Artificial intelligence-based information security detection method, system, terminal and medium

Abstract

The application relates to an information security detection method and system based on artificial intelligence, a terminal and a medium, and belongs to the technical field of information processing. The information security detection method comprises the following steps: when a transaction event occurs, capturing a transaction key field after data desensitization; generating a behavior vector according to the transaction key field; analyzing a user portrait to obtain user information; loading a corresponding transaction rule set from a local knowledge base according to the user information; obtaining a cumulative risk score of the transaction according to the behavior vector and a set transaction rule in the transaction rule set; judging whether the cumulative risk score is greater than a risk threshold; if yes, triggering an early warning, freezing the transaction and recording an event log; and if no, releasing the transaction. The application has the beneficial effect of comprehensively and objectively evaluating the risk degree of the transaction.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information processing, and in particular to an information security detection method and system based on artificial intelligence, a terminal and a medium. BACKGROUND

[0002] With the rapid development of science and technology, payment technology has made great progress. Online financial transactions have gradually become the mainstream transaction method in people's daily life due to their convenience and efficiency. Whether it is personal daily consumption, investment and financial management, or business transactions between enterprises, online financial transactions are highly dependent. However, the prosperity of online financial transactions also faces many security challenges such as network attacks and hacker intrusions. These threats can lead to user transaction information leakage, fund theft, transaction tampering and other serious consequences, causing huge losses to users and financial institutions. Therefore, it is particularly important for financial institutions and third-party transaction platforms to monitor online financial transactions and detect information security during the transaction process.

[0003] In traditional information security detection, there are many common methods. One is the manual review method based on expert experience, which relies on the knowledge and experience of professional security personnel to check and judge transaction data one by one to see if there are any abnormal situations. This method relies on the subjective judgment of professionals and is less adaptable to complex and variable transaction scenarios, and is inefficient, making it difficult to deal with large-scale transaction data. Another is the detection method based on fixed rule matching, which sets some explicit rules in advance, and when the transaction data meets these rules, it is determined to be abnormal. For example, set upper and lower limits for transaction amounts, and transactions exceeding the range are considered abnormal. However, this method can only deal with some common and explicit rule abnormal situations, and is often difficult to effectively identify new and complex abnormal patterns.

[0004] Whether it is a manual review method based on expert experience or a fixed rule matching method, it cannot comprehensively and objectively assess the risk level of transactions, which can easily lead to potential risk transactions being ignored, thereby causing economic losses and security threats to both parties. SUMMARY

[0005] In order to comprehensively and objectively assess the risk level of transactions, the present application provides an information security detection method and system based on artificial intelligence, a terminal and a medium.

[0006] In a first aspect, the present application provides an information security detection method based on artificial intelligence, which adopts the following technical solution:

[0007] An information security detection method based on artificial intelligence, comprising:

[0008] capture the transaction key fields after data desensitization when a transaction event occurs;

[0009] generate a behavior vector according to the transaction key fields;

[0010] analyze a user portrait to obtain user information;

[0011] load a corresponding transaction rule set from a local knowledge base according to the user information;

[0012] obtain a cumulative risk score of the transaction according to the behavior vector and a set transaction rule in the transaction rule set;

[0013] determine whether the cumulative risk score is greater than a risk threshold;

[0014] if yes, trigger an early warning, freeze the transaction, and record an event log;

[0015] if no, release the transaction.

[0016] By adopting the above technical solution, the transaction key fields after data desensitization are captured when a transaction event occurs, which can prevent sensitive information in the transaction process from being exposed in the detection stage and reduce the possibility of data leakage. By capturing the transaction key fields after desensitization, discrete transaction features are converted into a multi-dimensional behavior vector, which can quantify the abnormal patterns of user behavior. By analyzing the user portrait and loading the corresponding transaction rule set from the local knowledge base, the detection method can be adapted to the actual transaction habits and risk characteristics of the user. Then, combined with the transaction rule set, the cumulative risk score of the transaction is obtained to quantitatively evaluate the transaction risk, avoiding the errors caused by subjective judgment in the traditional way, and the risk degree of the transaction can be evaluated comprehensively and objectively. The transaction rule set in the local knowledge base can be updated and adjusted in real time according to the actual transaction situation and risk status, so that the generated risk score can better reflect the real risk degree of the current transaction. When the cumulative risk score is greater than the risk threshold, the system can trigger an early warning in time and freeze the transaction, avoiding potential risk transactions from continuing, reducing possible economic losses and security threats, and controlling the risk within the minimum range. At the same time, the event log is recorded, providing detailed records for subsequent risk analysis and troubleshooting, which helps to find potential security risks and sources and prevent similar risk events from occurring again; for transactions with a cumulative risk score less than or equal to the risk threshold, the system automatically releases, ensuring that normal transactions can proceed smoothly and not being hindered by excessive security detection, which leads to a cumbersome and inefficient transaction process. In summary, the transaction safety is ensured while the smoothness and efficiency of the transaction are taken into account.

