Data integration hierarchical security management and control method for consumer operation system

Abstract

The invention belongs to the field of operation system management, relates to a data integration analysis technology, and is used for solving the problem that an integrated data platform cannot effectively act on risk assessment analysis due to the fact that element decomposition and feature extraction cannot be performed on each access event in the prior art. The consumer operation system-oriented data integration hierarchical security management and control method comprises the following steps of performing attribute analysis on access elements of a data platform, wherein the access elements comprise access users, access behaviors and access resources; performing risk analysis on the access event of the data platform; performing authority and push optimization management on users of the data platform; carrying out attribute optimization analysis on the access elements of the data platform; according to the method and the device, the coincidence rate of the optimization feature in the pushing priority user is dynamically evaluated, and finally, the reserved optimization feature is added into the attribute marking basis, so that the self-adaptive updating of the attribute marking rule is realized.

Description

Technical Field

[0001] This invention belongs to the field of operation system management and involves data integration and analysis technology, specifically a data integration and hierarchical security control method for consumer operation systems. Background Technology

[0002] Data integration, layering, and security management for consumer operation systems (such as e-commerce platforms, membership centers, marketing campaign systems, user growth systems, etc.) are the core of data-driven operations for modern enterprises and the lifeline of compliance. The core concept is to maximize the value of data in consumer operations through efficient data integration and clear data layering, while ensuring data security and compliance.

[0003] The invention patent with publication number CN104142970B discloses an operation control system and method. This control system integrates business systems related to bank operations onto a single platform to achieve unified data management and interactive sharing; to achieve a unified and effective supervision method; and to provide monitoring standards for non-standard business and suspicious customers to strengthen prevention. However, after completing the data integration, the control system cannot perform element decomposition and feature extraction for each access event, which leads to the integrated data platform being unable to effectively play its role in risk assessment and analysis. Furthermore, the results of multi-factor risk analysis cannot be applied to the user evaluation system, resulting in the inability to effectively control the operational risks of the consumer operation system.

[0004] To address the aforementioned technical problems, this application proposes a solution. Summary of the Invention

[0005] The purpose of this invention is to provide a data integration and layered security management method for consumer-oriented operating systems, which solves the problem that existing technologies cannot decompose elements and extract features for each access event, thus making the integrated data platform unable to effectively perform risk assessment and analysis. The technical problem to be solved by this invention is: how to provide a data integration and layered security management method for consumer-oriented operating systems that can decompose elements and extract features for each access event, so that the integrated data platform can effectively play a role in risk assessment and analysis.

[0006] The objective of this invention can be achieved through the following technical solutions: A layered security control method for data integration in consumer-oriented operating systems includes the following steps: Step S1: Perform attribute analysis on the access elements of the data platform: access elements include accessing users, accessing behaviors, and accessing resources; Step S2: Conduct risk analysis on access events of the data platform: After an access event is generated, extract the access elements of the access event and determine whether there is any risk based on the access elements; Step S3: Perform permission and push optimization management for users on the data platform: Generate a management cycle, obtain the warning coefficient of the accessing user within the management cycle, and determine whether the accessing user's permission optimization is necessary based on the warning coefficient; arrange all accessing objects in ascending order of warning coefficient to obtain a warning sequence, extract the top L2 accessing users in the warning sequence and mark them as push priority users, and prioritize push advertising, promotional activities and new product pushes for push priority users in the next management cycle; Step S4: Perform attribute optimization analysis on the access elements of the data platform.

[0007] Further, in step S1, the attribute marking process for accessing users includes: obtaining the registration time of the accessing user, marking the difference between the current system time and the accessing user's registration time as the registration duration, marking the attributes of accessing users whose registration duration is less than a preset duration threshold as abnormal; marking L1 minutes before the current system time as a monitoring period, obtaining the activity level of the accessing user during the monitoring period, the activity level is obtained by summing and averaging the browsing frequency and order frequency of the accessing user, and marking the attributes of accessing users whose activity level is not less than a preset activity threshold as abnormal.

