A method for risk identification comprising: receiving, by an end user device, a service processing request; extracting, by the end user device, service data from the service processing request; performing, by the end user device, first risk identification on the service processing request based on a first stored risk identification rule with reference to the service data to generate a first risk identification result, wherein the first stored risk identification rule is stored at the end user device; determining, by the end user device, whether the first risk identification result is a definite result or an indefinite result, wherein the definite result indicates that the first risk identification result can be determined and the indefinite result indicates that the first risk identification result cannot be determined; in response to determining that the first risk identification result is the indefinite result, sending, by the end user device, a risk identification request that comprises the service data to a cloud risk identification device, wherein the risk identification request causes the cloud risk identification device to perform second risk identification on the service processing request based on a second stored risk identification rule with reference to the service data to generate a second risk identification result, wherein the second stored risk identification rule is different from the first stored risk identification rule, wherein the second stored risk identification rule is stored at the cloud risk identification device; in response to determining that the first risk identification result is the definite result, sending, by the end user device, the first risk identification result to the cloud risk identification device, receiving and storing, at the cloud risk identification device, the first risk identification result sent from the end user device, and obtaining, by the cloud risk identification device, service data of the first risk identification result; and using, by the cloud risk identification device, i) the stored first risk identification result and ii) the obtained service data as a training sample to optimize the second stored risk identification rule to improve risk identification accuracy. receiving, by an end user device, a service processing request; extracting, by the end user device, service data from the service processing request; performing, by the end user device, first risk identification on the service processing request based on a first stored risk identification rule with reference to the service data to generate a first risk identification result, wherein the first stored risk identification rule is stored at the end user device; determining, by the end user device, whether the first risk identification result is a definite result or an indefinite result, wherein the definite result indicates that the first risk identification result can be determined and the indefinite result indicates that the first risk identification result cannot be determined; in response to determining that the first risk identification result is the indefinite result, sending, by the end user device, a risk identification request that comprises the service data to a cloud risk identification device, wherein the risk identification request causes the cloud risk identification device to perform second risk identification on the service processing request based on a second stored risk identification rule with reference to the service data to generate a second risk identification result, wherein the second stored risk identification rule is different from the first stored risk identification rule, wherein the second stored risk identification rule is stored at the cloud risk identification device; in response to determining that the first risk identification result is the definite result, sending, by the end user device, the first risk identification result to the cloud risk identification device, receiving and storing, at the cloud risk identification device, the first risk identification result sent from the end user device, and obtaining, by the cloud risk identification device, service data of the first risk identification result; and using, by the cloud risk identification device, i) the stored first risk identification result and ii) the obtained service data as a training sample to optimize the second stored risk identification rule to improve risk identification accuracy. sending, by the end user device, the first risk identification result to the cloud risk identification device, receiving and storing, at the cloud risk identification device, the first risk identification result sent from the end user device, and obtaining, by the cloud risk identification device, service data of the first risk identification result; and using, by the cloud risk identification device, i) the stored first risk identification result and ii) the obtained service data as a training sample to optimize the second stored risk identification rule to improve risk identification accuracy.