CN114757757A

CN114757757A - Wind control method

Info

Publication number: CN114757757A
Application number: CN202210290392.4A
Authority: CN
Inventors: 闫保林; 范富强; 李世杰
Original assignee: Chezhubang Beijing Technology Co Ltd
Current assignee: Shandong Energy Chain Holding Co ltd
Priority date: 2022-03-23
Filing date: 2022-03-23
Publication date: 2022-07-15

Abstract

The invention relates to a wind control method, which comprises the following steps: the event layer acquires information of a user and sends the information to the service layer and the label layer; the service layer analyzes the information to obtain identity information and equipment information of the user, determines a first risk value according to the identity information and the equipment information, and sends the first risk value to the strategy model layer; the label layer determines an identity label and an equipment label according to the information and sends the identity label and the equipment label to the strategy model layer; and the strategy model layer analyzes the identity label and the equipment label according to the self-built model to obtain a second risk value, and generates a total risk value of the user according to the first risk value and the second risk value. According to the wind control method, on one hand, wind control scoring is carried out based on the information of the user, on the other hand, risk scoring of the user on other platforms is integrated, and accurate risk assessment of the user is achieved.

Description

Wind control method

Technical Field

The invention relates to the technical field of information, in particular to a wind control method.

Background

With the development of internet finance and electronic commerce, people conduct transactions, payments and loans by using networks, and generally in the process of the loans and the payments, risk control evaluation is very critical. However, the risk control evaluation is often required to be based on the wind control data, such as the user's historical payment record, the user's historical loan record, etc., but how to provide reliable and stable quality of service wind control data is still an unsolved problem in the prior art.

Disclosure of Invention

The invention aims to provide a wind control method aiming at the defects of the prior art, on one hand, wind control scoring is carried out based on the information of a user, on the other hand, the risk scoring of the user on other platforms is integrated, and accurate risk assessment of the user is realized.

In order to achieve the above object, a first aspect of the embodiments of the present invention provides a wind control method, where the wind control method includes:

the event layer acquires information of a user and sends the information to the service layer and the label layer;

the service layer analyzes the information to obtain the identity information and the equipment information of the user, determines a first risk value according to the identity information and the equipment information, and sends the first risk value to a strategy model layer;

the label layer determines an identity label and an equipment label according to the information and sends the identity label and the equipment label to the strategy model layer;

and the strategy model layer analyzes the identity label and the equipment label according to a self-built model to obtain a second risk value, and generates a total risk value of the user according to the first risk value and the second risk value.

Preferably, the information includes: activation information, login information, registration information, payment information.

Preferably, the determining a first risk value according to the identity information and the device information specifically includes:

calling a third-party interface according to the identity information, and determining the risk value of the identity information on each three-party platform;

and generating a first risk value of the user according to the risk value of each three-party platform.

Preferably, the determining, by the tag layer, the identity tag and the device tag according to the information specifically includes:

and classifying the information according to the source and the attribute of the information to obtain an identity label and an equipment label.

Preferably, the identity tag comprises: order information and city crossing information on the same day; the device tag includes: the device associates user information and payment account information.

Preferably, the base data layer stores said identity information and/or device information and/or identity tag and/or device tag and/or first risk value and/or second risk value and/or total risk value.

Preferably, the external service layer output displays the identity information and/or the equipment information and/or the identity label and/or the equipment label and/or the first risk value and/or the second risk value and/or the total risk value.

A second aspect of an embodiment of the present invention provides a wind control system, including:

the event layer is used for acquiring the information of the user and sending the information to the service layer and the label layer;

the service layer is used for analyzing the information to obtain the identity information and the equipment information of the user, determining a first risk value according to the identity information and the equipment information and sending the first risk value to the strategy model layer;

the label layer is used for determining an identity label and an equipment label according to the information and sending the identity label and the equipment label to the strategy model layer;

and the strategy model layer is used for analyzing the identity label and the equipment label according to a self-established model to obtain a second risk value and generating a total risk value of the user according to the first risk value and the second risk value.

