activates the Category II authentication strategy, implementing deep detection and multiple verifications, effectively enhancing its defenses against high-risk operations. Furthermore, by analyzing the anomalies in the time and location of operations, combined with a deep verification process, the system can more accurately identify and prevent potential fraudulent activity, thereby protecting the security of users and financial assets. Furthermore, the strict Category II authentication strategy requires users to confirm their identity through multiple verification methods, ensuring that each operation is initiated by a legitimately authorized user and preventing unauthorized access and manipulation.

[0090] In an embodiment of the present invention, a monitoring system for a business system is also provided, comprising: a command processing module, an evaluation system module, a monitoring system module, a verification system module, a command implementation module, an offline authentication module, and the like. The command processing module supports functions such as command input, command analysis, command confirmation, and command storage; the evaluation system module is used to assess the risk of commands and produce evaluation results such as high risk or low risk; the monitoring system module is used to monitor commands and produce monitoring results such as normal or abnormal; the verification system module includes preliminary testing and in-depth testing; and the command implementation module includes execution commands and self-locking commands. The monitoring system is equipped with monitoring capabilities that can monitor the user's location and usage time information. At the same time, the evaluation system module evaluates commands to verify whether there are risks within the commands, thereby improving the security of the business system, reducing the risk of the business, and making financial services more secure.

[0091] Figure 3 Schematic diagram of a monitoring system according to embodiment 1 of the present invention, Figure 3 As shown, the monitoring system includes: a command processing module, an evaluation system module, a monitoring system module, an inspection system module, a command implementation module, an offline authentication module, etc.

[0092] exist Figure 3 In the system, the command processing module is used to extract and verify the command information input by the user. The assessment system module is used to perform risk detection on the confirmed command information. The monitoring system module is used to confirm the user's location and input time. The inspection system module is used to verify the user's information and identity. The offline authentication module is used to verify the user's identity offline.

[0093] In this embodiment, the business system can be made more secure by performing mutual evaluation processing between the command processing module, the evaluation system module, etc.

[0094] In this embodiment, the command processing module includes command input, command analysis, command confirmation, and command storage modules. Command confirmation transfers information to the command storage, which stores the input command. The command processing module transfers information to both the assessment system module and the monitoring system module. Command processing streamlines user input, facilitating frequent information capture.

[0095] In this embodiment, the command processing module transmits the information to the internal evaluation system module, which evaluates the information and obtains a result such as high risk or low risk. The evaluation system module can detect the command information to determine whether the command contains any risk.

[0096] In this embodiment, the inspection system module includes different processing modules such as preliminary detection, deep detection, authentication success and authentication failure. The evaluation system module and the monitoring system module evaluate and process the information at the same time, so that information with different results passes through different processing modules in the inspection system module. The monitoring system module and the system module simultaneously transmit the information to the interior of the inspection system module.

[0097] In this embodiment, after the system module is inspected, the command implementation module can be opened by controlling the inspection result of the system module to execute an implementation command or a self-locking command.

[0098] Figure 4 FIG. 1 is a schematic diagram of monitoring performed by the monitoring system according to Example 1 of the present invention, as shown in FIG. Figure 4 As shown, the command processing module can perform command analysis and command confirmation on the input command, and store the confirmed command. Then, the command processing module transmits the confirmed command to the evaluation system module and the monitoring system module to perform command risk assessment and start the monitoring equipment, thereby obtaining results such as high risk or low risk, as well as monitoring results such as normal monitoring and abnormal monitoring. When the risk is low and the monitoring is normal, the preliminary detection in the inspection system module is turned on to implement the command after the preliminary monitoring is successful or the command is self-locked after the preliminary monitoring fails; when the risk is high and the monitoring is abnormal, the deep detection in the inspection system module is turned on, and after the deep detection is successful, the authentication success module is turned on to implement the command, or after the deep detection fails, the authentication failure module is turned on to self-lock the command. After the self-locking command, offline authentication can be performed.

