WO2018014811A1 - 风险识别方法、客户端设备及风险识别*** - Google Patents

风险识别方法、客户端设备及风险识别*** Download PDF

Info

Publication number
WO2018014811A1
WO2018014811A1 PCT/CN2017/093179 CN2017093179W WO2018014811A1 WO 2018014811 A1 WO2018014811 A1 WO 2018014811A1 CN 2017093179 W CN2017093179 W CN 2017093179W WO 2018014811 A1 WO2018014811 A1 WO 2018014811A1
Authority
WO
WIPO (PCT)
Prior art keywords
service
data
risk identification
risk
operation request
Prior art date
Application number
PCT/CN2017/093179
Other languages
English (en)
French (fr)
Inventor
夏巨鹏
李才伟
Original Assignee
阿里巴巴集团控股有限公司
夏巨鹏
李才伟
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 阿里巴巴集团控股有限公司, 夏巨鹏, 李才伟 filed Critical 阿里巴巴集团控股有限公司
Priority to JP2019503321A priority Critical patent/JP6731203B2/ja
Priority to EP17830445.7A priority patent/EP3489877A4/en
Priority to SG11201900517UA priority patent/SG11201900517UA/en
Priority to KR1020197005372A priority patent/KR102153840B1/ko
Publication of WO2018014811A1 publication Critical patent/WO2018014811A1/zh
Priority to US16/254,421 priority patent/US11075938B2/en
Priority to US16/722,943 priority patent/US11570194B2/en

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
    • G06Q20/401—Transaction verification
    • G06Q20/4016—Transaction verification involving fraud or risk level assessment in transaction processing
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1433—Vulnerability analysis
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q10/00—Administration; Management
    • G06Q10/06—Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
    • G06Q10/063—Operations research, analysis or management
    • G06Q10/0635—Risk analysis of enterprise or organisation activities
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q10/00—Administration; Management
    • G06Q10/06—Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
    • G06Q10/063—Operations research, analysis or management
    • G06Q10/0637—Strategic management or analysis, e.g. setting a goal or target of an organisation; Planning actions based on goals; Analysis or evaluation of effectiveness of goals
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
    • G06Q20/32—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using wireless devices
    • G06Q20/322—Aspects of commerce using mobile devices [M-devices]
    • G06Q20/3223—Realising banking transactions through M-devices
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
    • G06Q20/405—Establishing or using transaction specific rules
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
    • G06Q20/409—Device specific authentication in transaction processing
    • G06Q20/4093—Monitoring of device authentication
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q30/00—Commerce
    • G06Q30/06—Buying, selling or leasing transactions
    • G06Q30/0601—Electronic shopping [e-shopping]
    • G06Q30/0609—Buyer or seller confidence or verification

