15 results about "Grey list" patented technology

The invention relates to the technical field of insurance information, and discloses a personal insurance fraud full-process prevention monitoring system and method, and the system comprises a data collection and fusion module which is used for extracting data in real time or quasi-real time from business systems of insurance buying, underwriting, preservation, claim settlement and the like in an insurance company, external data such as medical records, credit investigation data, judicial information, internet financial behavior data, black and grey lists shared by other insurance companies and the like are integrated through an API interface, and multi-source heterogeneous data are cleaned, standardized and associated; and the multi-modal risk analysis engine comprises a rule engine layer, a machine learning model layer and a correlation graph analysis layer. A prevention and monitoring system covering a personal insurance full-service process is constructed, and anti-fraud monitoring is preposed to insurance and underwriting links and runs through a claim settlement link to form a closed loop. A traditional afterward response mode is changed, and early warning can be given out and intervention measures can be taken at the early stage of risk occurrence.

The invention discloses a transaction tracing method based on a fluff-stage transaction broadcast mechanism, and the method comprises the steps: triggering the connection reset of a target node after filling a gray list node list and a white list node list of the target node, and achieving the outgoing connection occupation of the target node; judging the current stage of the target node through two controllable nodes which establish incoming connection with the target node; and when the target node is in a fluff stage, if a controlled node in the occupied outgoing connection nodes receives a transaction of a step stage sent by the target node, judging that the transaction is an originating transaction of the target node. According to the invention, the identification precision of the originating transaction can be improved, and the complexity and resource consumption of the identification method can be reduced.

The invention discloses a ticket credit management and control method and system. The method comprises the following steps: receiving a to-be-synchronized limit list and an associated routing identifier of a first ticket server; wherein the to-be-synchronized limit list comprises a grey list and a black list; the routing identifier comprises an identifier of a server needing to synchronize the to-be-synchronized limit list; pre-configured message subscription modes of a plurality of message queues are obtained, and each message queue is associated with one type of ticket service servers; the message subscription mode comprises a target server identifier; when the routing identifier is matched with the message subscription mode, distributing the to-be-synchronized limit list to a message queue of which the message subscription mode is matched with the routing identifier; and synchronizing the to-be-synchronized limit list in the message queue to a corresponding second ticketing server. Through a real-time synchronization mechanism based on the message queue, the risk user information (grey / black list) identified by any channel or venue can be synchronized to all ticket sales channels.

The invention relates to an intelligent contract vulnerability detection method based on a grey list mechanism. The invention provides an improved bidirectional long-short-term memory neural network aiming at the problem that intelligent contract vulnerability detection under a grey list mechanism accurately and efficiently identifies known type vulnerabilities. The invention provides a smart contract vulnerability detection model classification system based on a grey list mechanism for solving the problem that unknown smart contract vulnerability types are difficult to judge by a classified model. The method can significantly improve the detection effect of the unknown type of vulnerability of the smart contract.

The invention discloses an originating transaction identification method of transaction traceability based on private transaction connection reset for a Momenian Tor network node. The method comprises the following steps: deploying a plurality of probe nodes in a Tor network; the method comprises the following steps: coordinating a plurality of probe nodes to jointly implement a delay filling strategy for Portuo Tor network hidden service nodes in the Tor network, filling addresses of the probe nodes into a grey list, and then filling the addresses into a white list; after spreading the address of the probe node in the white list to the portal Tor network client node by the portal Tor network hidden service node, filling the address into a grey list of the portal Tor network client node, and further filling the address into the white list of the portal Tor network client node; and after the probe node with the address in the white list and the grey list of the portal Tor network client node is selected as an agent node, identifying the originating transaction of the portal Tor network client node. By applying the method and the system, the originating transaction can be actively and efficiently identified.

The invention discloses a message service processing method and device, equipment and a storage medium, relates to the technical field of computers, and is applied to a server of an instant messaging tool. Judging whether the first client belongs to a grey list member of a second client serving as a message receiver based on the grey list relation table, if so, not pushing and notifying the message content to the second client, and feeding back a successful sending notification of the message content to the first client; if not, determining a message sending strategy to send the message based on a preset big data processing system, a junk information lexicon table, a preset parallel grading detection strategy and an account grey list risk level value of the first client; and determining whether to update the account grey list risk level value of the first client based on feedback information sent by the second client. According to the invention, silent filtering of the information sent by the specific contact person is realized, and the probability of damaging the relationship between two communication parties is greatly reduced.