[0008] Furthermore, in step S1, the attribute marking process for access behavior includes: marking the attributes of access behavior involving modification of identity information, modification of payment method, and payment failure as abnormal; the attribute marking process for access resources includes: arranging the data resources of the data platform in ascending order of access frequency to obtain an access sequence, and marking the attributes of the first L1 data resources in the access sequence as abnormal.

[0009] Furthermore, in step S2, the specific process for determining whether an access event poses a risk includes: if the attributes of the accessing user, access behavior, and accessed resource in the access element are all marked as abnormal, then the access event is determined to pose a risk, and the risk level is high. The corresponding access event is marked as a high-level warning event, triggering access circuit breaker; if any two attributes of the accessing user, access behavior, and accessed resource in the access element are marked as abnormal, then the access event is determined to pose a risk, and the risk level is low. The corresponding access event is marked as a low-level warning event, triggering access audit; otherwise, the access event is determined not to pose a risk, and the corresponding access event is marked as a security event.

[0010] Furthermore, in step S3, the process of obtaining the warning coefficient of the accessing user includes: marking the number of times the access events corresponding to the accessing user in the management cycle are marked as advanced warning events and primary warning events as advanced warning values ​​and primary warning values, respectively; and then performing weighted summation on the advanced warning values ​​and primary warning values ​​to obtain the warning coefficient of the accessing user.

[0011] Furthermore, in step S3, the specific process of determining whether the access user has the necessity for permission optimization includes: comparing the warning coefficient with the preset warning threshold; if the warning coefficient is less than the warning threshold, it is determined that the access user does not have the necessity for permission optimization; if the warning coefficient is greater than or equal to the warning threshold, it is determined that the access user has the necessity for permission optimization, and the corresponding access user is downgraded.

[0012] Furthermore, in step S4, the specific process of performing attribute optimization analysis on the access elements of the data platform includes: marking the optimization features, determining whether the compliance rate of the optimization features among priority push users is less than the compliance threshold; if yes, then retaining the corresponding optimization features; if no, then removing the corresponding optimization features; and adding the retained optimization features to the attribute marking criteria of the access users.

[0013] Furthermore, the specific process of marking optimization features includes: extracting and marking access elements whose attributes are not marked as abnormal in the primary early warning events within the management cycle as filtering elements; forming an access optimization set by all access users marked as filtering elements; extracting information features from all elements in the access optimization set; and marking the L3 information features with the highest overlap in the access optimization set as optimization features.

