CN115146957A - Method and device for judging abnormal modification of information - Google Patents

Abstract

The present application discloses a method and device for judging abnormal modification of information, which is used in the field of data processing. The method includes obtaining a first operation, scoring the first operation based on a preset modification rule and a preset event rule, and obtaining a scoring result, In response to the scoring result being greater than the first threshold, warning information is sent to a plurality of first administrators, so that the first administrators judge the modified user information based on the warning information, and determine whether the modified user information is abnormally modified. The present application can score the first operation, that is, the operation of modifying user information, and send warning information to a plurality of first administrators for the first operation whose score is greater than the first threshold. Therefore, the first administrator only needs to judge the first operation of sending the warning information to complete the judgment. It greatly reduces the manpower consumption in the process of judging whether the modification of user information is illegal, and improves the efficiency of judging abnormal modification of information.

Description

A method and device for judging abnormal modification of information

technical field

The present application relates to the technical field of data processing, and in particular, to a method for judging information modification.

Background technique

Now, with the development of society, the banking business is becoming more and more mature, and more and more customers go to the bank for business. As a result, more and more customer information is stored by banks. However, once these customer information is illegally modified, it will bring huge losses to the safety of customers' funds and the economic interests of the bank. Therefore, the bank needs to judge the modified user information. to determine whether it is an illegal modification.

At present, all modified user information is manually judged. Since there are many modified user information to be judged, the manual labor needs to work for a long time, which results in a lot of manpower consumption, and the work efficiency is low when the manual labor works for a long time.

Therefore, in the process of judging whether the modification of user information is illegal, how to greatly reduce manpower consumption and improve the efficiency of judging abnormal modification of information is a technical problem that those skilled in the art need to solve urgently.

SUMMARY OF THE INVENTION

Based on the above problems, the present application provides a method and device for judging abnormal modification of information, so as to greatly reduce labor consumption and improve the efficiency of judging abnormal modification of information in the process of judging whether modification of user information is illegal modification. The embodiments of the present application disclose the following technical solutions.

In the first aspect, a method for judging abnormal modification of information provided by this application includes:

obtaining a first operation, where the first operation is an operation of modifying user information;

Score the first operation based on the preset modification rule and the preset event rule, and obtain a scoring result, where the score is used to indicate the risk level of the first operation;

In response to the scoring result being greater than the first threshold, sending warning information to a plurality of first administrators, so that the first administrators can judge the modified user information based on the warning information, and determine whether the modified user information is abnormal Modify, the first administrator is an administrator with the right to modify user information.

Optionally, before acquiring the first operation, the method further includes:

obtaining first information, encrypting the first information row, and obtaining a first ciphertext and a first signature, where the first information is user information modified by the user during normal business handling;

obtain second information;

Encrypt the second information to obtain a second ciphertext and a second signature; determine that the second ciphertext matches the first ciphertext, and the second signature matches the first signature, obtain all the Describe the first operation.

Optionally, the method further includes:

In response to the first administrators of the plurality of first administrators who are greater than the threshold number confirming that the modified user information is correct, the modified user information is not an abnormal modification, and the modification of the user information is allowed.

Optionally, the method further includes:

In response to the modified user information being an abnormal modification, a third ciphertext and a third signature are generated;

Replace the first ciphertext with the third ciphertext, and replace the first signature with the third signature.

Optionally, the method further includes:

In response to the modified user information being abnormal modification, modify the read identification;

The modified read identification is reconnected to the database.

In a second aspect, the present application provides a device for judging abnormal modification of information, the device comprising:

a first obtaining unit, configured to obtain a first operation, where the first operation is an operation of modifying user information;

a second obtaining unit, configured to score the first operation based on a preset modification rule and a preset event rule, and obtain a scoring result, where the score is used to indicate the risk level of the first operation;

A first response unit, configured to send warning information to a plurality of first administrators in response to the scoring result being greater than a first threshold, so that the first administrators can judge the modified user information based on the warning information, and judge the Whether the modified user information is abnormally modified, the first administrator is an administrator with the right to modify user information.

