An intelligent process configuration engine system supporting globalized business

Abstract

The present application relates to the technical field of process engine system, and more particularly to an intelligent process configuration engine system supporting globalized business, which is provided with a data acquisition module, a node screening module, a node analysis module and a node process regulation module, determines cross-region interaction parameters through the node screening module to screen risk task nodes, determines risk data interaction behaviors through the node analysis module, determines transmission characteristic parameters based on the data transmission volume and the risk data interaction behaviors of the same risk task node, fits a risk fluctuation curve through the node process regulation module, determines a risk tendency coefficient to select a process interception mode of the risk task node, and realizes quick identification of risk task nodes, adaptively adjusts the interception mode of process data according to the actual data interaction fluctuation of the risk task nodes, and improves the reliability of the intelligent process configuration engine system in the globalized business scenario.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of process engine systems, and in particular to an intelligent process configuration engine system supporting globalized businesses. BACKGROUND

[0002] Under the background of rapid development of globalized businesses, enterprises need to realize data interaction and business collaboration through cross-regional task nodes, such as order synchronization of cross-border e-commerce and financial data aggregation of multinational groups. However, such cross-regional interaction also faces multiple risk prevention and control challenges. Traditional technical solutions have obvious limitations. On the one hand, the accuracy of risk identification is insufficient. Traditional engine systems mostly rely on a single threshold. Attackers can evade monitoring through intermittent anomalies, making it difficult to be identified, resulting in long-term risks such as data leakage and malicious instruction injection. On the other hand, the adaptability of risk prevention and control is limited. Traditional rule engines rely on static configuration and cannot adapt to complex scenarios of globalized businesses. Uniform rules can easily lead to missed or incorrect judgments. Moreover, the attack patterns of attackers are dynamically evolving, and static rules are difficult to respond quickly, resulting in risk prevention and control lagging behind actual threats. In addition, it is difficult to balance risks and businesses. Globalized businesses have high efficiency requirements for cross-regional data interaction. Although the traditional one-size-fits-all interception method can reduce risks, it will seriously affect the normal business flow, making it difficult to balance safety and efficiency. Therefore, improving the risk identification accuracy and dynamic prevention and control efficiency of each task node in cross-regional data interaction in the context of globalized businesses is a technical problem that needs to be solved.

[0003] For example, Chinese Patent No. CN120045302B discloses a process engine optimization method and system in a high-concurrency process scenario, which includes the following steps: attaching a priority label to the process task; attaching a resource type label to the process task; the process engine has a pre-warning mechanism for entering a high-concurrency process state. When the pre-warning is triggered, the new task enters a waiting sequence. The process engine prioritizes tasks with higher priority. When the priority is the same, the process engine prioritizes the processing of process tasks with resource type labels that match higher idle rate system resource types according to the real-time idle rate of system resources. The process engine has an exit mechanism. After exiting the high-concurrency process state, the new task no longer enters the waiting sequence but enters the normal processing sequence of the process engine. This application establishes a high-concurrency process state pre-warning mechanism and a high-concurrency task processing method, enabling the process engine to handle multiple concurrent tasks when facing a high-concurrency task scenario.

[0004] The existing technology also has the following problems:

[0005] The prior art does not consider that the cross-regional task node data interaction under the global business scenario is prone to security risks, the prior art cannot quickly identify risk task nodes, and cannot adaptively adjust the interception mode of process data according to the actual data interaction fluctuation of the risk task nodes, thereby affecting the dynamic prevention and control efficiency of each task node in cross-regional data interaction under the global business scenario, and the efficiency and reliability of the intelligent process configuration engine system. SUMMARY

[0006] Therefore, the present application provides an intelligent process configuration engine system supporting global business to overcome the problems that the prior art cannot quickly identify risk task nodes, cannot adaptively adjust the interception mode of process data according to the actual data interaction fluctuation of the risk task nodes, and affects the dynamic prevention and control efficiency of each task node in cross-regional data interaction under the global business scenario, and the efficiency and reliability of the intelligent process configuration engine system.

[0007] To achieve the above-mentioned purpose, the present application provides an intelligent process configuration engine system supporting global business, comprising:

[0008] a data acquisition module for acquiring regional information, data transmission volume and interaction characteristic data of each task node, wherein the interaction characteristic data includes an interaction domain name, an interaction time period corresponding to the interaction domain name, and an interaction data transmission volume;

[0009] a node screening module connected with the data acquisition module, for determining cross-regional interaction parameters according to the data transmission between task nodes in different regions within a preset monitoring period, and screening risk task nodes based on the cross-regional interaction parameters of the task nodes;

[0010] a node analysis module connected with the data acquisition module and the node screening module, for determining risk data interaction behavior according to real-time interaction characteristic data of the data interaction behavior between the risk task node and the remaining task nodes, and determining transmission characteristic parameters based on the data transmission volume and the risk data interaction behavior of the risk task node;

[0011] a node process regulation module connected with the node analysis module, for fitting a risk fluctuation curve based on the transmission characteristic parameters of the risk task node, and selecting a process interception mode for the risk task node according to the risk tendency coefficient of the risk task node, so as to partially intercept the process data of the risk task node or completely intercept the process data of the risk task node.

[0012] Further, the node screening module is used to determine cross-regional interaction parameters, wherein,

[0013] The node screening module determines the number of times of data exchange between any task node in a preset monitoring period and the task node and the task nodes in different regions as a cross-region interaction parameter of the task node.

[0014] Further, the node screening module is configured to screen a risk task node, wherein,

[0015] The node screening module screens the task node as a risk task node based on a determination result that the cross-region interaction parameter of the task node meets a risk task node screening condition.