[0017] Optionally, the information security detection method further comprises:

[0018] obtain a real-time false positive rate;

[0019] obtaining a false alarm difference value of the target false alarm rate and the real-time false alarm rate;

[0020] adjusting the risk threshold dynamically according to the false alarm difference value.

[0021] By adopting the technical scheme, the real-time false alarm rate is obtained, the false alarm difference value of the target false alarm rate and the real-time false alarm rate is calculated, and the risk threshold is adjusted dynamically according to the difference value, so that the system can continuously adapt to the actual transaction environment. By rapidly integrating the latest risk information into the detection mechanism, the system can timely grasp the dynamic change of the risk, thereby improving the response capability to the newly emerging risk.

[0022] Optionally, the transaction rule set comprises a transaction frequency rule, a transaction amount rule and a transaction location rule.

[0023] The step before obtaining the cumulative risk score comprises:

[0024] obtaining a network delay parameter;

[0025] determining whether the network delay parameter is greater than a dynamic delay threshold value;

[0026] if the network delay parameter is greater than the dynamic delay threshold value, starting a simplified mode, and generating a risk value based on a current transaction amount and a historical transaction amount average of the user;

[0027] determining whether the number of transactions within a unit time exceeds a frequency threshold value;

[0028] if yes, generating a frequency compensation factor;

[0029] outputting a cumulative risk score according to the frequency compensation factor and the risk value;

[0030] if the network delay parameter is less than or equal to the dynamic delay threshold value, obtaining a device power percentage;

[0031] determining whether the device power percentage is less than a set power threshold value;

[0032] if yes, starting a low-power-consumption mode, and reading the latest valid location coordinate from a local cache;

[0033] obtaining a risk coefficient of the latest valid location coordinate;

[0034] outputting a cumulative risk score according to the risk coefficient, a risk value corresponding to the transaction frequency rule and a risk value corresponding to the transaction amount rule.

[0035] By adopting the technical scheme, when the delay exceeds the dynamic threshold, the system is automatically switched to a simplified mode, only relying on comparison of a real-time transaction amount with a historical average value to generate a risk value, and then combining a frequency compensation factor for correction, to avoid risk control failure caused by network delay and ensure high-risk transaction interception rate. In the case of low power, by reading the last local cached position coordinate and superimposing the transaction frequency and amount rule risk value, it is ensured that the risk of geographical location can still be considered for interception in a network outage or weak network environment.

[0036] Optionally, the step of loading a corresponding transaction rule set from a local knowledge base according to the user information comprises:

[0037] Obtaining a historical transaction frequency in the user information;

[0038] Determining whether the historical transaction frequency is greater than a set frequency;

[0039] If yes, generating a personalized transaction rule set according to the user information;

[0040] If no, retrieving a latest transaction rule set of the same region and age group according to the residence information and age information in the user information.

[0041] By adopting the technical scheme, when the historical transaction frequency in the obtained user information is greater than the set frequency, since users with frequent transactions often have unique transaction modes and risk characteristics, the personalized rule set can more accurately reflect the risk situation of the user's transaction behavior. If the transaction frequency is less than or equal to the set frequency, the transaction rule set of the same region and age group can be referred to, and these universal factors can be considered from a macro perspective to improve the accuracy of transaction risk assessment for this part of users. This way of distinguishing and processing according to the transaction frequency respectively adopts different rule generation and retrieval methods for users with different transaction frequencies, so that the information security detection system can flexibly adapt to diverse user groups.

[0042] Optionally, the step of generating a personalized transaction rule set according to the user information comprises:

[0043] Calculating a current transaction security value of the user according to the user information;

[0044] From a transaction rule library, finding a first candidate transaction rule set corresponding to a historical transaction security value greater than the current transaction security value;

[0045] From the first candidate transaction rule set, filtering a second candidate transaction rule set with a security error less than an error threshold, ;

[0046] Obtaining an average security value of the second candidate transaction rule set;

[0047] determining whether there is a target historical transaction security value closest to the average security value in the transaction rule library;

[0048] If yes, generating a personalized transaction rule set according to a transaction rule set corresponding to the target historical transaction security value;

[0049] If no, generating a personalized transaction rule set according to the second alternative transaction rule set.

[0050] By using the above technical solution, the current transaction security value of the user is calculated, and the security situation of the user in the current transaction can be accurately measured. On this basis, the transaction rules are screened, so that the personalized transaction rule set generated finally is highly matched with the actual security demand of the user, the transaction risk is effectively reduced, and the security of transaction funds and information is guaranteed. The first alternative transaction rule set greater than the current transaction security value is searched, and then the second alternative transaction rule set with a security error less than a threshold value is screened from the first alternative transaction rule set, so as to gradually narrow the rule screening range. This hierarchical screening method avoids blind search of the entire transaction rule library, improves the screening efficiency, and reduces the consumption of system resources. The average security value of the second alternative transaction rule set is obtained, and it is determined whether there is a target historical transaction security value closest to the average security value in the transaction rule library. This method comprehensively considers the security situation of multiple alternative rules, avoids the one-sidedness of a single rule, and ensures the rationality and effectiveness of the personalized transaction rule set generated finally. According to whether there is the target historical transaction security value, different ways are used to generate the personalized transaction rule set. This flexible processing mechanism can adapt to various situations and ensure that appropriate transaction rules can be generated in different scenarios.