Optionally, the device further includes:

a third obtaining unit, configured to obtain the first information;

a first encryption unit, configured to encrypt the first line of information to obtain a first ciphertext and a first signature, where the first information is user information modified by the user during normal business handling;

a fourth acquiring unit, configured to acquire the second information;

a second encryption unit, configured to encrypt the second information to obtain a second ciphertext and a second signature; determine that the second ciphertext matches the first ciphertext, and the second signature matches the The first signature matches, and the first operation is obtained.

Optionally, the device further includes:

The permitting unit is configured to allow the modification of the user information in response to the confirmation that the modified user information is correct and the modified user information is not abnormally modified in response to the first administrators of the plurality of first administrators who are greater than the threshold number.

Optionally, the device further includes:

a generating unit, configured to generate a third ciphertext and a third signature in response to the modified user information being an abnormal modification;

A replacement unit, configured to replace the first ciphertext with the third ciphertext, and replace the first signature with the third signature.

Optionally, the device further includes:

a modification unit, configured to modify the read identification in response to the modified user information being an abnormal modification;

A connection unit, configured to reconnect the modified read identification to the database.

In a third aspect, an embodiment of the present application provides a device, the device includes a memory and a processor, the memory is used to store instructions or codes, and the processor is used to execute the instructions or codes, so that the device The method of any one of the preceding first aspects is performed.

In a fourth aspect, an embodiment of the present application provides a computer storage medium, where code is stored in the computer storage medium, and when the code is run, a device that runs the code implements any one of the foregoing first aspects. Methods.

Compared with the prior art, the present application has the following beneficial effects:

In this application, the first operation is obtained, the first operation is scored based on the preset modification rules and the preset event rules, the scoring result is obtained, and in response to the scoring result being greater than the first threshold, warning information is sent to multiple first administrators, so that The first administrator judges the modified user information based on the warning information, and judges whether the modified user information is abnormal modification. Compared with the prior art, all modified user information is manually judged. The present application can score the first operation, that is, the operation of modifying user information, and send warning information to a plurality of first administrators for the first operation whose score is greater than the first threshold. Therefore, the first administrator only needs to judge the first operation of sending the warning information to complete the judgment. It also overcomes the manual judgment of all the modified user information in the prior art. Since there are many modified user information that needs to be judged, the manual labor needs to work for a long time, resulting in a lot of manpower consumption and manual work for a long time. The problem of low work efficiency. It greatly reduces the manpower consumption in the process of judging whether the modification of user information is illegal, and improves the efficiency of judging abnormal modification of information.

Description of drawings

In order to more clearly illustrate the technical solutions in the present embodiment or the prior art, the following briefly introduces the accompanying drawings required in the description of the embodiment or the prior art. Obviously, the accompanying drawings in the following description are only For some embodiments of the present application, for those of ordinary skill in the art, other drawings can also be obtained according to these drawings without any creative effort.

1 is a flowchart of a method for judging abnormal modification of information provided by an embodiment of the present application;

2 is a flowchart of another method for judging abnormality modification of information provided by an embodiment of the present application;

FIG. 3 is a schematic structural diagram of a specific structure of an apparatus for judging abnormal modification of information according to an embodiment of the present application.

Detailed ways

The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, but not all of the embodiments. All other embodiments obtained by those of ordinary skill in the art based on the embodiments in the present application without creative work fall within the protection scope of the present application.

It should be noted that the method and device for judging abnormal modification of information provided by this application are used in the field of data processing.

With the development of society, the banking business is becoming more and more mature, and more and more customers go to the bank for business. As a result, more and more customer information is stored by banks. However, once these customer information is illegally modified, it will bring huge losses to the safety of customers' funds and the economic interests of the bank. Therefore, the bank needs to judge the modified user information. to determine whether it is an illegal modification. At present, all modified user information is manually judged. Since there are many modified user information to be judged, the manual labor needs to work for a long time, which results in a lot of manpower consumption, and the work efficiency is low when the manual labor works for a long time.

