WO2017028738A1

WO2017028738A1 - Region-based risk control method and device

Info

Publication number: WO2017028738A1
Application number: PCT/CN2016/094664
Authority: WO
Inventors: 王维强; 郭亮; 冯力国; 费斌杰; 蒋博赟
Original assignee: 阿里巴巴集团控股有限公司; 王维强; 郭亮; 冯力国; 费斌杰; 蒋博赟
Priority date: 2015-08-20
Filing date: 2016-08-11
Publication date: 2017-02-23
Also published as: CN106469346A; CN106469346B

Abstract

Disclosed are a region-based risk control method and device, the method comprising: acquiring a first behavior event generated by a target user in a first network region (101); determining a region transfer rule corresponding to the first behavior event according to a mapping relationship between the behavior events and the region transfer rule (102); determining, according to the region transfer rule, that the first behavior event is transferred from the first network region to a second network region by the target user within a set period of time (103); and adjusting a risk control level of the second network region according to the first behavior event and a preset risk control policy (104). Based on the region transfer rule corresponding to the behavior event, transfer of the first behavior event to the second network region can be effectively estimated according to the first behavior event generated in the first network region, thus adjusting the risk control policy of the second network region in a timely and effective way, avoiding the situation where the risk control policy lags behind the occurrence of risk events, realizing precise control over risk events, and improving network security in Internet information interaction.

Description

Regional based risk control method and device

Technical field

The present application relates to the field of Internet information processing technologies, and in particular, to a region-based risk control method and device.

Background technique

With the development of science and technology, Internet technology has brought great convenience to people's production and life. However, in real life, people are determined to be risky in doing anything, but things are different and the risks they face are different. Therefore, before deciding to do anything, they often risk the doing. control. For example, for a new product, before deciding to produce the new product, it is necessary to control the risk of whether the new product can bring benefits. In general, product producers estimate the possible risk events based on the experience of producing other products and conduct risk control on possible risk events.

However, the information interaction platform constructed by Internet technology belongs to the virtual space, which is different from the physical space to which the real life belongs. Then, the risk control method for the events occurring in the information interaction platform and the risk control method for the events occurring in the real life. different.

In existing risk control systems, risk control is usually carried out in a regionalized manner. Specifically, for a certain area, the area is divided into a plurality of different areas according to the geographical location, and risk control strategies are assigned to different areas obtained by the division, and the risk control strategies are used to control the area. For example, if a region in Area A has a large number of user information leakage events in the Internet information interaction platform, a high-level risk control strategy will be adopted for the region, thus reducing the risk of user information leakage again in the region.

However, due to the variable nature of the risk itself, the risk control methods used in the existing risk control systems are relatively fixed, and cannot flexibly adapt to the development needs of the Internet information interaction platform, making the implementation of risk control strategies often lagging behind. The occurrence of risk events has led to poor network security of the Internet information exchange platform, that is, the risk control of the Internet information interaction platform. The degree is relatively low.

Summary of the invention

In view of this, the embodiment of the present application provides a region-based risk control method and device, which is used to solve the problem that the risk control precision of the Internet information interaction platform in the prior art is relatively low.

A region-based risk control method that includes:

Obtaining, by the target user, a first behavior event generated in the first network area, where the first behavior event belongs to a behavior event whose generated frequency is higher than a set threshold in a set time;

Determining an area transfer rule corresponding to the first behavior event according to a mapping relationship between the behavior event and the area transfer rule;

Determining, according to the area transfer rule, a second network area to which the target user transfers the first behavior event from the first network area within the set time;

And adjusting a risk control level of the second network area according to the first behavior event and a preset risk control policy.

A zone-based risk control device that includes:

An acquiring unit, configured to acquire a first behavior event generated by the target user in the first network area, where the first behavior event belongs to a behavior event that generates a frequency higher than a set threshold in the first set time;

a determining unit, configured to determine an area transfer rule corresponding to the first behavior event according to a mapping relationship between the behavior event and the area transfer rule; and determine, according to the area transfer rule, that the target user is in the first setting And a second network area to which the first behavior event is transferred from the first network area to a fixed time;

And a control unit, configured to adjust a risk control level of the second network area according to the first behavior event and a preset risk control policy.