The invention provides a user risk behavior disposal method and device based on instant messaging, and the method comprises the steps: integrating user login and scientific and technological product key business data, and forming a risk assessment comprehensive data source; building an algorithm model to compare abnormal data, marking the users which do not reach the forbidden standard as a grey list and monitoring, and marking the users as a black list if continuous preset risk behaviors or obvious abnormal login exist; the grey / black list node is used for pushing a safety warning with an exclusive communication entrance and a forbidding notification with the communication entrance and a complaint component by means of instant messaging; the complaint material is researched and judged, and a butt joint interface is unforbidden or rejected according to a result; and regularly summarizing disposal results, triggering model learning, threshold adjustment and rule updating, and synchronizing to each scientific and technological product. According to the method, accurate risk identification, hierarchical disposal, instant communication and dynamic iteration can be realized, the disposal efficiency and universality are improved, and resource waste is reduced.

The invention provides a method and a system for realizing internet access control by using domain name enrollment, and relates to the technical field of wireless networks, and the method comprises the following steps: obtaining MAC addresses of all terminals hung under a wireless router; dividing the terminal devices into white list devices and grey list devices according to the MAC addresses of the terminals, and obtaining a domain name white list and a domain name grey list; judging whether a new legal domain name needs to be added in the domain name white list or not; triggering an operation of initializing the record domain name, and initializing the domain name white list; triggering an operation of newly adding a recording domain name, and adding a new legal domain name to the domain name white list; and stopping domain name recording, and triggering domain name filtering operation. According to the method, the white list and the grey list are divided through the MAC address, the internet surfing behavior of the child equipment is accurately controlled, and normal use of the parent equipment is not influenced; initialization is supported, a recording domain name is newly added, and different management and control requirements are met; the operation does not need professional network knowledge, and the practicability and accuracy of home internet access control are improved.

The invention discloses an attack detection method and system based on electric power protocol semantic analysis. Comprising the following steps: analyzing a captured communication message, and extracting seven-tuple features and an application layer protocol data unit; using the black and white list rule base to shunt the traffic, blocking the black list traffic, and dividing the residual traffic into a white list message and a gray list message; executing session finite-state machine time sequence verification on the grey list messages, skipping the verification on the white list messages to improve efficiency, and executing multi-dimensional logic coupling verification on the messages containing the measurement data; when the detection is not passed, virtual deduction is carried out by using the digital mechanism model, and virtual service data is generated and fed back to the attack source; and if the grey list message passes the detection, updating the white list rule base and forwarding. According to the method, through deep fusion of a physical mechanism and communication semantics, the problems that a legal terminal is hijacked and a high-concealment logic attack is difficult to recognize are solved, and the detection efficiency and the defense initiative are both considered.

The invention relates to the technical field of firewalls, and provides a defense method and system based on a dynamic firewall rule chain, and the method comprises the steps: responding to the IP access of a new device, calling a firewall dynamic blacklist chain for interception, and recording the access information in a monitoring log if the IP access is not in the firewall dynamic blacklist chain; the IP monitoring access service obtains access information from the monitoring log, after the access information is added into a firewall temporary grey list chain, the equipment is temporarily released to enter nginx, and the nginx records a request log; the IP monitoring admission service obtains the equipment information from the nginx request log and verifies the equipment information; if the verification is not passed, adding the equipment IP into a firewall dynamic blacklist chain for interception; and if the verification is passed, adding the device IP into the white list chain for release, and accessing the background service. The firewall rule can be quickly and accurately updated, and delay and errors possibly caused by manual updating are avoided.