The inventor proposes the technical solution of the present application after research. The present application can score the first operation, that is, the operation of modifying user information, and send warning information to a plurality of first administrators for the first operation whose score is greater than the first threshold. Therefore, the first administrator only needs to judge the first operation of sending the warning information to complete the judgment. It also overcomes the manual judgment of all the modified user information in the prior art. Since there are many modified user information that needs to be judged, the manual labor needs to work for a long time, resulting in a lot of manpower consumption and manual work for a long time. The problem of low work efficiency. It greatly reduces the manpower consumption in the process of judging whether the modification of user information is illegal, and improves the efficiency of judging abnormal modification of information.

The methods provided by the embodiments of the present application may be executed by software on a terminal device. The terminal device may be, for example, a mobile phone, a tablet computer, a computer and other devices. The software may be, for example, system software.

In order to make those skilled in the art better understand the solution of the present application, the present application will be further described in detail below with reference to the accompanying drawings and specific embodiments. In order to make those skilled in the art better understand the solution of the present application, the present application will be further described in detail below with reference to the accompanying drawings and specific embodiments. The following description is made by taking the method provided by the embodiment of the present application being executed by the first terminal as an example.

FIG. 1 is a flowchart of a method for judging abnormal modification of information provided by an embodiment of the present application. As shown in FIG. 1 , the method includes:

S101: Obtain the first operation.

The first terminal acquires the first operation. It can be understood that the first operation is an operation of modifying user information. For example, the user performs a transfer operation, the user performs a large-amount wealth management purchase operation, and the user performs a limit management operation. The user information may include the user's identity information, the user's account information, the user's transfer information, the user's financial management information, and the like. For ease of understanding, for example, for example, the user has 1,000 yuan in the account, and the user performs a transfer operation and transfers 800 yuan. At this time, the user's account information can be 200 yuan in the account.

S102: Score the first operation based on a preset modification rule and a preset event rule, and obtain a scoring result.

After acquiring the first operation, the first terminal scores the first operation, that is, the operation of modifying the user information, based on the preset modification rule and the preset event rule. Thereby, the risk level of the first operation is detected.

For further explanation, the modification rules and event rules can be obtained from fraudulent transactions, and the modification rules can be the rules for completing the customer input process in the transaction process. (0.3 points), business processing is repeatedly returned to the homepage more than 2 times (0.1), the transaction amount is modified after a specific time or the amount is modified frequently in a short time (0.2), etc. Event rules can be other handling process rules than transactions. For example, during the filling process, multiple people assist in filling in (0.1), others provide remote guidance during business processing (0.1), and the participation rate in information filling is less than 50% (0.5).

S103: In response to the scoring result being greater than a first threshold, send warning information to a plurality of first administrators, so that the first administrators can judge the modified user information based on the warning information, and determine whether the modified user information is Modified for exceptions.

After acquiring the first operation scoring result, the first terminal device determines the magnitude relationship between the first operation scoring result and the first threshold. When the scoring result is greater than the first threshold, a warning message can be sent to multiple administrators who have the authority to modify user information, and then the first administrator can judge the first operation based on the warning message, and determine that the modified user information is normal Modification or abnormal modification.

It is further explained that the first terminal sends the warning information to a plurality of first administrators, and the first administrators judge the first operation. When more than the threshold number of the first administrators among the plurality of first administrators confirms that the modified user information is correct, it can be indicated that the modified user information is not an abnormal modification, and the modification of the user information is allowed. For example, the warning message is sent to 10 first administrators, and the threshold number is set to 5. If more than 5 people confirm that the modified user information is correct, it can be shown that the modified user information is not an abnormal modification, and the modification of the user information is allowed.