A third aspect of an embodiment of the present invention provides an electronic device, including: a memory, a processor, and a transceiver;

the processor is configured to be coupled to the memory, read and execute instructions in the memory, so as to implement the method steps of the first aspect;

the transceiver is coupled to the processor, and the processor controls the transceiver to transmit and receive messages.

A fourth aspect of the embodiments of the present invention provides a computer-readable storage medium, which stores computer instructions that, when executed by a computer, cause the computer to execute the instructions of the method according to the first aspect.

According to the wind control method provided by the embodiment of the invention, on one hand, wind control scoring is carried out based on the information of the user, on the other hand, risk scoring of the user on other platforms is integrated, and accurate risk assessment of the user is realized.

Drawings

Fig. 1 is a flowchart of a wind control method according to an embodiment of the present invention;

fig. 2 is a block diagram of a wind control system according to a second embodiment of the present invention;

fig. 3 is a schematic structural diagram of an electronic device according to a third embodiment of the present invention.

Detailed Description

To make the objects, technical solutions and advantages of the present invention more apparent, the present invention will be described in further detail with reference to the accompanying drawings. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.

The point system is used as a common user incentive mode, and can achieve the purposes of increasing user viscosity and guiding customer behaviors through an incentive mechanism, so that the point system is widely applied to scenes such as large-scale airlines, hotels, banks, business supermarkets, retail brands and the like, and for internet products, the point system is also standard matching of a large-scale application program APP. Risk control of the integral system is therefore increasingly important.

The existing wind control system for the integral service basically keeps the wind control of offline business modes and sets rules by means of expert experience. The online wind control and the offline wind control are greatly different, users can be registered in large batch by the online service through various technologies, and the purpose of earning benefits is achieved by collecting the reward of a point system through an abnormal means, and the users who register benefits through the abnormal means can be called black grey product users. Many times, a single black and gray product user completely accords with the rules, and the reasonable and legal reward of a point collecting system cannot be prevented by offline expert experience. To avoid the loss, only the strength of the point excitation can be reduced, but the normal user has no power to participate in the point activity, and the whole point system becomes a layout. The attack users of the black and gray products are automatically executed in a large batch, and have single behavior form, strong regularity and strong aggregation, so that the attack users are obviously different from normal users in many indexes.

The cost of such an attack has increased to some extent, which requires that the attacker have to use a large number of accounts, since the gains from a small number of accounts do not cover the cost. Therefore, the account numbers have certain aggregation on a series of wind control indexes such as a login period, a login duration, an integral obtaining mode, an integral obtaining quantity, an integral using mode and the like. Through the joint judgment of the indexes, various attacks of black and gray products can be effectively identified. For a lower level attack, the IP and the device fingerprint are fixed, so that the attack IP and the attack device can be identified by counting the login times of a single IP or a single device and marked as a high risk. For higher level attacks, technologies such as code receiving platforms, IP software and cat pools are used. However, for technical reasons, the IP can be changed continuously, but cannot be changed to the designated IP, so that when the IP is registered for a plurality of times and the integral is acquired for a plurality of times, the IP is completely different, and even the IP home location has a large jump. And the IP is continuously converted into a wind control index through multiple logins.

That is to say, the prior art has a low recognition rate for the attacking users, which results in that a large number of slightly valuable service scenes are attacked by the attacking users produced in black and grey, and the security of the scoring system is difficult to guarantee.

Example one

Fig. 1 is a flowchart of a wind control method according to an embodiment of the present invention. The technical solution of the present invention is described in detail below with reference to fig. 1.

Step 110, the event layer acquires the information of the user and sends the information to the service layer and the label layer;

specifically, the information includes: activation information, login information, registration information, payment information, etc.

Step 120, the service layer analyzes the information to obtain the identity information and the equipment information of the user, determines a first risk value according to the identity information and the equipment information, and sends the first risk value to the strategy model layer;

specifically, a third-party interface is called according to the identity information and/or the equipment information, and the risk value of the identity information and/or the equipment information on each three-party platform is determined. And generating a first risk value of the user according to the risk values of the three-party platforms.

