Service security verification method and device, equipment and storage medium

Abstract

The invention provides a service security verification method and device, equipment and a storage medium, and relates to the technical field of security verification. According to the specific technical scheme, service attribute information of a target service is acquired; inputting the service attribute information into a credibility index selection model, and determining at least one to-be-evaluated credibility index corresponding to the target service and a credibility evaluation rule; determining an index analysis model corresponding to each credibility index to be evaluated; based on the index analysis model corresponding to each to-be-evaluated credibility index and the corresponding to-be-analyzed data, determining the index value of each to-be-evaluated credibility index; and in response to the obtained security verification task of the target service, aggregating the index value of each to-be-evaluated credibility index based on the credibility evaluation rule of the target service to obtain a verification result of the security verification task. The method is used for improving the response speed of service security verification.

Description

Technical Field

[0001] This application relates to the field of security verification technology, and in particular to a business security verification method, apparatus, device, and storage medium. Background Technology

[0002] Business security verification refers to the process of assessing the security of a business operation. This security assessment can quantify the probability of successful implementation or the expected benefits of the business, providing a crucial basis for decision-making.

[0003] Currently, the calculation method for business security verification is generally based on a chain structure. That is, in the calculation process of the corresponding security verification, multiple verification steps are usually executed in a fixed order. The processing result of the previous step is used as the input condition of the next step, and so on until the final result is obtained.

[0004] However, as business complexity continues to grow, this chain-based security verification computation method struggles to meet the demands for rapid response across large scales and multiple dimensions. Summary of the Invention

[0005] This application provides a business security verification method, apparatus, device, and storage medium. By moving the data acquisition and data processing processes in the security verification process to before the security verification, the length of the real-time security verification link and the computational pressure can be reduced, thereby improving the real-time response speed of the business security verification process.

[0006] To achieve the above objectives, the embodiments of this application adopt the following technical solutions:

[0007] Firstly, a business security verification method is provided, which includes:

[0008] First, the business attribute information of the target business is obtained, including: business type, business duration, business-related entity identifier, and business-related resource identifier. Second, the business attribute information is input into the credibility indicator selection model to determine at least one credibility indicator to be evaluated and a credibility evaluation rule for the target business. Each credibility indicator is used to quantify the credibility status of the target business in one dimension, while the credibility evaluation rule indicates the aggregation rule for the at least one credibility indicator to be evaluated for the target business. Then, the corresponding indicator analysis model for each credibility indicator to be evaluated is determined. One credibility indicator corresponds to one indicator analysis model, which is constructed based on the calculation rule of the corresponding credibility indicator. Next, based on the indicator analysis model corresponding to each credibility indicator to be evaluated and its corresponding data to be analyzed, the indicator value for each credibility indicator to be evaluated is determined. The data to be analyzed is obtained by collecting data from the target business's data source through a data acquisition model. Finally, in response to the acquisition of a security verification task for the target business, the indicator values ​​of each credibility indicator to be evaluated are aggregated based on the credibility evaluation rule of the target business to obtain the verification result of the security verification task.

[0009] This application provides a business security verification method. First, a credibility index selection model is used to identify business characteristics in the target business attribute information, achieving personalized matching between business characteristics and security verification logic. Furthermore, the credibility index to be evaluated refers to the credibility status of the target business in different dimensions. By determining the credibility index to be evaluated, the security verification process of the target business can be decoupled into multiple independent steps. Simultaneously, through the index analysis model corresponding to each credibility index to be evaluated and the data to be analyzed in the target business, the index values ​​of each index can be predetermined, allowing complex calculations that would otherwise need to be completed at request to be pre-executed. Finally, when the security verification task of the target business is received, this application can determine the security verification result of the target business based solely on the index values ​​determined by the index analysis model and the index aggregation rules. Compared with related chain-based security verification methods, this application, through the index selection model, can dynamically adapt business characteristics to the security verification logic (indicators). Through the index analysis model and data acquisition model, some calculation tasks of security verification can be pre-executed, thereby shortening the response time of business security verification while ensuring the accuracy of business security verification.

[0010] In one possible implementation of the first aspect, the credibility metric selection model is a decision tree model. The credibility metric selection model includes branch nodes and leaf nodes. Branch nodes are used to determine the next node in the credibility metric selection model based on business attribute information. Leaf nodes include at least one credibility metric to be evaluated and at least one credibility evaluation rule for the credibility metric to be evaluated.

[0011] It should be understood that using a decision tree model as the credibility index selection model, with its branch nodes and leaf nodes, makes the business evaluation logic clearly visible. This structured decision path not only improves the transparency and interpretability of index selection, but also makes model maintenance and updates more intuitive and efficient.

[0012] In another possible implementation of the first aspect, business attribute information is input into a credibility index selection model to determine the credibility index to be evaluated and the credibility evaluation rule corresponding to the target business. This includes: feature encoding the business attribute information of the target business to obtain a feature vector of the target business; inputting the feature vector into a decision tree model; selecting nodes for the feature vector through each branch node in the credibility index selection model to determine the target leaf node corresponding to the feature vector; and using the credibility index to be evaluated and the credibility evaluation rule in the target leaf node as the credibility index to be evaluated and the credibility evaluation rule corresponding to the target business.

[0013] It should be understood that this scheme transforms business attributes into inputs that the model can understand through feature encoding. It can then match business attributes with evaluation dimensions based on the numerical distribution characteristics of the feature vectors, thereby improving the efficiency of indicator selection in decision trees.

[0014] In another possible implementation of the first aspect, the data acquisition model includes multiple models, each obtained through the following steps: First, obtaining the calculation rules for the credibility indicators to be evaluated corresponding to different businesses. Second, extracting multiple basic calculation parameters from the calculation rules for the credibility indicators to be evaluated corresponding to different businesses. Third, dividing the multiple basic calculation parameters into different parameter groups based on preset parameter partitioning rules. Fourth, determining the data acquisition rules for each parameter group based on the data type of each basic calculation parameter in each parameter group. The data acquisition rules include: the frequency of data acquisition and the data preprocessing method. Fifth, constructing the data acquisition model corresponding to each parameter group based on the data acquisition rules for each parameter group.

[0015] It should be understood that by analyzing the calculation rules of different business indicators, extracting common basic parameters, and determining different parameter groups according to parameter partitioning rules, parameters with similar characteristics can be centrally managed. This allows the data collection model corresponding to each parameter group to provide data for the credibility indicators to be evaluated in different businesses, improving the reusability of basic calculation parameters. Based on this, the data collection frequency and preprocessing methods determined according to the parameter data type can optimize the efficiency of data resource collection, providing reliable data support for credibility assessment.

[0016] In another possible implementation of the first aspect, the parameter partitioning rules include: grouping basic computational parameters with the same data source into the same parameter group; and / or grouping basic computational parameters with the same update frequency into the same parameter group.

[0017] It should be understood that grouping parameters with the same data source or the same update frequency into the same group can simplify the data acquisition process. This grouping makes it possible to develop unified and more targeted acquisition strategies for different parameter groups, which helps improve the overall efficiency of data processing.

[0018] In another possible implementation of the first aspect, for any first credibility index to be evaluated among each credibility index to be evaluated, the index value of the first credibility index to be evaluated is determined based on the index analysis model corresponding to each credibility index to be evaluated and the corresponding data to be analyzed. This includes: determining at least one first basic calculation parameter of the calculation rule corresponding to the first credibility index to be evaluated and the first index analysis model corresponding to the first credibility index to be evaluated; determining the first data acquisition model corresponding to each first basic calculation parameter based on the parameter group to which each first basic calculation parameter belongs; obtaining the value of each first basic calculation parameter from the first data acquisition model corresponding to each first basic calculation parameter based on data synchronization rules, wherein the data synchronization rules include: full update or incremental update; the value of each first basic calculation parameter is the data to be analyzed in the first index analysis model; and inputting the value of each first basic calculation parameter into the first index analysis model to obtain the index value of the first credibility index to be evaluated.