In order to facilitate understanding, for example, for the transaction of "the customer has performed a transfer operation", the first operation is obtained. If the monitoring during the customer's operation shows that the customer's operation is performed by others during the transfer, the customer seldom participates or even is directly If the ID card information is used for processing, and the field is repeatedly modified 7 times during the business processing, the triggered modification rule can be: the cumulative number of field modifications is greater than 5 times (0.3 points), and the triggered event rule can be: remote guidance by others during business processing (0.1), the participation in information filling is less than 50% (0.5), and the risk score is 0.9. Calculate the accumulatively obtained scoring results. If the scoring results are greater than the first threshold, a warning confirmation needs to be sent to the first administrator to ensure the safety of user funds.

In this application, the first operation is obtained, the first operation is scored based on the preset modification rules and the preset event rules, the scoring result is obtained, and in response to the scoring result being greater than the first threshold, warning information is sent to multiple first administrators, so that The first administrator judges the modified user information based on the warning information, and judges whether the modified user information is abnormal modification. Compared with the prior art, all modified user information is manually judged. The present application can score the first operation, that is, the operation of modifying user information, and send warning information to a plurality of first administrators for the first operation whose score is greater than the first threshold. Therefore, the first administrator only needs to judge the first operation of sending the warning information to complete the judgment. It also overcomes the manual judgment of all the modified user information in the prior art. Since there are many modified user information that needs to be judged, the manual labor needs to work for a long time, resulting in a lot of manpower consumption and manual work for a long time. The problem of low work efficiency. It greatly reduces the manpower consumption in the process of judging whether the modification of user information is illegal, and improves the efficiency of judging abnormal modification of information.

FIG. 2 is a flowchart of another method for judging information abnormality modification provided by an embodiment of the present application. As shown in FIG. 2 , the method includes:

S201: Acquire first information, encrypt the first information line, and obtain a first ciphertext and a first signature.

The first terminal acquires the first information. The first information is user information modified by the user when the user normally handles the business, and then the first information line is encrypted to obtain the first ciphertext and the first signature.

S202: Obtain second information; encrypt the second information to obtain a second ciphertext and a second signature.

After acquiring the first information, the first terminal acquires the second information. The second information is currently modified user information, and the second information is encrypted to obtain a second ciphertext and a second signature.

S203: Determine that the second ciphertext matches the first ciphertext, and the second signature matches the first signature, and obtain the first operation.

The first terminal judges whether the second ciphertext matches the first ciphertext, and judges that the second signature matches the first signature, and when it is determined that the second ciphertext matches the first ciphertext, and the second signature matches the first signature, After the authentication is passed, the first operation is obtained. The identity of the person who modifies the user information is verified by verifying whether the encrypted ciphertext and the signature match, so that only when the identity verification is passed, the first acquisition operation will be performed. The accuracy of judging whether the modified user information is abnormal modification is improved.

S204: Acquire a first operation, score the first operation based on a preset modification rule and a preset event rule, and obtain a scoring result.

S205: In response to the scoring result being greater than the first threshold, send warning information to a plurality of first administrators, so that the first administrators can judge the modified user information based on the warning information, and determine whether the modified user information is Modified for exceptions.

S206: In response to the modified user information being abnormal modification, generate a third ciphertext and a third signature, replace the first ciphertext with the third ciphertext, and replace the first signature with the Third signature.

When determining that the modified user information is abnormally modified, the first terminal may generate a third ciphertext and a third signature, and then replace the first ciphertext with the third ciphertext, and replace the first signature with the third signature. In order to update the ciphertext and signature in the database, criminals cannot continue to modify user information.

S207: In response to the modified user information being an abnormal modification, modify the read identifier, and reconnect the modified read identifier to the database.

It should be explained that the database is the location where user information is stored and queried, and the information in the database cannot be directly modified, such as command line modification, database link tool modification, etc.

When the first terminal determines that the modified user information is abnormally modified, it can also modify the original read representation in the database, and then reconnect the modified read identifier to the database. Make the criminals unable to read the user information in the database.