The beneficial effects of the application are as follows:

The embodiment of the present application obtains a first behavior event generated by the target user in the first network area, where the first behavior event belongs to a behavior event whose frequency is higher than a set threshold in the first set time; a mapping relationship between the behavior event and the regional transfer rule, determining an area transfer rule corresponding to the first behavior event; determining, according to the area transfer rule, that the target user performs the first behavior within the set time The second network area to which the event is transferred by the first network area; adjusting the risk control level of the second network area according to the first behavior event and a preset risk control policy. In this way, based on the regional transfer rule corresponding to the behavior event, the second network region to which the first behavior event is transferred can be effectively estimated according to the first behavior event generated in the first network region, and the second network can be effectively adjusted in time. The risk control strategy of the network area avoids the risk control strategy lags behind the occurrence of the risk event, realizes the precise control of the risk event, and improves the network security of the Internet information interaction platform.

DRAWINGS

In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following drawings will be briefly described in the description of the embodiments. It is obvious that the drawings in the following description are only some embodiments of the present application, Those skilled in the art can also obtain other drawings based on these drawings without paying for inventive labor.

FIG. 1 is a schematic flowchart of a region-based risk control method according to an embodiment of the present application;

2 is a schematic flowchart of determining a mapping relationship between a behavior event and a region transfer rule;

FIG. 3 is a schematic structural diagram of a region-based risk control device according to an embodiment of the present application.

detailed description

In order to achieve the purpose of the present application, an embodiment of the present application provides a region-based risk control method and device, and acquires a first behavior event generated by a target user in a first network region, where the first behavior event belongs to the first device. A behavior event having a frequency higher than a set threshold is generated in a predetermined time; determining, according to a mapping relationship between the behavior event and the regional transfer rule, an area transfer rule corresponding to the first behavior event; determining, according to the regional transfer rule, Adjusting, by the target user, the first behavior event from the first network area to the second network area within the set time; adjusting the location according to the first behavior event and a preset risk control policy The risk control level of the second network area. In this way, based on The area transfer rule corresponding to the behavior event can effectively predict the second network area to which the first behavior event is transferred according to the first behavior event generated in the first network area, and can adjust the second network area in time and effectively. The risk control strategy avoids the risk control strategy lags behind the occurrence of risk events, achieves precise control of risk events, and improves the network security of the Internet information interaction platform.

The various embodiments of the present application are further described in detail below with reference to the accompanying drawings. It is apparent that the described embodiments are only a part of the embodiments of the present application, and not all of them. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present application without departing from the inventive scope are the scope of the present application.

FIG. 1 is a schematic flowchart of a region-based risk control method according to an embodiment of the present application. The method can be as follows.

Step 101: Acquire a first behavior event generated by the target user in the first network area.

The first behavior event belongs to a behavior event that generates a frequency higher than a set threshold in a first set time.

In step 101, in the embodiment of the present application, the first network area is used as a starting target of the area transfer, and the first type of the at least one type generated by the target user in the first network area in the first set time is obtained from the database. Behavioral events.

The first behavior event here may be a subscription behavior event initiated by the target user on the Internet information interaction platform, or a payment behavior event initiated by the target user on the Internet information interaction platform, or the target user may be on the Internet information interaction platform. Initiated network transaction behavior events and so on.

The frequency of occurrence of each type of first behavioral event is determined when at least one type of first behavioral event generated by the target user within the first network region is obtained.

Further, determining whether the frequency of occurrence of each type of the first behavior event is higher than a set threshold, and generating a first behavior event having a frequency higher than the set threshold as a risk control level for triggering adjustment of the associated network region Basis.

It should be noted that the “first set time” described in the embodiment of the present application corresponds to a long time. The length of time corresponding to the "second set time" described in the following may be the same or different, and is not limited herein; the "first" and "second" herein have no other special meaning, and are only used to distinguish different ones. set time.

The size of the threshold value can be determined according to actual needs, or can be determined according to experimental data. Here, the value of the size is not limited.

Step 102: Determine an area transfer rule corresponding to the first behavior event according to a mapping relationship between the behavior event and the area transfer rule.

In step 102, first, a method for determining the mapping relationship between the behavior event and the regional transfer rule is introduced.

In the embodiment of the present application, the manner of determining the mapping relationship between the behavior event and the area transfer rule may be in the manner described below, or may be other manners, and the other manners are not specifically limited herein.