[0051] Optionally, the step before triggering the warning comprises:

[0052] searching, from a false alarm statistical library, an error number corresponding to a historical risk score matching the cumulative risk score;

[0053] calculating an average error number according to the error number;

[0054] determining whether the average error number is greater than a number threshold value;

[0055] If yes, triggering the warning.

[0056] By adopting the technical scheme, the false alarm frequency corresponding to the historical risk score matching the accumulated risk score is found from the false alarm statistical library, and the current early warning situation can be analyzed with the help of past data. The historical data reflects the false alarm rule under similar risk scores, providing an important reference for judging whether the current early warning is false. It avoids blindly triggering early warning only according to the current data, reduces the possibility of false alarm, calculates the average false alarm frequency and compares it with the frequency threshold, and if the average false alarm frequency is greater than the frequency threshold, it means that false alarm is more frequent under similar risk scores, and it is more cautious to trigger early warning at this time, thereby reducing unnecessary early warning triggering and making the early warning system more accurate. The current accumulated risk score is combined with the historical false alarm data to comprehensively evaluate the necessity of triggering early warning. Both the current risk situation and the historical false alarm situation under the same or similar risk scores are considered, so that the early warning decision is more comprehensive and accurate, and the situation that really needs early warning can be more accurately identified.

[0057] Optionally, the step of judging whether the average false alarm frequency is greater than the frequency threshold further comprises:

[0058] If not, a comprehensive risk transaction value is calculated according to the accumulated risk score and the current transaction security value;

[0059] An actual difference value between the comprehensive risk transaction value and a risk transaction threshold is obtained;

[0060] It is judged whether the actual difference value is less than a difference threshold;

[0061] If not, early warning is triggered;

[0062] If yes, the transaction is released, and risk marking is performed.

[0063] By adopting the technical scheme, when the average error times are not greater than the times threshold value, the comprehensive risk transaction value is calculated by combining the cumulative risk score and the current transaction security value, which can comprehensively evaluate the transaction risk from multiple dimensions. The actual difference between the comprehensive risk transaction value and the risk transaction threshold value is obtained and compared with the difference threshold value, realizing dynamic monitoring of the transaction risk and flexible adjustment of the early warning strategy. In different transaction scenarios and environments, the degree and change of the risk are different. The dynamic judgment mechanism can determine whether to trigger the early warning according to the actual risk difference, so that the early warning is more accurate, various complex transaction risks are effectively coped with, and the safety and stability of the transaction are ensured. In the judgment process, if the actual difference is not less than the difference threshold value, the early warning is triggered, and if the actual difference is less than the difference threshold value, the transaction is released, avoiding unnecessary intervention caused by an excessively sensitive early warning mechanism. Since the released transaction is risk marked, the traceability and safety of the transaction are ensured, and the transaction is managed as necessary without affecting the transaction efficiency. Through the marking, the transaction can be conveniently reviewed and verified when needed in the future, ensuring that the transaction meets relevant regulations and requirements.

[0064] In a second aspect, the application provides an information security detection system based on artificial intelligence, which adopts the following technical scheme:

[0065] An information security detection system based on artificial intelligence comprises:

[0066] A data capture module is configured to capture a transaction key field after data desensitization when a transaction event occurs.

[0067] A data processing module is configured to generate a behavior vector according to the transaction key field.

[0068] A user information analysis module is configured to analyze a user portrait to obtain user information.

[0069] The data processing module is further configured to load a corresponding transaction rule set from a local knowledge base according to the user information, and obtain a cumulative risk score of a transaction according to the behavior vector and a set transaction rule in the transaction rule set.

[0070] A judgment module is configured to judge whether the cumulative risk score is greater than a risk threshold value.

[0071] A pre-warning recording module is configured to trigger a pre-warning, freeze a transaction, and record an event log when the judgment module judges yes, and release the transaction when the judgment module judges no.

[0072] In a third aspect, the application provides a terminal, which adopts the following technical scheme:

[0073] A terminal comprises:

[0074] a memory storing an artificial intelligence-based information security detection program;

[0075] a processor configured to execute the program stored on the memory to implement the steps of the artificial intelligence-based information security detection method.

[0076] In a fourth aspect, the present application provides a computer-readable storage medium, which adopts the following technical solution:

[0077] A computer-readable storage medium storing a computer program capable of being loaded by a processor and executing the artificial intelligence-based information security detection method.