[0016] The risk task node screening condition is that the cross-region interaction parameter exceeds a preset cross-region interaction parameter threshold.

[0017] Further, the node analysis module is configured to determine a risk data interaction behavior, wherein,

[0018] The node analysis module determines the data interaction behavior as a risk data interaction behavior based on a determination result that a comparison between real-time interaction feature data and historical interaction feature data of the data interaction behavior of the risk task node meets a risk data interaction behavior condition.

[0019] Further, the risk data interaction behavior condition is that the real-time interaction domain name does not meet any one of the historical interaction domain names, or the real-time interaction time period corresponding to the real-time interaction domain name is inconsistent with the historical interaction time period of the real-time interaction domain name in the historical interaction feature data, or the interaction data transmission amount exceeds a preset interaction data transmission amount threshold.

[0020] Further, the node analysis module is configured to determine a transmission characteristic parameter, wherein,

[0021] The node analysis module obtains data transmission amounts and risk data interaction behaviors of the same risk task node at a plurality of monitoring moments in a preset monitoring period, and determines a ratio of a risk interaction data transmission amount to a total node data transmission amount as the transmission characteristic parameter.

[0022] The risk interaction data transmission amount is a number of interaction data transmission amounts in the risk data interaction behavior.

[0023] The total node data transmission amount is the data transmission amount of the risk task node at each monitoring moment.

[0024] Further, the node flow control module is configured to determine the risk tendency coefficient, wherein,

[0025] The node flow regulation module obtains transmission characteristic parameters at each trough on the risk fluctuation curve in the horizontal coordinate direction, and determines a ratio of a difference between the transmission characteristic parameter of a later trough in adjacent troughs and the transmission characteristic parameter of an earlier trough in the adjacent troughs to a time interval of the adjacent troughs as the risk tendency coefficient;

[0026] The risk fluctuation curve establishes a rectangular coordinate system with time as the horizontal axis and the value of the transmission characteristic parameter as the vertical axis, and is fitted according to a plurality of risk fluctuation points, which are determined according to the transmission characteristic parameter and the time corresponding to the transmission characteristic parameter.

[0027] Further, the node flow regulation module is configured to select a flow interception mode of the risk task node, wherein,

[0028] If the risk tendency coefficient of the risk task node meets all interception conditions, the node flow regulation module selects the flow interception mode as all interception of the flow data of the risk task node.

[0029] If the risk tendency coefficient of the risk task node does not meet all interception conditions, the node flow regulation module selects the flow interception mode as partial interception of the flow data of the risk task node.

[0030] The all interception condition is that the risk tendency coefficient exceeds a preset risk tendency coefficient threshold.

[0031] Further, the node flow regulation module is configured to determine the flow data for partial interception, wherein,

[0032] The node flow regulation module is configured to divide the risk fluctuation curve into a plurality of time periods, and intercept the flow data of the risk task node in a characteristic time period.

[0033] Further, the node flow regulation module is configured to determine a characteristic time period, wherein,

[0034] The node flow regulation module determines a time period as a characteristic time period based on a determination result that a characteristic risk characteristic value of the time period meets a characteristic time period screening condition.

[0035] The characteristic time period screening condition is that the characteristic risk characteristic value exceeds a preset characteristic risk characteristic value threshold, and the characteristic risk characteristic value is a difference between a maximum transmission characteristic parameter and a minimum transmission characteristic parameter in a time period.

[0036] Compared with the prior art, the present application has the beneficial effects that the present application is provided with a data acquisition module, a node screening module, a node analysis module, and a node process control module, the cross-region interaction parameters are determined through the node screening module to screen the risk task nodes, the risk data interaction behavior is determined through the node analysis module, the transmission characteristic parameters are determined based on the data transmission volume and the risk data interaction behavior of the same risk task node, the risk fluctuation curve is fitted through the node process control module, the risk tendency coefficient is determined to select the process interception mode of the risk task node, and then, the risk task node is quickly identified, the process data interception mode is adaptively adjusted according to the actual data interaction fluctuation of the risk task node, and the efficiency and reliability of the intelligent process configuration engine system in the global business scenario are improved.

[0037] Especially, the risk task nodes are screened based on the cross-region interaction parameters of the task nodes through the node screening module, and it can be understood that high-frequency cross-region interaction itself implies higher risk exposure, potential risk nodes are identified early, and passive response after risk diffusion is avoided, the cross-region interaction frequency is quantified, redundant monitoring of low-frequency task nodes is avoided, resources are concentrated on high-frequency interaction task nodes, task nodes with high risk potential are quickly focused in the global business, the efficiency and pertinence of subsequent risk analysis are improved, the risk task nodes are quickly identified through the node screening module based on the cross-region interaction parameters of the task nodes, and then, the efficiency and reliability of the intelligent process configuration engine system in the global business scenario are improved.

[0038] Especially, the risk data interaction behavior is determined according to the comparison between the real-time interaction feature data and the historical interaction feature data of the data interaction behavior between the risk task nodes and the remaining task nodes through the node analysis module, and it can be understood that the normal behavior baseline is constructed based on the historical features such as long-term stable interaction domain name and regular time period, the behavior deviating from the baseline is determined as the risk data interaction behavior, the misjudgment of normal interaction behavior is avoided, the core features are focused, the risk data interaction behavior is quickly located, the real-time monitoring demand of high-frequency interaction in the global business is adapted, the three core features of the interaction domain name, the interaction time period corresponding to the interaction domain name, and the interaction data transmission volume cover the common risk scenarios in the global business, the risk data interaction behavior is determined according to the comparison between the real-time interaction feature data and the historical interaction feature data through the present application, and then, the risk data interaction behavior is determined according to the actual data interaction behavior of the risk task node, the efficiency and reliability of the intelligent process configuration engine system in the global business scenario are improved.