Specifically, as shown in FIG. 2, a schematic flowchart of determining a mapping relationship between a behavior event and a region transfer rule.

S21: Acquire environmental data of a target behavior event generated by the user in the second set time.

The environmental data includes real space data and/or virtual space data.

In S21, acquiring environmental data of the target behavior event generated by the user in the second set time may be understood as extracting historical data of the user, the historical data including the target behavior event, the environmental data generating the target behavior event, and generating the target The time of the behavioral event.

When the historical data is obtained, the target behavior event that generates the target behavior event for the second set time and the environment data that generates the target behavior event that meets the second set time are selected from the acquired historical data.

The environmental data involved in the embodiment of the present application includes real space data and/or virtual space data, where the real space data may refer to a user acquired by a location based service (English: Location Based Services; abbreviation: LBS). Location information of the terminal device; may also refer to the city information, the area code, etc. of the terminal device used by the user; the virtual space data may refer to the network between Protocol (English: Internet Protocol; abbreviation: IP) address; can also refer to the unique material identifier (English: Unique Material Identifier; abbreviation: UMID); can also be a WiFi address and so on.

Optionally, after the environment data is acquired, the environment data needs to be converted. For example, for real-world data, the real-space data is converted into a grid point according to the spatial dimension by using data analysis, for example, the target behavior event occurs. The real-space data is LBS, then the obtained LBS can be converted into a point with a geographic location of XXXXXX; for virtual space data, the virtual space data is also converted into a grid point according to the spatial dimension by means of data analysis, for example, : The virtual space data of the target behavior event is the IP address (128.10.2.21), then the obtained IP address can be converted to 128.10.2.0.

It should be noted that the grid points belong to a multi-dimensional space network, that is, the multi-dimensional space network is set to contain multiple dimensions, and each dimension can be mapped from 1 to any, and the transformed grid points are mapped in the multi-dimensional space network, that is, Each grid point corresponds to a unique multidimensional spatial location in a multidimensional space network.

S22: Analyze, according to the environmental data, an area transfer rule that is generated by the user to generate the target behavior event.

The area transfer rule includes at least two network areas, and the area coincidence degree in the at least two network areas is greater than a set threshold.

In S22, optionally, the second set time is divided into at least two time intervals, and the time points included in the at least two time intervals are consecutive.

Specifically, in the first step, the environment data is divided into at least two groups according to the generation time of the target behavior event, wherein the generation time of the environment data included in each group belongs to a time interval.

In the second step, the environmental data included in each of the at least two groups is aggregated to obtain different network regions.

Specifically, the environmental data included in each of the at least two groups is aggregated to obtain different network regions, including:

For the environmental data contained in each group, perform:

Converting the environmental data contained in one of the groups into grid points in the multi-dimensional space network, and determining an association relationship between the grid points in the multi-dimensional space network; wherein the association relationship is based on each network The positional relationship of the grid points in the multidimensional space network is determined.

The multi-dimensional space network including the respective grid points is divided into different network areas by using the association relationship.

For example, according to the algorithm of graph clustering and the association relationship, the multi-dimensional space network including the respective grid points is divided into different network regions.

For another example, the multi-dimensional space network including the respective grid points is divided into different network areas according to the association rule and the association relationship.

In the third step, two of the network regions obtained by the at least two groups of aggregations are selected.

In the fourth step, a network area is selected from each of the selected network areas, and the area overlap degree of the selected two network areas is calculated.

It should be noted that the area coincidence degree refers to the ratio of the area formed by the same coordinate position points included in the two network areas to the two network areas.

In the fifth step, when the calculated area coincidence degree is greater than a set threshold, it is determined that the selected two network areas satisfy the area transfer rule.

It should be noted that the third step to the fifth step may be performed multiple times until it is determined that at least two network areas satisfying the area transfer rule in the network area obtained by the at least two groups of aggregations are determined.

That is to say, by calculating the coincidence degree, the regional transfer rule generated by the target behavior event in the second set time is determined, and the stability of the target behavior event occurring in the regions satisfying the regional transfer rule is determined, and Once the target behavior event is generated in any of these areas that satisfy the regional transfer rule, it is possible to predict in advance that the possibility of occurrence in other areas in the areas satisfying the regional transfer rule is increased, and the risk control strategy for other areas in time is timely. Make adjustments to avoid the risk control strategy lags behind the risk event and effectively improve the accuracy of risk control.