[0078] In summary, the present application has at least the following beneficial effects:

[0079] The transaction key field after data desensitization is captured when the transaction event occurs, which can prevent sensitive information in the transaction process from being exposed during the detection phase and reduce the possibility of data leakage. By capturing the desensitized transaction key field, discrete transaction features are converted into multi-dimensional behavior vectors, which can quantify the abnormal patterns of user behavior. By analyzing the user portrait and loading the corresponding transaction rule set from the local knowledge base accordingly, the detection method can be tailored to the actual transaction habits and risk characteristics of the user. Then, combined with the transaction rule set, the cumulative risk score of the transaction is obtained to evaluate the transaction risk in a quantitative manner, avoiding the errors caused by subjective judgment in the traditional method, and enabling comprehensive and objective evaluation of the risk level of the transaction. The transaction rule set in the local knowledge base can be updated and adjusted in real time according to the actual transaction situation and risk status, so that the generated risk score can better reflect the true risk level of the current transaction. When the cumulative risk score is greater than the risk threshold, the system can timely trigger an early warning and freeze the transaction, avoiding potential risk transactions from continuing, reducing possible economic losses and security threats, and controlling risks within the minimum range. At the same time, event logs are recorded, providing detailed records for subsequent risk analysis and troubleshooting, which helps to find potential security risks and sources and prevent similar risk events from occurring again; for transactions with a cumulative risk score less than or equal to the risk threshold, the system automatically releases them, ensuring that normal transactions can proceed smoothly without causing transaction processes to be cumbersome and inefficient due to excessive security detection, balancing transaction safety, smoothness, and efficiency. BRIEF DESCRIPTION OF DRAWINGS

[0080] Figure 1 is the first flowchart of the embodiment of the present application;

[0081] Figure 2 is the second flowchart of the embodiment of the present application;

[0082] Figure 3 is a third flow chart of embodiments of the present application;

[0083] Figure 4 is a fourth flow chart of embodiments of the present application;

[0084] Figure 5 is a fifth flow chart of embodiments of the present application;

[0085] Figure 6 is a sixth flow chart of embodiments of the present application;

[0086] Figure 7 is a seventh flow chart of embodiments of the present application. DETAILED DESCRIPTION

[0087] In order to make the purposes, technical solutions and advantages of the embodiments of the present application clearer, the following will combine the accompanying drawings of the embodiments of the present application to further describe the embodiments of the present application in detail. Figure 1 - the accompanying drawings Figure 7 , the technical solutions in the embodiments of the present application are described clearly and completely, obviously, the described embodiments are part of the embodiments of the present application, not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0088] The first embodiment of the present application discloses an information security detection method based on artificial intelligence. Referring to Figure 1 , the information security detection method can include S110-S180:

[0089] S110, when a transaction event occurs, capturing a transaction key field after data desensitization;

[0090] S120, generating a behavior vector according to the transaction key field;

[0091] S130, analyzing a user portrait to obtain user information;

[0092] S140, loading a corresponding transaction rule set from a local knowledge base according to the user information;

[0093] S150, obtaining a cumulative risk score of the transaction according to the behavior vector and the set transaction rule in the transaction rule set;

[0094] S160, judging whether the cumulative risk score is greater than a risk threshold;

[0095] S170, if yes, triggering an early warning, freezing the transaction, and recording an event log;

[0096] S180, if no, releasing the transaction.

[0097] Specifically, after the system receives a real-time transaction event, a log interceptor can be used to capture key fields in the transaction event, including a user unique identifier, a transaction amount, GPS coordinates or IP resolution location, transaction time, etc. Then data de-sensitization is performed, sensitive fields (such as bank card numbers) are deleted, and non-sensitive fields corresponding to behavior labels (such as transaction amounts greater than 5000 yuan) are retained. According to the non-sensitive fields, a behavior vector is constructed, the behavior vector V = [freq, amount, loc], where freq represents the number of transactions in the past 30 days; amount represents the ratio of the transaction amount to the historical average, , the numerator represents the transaction amount, and the denominator represents the historical average; loc represents the straight-line distance between the current location and the commonly used location (such as home address or company), and the commonly used location can also be the high-frequency location in the past 30 days.

[0098] According to pre-set rules, the required user information is extracted from the user portrait data, including user name, user historical transaction address, user historical transaction frequency, user residence, user age, etc. For example, by querying the records associated with the user unique identifier in the transaction database, the user name, user age, etc. are directly obtained. For user historical transaction address and user historical transaction frequency, SQL query statements can be written for statistics and screening. Then according to the user information, the corresponding transaction rule set is loaded from the local knowledge base; the transaction rule set at least includes transaction frequency rules, transaction amount rules, and transaction location rules, etc.

[0099] For the transaction frequency rule: if freq exceeds the pre-set threshold, the risk score is triggered, which can be 0.4. For the transaction amount rule: if amount exceeds the pre-set threshold, the risk score is triggered, which can be 0.8. For the transaction location rule: if loc exceeds the pre-set threshold, the risk score is triggered, which can be 0.6. In addition, the value can be modified and set through the background, and the modification and setting need to meet the condition that the amount rule is greater than the location rule, which is greater than the frequency rule. Then the cumulative risk score is calculated as the rule weight, for example, the transaction frequency rule corresponds to a weight of 0.2, the transaction amount rule corresponds to a weight of 0.5, and the transaction location rule corresponds to a weight of 0.3. is the rule value; is the rule trigger indicator function, and the risk score triggered is 1, otherwise it is 0.