[0099] In this embodiment, the user inputs instruction information in the input command. At this time, the input command transmits the information to the command analysis. At this time, the command analysis can extract keywords in the information and capture important information. At this time, the command analysis displays the captured information on the display screen surface of the initiator used by the user. At this time, the command is displayed on the display screen surface, and the information can be confirmed through command confirmation. The command confirmation can be transmitted to the command storage. At the same time, the evaluation system module and the monitoring system module simultaneously detect the confirmed command. The monitoring system module can monitor the user's input time and input location, observe whether the user's input time and input location information have changed, and compare the input time and input location of the last input command. When the data monitored by the monitoring system module is normal, the information can be determined as normal monitoring. When the data monitored by the monitoring system module is relatively abnormal, it can be determined as abnormal monitoring. At the same time, the evaluation system module can perform risk assessment on the confirmed command information to detect whether the information has certain risks. When a command confirmation is risky, it can be judged as a high risk. When a command confirmation contains both low risk and normal monitoring, the user's identity can be directly confirmed through preliminary detection, in the form of fingerprint or password. When the preliminary detection is successful, the command can be directly implemented. When the preliminary detection fails, the control system directly enters the self-locking command and locks the system. At this time, it can be operated again after the lock time of the self-locking command; when a command confirmation contains both high risk or abnormal monitoring, the user's identity can be deeply detected. At this time, the user can be facial recognition and voice recognition. When the user's deep detection and authentication is successful, the command can be directly implemented on the information inside the command confirmation. When the deep detection and authentication fails, the system implements the self-locking command and locks the system. After the lock time ends, it can be re-identified. When multiple identification failures occur, the self-locking command will lock the system for a long time. When the system needs to be unlocked, it can be unlocked by going to a nearby business outlet through offline authentication.

[0100] The business system monitoring method and monitoring system provided in the embodiments of the present application confirm the initiator's location and usage time information, and simultaneously evaluate the command through an evaluation system module to verify whether there are risks within the command. This improves the security of the business system, reduces business risks, and makes financial services more secure. Furthermore, by providing a self-locking command and a verification system module, different verifications can be performed on the command based on the monitoring and evaluation results. If the verification is successful, the command can be implemented. If the verification fails, the system can be caused to self-lock to protect the system, thereby improving the security of financial services.

[0101] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0102] Example 2

[0103] The embodiment of the present application also provides a monitoring device for a business system. It should be noted that the monitoring device for a business system in the embodiment of the present application can be used to execute the monitoring method for a business system provided in the embodiment of the present application. The monitoring device for a business system provided in the embodiment of the present application is introduced below.

[0104] According to an embodiment of the present application, a device for implementing the above-mentioned monitoring method of the business system is also provided. Figure 5 FIG. 1 is a schematic diagram of an optional monitoring device for a business system according to an embodiment of the present invention. Figure 5 As shown, the monitoring device may include: a confirmation unit 50 , an evaluation unit 51 , a monitoring unit 52 , and an authentication unit 53 .

[0105] Among them, the confirmation unit 50 is used to receive the command monitoring request sent by the business system, and confirm the command information carried by the command monitoring request to obtain command confirmation information, wherein the command monitoring request also carries the initiator identifier and command initiation information;

[0106] An evaluation unit 51 is used to evaluate the command confirmation information and obtain an evaluation result;

[0107] A monitoring unit 52 is configured to monitor the command confirmation information based on the command initiation information and obtain a monitoring result;

[0108] The authentication unit 53 is used to authenticate the initiator indicated by the initiator identifier when the assessment result is the first risk level and the monitoring result is a normal monitoring state, obtain the authentication result, and return an execution command response to the business system when the authentication result indicates that the authentication of the initiator is successful.

