Method and device for intelligently identifying panic buying behaviors

[0063] The preferred embodiments of the present invention will be described below with reference to the accompanying drawings. It should be understood that the preferred embodiments described here are only used to illustrate and explain the present invention, and are not used to limit the present invention.

[0064] figure 1 It is a flowchart of a method for intelligently identifying panic buying behavior according to an exemplary embodiment, such as figure 1 As shown, the method for intelligently identifying snap-buying behavior includes the following steps S11-S14:

[0065] In step S11, construct a corresponding initial weight data set for the user account;

[0066] In step S12, obtain the request behavior fingerprint of the user account;

[0067] In step S13, the request behavior fingerprint of the user account is substituted into a preset hierarchical nonlinear function for calculation to obtain an abnormality structure score of the user account;

[0068] In step S14, when the abnormality structure score of a certain user account is lower than a certain threshold, the snap purchase behavior of the user account is intercepted.

[0069] In one embodiment, on the Internet, product flash sales have become an indispensable part of people's online shopping. However, many people who participated in the merchandise seckill have had a merchandise seckill experience that could not be successful no matter how quickly they clicked. The main reason is that the natural manual click speed of human beings is far lower than the frequency of click instructions issued by computers. This will cause people who participate in the product seckill manually to suffer unfair competition from the commodity seckill, thereby reducing manual participation The user experience of the people who kill the goods. In the prior art, the spike request is intercepted by a fixed strategy such as IP, which is not high enough for the effective interception rate of non-manual snap-up behavior. The technical solution in this embodiment can properly solve the above-mentioned problems, as detailed below.

[0070] Construct a corresponding initial weight data set for the user account. Among them, according to the historical browsing record of the user account, geographic location information, IP address information, shopping history data, daily life time data, the first time to participate in the spike product activity, the number of seconds to participate in the product activity, and the number of successful spikes to construct the The initial weight data set of the user account; when the data content in the initial weight data set changes, the initial weight data set is updated accordingly in real time.

[0071] Get the request behavior fingerprint of the user account. Get the status of the smart devices logged in the same user account, and name the above content as the first factor; sample the number of requests made by a certain device at multiple different moments before the spike time point, and name the above content as the second factor; The first factor and the second factor are used to calculate the density of a certain user account request behavior, and then analyze the request behavior fingerprint of the certain user account.

[0072] Substitute the request behavior fingerprint of the user account into the preset hierarchical nonlinear function for calculation, and obtain the abnormality structure score of the user account. Among them, the value range of the request behavior fingerprint of the user account is Ω; when the request behavior fingerprint of the user account is in the value range of α, the calculated abnormality structure score and the request behavior fingerprint of the user account are In a positive proportional relationship, the abnormality structure scores in the α range are all in the normal access score range; when the request behavior fingerprint of the user account is in the value range of β, the calculated abnormality structure score and the request behavior fingerprint of the user account are the first Proportional and inversely proportional, the abnormality structure scores within the value range of β are all within the normal access score range; when the request behavior fingerprint of the user account is within the value range of γ, the calculated abnormality structure score and the user account The request behavior fingerprint of is a proportional relationship, where the proportional relationship increases significantly as the behavior fingerprint increases, and the abnormality structure score within the value range of γ may be in the abnormal access score interval.

[0073] When the abnormality structure score of a certain user account is lower than a certain threshold, the snap purchase behavior of the user account is intercepted. Wherein, when the abnormality structure score of a certain user account exceeds a preset abnormality threshold, it is determined that the user account is an abnormal access account; all requests issued by the abnormal access account are intercepted.

[0074] In addition, when the initial weight data set of the user account is higher than the preset whitelist threshold, the user account that meets the whitelist threshold is set as the whitelisted user account, and the system does not experience any abnormalities in the snapping behavior of the whitelisted user account The sampling and analysis of the degree structure score not only realizes that all requests from the whitelisted user accounts are not intercepted.

[0075] The technical solution in this embodiment analyzes panic buying behavior based on dynamic sampling and multi-dimensional sampling, which can effectively improve the recognition accuracy of non-manual panic buying behaviors, and thus the panic buying behavior issued to user accounts that are not manual panic buying To intercept.

[0076] In one embodiment, such as figure 2 As shown, step S11 includes the following steps S21-S22:

[0077] In step S21, according to the historical browsing records of the user account, geographic location information, IP address information, shopping history data, daily life time data, the first time to participate in the seckill product activity, the number of seckills participated in the product activity, and the number of successful seckills, Constructing an initial weight data set of the user account;

[0078] In step S22, when the data content in the initial weight data set changes, the initial weight data set is updated accordingly in real time.