[0100] When the cumulative risk score is greater than the risk threshold, the event log can be recorded using the Python log module, and the operations of triggering early warning and freezing transactions are simulated. Otherwise, the transaction is released, and a message indicating that the transaction is successful is returned.

[0101] Further, refer to Figure 2Before the step of obtaining the cumulative risk score, steps S210-S280 are included:

[0102] S210, obtaining a network delay parameter;

[0103] S220, determining whether the network delay parameter is greater than a dynamic delay threshold value;

[0104] S230, if yes, starting a simplified mode, generating a risk value based on a current transaction amount and a historical transaction amount average value of the user;

[0105] S240, determining whether the number of transactions within a unit time exceeds a frequency threshold value;

[0106] S250, if yes, generating a frequency compensation factor;

[0107] S260, outputting a cumulative risk score according to the frequency compensation factor and the risk value;

[0108] S270, if no, the cumulative risk score is a risk value corresponding to a transaction amount rule.

[0109] Specifically, for example, the network delay parameter can be measured using the ping command in Python, and the battery percentage information can be obtained using the psutil library. After obtaining the network delay parameter and the device battery percentage, first determine whether the network delay parameter is greater than the dynamic delay threshold value, and the dynamic delay threshold value is generated according to the current network connection type from the preset threshold library. For example, when the network connection type is 5G cellular network, the dynamic delay threshold value is set to 100ms; when the network connection type is 4G cellular network, the dynamic delay threshold value is set to 300ms; when the network connection type is Wi-Fi, the dynamic delay threshold value is set to 500ms.

[0110] If yes, enter the simplified mode, calculate the historical transaction amount average value and the standard deviation, and then divide the difference between the current transaction amount and the historical transaction amount average value by the standard deviation to obtain the risk value.

[0111] Further determine whether the number of transactions within a unit time exceeds the frequency threshold value, if yes, generate a frequency compensation factor, and then add the risk value and the frequency compensation factor to obtain the cumulative risk score; if no, the cumulative risk score is a risk value corresponding to a transaction amount rule, and in addition, the weight of the transaction amount rule is increased.

[0112] Referring to Figure 3 The steps after determining whether the network delay parameter is greater than the dynamic delay threshold value also include S310-S350:

[0113] S310, obtaining a device battery percentage;

[0114] S320, determining whether the device power percentage is less than a set power threshold;

[0115] S330, if yes, starting a low-power mode, and reading the last valid position coordinate from a local cache;

[0116] S340, obtaining a risk coefficient of the last valid position coordinate;

[0117] S350, outputting a cumulative risk score according to the risk coefficient, a risk value corresponding to a transaction frequency rule, and a risk value corresponding to a transaction amount rule.

[0118] Specifically, the historical fraud transaction proportion in each geographical grid is periodically collected, and a normalized risk coefficient of 0.1 to 1.0 is given to each geographical grid according to the fraud proportion. Then, the data is updated every 6 hours and compressed and stored in the local cache of the device. After entering the low-power mode, the real-time GPS positioning module is turned off, the last valid position coordinate is read from the local cache, and then the risk coefficient is matched according to the last valid position coordinate. Then, the risk value corresponding to the transaction frequency rule, the risk value corresponding to the transaction amount rule, and the risk coefficient are weighted and summed to obtain the cumulative risk score, and at this time the transaction position rule calculation is skipped. If no, end, and the cumulative risk score is the sum of all set rule risk values.

[0119] Referring to Figure 4 According to the user information, the step of loading a corresponding transaction rule set from the local knowledge base includes S410-S440:

[0120] S410, obtaining the historical transaction times in the user information;

[0121] S420, determining whether the historical transaction times are greater than a set number of times;

[0122] S430, if yes, generating a personalized transaction rule set according to the user information;

[0123] S440, if no, retrieving the latest transaction rule set of the same region and age group according to the residence information and age information in the user information.

[0124] Specifically, after the historical transaction times of the user are acquired, it can be judged whether the historical transaction times are greater than a set number of times; if yes, a personalized transaction rule set is generated according to the user information, and if no, a latest transaction rule set of the same region and age group is called according to the residence information and age information in the user information. The local knowledge base stores a transaction rule library, and the transaction rule library stores transaction rules corresponding to different regions and age groups. The age group to which the user belongs can be determined according to a pre-set age group division standard, and then the region to which the user belongs is determined according to the residence (such as the home address or company) of the user; after the transaction rule set meeting the age group and residence is screened out, the latest transaction rule set is called according to the creation time or update time associated with the screened transaction rule set.

[0125] With reference to Figure 5 , the step of generating a personalized transaction rule set according to the user information includes S510-S570:

[0126] S510, calculating a current transaction security value of the user according to the user information;

[0127] S520, finding a first candidate transaction rule set corresponding to a historical transaction security value greater than the current transaction security value from the transaction rule library;

[0128] S530, screening a second candidate transaction rule set with a security error less than an error threshold from the first candidate transaction rule set, ;

[0129] S540, acquiring an average security value of the second candidate transaction rule set;

[0130] S550, judging whether there is a target historical transaction security value closest to the average security value in the transaction rule library;

[0131] S560, if yes, generating a personalized transaction rule set according to the transaction rule set corresponding to the target historical transaction security value;

[0132] S570, if no, generating a personalized transaction rule set according to the second candidate transaction rule set.