[0039] Especially, the application determines the transmission characteristic parameters according to the data transmission amount and risk data interaction behavior of the same risk task node at several monitoring moments within a preset monitoring period, fits the risk fluctuation curve based on the transmission characteristic parameters of the risk task node, and can be understood that the risk evaluation standard of different scale nodes is unified through the ratio form of the risk interaction data transmission amount and the total node data transmission amount, rather than the absolute transmission amount, for example, 100MB risk transmission amount accounts for 50% of the total transmission amount 200MB of the node, and accounts for 5% of the total transmission amount 2000MB of the node, avoiding risk misjudgment caused by different node business volumes, the ratio directly reflects the proportion weight of the risk data interaction behavior in the total transmission of the node, and the higher the proportion is, the more serious the risk data interaction behavior penetrates into normal business, the traditional threshold detection only focuses on instantaneous data, and the fluctuation curve can identify the change trend of the risk in advance by analyzing the change trend of the transmission characteristic parameters, for example, the attacker expands the data stealing scale in stages, and the transmission amount does not exceed the threshold value each time, but the wave trough gradually rises from 10% to 30%, which can be identified through the fluctuation curve, and then, the actual data interaction fluctuation of the risk task node is obtained, and the efficiency and reliability of the intelligent process configuration engine system in the global business scenario are improved.

[0040] Especially, the application determines the risk tendency coefficient according to the risk fluctuation curve through the node process regulation module to select the process interception mode of the risk task node, and can be understood that the risk tendency coefficient focuses on the wave trough change of the risk fluctuation curve rather than single-point data, obtains the dynamic change trend, and advances the interception time to the trend formation stage, sets different interception strategies to balance safety and business continuity, when the business scenario changes, the risk tendency coefficient filters short-term interference through multi-period wave trough comparison, adapts to the dynamic nature of global business, selects the interception mode through the risk tendency coefficient of the risk fluctuation curve, realizes dynamic hierarchical prevention and control of the risk task node, avoids excessive interception affecting business, and prevents insufficient interception from leading to risk spread, and then, the interception mode of the process data is adaptively adjusted according to the actual data interaction fluctuation of the risk task node, and the efficiency and reliability of the intelligent process configuration engine system in the global business scenario are improved.

[0041] Especially, the application selects the interception mode of the process data of the risk task node as all interception by the node process regulation module when the risk task node meets all interception conditions. It can be understood that the risk tendency coefficient is a quantification of the risk accumulation state, which can represent the deterioration acceleration of the transmission characteristic parameter. The larger the risk tendency coefficient is, the faster the risk deterioration rate is, and the higher the risk out-of-control possibility is. If not all interception, the risk will spread rapidly. The risk behavior is more persistent, not an occasional fluctuation such as normal business peak, but a systematic anomaly such as malicious program continuous operation, which needs to be immediately cut off to prevent the risk from spreading to other nodes. The trough is less affected by accidental factors in the risk fluctuation curve, and the rising trough, i.e. the risk tendency coefficient exceeding the risk tendency coefficient threshold, represents that the risk is gradually increasing. All interception can directly block the transmission to other task nodes, avoiding the risk from spreading from a single task node to the associated business link. Partial interception cannot cover all risk carriers. All interception can terminate the transmission before the risk spreads on a large scale, reducing the cost of subsequent traceability, data repair, and loss accountability. Further, the application adaptively adjusts the interception mode of the process data according to the actual data interaction fluctuation of the risk task node, improving the efficiency and reliability of the intelligent process configuration engine system in the global business scenario.

[0042] Especially, the application selects the interception mode of the process data of the risk task node as all interception by the node process regulation module when the risk task node meets all interception conditions. It can be understood that the risk tendency coefficient is a quantification of the risk accumulation state, which can represent the deterioration acceleration of the transmission characteristic parameter. The larger the risk tendency coefficient is, the faster the risk deterioration rate is, and the higher the risk out-of-control possibility is. If not all interception, the risk will spread rapidly. The risk behavior is more persistent, not an occasional fluctuation such as normal business peak, but a systematic anomaly such as malicious program continuous operation, which needs to be immediately cut off to prevent the risk from spreading to other nodes. The trough is less affected by accidental factors in the risk fluctuation curve, and the rising trough, i.e. the risk tendency coefficient exceeding the risk tendency coefficient threshold, represents that the risk is gradually increasing. All interception can directly block the transmission to other task nodes, avoiding the risk from spreading from a single task node to the associated business link. Partial interception cannot cover all risk carriers. All interception can terminate the transmission before the risk spreads on a large scale, reducing the cost of subsequent traceability, data repair, and loss accountability. Further, the application adaptively adjusts the interception mode of the process data according to the actual data interaction fluctuation of the risk task node, improving the efficiency and reliability of the intelligent process configuration engine system in the global business scenario. BRIEF DESCRIPTION OF DRAWINGS

[0043] Figure 1 A functional block diagram of an intelligent process configuration engine system supporting globalized business for an embodiment of the present application;

[0044] Figure 2 A logic flow chart of a node screening module screening a risk task node for an embodiment of the present application;

[0045] Figure 3 A logic flow chart of a node analysis module judging a risk data interaction behavior for an embodiment of the present application;

[0046] Figure 4 A logic flow chart of a node process control module selecting a process interception mode of a risk task node for an embodiment of the present application. DETAILED DESCRIPTION

[0047] In order to make the objects and advantages of the present application clearer, the present application will be further described below in conjunction with embodiments. It should be understood that the specific embodiments described herein merely serve the purpose of explaining the present application and are not intended to limit the present application.