The above embodiments of the present application provide some specific implementations of the method for judging abnormal modification of information. Based on this, the present application also provides a corresponding device. The following will introduce the device provided by the embodiments of the present application from the perspective of functional modularity, and the device and the data input method described above can be referred to each other correspondingly.

FIG. 3 is a specific structural schematic diagram of a device for judging abnormal modification of information provided by an embodiment of the present application, and the device includes:

a first obtaining unit 300, configured to obtain a first operation, where the first operation is an operation of modifying user information;

A second obtaining unit 310, configured to score the first operation based on a preset modification rule and a preset event rule, and obtain a scoring result, where the score is used to indicate the risk level of the first operation;

The first response unit 320 is configured to send warning information to a plurality of first administrators in response to the scoring result being greater than the first threshold, so that the first administrators can judge the modified user information based on the warning information, Whether the modified user information is abnormally modified, the first administrator is an administrator with the authority to modify user information.

Optionally, the device further includes:

a third obtaining unit, configured to obtain the first information;

a first encryption unit, configured to encrypt the first line of information to obtain a first ciphertext and a first signature, where the first information is user information modified by the user during normal business handling;

a fourth acquiring unit, configured to acquire the second information;

a second encryption unit, configured to encrypt the second information to obtain a second ciphertext and a second signature; determine that the second ciphertext matches the first ciphertext, and the second signature matches the The first signature matches, and the first operation is obtained.

Optionally, the device further includes:

The permitting unit is configured to allow the modification of the user information in response to the confirmation that the modified user information is correct and the modified user information is not abnormally modified in response to the first administrators of the plurality of first administrators who are greater than the threshold number.

Optionally, the device further includes:

a generating unit, configured to generate a third ciphertext and a third signature in response to the modified user information being an abnormal modification;

a replacement unit, configured to replace the first ciphertext with the third ciphertext, and replace the first signature with the third signature, so as to verify the acquired second signature and the third signature Whether it matches, whether the second ciphertext matches the third ciphertext.

Optionally, the device further includes:

a modification unit, configured to modify the read identification in response to the modified user information being an abnormal modification;

A connection unit, configured to reconnect the modified read identification to the database.

In this application, the first obtaining unit 300 obtains the first operation. The second obtaining unit 310 scores the first operation based on the preset modification rule and the preset event rule, and obtains a scoring result. The first response unit 320 sends warning information to a plurality of first administrators in response to the scoring result being greater than the first threshold, so that the first administrators can judge the modified user information based on the warning information, and determine the modified user information. Whether it is an abnormal modification. Compared with the prior art, all modified user information is manually judged. The present application can score the first operation, that is, the operation of modifying user information, and send warning information to a plurality of first administrators for the first operation whose score is greater than the first threshold. Therefore, the first administrator only needs to judge the first operation of sending the warning information to complete the judgment. It also overcomes the manual judgment of all the modified user information in the prior art. Since there are many modified user information that needs to be judged, the manual labor needs to work for a long time, resulting in a lot of manpower consumption and manual work for a long time. The problem of low work efficiency. It greatly reduces the manpower consumption in the process of judging whether the modification of user information is illegal, and improves the efficiency of judging abnormal modification of information.

The embodiments of the present application also provide corresponding devices and computer storage media for implementing the solutions provided by the embodiments of the present application.

The device includes a memory and a processor, where the memory is used to store instructions or codes, and the processor is used to execute the instructions or codes, so that the device performs the method described in any embodiment of the present application.

Code is stored in the computer storage medium, and when the code is executed, a device running the code implements the method described in any of the embodiments of the present application.

The "first" and "second" in the names such as "first" and "second" (if any) mentioned in the embodiments of this application are only used for name identification, and do not represent the first, second.

From the description of the above embodiments, those skilled in the art can clearly understand that all or part of the steps in the methods of the above embodiments can be implemented by means of software plus a general hardware platform. Based on this understanding, the technical solution of the present application can be embodied in the form of a software product, and the computer software product can be stored in a storage medium, such as read-only memory (English: read-only memory, ROM)/RAM, magnetic disk, An optical disc, etc., includes several instructions for causing a computer device (which may be a personal computer, a server, or a network communication device such as a router) to execute the methods described in various embodiments or some parts of the embodiments of the present application.