[0019] It should be understood that this scheme utilizes the correspondence between "credibility index to be evaluated - credibility evaluation rules - basic calculation parameters - parameter group - data acquisition model" to obtain the data to be analyzed from one or more data acquisition models corresponding to each credibility index to be evaluated, and calculates the data to be analyzed based on the calculation rules of each credibility index to obtain the index value of each credibility index to be evaluated, thereby achieving coordinated and automated processing of data acquisition and index calculation.

[0020] Secondly, a business security verification device is provided, the device comprising:

[0021] The acquisition module is used to obtain the business attribute information of the target business. The business attribute information includes: business type, business duration, business associated entity identifier, and business associated resource identifier.

[0022] The processing module inputs business attribute information into the credibility index selection model to determine at least one credibility index to be evaluated and credibility evaluation rules corresponding to the target business. Each credibility index to be evaluated is used to quantify the credibility status of the target business in one dimension. The credibility evaluation rules are used to indicate the aggregation rules of at least one credibility index to be evaluated corresponding to the target business. The module determines the corresponding index analysis model for each credibility index to be evaluated. One credibility index to be evaluated corresponds to one index analysis model. The index analysis model is constructed based on the calculation rules of the corresponding credibility index to be evaluated. Based on the index analysis model corresponding to each credibility index to be evaluated and its corresponding data to be analyzed, the index value of each credibility index to be evaluated is determined. The data to be analyzed is obtained by collecting data from the data source of the target business through the data acquisition model. In response to obtaining the security verification task of the target business, the index values ​​of each credibility index to be evaluated are aggregated based on the credibility evaluation rules of the target business to obtain the verification result of the security verification task.

[0023] Thirdly, a business security verification device is provided, the method comprising: a memory and at least one processor. The memory is communicatively connected to the processor. The memory is used to store computer program code, which includes computer instructions. When the processor executes the computer instructions, it causes the electronic device to perform the method as described in the first aspect and any possible implementation thereof.

[0024] Fourthly, embodiments of this application provide a computer-readable storage medium storing computer instructions. When executed by a processor, these computer instructions are used to implement the method described in the first aspect and any possible implementation thereof.

[0025] Fifthly, embodiments of this application provide a computer program product that, when run on a computer or executed by a computer's processor, implements the method described in the first aspect and any possible design thereof. The computer may be the electronic device described in the second aspect and any possible implementation thereof.

[0026] It is understood that the beneficial effects that the business security verification device described in the second aspect, the business security verification equipment described in the third aspect, the computer-readable storage medium described in the fourth aspect, and the computer program product described in the fifth aspect can achieve can be referred to the beneficial effects in the first aspect and any possible implementation thereof, and will not be repeated here. Attached Figure Description

[0027] Figure 1 This application provides a schematic diagram of the application scenario architecture for a business security verification method.

[0028] Figure 2 A flowchart illustrating a business security verification method provided in an embodiment of this application;

[0029] Figure 3 A flowchart illustrating a data acquisition model construction method provided in an embodiment of this application;

[0030] Figure 4 A flowchart illustrating another business security verification method provided in this application embodiment;

[0031] Figure 5 A flowchart illustrating a data synchronization method between a data acquisition model and an indicator analysis model, provided in an embodiment of this application;

[0032] Figure 6 A flowchart illustrating another business security verification method provided in this application embodiment;

[0033] Figure 7 This is a schematic diagram of the structure of a business security verification device provided in an embodiment of this application;

[0034] Figure 8 This is a schematic diagram of the structure of a business security verification device provided in an embodiment of this application. Detailed Implementation

[0035] Hereinafter, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this embodiment, unless otherwise stated, "a plurality of" means two or more.

[0036] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0037] The technical solutions provided in this application, including the collection, storage, use, processing, transmission, provision, and disclosure of financial data or user data, comply with relevant laws and regulations and do not violate public order and good morals.

[0038] It should be noted that in the embodiments of this application, certain software, components, models and other existing solutions in the industry may be mentioned. These should be regarded as exemplary and are only intended to illustrate the feasibility of implementing the technical solution of this application. However, it does not mean that the applicant has used or necessarily used the solution.

[0039] The relevant business security verification method involves temporarily collecting raw security verification data upon receiving a business security verification request or instruction, and then obtaining the business security verification result after a series of data processing and calculations.

[0040] However, when faced with a large number of business security verification tasks or complex business logic with diverse data dimensions, this method requires starting multiple parallel data acquisition processes and repeatedly performing data cleaning, transformation and other data preprocessing operations, which consumes too many computing resources and thus prolongs the response time of security verification.

[0041] Therefore, improving the response speed of business security verification has become an urgent technical problem to be solved.

[0042] In view of this, this application provides a business security verification method, which decomposes the security verification process into multiple independent steps and pre-calculates the data collection and data calculation of each independent step, thereby reducing the workload of the actual calculation stage and improving the response speed of business security verification.

[0043] First, the application scenarios of the embodiments of this application will be introduced.

[0044] The business security verification method provided in this application can be applied to computing devices. Specifically, the computing device can be a single server or a server cluster composed of multiple servers, or a computer, or a processor or processing chip in a server or computer, etc. This application does not limit the specific device form of the computing device.

[0045] like Figure 1The diagram shown illustrates an application scenario architecture for a business security verification method provided in this application embodiment, specifically including the following:

[0046] Data source 100 specifically includes data sources from different business operations, which are the raw data for security verification.

[0047] In some embodiments, the data sources for different services include business data carriers with data storage and output capabilities, such as business databases, message queues, and log files.

[0048] The data acquisition layer 110 includes multiple data acquisition models. Each data acquisition model performs data acquisition and preprocessing on the data source to obtain the data to be analyzed, and then provides the data to be analyzed to the data application layer.

[0049] like Figure 1 As shown, the data acquisition layer 110 may include: a basic information data acquisition model, an event information data acquisition model, and a resource information data acquisition model. It is understood that... Figure 1 The data acquisition model in the middle data acquisition layer 110 is for illustrative purposes only, and the embodiments of this application do not limit the types and number of data acquisition models.

[0050] The data application layer 120 includes multiple indicator analysis models. Each indicator analysis model receives the data to be analyzed from the data acquisition layer 110 and executes the calculation logic of the corresponding credibility indicator to be evaluated in order to pre-calculate the indicator value of the corresponding credibility indicator to be evaluated.

[0051] like Figure 1 The indicator analysis models shown are 121, 122, 123, and 124. It is understandable that... Figure 1 The indicator analysis models in the data application layer 120 are for illustrative purposes only, and this application embodiment does not limit the types and number of indicator analysis models.

[0052] The security verification application layer 130 includes response modules for two types of security verification tasks: security verification data display 131 and security verification 132.

[0053] like Figure 1 As shown, for a business security verification task sent by a requester 140, the security verification application layer 130 starts security verification data display 131 and security verification 132 respectively.

[0054] The security verification data display 131 obtains indicator value 121 from indicator analysis model 121 and indicator value 124 from indicator analysis model 124. After data encapsulation, indicator value 121 and indicator value 124 can be directly used as the return data of the security verification task.

[0055] Security verification 132 obtains indicator value 122 from indicator analysis model 122 and indicator value 123 from indicator analysis model 123. The indicator value 122 and indicator value 123 are processed by the corresponding credibility evaluation rules to obtain the verification result of the business security verification task.

[0056] After the security verification data display 131 and security verification 132 are completed, a verification completion message is returned to the requester 140. The verification completion message includes: the over-encapsulated data of indicator values ​​121 and 124, and the security verification results calculated from indicator values ​​122 and 123.

[0057] Among them, the requester 140 can be an associated entity of the business, such as the business provider or the business participant.