Definitions

  • the present application relates to the field of computer technologies, and in particular, to a risk identification method, a client device, and a risk identification system.
  • the centralized processing of the server cluster is usually adopted, and the identification and control of the risk is initiated after the server receives the data.
  • This approach requires a large amount of server resources to store, calculate, and analyze data, and the computational cost and hardware cost of the server cluster are very expensive.
  • the embodiment of the present invention provides a risk identification method, which aims to solve the problem that the cost of the server is too high in the prior art, reduces the cost of the server, and reduces the storage cost of the risk identification and control.
  • the embodiment of the present application further provides a client device, which solves the problem that the cost of the server is too high in the prior art, reduces the cost to the server, and reduces the storage cost of the risk identification and control.
  • the embodiment of the present application further provides a risk identification system, which solves the problem that the cost of the server is too high in the prior art, reduces the cost to the server, and reduces the storage cost and calculation and analysis cost of the risk identification and control.
  • the embodiment of the present application further provides a second risk identification system, which is to solve the prior art service.
  • the problem of excessive cost of the transaction reduces the cost of the server and reduces the storage cost of risk identification and control.
  • the embodiment of the present application further provides a third type of risk identification system, which solves the problem that the cost of the server is too high in the prior art, reduces the cost to the server, and reduces the storage cost of the risk identification and control.
  • the embodiment of the present application provides a risk identification method, including:
  • the client receives a risk identification request initiated according to the service operation request, where the service operation request includes service data;
  • the client acquires service data corresponding to the risk identification request
  • the embodiment of the present application further provides a client device, including:
  • the request receiving module receives a risk identification request initiated according to the service operation request, where the service operation request includes service data;
  • a data acquisition module which acquires service data corresponding to the risk identification request
  • An indicator storage module configured to store service indicator data determined according to the service data
  • the risk identification module determines whether the service operation request has a risk according to the service data and/or the service indicator data based on the risk identification rule or the risk identification model.
  • the embodiment of the present application further provides a risk identification system, including
  • the service indicator data stored in the client device is received through the data channel.
  • the embodiment of the present application further provides a second risk identification system, including
  • the third embodiment of the present application further provides a third risk identification system, including
  • the embodiment of the present application determines the service indicator data according to the original service data, and stores the service indicator data in the client.
  • the advantage is that: on the one hand, the service for risk identification is used.
  • the indicator data is stored on the client, which can reduce the storage cost of the server; on the other hand, the original data of the huge amount of data is converted into the business indicator data for storage, which also reduces the overall storage cost, even if the business indicator data is synchronized to The server performs storage, and the storage cost to the server is also lower than the prior art.
  • 1 is a typical system to which the risk identification method of the present application is applied;
  • FIG. 2 is a schematic flowchart of a risk identification method according to an embodiment of the present application.
  • FIG. 3 is a schematic structural diagram of a risk identification device according to an embodiment of the present application.
  • FIG. 4 is a schematic structural diagram of a second risk identification device according to an embodiment of the present application.
  • FIG. 5 is a schematic structural diagram of a risk identification system according to an embodiment of the present application.
  • FIG. 6 is a schematic structural diagram of a second risk identification system in an embodiment of the present application.
  • FIG. 7 is a schematic structural diagram of a third risk identification system in an embodiment of the present application.
  • FIG. 8 is a schematic structural diagram of a fourth risk identification system in the embodiment of the present application.
  • the system is constructed as shown in FIG. 1.
  • the system includes a client and a server, and the client and the server synchronize data through a data channel.
  • a risk identification method provided by the present application includes the following steps, as shown in FIG. 2:
  • S101 The client receives a risk identification request initiated according to the service operation request, where the service operation request includes service data.
  • S102 The client obtains service data corresponding to the risk identification request.
  • the service operation request is usually initiated by the user.
  • the client After the client receives the service operation request, if the service operation request belongs to a more risky operation type, the client starts the risk identification program and initiates the risk identification request.
  • the client can identify the request according to the risk, and can The business data corresponding to the risk identification request is obtained, specifically, the business data is extracted from the business operation request associated with the risk identification request.
  • the payment request belongs to a highly risky operation type. Therefore, the client starts the risk identification program, and extracts service data related to the payment service from the payment request, such as the login information of the user and the user's use.
  • this part of the original business data often needs to be sent to the server, and stored in the server for risk identification and control.
  • the identification of the risk can be realized without storing the part of the original business data to the server.
  • the original service data may also be sent to the server for storage or retained on the client for storage when the service operation request is completed, the network is idle, or the server storage space is sufficient. Does not affect the implementation of the technical effects of the present application.
  • S103 Determine, according to the service identification data or the service indicator data stored in the client, whether the risk exists in the business operation request based on the risk identification rule or the risk identification model; wherein the service indicator data is determined according to the service data.
  • the calculation step of calculating the service indicator data according to the service data, and the step of analyzing and judging according to the service data and/or the service indicator data are involved.
  • the above calculation steps may be performed on the client side or on the server side; the steps of the above analysis and judgment may be performed on the client side or on the server side.
  • Different calculation methods and contents in the calculation step can be calculated simultaneously on the client or the server, or part of the calculation on the client side, and part of the calculation on the server side; the different analysis contents and the judgment process in the analysis and judgment step can be simultaneously
  • the client or the server performs the part, and the part is performed on the client side, and the part is performed on the server side, which is not limited herein. Taking the embodiment shown in FIG. 8 as an example, data storage and calculation can be performed in the client device, and analysis and processing are performed in the server device.
  • a series of statistical calculations can be performed.
  • the result of these calculations is the business indicator data
  • the business indicator data can represent the historical situation of the business operation request corresponding to the business data within a certain period of time.
  • a series of statistical values of the data generated by the business operation request in a predetermined time window may be calculated, for example, may be a count value (COUNT) of an amount, time, etc., a sum value (SUM), a start value (FIRST), End value (LAST), difference value (DISTINCT), average value (AVG), standard deviation (STDEV), variance (VAR), maximum value (MAX) and / or minimum value (MIN), etc.
  • the time window can be 1 hour , 12 hours, 7 days, etc.
  • calculating "COUNT, 1 hour payment success” means counting the number of successful payment of the client device and the account in the last hour, wherein the information of the client device and the information of the account may be from the business data extracted from the business operation request.
  • calculating "SUM, 24 hour payment amount” means counting the total amount of client device and account payment success amount in the last 24 hours, wherein the client device information, the payment account information, and each time within 24 hours. Information such as the amount of successful payment (related to the business operation request within 24 hours) may be derived from the business data extracted from the business operation request.
  • the first manner is that the original service data of the preset time window can be stored, and the corresponding original service data is invoked when the service indicator data is calculated;
  • the original business data of the historical history is stored.
  • the original business indicator data is recalculated according to the new business data, and the business indicator data is updated, for example, the "COUNT, 1 hour payment success" item is calculated.
  • the indicator is used, the data of the indicator can be updated over time and every successful payment.
  • the second method is better from the perspective of reducing storage costs.
  • the frequency characteristic of the service operation request and/or the running environment characteristic of the client may be calculated, and the running environment characteristic of the client may be embodied as a software environment and a hardware environment run by the client.
  • the frequency at which the client device performs the payment operation can be calculated (which can also be converted to the number of times the computing client device performs the payment operation in the preset time window). Calculate the frequency of the payment operation of an account in the client device, and calculate the attenuation level of the battery of the client device.
  • the foregoing service indicator data is calculated according to the service data.
  • the calculation process may be performed on the client side or on the server side. If the client performs the calculation of the service indicator data, the client calculates the service indicator data according to the service data, and further, the client reports the calculated service indicator data to the server through the data channel; and the server correspondingly The service indicator data calculated by the client according to the service data is received through the data channel. The calculation of the client can reduce the computational cost of the server. After the calculation is completed in the client, the service indicator data is stored in the client, and can also be reported to the server through the data channel to implement the server. Synchronize with the data of the client on the business indicator data.
  • the client first reports the service data to the server through the data channel, and then the client receives the service indicator data calculated by the server according to the service data through the data channel; correspondingly, the service The service end receives the service data reported by the client through the data channel, and the server calculates the service indicator data according to the service data, and then the server sends the service indicator data to the client through the data channel.
  • the client does not need to calculate the business indicator data, which is beneficial to simplify the design of the client, and the client can receive the service indicator data calculated by the server through the data channel, and also implement the service indicator data of the client and the server.
  • the data is synchronized.
  • step S103 based on the risk identification rule or the risk identification model, based on the service data and/or the service indicator data stored in the client, determining whether the service operation request has a risk, the client may directly directly access the service data and/or the service indicator data. Perform a logic analysis and/or a probability analysis to determine whether the business operation request is at risk based on the results of the logic analysis and/or the probability analysis.
  • the use of such a client for analysis can timely discover abnormal business operation requests, and better achieve the purpose of identifying risks and preventing risks. details as follows:
  • the client logically divides the business data and/or business indicator data. Analysis, based on the results of the logical analysis to determine whether the business operation request is at risk; or
  • the client Based on the risk identification model, the client performs logical analysis and/or probability analysis on the business data and/or the business indicator data, and determines whether the business operation request is at risk according to the result of the logic analysis and/or the probability analysis.
  • the client can also receive the result of logical analysis and/or probability analysis of the service data and/or service indicator data by the server through the data channel, and then determine the service operation request according to the result of the logic analysis and/or the probability analysis. Is there a risk? If there is no information about the service data or the service indicator data in the server, the client needs to send the service data and/or the service indicator data to the server through the data channel before receiving the analysis result of the server.
  • the method of sending data to the server for analysis is beneficial to simplify the design of the client, and the client can identify the risk according to the conclusion drawn by the server. details as follows:
  • the client receives the result of logical analysis of the service data and/or the service indicator data by the server through the data channel, or determines whether the service operation request has a risk result according to the result of the logic analysis; or
  • the client receives the result of logical analysis and/or probability analysis of the service data and/or the service indicator data by the server through the data channel, or determines whether the service operation request exists according to the result of the logic analysis and/or the probability analysis.
  • the result of risk is the result of risk.
  • the risk identification model When performing probability analysis on business data and/or business indicator data, it can be realized by calling the risk identification model, and the output is a risk probability and a risk-free probability, and the risk can be determined according to the probability.
  • Logical analysis of business data and/or business metrics data can be accomplished by invoking business data and/or business metrics data, as well as pre-defined risk identification rules or risk identification models.
  • a risk identification rule can be understood as a logical expression, and a preset correspondence between a state value (true or false) of the logical expression and a conclusion of whether or not there is a risk.
  • the business data and/or the business indicator data can be understood as a band. Enter the specific value of the above logical expression.
  • Example 1 A preset one
  • the risk identification rules are:
  • the value of “current amount” comes from the current business operation request to be judged whether there is risk, that is, the current business data; the values of “accumulated amount of the day” and “accumulated payment amount of 7 days” are derived from the business indicators. Data, this rule uses both business data and business metrics data for analysis.
  • the logical state (current amount + accumulated amount of the day ⁇ 200) AND (7-day cumulative payment amount > 1w) is the determined status value of true or false.