[0133] Specifically, different information dimensions in the user information, such as transaction history, credit rating, account activity, etc., can be assigned corresponding weights, for example, the transaction history weight is 0.4, the credit rating weight is 0.3, and the account activity weight is 0.3. For transaction history, scoring can be performed according to factors such as transaction frequency and transaction amount stability; credit rating can directly refer to the rating results of professional institutions and convert them into corresponding scores; account activity can be scored according to login frequency and operation frequency. Multiply the quantitative scores of each information dimension by the corresponding weight, and then sum to obtain the current transaction security value. Assuming that the transaction history score is 80 points, the credit rating score is 70 points, and the account activity score is 60 points, then the current transaction security value = 80 x 0.4 + 70 x 0.3 + 60 x 0.3 = 71 points.

[0134] Each transaction rule set in the transaction rule library is associated with a historical transaction security value. A SQL query statement can be used to filter out transaction rule sets with a historical transaction security value greater than the current transaction security value from the transaction rule library. The set of these transaction rule sets is the first candidate rule set. According to business requirements and experience, a suitable error threshold is set. For each transaction rule set in the first candidate rule set, the absolute value of the security error is calculated. The first candidate transaction rule set with a security error less than the error threshold is filtered out to form the second candidate rule set. Then the sum of the historical transaction security values in the second candidate rule set is calculated and the average value is calculated. Then the absolute value of the difference between each historical transaction security value in the transaction rule library and the average security value is calculated. The second candidate transaction rule set with the smallest absolute value is the target transaction rule set. If there are multiple second candidate transaction rule sets with the smallest absolute value, the latest second candidate transaction rule set is the target transaction rule set. It should be noted that the number of transaction rules in different transaction rule sets can be different or the same. When the number of transaction rules is the same, the threshold values corresponding to the transaction rules are different.

[0135] According to the target transaction rule set, the personalized transaction rule set is generated in the following way: after determining the target transaction rule set, the threshold value corresponding to the transaction rule can be updated according to the current transaction security value of the user, thereby generating a personalized transaction rule set. For example, when the transaction security value is high, the threshold value of the transaction rule can be appropriately increased; when the transaction security value is low, the threshold value of the transaction rule is reduced to strengthen risk control. After determining the current transaction security value, the change value mapping table is called to find the change value corresponding to the transaction security value in the change value mapping table, and then the new threshold value is obtained according to the threshold value + change value. Each change value corresponds to a transaction security value range.

[0136] According to the second alternative transaction rule set, the personalized transaction rule is generated in the following manner: a second alternative transaction rule set with the same number of transaction rules is selected, and then a second alternative transaction rule set similar to the same transaction rule threshold is further searched from the selected second alternative transaction rule set, and the similar second alternative transaction rule set refers to the difference between the same transaction rule threshold being less than a set difference value. If there are multiple similar second alternative transaction rule sets, the latest second alternative transaction rule set is taken as the target rule set, so that the threshold corresponding to the transaction rule in the target rule set is updated according to the current transaction security value of the user; if there is only one similar second alternative transaction rule set, the threshold corresponding to the transaction rule in the similar second alternative transaction rule set is updated according to the current transaction security value of the user.

[0137] Further, with reference to Figure 6 and Figure 7 Before triggering the early warning, the steps can include S610-S690:

[0138] S610, from the false alarm statistics library, find the error times corresponding to the historical risk score matching the cumulative risk score;

[0139] S620, calculate the average error times according to the error times;

[0140] S630, determine whether the average error times is greater than the number threshold;

[0141] S640, if yes, trigger the early warning;

[0142] S650, if no, calculate the comprehensive risk transaction value according to the cumulative risk score and the current transaction security value;

[0143] S660, obtain the actual difference between the comprehensive risk transaction value and the risk transaction threshold;

[0144] S670, determine whether the actual difference is less than the difference threshold;

[0145] S680, if no, trigger the early warning;

[0146] S690, if yes, release the transaction and perform risk marking.

[0147] Specifically, the false alarm statistics library can use a relational database (such as MySQL) to store data, and the library contains two fields: historical risk score and corresponding error times. After the cumulative risk score is greater than the risk threshold, a SQL query statement can be used to retrieve the error times corresponding to the matching historical risk score from the database using the cumulative risk score as the query condition, then sum and average the error times, and compare the calculated average error times with the threshold.

[0148] The comprehensive risk transaction value is equal to the accumulated risk score multiplied by a weight coefficient plus the current transaction security value multiplied by another weight coefficient. The comprehensive risk transaction value is subtracted by a set risk transaction threshold constant to obtain an actual difference value, and then the actual difference value is compared with a set difference threshold constant. If the actual difference value is less than the difference threshold, the transaction is released, and the transaction is marked with a risk label for subsequent manual verification.