[0058] In some embodiments, the security verification application layer 130 can be understood as a processing window for external devices, used to receive security verification requests from the requesting terminal.

[0059] In some embodiments, the business security verification task may also include data display and monitoring functions. That is, the credibility indicators to be evaluated for each business can not only be used for subsequent actual security verification, but also directly serve as the data source for visual charts, reports or monitoring dashboards, providing intuitive reference for operational decisions.

[0060] like Figure 2 As shown, when the business security verification method of this application is applied to the above-mentioned computing device, it specifically includes the following:

[0061] S101. Obtain the business attribute information of the target business.

[0062] The business attribute information includes: business type, business duration, business-related entity identifier, and business-related resource identifier.

[0063] Business attribute information is the basic context of the target business in the computing device. Through business attribute information, the multi-dimensional characteristics of the target business can be obtained, providing the necessary input parameters and evaluation basis for security verification.

[0064] Business type can reflect the service or function classification of the target business, and can be used to directly distinguish the security verification requirements of different businesses.

[0065] Business duration refers to the time span from the start to the end of a business, reflecting the stability and maturity of the target business. In some embodiments, a longer business duration generally indicates a more stable business (i.e., higher security). A shorter duration indicates a less stable business.

[0066] Business-related entity identifiers refer to the identification identifiers of participating entities in the target business. Through these identifiers, the historical behavioral background of the participating entities can be obtained to determine the security requirements of the target business based on entity trustworthiness.

[0067] Business-related resource identifiers refer to the identification identifiers of resources involved in a business, used to associate specific operational objects of the target business. By identifying the resources involved in the target business, the security requirements of the target business based on resource sensitivity can be determined.

[0068] For example, in the financial sector, business types can include: trading and investment, loan applications or fund transfers, etc. Business duration refers to the length of time since the account was opened, business-related entities refer to the user identifiers of the two parties in the transaction, and business-related resource identifiers can be bank account numbers or transaction serial numbers.

[0069] For example, in the field of cloud computing, business types can include user login, user registration, or data query, business duration refers to the runtime of the cloud service instance, business associated entity refers to tenant ID or user account, and business associated resource identifier can be virtual machine ID or storage bucket name.

[0070] This application does not limit the specific application areas of business security verification.

[0071] In some embodiments, the business attribute information of a service may be pre-configured manually and imported into the computing device as a static configuration file.

[0072] S102. Input the business attribute information into the credibility index selection model to determine at least one credibility index to be evaluated and credibility evaluation rules corresponding to the target business.

[0073] Each credibility metric to be evaluated is used to quantify the credibility status of the target business in one dimension. The credibility evaluation rule is used to indicate the aggregation rule for the credibility metrics to be evaluated.

[0074] The credibility index selection model is used to determine the security verification requirements of a target business based on business type, business duration, and related identifiers across different dimensions in the business attribute information. Based on these requirements, the model can decouple the security verification process of the target business into multiple independent computational steps, leveraging the correlation between the learned business features and security verification. Each independent computational step can be understood as the credibility status of the target business in different dimensions, which is then quantified using the credibility index to be evaluated. Furthermore, this decoupling process clarifies the decomposition logic between the various independent computational steps. Reverse reconstruction and rule-based definition of this decomposition logic constitutes the aggregation logic of the multiple independent computational steps.

[0075] In some embodiments, the credibility index selection model can be a decision tree model, which is trained by supervised learning on historical business data (including business attribute information) and its corresponding set of credibility indices to be evaluated and aggregation rules. During the training process, branch nodes with business attribute features as judgment conditions and leaf nodes containing credibility indices to be evaluated and aggregation rules are automatically generated.

[0076] The branch node is used to determine the next node of the credibility index selection model based on the business attribute information. The decision path is dynamically divided by quantitatively comparing key features in the business attributes (such as comparing whether the business type belongs to a high-risk category or whether the frequency of related resource calls exceeds the threshold).

[0077] The leaf node includes at least one of the credibility indicators to be evaluated and the credibility evaluation rules of the at least one credibility indicator to be evaluated. It is the final output unit of the model inference, and the combination of indicators and rules contained therein directly corresponds to the security verification dimensions and calculation logic in a specific business scenario.

[0078] It should be understood that through the feature identification and path guidance functions of branch nodes, and the result storage and output functions of leaf nodes, the decision tree model constructs a complete decision-making chain of "business attribute analysis → verification of scheme matching". It not only realizes the automatic optimization of decision logic through the training process, but also maintains the traceability from input to output.

[0079] For details, please refer to the following text. Figure 6 This will not be elaborated upon here.

[0080] S103. Determine the corresponding indicator analysis model for each credibility indicator to be evaluated.

[0081] Each credibility indicator to be evaluated corresponds to an indicator analysis model. The indicator analysis model is constructed based on the calculation rules of the corresponding credibility indicator to be evaluated.

[0082] An indicator analysis model refers to an algorithm module or program unit used to execute the calculation logic of a specific credibility indicator to be evaluated. It can output specific indicator values ​​based on the data to be analyzed and according to preset calculation rules. It is the core execution carrier for transforming business data into quantitative evaluation basis.

[0083] The indicator analysis model is constructed based on the calculation rules of the corresponding credibility indicator to be evaluated. This means that for each credibility indicator to be evaluated (such as "user historical fraud rate" or "interface abnormal call frequency"), its explicit calculation logic is first defined (such as "fraud count / total transaction count" or "abnormal call count / total call count"), and then the logic is encoded into an executable program module to form the indicator analysis model.

[0084] In some embodiments, the calculation rules for the credibility index to be evaluated can be standardized formulas or logical rules derived from the experience of business experts and predefined through manual configuration.

[0085] In other embodiments, the calculation rule for the credibility index to be evaluated may also be: obtained by the index selection model automatically learning and optimizing during the training process through feature importance analysis or association rule mining of historical evaluation data.

[0086] One possible implementation involves determining the corresponding indicator analysis model for each credibility indicator to be evaluated as follows: The computing device has a pre-set mapping table of indicator identification identifiers and indicator analysis models, which stores the association between the unique identifier of each indicator and its corresponding indicator analysis model. Once the credibility indicators to be evaluated for the target business are obtained, the corresponding indicator analysis model can be matched by traversing the indicator identification identifiers in the mapping list.

[0087] One possible implementation involves constructing an analysis model for a credibility index to be evaluated, as follows: First, parse the calculation rules of the credibility index to be evaluated, clarifying the input data fields (i.e., the basic calculation parameters of the credibility index calculation rules), the calculation logic, and the output format (retaining 4 decimal places). Second, select a suitable programming framework (to implement the calculation logic) based on the data source and computational complexity. Then, add a data cleaning submodule (such as null value handling and outlier truncation) and a result validation submodule (such as numerical range validation). Finally, encapsulate the above modules into independent callable units, assign them unique identifiers, and bind them to the identification identifier of the corresponding index, storing them in a mapping table.

[0088] S104. Based on the indicator analysis model corresponding to each credibility indicator to be evaluated and the corresponding data to be analyzed, determine the indicator value of each credibility indicator to be evaluated.

[0089] The data to be analyzed is obtained by collecting data from the data sources of the target business through a data acquisition model.

[0090] Each data acquisition model is designed to collect data with the same feature dimensions.

[0091] For example, in the financial sector, one data collection model is specifically designed to collect "user identity information" (such as name, ID number, and contact information) involved in all business transactions (whether it is credit, payment, or wealth management); another data collection model is specifically designed to collect "account transaction information" (such as transaction time, transaction amount, and counterparty) for all business transactions.

[0092] This data acquisition model encapsulates the acquisition logic for data with similar characteristics, effectively improving the efficiency, quality, and consistency of data acquisition. Furthermore, it enables data with the same feature dimensions to be shared across different business scenarios, enhancing the reusability of data resources and acquisition logic.