[0048] The preferred embodiments of the present application will be described below with reference to the accompanying drawings. It should be understood by those skilled in the art that the embodiments merely serve the purpose of explaining the technical principles of the present application and are not intended to limit the protection scope of the present application.

[0049] It should be noted that, in the description of the present application, the terms indicating the direction or positional relationship such as "upper", "lower", "inner", "outer" and the like are based on the direction or positional relationship shown in the drawings, which is merely for the purpose of description and does not indicate or imply that the device or element must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as a limitation on the present application.

[0050] In addition, it should also be noted that, in the description of the present application, unless otherwise explicitly specified and limited, the terms "mounting", "connection" should be understood broadly, for example, can be fixed connection, can also be detachable connection, or integral connection; can be mechanical connection, can also be electrical connection; can be directly connected, can also be indirectly connected through an intermediate medium, can be the internal communication of two elements. For those skilled in the art, the specific meaning of the above terms in the present application can be understood according to the specific circumstances.

[0051] Please refer to Figure 1 Fig. 1 shows a functional block diagram of an intelligent process configuration engine system supporting globalized business for an embodiment of the present application, the intelligent process configuration engine system supporting globalized business of the present application comprises:

[0052] a data acquisition module configured to acquire regional information, data transmission volume, and interaction feature data of each task node, wherein the interaction feature data comprises an interaction domain name, an interaction time period corresponding to the interaction domain name, and interaction data transmission volume;

[0053] Specifically, the data acquisition module is not limited in structure, and preferably, it can acquire the regional information, data transmission volume, and interaction feature data of each task node through flow capture, geolocation, and log analysis.

[0054] a node screening module connected to the data acquisition module and configured to determine a cross-region interaction parameter according to data transmission conditions between task nodes in different regions within a preset monitoring period, and screen a risk task node based on the cross-region interaction parameter of the task node;

[0055] Specifically, the preset monitoring period can be set by a person skilled in the art according to the accuracy requirement of the intelligent process configuration engine system, the higher the accuracy requirement, the shorter the preset monitoring period, and the preset monitoring period can be in the range of [10, 30] with a unit of min, and preferably, the preset monitoring period can be 15 min.

[0056] Specifically, the task nodes in different regions are determined according to the actual physical positions of the task nodes, and are divided into different regions according to the countries.

[0057] Specifically, the node screening module is not limited in structure, and preferably, it can be a microprocessor configured to determine the cross-region interaction parameter and screen the risk task node.

[0058] a node analysis module connected to the data acquisition module and the node screening module, and configured to determine a risk data interaction behavior according to real-time interaction feature data of data interaction behaviors between the risk task node and other task nodes, and determine a transmission characteristic parameter based on the data transmission volume and the risk data interaction behavior of the risk task node;

[0059] Specifically, the interval length between a plurality of monitoring time points within the preset monitoring period can be set by a person skilled in the art according to the accuracy requirement of the intelligent process configuration engine system, the higher the accuracy requirement, the shorter the interval length, and the interval length can be in the range of [10, 30] with a unit of s, and preferably, the interval length can be 15 s.

[0060] Specifically, the structure of the node analysis module is not limited, and preferably, the node analysis module can be a processor used in a computer to determine the risk data interaction behavior and determine the transmission characteristic parameter, which will not be repeated here.

[0061] The node flow regulation module is connected with the node analysis module to fit a risk fluctuation curve based on the transmission characteristic parameter of the risk task node, and select a flow interception mode according to the risk tendency coefficient of the risk task node, so as to partially intercept the flow data of the risk task node or totally intercept the flow data of the risk task node.

[0062] Specifically, the structure of the node flow regulation module is not limited, and preferably, the node flow regulation module can be a microprocessor to fit the risk fluctuation curve, determine the risk tendency coefficient, and select the flow interception mode of the risk task node, which will not be repeated here.

[0063] Specifically, a field pool used in the flow can be set in advance, the flow type is set according to the region where the business is located, and the task node in each flow type is customized according to the field in the field pool.

[0064] Specifically, the node screening module is used to determine the cross-region interaction parameter, wherein,

[0065] The node screening module determines the number of times that any task node in a preset monitoring period exchanges data with the task node in a different region as the cross-region interaction parameter of the task node.

[0066] Please refer to Figure 2 The node screening module is used to screen the risk task node, wherein,

[0067] The node screening module screens the task node as a risk task node based on the determination result that the cross-region interaction parameter of the task node meets the risk task node screening condition;

[0068] If the cross-region interaction parameter of the task node does not meet the risk task node screening condition, the node screening module does not screen the task node;

[0069] The risk task node screening condition is that the cross-region interaction parameter exceeds a preset cross-region interaction parameter threshold.

[0070] Specifically, the preset cross-region interaction parameter threshold is a product of a cross-region interaction parameter reference value and a cross-region factor, the cross-region interaction parameter reference value is an average value of the cross-region interaction parameters of the task nodes in the historical data, the cross-region factor can be set by a person skilled in the art according to the accuracy requirement of the intelligent process configuration engine system, the higher the accuracy requirement, the smaller the cross-region factor, and the value range of the cross-region factor can be [1.1, 1.3], preferably, the cross-region factor can be 1.2.