  • Example 2 The default risk identification rule is:
  • Example 3 The default risk identification rule is:
  • the values of “accumulated amount of the day”, “number of payments within one hour”, and “variance of payment amount within one hour” are derived from the business indicator data, and this rule only performs logical analysis based on the business indicator data.
  • the output of the logical expression is preset to "true” in the above rule, it indicates that the business operation request is risky.
  • the logic analysis or probability analysis is used for whether or not there is risk.
  • Risk identification rules, risk-free lists, and/or risk identification models can all belong to configuration data, and business indicator update data can also belong to one type of configuration data.
  • the configuration data can be delivered by the server through the data channel, and the client receives and stores the configuration data, which is used to combine with the service data and/or the service indicator data to determine whether the service operation request is at risk. These configuration data can also be obtained by the client itself.
  • the preferred embodiment is that the client and the server synchronize data synchronously or irregularly, and store data including service indicator data, service indicator update data, risk identification rules, risk-free list, and risk identification model on the server and the client at the same time. end.
  • the network communication PUSH mode may be adopted, that is, the server notifies the client of the communication mode; at this time, when the server finds that the data stored by the client needs to be updated, the server actively informs the client to update the data, where the data includes Synchronized various types of data.
  • the network communication PULL mode can also be adopted, that is, the client pulls the communication mode of the server data; at this time, when the client receives the notification of the server or the local storage of the client needs to be updated, the client will actively go to the server to obtain the updated data.
  • the method of the present application further includes: determining a processing manner of the service operation request according to whether the risk operation result of the risk exists according to the service operation request.
  • the client directly performs the operation of the business operation request. If the business operation request is at risk, the operation authority of the business operation request needs to be restricted. Specifically, if the business operation request is at risk, the client directly limits the operation authority of the business operation request.
  • the client receives a request from the server to restrict the operation authority of the business operation request through the data channel, and further restricts the operation authority of the business operation request.
  • the limitation of the operation authority of the service operation request may be released after the risk is excluded, which includes: if the release risk check for the release risk check request feedback is received Information, the restriction on the operation authority of the business operation request is released; wherein the release of the risk verification request can be performed by the client Or the server sends out.
  • the application also provides a client device, as shown in FIG. 3, including:
  • the request receiving module 101 receives a risk identification request initiated according to a service operation request, where the service operation request includes service data;
  • the data obtaining module 102 acquires service data corresponding to the risk identification request
  • the indicator storage module 103 stores service indicator data determined according to the service data
  • the risk identification module 105 determines whether the business operation request has a risk based on the service data and/or the service indicator data based on the risk identification rule or the risk identification model.
  • the client device may further include:
  • the configuration data storage module 104 receives and stores configuration data synchronized through the data channel; the configuration data is used in combination with the service data and/or the service indicator data to determine whether the service operation request is at risk.
  • configuration data storage module 104 includes:
  • the rule storage unit 1041 stores a risk identification rule for determining whether the business operation request has a risk
  • the list storage unit 1042 stores information related to hardware environment information of the client device, software environment information, and/or account information in the client device;
  • the model storage unit 1043 stores a risk identification model for analyzing whether a business operation request is at risk.
  • the risk identification module 105 may specifically include:
  • the calculating unit 1051 calculates the service indicator data according to the service data.
  • the risk identification module 105 may specifically include:
  • the analyzing unit 1052 performs logical analysis and/or probability analysis on the service data and/or the service indicator data based on the risk identification rule or the risk identification model, and determines whether the business operation request has a risk according to the result of the logic analysis and/or the probability analysis.
  • the client device may further include:
  • the processing module 107 determines the processing manner of the service operation request according to whether the risk operation result of the risk exists according to the service operation request.
  • FIG. 4 is a schematic structural diagram of a preferred embodiment of a client device, where the device includes a request receiving module 101, a data obtaining module 102, an indicator storage module 103, a configuration data storage module 104, a risk identification module 105, and a processing module. 107.
  • the processing module 107 relies on the risk identification module 105.
  • the risk identification module 105 relies on the indicator storage module 102 and the configuration data storage module 104.
  • the indicator storage module 102 relies on the data acquisition module 101, and the configuration data storage module 104 relies on the data channel.
  • the risk identification module 105 specifically, the calculating unit 1051 and the analyzing unit 1052 are included.
  • the calculating unit 1051 may specifically include a statistical calculation subunit and a feature calculation subunit for performing statistical calculation and feature calculation, respectively.
  • the analyzing unit 1052 may specifically include a probability analysis subunit and a logic analysis subunit for performing probability analysis and logic analysis, respectively.
  • the principles and implementations of statistical calculations, feature calculations, probabilistic analysis, and logic analysis have been described in detail in the foregoing description of the embodiments of the risk identification method, and are not described herein.
  • the client device constructed in this way will be executed by the client based on the acquisition, storage, calculation and analysis of the original business data, realizing the data-based risk prevention and control, reducing the number of interactions with the server and the data size. , thereby reducing the cost of server-side risk identification and processing.
  • the user can sense and process it in time when the business operation is abnormal, achieving the purpose of risk prevention and control.
  • the data analysis on the client side concludes that there is a risk, and it also solves the problem of flexible calculation of complex data.
  • Obtaining configuration data including service indicator update data, risk identification rules, risk-free list, and risk identification model from the server through the data channel can better ensure the recognition ability of the client itself for calculation and analysis.
  • FIG. 5 shows a risk identification system, including a client device and a service, according to an embodiment of the present application.
  • Terminal equipment wherein
  • Client devices include:
  • the request receiving module receives the risk identification request initiated according to the service operation request, and the service operation request includes the service data;
  • a data acquisition module which acquires service data corresponding to the risk identification request
  • the indicator storage module stores the service indicator data determined according to the service data
  • the risk identification module determines whether the business operation request is at risk according to the service data and/or the service indicator data stored in the client device;
  • the server device includes:
  • the issuing module sends a risk identification rule or a risk identification model for determining whether the business operation request is risky to the client device through the data channel;
  • the receiving module receives the service indicator data stored in the client device through the data channel.
  • the client completes a series of operations from the acquisition, calculation, storage, analysis, and processing of business data.
  • the storage engine is configured to store data, including service indicator data obtained by the client for calculating the service data (stored in the indicator storage module), and the client obtains the data from the management background (corresponding to the server) through the data channel.
  • the rules corresponding to the aforementioned risk identification rules, stored in the rule storage module
  • the list corresponding to the aforementioned risk-free list, stored in the list storage module
  • the model corresponding to the aforementioned risk identification model, Into the model storage module).
  • the client starts the calculation engine to perform statistical calculation and feature calculation, and stores the calculation result, that is, the service indicator data, into the indicator storage module, and synchronizes the service indicator data to the management background through the data channel.
  • the analysis engine performs probability analysis and/or logic analysis on the business data and/or the business indicator data based on the risk identification rule or the risk identification model, and determines whether the business operation request exists in the wind according to the analysis result. risk.
  • the processing engine may be processed by the processing engine according to the result of the risk identification, including a freeze processing (corresponding to the operation authority for restricting the business operation request) and a solution processing (and releasing the operation authority for the business operation request) The corresponding restrictions).
  • FIG. 6 shows a second risk identification system according to an embodiment of the present application, including a client device and a server device, where
  • Client devices include:
  • the request receiving module receives the risk identification request initiated according to the service operation request, and the service operation request includes the service data;
  • a data acquisition module which acquires service data corresponding to the risk identification request
  • the indicator storage module stores the service indicator data determined according to the service data
  • a result receiving module receiving, by the data channel, a result of whether the service operation request determined by the server device has a risk
  • the server device includes:
  • the receiving module receives the service indicator data stored in the client device through the data channel;
  • the risk identification module determines whether the business operation request has a risk according to the service data and/or the service indicator data stored in the client device; wherein the service indicator data is determined according to the service data;
  • the sending module sends a result of the risk of the service operation request determined by the server device to the client device through the data channel.
  • the client device only includes the storage engine, and the computing engine, the analysis engine, and the processing engine are all implemented by the server device, which is beneficial to simplifying the client and reducing the client SDK (software development tool).
  • the size of the package reduces integration costs and avoids problems such as excessive installation packages.
  • FIG. 7 shows a third risk identification system, including a client device, in an embodiment of the present application, Cloud risk identification device and server device, wherein
  • Client devices include:
  • the request receiving module receives the risk identification request initiated according to the service operation request, and the service operation request includes the service data;
  • a data acquisition module which acquires service data corresponding to the risk identification request
  • the indicator storage module stores the service indicator data determined according to the service data
  • a result receiving module receiving, by the data channel, a result of whether the service operation request determined by the cloud risk identification device is at risk
  • Cloud risk identification devices include:
  • the risk identification module determines whether the business operation request has a risk according to the service data and/or the service indicator data stored in the client device; wherein the service indicator data is determined according to the service data;
  • the server device includes:
  • the receiving module receives the service indicator data stored in the client device through the data channel;
  • the sending module sends the service indicator data to the cloud risk identification device, and sends the risk identification rule or the risk identification model to the cloud risk identification device.
  • the server is divided into a cloud risk identification device and a server device, which further reduces the calculation and analysis pressure of the server device and reduces the cost of the server.
  • embodiments of the present invention can be provided as a method, system, or computer program product. Accordingly, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or a combination of software and hardware. Moreover, the present invention can employ a computer program product embodied on one or more computer usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) having computer usable program code embodied therein. form.
  • computer usable storage media including but not limited to disk storage, CD-ROM, optical storage, etc.
  • the computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture comprising the instruction device.
  • the apparatus implements the functions specified in one or more blocks of a flow or a flow and/or block diagram of the flowchart.
  • These computer program instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce computer-implemented processing for execution on a computer or other programmable device.
  • the instructions provide steps for implementing the functions specified in one or more of the flow or in a block or blocks of a flow diagram.
  • a computing device includes one or more processors (CPUs), input/output interfaces, network interfaces, and memory.
  • processors CPUs
  • input/output interfaces network interfaces
  • memory volatile and non-volatile memory
  • the memory may include non-persistent memory, random access memory (RAM), and/or non-volatile memory in a computer readable medium, such as read only memory (ROM) or flash memory.
  • RAM random access memory
  • ROM read only memory
  • Memory is an example of a computer readable medium.
  • Computer readable media includes both permanent and non-persistent, removable and non-removable media.
  • Information storage can be implemented by any method or technology.
  • Information can be computer readable instructions, data knots Structure, program module or other data.
  • Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read only memory. (ROM), electrically erasable programmable read only memory (EEPROM), flash memory or other memory technology, compact disk read only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, Magnetic tape cartridges, magnetic tape storage or other magnetic storage devices or any other non-transportable media can be used to store information that can be accessed by a computing device.
  • computer readable media does not include temporary storage of computer readable media, such as modulated data signals and carrier waves.
  • embodiments of the present application can be provided as a method, system, or computer program product.
  • the present application can take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment in combination of software and hardware.
  • the application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) including computer usable program code.