[0093] The relationship between data acquisition models and indicator analysis models is many-to-one, meaning that an indicator analysis model often relies on data from multiple data acquisition models to calculate its corresponding indicator. For example, calculating the indicator "risk of login from a different location" requires not only login location information from the "user login log acquisition model" but also frequently used login location information from the "user historical behavior acquisition model." This decoupling design makes the indicator calculation logic clearer. When a data source changes, only the corresponding acquisition model needs to be adjusted, without altering the complex indicator calculation logic, thus enhancing the system's flexibility and maintainability.

[0094] For details on the specific construction of the data acquisition model, please refer to the following text. Figure 3 This will not be elaborated upon here.

[0095] One possible implementation involves determining the individual index value for each credibility index based on its corresponding index analysis model and the corresponding data to be analyzed. Since the calculation rules are generally unchanged, this process can be triggered by updates to the data to be analyzed. That is, when the data acquisition layer acquires new data or detects changes to existing data, the corresponding index analysis model is automatically triggered to execute the calculation logic, updating the index value in real time. This data-driven calculation method ensures the timeliness of index values ​​while avoiding meaningless repetitive calculations, thus improving system resource utilization.

[0096] S105. In response to obtaining the security verification task of the target business, the index values ​​of each credibility index to be evaluated are aggregated based on the credibility assessment rules of the target business to obtain the verification result of the security verification task.

[0097] S101-S104 can be understood as the pre-computation preparation process for the computing device to perform security verification of the business. When the computing device actually receives the security verification task of the target business, it can directly aggregate the index values ​​of each credibility index to be evaluated based on the credibility assessment rules of the target business to obtain the verification result of the security verification task.

[0098] This architecture moves time-consuming data processing and computation to the forefront, allowing the S105 to perform only efficient rule aggregation operations when it receives a real-time verification request, thereby achieving low-latency, high-throughput online decision response.

[0099] One possible implementation involves aggregating the values ​​of each credibility indicator to be evaluated based on the credibility assessment rules of the target business to obtain the verification result of the security verification task. The process is as follows: First, based on the identification identifier of the target business, determine the credibility indicators to be evaluated corresponding to the target business. Second, obtain the indicator values ​​of the credibility indicators to be evaluated from the indicator analysis models corresponding to each credibility indicator to be evaluated for the target business. Then, based on the credibility assessment rules determined in S102, aggregate and calculate the indicator values ​​of the credibility indicators to be evaluated to obtain the verification result of the security verification task.

[0100] In some embodiments, the verification result of a security verification task may be in Boolean form, security verification level form, or security verification score form.

[0101] Specifically, the Boolean value of the verification result directly reflects the security verification result of the business as either "security verification passed" or "security verification failed". The security verification level reflects the security verification result of the business as "high security", "medium security", or "low security". The security verification score quantifies the security level of the business through a specific numerical value. This score is usually a normalized value, such as a decimal between 0 and 1 (e.g., 0.85), or an integer between 0 and 100 (e.g., 85 points). The higher the score, the higher the security of the business.

[0102] This application provides a business security verification method. First, a credibility index selection model is used to identify business characteristics in the target business attribute information, achieving personalized matching between business characteristics and security verification logic. Furthermore, the credibility index to be evaluated refers to the credibility status of the target business in different dimensions. By determining the credibility index to be evaluated, the security verification process of the target business can be decoupled into multiple independent steps. Simultaneously, through the index analysis model corresponding to each credibility index to be evaluated and the data to be analyzed in the target business, the index values ​​of each index can be predetermined, allowing complex calculations that would otherwise need to be completed at request to be pre-executed. Finally, when the security verification task of the target business is received, this application can determine the security verification result of the target business based solely on the index values ​​determined by the index analysis model and the index aggregation rules. Compared with related chain-based security verification methods, this application, through the index selection model, can dynamically adapt business characteristics to the security verification logic (indicators). Through the index analysis model and data acquisition model, some calculation tasks of security verification can be pre-executed, thereby shortening the response time of business security verification while ensuring the accuracy of business security verification.

[0103] The following section introduces the specific construction method of the data acquisition model.

[0104] In some embodiments, to achieve reusability of the data acquisition model and enable the acquired data to be shared with different indicator analysis models, the computing device can deduce unified data acquisition requirements from the calculation rules of different indicator analysis models. In this case, the data acquisition model construction process is as follows: Figure 3 As shown, the specific steps include the following:

[0105] S201. Obtain the calculation rules for the credibility indicators to be evaluated for different businesses.

[0106] Different businesses refer to different types of businesses within the same field or scenario.

[0107] One possible implementation is that during initial configuration, the computing device obtains the credibility indicators to be evaluated for different services based on their business attribute information (such as service type and associated resource identifier) ​​and the indicator selection model. Based on this, the computing device can obtain the calculation rules (such as structured JSON configuration and standardized rule tables) corresponding to each indicator.

[0108] Obtain the calculation rules for different business credibility indicators to be evaluated, and standardize and converge the data requirements for business security verification from a global perspective.

[0109] S202. Extract multiple basic calculation parameters from the calculation rules of the credibility indicators to be evaluated corresponding to different businesses.

[0110] Basic calculation parameters refer to the smallest, indivisible, and necessary calculation parameters in the calculation of the credibility index to be evaluated.

[0111] Indicator calculation rules typically exist in the form of formulas or descriptions, which cannot directly guide data collection operations. Computing devices extract the smallest data units (basic calculation parameters) by breaking down the rules, thus transforming abstract indicator calculation requirements into concrete data lists.

[0112] One possible approach is that the computing device can use a combination of "rule parsing tools + manual review" to extract multiple basic calculation parameters from the calculation rules of the credibility indicators to be evaluated for different businesses.

[0113] The specific process of this implementation is as follows: A rule parsing tool identifies the data fields in the indicator calculation rule files (such as Word, TXT, JSON, etc.) for each business and marks them as candidate basic calculation parameters. Subsequently, data fields are cleaned and duplicate data is checked to obtain a set of candidate basic calculation parameters. Finally, the candidate basic calculation parameters are manually reviewed, and any missing fields are added, ultimately resulting in the basic calculation parameter set.

[0114] Another possible implementation is that the computing device can use a combination of "business data dictionary + semantic recognition" to extract multiple basic calculation parameters from the calculation rules of the credibility indicators to be evaluated corresponding to different businesses.

[0115] The specific process of this implementation is as follows: First, the computing device acquires the existing standardized business data dictionary for each business function. This dictionary defines metadata such as field names, data types, and business meanings for all business data. Then, the computing device uses natural language processing or keyword matching technology to automatically map candidate data fields parsed from the calculation rules to the standard fields in the business data dictionary. During the mapping process, the system intelligently matches fields based on their business meanings and data types, and performs consistency checks on the matching results. For example, it checks whether the data type of the field matches the operational requirements in the rules, or whether the field's value range meets the calculation logic. For fields that cannot be automatically matched or have low matching confidence, the system marks them as items requiring manual processing, which are then manually reviewed and confirmed by data experts. Finally, all successfully matched and validated fields are used as basic calculation parameters to form the final set of basic calculation parameters.

[0116] S203. Based on the preset parameter partitioning rules, multiple basic calculation parameters are divided into different parameter groups.

[0117] By grouping by features, a set of parameters corresponds to a set of suitable acquisition strategies, which improves the efficiency and accuracy of acquisition rule formulation, while reducing the complexity of subsequent model maintenance.

[0118] In some embodiments, the preset parameter partitioning rule may be: basic parameters with the same data source among the basic calculation parameters are partitioned into the same parameter group.

[0119] For example, in the field of financial payments, computing devices can group parameters such as transaction amount, payment channel, and merchant number from the payment transaction database into one group, and parameters such as available balance, frozen amount, and account opening time from the user account database into another group.