[0149] It should be noted that after the completion of the transaction on the same day, the real-time false positive rate can be obtained, and then the false positive difference between the target false positive rate (set false positive rate) and the real-time false positive rate is obtained; then according to the false positive difference, the risk threshold of the next day is dynamically adjusted.

[0150] Specifically, according to the false positive difference, the risk threshold is dynamically adjusted, and the new risk threshold is , is the original risk threshold, is the learning rate, is the target false positive rate, is the real-time false positive rate. Real-time false positive rate = false positive event number / total interception event number.

[0151] An implementation scenario of the embodiment is:

[0152] When a transaction event occurs, the transaction key field after data desensitization is captured, and then the behavior vector is generated according to the transaction key field, and then the user portrait is parsed to obtain user information; then it is judged whether the historical transaction times in the user information are greater than a set number of times, if yes, then the current transaction security value of the user is calculated according to the user information, and then the first candidate transaction rule set corresponding to the historical transaction security value greater than the current transaction security value is searched from the transaction rule library, and then the second candidate transaction rule set with a security error less than an error threshold is screened from the first candidate transaction rule set, and then the average security value of the second candidate transaction rule set is obtained, and then it is judged whether there is a target historical transaction security value closest to the average security value in the transaction rule library, if yes, then the personalized transaction rule set is generated according to the transaction rule set corresponding to the target historical transaction security value; then the accumulated risk score of the transaction is obtained according to the behavior vector and the set transaction rule in the personalized transaction rule set, and it is judged whether the accumulated risk score is greater than the risk threshold, if yes, the pre-warning is triggered, the transaction is frozen, and the event log is recorded.

[0153] After the completion of the transaction on the same day, the real-time false positive rate can be obtained, and then the false positive difference between the target false positive rate and the real-time false positive rate is obtained; then according to the false positive difference, the risk threshold of the next day is dynamically adjusted.

[0154] Based on the above method embodiments, the second embodiment of this application discloses an artificial intelligence-based information security detection system. The artificial intelligence-based information security detection system of this application embodiment can implement any of the above-described artificial intelligence-based information security detection methods, and the specific working process of each module in the artificial intelligence-based information security detection system can be referred to the corresponding process in the above method embodiments.

[0155] For ease of understanding, an example is as follows: An information security detection system based on artificial intelligence includes:

[0156] The data capture module is used to capture the anonymized key fields of a transaction when a transaction event occurs.

[0157] The data processing module is used to generate behavior vectors based on key transaction fields;

[0158] The user information parsing module is used to parse user profiles and obtain user information.

[0159] The data processing module is also used to load the corresponding set of transaction rules from the local knowledge base based on user information, and obtain the cumulative risk score of the transaction based on the behavior vector and the set of transaction rules in the transaction rule set.

[0160] The judgment module is used to determine whether the cumulative risk score is greater than the risk threshold;

[0161] The early warning recording module is used to trigger an early warning, freeze the transaction, and record the event log when the judgment module determines that the transaction is true. It is also used to allow the transaction to proceed when the judgment module determines that the transaction is false.

[0162] A third embodiment of this application provides a terminal. As one implementation of this terminal, the terminal may include: a memory and a processor; wherein...

[0163] The memory is used to store AI-based information security detection programs;

[0164] The processor is used to execute the program stored in the memory to implement the steps of the above-described artificial intelligence-based information security detection method.

[0165] The memory can communicate with the processor via a communication bus, which can be an address bus, a data bus, a control bus, etc.

[0166] Additionally, the memory may include random access memory (RAM) or non-volatile memory (NVM), such as at least one disk storage device.

[0167] The processor can be a general purpose processor, including a central processing unit (CPU), a network processor (NP), etc., and can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA), or other programmable logic device, discrete gate or transistor logic, discrete hardware components, etc.

[0168] The fourth embodiment of the present application provides a computer readable storage medium, which stores a computer program capable of being loaded by a processor and executing the above-mentioned information security detection method based on artificial intelligence.

[0169] The computer readable storage medium can be any available medium that can be accessed by a computer or a data storage device, such as a server, data center, etc., integrated with one or more available media. The available media can be a magnetic medium (e.g., a floppy disk, a hard disk, a magnetic tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid state disk), etc.

[0170] The above are preferred embodiments of the present application, and are not intended to limit the protection scope of the present application. Any feature disclosed in the specification (including the abstract and the drawings) can be replaced by other equivalent or similar features unless specifically stated. That is, each feature is only an example of a series of equivalent or similar features unless specifically stated.