Landscapes

  • Business, Economics & Management (AREA)
  • Engineering & Computer Science (AREA)
  • Accounting & Taxation (AREA)
  • Strategic Management (AREA)
  • General Physics & Mathematics (AREA)
  • General Business, Economics & Management (AREA)
  • Physics & Mathematics (AREA)
  • Theoretical Computer Science (AREA)
  • Human Resources & Organizations (AREA)
  • Computer Security & Cryptography (AREA)
  • Finance (AREA)
  • Economics (AREA)
  • Entrepreneurship & Innovation (AREA)
  • Development Economics (AREA)
  • Marketing (AREA)
  • Educational Administration (AREA)
  • Game Theory and Decision Science (AREA)
  • Tourism & Hospitality (AREA)
  • Quality & Reliability (AREA)
  • Operations Research (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Signal Processing (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)
  • Computer And Data Communications (AREA)
  • Information Transfer Between Computers (AREA)
  • Information Retrieval, Db Structures And Fs Structures Therefor (AREA)

Abstract

本申请公开了一种风险识别方法，包括：客户端接收依据业务操作请求发起的风险识别请求，业务操作请求中包含有业务数据(S101)；客户端获取与风险识别请求相对应的业务数据(S102)；基于风险识别规则或风险识别模型，依据业务数据和/或存储在客户端的业务指标数据，确定业务操作请求是否存在风险；其中，业务指标数据依据业务数据确定(S103)。本申请还公开了一种风险识别设备，包括数据获取模块、指标存储模块和风险识别模块。本申请还公开了一种风险识别***，包括客户端设备和服务端设备，或者客户端设备、服务端设备和云端风险识别设备。本申请解决了现有技术中服务端成本过高的问题，减少了对服务端的耗费，降低了风险识别与控制的存储成本。