When the three-party platform has the wind control evaluation, the risk value of each platform is obtained according to the identity information and/or the equipment information of the user, the weight distribution is carried out according to the information of each platform, and finally the first risk value is generated according to the risk value of each platform and the corresponding weight. And when the three-party platform does not have risk evaluation, evaluating according to the historical records of each platform, and synthesizing the evaluation results of each platform to generate a first risk value.

Wherein the identity information comprises: and the user binds information such as a mobile phone number, an IP address, a mailbox, login time and the like. The device information includes: equipment brand, version number, mac address, IP address, etc.

In a preferred scheme, the service layer analyzes and obtains the transaction information, and the method comprises the following steps: participation channel, converted commodity id, converted merchant id, converted integral value, participation time, receiving address and other information.

Step 130, the label layer determines an identity label and an equipment label according to the information and sends the identity label and the equipment label to the strategy model layer;

specifically, the information is classified according to the source and the attribute of the information to obtain an identity tag and an equipment tag. The identity tag comprises: order information and city crossing information on the same day. The device tag includes: the device associates user information and payment account information.

And 140, analyzing the identity label and the equipment label by the strategy model layer according to the self-established model to obtain a second risk value, and generating a total risk value of the user according to the first risk value and the second risk value.

Specifically, the identity tag and the equipment tag are used as the input of the self-established model, and the second risk value is obtained through output. The self-built model can be understood as a preset rule.

For example, when the IP attribution is not equal to china and the number of registered mobile phone numbers associated with the IP in about 10 minutes is higher than a certain threshold, the second risk value is increased by 5. And in the last 1 hour, the number of the login mobile phone numbers related to the same IP address is higher than a certain threshold, and the second risk value is increased by 5. And in the last 1 day, the number of the login mobile phones associated with the same IP address is higher than a certain threshold, and the second risk value is increased by 5.

And finally, obtaining a total risk value by accumulating the first risk value and the second risk value. Or calculating according to the first risk value, the weight corresponding to the first risk value, the second risk value and the weight corresponding to the second risk value to obtain a total risk value. And judging the score intervals corresponding to the total risk values, wherein each score interval corresponds to one user category.

According to the embodiment of the invention, the users are divided into extremely high risk, medium risk and low risk according to the total risk value of the users, and different treatments are taken for different users. For the user request with extremely high risk, directly pulling the user into a blacklist; if the high-risk user request is rejected, and corresponding dialogues are returned, if 'your account login is abnormal, please contact the customer service to check the specific reason'; requesting a low-risk user to go to a normal business process; the user request for intermediate risk is again authenticated.

In one embodiment, a wind control analysis result of the user is generated according to the first risk value and the second risk value. The wind control analysis results may include normal and abnormal. And the normal wind control analysis result is used for representing that no risk exists in resource exchange data. And the abnormal wind control analysis result is used for representing that the resource exchange data possibly has risks.

In one embodiment, the abnormal wind control analysis result may further include at least one of a risk type, a risk degree, and the like.

In one embodiment, the risk categories may include at least one of a pull-and-lift pressure, a false declaration, a continuous declaration, a self-buy and self-sell, a continuous transaction, a large declaration, a high-buy and low-sell, a turn-around-the-day, and a maintenance price-stop-and-rise.

In a preferred scheme, the wind control system further comprises a basic data layer and an external service layer. The underlying data layer stores identity information and/or device information and/or identity tags and/or device tags and/or first risk values and/or second risk values and/or total risk values. And displaying the identity information and/or the equipment information and/or the identity label and/or the equipment label and/or the first risk value and/or the second risk value and/or the total risk value for the external service layer output.

Example two

Fig. 2 is a block diagram of a wind control system according to a second embodiment of the present invention, and as shown in fig. 2, the wind control system includes:

the service layer is used for analyzing the information to obtain identity information and equipment information of the user, determining a first risk value according to the identity information and the equipment information, and sending the first risk value to the strategy model layer;

the label layer is used for determining the identity label and the equipment label according to the information and sending the identity label and the equipment label to the strategy model layer;

and the strategy model layer is used for analyzing the identity label and the equipment label according to the self-established model to obtain a second risk value and generating a total risk value of the user according to the first risk value and the second risk value.