[0109] The monitoring device for a business system provided in an embodiment of the present application ensures the authenticity and accuracy of commands by extracting and confirming keywords from command information. Then, the command confirmation information is evaluated using a risk assessment model, and the potential risk level can be intelligently identified. The command confirmation information is monitored in combination with command initiation information, and the rationality of the command can be further verified, thereby achieving the technical effect of enhancing the business system's ability to resist malicious attacks, reducing the misjudgment rate, and improving business continuity and user satisfaction, thereby solving the technical problem of low security in monitoring business systems in related technologies.

[0110] Optionally, the monitoring device also includes: a first acquisition module, used to control the business system to collect the input time and input position of the command information input by the initiator before receiving the command monitoring request sent by the business system, when the business system receives the command information input by the initiator; a first sending module, used to control the business system to send a command monitoring request to the monitoring system based on the command information, input time and input position.

[0111] Optionally, the confirmation unit includes: a first extraction module, used to extract keywords in the command information to obtain a keyword set; a first return module, used to return the keyword set to the business system, wherein the business system displays the keyword set at the initiating end and returns a confirmation response to the monitoring system when the confirmation operation is triggered at the initiating end; when the confirmation response is received, command confirmation information is obtained based on the keyword set.

[0112] Optionally, the evaluation unit includes: a second extraction module, used to extract features from the command confirmation information to obtain a feature vector; a first processing module, used to process the feature vector using a risk assessment model to obtain a risk score, wherein the risk assessment model is pre-connected with the monitoring system; a first determination module, used to determine that the evaluation result is a first type of risk level when the risk score falls within a first preset range; a second determination module, used to determine that the evaluation result is a second type of risk level when the risk score falls within a second preset range, wherein the risk indicated by the second type of risk level is higher than the risk indicated by the first type of risk level.

[0113] Optionally, the monitoring unit includes: a first detection module, used to detect whether the command initiation library contains the target history command initiation information of the initiator, wherein the command initiation library includes: multiple historical command initiation information associated with the initiator; a first acquisition module, used to acquire the target history command initiation information when the command initiation library contains the target history command initiation information, wherein the target history command initiation information includes at least: multiple target history input times and multiple target history input positions; a third determination module, used to determine that the monitoring result is a normal monitoring state when the input time contained in the command initiation information belongs to multiple target history input times and the input position contained in the command initiation information belongs to multiple target history input positions; a fourth determination module, used to determine that the monitoring result is an abnormal monitoring state when the input time contained in the command initiation information does not belong to multiple target history input times, and / or the input position contained in the command initiation information does not belong to multiple target history input positions.

[0114] Optionally, the monitoring device also includes: a first recording module, which is used to record the command initiation information to the command initiation library after detecting whether the command initiation library contains the target historical command initiation information of the initiator, if the command initiation library does not contain the target historical command initiation information; a first judgment module, which is used to judge whether the input time contained in the command initiation information belongs to the preset time range, and judge whether the input position contained in the command initiation information belongs to the preset position range; a fifth determination module, which is used to determine that the monitoring result is a normal monitoring state when the input time contained in the command initiation information belongs to the preset time range and the input position contained in the command initiation information belongs to the preset position range.

[0115] Optionally, the authentication unit includes: a first trigger module, used to trigger a first type of authentication policy when the assessment result is a first type of risk level and the monitoring result is a normal monitoring state; a first authentication module, used to authenticate the initiator based on the first type of authentication policy; a second return module, used to return a lock command response to the business system when the authentication fails and the number of authentication failures reaches a preset number of times.

[0116] Optionally, the monitoring device also includes: a second trigger module, which is used to monitor the command confirmation information based on the command initiation information, and after obtaining the monitoring result, trigger the second type of authentication policy when the evaluation result is a second type of risk level and / or the monitoring result is an abnormal monitoring state; a second authentication module, which is used to authenticate the initiator based on the second type of authentication policy.

[0117] The above-mentioned monitoring device may also include a processor and a memory. The above-mentioned confirmation unit 50, evaluation unit 51, monitoring unit 52, authentication unit 53, etc. are all stored in the memory as program units, and the processor executes the above-mentioned program units stored in the memory to realize corresponding functions.