[0014] The present invention has the following beneficial effects: This application supplements the attribute marking mechanism for access behavior and accessed resources, enabling the attribute analysis of access elements to cover three dimensions: users, behavior, and resources. In the attribute analysis phase, the system first categorizes access behavior, marking behaviors such as identity information modification, payment method modification, and payment failure as abnormal. These behaviors are strongly correlated with account hijacking, fraudulent operations, and abnormal transaction patterns, allowing for precise capture of potential threats at the behavioral level. Simultaneously, the system sorts data resources by access frequency, marking the top L1 resources in the low-frequency access sequence as abnormal. Since low-frequency resources often contain sensitive or critical data, their abnormal access is easily missed by routine monitoring; focusing on these resources effectively identifies hidden risk points. These processes collectively provide complete element attribute status input for the risk analysis phase, enabling the system to make comprehensive risk judgments based on multi-dimensional attribute combinations of users, behavior, and resources, thereby constructing a comprehensive access event risk assessment system. This application constructs a multi-level risk assessment logic system by quantifying the number of abnormal attribute combinations of access elements. When the attributes of the three elements—accessing user, access behavior, and accessed resource—are all marked as abnormal, the system determines it as a high-level risk and triggers an access circuit breaker. This mechanism, based on the high correlation of multiple element anomalies, ensures that the circuit breaker operation is only executed when user identity, behavior pattern, and resource sensitivity are all abnormal simultaneously, avoiding over-response caused by misjudgment of a single element. When any two element attributes are marked as abnormal, the system determines it as a basic risk and triggers an access audit. This mechanism is based on a combination threshold setting for some abnormal elements, ensuring security monitoring coverage while reducing service interruption, verifying risks only through the audit process without affecting user experience. When the number of abnormal elements is less than two, the system determines it as a security event. This mechanism, by setting a minimum abnormal threshold, ensures that system resources are focused on real risk points, maintaining overall operational efficiency. The above judgment logic transforms risk assessment from subjective experience into objective quantitative standards, strictly matching security response actions with risk levels, forming a complete risk classification and processing closed loop. This application categorizes and statistically analyzes the risk levels of user access events within a management cycle, sets differentiated weights based on differences in risk severity, and then generates continuous risk assessment indicators through weighted aggregation. This allows risk assessment to accurately reflect the severity of different event types. First, the system classifies access events into risk levels, categorizing events that trigger circuit breakers, such as those involving identity information modification, as high-level warning events, and events that trigger audits, such as those involving payment failures, as low-level warning events. Second, different weights are assigned to the frequency of events based on risk level, with high-level warning events receiving higher weights due to their greater severity. Finally, the classification and statistical results are converted into a single warning coefficient through weighted summation. This coefficient serves as the objective basis for subsequent permission optimization decisions, thus forming a complete technical chain from risk identification to quantitative assessment. This application dynamically evaluates the compliance rate of optimized features among priority push users. First, the optimized features are marked. Then, it is determined whether the compliance rate of the optimized features among priority push users is less than a compliance threshold. When the compliance rate is lower than the threshold, it indicates that the feature can effectively distinguish high-risk user groups and is retained. When the compliance rate is not lower than the threshold, it indicates that the feature is prevalent among users and cannot effectively distinguish risks, and is removed. Finally, the retained optimized features are added to the attribute marking criteria to achieve adaptive updates of attribute marking rules. This mechanism allows the attribute marking criteria to be dynamically adjusted according to actual user behavior data, avoiding the feature outdated problem caused by static rules. At the same time, it forms a closed loop with the early warning coefficient calculation and priority push user screening in the previous steps, ensuring that the attribute marking criteria continuously reflect the latest user behavior characteristics. Attached Figure Description

[0015] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0016] Figure 1 This is a flowchart of the method of the present invention. Detailed Implementation

[0017] The technical solution of the present invention will be clearly and completely described below with reference to the embodiments. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0018] In the process of data integration and layering for consumer-oriented operating systems, the data platform lacks the ability to decompose and extract features of access events at a fine-grained level. Specifically, the system cannot structurally break down access events into key elements such as accessing users, access behaviors, and accessed resources, leading to the failure of the risk assessment and analysis process. Furthermore, the results of multi-factor risk analysis cannot be effectively integrated into the user evaluation system, thus affecting the real-time response capability of the security control mechanism. This problem directly results in a decrease in the accuracy of risk identification in the consumer operating system, constrains the reliability of data-driven decision-making, and causes a targeted deterioration trend in key system performance indicators such as security control efficiency and user evaluation accuracy.

[0019] For example, in large-scale marketing campaigns on e-commerce platforms, the system records sequences of users frequently visiting high-value product detail pages. However, because the data platform cannot decompose the access events into elements, the system fails to extract features such as the user's identity attributes, operational patterns of access behavior, and the sensitivity level of the accessed resources. Specifically, when users exhibit abnormal login regions, abnormally high-frequency click patterns, or accessed resources involving price adjustment pages, the system cannot determine the risk level based on the combination of these elements. Consequently, the risk assessment model fails to generate effective risk labels, the user evaluation system lacks dynamic risk data input, and user access control strategies and marketing resource allocation mechanisms become detached from risk orientation, leading to the continuous amplification of system security vulnerabilities during the campaign.

[0020] If these issues are not addressed, the data platform will continue to be unable to provide structured risk assessment data, and the user evaluation system will make decisions based on incomplete event data. Furthermore, the security control mechanisms of the consumer operations system will lose their ability to identify abnormal access behavior, increasing the technical risks of data leakage and unauthorized operations. Consequently, the overall reliability and compliance of the system will be fundamentally affected, and enterprises may face a chain reaction of regulatory compliance pressure and declining user trust, ultimately hindering the effective conversion of data value into consumer operations.