In a specific implementation manner provided in this embodiment, the service layer is specifically configured to: calling a third-party interface according to the identity information, and determining the risk value of the identity information on each three-party platform;

and generating a first risk value of the user according to the risk values of the three-party platforms.

In a specific implementation manner provided in this embodiment, the label layer is specifically configured to: and classifying the information according to the source and the attribute of the information to obtain an identity tag and an equipment tag.

In a specific implementation manner provided in this embodiment, the wind control system further includes: a basic data layer for storing identity information and/or device information and/or identity tags and/or device tags and/or first risk values and/or second risk values and/or total risk values.

In a specific implementation manner provided in this embodiment, the wind control system further includes: and the external service layer is used for outputting and displaying the identity information and/or the equipment information and/or the identity label and/or the equipment label and/or the first risk value and/or the second risk value and/or the total risk value.

The wind control system provided by the embodiment of the present invention may execute the method steps in the above method embodiments, and the implementation principle and the technical effect are similar, which are not described herein again.

It should be noted that the division of the modules of the above system is only a logical division, and the actual implementation may be wholly or partially integrated into one physical entity, or may be physically separated. And these modules can be realized in the form of software called by processing element; or can be implemented in the form of hardware; and part of the modules can be realized in the form of calling software by the processing element, and part of the modules can be realized in the form of hardware. For example, the determining module may be a separately established processing element, or may be integrated into a chip of the system, or may be stored in a memory of the system in the form of program code, and a processing element of the system calls and executes the function of the determining module. Other modules are implemented similarly. In addition, all or part of the modules can be integrated together or can be independently realized. The processing element described herein may be an integrated circuit having signal processing capabilities. In implementation, each step of the above method or each module above may be implemented by an integrated logic circuit of hardware in a processor element or an instruction in the form of software.

For example, the above modules may be one or more integrated circuits configured to implement the above methods, such as: one or more Application Specific Integrated Circuits (ASICs), or one or more microprocessors (DSPs), or one or more Field Programmable Gate Arrays (FPGAs), etc. For another example, when some of the above modules are implemented in the form of a Processing element scheduler code, the Processing element may be a general-purpose processor, such as a Central Processing Unit (CPU) or other processor that can invoke the program code. As another example, these modules may be integrated together and implemented in the form of a System-on-a-chip (SOC).

In the above embodiments, the implementation may be wholly or partially realized by software, hardware, firmware, or any combination thereof. When implemented in software, may be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When loaded and executed on a computer, cause the processes or functions described in accordance with the embodiments of the application to occur, in whole or in part. The computer may be a general purpose computer, a special purpose computer, a network of computers, or other programmable system. The computer instructions may be stored in a computer readable storage medium or transmitted from one computer readable storage medium to another computer readable storage medium, for example, from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, Digital Subscriber Line (DSL)) or wireless (e.g., infrared, wireless, bluetooth, microwave, etc.) means, the computer readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server, data center, etc. that includes one or more of the available media, which may be magnetic media, (e.g., floppy disks, hard disks, magnetic tape), optical media (e.g., DVD), or semiconductor media (e.g., Solid State Disk (SSD)), etc.

EXAMPLE III

Fig. 3 is a schematic structural diagram of an electronic device according to a third embodiment of the present invention. The electronic device may be the aforementioned pick-up reservation information processing device. As shown in fig. 3, the electronic device 300 may include: a processor 31 (e.g., CPU), a memory 32, a transceiver 33; the transceiver 33 is coupled to the processor 31, and the processor 31 controls the transceiving operation of the transceiver 33. Various instructions may be stored in memory 32 for performing various processing functions and implementing method steps performed by the electronic device of embodiments of the present invention. Preferably, the electronic device according to an embodiment of the present invention may further include: a power supply 34, a system bus 35, and a communication port 36. The system bus 35 is used to implement communication connections between the elements. The communication port 36 is used for connection communication between the electronic device and other peripherals.