Description

风险识别方法、客户端设备及风险识别*** 技术领域
本申请涉及计算机技术领域，尤其涉及一种风险识别方法、客户端设备及风险识别***。
背景技术
随着互联网金融行业的快速发展，各类业务、产品、交易类型越来越多，由此产生的业务风险也越来越高，为此，需要对互联网业务的风险进行控制。
现有的风险控制***中，通常采用服务端集群集中式处理的方式，由服务端收到数据后启动风险的识别和控制。这种方式需要消耗大量的服务端资源来进行数据的存储、计算和风险分析，耗费的计算成本和服务器集群的硬件成本都非常昂贵。
发明内容
本申请实施例提供了一种风险识别方法，目的在于解决现有技术中服务端成本过高的问题，减少了对服务端的耗费，降低了风险识别与控制的存储成本。
本申请实施例还提供了一种客户端设备，在于解决现有技术中服务端成本过高的问题，减少了对服务端的耗费，降低了风险识别与控制的存储成本。
本申请实施例还提供了一种风险识别***，在于解决现有技术中服务端成本过高的问题，减少了对服务端的耗费，降低了风险识别与控制的存储成本和计算分析成本。
本申请实施例还提供了第二种风险识别***，在于解决现有技术中服 务端成本过高的问题，减少了对服务端的耗费，降低了风险识别与控制的存储成本。
本申请实施例还提供了第三种风险识别***，在于解决现有技术中服务端成本过高的问题，减少了对服务端的耗费，降低了风险识别与控制的存储成本。
本申请实施例采用下述技术方案：
本申请实施例提供了一种风险识别方法，包括：
客户端接收依据业务操作请求发起的风险识别请求，所述业务操作请求中包含有业务数据；
所述客户端获取与所述风险识别请求相对应的业务数据；
基于风险识别规则或风险识别模型，依据所述业务数据和/或存储在所述客户端的业务指标数据，确定所述业务操作请求是否存在风险；其中，所述业务指标数据依据所述业务数据确定。
本申请实施例还提供了一种客户端设备，包括：
请求接收模块，接收依据业务操作请求发起的风险识别请求，所述业务操作请求中包含有业务数据；
数据获取模块，获取与所述风险识别请求相对应的业务数据；
指标存储模块，存储依据所述业务数据确定的业务指标数据；
风险识别模块，基于风险识别规则或风险识别模型，依据所述业务数据和/或所述业务指标数据，确定所述业务操作请求是否存在风险。
本申请实施例还提供了一种风险识别***，包括，
客户端设备：
接收依据业务操作请求发起的风险识别请求，所述业务操作请求中包含有业务数据；
获取与所述风险识别请求相对应的业务数据；
基于风险识别规则或风险识别模型，依据所述业务数据和/或存储在所述客户端设备的业务指标数据，确定所述业务操作请求是否存在风险；其中，所述业务指标数据依据所述业务数据确定；
服务端设备：
通过数据通道向所述客户端设备下发用于确定所述业务操作请求是否存在风险的所述风险识别规则或所述风险识别模型；
通过所述数据通道接收存储在所述客户端设备的业务指标数据。
本申请实施例还提供了第二种风险识别***，包括，
客户端设备：
接收依据业务操作请求发起的风险识别请求，所述业务操作请求中包含有业务数据；
获取与所述风险识别请求相对应的业务数据；
通过数据通道接收服务端设备确定的所述业务操作请求是否存在风险的结果；
服务端设备：
通过所述数据通道接收存储在所述客户端设备的业务指标数据；
基于风险识别规则或风险识别模型，依据所述业务数据和/或存储在所述客户端设备的业务指标数据，确定所述业务操作请求是否存在风险；其中，所述业务指标数据依据所述业务数据确定；
通过数据通道向所述客户端设备发送由所述服务端设备确定的所述业务操作请求是否存在风险的结果。
本申请实施例还提供了第三种风险识别***，包括，
客户端设备：
接收依据业务操作请求发起的风险识别请求，所述业务操作请求中包含有业务数据；
获取与所述风险识别请求相对应的业务数据；
通过数据通道接收由云端风险识别设备确定的所述业务操作请求是否存在风险的结果；
云端风险识别设备：
基于风险识别规则或风险识别模型，依据所述业务数据和/或存储在所述客户端设备的业务指标数据，确定所述业务操作请求是否存在风险；其中，所述业务指标数据依据所述业务数据确定；
服务端设备：
通过所述数据通道接收存储在所述客户端设备的业务指标数据；
向所述云端风险识别设备发送所述业务指标数据；
向所述云端风险识别设备发送所述风险识别规则或所述风险识别模型。
本申请实施例采用的上述至少一个技术方案能够达到以下有益效果：
在存储用于风险识别的数据时，本申请实施例依据原始的业务数据确定出业务指标数据，并将业务指标数据存储在客户端中，好处在于：一方面，将用于进行风险识别的业务指标数据存储在客户端，可以降低服务端的存储成本；另一方面，将数据量巨大的原始业务数据转化为业务指标数据进行存储，也降低了整体的存储成本，即使将业务指标数据也同步到服务端进行存储，对服务端的存储耗费也低于现有技术。
附图说明
此处所说明的附图用来提供对本申请的进一步理解，构成本申请的一部分，本申请的示意性实施例及其说明用于解释本申请，并不构成对本申 请的不当限定。在附图中：
图1为本申请的风险识别方法所应用的典型***；
图2为本申请实施例中一种风险识别方法的流程示意图；
图3为本申请实施例中一种风险识别设备的结构示意图；
图4为本申请实施例中第二种风险识别设备的结构示意图；
图5为本申请实施例中的一种风险识别***的架构示意图；
图6为本申请实施例中的第二种风险识别***的架构示意图；
图7为本申请实施例中的第三种风险识别***的架构示意图；
图8为本申请实施例中的第四种风险识别***的架构示意图。
具体实施方式
为使本申请的目的、技术方案和优点更加清楚，下面将结合本申请具体实施例及相应的附图对本申请技术方案进行清楚、完整地描述。显然，所描述的实施例仅是本申请一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本申请保护的范围。
以下结合附图，详细说明本申请各实施例提供的技术方案。
在本申请实施例的一次典型实现中，***构建如图1所示，***包括客户端和服务端，客户端与服务端之间通过数据通道同步数据。
本申请提供的一种风险识别方法，包括以下步骤，参见图2所示：
S101：客户端接收依据业务操作请求发起的风险识别请求，业务操作请求中包含有业务数据；
S102：客户端获取与风险识别请求相对应的业务数据；
在实际实施中，通常由用户发起业务操作请求，客户端接收到该业务操作请求后，若该业务操作请求属于风险性较高的操作类型，则客户端启动风险识别程序，发起风险识别请求。客户端依据该风险识别请求，可以 获取到与该风险识别请求相对应的业务数据，具体地，为从与该风险识别请求相关联的业务操作请求中提取业务数据。以用户发起支付请求为例，支付请求属于风险性较高的操作类型，因此，客户端启动风险识别程序，从支付请求中提取与支付业务有关的业务数据，例如用户的登录信息、用户所使用客户端的硬件环境信息和/或软件环境信息、拟支付的账号信息和/或密码信息、当前付款金额、收款人信息等。
在现有技术中，这部分原始的业务数据往往需要发往服务端，并存储在服务端中进行风险的识别与控制。在本申请的实施例中，无需将这部分原始的业务数据存储到服务端即可实现对风险的识别。当然，若出于数据备份的考虑，也可以在完成该项业务操作请求、网络空闲、或者服务器存储空间充足等情况下将原始的业务数据也发往服务端进行存储或保留在客户端进行存储，并不影响本申请技术效果的实现。
S103：基于风险识别规则或风险识别模型，依据业务数据和/或存储在客户端的业务指标数据，确定业务操作请求是否存在风险；其中，业务指标数据依据业务数据确定。
在执行步骤S103确定业务操作请求是否存在风险的过程中，涉及到依据业务数据计算业务指标数据的计算步骤，以及依据业务数据和/或业务指标数据进行分析判断的步骤。上述计算步骤，可以在客户端进行，也可以在服务端进行；上述分析判断的步骤，可以在客户端进行，也可以在服务端进行。计算步骤中的不同计算方式和内容，可以同时在客户端或服务端进行计算，也可以一部分在客户端计算，一部分在服务端计算；分析判断步骤中的不同分析内容和判断过程，可以同时在客户端或服务端进行，也可以一部分在客户端进行，一部分在服务端进行，在此不作限定。以图8所示实施例为例，可以在客户端设备中进行数据存储和计算，而在服务端设备中进行分析和处理，
依据业务数据，可以进行一系列的统计计算，这些计算的结果即为业务指标数据，这些业务指标数据可以表征与业务数据相对应的业务操作请求在一定时间段内的历史情况。具体地，可以计算业务操作请求产生的数据在预定时间窗口的一系列统计值，例如，可以是金额、时间等的计数值(COUNT)、加和值(SUM)、起始值(FIRST)、终止值(LAST)、区别值(DISTINCT)、平均值(AVG)、标准差(STDEV)、方差(VAR)、最大值(MAX)和/或最小值(MIN)等，时间窗口可以是1小时，12小时，7天等。例如，计算“COUNT，1小时支付成功”表示统计最近1小时客户端设备及账户成功支付的次数，其中，客户端设备的信息及账户的信息可以来自于从业务操作请求中提取的业务数据。再例如，计算“SUM，24小时支付的金额”表示统计最近24小时内客户端设备及账户支付成功额金额的总数，其中，客户端设备的信息、支付账户的信息、以及24小时内每次成功支付的金额(与24小时内的业务操作请求有关)等信息可以来自于业务操作请求中提取的业务数据。本领域技术人员可以理解到，在具体实施时，第一种方式是可以存储预设时间窗口的原始业务数据，在计算业务指标数据时调用相对应的原始业务数据；第二种方式是可以不存储历史的原始业务数据，每当有新的业务数据产生时，依据新的业务数据对原业务指标数据进行重新计算，更新业务指标数据，例如，计算“COUNT，1小时支付成功”这一项指标时，可以随着时间推移以及每一次成功支付更新该项指标的数据。从降低存储耗费的角度而言，第二种方式更优。
依据业务数据，也可以进行一系列的特征计算，这些计算的结果即为业务指标数据。具体地，可以计算业务操作请求出现的频率特性和/或客户端的运行环境特性，客户端的运行环境特性，可以具体化为客户端运行的软件环境、硬件环境等。例如，可以计算客户端设备执行支付操作的频率(也可转化为计算客户端设备在预设时间窗口执行支付操作的次数)，计 算客户端设备中某一账户执行支付操作的频率，可以计算客户端设备电池的衰减程度等。
需要说明的是，上述业务指标数据是依据业务数据计算得出的，在具体实施时，这一计算过程可以在客户端进行，也可以在服务端进行。若在客户端进行业务指标数据的计算，则客户端依据业务数据，计算得到业务指标数据，更进一步地，客户端将计算得到的业务指标数据通过数据通道上报至服务端；而服务端相应地通过数据通道接收客户端依据业务数据计算得到的业务指标数据。采用这种在客户端中进行计算的方式可以降低服务端的计算耗费，在客户端中计算完毕后，将业务指标数据存储在客户端中，并且还可以通过数据通道上报至服务端，实现服务端与客户端在业务指标数据上的数据同步。若在服务端进行业务指标数据的计算，则客户端先将业务数据通过数据通道上报至服务端，然后客户端通过数据通道接收服务端依据业务数据计算得到的业务指标数据；相对应地，服务端通过数据通道接收客户端上报的业务数据，服务端依据业务数据，计算得到业务指标数据，然后服务端通过数据通道将业务指标数据发送到客户端。采用这种方式无需客户端进行业务指标数据的计算，有利于简化客户端的设计，并且客户端可以通过数据通道接收服务端计算得到的业务指标数据，同样实现了客户端与服务端在业务指标数据上的数据同步。
在执行步骤S103，基于风险识别规则或风险识别模型，依据业务数据和/或存储在客户端的业务指标数据，确定业务操作请求是否存在风险时，客户端可以直接对业务数据和/或业务指标数据进行逻辑分析和/或概率分析，依据逻辑分析和/或概率分析的结果确定业务操作请求是否存在风险。采用这种客户端进行分析的方式可以及时地发现异常的业务操作请求，更好地达到识别风险、防控风险的目的。具体如下：
基于风险识别规则，客户端对业务数据和/或业务指标数据进行逻辑分 析，依据逻辑分析的结果确定业务操作请求是否存在风险；或者
基于风险识别模型，客户端对业务数据和/或业务指标数据进行逻辑分析和/或概率分析，依据逻辑分析和/或概率分析的结果确定业务操作请求是否存在风险。
除此之外，客户端也可以通过数据通道接收服务端对业务数据和/或业务指标数据进行逻辑分析和/或概率分析的结果，再依据逻辑分析和/或概率分析的结果确定业务操作请求是否存在风险。假若服务端中没有关于业务数据或者业务指标数据的信息，则客户端在接收服务端的分析结果之前，还需将业务数据和/或业务指标数据通过数据通道发送到服务端。采用将数据发送到服务端进行分析的方式，有利于简化客户端的设计，客户端依据服务端分析得出的结论识别风险即可。具体如下：
基于风险识别规则，客户端通过数据通道接收服务端对业务数据和/或业务指标数据进行逻辑分析的结果，或依据逻辑分析的结果确定业务操作请求是否存在风险的结果；或者
基于风险识别模型，客户端通过数据通道接收服务端对业务数据和/或业务指标数据进行逻辑分析和/或概率分析的结果，或依据逻辑分析和/或概率分析的结果确定业务操作请求是否存在风险的结果。
在对业务数据和/或业务指标数据进行概率分析时，可以通过调用风险识别模型实现，输出为有风险的概率和无风险的概率，可以依据概率的高低确定是否存在风险。