[0021] like Figure 1 As shown, the data integration and layered security control method for consumer-oriented operating systems includes the following steps: Step S1: Perform attribute analysis on the access elements of the data platform: Access elements include users, access behaviors, and access resources; The attribute marking process for users includes: obtaining the registration time of the users, marking the difference between the current system time and the user's registration time as the registration duration, and marking the attributes of users whose registration duration is less than a preset duration threshold as abnormal; marking the L1 minutes before the current system time as the monitoring period, obtaining the activity level of users during the monitoring period, which is obtained by summing and averaging the user's browsing frequency and order frequency, and marking the attributes of users whose activity level is not less than a preset activity threshold as abnormal; The attribute marking process for access behaviors includes: marking the attributes of access behaviors involving modification of identity information, modification of payment methods, and payment failure as abnormal; The attribute marking process for access resources includes: arranging the data resources of the data platform according to the access frequency from low to high to obtain the access sequence, and marking the attributes of the first L1 data resources in the access sequence as abnormal; Access elements refer to the basic components that constitute access events on a data platform, including accessing users, access behaviors, and accessed resources. Attribute analysis of access elements refers to the process of classifying and labeling the status of these components. Specifically, this can be achieved using statistical analysis methods based on user behavior logs, such as identifying abnormal patterns by monitoring the dispersion of user login time distribution; or using third-party authentication services to cross-verify user attributes. The main purpose is to achieve a structured decomposition of access events and provide basic data support for subsequent risk assessment.

[0022] In practical applications, registration duration refers to the difference between the current system time and the user's registration time. This can be calculated in real-time using a timestamp calculation module to objectively assess the user's familiarity with the system and avoid bias in identifying abnormal users due to subjective judgment. The duration threshold can be set as a dynamically adjustable time limit, such as 24 hours or 72 hours, to distinguish between normal users and potentially risky users; excessively short registration durations are often associated with malicious accounts. The monitoring period can be understood as a time window focusing on recent user behavior, which can be configured to different lengths, such as the most recent 5 minutes or 30 minutes, to improve the timeliness of risk monitoring. Activity level is specifically a quantitative indicator of the degree of user activity. The indicator can be calculated by averaging the browsing frequency and order frequency, or by using a weighted statistical method. Its purpose is to comprehensively reflect user behavior characteristics and avoid the limitations of a single indicator. Browsing frequency can be understood as the frequency with which a user browses a page during the monitoring period. It can be statistically analyzed based on page request logs to quantify the activity level of a user's browsing behavior. Order frequency specifically refers to the frequency with which a user completes an order during the monitoring period. It can be extracted based on order generation records to quantify the activity level of a user's transaction behavior. The activity threshold can be set as a dynamically adjusted boundary value based on historical data to identify abnormally high-activity users and reduce the interference of subjective factors.

[0023] As a specific implementation method, this application is implemented as follows: When the system executes step S1, it obtains the registration timestamp of the accessing user and calculates the difference between the current system time and the registration time to obtain the registration duration; if the registration duration is less than 24 hours, the user attribute is marked as abnormal. Simultaneously, the system defines the 10 minutes before the current time as the monitoring period, counts the number of page views and order submissions by the user during this period, adds the two together, and divides by 2 to obtain the activity value; if the activity value is greater than or equal to 5 times per minute, the user attribute is marked as abnormal. In this way, the system can automatically identify newly registered users with abnormal behavior, completing attribute marking without manual intervention.