Each embodiment in this specification is described in a progressive manner, and the same and similar parts between the various embodiments may be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the apparatus embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and reference may be made to the partial description of the method embodiment for related parts. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution in this embodiment. Those of ordinary skill in the art can understand and implement it without creative effort.

The above descriptions are only exemplary embodiments of the present application, and are not intended to limit the protection scope of the present application.

Claims (10)

1. a method for judging abnormal modification of information, wherein the method comprises: obtaining a first operation, where the first operation is an operation of modifying user information; Score the first operation based on the preset modification rule and the preset event rule, and obtain a scoring result, where the score is used to indicate the risk level of the first operation; In response to the scoring result being greater than the first threshold, sending warning information to a plurality of first administrators, so that the first administrators can judge the modified user information based on the warning information, and determine whether the modified user information is abnormal Modify, the first administrator is an administrator with the right to modify user information. 2. The method according to claim 1, wherein before acquiring the first operation, the method further comprises: obtaining first information, encrypting the first information row, and obtaining a first ciphertext and a first signature, where the first information is user information modified by the user during normal business handling; obtain second information; Encrypt the second information to obtain a second ciphertext and a second signature; determine that the second ciphertext matches the first ciphertext, and the second signature matches the first signature, obtain all the Describe the first operation. 3. The method according to claim 1, wherein the method further comprises: In response to the first administrators of the plurality of first administrators who are greater than the threshold number confirming that the modified user information is correct, the modified user information is not an abnormal modification, and the modification of the user information is allowed. 4. The method according to claim 2, wherein the method further comprises: In response to the modified user information being an abnormal modification, a third ciphertext and a third signature are generated; Replace the first ciphertext with the third ciphertext, and replace the first signature with the third signature. 5. The method according to claim 1, wherein the method further comprises: In response to the modified user information being abnormal modification, modify the read identification; The modified read identification is reconnected to the database. 6. A device for judging abnormal modification of information, characterized in that, comprising: a first obtaining unit, configured to obtain a first operation, where the first operation is an operation of modifying user information; a second obtaining unit, configured to score the first operation based on a preset modification rule and a preset event rule, and obtain a scoring result, where the score is used to indicate the risk level of the first operation; A first response unit, configured to send warning information to a plurality of first administrators in response to the scoring result being greater than a first threshold, so that the first administrators can judge the modified user information based on the warning information, and judge the Whether the modified user information is abnormally modified, the first administrator is an administrator with the right to modify user information. 7. The device according to claim 6, wherein the device further comprises: a third acquiring unit, configured to acquire the first information; a first encryption unit, configured to encrypt the first line of information to obtain a first ciphertext and a first signature, where the first information is user information modified by the user during normal business handling; a fourth obtaining unit, configured to obtain the second information; a second encryption unit, configured to encrypt the second information to obtain a second ciphertext and a second signature; determine that the second ciphertext matches the first ciphertext, and the second signature matches the The first signature matches, and the first operation is obtained. 8. The apparatus of claim 6, wherein the apparatus further comprises: The permitting unit is configured to allow the modification of the user information in response to the confirmation that the modified user information is correct and the modified user information is not abnormally modified in response to the first administrators in the plurality of first administrators who are greater than the threshold number. 9. The apparatus of claim 7, wherein the apparatus further comprises: a generating unit, configured to generate a third ciphertext and a third signature in response to the modified user information being an abnormal modification; A replacement unit, configured to replace the first ciphertext with the third ciphertext, and replace the first signature with the third signature. 10. The apparatus of claim 6, wherein the apparatus further comprises: a modification unit, configured to modify the read identification in response to the modified user information being an abnormal modification; A connection unit, configured to reconnect the modified read identification to the database.

Images