对业务数据和/或业务指标数据进行逻辑分析，可以通过调用业务数据和/或业务指标数据、以及预设的风险识别规则或风险识别模型来实现。风险识别规则可以理解为是一逻辑表达式，以及预设的该逻辑表达式的状态值(true或false)与是否存在风险的结论的对应关系，业务数据和/或业务指标数据可以理解为带入上述逻辑表达式的具体数值。例1：预设的一条 风险识别规则为：
(当前金额+当天累计金额<200)AND(7天累计支付金额>1w):无风险
上述风险识别规则中，“当前金额”的数值来自于当前待判断是否存在风险的业务操作请求，即当前的业务数据；“当天累计金额”和“7天累计支付金额”的数值来自于业务指标数据，此条规则同时使用业务数据和业务指标数据进行分析。逻辑表达式(当前金额+当天累计金额<200)AND(7天累计支付金额>1w)的输出为true或false的确定状态值，上述规则中预设该逻辑表达式的输出为“true”时，表示该项业务操作请求无风险。
例2：预设的一条风险识别规则为：
(当前金额>1w)OR(当前账户不在无风险名单中):有风险
上述风险识别规则中，“当前金额”的数值来自于当前的业务数据，“当前账户”的信息来自于当前业务数据，因此，本条规则是仅依据业务数据进行逻辑分析的。在确定(当前账户不在无风险名单中)的状态时，除了需要知道“当前账户”的信息外，还需要知道“无风险名单”，在稍后介绍服务端通过数据通道下发的配置数据时会详细说明。
例3：预设的一条风险识别规则为：
(当天累计金额>2000)AND(1小时内支付次数>3)AND(1小时内支付金额方差<0.3):有风险
上述风险识别规则中，“当天累计金额”、“1小时内支付次数”、“1小时内支付金额方差”的数值来自于业务指标数据，此条规则仅依据业务指标数据进行逻辑分析。上述规则中预设该逻辑表达式的输出为“true”时，表示该项业务操作请求有风险。
在上述实施例中，对是否存在风险进行逻辑分析或概率分析时所用的 风险识别规则、无风险名单和/或风险识别模型，都可属于配置数据，业务指标更新数据也可属于配置数据的一种。配置数据可以由服务器通过数据通道下发，客户端接收并存储配置数据，这些配置数据用来与业务数据和/或业务指标数据结合，确定业务操作请求是否存在风险。这些配置数据也可以由客户端自身经过训练获得。优选实施例在于，客户端与服务端定时或不定时的进行数据同步，将包括业务指标数据、业务指标更新数据、风险识别规则、无风险名单和风险识别模型等数据同时存储在服务端和客户端。在具体实现时，可以采用网络通信PUSH模式，即服务端通知客户端的通信方式；此时，服务端发现需要更新客户端存储的数据时，主动通知客户端进行数据的更新，这里的数据包括需同步的各类数据。也可以采用网络通信PULL模式，即客户端拉取服务端数据的通信方式；此时，客户端收到服务端的通知或者客户端本地的存储需要更新时，会主动去服务端获取更新的数据。
在依据上述各实施例及其合理组合，确定业务操作请求是否存在风险之后，本申请的方法还包括：依据业务操作请求是否存在风险的风险识别结果，确定对业务操作请求的处理方式。对业务操作请求的处理方式有多种，若业务操作请求不存在风险，则客户端直接执行该业务操作请求的操作即可。而若业务操作请求存在风险，则需限制该业务操作请求的操作权限。具体地，若业务操作请求存在风险，则客户端直接限制业务操作请求的操作权限。或者，若业务操作请求存在风险，则客户端通过数据通道接收服务端发出的限制业务操作请求的操作权限的请求，并进而限制业务操作请求的操作权限。进一步地，在限制业务操作请求的操作权限之后，还可以在排除了风险之后解除对该业务操作请求的操作权限的限制，具体包括：若接收到针对解除风险校验请求反馈的解除风险校验信息，则解除对业务操作请求的操作权限的限制；其中，解除风险校验请求可以由客户端 或服务端发出。
本申请还提供了一种客户端设备，参见图3所示，包括：
请求接收模块101，接收依据业务操作请求发起的风险识别请求，业务操作请求中包含有业务数据；
数据获取模块102，获取与所述风险识别请求相对应的业务数据；
指标存储模块103，存储依据业务数据确定的业务指标数据；
风险识别模块105，基于风险识别规则或风险识别模型，依据业务数据和/或业务指标数据，确定业务操作请求是否存在风险。
优选地，上述客户端设备可还包括：
配置数据存储模块104，接收并存储通过数据通道同步的配置数据；配置数据用来与业务数据和/或业务指标数据结合，确定业务操作请求是否存在风险。
进一步地，上述配置数据存储模块104包括：
规则存储单元1041，存储用于判断业务操作请求是否存在风险的风险识别规则；
名单存储单元1042，存储与客户端设备的硬件环境信息、软件环境信息和/或客户端设备中的账户信息相关联的信息；
模型存储单元1043，存储用于分析业务操作请求是否存在风险的风险识别模型。
优选地，上述风险识别模块105可具体包括：
计算单元1051，依据业务数据，计算得到业务指标数据。
优选地，上述风险识别模块105可具体包括：
分析单元1052，基于风险识别规则或风险识别模型，对业务数据和/或业务指标数据进行逻辑分析和/或概率分析，依据逻辑分析和/或概率分析的结果确定业务操作请求是否存在风险。
优选地，上述客户端设备还可包括：
处理模块107，依据业务操作请求是否存在风险的风险识别结果，确定对业务操作请求的处理方式。
图4给出了客户端设备的一种优选实施例的结构示意图，该设备中包含请求接收模块101、数据获取模块102、指标存储模块103、配置数据存储模块104、风险识别模块105和处理模块107。其中，处理模块107依赖于风险识别模块105，风险识别模块105依赖于指标存储模块102和配置数据存储模块104，指标存储模块102依赖于数据获取模块101，配置数据存储模块104依赖于通过数据通道获取的服务端下发的配置数据。在风险识别模块105中，具体包括计算单元1051和分析单元1052。计算单元1051具体可包括统计计算子单元和特征计算子单元，分别用于进行统计计算和特征计算。分析单元1052具体可包括概率分析子单元和逻辑分析子单元，分别用于进行概率分析和逻辑分析。关于统计计算、特征计算、概率分析和逻辑分析的原理和实现方式在前述描述风险识别方法的实施例时已经详细阐述，此处与之相对应，不再赘述。采用此种方式构成的客户端设备，将基于原始业务数据的获取、存储、计算、分析均交由客户端执行，实现了基于数据的风险防控，降低了与服务端交互的次数、数据大小，从而降低了服务端风险识别与处理的成本。同时，由于数据的计算和分析都发生在客户端，因此，在业务操作出现异常时用户能够及时感知并进行处理，达到了风险防控的目的。除此之外，在客户端进行数据分析得出是否存在风险的结论，也很好的解决了复杂数据灵活计算的问题。通过数据通道从服务端获取包括业务指标更新数据、风险识别规则、无风险名单和风险识别模型等在内的配置数据，能够更好地保证客户端自身进行计算和分析时的识别能力。
图5给出了本申请实施例的一种风险识别***，包括客户端设备和服 务端设备，其中，
客户端设备包括：
请求接收模块，接收依据业务操作请求发起的风险识别请求，业务操作请求中包含有业务数据；
数据获取模块，获取与风险识别请求相对应的业务数据；
指标存储模块，存储依据业务数据确定的业务指标数据；
风险识别模块，基于风险识别规则或风险识别模型，依据业务数据和/或存储在客户端设备的业务指标数据，确定业务操作请求是否存在风险；
服务端设备包括：
下发模块，通过数据通道向客户端设备下发用于确定业务操作请求是否存在风险的风险识别规则或风险识别模型；
接收模块，通过数据通道接收存储在客户端设备的业务指标数据。
结合图5所示功能示意框图，客户端完成从业务数据的获取、计算、存储、分析、和处理等一系列操作。图5中，存储引擎用于存储数据，包括客户端对业务数据进行计算得到的业务指标数据(存入指标存储模块)，也包括客户端通过数据通道从管理后台(与服务端相对应)获取到的规则(与前述的风险识别规则相对应，存入规则存储模块)、名单(与前述的无风险名单相对应，存入名单存储模块)和模型(与前述的风险识别模型相对应，存入模型存储模块)。客户端在获取了业务数据的基础上，启动计算引擎进行统计计算和特征计算，将计算结果，即业务指标数据存入指标存储模块中，并通过数据通道将业务指标数据同步到管理后台。分析引擎基于风险识别规则或风险识别模型，对业务数据和/或业务指标数据进行概率分析和/或逻辑分析，依据分析的结果确定业务操作请求是否存在风 险。更进一步地，可以用处理引擎依据风险识别的结果对业务操作请求进行处理，包括冻结处理(与限制所述业务操作请求的操作权限相对应)和解限处理(与解除对业务操作请求的操作权限的限制相对应)。
图6给出了本申请实施例的第二种风险识别***，包括客户端设备和服务端设备，其中，
客户端设备包括：
请求接收模块，接收依据业务操作请求发起的风险识别请求，业务操作请求中包含有业务数据；
数据获取模块，获取与风险识别请求相对应的业务数据；
指标存储模块，存储依据业务数据确定的业务指标数据；
结果接收模块，通过数据通道接收服务端设备确定的业务操作请求是否存在风险的结果；
服务端设备包括：
接收模块，通过数据通道接收存储在客户端设备的业务指标数据；
风险识别模块，基于风险识别规则或风险识别模型，依据业务数据和/或存储在客户端设备的业务指标数据，确定业务操作请求是否存在风险；其中，业务指标数据依据业务数据确定；
下发模块，通过数据通道向客户端设备发送由服务端设备确定的业务操作请求是否存在风险的结果。
在图6给出的实施例中，客户端设备中仅包含存储引擎，而将计算引擎、分析引擎和处理引擎都由服务端设备实现，有利于简化客户端，降低客户端SDK(软件开发工具包)的大小，从而降低集成成本，避免了安装包过大等问题。
图7给出了本申请实施例的第三种风险识别***，包括客户端设备、 云端风险识别设备和服务端设备，其中，
客户端设备包括：
请求接收模块，接收依据业务操作请求发起的风险识别请求，业务操作请求中包含有业务数据；
数据获取模块，获取与风险识别请求相对应的业务数据；
指标存储模块，存储依据业务数据确定的业务指标数据；
结果接收模块，通过数据通道接收由云端风险识别设备确定的业务操作请求是否存在风险的结果；
云端风险识别设备包括：
风险识别模块，基于风险识别规则或风险识别模型，依据业务数据和/或存储在客户端设备的业务指标数据，确定业务操作请求是否存在风险；其中，业务指标数据依据业务数据确定；
服务端设备包括：
接收模块，通过数据通道接收存储在客户端设备的业务指标数据；
发送模块，向云端风险识别设备发送业务指标数据；向云端风险识别设备发送风险识别规则或风险识别模型。
在图7给出的实施例中，将服务端划分为云端风险识别设备和服务端设备，有利于进一步减轻服务端设备的计算和分析压力，减少服务端的成本耗费。
本领域内的技术人员应明白，本发明的实施例可提供为方法、***、或计算机程序产品。因此，本发明可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本发明可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的 形式。
本发明是参照根据本发明实施例的方法、设备(***)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
在一个典型的配置中，计算设备包括一个或多个处理器(CPU)、输入/输出接口、网络接口和内存。
内存可能包括计算机可读介质中的非永久性存储器，随机存取存储器(RAM)和/或非易失性内存等形式，如只读存储器(ROM)或闪存(flash RAM)。内存是计算机可读介质的示例。
计算机可读介质包括永久性和非永久性、可移动和非可移动媒体可以由任何方法或技术来实现信息存储。信息可以是计算机可读指令、数据结 构、程序的模块或其他数据。计算机的存储介质的例子包括，但不限于相变内存(PRAM)、静态随机存取存储器(SRAM)、动态随机存取存储器(DRAM)、其他类型的随机存取存储器(RAM)、只读存储器(ROM)、电可擦除可编程只读存储器(EEPROM)、快闪记忆体或其他内存技术、只读光盘只读存储器(CD-ROM)、数字多功能光盘(DVD)或其他光学存储、磁盒式磁带，磁带磁磁盘存储或其他磁性存储设备或任何其他非传输介质，可用于存储可以被计算设备访问的信息。按照本文中的界定，计算机可读介质不包括暂存电脑可读媒体(transitory media)，如调制的数据信号和载波。
还需要说明的是，术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、商品或者设备不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、商品或者设备所固有的要素。在没有更多限制的情况下，由语句“包括一个……”限定的要素，并不排除在包括所述要素的过程、方法、商品或者设备中还存在另外的相同要素。
本领域技术人员应明白，本申请的实施例可提供为方法、***或计算机程序产品。因此，本申请可采用完全硬件实施例、完全软件实施例或结合软件和硬件方面的实施例的形式。而且，本申请可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
以上所述仅为本申请的实施例而已，并不用于限制本申请。对于本领域技术人员来说，本申请可以有各种更改和变化。凡在本申请的精神和原理之内所作的任何修改、等同替换、改进等，均应包含在本申请的权利要求范围之内。