[0024] The attribute tagging of access behavior refers to the process of identifying the risk status of user operations. This can be achieved using a behavior type recognition engine combined with rule-based matching. Specifically, it involves real-time monitoring of user operation logs; when specific behavior types such as identity information modification, payment method modification, or payment failure are detected, anomaly tagging is automatically triggered. The purpose of this feature is to capture dynamic changes in behavior strongly associated with high-risk scenarios, avoiding blind spots in risk identification due to missing behavior attributes. The attribute tagging of access resources refers to the process of classifying data resources by risk level. This can be achieved using an access log analysis module combined with a sorting algorithm. Specifically, it involves generating a frequency sequence by statistically analyzing historical access records and then selecting a subset of low-frequency resources for anomaly tagging based on a preset threshold. The purpose of this feature is to identify highly concealed sensitive data access risks, compensating for the control loopholes in managing less frequently accessed, high-risk data when only high-frequency resources are focused on.

[0025] In the data integration and layered security management scenario of e-commerce platforms, when a user attempts to change their linked mobile phone number, the system identifies this operation as an identity information modification behavior through the behavior monitoring module and immediately triggers an anomaly flag. When a user fails to make three consecutive payments, the system marks the payment behavior sequence as abnormal. Simultaneously, the system daily tracks the access frequency of data resources such as product detail pages and user privacy settings pages, generates access sequences, and filters out the L1 resources with the lowest access volume (e.g., user privacy settings pages, payment security policy configuration pages), marking them as abnormal resources. In subsequent risk analysis, if an access event simultaneously involves a user, abnormal behavior, and abnormal resources marked as abnormal, the system determines it as a high-risk event and triggers the circuit breaker mechanism.

[0026] Step S2: Perform risk analysis on access events of the data platform: After an access event is generated, extract the access elements of the access event. If the attributes of the accessing user, access behavior, and accessed resource in the access elements are all marked as abnormal, the access event is determined to have a risk level of high, and the corresponding access event is marked as a high-level warning event, triggering access circuit breaker; if any two attributes of the accessing user, access behavior, and accessed resource in the access elements are marked as abnormal, the access event is determined to have a risk level of low, and the corresponding access event is marked as a low-level warning event, triggering access audit; otherwise, the access event is determined not to have a risk, and the corresponding access event is marked as a security event. Among them, "High Risk Level" refers to the highest risk level, which can be implemented by automatically terminating the access connection to prevent data leakage or system intrusion caused by high-risk events; "High-Level Warning Event" refers to access events judged as high-risk, which can be implemented by generating high-priority alarm logs and notifying the security response module to quickly activate the blocking mechanism; "Triggering Access Circuit Breaker" refers to immediately terminating the current access session, which can be implemented by closing the network connection channel or rejecting subsequent request processing to block potential malicious behavior; "Low Risk Level" refers to the medium risk level, which can be implemented by activating the background monitoring process to verify risks without affecting normal services; "Low Risk Warning Event" refers to access events judged as low-risk, which can be implemented by recording detailed operation logs and activating the analysis engine to support subsequent audit verification; "Triggering Access Audit" refers to detailed recording and review of access behavior, which can be implemented by activating the log collection and analysis module to confirm the authenticity of the risk; "Security Event" refers to a risk-free judgment result, which can be implemented by normally processing access requests to maintain efficient system operation.

[0027] Step S3: Perform permission and push optimization management for users on the data platform: Generate a management cycle, and mark the number of times the access events of the users in the management cycle are marked as advanced warning events and primary warning events as advanced warning values ​​and primary warning values, respectively. After assigning weights to the advanced warning values ​​and primary warning values, calculate the warning coefficient of the users by weighted summation, and compare the warning coefficient with the preset warning threshold: if the warning coefficient is less than the warning threshold, it is determined that the users do not need permission optimization; if the warning coefficient is greater than or equal to the warning threshold, it is determined that the users need permission optimization, and the corresponding users are downgraded; arrange all access objects in order of warning coefficient from small to large to obtain a warning sequence, extract the top L2 users in the warning sequence and mark them as push priority users, and give priority to push advertising, promotional activities and new product pushes in the next management cycle; In practical applications, the advanced warning value refers to the frequency statistics of users triggering advanced warning events within the management period. It can be implemented using an event counter or log analysis module, with the aim of quantifying the frequency of high-risk behaviors. The primary warning value refers to the frequency statistics of users triggering primary warning events within the management period. It can be implemented using a stream processing engine or batch processing job, with the aim of quantifying the frequency of medium-risk behaviors. Weight allocation refers to the process of setting influence coefficients for events of different risk levels. It can be implemented using a preset weight table or a dynamic adjustment algorithm, with the aim of reflecting the differences in the severity of risk events. Weighted summation calculation refers to the process of accumulating the weighted warning values ​​to generate a comprehensive index. It can be implemented using an arithmetic operation unit or a dedicated calculation module, with the aim of generating comparable risk assessment values.