The invention discloses a DNS domain name abnormal access identification system based on behavior characteristics, which is oriented to plaintext and encrypted DNS scenes, integrates multi-source data such as terminal / process, recursive analysis and passive DNS, and constructs a subject-domain name-IP / CNAME multi-split graph and character level, time sequence statistics, graph structure and protocol semantic four-dimensional portrait; through white / grey lists, CDN discrimination, TTL and IP quantity / similarity threshold values and DGA / Fast-Flux feature rapid convergence candidates, an unsupervised / semi-supervised / supervised hybrid model is used for scoring and evidence fusion to output an abnormal type and confidence; identifying abnormal relation evolution and gang by adopting a time sequence diagram attention network; automatic linkage and auditing trace leaving of graded alarm, DNS redirection / NXDOMAIN, current limiting, terminal isolation and boundary blocking are supported; and online incremental learning, feature / threshold recalibration and versioning management are carried out based on disposal feedback and information updating, so that high-accuracy and low-delay identification and sustainable evolution protection of DGA, Fast-Flux, domain name hijacking, DNS tunnel and abnormal equipment are realized.

A method, device, equipment and medium for determining an object gray list are disclosed. The method comprises: determining real-time news data associated with at least one white list object; the real-time news data is data authorized for use by the white list object; determining a first risk object from the white list objects based on each real-time news data; the first risk object is an object with potential financial risk; determining at least one second risk object having a risk association with the first risk object; determining a risk probability value of the second risk object, and determining the first risk object and the second risk object with a risk probability value greater than a preset probability threshold as the object gray list. By executing the present scheme, the object with potential financial risk can be predicted, and a reference basis for building a good risk management system for financial institutions is provided.

The invention relates to a low-voltage power distribution and utilization dual-mode communication relay method, a low-voltage power distribution and utilization dual-mode repeater, electronic equipment and a computer readable storage medium, and the method comprises the steps: setting a logic address of the low-voltage power distribution and utilization dual-mode repeater as a network access MAC address, and transmitting a network access request according to a repeater equipment type; receiving a network access permission instruction and a terminal equipment identifier fed back by the concentrator communication unit based on a preset grey list mechanism, monitoring channel quality of uplink and downlink communication links in real time after network access succeeds, and performing self-adaptive switching in a plurality of preset communication networking relay modes based on the channel quality, and direct or indirect relay forwarding is carried out based on the current relay mode. The network access and archive management process of the relay equipment is simplified, plug and play is realized, the communication mode can be adaptively switched according to the channel state, and high efficiency and high reliability of data transmission in a complex power distribution and utilization environment are guaranteed.

The invention discloses a DNS domain name abnormal access identification system based on behavior characteristics, which is oriented to plaintext and encrypted DNS scenes, integrates multi-source data such as terminal / process, recursive analysis and passive DNS, and constructs a subject-domain name-IP / CNAME multi-split graph and character level, time sequence statistics, graph structure and protocol semantic four-dimensional portrait; through white / grey lists, CDN discrimination, TTL and IP quantity / similarity threshold values and DGA / Fast-Flux feature rapid convergence candidates, an unsupervised / semi-supervised / supervised hybrid model is used for scoring and evidence fusion to output an abnormal type and confidence; identifying abnormal relation evolution and gang by adopting a time sequence diagram attention network; automatic linkage and auditing trace leaving of graded alarm, DNS redirection / NXDOMAIN, current limiting, terminal isolation and boundary blocking are supported; and online incremental learning, feature / threshold recalibration and versioning management are carried out based on disposal feedback and information updating, so that high-accuracy and low-delay identification and sustainable evolution protection of DGA, Fast-Flux, domain name hijacking, DNS tunnel and abnormal equipment are realized.

The present application relates to the technical field of insurance industry management, in particular to a customer risk management system for personal injury insurance products, comprising a data acquisition module, a list division module, a forbidden insurance marking module, a job type screening module, a data processing module and a comparison and prompt module; historical claim data of each insurance company that has cooperated is acquired; all insurance companies are divided into lists; the insurance companies that newly upload personnel lists are subjected to multiple screening and forbidden insurance marking; the insurance companies that have not been subjected to forbidden insurance marking are exported and subjected to forbidden insurance job type screening; the gray list is combined with the insurance liability parameters and insurance application parameters of various job types in the standard comparison parameters to obtain combined data; the personnel list uploaded by the insurance companies after forbidden insurance job type screening is compared with the insurance liability parameters or insurance application parameters in the combined data, and abnormal prompts are given. The selection and elimination of stock customers and the accurate control of new insurance companies are realized, so that the risk management is more flexible and efficient.