Claims (25)

  1. 一种风险识别方法，其特征在于，包括：
    客户端接收依据业务操作请求发起的风险识别请求，所述业务操作请求中包含有业务数据；
    所述客户端获取与所述风险识别请求相对应的业务数据；
    基于风险识别规则或风险识别模型，依据所述业务数据和/或存储在所述客户端的业务指标数据，确定所述业务操作请求是否存在风险；其中，所述业务指标数据依据所述业务数据确定。
  2. 按照权利要求1所述方法，其特征在于，所述业务指标数据依据所述业务数据确定，具体为：
    所述客户端依据所述业务数据，计算得到所述业务指标数据。
  3. 按照权利要求2所述方法，其特征在于，在所述客户端依据所述业务数据，计算得到所述业务指标数据之后，还包括：
    所述客户端将计算得到的所述业务指标数据通过数据通道上报至服务端。
  4. 按照权利要求1所述方法，其特征在于，所述业务指标数据依据所述业务数据确定，具体为：
    服务端通过数据通道接收所述客户端依据所述业务数据计算得到的所述业务指标数据。
  5. 按照权利要求1所述方法，其特征在于，所述业务指标数据依据所述业务数据确定，具体为：
    所述客户端将所述业务数据通过数据通道上报至服务端；
    所述客户端通过所述数据通道接收所述服务端依据所述业务数据计算得到的所述业务指标数据。
  6. 按照权利要求1所述方法，其特征在于，所述业务指标数据依据所述业务数据确定，具体为：
    服务端通过数据通道接收所述客户端上报的所述业务数据；
    所述服务端依据所述业务数据，计算得到所述业务指标数据；
    所述服务端通过所述数据通道将所述业务指标数据发送到所述客户端。
  7. 按照权利要求1～6之任一所述方法，其特征在于，所述业务指标数据包括所述业务操作请求产生的数据在预定时间窗口的计数值、加和值、起始值、终止值、区别值、平均值、标准差、方差、最大值和/或最小值。
  8. 按照权利要求1～6之任一所述方法，其特征在于，所述业务指标数据包括所述业务操作请求出现的频率特性和/或客户端的运行环境特性。
  9. 按照权利要求1所述方法，其特征在于，基于风险识别规则或风险识别模型，依据所述业务数据和/或存储在所述客户端的业务指标数据，确定所述业务操作请求是否存在风险，包括：
    基于风险识别规则，所述客户端对所述业务数据和/或所述业务指标数据进行逻辑分析，依据逻辑分析的结果确定所述业务操作请求是否存在风险；或者
    基于风险识别模型，所述客户端对所述业务数据和/或所述业务指标数 据进行逻辑分析和/或概率分析，依据逻辑分析和/或概率分析的结果确定所述业务操作请求是否存在风险。
  10. 按照权利要求1所述方法，其特征在于，基于风险识别规则或风险识别模型，依据所述业务数据和/或存储在所述客户端的业务指标数据，确定所述业务操作请求是否存在风险，包括：
    基于风险识别规则，所述客户端通过数据通道接收服务端对所述业务数据和/或所述业务指标数据进行逻辑分析的结果，或依据所述逻辑分析的结果确定所述业务操作请求是否存在风险的结果；或者
    基于风险识别模型，所述客户端通过数据通道接收服务端对所述业务数据和/或所述业务指标数据进行逻辑分析和/或概率分析的结果，或依据逻辑分析和/或概率分析的结果确定所述业务操作请求是否存在风险的结果。
  11. 按照权利要求1所述方法，其特征在于，所述方法还包括：
    所述客户端接收并存储服务端通过数据通道下发的配置数据；所述配置数据用来与所述业务数据和/或所述业务指标数据结合，确定所述业务操作请求是否存在风险。
  12. 按照权利要求11所述方法，其特征在于，所述配置数据包括业务指标更新数据、所述风险识别规则、无风险名单和/或所述风险识别模型。
  13. 按照权利要求1所述方法，其特征在于，在确定所述业务操作请求是否存在风险之后，还包括：
    依据所述业务操作请求是否存在风险的风险识别结果，确定对所述业务操作请求的处理方式。
  14. 按照权利要求13所述方法，其特征在于，依据所述业务操作请求是否存在风险的风险识别结果，确定对所述业务操作请求的处理方式，包括：
    若所述业务操作请求存在风险，则所述客户端限制所述业务操作请求的操作权限。
  15. 按照权利要求13所述方法，其特征在于，依据所述业务操作请求是否存在风险的风险识别结果，确定对所述业务操作请求的处理方式，包括：
    若所述业务操作请求存在风险，则所述客户端通过数据通道接收服务端发出的限制所述业务操作请求的操作权限的请求，并限制所述业务操作请求的操作权限。
  16. 按照权利要求14或15所述方法，其特征在于，在限制所述业务操作请求的操作权限之后，还包括：
    若接收到针对解除风险校验请求反馈的解除风险校验信息，则解除对所述业务操作请求的操作权限的限制；其中，所述解除风险校验请求由所述客户端或服务端发出。
  17. 一种客户端设备，其特征在于，包括：
    请求接收模块，接收依据业务操作请求发起的风险识别请求，所述业务操作请求中包含有业务数据；
    数据获取模块，获取与所述风险识别请求相对应的业务数据；
    指标存储模块，存储依据所述业务数据确定的业务指标数据；
    风险识别模块，基于风险识别规则或风险识别模型，依据所述业务数 据和/或所述业务指标数据，确定所述业务操作请求是否存在风险。
  18. 按照权利要求17所述设备，其特征在于，所述设备还包括：
    配置数据存储模块，接收并存储通过数据通道同步的配置数据；所述配置数据用来与所述业务数据和/或所述业务指标数据结合，确定所述业务操作请求是否存在风险。
  19. 按照权利要求18所述设备，其特征在于，所述配置数据存储模块包括：
    规则存储单元，存储用于判断业务操作请求是否存在风险的风险识别规则；
    名单存储单元，存储与所述客户端设备的硬件环境信息、软件环境信息和/或所述客户端设备中的账户信息相关联的信息；
    模型存储单元，存储用于分析业务操作请求是否存在风险的风险识别模型。
  20. 按照权利要求17所述设备，其特征在于，所述风险识别模块包括：
    计算单元，依据所述业务数据，计算得到所述业务指标数据。
  21. 按照权利要求17所述设备，其特征在于，所述风险识别模块包括：
    分析单元，基于风险识别规则或风险识别模型，对所述业务数据和/或所述业务指标数据进行逻辑分析和/或概率分析，依据逻辑分析和/或概率分析的结果确定所述业务操作请求是否存在风险。
  22. 按照权利要求17所述设备，其特征在于，所述设备还包括：
    处理模块，依据所述业务操作请求是否存在风险的风险识别结果，确定对所述业务操作请求的处理方式。
  23. 一种风险识别***，其特征在于，包括客户端设备和服务端设备，其中，
    所述客户端设备包括：
    请求接收模块，接收依据业务操作请求发起的风险识别请求，所述业务操作请求中包含有业务数据；
    数据获取模块，获取与所述风险识别请求相对应的业务数据；
    指标存储模块，存储依据所述业务数据确定的业务指标数据；
    风险识别模块，基于风险识别规则或风险识别模型，依据所述业务数据和/或存储在所述客户端设备的业务指标数据，确定所述业务操作请求是否存在风险；
    所述服务端设备包括：
    下发模块，通过数据通道向所述客户端设备下发用于确定所述业务操作请求是否存在风险的所述风险识别规则或所述风险识别模型；
    接收模块，通过所述数据通道接收存储在所述客户端设备的业务指标数据。
  24. 一种风险识别***，其特征在于，包括客户端设备和服务端设备，其中，
    所述客户端设备包括：
    请求接收模块，接收依据业务操作请求发起的风险识别请求，所述业务操作请求中包含有业务数据；
    数据获取模块，获取与所述风险识别请求相对应的业务数据；
    指标存储模块，存储依据所述业务数据确定的业务指标数据；
    结果接收模块，通过数据通道接收服务端设备确定的所述业务操作请求是否存在风险的结果；
    所述服务端设备包括：
    接收模块，通过所述数据通道接收存储在所述客户端设备的业务指标数据；
    风险识别模块，基于风险识别规则或风险识别模型，依据所述业务数据和/或存储在所述客户端设备的业务指标数据，确定所述业务操作请求是否存在风险；其中，所述业务指标数据依据所述业务数据确定；
    下发模块，通过数据通道向所述客户端设备发送由所述服务端设备确定的所述业务操作请求是否存在风险的结果。
  25. 一种风险识别***，其特征在于，包括客户端设备、云端风险识别设备和服务端设备，其中，
    所述客户端设备包括：
    请求接收模块，接收依据业务操作请求发起的风险识别请求，所述业务操作请求中包含有业务数据；
    数据获取模块，获取与所述风险识别请求相对应的业务数据；
    指标存储模块，存储依据所述业务数据确定的业务指标数据；
    结果接收模块，通过数据通道接收由云端风险识别设备确定的所述业务操作请求是否存在风险的结果；
    所述云端风险识别设备包括：
    风险识别模块，基于风险识别规则或风险识别模型，依据所述业务数据和/或存储在所述客户端设备的业务指标数据，确定所述业 务操作请求是否存在风险；其中，所述业务指标数据依据所述业务数据确定；
    所述服务端设备包括：
    接收模块，通过所述数据通道接收存储在所述客户端设备的业务指标数据；
    发送模块，向所述云端风险识别设备发送所述业务指标数据；向所述云端风险识别设备发送所述风险识别规则或所述风险识别模型。
PCT/CN2017/093179 2016-07-22 2017-07-17 风险识别方法、客户端设备及风险识别*** WO2018014811A1 (zh)

Priority Applications (6)

Application Number Priority Date Filing Date Title
JP2019503321A JP6731203B2 (ja) 2016-07-22 2017-07-17 リスク識別方法、クライアントデバイス及びリスク識別システム
EP17830445.7A EP3489877A4 (en) 2016-07-22 2017-07-17 RISK IDENTIFICATION PROCEDURE, CLIENT DEVICE AND RISK IDENTIFICATION SYSTEM
SG11201900517UA SG11201900517UA (en) 2016-07-22 2017-07-17 Risk identification method, client device, and risk identification system
KR1020197005372A KR102153840B1 (ko) 2016-07-22 2017-07-17 위험 식별 방법, 클라이언트 디바이스 및 위험 식별 시스템
US16/254,421 US11075938B2 (en) 2016-07-22 2019-01-22 Identifying high risk computing operations
US16/722,943 US11570194B2 (en) 2016-07-22 2019-12-20 Identifying high risk computing operations

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201610589384.4A CN107644340A (zh) 2016-07-22 2016-07-22 风险识别方法、客户端设备及风险识别***
CN201610589384.4 2016-07-22

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/254,421 Continuation US11075938B2 (en) 2016-07-22 2019-01-22 Identifying high risk computing operations

Publications (1)

Publication Number Publication Date
WO2018014811A1 true WO2018014811A1 (zh) 2018-01-25

Family

ID=60991935

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/093179 WO2018014811A1 (zh) 2016-07-22 2017-07-17 风险识别方法、客户端设备及风险识别***

Country Status (8)

Country Link
US (2) US11075938B2 (zh)
EP (1) EP3489877A4 (zh)
JP (1) JP6731203B2 (zh)
KR (1) KR102153840B1 (zh)
CN (1) CN107644340A (zh)
SG (1) SG11201900517UA (zh)
TW (1) TWI761349B (zh)
WO (1) WO2018014811A1 (zh)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109409896A (zh) * 2018-10-17 2019-03-01 北京芯盾时代科技有限公司 银行欺诈识别模型训练方法、银行欺诈识别方法和装置
CN110515975A (zh) * 2019-07-17 2019-11-29 阿里巴巴集团控股有限公司 风险检测***、方法以及装置
CN110992045A (zh) * 2019-11-15 2020-04-10 安徽海汇金融投资集团有限公司 一种应收账款债权流转异常风险监控方法及***

Families Citing this family (29)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107644340A (zh) * 2016-07-22 2018-01-30 阿里巴巴集团控股有限公司 风险识别方法、客户端设备及风险识别***
US10643214B2 (en) * 2017-04-28 2020-05-05 Splunk Inc. Risk monitoring system
CN114374560A (zh) * 2018-02-07 2022-04-19 阿里巴巴集团控股有限公司 数据处理方法、设备及存储介质
CN108491304B (zh) * 2018-03-06 2019-12-10 平安科技（深圳）有限公司 电子装置、业务***风险控制方法及存储介质
CN108734380B (zh) * 2018-04-08 2022-02-01 创新先进技术有限公司 风险账户判定方法、装置及计算设备
CN108712275A (zh) * 2018-04-19 2018-10-26 平安科技（深圳）有限公司 数据传输风险评估方法、装置、计算机设备和存储介质
CN108874968B (zh) * 2018-06-07 2023-04-18 平安科技（深圳）有限公司 风险管理数据处理方法、装置、计算机设备和存储介质
CN108876600B (zh) * 2018-08-20 2023-09-05 平安科技（深圳）有限公司 预警信息推送方法、装置、计算机设备和介质
CN109308573A (zh) * 2018-08-31 2019-02-05 阿里巴巴集团控股有限公司 一种基于风险点的业务风险控制方法、装置及电子设备
CN110059920B (zh) * 2019-03-08 2021-08-06 创新先进技术有限公司 风险决策方法及装置
CN110033166B (zh) * 2019-03-08 2023-04-07 创新先进技术有限公司 风险识别处理方法及装置
CN110135693A (zh) * 2019-04-12 2019-08-16 北京中科闻歌科技股份有限公司 一种风险识别方法、装置、设备及存储介质
CN110310007A (zh) * 2019-05-22 2019-10-08 菜鸟智能物流控股有限公司 风险识别方法、装置、设备和存储介质
CN110147967B (zh) * 2019-05-28 2023-05-30 创新先进技术有限公司 风险防控方法及装置
CN110458401A (zh) * 2019-07-05 2019-11-15 深圳壹账通智能科技有限公司 基于区块链的信息处理装置、方法及存储介质
CN110738401A (zh) * 2019-09-25 2020-01-31 支付宝(杭州)信息技术有限公司 申诉处理方法、装置、电子设备
US11281794B2 (en) * 2019-09-26 2022-03-22 Microsoft Technology Licensing, Llc Fine grained access control on procedural language for databases based on accessed resources
CN110781500A (zh) * 2019-09-30 2020-02-11 口碑(上海)信息技术有限公司 一种数据风控***以及方法
CN111104664B (zh) * 2019-11-29 2022-03-15 北京云测信息技术有限公司 一种电子设备的风险识别方法及服务器
CN111080303B (zh) * 2019-12-06 2022-05-31 支付宝(杭州)信息技术有限公司 终端设备的风险识别方法、装置及设备
CN111126797B (zh) * 2019-12-09 2021-11-30 支付宝(杭州)信息技术有限公司 私有数据保护的业务风险控制方法、装置、平台及***
CN111428237B (zh) * 2020-03-06 2022-08-12 支付宝(杭州)信息技术有限公司 一种攻击风险的识别方法、***、装置和电子设备
CN111681005A (zh) * 2020-05-06 2020-09-18 支付宝(杭州)信息技术有限公司 数据交互方法、装置和电子设备
CN111310196B (zh) * 2020-05-09 2020-12-04 支付宝(杭州)信息技术有限公司 风险识别方法及装置和电子设备
CN111932135B (zh) * 2020-08-13 2023-09-26 中国工商银行股份有限公司 基于分布式数据库的客户风险识别方法及装置
CN112132649A (zh) * 2020-08-28 2020-12-25 绿瘦健康产业集团有限公司 一种订单校验处理方法、装置、介质及终端设备
CN112399424B (zh) * 2020-11-17 2023-11-17 北京国联视讯信息技术股份有限公司 一种基于大数据的智能设备管理方法
CN112861140B (zh) * 2021-01-26 2024-03-22 上海德启信息科技有限公司 一种业务数据的处理方法及装置、可读存储介质
CN112862339A (zh) * 2021-02-25 2021-05-28 厦门渊亭信息科技有限公司 一种风险决策方法及***