[0028] Specifically, the proposed solution categorizes and statistically analyzes the risk levels of user access events within a management cycle, sets differentiated weights based on differences in risk severity, and then generates continuous risk assessment indicators through weighted aggregation. This allows the risk assessment to accurately reflect the severity of different event types. First, the system classifies access events into risk levels, categorizing events that trigger circuit breakers, such as those involving identity information modification, as high-level warning events, and events that trigger audits, such as those involving payment failures, as low-level warning events. Second, different weights are assigned to the frequency of events based on their risk levels, with high-level warning events receiving higher weights due to their greater severity. Finally, the weighted summation transforms the categorized statistical results into a single warning coefficient, which serves as the objective basis for subsequent permission optimization decisions, thus forming a complete technical chain from risk identification to quantitative assessment.

[0029] As a specific implementation method, the solution of this application is implemented as follows: At the end of the daily management cycle, the system uses the log analysis module to count the number of advanced warning events and primary warning events triggered by the user on that day, assigns higher weight to advanced warning events and lower weight to primary warning events, and calculates the warning coefficient by weighted summation. This coefficient is used in the subsequent permission determination process for comparison with the warning threshold. The weight allocation can be dynamically adjusted based on historical risk data to adapt to different business scenarios.

[0030] The early warning coefficient is a weighted quantitative indicator of a user's historical risk events. It can be calculated by weighting and summing the high-level and low-level early warning values, aiming to objectively reflect the user's risk level. The preset early warning threshold is the critical point of risk tolerance. It can be a fixed value determined based on historical data analysis or a threshold dynamically adjusted according to the system's operating status, aiming to provide a benchmark for determining the necessity of permission optimization. The comparison process refers to the operation of comparing the early warning coefficient with the early warning threshold. It can be implemented using conditional statements or comparison circuits, aiming to determine whether the user's risk level exceeds the acceptable range. Permission downgrading refers to the permission restriction measures implemented for high-risk users. It can be implemented by modifying user role configuration files or adjusting access control lists, aiming to block potential data abuse paths.

[0031] Step S4: Perform attribute optimization analysis on the access elements of the data platform: Extract and mark the access elements whose attributes are not marked as abnormal in the primary early warning events within the management cycle as filtering elements. The access optimization set is composed of all access users marked as filtering elements. Information features are extracted from all elements in the access optimization set. The L3 information features with the highest overlap in the access optimization set are marked as optimization features. Determine whether the compliance rate of the optimization features among priority push users is less than the compliance threshold: if yes, the corresponding optimization feature is retained; if no, the corresponding optimization feature is removed. The retained optimization features are added to the attribute marking criteria of the access users.

[0032] In practical applications, optimized features refer to user behavior information features extracted from primary warning events. These can be achieved using features such as user browsing path patterns, order time distribution characteristics, or page dwell time distribution. The purpose is to identify effective user behavior patterns in actual risk events. The compliance rate can be understood as the proportion of users with specific optimized features among those prioritized for push notifications. It can be calculated by statistically analyzing the ratio of the number of users with that feature to the total number of priority users. The purpose is to objectively quantify the representativeness of that feature within the target user group. Specifically, the compliance threshold refers to a preset critical judgment value. This can be achieved using dynamic thresholds derived from historical data statistical analysis or industry experience thresholds. The purpose is to provide scientific feature selection criteria. In practical applications, attribute labeling criteria refer to the set of rules used to determine whether the attributes of accessing users are abnormal. This can be implemented using rule engines or decision tree models. The purpose is to provide a reliable basis for risk assessment of access events.