S23: Establish a mapping relationship between the target behavior event and the regional transfer rule according to the regional transfer rule obtained by the analysis.

In the embodiment of the present application, after obtaining the mapping relationship between the behavior event and the regional transfer rule, the mapping relationship between the different behavior events and the determined regional transfer rule may be separately established in the database according to different behavior events.

When the first behavior event is obtained, according to the mapping relationship between the established target behavior event and the regional transfer rule, the regional transfer rule corresponding to the first behavior event is obtained.

Step 103: Determine, according to the area transfer rule, a second network area to which the target user transfers the first behavior event from the first network area within the set time.

In step 103, in step 102, the area transfer rule of the first behavior event is determined, that is, the obtained area transfer rule includes at least one second network area other than the first network area, and then the area transfer rule is included. At least one of the second network areas is a target network area to which the target user transfers the first behavior event from the first network area within the set time.

Step 104: Adjust a risk control level of the second network area according to the first behavior event and a preset risk control policy.

In step 104, specifically, if the risk level of the first behavior event is less than the set risk level, reducing the risk control level of the second network area according to the preset risk control policy;

If the risk level of the first behavior event is greater than the set risk level, the risk control level of the second network area is increased according to a preset risk control policy.

It should be noted that the risk level of the first behavior event may be determined by the degree of harm caused by the occurrence of the first behavior event, and the general risk level may be classified into a low level, a medium level, and a high level. The risk level corresponding to the severity of the hazard is a high level; the medium level of the corresponding hazard level is a medium level; the degree of hazard is small or the corresponding risk level is a low level.

Determining that the first behavior event belongs to a low-risk event when the risk level of the first behavior event is less than a set risk level; determining the first when the risk level of the first behavior event is greater than a set risk level A behavioral event is a high-risk event.

Optionally, performing risk control adjustment on all network areas included in the determined area transfer rule according to the first behavior event and the preset risk control policy, for example, if the first behavior If the event is a low-risk event, the risk control strategy of all network areas included in the determined area transfer rule is adjusted to be loose (or, reduce the risk control level);

If the first behavior event belongs to a low-risk event, the risk control policy of all network areas included in the determined area transfer rule is adjusted to be tightened (or the risk control level is increased).

Obtaining, by the solution of the embodiment of the present application, a first behavior event generated by the target user in the first network area, where the first behavior event belongs to a behavior event in which the generated frequency is higher than the set threshold in the first set time; Determining, according to the mapping relationship between the behavior event and the regional transfer rule, an area transfer rule corresponding to the first behavior event; determining, according to the area transfer rule, that the target user is to be the first time in the set time The second network area to which the behavior event is transferred by the first network area; and the risk control level of the second network area is adjusted according to the first behavior event and a preset risk control policy. In this way, based on the regional transfer rule corresponding to the behavior event, the second network region to which the first behavior event is transferred can be effectively estimated according to the first behavior event generated in the first network region, and the second network can be effectively adjusted in time. The risk control strategy of the network area avoids the risk control strategy lags behind the occurrence of the risk event, realizes the precise control of the risk event, and improves the network security of the Internet information interaction platform.

FIG. 3 is a schematic structural diagram of a region-based risk control device according to an embodiment of the present disclosure. The risk control device includes: an obtaining unit 31, a determining unit 32, and a control unit 33, where:

The acquiring unit 31 is configured to acquire a first behavior event that is generated by the target user in the first network area, where the first behavior event belongs to a behavior event that generates a frequency higher than a set threshold in the first set time;

a determining unit 32, configured to determine an area transfer rule corresponding to the first behavior event according to a mapping relationship between the behavior event and the area transfer rule; and determine, according to the area transfer rule, that the target user is in the first And a second network area to which the first behavior event is transferred from the first network area within a set time;

The control unit 33 is configured to adjust a risk control level of the second network area according to the first behavior event and a preset risk control policy.

Specifically, the control unit 33 is specifically configured to: if the first behavior event belongs to a low-risk event, reduce a risk control level of the second network region according to a preset risk control policy;

If the first behavior event belongs to a high-risk event, the risk control level of the second network region is increased according to a preset risk control policy.