[0071] Specifically, the node screening module screens the risk task nodes based on the cross-region interaction parameters of the task nodes, and it can be understood that high-frequency cross-region interaction itself implies higher risk exposure, early identification of potential risk nodes can avoid passive response after risk diffusion, and through quantification of the cross-region interaction frequency, redundant monitoring of low-frequency task nodes is avoided, resources are concentrated on high-frequency interaction task nodes, and the efficiency and pertinence of subsequent risk analysis are improved in the globalized business. The node screening module screens the risk task nodes based on the cross-region interaction parameters of the task nodes, and then, the efficiency and reliability of the intelligent process configuration engine system in the globalized business scenario are improved.

[0072] Specifically, it can be understood that in the globalized business, cross-region interaction needs to pass through more network boundaries, and the probability of being intercepted and used by attackers is higher than that of intra-region interaction. When the cross-region interaction parameter of a certain task node exceeds the preset cross-region interaction parameter threshold, the opportunity cost of its risk exposure is significantly increased, even if the risk of single interaction is low, the cumulative risk exists due to high frequency. By screening the risk task nodes through the cross-region interaction frequency, the essence is to reduce the scope of key monitoring through frequency quantification. For high-frequency task nodes, further analysis is performed subsequently, and for low-frequency task nodes, a conventional monitoring process is applied. Through this hierarchical strategy of focusing on key points, the marginal benefit principle of risk prevention and control is met, and the actual scenario of globalized business is adapted, and then, the efficiency and reliability of the intelligent process configuration engine system in the globalized business scenario are improved.

[0073] Please refer to Figure 3 The node analysis module is used to determine the risk data interaction behavior, wherein,

[0074] The node analysis module determines the data interaction behavior as the risk data interaction behavior based on the comparison result of the real-time interaction feature data and the historical interaction feature data of the data interaction behavior of the risk task node.

[0075] If the comparison of the real-time interaction feature data of the data interaction behavior of the risk task node with the historical interaction feature data does not meet the risk data interaction behavior condition, the node analysis module does not screen the data interaction behavior.

[0076] Specifically, the historical interaction feature data is obtained within a preset collection period before the current risk task node is monitored. The preset collection period can be set by a person skilled in the art according to the accuracy requirement of the intelligent flow configuration engine system. The higher the accuracy requirement, the longer the preset collection period. The preset collection period can be [10, 20] days, and the interval unit is day. Preferably, the preset collection period can be 15 days. The historical interaction feature data includes historical interaction domain name, historical interaction time period, and historical interaction data transmission amount.

[0077] Specifically, the risk data interaction behavior condition is that the real-time interaction domain name does not meet any of the historical interaction domain names, or the real-time interaction time period corresponding to the real-time interaction domain name is inconsistent with the historical interaction time period of the real-time interaction domain name in the historical interaction feature data, or the interaction data transmission amount exceeds the preset interaction data transmission amount threshold.

[0078] Specifically, each task node is uniformly converted to UTC time for comparison. The system has a built-in time zone conversion interface that can convert each regional time to UTC time in real time. The historical interaction time period is the time period with the highest occurrence in the historical data. The preset interaction data transmission amount threshold is the product of the interaction data transmission reference value and the interaction factor. The interaction data transmission reference value is the average value of the interaction data transmission amount of the current risk task node in the historical data. The interaction factor can be set by a person skilled in the art according to the accuracy requirement of the intelligent flow configuration engine system. The higher the accuracy requirement, the smaller the interaction factor. The value range of the interaction factor can be [1.15, 1.25]. Preferably, the interaction factor can be 1.2.

[0079] Specifically, the embodiment of the present application determines the risk data interaction behavior according to the comparison between the real-time interaction feature data and the historical interaction feature data of the data interaction behavior between the risk task node and the remaining task nodes. It can be understood that, based on historical features such as long-term stable interaction domain name and regular time period, a normal behavior baseline is constructed, behaviors deviating from the baseline are determined as risk data interaction behaviors, avoiding misjudgment of normal interaction behaviors, focusing on core features, quickly positioning risk data interaction behaviors, adapting to the real-time monitoring needs of high-frequency interactions in globalized businesses, and covering common risk scenarios in globalized businesses through three core features of interaction domain name, interaction time period corresponding to the interaction domain name, and interaction data transmission volume. The embodiment of the present application determines the risk data interaction behavior according to the comparison between the real-time interaction feature data and the historical interaction feature data, and further, realizes the determination of the risk data interaction behavior according to the actual data interaction behavior of the risk task node, improves the efficiency and reliability of the intelligent process configuration engine system in the globalized business scenario.

[0080] Specifically, it can be understood that, based on the risk prevention and control principle, the interaction features of normal businesses usually have stability and predictability, for example, the historical data of a certain cross-border node shows that only the fixed cooperation party domain name is used for data interaction within 9-18 time period, and the single transmission volume is stable within 100MB. These historical features constitute a normal behavior baseline, while risk data interaction behaviors, such as data stealing by attackers, usually break the baseline, for example, if the real-time interaction domain name is a strange interaction domain name, it may be malicious external connection, if data interaction is performed at 2am, it may be unauthorized hidden transmission, and if the single transmission volume suddenly increases to 500MB, it may be batch data leakage. Through the comparison between real-time features and historical baseline, the deviation of subjective judgment is avoided, and the individualized interaction rules of different task nodes are adapted to realize the determination of risk data interaction behaviors, and further, the determination of the risk data interaction behavior according to the actual data interaction behavior of the risk task node is realized, improving the efficiency and reliability of the intelligent process configuration engine system in the globalized business scenario.