[0118] The processor includes a kernel that retrieves corresponding program units from memory. One or more kernels may be configured to adjust kernel parameters to authenticate the initiator indicated by the initiator identifier when the assessment result indicates a Class I risk level and the monitoring result indicates a normal monitoring state, obtain an authentication result, and return an execution command response to the business system when the authentication result indicates successful authentication of the initiator.

[0119] The above-mentioned memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0120] It should be noted that the confirmation unit 50, evaluation unit 51, monitoring unit 52, and authentication unit 53 correspond to steps S201 to S204 in Example 1. The examples and application scenarios implemented by the above units and the corresponding steps are the same, but are not limited to the contents disclosed in the above Example 1. It should be noted that the above units can be hardware components or software components stored in a memory (e.g., memory 104) and processed by one or more processors (e.g., processors 102a, 102b, ..., 102n). The above units can also be part of the device and can be run in the computer terminal 10 provided in Example 1.

[0121] Example 3

[0122] An embodiment of the present application may provide an electronic device, Figure 6 FIG. 1 is a structural block diagram of an electronic device according to an embodiment of the present invention. Figure 6 As shown, the electronic device may include: one or more ( Figure 6 Only one is shown) processor 602, memory 604, storage controller, and peripheral interface, wherein the peripheral interface is connected to the radio frequency module, audio module and display.

[0123] Among them, the memory can be used to store software programs and modules, such as the program instructions / modules corresponding to the monitoring method and device of the business system in the embodiment of the present application. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory, that is, realizing the above-mentioned monitoring method of the business system. The memory may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include a memory remotely arranged relative to the processor, and these remote memories may be connected to the terminal via a network. Examples of the above-mentioned network include but are not limited to the Internet, corporate intranet, local area network, mobile communication network and combinations thereof.

[0124] The processor can call the information and application stored in the memory through the transmission device to perform the following steps: receive the command monitoring request sent by the business system, and confirm the command information carried by the command monitoring request to obtain command confirmation information, wherein the command monitoring request also carries the initiator identification and command initiation information; evaluate the command confirmation information to obtain an evaluation result; based on the command initiation information, monitor the command confirmation information to obtain a monitoring result; when the evaluation result is the first risk level and the monitoring result is a normal monitoring state, authenticate the initiator indicated by the initiator identification to obtain an authentication result, and when the authentication result indicates that the authentication of the initiator is successful, return an execution command response to the business system.

[0125] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: when the business system receives the command information input by the initiator, control the business system to collect the input time and input location when the initiator inputs the command information; control the business system to send a command monitoring request to the monitoring system based on the command information, input time and input location.

[0126] The processor can also call the information and applications stored in the memory through the transmission device to perform the following steps: extract the keywords in the command information to obtain a keyword set; return the keyword set to the business system, wherein the business system displays the keyword set at the initiating end and returns a confirmation response to the monitoring system when the initiating end triggers a confirmation operation; when the confirmation response is received, command confirmation information is obtained based on the keyword set.

[0127] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: extract features from the command confirmation information to obtain a feature vector; process the feature vector using a risk assessment model to obtain a risk score, wherein the risk assessment model is pre-connected to the monitoring system; when the risk score falls within a first preset range, determine that the assessment result is a first type of risk level; when the risk score falls within a second preset range, determine that the assessment result is a second type of risk level, wherein the risk indicated by the second type of risk level is higher than the risk indicated by the first type of risk level.

[0128] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: detect whether the command initiation library contains the target history command initiation information of the initiator, wherein the command initiation library includes: multiple historical command initiation information associated with the initiator; in the case that the command initiation library contains the target history command initiation information, obtain the target history command initiation information, wherein the target history command initiation information includes at least: multiple target history input times, multiple target history input positions; in the case that the input time contained in the command initiation information belongs to multiple target history input times and the input position contained in the command initiation information belongs to multiple target history input positions, determine that the monitoring result is a normal monitoring state; in the case that the input time contained in the command initiation information does not belong to multiple target history input times, and / or the input position contained in the command initiation information does not belong to multiple target history input positions, determine that the monitoring result is an abnormal monitoring state.