Claims

1. An information security detection method based on artificial intelligence, characterized in that, include: When a transaction event occurs, capture the key transaction fields after data anonymization; Based on the key transaction fields, a behavior vector is generated, which includes the number of transactions in the past 30 days, the ratio of the current transaction amount to the historical average, and the straight-line distance between the current location and the frequently used location. Analyze user profiles to obtain user information; Based on the user information, load the corresponding transaction rule set from the local knowledge base. The transaction rule set includes at least transaction frequency rules, transaction amount rules, and transaction location rules. Based on the behavior vector and the set of trading rules in the trading rule set, the cumulative risk score of the transaction is obtained; Determine whether the cumulative risk score is greater than the risk threshold; If so, an alert will be triggered, the transaction will be frozen, and the event log will be recorded. If not, then proceed with the transaction; The steps prior to obtaining the cumulative risk score include: Obtain network latency parameters; Determine whether the network latency parameter is greater than a dynamic latency threshold, which is generated by matching from a preset threshold library based on the current network connection type; If the network latency parameter is greater than the dynamic latency threshold, a simplified mode is activated to calculate the mean and standard deviation of historical transaction amounts, and a risk value is generated by dividing the difference between the current transaction amount and the mean of historical transaction amounts by the standard deviation. Determine whether the number of transactions per unit time exceeds the frequency threshold; If yes, then a frequency compensation factor is generated, the risk value is added to the frequency compensation factor, and the cumulative risk score is output; if no, then the cumulative risk score is the risk value corresponding to the transaction amount rule. If the network latency parameter is less than or equal to the dynamic latency threshold, then obtain the device battery percentage; Determine whether the device's battery percentage is less than a set battery threshold; If so, then activate low-power mode and read the most recent valid location coordinates from the local cache; Obtain the historical fraud transaction ratio within the geographic grid corresponding to the most recent valid location coordinates, and determine the risk coefficient based on the historical fraud transaction ratio; The risk values ​​corresponding to the trading frequency rule, the trading amount rule, and the aforementioned risk coefficient are weighted and summed to obtain the cumulative risk score. If not, the cumulative risk score is the sum of all set rule risk values.

2. The information security detection method based on artificial intelligence according to claim 1, characterized in that, The information security detection method also includes: Get the real-time false alarm rate; Obtain the false alarm difference between the target false alarm rate and the real-time false alarm rate; The risk threshold is dynamically adjusted based on the false alarm difference.

3. The information security detection method based on artificial intelligence according to claim 1, characterized in that, The step of loading the corresponding transaction rule set from the local knowledge base based on the user information includes: Obtain the number of historical transactions from the user information; Determine whether the number of historical transactions exceeds a set number; If so, a personalized transaction rule set is generated based on the user information; If not, then based on the user's place of residence and age information, retrieve the latest set of transaction rules for the same region and age group.

4. The information security detection method based on artificial intelligence according to claim 3, characterized in that, The step of generating a personalized transaction rule set based on the user information includes: Calculate the user's current transaction security value based on the user information; From the transaction rule base, find the first set of alternative transaction rules corresponding to historical transaction security values ​​that are greater than the current transaction security value; From the first set of candidate trading rules, a second set of candidate trading rules with a safety error less than the error threshold is selected, wherein the safety error = |current trading safety value - historical trading safety value|; Obtain the average safety value of the second set of alternative transaction rules; Determine whether there exists a target historical transaction security value in the transaction rule base that is closest to the average security value; If so, a personalized transaction rule set is generated based on the transaction rule set corresponding to the target historical transaction security value; If not, a personalized set of trading rules is generated based on the second alternative set of trading rules.

5. The information security detection method based on artificial intelligence according to claim 4, characterized in that, The steps prior to triggering the warning include: From the false alarm statistics database, find the number of errors corresponding to historical risk scores that match the cumulative risk score; Calculate the average number of errors based on the number of errors mentioned above; Determine whether the average error count is greater than the count threshold; If so, an alert will be triggered.

6. The information security detection method based on artificial intelligence according to claim 5, characterized in that, The step following the determination of whether the average error count is greater than the count threshold further includes: If not, then calculate the comprehensive risk transaction value based on the accumulated risk score and the current transaction security value; Obtain the actual difference between the comprehensive risk transaction value and the risk transaction threshold; Determine whether the actual difference is less than the difference threshold; If not, an alert will be triggered; If so, the transaction is allowed, and a risk marker is applied.

7. An information security detection system based on artificial intelligence, characterized in that, Performing the information security detection method based on artificial intelligence as described in any one of claims 1-6 includes: The data capture module is used to capture the anonymized key fields of a transaction when a transaction event occurs. The data processing module is used to generate behavior vectors based on the key transaction fields; The user information parsing module is used to parse user profiles and obtain user information. The data processing module is also used to load the corresponding transaction rule set from the local knowledge base according to the user information, and obtain the cumulative risk score of the transaction according to the behavior vector and the set transaction rules in the transaction rule set; The judgment module is used to determine whether the cumulative risk score is greater than the risk threshold; The early warning recording module is used to trigger an early warning, freeze the transaction, and record the event log when the judgment module determines that the transaction is true, and to allow the transaction to proceed when the judgment module determines that the transaction is false.

8. A terminal, characterized in that, include: The memory contains information security detection programs based on artificial intelligence. A processor is configured to execute a program stored in the memory to implement the steps of the artificial intelligence-based information security detection method as described in any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The computer program is stored and can be loaded by a processor and executed as described in any one of claims 1-6.

Images