[0081] Specifically, the node analysis module is used to determine a transmission characteristic parameter, wherein,

[0082] The node analysis module obtains the data transmission volume and the risk data interaction behavior of the same risk task node at a plurality of monitoring time points within a preset monitoring period, and determines the transmission characteristic parameter by the ratio of the risk interaction data transmission volume to the total node data transmission volume;

[0083] The risk interaction data transmission volume is the number of interaction data transmission volumes in the risk data interaction behavior.

[0084] The total node data transmission volume is the data transmission volume of the risk task node at each monitoring time point.

[0085] Specifically, the embodiment of the present application determines the transmission characteristic parameter according to the data transmission amount and risk data interaction behavior of the same risk task node at several monitoring moments within a preset monitoring period, and fits the risk fluctuation curve based on the transmission characteristic parameter of the risk task node. It can be understood that the risk evaluation standard of different scale nodes is unified through the ratio form of the risk interaction data transmission amount to the total node data transmission amount, rather than the absolute transmission amount. For example, 100MB of risk transmission amount accounts for 50% of the total transmission amount of 200MB of the node, and 5% of the total transmission amount of 2000MB of the node, avoiding risk misjudgment caused by different node business volumes. The ratio directly reflects the proportion weight of the risk data interaction behavior in the total transmission of the node. The higher the proportion, the more serious the risk data interaction behavior penetrates into normal business. Traditional threshold detection only focuses on instantaneous data, while the fluctuation curve can identify the trend of risk changes in advance by analyzing the change trend of the transmission characteristic parameter. For example, the attacker expands the data stealing scale in stages, and the transmission amount does not exceed the threshold each time, but the trough gradually rises from 10% to 30%. The fluctuation curve can be identified, and then the actual data interaction fluctuation of the risk task node is obtained, improving the efficiency and reliability of the intelligent process configuration engine system in the global business scenario.

[0086] Specifically, it can be understood that the ratio of the risk interaction data transmission amount to the total node data transmission amount is determined as the transmission characteristic parameter, and the absolute amount interference is eliminated by the relative proportion to obtain the proportion and influence degree of risk in the overall transmission behavior of the node. The absolute amount, such as the risk interaction data transmission amount, is greatly affected by the node business scale. For example, a task node with a total node data transmission amount of 100GB, even if the risk interaction data transmission amount reaches 10GB, may only account for 10% of the total transmission amount, and the actual impact is limited. However, for a task node with a total node data transmission amount of 10GB, if the risk interaction data transmission amount reaches 5GB, the proportion is as high as 50%, and the actual impact is more significant. If only the absolute amount is used for evaluation, it may cause misjudgment. However, the relative proportion avoids such interference and reflects the weight of the risk interaction data transmission amount in the overall node data transmission amount of the task node. The higher the ratio, the greater the proportion of the transmission behavior of the task node occupied by the risk data interaction, and the higher the possibility of deviating from the normal business track. The discrete risk events are converted into continuous risk fluctuation trend through the risk fluctuation curve to capture the risk gain of the attacker, and then the actual data interaction fluctuation of the risk task node is obtained, improving the efficiency and reliability of the intelligent process configuration engine system in the global business scenario.

[0087] Specifically, the node process regulation module is used to determine the risk tendency coefficient, wherein,

[0088] The node flow regulation module obtains transmission characteristic parameters at each trough on the risk fluctuation curve in the horizontal coordinate direction, and determines the ratio of the difference between the transmission characteristic parameter of the latter trough in adjacent troughs and the transmission characteristic parameter of the former trough in the adjacent troughs to the time interval of the adjacent troughs as the risk tendency coefficient;

[0089] The risk fluctuation curve establishes a rectangular coordinate system with time as the horizontal axis and the value of the transmission characteristic parameter as the vertical axis, and is fitted according to a plurality of risk fluctuation points, wherein the risk fluctuation points are determined according to the transmission characteristic parameter and the time corresponding to the transmission characteristic parameter.

[0090] Specifically, the risk fluctuation curve can be fitted by a polynomial to the risk fluctuation points, the data is fitted by a polynomial function, and the coefficients are solved by the least square method to fit the risk fluctuation curve, which will not be repeated here.

[0091] Please refer to Figure 4 The logic flow chart of the flow interception mode of the node flow regulation module of the embodiment of the application is shown, which is used to select the flow interception mode of the risk task node, wherein,

[0092] If the risk tendency coefficient of the risk task node meets all the interception conditions, the node flow regulation module selects the flow interception mode as all interception of the flow data of the risk task node;

[0093] Specifically, the embodiment of the present application selects the flow interception mode of the risk task node that meets all the interception conditions by the node flow regulation module, that is, all the flow data of the risk task node is intercepted. It can be understood that the risk tendency coefficient is a quantification of the risk accumulation state, which can represent the deterioration acceleration of the transmission characteristic parameter. The larger the risk tendency coefficient, the faster the risk deterioration rate, and the higher the risk out of control possibility. If not all intercepted, the risk will spread rapidly, and the risk behavior is more persistent, not an occasional fluctuation such as normal business peak, but a systematic anomaly such as malicious program continuous operation, which needs to be immediately cut off to prevent the risk from spreading to other nodes. The trough is less affected by accidental factors in the risk fluctuation curve, and the rising trough, that is, the risk tendency coefficient exceeds the risk tendency coefficient threshold, represents that the risk is gradually increasing. All interception can directly block the transmission to other task nodes, avoiding the risk from spreading from a single task node to the associated business link. Partial interception cannot cover all risk carriers, and all interception can terminate transmission before the risk spreads on a large scale, reducing the cost of subsequent traceability, data repair, and loss accountability. After all interception, the system can suspend the business interaction of the node, concentrate resources on deep analysis of its historical data, interaction link, and risk characteristics, avoid investigation while the risk continues to spread, and further, adaptively adjust the interception mode of the flow data according to the actual data interaction fluctuation of the risk task node, improve the efficiency and reliability of the intelligent flow configuration engine system in the global business scenario.