[0129] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: when the command initiation library does not contain the target historical command initiation information, record the command initiation information to the command initiation library; determine whether the input time contained in the command initiation information falls within the preset time range, and determine whether the input position contained in the command initiation information falls within the preset position range; when the input time contained in the command initiation information falls within the preset time range and the input position contained in the command initiation information falls within the preset position range, determine that the monitoring result is a normal monitoring state.

[0130] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: trigger the first type of authentication policy when the assessment result is the first type of risk level and the monitoring result is a normal monitoring state; authenticate the initiator based on the first type of authentication policy; return a lock command response to the business system when the authentication fails and the number of authentication failures reaches a preset number.

[0131] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: triggering the second type of authentication strategy when the assessment result is the second type of risk level and / or the monitoring result is an abnormal monitoring state; authenticating the initiator based on the second type of authentication strategy.

[0132] The embodiments of the present application provide a monitoring solution for a business system. By extracting and confirming keywords from command information, the authenticity and accuracy of the command are ensured. Then, the command confirmation information is evaluated using a risk assessment model, enabling intelligent identification of potential risk levels. Furthermore, by combining command initiation information with monitoring of the command confirmation information, the rationality of the command can be further verified. This achieves the technical effect of enhancing the business system's ability to resist malicious attacks, reducing the false positive rate, and improving business continuity and user satisfaction. This resolves the technical issue of low security in monitoring business systems in related technologies.

[0133] It can be understood by those skilled in the art that Figure 6 The structure shown is for illustration only, and the electronic device may also be a terminal device such as a smart phone, a tablet computer, a PDA, or a mobile Internet device (MID). Figure 6 It does not limit the structure of the above electronic device. For example, the electronic device may also include Figure 6 More or fewer components (such as network interfaces, display devices, etc.) shown in, or with Figure 6 Different configurations shown.

[0134] A person skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be completed by instructing the hardware related to the terminal device through a program, and the program can be stored in a computer-readable storage medium, which may include: a flash drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0135] Example 4

[0136] The embodiment of the present application further provides a storage medium. Optionally, in this embodiment, the storage medium can be used to store the program code executed by the business system monitoring method provided in the first embodiment.

[0137] Optionally, in this embodiment, the storage medium may be located in any computer terminal in a computer terminal group in a computer network, or in any mobile terminal in a mobile terminal group.

[0138] The present application also provides a computer program product, which, when executed on a data processing device, is suitable for executing the steps of the monitoring method of a business system.

[0139] The serial numbers of the above embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0140] In the above embodiments of the present application, the description of each embodiment has its own focus. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0141] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0142] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0143] In addition, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0144] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for enabling a computer device (which can be a personal computer, a server or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk.

[0145] The above is only a preferred embodiment of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A method for monitoring a business system, characterized in that: Applied to monitoring systems, including: Receive a command monitoring request sent by the business system, and confirm the command information carried in the command monitoring request to obtain command confirmation information, wherein the command monitoring request also carries an initiator identifier and command initiation information; Evaluating the command confirmation information to obtain an evaluation result; Based on the command initiation information, monitoring the command confirmation information to obtain a monitoring result; When the assessment result is the first risk level and the monitoring result is a normal monitoring state, the initiator indicated by the initiator identifier is authenticated to obtain an authentication result, and when the authentication result indicates that the authentication of the initiator is successful, an execution command response is returned to the business system.

2. The monitoring method according to claim 1, characterized in that: Before receiving the command monitoring request sent by the business system, it also includes: When the business system receives the command information input by the initiating end, controlling the business system to collect the input time and input location when the initiating end inputs the command information; The business system is controlled to send the command monitoring request to the monitoring system based on the command information, the input time and the input location.