Specifically, the determining unit 32 determines a mapping relationship between the behavior event and the area transfer rule by:

Acquiring environment data of the target behavior event generated by the user in the second set time, wherein the environment data includes real space data and/or virtual space data;

And analyzing, according to the environment data, an area transfer rule that is generated by the user to generate the target behavior event, where the area transfer rule includes at least two network areas, and the area overlap degree in the at least two network areas is greater than Set a threshold;

And establishing, according to the analyzed regional transfer rule, a mapping relationship between the target behavior event and the regional transfer rule.

Optionally, the second set time is divided into at least two time intervals, and the time points included in the at least two time intervals are consecutive;

The determining unit 32 analyzes, according to the environment data, an area transfer rule that the user generates the target behavior event, including:

The environmental data is divided into at least two groups according to the generation time of the target behavior event, wherein the generation time of the environmental data included in each group belongs to a time interval;

Aggregating the environmental data included in each of the at least two groups to obtain different network regions;

Selecting two of the network regions obtained by the at least two groups of aggregations;

Selecting one network area from each of the selected network areas obtained by the aggregation, and calculating the area coincidence degree of the selected two network areas;

When the calculated area coincidence degree is greater than the set threshold, it is determined that the area transfer rule is satisfied between the selected two network areas.

Specifically, the determining unit 32 includes the environmental data included in each of the at least two groups Aggregation yields different network areas, including:

For the environmental data contained in each group, perform:

Converting the environmental data contained in one of the groups into grid points in the multi-dimensional space network, and determining an association relationship between the grid points in the multi-dimensional space network;

It should be noted that the risk control device provided by the embodiment of the present disclosure may be implemented by using a software, or may be implemented by using a hardware, which is not limited herein.

The risk control device provided by the embodiment of the present application is capable of effectively estimating the second network region to which the first behavior event is transferred according to the first behavior event generated in the first network region, based on the region transfer rule corresponding to the behavior event. The risk control strategy of the second network area can be adjusted in time and effectively to avoid the risk control strategy lags behind the occurrence of the risk event, achieve precise control of the risk event, and improve the network security of the Internet information interaction platform.

Those skilled in the art will appreciate that embodiments of the present application can be provided as a method, apparatus (device), or computer program product. Thus, the present application can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment in combination of software and hardware. Moreover, the application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) including computer usable program code.

The present application is described with reference to flowchart illustrations and/or block diagrams of a method, apparatus, and computer program product according to embodiments of the present application. It will be understood that each flow and/or block of the flowchart illustrations and/or FIG. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing device to produce a machine for the execution of instructions for execution by a processor of a computer or other programmable data processing device. Means for implementing the functions specified in one or more of the flow or in a block or blocks of the flow chart.

These computer program instructions can also be stored in a bootable computer or other programmable data processing device. In a computer readable memory that operates in a particular manner, causing instructions stored in the computer readable memory to produce an article of manufacture comprising an instruction device implemented in one or more flows and/or block diagrams of the flowchart The function specified in the box or in multiple boxes.

These computer program instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce computer-implemented processing for execution on a computer or other programmable device. The instructions provide steps for implementing the functions specified in one or more of the flow or in a block or blocks of a flow diagram.

While the preferred embodiment of the present application has been described, it will be apparent that those skilled in the art can make further changes and modifications to the embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and the modifications and

It will be apparent to those skilled in the art that various modifications and changes can be made in the present application without departing from the scope of the application. Thus, it is intended that the present invention cover the modifications and variations of the present invention.

Claims

A region-based risk control method, comprising:

Obtaining, by the target user, a first behavior event generated in the first network area, where the first behavior event belongs to a behavior event that generates a frequency higher than a set threshold in a first set time;

Determining an area transfer rule corresponding to the first behavior event according to a mapping relationship between the behavior event and the area transfer rule;

Determining, according to the area transfer rule, the second network area to which the target user transfers the first behavior event from the first network area in the first set time;

And adjusting a risk control level of the second network area according to the first behavior event and a preset risk control policy.
The risk control method according to claim 1, wherein the risk control level of the second network area is adjusted according to the first behavior event and a preset risk control policy, including:

If the risk level of the first behavior event is less than the set risk level, reducing the risk control level of the second network area according to the preset risk control policy;

If the risk level of the first behavior event is greater than the set risk level, the risk control level of the second network area is increased according to a preset risk control policy.
The risk control method according to claim 1 or 2, wherein the mapping relationship between the behavior event and the area transfer rule is determined by:

Acquiring environment data of the target behavior event generated by the user in the second set time, wherein the environment data includes real space data and/or virtual space data;

And analyzing, according to the environment data, an area transfer rule that is generated by the user to generate the target behavior event, where the area transfer rule includes at least two network areas, and the area overlap degree in the at least two network areas is greater than Set a threshold;

And establishing, according to the analyzed regional transfer rule, a mapping relationship between the target behavior event and the regional transfer rule.
The risk control method according to claim 3, wherein said second set time Divided into at least two time intervals, the time points included in the at least two time intervals being continuous;

And analyzing, according to the environmental data, an area transfer rule that is generated by the user to generate the target behavior event, including:

The environmental data is divided into at least two groups according to the generation time of the target behavior event, wherein the generation time of the environmental data included in each group belongs to a time interval;

Aggregating the environmental data included in each of the at least two groups to obtain different network regions;

Selecting two of the network regions obtained by the at least two groups of aggregations;

Selecting one network area from each of the selected network areas obtained by the aggregation, and calculating the area coincidence degree of the selected two network areas;

When the calculated area coincidence degree is greater than the set threshold, it is determined that the area transfer rule is satisfied between the selected two network areas.
The risk control method according to claim 4, wherein the environmental data included in each of the at least two groups is aggregated to obtain different network regions, including:

For the environmental data contained in each group, perform:

Converting the environmental data contained in one of the groups into grid points in the multi-dimensional space network, and determining an association relationship between the grid points in the multi-dimensional space network;

The multi-dimensional space network including the respective grid points is divided into different network areas by using the association relationship.
A region-based risk control device, comprising:

An acquiring unit, configured to acquire a first behavior event generated by the target user in the first network area, where the first behavior event belongs to a behavior event that generates a frequency higher than a set threshold in the first set time;

a determining unit, configured to determine an area transfer rule corresponding to the first behavior event according to a mapping relationship between the behavior event and the area transfer rule; and determine, according to the area transfer rule, that the target user is in the first setting And a second network area to which the first behavior event is transferred from the first network area to a fixed time;

And a control unit, configured to adjust a risk control level of the second network area according to the first behavior event and a preset risk control policy.
A risk control device according to claim 6 wherein:

The control unit is specifically configured to: if the risk level of the first behavior event is less than a set risk level, reduce a risk control level of the second network area according to a preset risk control policy;

If the risk behavior level of the first behavior event belongs to the high risk event is greater than the set risk level, the risk control level of the second network area is increased according to the preset risk control policy.
The risk control device according to claim 6 or 7, wherein the determining unit determines a mapping relationship between the behavior event and the area transfer rule by:

Acquiring environment data of the target behavior event generated by the user in the second set time, wherein the environment data includes real space data and/or virtual space data;

And analyzing, according to the environment data, an area transfer rule that is generated by the user to generate the target behavior event, where the area transfer rule includes at least two network areas, and the area overlap degree in the at least two network areas is greater than Set a threshold;

And establishing, according to the analyzed regional transfer rule, a mapping relationship between the target behavior event and the regional transfer rule.
The risk control device according to claim 8, wherein the second set time is divided into at least two time intervals, and the time points included in the at least two time intervals are continuous;

The determining unit analyzes, according to the environmental data, an area transfer rule that the user generates the target behavior event, including:

The environmental data is divided into at least two groups according to the generation time of the target behavior event, wherein the generation time of the environmental data included in each group belongs to a time interval;

Aggregating the environmental data included in each of the at least two groups to obtain different network regions;

Selecting two of the network regions obtained by the at least two groups of aggregations;

Selecting one network area from each of the selected network areas obtained by the aggregation, and calculating the area coincidence degree of the selected two network areas;

When the calculated area coincidence degree is greater than the set threshold, it is determined that the area transfer rule is satisfied between the selected two network areas.
The risk control device according to claim 5, wherein the determining unit aggregates the environmental data included in each of the at least two groups to obtain different network regions, including:

For the environmental data contained in each group, perform:

Converting the environmental data contained in one of the groups into grid points in the multi-dimensional space network, and determining an association relationship between the grid points in the multi-dimensional space network;

The multi-dimensional space network including the respective grid points is divided into different network areas by using the association relationship.