[0094] If the risk tendency coefficient of the risk task node does not meet all the interception conditions, the node flow regulation module selects the flow interception mode as partial interception of the flow data of the risk task node.

[0095] Specifically, the embodiment of the present application selects the interception mode of the process of the risk task node that does not meet all the interception conditions as partial interception of the process data of the risk task node through the node process regulation module. It can be understood that the risk task node that does not meet all the interception conditions represents that the transmission data of the node in most time periods is still normal business data, and the partial interception is only for the feature time period in the risk set. The overall business interruption caused by the full interception can be avoided. The risk tendency coefficient is not more than the risk tendency coefficient threshold, that is, the risk does not form a step-by-step solidification trend. At this time, the risk data interaction behavior is more likely to be short-term, occasional, and local. According to the feature risk characteristic value, that is, the difference between the maximum value and the minimum value of the transmission characteristic parameter, the feature time period is determined. The period in which the risk interaction data and normal data are mixed and fluctuate sharply is filtered out, such as short-time exploratory attack of attackers, abnormal data burst transmission. The partial interception focuses on such time periods, which can intercept high-risk data and avoid interception of normal data in stable periods, reducing system resource consumption caused by invalid interception. The larger the feature risk characteristic value in the time period, that is, the larger the difference between the maximum value and the minimum value of the transmission characteristic parameter, the more significant the instability and abnormality of the risk data interaction behavior in the time period. By locking the time period with the most obvious risk characteristics, the potential risk data is intercepted to avoid abnormal interaction diffusion. Further, the interception mode of the process data is adaptively adjusted according to the actual data interaction fluctuation of the risk task node, and the efficiency and reliability of the intelligent process configuration engine system in the global business scenario are improved.

[0096] The full interception condition is that the risk tendency coefficient exceeds the preset risk tendency coefficient threshold.

[0097] Specifically, the preset risk tendency coefficient threshold is the product of the risk tendency coefficient reference value and the risk tendency factor. The risk tendency coefficient reference value is the average value of the risk tendency coefficient of the risk task node in the historical data. The risk tendency factor can be set by a person skilled in the art according to the accuracy requirement of the intelligent process configuration engine system. The higher the accuracy requirement, the smaller the risk tendency factor. The value range of the risk tendency factor can be [1.12, 1.2], and preferably, the risk tendency factor can be 1.15.

[0098] Specifically, the node flow regulation module determines a risk tendency coefficient according to the risk fluctuation curve to select a flow interception manner of the risk task node. It can be understood that the risk tendency coefficient focuses on the trough change of the risk fluctuation curve instead of single-point data, obtains a dynamic change trend, advances the interception opportunity to the trend formation stage, sets different interception strategies to balance safety and business continuity, and when the business scene changes, the risk tendency coefficient filters short-term interference through multi-cycle trough comparison, adapts to the dynamic nature of globalized business, and selects the interception manner through the risk tendency coefficient of the risk fluctuation curve, thereby realizing dynamic hierarchical prevention and control of the risk task node, avoiding excessive interception affecting business, and preventing insufficient interception leading to risk spread. Furthermore, the interception manner of the flow data is adaptively adjusted according to the actual data interaction fluctuation of the risk task node, thereby improving the efficiency and reliability of the intelligent flow configuration engine system in the globalized business scene.

[0099] Specifically, the node flow regulation module is configured to determine the flow data for partial interception.

[0100] The node flow regulation module is configured to divide the risk fluctuation curve into a plurality of time periods and intercept the flow data of the risk task node in a feature time period.

[0101] Specifically, the duration of the time period divided by the risk fluctuation curve is the product of the total duration of the risk fluctuation curve and a time period division factor. The time period division factor can be set by a person skilled in the art according to the accuracy requirement of the intelligent flow configuration engine system. The higher the accuracy requirement, the smaller the time period division factor. The time period division factor can be [0.05, 0.15], and preferably, the time period division factor can be 0.1.

[0102] Specifically, the node flow regulation module is configured to determine a feature time period.

[0103] The node flow regulation module screens the time period as a feature time period based on the determination result that the feature risk representation value of the time period meets the feature time period screening condition.

[0104] If the feature risk representation value of the time period does not meet the feature time period screening condition, the node flow regulation module does not screen the time period.

[0105] The feature time period screening condition is that the feature risk representation value exceeds a preset feature risk representation value threshold. The feature risk representation value is the difference between the maximum value and the minimum value of the transmission representation parameter in the time period.

[0106] Specifically, the preset feature risk representation value threshold is a product of a feature risk representation value reference value and a feature risk factor, the feature risk representation value reference value is an average value of feature risk representation values of risk task nodes in historical data, the feature risk factor can be set by a person skilled in the art according to an accuracy requirement of the intelligent flow configuration engine system, the higher the accuracy requirement is, the smaller the feature risk factor is set, and the feature risk factor can be in a range of [1.15, 1.25], preferably, the feature risk factor can be 1.2.