[0120] In other embodiments, the preset parameter partitioning rule may be: to partition the basic calculation parameters with the same update frequency into the same parameter group.

[0121] For example, in the e-commerce retail sector, computing devices can group parameters such as hourly updated real-time product inventory and current selling price into one group, and daily updated parameters such as total monthly user spending and quarterly repurchase rate into another group.

[0122] In other embodiments, the preset parameter partitioning rule may be: basic parameters with the same data source and the same update frequency among the basic calculation parameters are partitioned into the same parameter group.

[0123] For example, in the field of internet finance, computing devices can group parameters such as overdue status and risk rating from credit risk control databases that are updated in real time into one group, and group parameters such as historical default records and credit score trends from the same database that are updated weekly into another group.

[0124] In some embodiments, for basic computational parameters with complex data characteristics, computing devices can also use a main grouping plus dynamic labeling approach. First, the main grouping is determined based on core features, and then multi-dimensional labels are added to the parameters to reflect additional attributes. For example, in the cross-border e-commerce field, order numbers come from the order database and are used in logistics, settlement, customs declaration, and other scenarios. They can be first categorized into the main group of basic order information, and then labels such as logistics association and tax association can be added. This ensures that the core logic of the grouping is clear while meeting the data retrieval needs of multiple scenarios.

[0125] S204. Based on the data type of each basic calculation parameter in each parameter group, determine the data acquisition rules for each parameter group.

[0126] The data collection rules include the frequency of data collection and the data preprocessing method.

[0127] Data acquisition rules guide the data acquisition model in performing specific steps for data acquisition and preprocessing operations. They consist of two main modules: "data acquisition frequency" (how often data is acquired) and "data preprocessing method" (how to process the data after acquisition).

[0128] One possible implementation is that the computing device can establish a fixed mapping relationship between data type and acquisition frequency and preprocessing method, then match basic rules based on the main data types in the parameter group, and finally fine-tune it according to the business scenario to form the data acquisition rules for each parameter group.

[0129] The specific process is as follows: Establish a data type and collection rule mapping table: The first column lists the data type and specific examples (e.g., numeric type: transaction amount, account balance; timestamp type: login time, transaction time); the second column lists the corresponding collection frequency suggestions (e.g., for numeric types, if they are transaction-related parameters, real-time / minute-level collection is recommended; for timestamp types, if they are log-related parameters, second-level collection is recommended); the third column lists the corresponding preprocessing methods (e.g., for numeric types: range validation (>0), unit unification (yuan to fen); for timestamp types: format conversion (yyyy-MM-dd HH:mm:ss), time zone unification (UTC+8)). After the parameter group is determined, based on the main data type of the parameters within the group, query the mapping table to obtain the basic collection rules, and then fine-tune the rules according to special business needs (e.g., increasing the collection frequency during major promotions), finally determining the collection rules for the parameter group.

[0130] In the above process, the data collection frequency for each data type is obtained through business scenario requirement analysis or historical data call frequency statistics. The data preprocessing method for each data type is obtained through the data format requirements of the indicator calculation rules or industry-standard data cleaning methods.

[0131] This application does not limit the frequency of data acquisition and the data preprocessing method for the parameter group.

[0132] In some embodiments, for parameter groups with large fluctuations in data volume, dynamic acquisition rules can be designed: by monitoring the data volume change trend of the parameter group, threshold trigger conditions can be set (such as triggering when the data volume reaches 80% of the daily peak); when the trigger condition is met, the acquisition frequency is automatically increased from "once every 5 minutes" to "once every 1 minute", and preprocessing resources are adjusted (such as adding preprocessing server nodes) to prevent data backlog; when the data volume falls back to the daily level, the original acquisition frequency and resource configuration are automatically restored, realizing the elastic adaptation of acquisition rules and balancing data timeliness and resource consumption.

[0133] S205. Based on the data acquisition rules for each parameter group, construct the data acquisition model corresponding to each parameter group.

[0134] One possible implementation is to adopt a "general module combination" model: first, break down the core data acquisition process into four general units: "data acquisition module," "frequency control module," "preprocessing module," and "storage module." Based on the data source of the parameter group, select an appropriate connection method for the "data acquisition module" (e.g., database connection, file reading, API request). Set a scheduled task (e.g., execute hourly, execute minutely) or enable real-time monitoring through the "frequency control module" to match the frequency requirements in the acquisition rules. Configure general processing logic (e.g., remove invalid characters, verify data range, unify data format) in the "preprocessing module," corresponding to the preprocessing methods in the acquisition rules. Finally, write the processed data to the target storage location (e.g., a unified data pool, a business-specific storage area) through the "storage module." Throughout this process, there is no need to focus on the specific technical framework details; model construction can be completed solely through module parameter configuration, lowering the technical threshold and supporting subsequent replacement of individual modules as needed.

[0135] It should be understood that by acquiring the indicator calculation rules of different businesses and extracting basic calculation parameters, abstract requirements are transformed into specific data lists; then, through parameter grouping and determining collection rules, the corresponding data collection model is finally constructed. This process realizes the automation and standardization of data collection, improves efficiency and consistency across business scenarios, reduces maintenance complexity and repetitive development costs, and supports the construction of a highly reusable data collection system.

[0136] The above embodiments introduced the method for constructing a data acquisition model. The following describes the process of acquiring the data to be analyzed based on the data acquisition model.

[0137] In some embodiments, taking any first confidence index among the confidence indices to be evaluated in S104 as an example, the process of determining the index value of the first confidence index to be evaluated is as follows: Figure 4 As shown, S104 specifically includes the following steps:

[0138] S301. Determine at least one first basic calculation parameter of the calculation rule corresponding to the first credibility index to be evaluated and the first index analysis model corresponding to the first credibility index to be evaluated.

[0139] As can be seen from S103 above, one credibility index to be evaluated corresponds to one index analysis model. Therefore, the corresponding first index analysis model can be determined based on the first credibility index to be evaluated.

[0140] As described in S202 above, the first basic calculation parameters can be obtained through the calculation rules corresponding to the first credibility index to be evaluated. The specific process can be found in the basic calculation parameter extraction logic of S202 above. It will not be elaborated further here.

[0141] S302. Based on the parameter group to which each first basic calculation parameter belongs, determine the first data acquisition model corresponding to each first basic calculation parameter.

[0142] Since all basic calculation parameters (including the first basic calculation parameter) have been assigned to corresponding parameter groups according to preset rules in S203, and a data acquisition model has been built for each parameter group in S205, the first data acquisition model corresponding to each first basic calculation parameter can be directly matched through the attribution relationship between the parameter and the parameter group.

[0143] S303. Based on the data synchronization rules, obtain the value of each first basic calculation parameter from the first data acquisition model corresponding to each first basic calculation parameter.

[0144] The data synchronization rules include either full update or incremental update. The value of each primary basic calculation parameter is the data to be analyzed in the first indicator analysis model.

[0145] Full update refers to obtaining the complete dataset of parameters (e.g., obtaining all historical transaction frequencies of a user on the first call); incremental update refers to obtaining only the data that has been added or changed since the last synchronization (e.g., obtaining only the transaction records added on the current day to update the frequency). The computing device sends a request carrying synchronization rules to the matched first data acquisition model. The model performs acquisition and processing according to its own acquisition rules (the frequency and preprocessing method defined in S204). The returned parameter values ​​are summarized to form the data to be analyzed by the first indicator analysis model.