3. The monitoring method according to claim 1, wherein: The step of confirming the command information carried in the command monitoring request to obtain command confirmation information includes: Extracting keywords from the command information to obtain a keyword set; Returning the keyword set to the business system, wherein the business system displays the keyword set at the initiating end and returns a confirmation response to the monitoring system when a confirmation operation is triggered at the initiating end; When the confirmation response is received, the command confirmation information is obtained based on the keyword set.

4. The monitoring method according to claim 1, wherein: The step of evaluating the command confirmation information to obtain an evaluation result includes: Performing feature extraction on the command confirmation information to obtain a feature vector; Processing the feature vector using a risk assessment model to obtain a risk score, wherein the risk assessment model is pre-interfaced with the monitoring system; If the risk score falls within a first preset range, determining the assessment result as the first risk level; In a case where the risk score falls within a second preset range, the assessment result is determined to be a second risk level, wherein the risk indicated by the second risk level is higher than the risk indicated by the first risk level.

5. The monitoring method according to claim 1, characterized in that: The step of monitoring the command confirmation information based on the command initiation information to obtain a monitoring result includes: Detecting whether a command initiation library contains target historical command initiation information of the initiating end, wherein the command initiation library includes: a plurality of historical command initiation information associated with the initiating end; In a case where the command initiation library contains the target history command initiation information, acquiring the target history command initiation information, wherein the target history command initiation information at least includes: a plurality of target history input times and a plurality of target history input positions; In a case where the input time included in the command initiation information belongs to the multiple target historical input times and the input position included in the command initiation information belongs to the multiple target historical input positions, determining that the monitoring result is the normal monitoring state; When the input time included in the command initiation information does not belong to the multiple target historical input times, and / or the input position included in the command initiation information does not belong to the multiple target historical input positions, it is determined that the monitoring result is an abnormal monitoring state.

6. The monitoring method according to claim 5, characterized in that: After detecting whether the command initiation library contains the target historical command initiation information of the initiator, the method further includes: If the command initiation library does not contain the target historical command initiation information, recording the command initiation information into the command initiation library; Determining whether the input time included in the command initiation information falls within a preset time range, and determining whether the input position included in the command initiation information falls within a preset position range; In a case where the input time included in the command initiation information belongs to the preset time range and the input position included in the command initiation information belongs to the preset position range, it is determined that the monitoring result is the normal monitoring state.

7. The monitoring method according to claim 1, characterized in that: When the assessment result is a first risk level and the monitoring result is a normal monitoring state, the step of authenticating the initiator indicated by the initiator identifier includes: When the assessment result is the first risk level and the monitoring result is the normal monitoring state, triggering the first authentication policy; authenticating the initiator based on the first type of authentication policy; In the event that the authentication fails and the number of authentication failures reaches a preset number, a lock command response is returned to the business system.

8. The monitoring method according to claim 1, wherein: After monitoring the command confirmation information based on the command initiation information and obtaining a monitoring result, the method further includes: If the assessment result is a second risk level, and / or the monitoring result is an abnormal monitoring state, triggering a second authentication strategy; Based on the second type of authentication policy, the initiator is authenticated.

9. A monitoring device for a business system, characterized in that: Applied to monitoring systems, including: A confirmation unit, configured to receive a command monitoring request sent by a business system, and confirm the command information carried in the command monitoring request to obtain command confirmation information, wherein the command monitoring request also carries an initiator identifier and command initiation information; An evaluation unit, configured to evaluate the command confirmation information and obtain an evaluation result; a monitoring unit, configured to monitor the command confirmation information based on the command initiation information and obtain a monitoring result; An authentication unit is used to authenticate the initiator indicated by the initiator identifier when the assessment result is the first risk level and the monitoring result is a normal monitoring state, obtain an authentication result, and return an execution command response to the business system when the authentication result indicates that the authentication of the initiator is successful.

10. An electronic device, characterized in that: It includes one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the business system monitoring method described in any one of claims 1 to 8.

Images