淘宝返利软件后端架构中的防刷单风控规则引擎设计（Drools 应用）-编程阁

淘宝返利软件后端架构中的防刷单风控规则引擎设计（Drools 应用）

大家好，我是微赚淘客系统3.0 的研发者省赚客！

在高并发返利场景下，恶意用户通过脚本、虚拟设备、多账号等方式批量下单套取佣金，严重侵蚀平台利润。为应对复杂多变的刷单行为，微赚淘客系统3.0 引入基于Drools 规则引擎的动态风控体系，实现规则热更新、多维度判定与毫秒级拦截。

一、风控对象建模

首先定义风控上下文实体，作为规则判断依据：

packagejuwatech.cn.risk.model;importjava.time.LocalDateTime;importjava.util.List;publicclassOrderRiskContext{privateLonguserId;privateStringdeviceId;privateStringip;privateLongorderId;privateLongorderAmount;// 订单金额（分）privateLocalDateTimecreateTime;privateList<String>recentOrderIps;// 近1小时订单IP列表privateintsameDeviceOrderCount24h;// 24小时内同设备订单数privatebooleanisNewUser;// 是否注册<7天privatebooleanisHighRiskIp;// 是否高危IP（来自情报库）privatebooleanblocked;// 是否被拦截（输出字段）// getters & setterspublicvoidblock(){this.blocked=true;}}

二、Drools 规则文件示例

规则文件fraud-rules.drl存放于resources/rules/目录，支持动态加载：

package juwatech.cn.rules import juwatech.cn.risk.model.OrderRiskContext // 规则1：新用户大额订单 rule "NewUserLargeOrder" when $ctx: OrderRiskContext( isNewUser == true, orderAmount > 50000, // >500元 !blocked ) then System.out.println("Blocked: New user large order, userId=" + $ctx.getUserId()); $ctx.block(); end // 规则2：同一设备高频下单 rule "HighFrequencySameDevice" when $ctx: OrderRiskContext( sameDeviceOrderCount24h >= 10, !blocked ) then System.out.println("Blocked: High frequency on device=" + $ctx.getDeviceId()); $ctx.block(); end // 规则3：IP异常跳转（1小时内多个省份） rule "MultiProvinceIpJump" when $ctx: OrderRiskContext( recentOrderIps != null, recentOrderIps.size > 3, isHighRiskIp == false, !blocked ) eval( hasDifferentProvinces($ctx.recentOrderIps) ) then System.out.println("Blocked: Multi-province IP jump for userId=" + $ctx.getUserId()); $ctx.block(); end

其中hasDifferentProvinces为自定义函数，需在 DRL 中声明或通过 Java 调用：

packagejuwatech.cn.risk.util;importjuwatech.cn.geo.IpGeoService;publicclassRiskFunctions{publicstaticbooleanhasDifferentProvinces(List<String>ips){IpGeoServicegeo=newIpGeoService();longprovinceCount=ips.stream().map(geo::getProvince).filter(p->p!=null&&!p.isEmpty()).distinct().count();returnprovinceCount>2;}}

并在 DRL 文件顶部导入：

import function juwatech.cn.risk.util.RiskFunctions.hasDifferentProvinces

三、Drools 引擎初始化与调用

通过 Spring Boot 集成 Drools：

packagejuwatech.cn.risk.config;importorg.kie.api.KieServices;importorg.kie.api.builder.KieBuilder;importorg.kie.api.builder.KieFileSystem;importorg.kie.api.runtime.KieContainer;importorg.kie.api.runtime.KieSession;importorg.springframework.context.annotation.Bean;importorg.springframework.context.annotation.Configuration;@ConfigurationpublicclassDroolsConfig{privatestaticfinalStringRULES_PATH="rules/fraud-rules.drl";@BeanpublicKieContainerkieContainer(){KieServicesks=KieServices.Factory.get();KieFileSystemkfs=ks.newKieFileSystem();kfs.write(RULES_PATH,getResource(RULES_PATH));KieBuilderkb=ks.newKieBuilder(kfs);kb.buildAll();returnks.newKieContainer(ks.getRepository().getDefaultReleaseId());}privateStringgetResource(Stringpath){// 从 classpath 或远程配置中心加载规则内容returngetClass().getClassLoader().getResourceAsStream(path).readAllBytes();}@BeanpublicKieSessionkieSession(KieContainerkieContainer){returnkieContainer.newKieSession();}}

四、风控服务调用流程

在订单创建前插入风控检查：

packagejuwatech.cn.risk.service;importjuwatech.cn.risk.model.OrderRiskContext;importorg.kie.api.runtime.KieSession;importorg.springframework.stereotype.Service;@ServicepublicclassFraudDetectionService{privatefinalKieSessionkieSession;privatefinalRiskDataEnricherenricher;publicFraudDetectionService(KieSessionkieSession,RiskDataEnricherenricher){this.kieSession=kieSession;this.enricher=enricher;}publicbooleanisFraudulent(LonguserId,LongorderId){OrderRiskContextctx=newOrderRiskContext();ctx.setUserId(userId);ctx.setOrderId(orderId);// 填充基础字段enricher.enrich(ctx);// 补全IP、设备、历史行为等kieSession.insert(ctx);kieSession.fireAllRules();kieSession.dispose();// 注意：生产环境应使用有状态会话池或无状态KieBasereturnctx.isBlocked();}}

其中RiskDataEnricher负责从 Redis、MySQL、风控情报库中聚合数据：

packagejuwatech.cn.risk.service;importjuwatech.cn.risk.model.OrderRiskContext;importorg.springframework.data.redis.core.RedisTemplate;importorg.springframework.stereotype.Component;@ComponentpublicclassRiskDataEnricher{privatefinalRedisTemplate<String,Object>redisTemplate;privatefinalIpRiskServiceipRiskService;publicvoidenrich(OrderRiskContextctx){StringdeviceKey="device:orders:"+ctx.getDeviceId();Integercount=(Integer)redisTemplate.opsForHash().get(deviceKey,"count_24h");ctx.setSameDeviceOrderCount24h(count!=null?count:0);ctx.setRecentOrderIps(getRecentIpsFromRedis(ctx.getUserId()));ctx.setIsHighRiskIp(ipRiskService.isHighRisk(ctx.getIp()));ctx.setIsNewUser(isNewUser(ctx.getUserId()));}// 省略具体实现}

五、规则热更新机制

为避免重启服务，我们监听 Nacos 或 Apollo 配置变更，动态重载 KieContainer：

@EventListenerpublicvoidonRuleUpdate(RuleConfigChangeEventevent){StringnewDrl=event.getNewContent();// 写入临时文件或直接构建 KieModuleKieServicesks=KieServices.Factory.get();KieFileSystemkfs=ks.newKieFileSystem();kfs.write("rules/fraud-rules.drl",newDrl);KieBuilderkb=ks.newKieBuilder(kfs).buildAll();if(kb.getResults().hasMessages(org.kie.api.builder.Message.Level.ERROR)){log.error("Rule compile error: {}",kb.getResults().getMessages());return;}KieContainernewContainer=ks.newKieContainer(ks.getRepository().getDefaultReleaseId());// 原子替换全局引用this.kieContainerRef.set(newContainer);}