[0146] For example, suppose a certain first indicator analysis model in the target business is used to calculate the "user credit delinquency risk value". Its calculation rule is "delinquency risk value = (number of delinquencies in the past 3 months × 3 + current outstanding amount ÷ total credit line) × risk coefficient". S301 determines the first basic calculation parameters of this rule as "number of delinquencies in the past 3 months", "current outstanding amount", "total credit line", and "risk coefficient". In S302, since "number of delinquencies in the past 3 months" and "current outstanding amount" belong to the "credit-real-time parameter group" (corresponding to real-time data collection model A), and "total credit line" belongs to the "user qualification-daily updated parameter group" (corresponding to daily updated data collection model A), B) "Risk coefficient" belongs to "Risk control basic parameters - weekly update parameter group" (corresponding to weekly update data collection model C). Therefore, the first data collection models corresponding to each parameter are A, A, B, and C, respectively. In S303, based on the incremental update rule, the newly added "number of overdue payments in the past 3 months" (assumed value 2) and "current outstanding amount" (assumed value 5000 yuan) are obtained from model A. Based on the full update rule, the "total credit line" (assumed value 20000 yuan) is obtained from model B. The "risk coefficient" (assumed value 1.2) is obtained from model C. These values ​​are summarized and used as the data to be analyzed in the first indicator analysis model.

[0147] In some embodiments, the data synchronization rules also include format conversion rules for the same basic calculation parameters between the data acquisition model and the indicator analysis model.

[0148] For example, the timestamp format can be uniformly converted to a time format, and multi-value enumeration strings can be converted to numeric flags.

[0149] This format conversion rule can be applied to the calculation needs of different formats of the same basic calculation parameters for the same index analysis model.

[0150] S304. Input the value of each first basic calculation parameter into the first index analysis model to obtain the index value of the first credibility index to be evaluated.

[0151] As described in S103 above, the first indicator analysis model is constructed based on the calculation rules of the first credibility index to be evaluated, and the value of each first basic calculation parameter is the data to be analyzed obtained by the first indicator analysis model from the data acquisition model. Therefore, the index value of the first credibility index to be evaluated can be obtained based on the data to be analyzed.

[0152] For example, suppose the first credibility indicator to be evaluated is "user login behavior anomaly degree", and its calculation rule is "anomaly degree = (number of login failures × 0.5 + remote login flag × 2.0 + non-frequented device flag × 1.5 - number of security authentication successes × 0.8)". S301 determines its first basic calculation parameters as "number of login failures in the past hour", "whether this login is remote", "whether this login device is non-frequented", and "number of security authentication successes in the past day". In S302 and S303, based on the incremental update rule, the data collection model corresponding to "login security - real-time risk control group" obtains "number of login failures in the past hour" as 3, "whether this login is remote" as 1 (yes), and "whether this login device is non-frequented" as 1 (yes); based on the full update rule, the data collection model corresponding to "user security profile - daily update group" obtains "number of security authentication successes in the past day" as 2. These values ​​are input into the first indicator analysis model, and calculated according to the rules: Anomaly score = (3 × 0.5 + 1 × 2.0 + 1 × 1.5 - 2 × 0.8) = (1.5 + 2.0 + 1.5 - 1.6) = 3.4. Finally, the indicator value for "User Login Behavior Anomaly Score" is 3.4.

[0153] It should be understood that this solution utilizes the correspondence between "credibility index to be evaluated - credibility evaluation rules - basic calculation parameters - parameter group - data acquisition model" to obtain the data to be analyzed from one or more data acquisition models corresponding to each credibility index to be evaluated, and calculates the data to be analyzed based on the calculation rules of each credibility index to obtain the index value of each credibility index to be evaluated, thereby achieving coordinated and automated processing of data acquisition and index calculation.

[0154] In an exemplary embodiment, this application also provides a schematic diagram of the data synchronization process between a data acquisition model and an indicator analysis model, such as... Figure 5 As shown, it specifically includes the following:

[0155] The calculation rules for the credibility index to be evaluated in indicator analysis model C include: basic calculation parameter 1, basic calculation parameter 2, basic calculation parameter 3, basic calculation parameter 4, basic calculation parameter 5, and basic calculation parameter 6. Based on the above S301-304, data acquisition model A and data acquisition model B are determined.

[0156] According to the data synchronization rules, data acquisition model A provides acquisition parameter 1 for basic calculation parameter 1 based on data synchronization 1, and provides acquisition parameter 2 for basic calculation parameter 2 based on data synchronization 2.

[0157] Data acquisition model B provides acquisition parameter 3 based on data synchronization 3 as the basic calculation parameter 3, and provides acquisition parameter 3 based on data synchronization 4 as the basic calculation parameter 4. It provides acquisition parameter 4 based on data synchronization 5 as the basic calculation parameter 5, and provides acquisition parameter 5 based on data synchronization 6 as the basic calculation parameter 6.

[0158] At this point, data synchronization refers to the rules in the data synchronization rules regarding the conversion of data formats between the collected parameters and the basic calculation parameters.

[0159] For example, providing collection parameter 3 based on data synchronization 3 as the basic calculation parameter 3, and providing collection parameter 3 based on data synchronization 4 as the basic calculation parameter 4, reflects the requirement of indicator analysis model C for different data formats of collection parameter 3.

[0160] Therefore, it can be seen that by using basic calculation parameters, parameter groups, and data acquisition models, a mapping relationship can be established between indicator analysis models and indicator acquisition models, enabling different indicator analysis models to reuse the same data acquisition model.

[0161] The following describes the process of determining the credibility indicators to be evaluated for the target business and the credibility evaluation rules.

[0162] In some embodiments, in S102 above, when the credibility index selection model can be a decision tree model, the process of inputting business attribute information into the credibility index selection model to determine the credibility index to be evaluated and the credibility evaluation rules corresponding to the target business is as follows: Figure 6 As shown, step S102 specifically includes the following steps:

[0163] S401. Encode the business attribute information of the target business to obtain the feature vector of the target business.

[0164] A feature vector is a numerical representation of the business attribute information of a target business. It converts various attributes of the business (such as text, category, and number) into a set of numerical values ​​that can be recognized and calculated by machine learning models (such as decision trees).

[0165] Feature encoding refers to the process of converting non-numerical business attribute information (such as text descriptions, category labels, etc.) into numerical format.

[0166] In some embodiments, the feature encoding method includes one-hot encoding or label encoding.

[0167] One possible implementation, taking "one-hot encoding" as an example, involves encoding the business attribute information of the target business to obtain its feature vector as follows: For each non-numerical business attribute, first, all possible values ​​are sorted out and a category set is formed, and a unique index is assigned to each value in a fixed order; then, the specific value of the target business on that attribute is converted into a numerical array (the array length is consistent with the category set, only the index position corresponding to that value is 1, and the rest are 0); finally, according to the preset order of "business type → business duration → business associated entity identifier → business associated resource identifier", the encoded arrays of all attributes are concatenated into a one-dimensional array, which yields the feature vector.

[0168] For example, if the target business's attribute information is as follows: Business type: Credit (category set is [Payment, Credit, Wealth Management], corresponding index 1) → encoded as [0,1,0]; Business duration: 3 years (classified as "less than 1 year, 1-3 years, more than 3 years", corresponding index 1) → encoded as [0,1,0]; Business associated entity identifier: Merchant ID (category set is [User ID, Merchant ID, Device ID], corresponding index 1) → encoded as [0,1,0]; Business associated resource identifier: Account resource (category set is [Account Resource, Order Resource, Product Resource], corresponding index 0) → encoded as [1,0,0]. After concatenation, the resulting feature vector is [0,1,0,0,1,0,0,1,0,1,0,0].

[0169] S402. Input the feature vector into the decision tree model, select each branch node in the model using the credibility index to select the node for the feature vector, and determine the target leaf node corresponding to the feature vector.

[0170] Specifically, a decision tree model consists of a series of branch nodes (internal nodes) and leaf nodes (terminal nodes). Each branch node represents a judgment (or test) on a feature in the feature vector. It poses a question and, based on the value of the feature vector for that feature, decides which child node to guide it to. This process repeats continuously along the tree structure until no further branching is possible, eventually reaching a leaf node.