The system bus mentioned in fig. 3 may be a Peripheral Component Interconnect (PCI) bus, an Extended Industry Standard Architecture (EISA) bus, or the like. The system bus may be divided into an address bus, a data bus, a control bus, and the like. For ease of illustration, only one thick line is shown, but this does not mean that there is only one bus or one type of bus. The communication interface is used for realizing communication between the database access device and other equipment (such as a client, a read-write library and a read-only library). The Memory may include a Random Access Memory (RAM) and may also include a Non-Volatile Memory (Non-Volatile Memory), such as at least one disk Memory.

The Processor may be a general-purpose Processor, including a central processing unit CPU, a Network Processor (NP), and the like; but also a digital signal processor DSP, an application specific integrated circuit ASIC, a field programmable gate array FPGA or other programmable logic device, discrete gate or transistor logic, discrete hardware components.

Example four

A fourth embodiment of the present invention provides a computer-readable storage medium, which stores instructions that, when executed on a computer, cause the computer to perform the method and process provided in the above embodiments.

EXAMPLE five

An embodiment of the present invention provides a chip for executing instructions, where the chip is configured to execute the method and the processing procedure provided in the foregoing embodiments.

EXAMPLE six

An embodiment of the present invention provides a program product, which includes a computer program, where the computer program is stored in a storage medium, and at least one processor can read the computer program from the storage medium, and the at least one processor executes the method and the processing procedure provided in the above embodiment.

According to the wind control method, on one hand, wind control scoring is carried out based on the information of the user, on the other hand, risk scoring of the user on other platforms is integrated, and accurate risk assessment of the user is achieved.

Those of skill would further appreciate that the various illustrative components and algorithm steps described in connection with the embodiments disclosed herein may be implemented as electronic hardware, computer software, or combinations of both, and that the various illustrative components and steps have been described above generally in terms of their functionality in order to clearly illustrate this interchangeability of hardware and software. Whether such functionality is implemented as hardware or software depends upon the particular application and design constraints imposed on the technical solution. Skilled artisans may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present invention.

The steps of a method or algorithm described in connection with the embodiments disclosed herein may be embodied in hardware, a software module executed by a processor, or a combination of the two. A software module may reside in Random Access Memory (RAM), memory, Read Only Memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

The above-mentioned embodiments are intended to illustrate the objects, technical solutions and advantages of the present invention in further detail, and it should be understood that the above-mentioned embodiments are merely exemplary embodiments of the present invention, and are not intended to limit the scope of the present invention, and any modifications, equivalent substitutions, improvements and the like made within the spirit and principle of the present invention should be included in the scope of the present invention.

Claims

1. A wind control method, characterized in that the wind control method comprises:

2. The wind control method of claim 1, wherein the information comprises: activation information, login information, registration information, payment information.

3. The wind control method according to claim 1, wherein the determining a first risk value according to the identity information and the device information specifically comprises:

4. The wind control method according to claim 1, wherein the determining, by the tag layer, the identity tag and the device tag according to the information specifically comprises:

5. The wind-controlled method of claim 1, wherein the identity tag comprises: order information and city crossing information on the same day; the device tag includes: the device associates user information and payment account information.

6. The wind control method of claim 1, further comprising:

the underlying data layer stores said identity information and/or device information and/or identity tag and/or device tag and/or first risk value and/or second risk value and/or total risk value.

7. The wind control method of claim 1, further comprising:

and displaying the identity information and/or the equipment information and/or the identity label and/or the equipment label and/or the first risk value and/or the second risk value and/or the total risk value to an external service layer output.

8. A wind control system, comprising:

and the strategy model layer is used for analyzing the identity label and the equipment label according to a self-built model to obtain a second risk value and generating a total risk value of the user according to the first risk value and the second risk value.

9. An electronic device, comprising: a memory, a processor, and a transceiver;

the processor is used for being coupled with the memory, reading and executing the instructions in the memory to realize the method steps of any one of claims 1 to 7;

10. A computer-readable storage medium having stored thereon computer instructions which, when executed by a computer, cause the computer to perform the method of any of claims 1-7.