[0033] This application's solution dynamically evaluates the compliance rate of optimized features among priority push users. First, optimized features are marked. Then, it determines whether the compliance rate of optimized features among priority push users is less than a compliance threshold. If the compliance rate is lower than the threshold, it indicates that the feature can effectively distinguish high-risk user groups and is retained. If the compliance rate is not lower than the threshold, it indicates that the feature is prevalent among users and cannot effectively distinguish risk, and is removed. Finally, the retained optimized features are added to the attribute marking criteria, achieving adaptive updates to the attribute marking rules. This mechanism allows the attribute marking criteria to be dynamically adjusted based on actual user behavior data, avoiding the feature outdated problem caused by static rules. Simultaneously, it forms a closed loop with the warning coefficient calculation and priority push user screening in the preceding steps, ensuring that the attribute marking criteria continuously reflect the latest user behavior characteristics.

[0034] As a specific implementation method, this application is implemented in an e-commerce platform as follows: The system extracts access elements that are not marked as abnormal from the primary warning events within the management cycle, and analyzes them to obtain the optimization feature of "frequently browsing high-value products late at night but not placing an order"; then, it counts that the proportion of users with this feature among priority push users is 15%. If the threshold is set at 20%, then 15% is less than 20%, and the system retains this optimization feature; finally, this feature is added to the attribute marking criteria, and users with this feature are marked as abnormal in subsequent management cycles for risk assessment and push optimization management.

[0035] A layered security control method for data integration in consumer operation systems begins by analyzing the attributes of access elements on the data platform. These elements encompass users, behaviors, and resources. This analysis provides a structured basis for decomposing access events, breaking each event down into quantifiable key elements, thus providing necessary data support for subsequent risk assessment. Furthermore, after an access event is generated, the system extracts its access elements and determines the presence of risk based on these elements. Through a multi-dimensional combination analysis mechanism, the system can identify the risk levels corresponding to abnormal combinations of different elements, avoiding the limitations of single-indicator assessments and ensuring risk control. The system ensures the accuracy of the judgment results. Based on this, the system generates a management cycle and obtains the warning coefficient of the accessing user within that cycle. This warning coefficient is obtained through quantitative calculation of historical risk events and is used to determine whether the accessing user has the necessary permissions for optimization. At the same time, all accessing objects are arranged in ascending order of warning coefficient to form a warning sequence, and the top L2 accessing users in the sequence are marked as priority push users, so that advertisements, promotional activities and new product information are pushed to them first in the next management cycle. Finally, the system performs attribute optimization analysis on the access elements, and dynamically adjusts the attribute marking rules by continuously screening and verifying optimization features to ensure the adaptability and timeliness of the risk judgment standard.

[0036] The above description is merely an example and illustration of the structure of the present invention. Those skilled in the art can make various modifications or additions to the specific embodiments described, or use similar methods to replace them, as long as they do not deviate from the structure of the invention or exceed the scope defined in the claims, all of which should fall within the protection scope of the present invention.

[0037] In the description of this specification, references to terms such as "an embodiment," "example," "specific example," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0038] The preferred embodiments of the present invention disclosed above are merely illustrative of the invention. These preferred embodiments do not exhaustively describe all details, nor do they limit the invention to any specific implementation. Clearly, many modifications and variations can be made based on the content of this specification. This specification selects and specifically describes these embodiments to better explain the principles and practical applications of the invention, thereby enabling those skilled in the art to better understand and utilize the invention. The invention is limited only by the claims and their full scope and equivalents.