[0171] One possible implementation method is to select each branch node in the model to select the feature vector by means of a credibility index. The process is as follows: starting from the root node, each branch node first specifies the position (i.e., index) of the feature to be detected in the vector and sets the judgment condition (such as whether the value is 1); after extracting the value of the position in the vector and comparing it with the condition, the vector is directed to the left child node or the right child node; after entering the child node, the above judgment process based on position and condition is repeated until the vector reaches the leaf node without branches.

[0172] For example, if the feature vector is [0,1,0,0,1,0,0,1,0,1,0,0], the root node of the decision tree checks the 2nd position (corresponding to "whether the business type is credit"), and the judgment condition is "whether the value is 1". Since the value at this position is 1, it enters the left child node; the child node checks the 5th position (corresponding to "whether the business duration is 1-3 years"), and the judgment condition is "whether the value is 1". Since the value is 1, it enters the left child node; the next node checks the 8th position (corresponding to "whether the associated entity identifier is a merchant ID"), and the judgment condition is "whether the value is 1". Since the value is 1, it enters the left child node; the final node checks the 10th position (corresponding to "whether the associated resource identifier is an account resource"), and the judgment condition is "whether the value is 1". Since the value is 1, it enters the left child node, which is the target leaf node.

[0173] S403. Use the credibility indicators and credibility assessment rules to be evaluated in the target leaf node as the credibility indicators and credibility assessment rules to be evaluated for the target business.

[0174] Specifically, the target leaf node includes at least one credibility index to be evaluated and the credibility evaluation rules between the corresponding credibility indices.

[0175] The feature vector of the target business is a numerical form of the business attributes. By continuously judging and selecting the feature vector through branch nodes, the credibility index to be evaluated that best matches the target business attribute information can be determined.

[0176] It should be understood that this scheme transforms business attributes into inputs that the model can understand through feature encoding. It can then match business attributes with evaluation dimensions based on the numerical distribution characteristics of the feature vectors, thereby improving the efficiency of indicator selection in decision trees.

[0177] Figure 7 This is a schematic diagram of a business security verification device provided in an embodiment of this application. Figure 7 As shown, the business security verification device includes: an acquisition module 701 and a processing module 702.

[0178] The acquisition module 701 is used to acquire the business attribute information of the target business. The business attribute information includes: business type, business duration, business associated entity identifier, and business associated resource identifier.

[0179] Processing module 702 is used to input business attribute information into the credibility index selection model to determine at least one credibility index to be evaluated and credibility evaluation rules corresponding to the target business. Each credibility index to be evaluated is used to quantify the credibility status of the target business in one dimension. The credibility evaluation rules are used to indicate the aggregation rules of at least one credibility index to be evaluated corresponding to the target business. The module determines the index analysis model corresponding to each credibility index to be evaluated. One credibility index to be evaluated corresponds to one index analysis model. The index analysis model is constructed based on the calculation rules of the corresponding credibility index to be evaluated. Based on the index analysis model corresponding to each credibility index to be evaluated and its corresponding data to be analyzed, the index value of each credibility index to be evaluated is determined. The data to be analyzed is obtained by collecting data from the data source of the target business through the data acquisition model. In response to obtaining the security verification task of the target business, the index values ​​of each credibility index to be evaluated are aggregated based on the credibility evaluation rules of the target business to obtain the verification result of the security verification task.

[0180] In other embodiments, the credibility metric selection model is a decision tree model. The credibility metric selection model includes branch nodes and leaf nodes. Branch nodes are used to determine the next node in the credibility metric selection model based on business attribute information. Leaf nodes include at least one credibility metric to be evaluated and at least one credibility evaluation rule for the credibility metric to be evaluated.

[0181] In other embodiments, the processing module 702 is further specifically used to: encode the business attribute information of the target business to obtain a feature vector of the target business; input the feature vector into a decision tree model; select each branch node in the model using a credibility index to select nodes for the feature vector, thereby determining the target leaf node corresponding to the feature vector; and use the credibility index to be evaluated and the credibility evaluation rule in the target leaf node as the credibility index to be evaluated and the credibility evaluation rule corresponding to the target business.

[0182] In other embodiments, the processing module 702 is further configured to obtain the calculation rules for the credibility indicators to be evaluated corresponding to different services. Multiple basic calculation parameters are extracted from the calculation rules of the credibility indicators to be evaluated corresponding to different services. Based on preset parameter partitioning rules, the multiple basic calculation parameters are divided into different parameter groups. Based on the data type of each basic calculation parameter in each parameter group, the data collection rules for each parameter group are determined. The data collection rules include: the frequency of data collection and the data preprocessing method. Based on the data collection rules for each parameter group, a data collection model corresponding to each parameter group is constructed.

[0183] In other embodiments, the parameter partitioning rules include: grouping basic calculation parameters with the same data source into the same parameter group; and / or grouping basic calculation parameters with the same update frequency into the same parameter group.

[0184] In other embodiments, the processing module 702 is further configured to: determine at least one first basic calculation parameter of the calculation rule corresponding to the first credibility index analysis model to be evaluated, and the first index analysis model corresponding to the first credibility index to be evaluated; determine the first data acquisition model corresponding to each of the first basic calculation parameters based on the parameter group to which each of the first basic calculation parameters belongs; and, based on data synchronization rules, obtain the value of each of the first basic calculation parameters from the first data acquisition model corresponding to each of the first basic calculation parameters, as the data to be analyzed in the first index analysis model; the data synchronization rules include: full update or incremental update. The value of each of the first basic calculation parameters is the data to be analyzed in the first index analysis model; the value of each of the first basic calculation parameters is input into the first index analysis model to obtain the index value of the first credibility index to be evaluated.

[0185] The business security verification device provided in this application embodiment can execute the method shown in the above method embodiment. Its implementation principle and beneficial effects can be referred to the relevant description in the method embodiment, and will not be repeated here.

[0186] Figure 8 This is a schematic diagram of a business security verification device provided in an embodiment of this application. Figure 8 As shown, the service security verification device includes: a memory 801, a transceiver 802, and at least one processor 803.

[0187] The transceiver 802 is used to interact with other devices to send and receive data. For example, in this embodiment, the transceiver 802 can specifically be used to obtain the service attribute information of the target service.

[0188] The memory 801 stores computer program code, which includes computer instructions. These computer instructions run in the aforementioned business security verification device to implement the method shown in the above-described method embodiments. For example, the memory may include high-speed random access memory (RAM), and may also include non-volatile memory (NVM), such as at least one disk storage device, or a USB flash drive, external hard drive, read-only memory, disk, or optical disc, etc.

[0189] Processor 803 can be a general-purpose processor, including a Central Processing Unit (CPU), a network processor (NP), etc.; it can also be a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field-Programmable Gate Array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. Processor 803 can also be other general-purpose processors. The general-purpose processor can be a microprocessor or any conventional processor.

[0190] The memory 801, transceiver 802, and processor 803 are communicatively connected. For example, the memory 801 and transceiver 802 can be connected to the processor 803 via a system bus to complete communication between them. The system bus can be a peripheral component interconnect (PCI) bus, an extended industry standard architecture (EISA) bus, an industry standard architecture (ISA) bus, etc. The system bus can be divided into address bus, data bus, control bus, etc. For ease of representation, only one thick line is used in the figure, but this does not mean that there is only one bus or one type of bus.

[0191] Optionally, the memory 801 can be either standalone or integrated with the processor 803. When the memory 801 is set up independently, it is connected to the processor 803 via the system bus.

[0192] This application also provides a chip for executing instructions, which is used to execute the technical solution of the business security verification method in the above embodiments.