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101236638A (zh) * 2008-02-20 2008-08-06 中国工商银行股份有限公司 一种基于Web的银行卡风险监测方法及***
CN103279883A (zh) * 2013-05-02 2013-09-04 携程计算机技术（上海）有限公司 电子支付交易风险控制方法及***
CN105556552A (zh) * 2013-03-13 2016-05-04 加迪安分析有限公司 欺诈探测和分析

Family Cites Families (26)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7809617B1 (en) 2003-08-01 2010-10-05 Checkfree Corporation Payment processing with selection of a risk reduction technique
KR100803889B1 (ko) * 2006-02-07 2008-02-14 주식회사 케이티프리텔 클라이언트 단말로 제공되는 서비스 성능 분석 방법 및시스템
JP2008112389A (ja) * 2006-10-31 2008-05-15 Hitachi Software Eng Co Ltd クライアント端末監視方法及びシステム
US20080201780A1 (en) * 2007-02-20 2008-08-21 Microsoft Corporation Risk-Based Vulnerability Assessment, Remediation and Network Access Protection
JP2009064127A (ja) * 2007-09-05 2009-03-26 Oki Electric Ind Co Ltd 自動取引システム、サーバおよび自動取引装置
US9781148B2 (en) * 2008-10-21 2017-10-03 Lookout, Inc. Methods and systems for sharing risk responses between collections of mobile communications devices
JP2011008730A (ja) * 2009-06-29 2011-01-13 Lac Co Ltd コンピュータシステム、コンピュータ装置、ファイルオープン方法、及びプログラム
US9015843B2 (en) * 2010-12-03 2015-04-21 Microsoft Corporation Predictive malware threat mitigation
US8666829B1 (en) * 2010-12-13 2014-03-04 Eventbrite, Inc. Detecting fraudulent event listings
US8918904B2 (en) * 2010-12-17 2014-12-23 Wepay, Inc. Systems and methods for user identity verification and risk analysis using available social and personal data
JP5851311B2 (ja) * 2012-03-30 2016-02-03 セコム株式会社 アプリケーション検査装置
US20130339186A1 (en) 2012-06-15 2013-12-19 Eventbrite, Inc. Identifying Fraudulent Users Based on Relational Information
US8850517B2 (en) * 2013-01-15 2014-09-30 Taasera, Inc. Runtime risk detection based on user, application, and system action sequence correlation
US9928497B2 (en) * 2013-01-18 2018-03-27 Wal-Mart Stores, Inc. System and method for managing prepaid cards
WO2014116286A2 (en) * 2013-01-25 2014-07-31 Adaptive Spectrum And Signal Alignment, Inc. Method and apparatus for cloud services for enhancing broadband experience
US9519934B2 (en) * 2013-07-19 2016-12-13 Bank Of America Corporation Restricted access to online banking
CN103532927A (zh) * 2013-07-30 2014-01-22 北京中科金财科技股份有限公司 一种基于移动终端的金融云安全服务平台和数据保护方法
JP5973413B2 (ja) * 2013-11-26 2016-08-23 ビッグローブ株式会社 端末装置、ｗｅｂメールサーバ、安全確認方法、及び安全確認プログラム
US20150193768A1 (en) * 2014-01-09 2015-07-09 Capital One Financial Corporation Method and system for providing alert messages related to suspicious transactions
US20150199628A1 (en) 2014-01-10 2015-07-16 International Business Machines Corporation Framework for cascading risk management
US10438206B2 (en) * 2014-05-27 2019-10-08 The Toronto-Dominion Bank Systems and methods for providing merchant fraud alerts
CN105516071B (zh) * 2014-10-13 2019-01-18 阿里巴巴集团控股有限公司 验证业务操作安全性的方法、装置、终端及服务器
US20160232600A1 (en) 2015-02-08 2016-08-11 Visa International Service Association One-Click Checkout Apparatuses, Systems, and Methods
CN105117544B (zh) * 2015-08-21 2018-09-28 李涛 基于移动云计算的Android平台App风险评估方法与装置
US10891620B2 (en) * 2015-08-21 2021-01-12 Samsung Electronics Co., Ltd. Method for risk management based on aggregated information from multiple payment networks while maintaining anonymity of user
CN107644340A (zh) * 2016-07-22 2018-01-30 阿里巴巴集团控股有限公司 风险识别方法、客户端设备及风险识别***

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101236638A (zh) * 2008-02-20 2008-08-06 中国工商银行股份有限公司 一种基于Web的银行卡风险监测方法及***
CN105556552A (zh) * 2013-03-13 2016-05-04 加迪安分析有限公司 欺诈探测和分析
CN103279883A (zh) * 2013-05-02 2013-09-04 携程计算机技术（上海）有限公司 电子支付交易风险控制方法及***

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3489877A4 *

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109409896A (zh) * 2018-10-17 2019-03-01 北京芯盾时代科技有限公司 银行欺诈识别模型训练方法、银行欺诈识别方法和装置
CN110515975A (zh) * 2019-07-17 2019-11-29 阿里巴巴集团控股有限公司 风险检测***、方法以及装置
CN110992045A (zh) * 2019-11-15 2020-04-10 安徽海汇金融投资集团有限公司 一种应收账款债权流转异常风险监控方法及***
CN110992045B (zh) * 2019-11-15 2024-03-22 安徽海汇金融投资集团有限公司 一种应收账款债权流转异常风险监控方法及***

Also Published As

Publication number Publication date
US20190158528A1 (en) 2019-05-23
JP6731203B2 (ja) 2020-07-29
TWI761349B (zh) 2022-04-21
EP3489877A4 (en) 2019-06-26
SG11201900517UA (en) 2019-02-27
US11570194B2 (en) 2023-01-31
KR102153840B1 (ko) 2020-09-09
EP3489877A1 (en) 2019-05-29
JP2019525334A (ja) 2019-09-05
CN107644340A (zh) 2018-01-30
US20200236128A1 (en) 2020-07-23
US11075938B2 (en) 2021-07-27
KR20190032517A (ko) 2019-03-27
TW201816692A (zh) 2018-05-01

Similar Documents

Publication Publication Date Title
WO2018014811A1 (zh) 风险识别方法、客户端设备及风险识别***
US11411825B2 (en) In intelligent autoscale of services
US10536416B2 (en) Intelligent message queue management
US11456965B2 (en) Network service request throttling system
WO2018214898A1 (zh) 一种向区块链***中写入业务数据的方法和装置
US20200250677A1 (en) Processing service requests based on risk identification
US8825798B1 (en) Business event tracking system
JP2019533235A5 (zh)
US8589537B2 (en) Methods and computer program products for aggregating network application performance metrics by process pool
US9888075B2 (en) Method and apparatus for data exchange based on user status
US10248508B1 (en) Distributed data validation service
US10606604B2 (en) Predictive queue control and allocation
CN116860470A (zh) 数据传输方法、装置、计算机设备和存储介质
CN111488373A (zh) 用于处理请求的方法和***
US9774661B1 (en) System, method, and computer program for processing interdependent transactions between a requesting system and a target system
US11023479B2 (en) Managing asynchronous analytics operation based on communication exchange
CN114048512B (zh) 一种处理敏感数据的方法及装置
CN114650252B (zh) 基于企业服务总线的路由方法、装置及计算机设备
CN118051356A (zh) 一种消息处理方法、装置、电子设备及计算机可读介质
CN117614998A (zh) 用于微服务***的限流方法、装置、电子设备及存储介质
CN116362731A (zh) 一种业务处理方法、装置、电子设备及计算机可读介质
CN116629616A (zh) 一种风险识别方法、装置、设备及存储介质
CN116308392A (zh) 数据处理方法、装置、电子设备及存储介质
CN115617763A (zh) 数据处理方法、装置、电子设备及存储介质
CN116468491A (zh) 计费规则调整方法、装置、存储介质及电子设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17830445

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2019503321

Country of ref document: JP

Kind code of ref document: A

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 20197005372

Country of ref document: KR

Kind code of ref document: A

ENP Entry into the national phase

Ref document number: 2017830445

Country of ref document: EP

Effective date: 20190222