Claims

1. A data integration and layered security control method for consumer-oriented operating systems, characterized in that, Includes the following steps: Step S1: Perform attribute analysis on the access elements of the data platform: access elements include accessing users, accessing behaviors, and accessing resources; Step S2: Conduct risk analysis on access events of the data platform: After an access event is generated, extract the access elements of the access event and determine whether there is any risk based on the access elements; Step S3: Perform permission and push optimization management for users on the data platform: Generate a management cycle, obtain the warning coefficient of the accessing user within the management cycle, and determine whether the accessing user's permission optimization is necessary based on the warning coefficient; arrange all accessing objects in ascending order of warning coefficient to obtain a warning sequence, extract the top L2 accessing users in the warning sequence and mark them as push priority users, and prioritize push advertising, promotional activities and new product pushes for push priority users in the next management cycle; Step S4: Perform attribute optimization analysis on the access elements of the data platform.

2. The data integration and layered security management method for a consumer-oriented operating system according to claim 1, characterized in that, In step S1, the user attribute marking process includes: obtaining the user's registration time, marking the difference between the current system time and the user's registration time as the registration duration, marking users whose registration duration is less than a preset duration threshold as abnormal; marking L1 minutes before the current system time as a monitoring period, obtaining the user's activity level during the monitoring period, the activity level is obtained by summing the user's browsing frequency and order frequency and taking the average, and marking users whose activity level is not less than a preset activity threshold as abnormal.

3. The data integration and layered security management method for a consumer-oriented operating system according to claim 2, characterized in that, In step S1, the attribute marking process for access behavior includes: marking the attributes of access behaviors involving modification of identity information, modification of payment method, and payment failure as abnormal; the attribute marking process for access resources includes: arranging the data resources of the data platform in ascending order of access frequency to obtain an access sequence, and marking the attributes of the first L1 data resources in the access sequence as abnormal.

4. The data integration and layered security management method for a consumer-oriented operating system according to claim 3, characterized in that, In step S2, the specific process of determining whether an access event is risky includes: if the attributes of the accessing user, accessing behavior, and accessing resources in the access elements are all marked as abnormal, then the access event is determined to be risky and the risk level is high. The corresponding access event is marked as a high-level warning event, and the access circuit breaker is triggered. If any two of the access elements—accessing user, access behavior, and accessing resource—are marked as abnormal, the access event is determined to be risky, and the risk level is primary. The corresponding access event is marked as a primary warning event, triggering access auditing. Otherwise, if the access event is deemed not to pose a risk, the corresponding access event will be marked as a security event.

5. The data integration and layered security management method for a consumer-oriented operating system according to claim 4, characterized in that, In step S3, the process of obtaining the warning coefficient of the accessing user includes: marking the number of times the access events corresponding to the accessing user in the management cycle are marked as advanced warning events and primary warning events as advanced warning values ​​and primary warning values, respectively; and then performing weighted summation on the advanced warning values ​​and primary warning values ​​to obtain the warning coefficient of the accessing user.

6. The data integration and layered security management method for a consumer-oriented operating system according to claim 5, characterized in that, In step S3, the specific process of determining whether an access user has the necessity for permission optimization includes: comparing the warning coefficient with a preset warning threshold; if the warning coefficient is less than the warning threshold, it is determined that the access user does not have the necessity for permission optimization; if the warning coefficient is greater than or equal to the warning threshold, it is determined that the access user has the necessity for permission optimization, and the corresponding access user is downgraded.

7. The data integration and layered security management method for a consumer-oriented operating system according to claim 6, characterized in that, In step S4, the specific process of performing attribute optimization analysis on the access elements of the data platform includes: marking the optimization features, determining whether the compliance rate of the optimization features among priority push users is less than the compliance threshold; if yes, retaining the corresponding optimization features; if no, removing the corresponding optimization features; and adding the retained optimization features to the attribute marking criteria of the access users.

8. The data integration and layered security management method for a consumer-oriented operating system according to claim 7, characterized in that, The specific process of marking optimization features includes: extracting access elements whose attributes are not marked as abnormal in the primary early warning events within the management cycle and marking them as filtering elements; forming an access optimization set by all access users marked as filtering elements; extracting information features from all elements in the access optimization set; and marking the L3 information features with the highest overlap in the access optimization set as optimization features.

Images