[0193] This application also provides a computer-readable storage medium storing computer instructions. When these computer instructions are executed by a processor, they are used to implement the technical solution of the security verification method in the above embodiments. Specifically, when the computer instructions are executed by a processor, the above-mentioned business security verification device can execute the technical solution of the security verification method in the above examples.

[0194] This application also provides a computer program product, which includes a computer program stored in a computer-readable storage medium. At least one processor can read the computer program from the computer-readable storage medium, and when the at least one processor executes the computer program, it can implement the technical solution of the security verification method in the above embodiments.

[0195] The aforementioned computer-readable storage media can be implemented from any type of volatile or non-volatile storage device or a combination thereof, such as Static Random-Access Memory (SRAM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Erasable Programmable Read-Only Memory (EPROM), Programmable Read-Only Memory (PROM), Read-Only Memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. The computer-readable storage media can be any available medium accessible to a general-purpose or special-purpose computer.

[0196] An exemplary computer-readable storage medium is coupled to a processor, enabling the processor to read information from and write information to the storage medium. Of course, the computer-readable storage medium can also be a component of the processor. The processor and the computer-readable storage medium can reside in an application-specific integrated circuit (ASIC). Alternatively, the processor and the computer-readable storage medium can exist as discrete components in an electronic control unit or main control device; this application does not limit this.

[0197] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative; for instance, the division of modules is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple modules may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be indirect coupling or communication connection through some interfaces, devices, or modules, and may be electrical, mechanical, or other forms.

[0198] The modules described as separate components may or may not be physically separate. The components shown as modules may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to implement the solution of this embodiment according to actual needs.

[0199] Furthermore, the functional modules in the various embodiments of this application can be integrated into one processing unit, or each module can exist physically separately, or two or more modules can be integrated into one unit. The unit composed of the above modules can be implemented in hardware or in the form of hardware plus software functional units.

[0200] The integrated modules described above, implemented as software functional modules, can be stored in a computer-readable storage medium. These software functional modules, stored in a storage medium, include several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) or processor to execute some steps of the methods of the various embodiments of this application.

[0201] It should be understood that the steps of the method disclosed in the embodiments of this application can be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules in the processor.

[0202] Those skilled in the art will understand that all or part of the steps of the above-described method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When executed, the program performs the steps of the above-described method embodiments; and the aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disks, or optical disks.

[0203] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

Claims

1. A service security check method, characterized by, The method comprises: obtaining service attribute information of a target service; the service attribute information comprises: a service type, a service duration, a service associated entity identifier, and a service associated resource identifier; inputting the service attribute information into a credibility index selection model to determine at least one to-be-evaluated credibility index corresponding to the target service and a credibility evaluation rule; each to-be-evaluated credibility index is used to quantitatively evaluate the credibility state of the target service in one dimension; the credibility evaluation rule is used to indicate an aggregation rule of at least one to-be-evaluated credibility index corresponding to the target service; determining an index analysis model corresponding to each to-be-evaluated credibility index; one to-be-evaluated credibility index corresponds to one index analysis model; the index analysis model is constructed according to a calculation rule of the corresponding to-be-evaluated credibility index; based on the index analysis model corresponding to each to-be-evaluated credibility index and to-be-analyzed data corresponding to the index analysis model, determining an index value of each to-be-evaluated credibility index; the to-be-analyzed data is obtained by data collection on a data source of the target service through a data collection model; in response to obtaining a security verification task of the target service, aggregating the index value of each to-be-evaluated credibility index based on the credibility evaluation rule of the target service to obtain a verification result of the security verification task.

2. The method of claim 1, wherein, The credibility index selection model is a decision tree model; the credibility index selection model comprises branch nodes and leaf nodes; the branch nodes are used to determine a next node of the credibility index selection model according to the service attribute information; the leaf nodes comprise at least one to-be-evaluated credibility index and a credibility evaluation rule of the at least one to-be-evaluated credibility index.

3. The method of claim 2, wherein, The method comprises: performing feature coding on the service attribute information of the target service to obtain a feature vector of the target service; inputting the feature vector into a decision tree model, performing node selection on the feature vector through each branch node in the credibility index selection model to determine a target leaf node corresponding to the feature vector; taking the to-be-evaluated credibility index and the credibility evaluation rule in the target leaf node as the to-be-evaluated credibility index and the credibility evaluation rule corresponding to the target service.

4. The method of claim 1, wherein, The data collection model comprises a plurality of types, and each data collection model is obtained by: obtaining a calculation rule of a to-be-evaluated credibility index corresponding to different services; extracting a plurality of basic calculation parameters from the calculation rule of the to-be-evaluated credibility index corresponding to the different services; dividing the plurality of basic calculation parameters into different parameter groups based on a preset parameter division rule; determining a data collection rule of each parameter group based on the data type of each basic calculation parameter in each parameter group; the data collection rule comprises: a data collection frequency and a data preprocessing mode; According to a data collection rule of each parameter group, a data collection model corresponding to each parameter group is constructed.

5. The method of claim 4, wherein, The parameter division rule comprises: dividing the basic parameters with the same data source in the basic calculation parameters into the same parameter group; and / or; dividing the basic calculation parameters with the same update frequency into the same parameter group.

6. The method of claim 4, wherein, According to any one first to-be-evaluated credibility index in each to-be-evaluated credibility index, determining an index value of the first to-be-evaluated credibility index based on the index analysis model corresponding to each to-be-evaluated credibility index and the corresponding to-be-analyzed data of the index analysis model, comprises: determining at least one first basic calculation parameter corresponding to the calculation rule of the first to-be-evaluated credibility index and the first index analysis model corresponding to the first to-be-evaluated credibility index; determining a first data collection model corresponding to each first basic calculation parameter based on the parameter group to which each first basic calculation parameter belongs; based on a data synchronization rule, obtaining the value of each first basic calculation parameter from the first data collection model corresponding to each first basic calculation parameter; the data synchronization rule comprises: full update or incremental update; the value of each first basic calculation parameter is the to-be-analyzed data of the first index analysis model; inputting the value of each first basic calculation parameter into the first index analysis model to obtain the index value of the first to-be-evaluated credibility index.

7. A service security check device, characterized by comprising: comprises: an acquisition module configured to acquire service attribute information of a target service; the service attribute information comprises: a service type, a service survival time, a service associated entity identifier, and a service associated resource identifier; a processing module configured to input the service attribute information into a credibility index selection model, determine at least one to-be-evaluated credibility index corresponding to the target service and a credibility evaluation rule, and determine an index analysis model corresponding to each to-be-evaluated credibility index; one to-be-evaluated credibility index is used to quantitatively evaluate the credibility state of the target service in one dimension; the credibility evaluation rule is used to indicate an aggregation rule of at least one to-be-evaluated credibility index corresponding to the target service; determine an index analysis model corresponding to each to-be-evaluated credibility index; one to-be-evaluated credibility index corresponds to one index analysis model; the index analysis model is constructed according to the calculation rule of the corresponding to-be-evaluated credibility index; determine the index value of each to-be-evaluated credibility index based on the index analysis model corresponding to each to-be-evaluated credibility index and the corresponding to-be-analyzed data of the index analysis model; the to-be-analyzed data is obtained by data collection of a data source of the target service through a data collection model; in response to acquisition of a security verification task of the target service, aggregate the index value of each to-be-evaluated credibility index based on the credibility evaluation rule of the target service, and obtain a verification result of the security verification task.

8. A service security check device characterized by comprising: comprises: A memory and at least one processor; the memory is connected with the processor in communication; the memory is configured to store computer program codes, the computer program codes comprise computer instructions; when the processor executes the computer instructions, the business credibility determination device executes the method in any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer instructions, the computer instructions are executed by the processor to implement the method in any one of claims 1-6.

10. A computer program product, characterised in that, When the computer program product is running on the computer / is executed by the processor of the computer, the method in any one of claims 1-6 is implemented.

Images