[0107] So far, the technical solutions of the present application have been described in combination with the preferred embodiments shown in the drawings, but it is easy for those skilled in the art to understand that the protection scope of the present application is obviously not limited to these specific embodiments. Those skilled in the art can make equivalent changes or replacements to the related technical features without departing from the principles of the present application, and the technical solutions after the changes or replacements will fall within the protection scope of the present application.

[0108] The above description is only the preferred embodiments of the present application and is not intended to limit the present application; for those skilled in the art, the present application can have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application.

Claims

1. An intelligent process configuration engine system supporting global business operations, characterized in that, include: The data acquisition module is used to acquire the regional information, data transmission volume, and interaction feature data of each task node. The interaction feature data includes the interaction domain name, the interaction time period corresponding to the interaction domain name, and the interaction data transmission volume. A node filtering module, which is connected to the data acquisition module, is used to determine cross-regional interaction parameters based on the data transmission between task nodes in different regions within a preset monitoring period, and to filter risky task nodes based on the cross-regional interaction parameters of the task nodes. The node analysis module is connected to the data acquisition module and the node filtering module respectively. It is used to determine the risk data interaction behavior based on the real-time interaction feature data of the data interaction behavior between the risk task node and other task nodes, and to determine the transmission characterization parameters based on the data transmission volume and risk data interaction behavior of the risk task node. The node process control module, which is connected to the node analysis module, is used to fit the risk fluctuation curve based on the transmission characterization parameters of the risk task node, and select the process interception method according to the risk tendency coefficient of the risk task node, either to partially intercept the process data of the risk task node or to completely intercept the process data of the risk task node.

2. The intelligent process configuration engine system supporting global business as described in claim 1, characterized in that, The node filtering module is used to determine cross-regional interaction parameters, wherein... The node filtering module determines the number of times that any task node exchanges data with a task node in a different region within a preset monitoring period as the cross-regional interaction parameter of the task node.

3. The intelligent process configuration engine system supporting global business as described in claim 2, characterized in that, The node filtering module is used to filter risky task nodes, wherein... The node filtering module filters the task node as a risk task node based on the judgment result that the cross-regional interaction parameters of the task node meet the risk task node filtering conditions. The screening criterion for risk task nodes is that the cross-regional interaction parameters exceed a preset cross-regional interaction parameter threshold.

4. The intelligent process configuration engine system supporting global business as described in claim 3, characterized in that, The node analysis module is used to determine risk data interaction behavior, wherein... If the comparison between the real-time interaction feature data and the historical interaction feature data of the data interaction behavior of the risk task node by the node analysis module meets the conditions for risk data interaction behavior, then the data interaction behavior is determined to be risk data interaction behavior.

5. The intelligent process configuration engine system supporting global business as described in claim 4, characterized in that, The risk data interaction behavior conditions are that the real-time interaction domain name does not conform to any of the historical interaction domain names, or the real-time interaction time period corresponding to the real-time interaction domain name is inconsistent with the historical interaction time period of the real-time interaction domain name in the historical interaction feature data, or the interaction data transmission volume exceeds the preset interaction data transmission volume threshold.

6. The intelligent process configuration engine system supporting global business as described in claim 5, characterized in that, The node analysis module is used to determine transmission characterization parameters, wherein, The node analysis module obtains the data transmission volume and risk data interaction behavior of the same risk task node at several monitoring times within a preset monitoring period, and determines the transmission characterization parameter by the ratio of the risk interaction data transmission volume to the total data transmission volume of the node. The risk interaction data transmission volume is the sum of the number of interaction data transmission volumes in the risk data interaction behavior; The total data transmission volume of the node is the data transmission volume of the risk task node at each monitoring time.

7. The intelligent process configuration engine system supporting global business as described in claim 6, characterized in that, The node process control module is used to determine the risk propensity coefficient, wherein... The node process control module acquires the transmission characterization parameters at each trough on the risk fluctuation curve along the horizontal axis, and determines the risk tendency coefficient by the ratio of the difference between the transmission characterization parameter of the next trough in the adjacent trough and the transmission characterization parameter of the previous trough in the adjacent trough to the time interval between the adjacent troughs. The risk fluctuation curve establishes a rectangular coordinate system with time as the horizontal axis and the magnitude of the transmission characterization parameter as the vertical axis. It is fitted based on several risk fluctuation points, which are determined according to the transmission characterization parameter and the time corresponding to the transmission characterization parameter.

8. The intelligent process configuration engine system supporting global business as described in claim 7, characterized in that, The node process control module is used to select the process interception method for the risk task node, wherein... If the risk tendency coefficient of the risk task node meets the full interception condition, then the node process control module selects the process interception method as to fully intercept the process data of the risk task node. If the risk tendency coefficient of the risk task node does not meet the full interception condition, the node process control module selects the process interception method as partially intercepting the process data of the risk task node. The condition for complete interception is that the risk propensity coefficient exceeds a preset risk propensity coefficient threshold.

9. The intelligent process configuration engine system supporting global business as described in claim 8, characterized in that, The node process control module is used to determine the process data to be partially retained, wherein, The node process control module is used to divide the risk fluctuation curve into several time periods and to retain the process data of the risk task node within the characteristic time period.

10. The intelligent process configuration engine system supporting global business as described in claim 9, characterized in that, The node process control module is used to determine characteristic time periods, wherein... The node process control module selects the time period as a characteristic time period based on the judgment result that the characteristic risk characterization value of the time period meets the characteristic time period screening conditions. The characteristic time period filtering condition is that the characteristic risk characterization value exceeds the preset characteristic risk characterization value threshold, and the characteristic risk characterization value is the difference between the maximum value and the minimum value of the transmission characterization parameter within the time period.

Images