[0079] In one embodiment, in addition to basic factors such as the frequency of requests to obtain user accounts and the IP of the user account, for the construction of the initial weight data set of the user account, the construction of the user account through multi-dimensional information can more accurately Analyze, for example, by analyzing the historical browsing records, geographic location information, IP address information, shopping history data, daily life time data, the first time to participate in the spike product activity, the number of seconds to participate in the product activity, and the number of successful spikes , The initial parameters can be appropriately modified in the subsequent analysis of the request behavior fingerprint. Regularly analyze the data content in the initial weight data set of the user account. If the data content changes, the initial weight data set will be updated accordingly in real time, which can effectively prevent the user account from being stolen. Molecules use stolen accounts with good initial weight data sets to engage in improper and non-artificial panic buying behavior.

[0080] In one embodiment, such as image 3 As shown, step S12 includes the following steps S31-S32:

[0081] In step S31, obtain the status of the smart device logged in the same user account, and name the above content as the first factor;

[0082] In step S32, sample the number of requests of a certain device at multiple different moments before the spike time point, and name the above content as the second factor;

[0083] In step S33, according to the first factor and the second factor, the degree of density of a certain user account request behavior is calculated, and then the request behavior fingerprint of the certain user account is analyzed.

[0084] In one embodiment, in some cases, the same user account may be logged in on a laptop computer, a smart phone, a smart tablet, or a smart wearable device, which is referred to as the first factor. In addition, there are cases where the same user account "Happy Xiaozhen 101" is logged in the smart phone A, smart phone B, and smart phone C. What needs to be considered is that the upper limit of the frequency value of the number of requests is higher when the mouse is operated on the laptop. On the smart phone, by tapping the touch screen to operate, the frequency value of the number of requests is affected by the response time of the touch screen, and the upper limit of the frequency value of the number of requests is lower. Similar situations exist in other smart devices, so I won't go into it.

[0085] For a specific piece of equipment, sampling is performed several times before the spike time, and the above situation is called the second factor. For example, the degree of density at 10 seconds, 5 seconds, 3 seconds, 1 second, 500 milliseconds, and 200 milliseconds before the start of the spike time.

[0086] For example, comprehensively analyze the first and second factors of the user account "Happy Xiaozhen 101". The user account "Happy Xiaozhen 101" is logged in to three smart devices at the same time. For ease of presentation, you may name the three devices smart device A, smart device B, and smart device C. The collection time is 10 seconds, 5 seconds, 3 seconds, 1 second, 500 milliseconds and 200 milliseconds before the start of the spike time. Then the number of requests regarding the request behavior of the user account "Happy Xiaozhen 101" can be expressed as P A10 , P A5 , P A3 , P A1 , P A0.5 , P A0.2 , P B10 , P B5 , P B3 , P B1 , P B0.5 , P B0.2 , P C10 , P C5 , P C3 , P C1 , P C0.5 And P C0.2. By weighting and merging the number of requests, the analysis has obtained the degree of densification Q of the request behavior of the user account "Happy Xiaozhen 101" 10 , Q 5 , Q 3 , Q 1 , Q 0.5 And Q 0.2 , According to the preset request behavior fingerprint formula, the request behavior fingerprint x of the user account "Happy Xiaozhen 101" can be calculated.

[0087] Also, as the spike time gradually approaches, the number of collected requests is not a fixed value, which can reduce the value of the request behavior fingerprint. For example, as the spike time gradually approaches, the number of collected requests continuously and gently increases, which can reduce the value of the request behavior fingerprint.

[0088] In addition, as the spike time gradually approaches, the number of collected requests is always fixed and orderly or bursts with high density, which will cause the fingerprint value of the request behavior to increase significantly.

[0089] In one embodiment, such as Figure 4 As shown, step S13 includes the following steps S41-S42:

[0090] In step S41, the value range of the request behavior fingerprint of the user account is Ω; when the request behavior fingerprint of the user account is in the value range of α, the calculated abnormality structure score is compared with the request of the user account Behavioral fingerprints are in a proportional relationship, and the abnormality structure scores in the α range are all in the normal access score range;

[0091] In step S42, when the request behavior fingerprint of the user account is within the value range of β, the calculated abnormality structure score and the request behavior fingerprint of the user account have a first proportional relationship and then an inverse relationship, which is within the value range of β The abnormality structure scores are all within the normal access score range;

[0092] In step S43, when the request behavior fingerprint of the user account is in the value range of γ, the calculated abnormality structure score and the request behavior fingerprint of the user account are in a proportional relationship, wherein the proportional relationship follows the behavior fingerprint The abnormality structure score in the value range of γ may be in the abnormal access score range.

[0093] In one embodiment, the initial weight data set and request behavior fingerprint of a user account of a certain user account can be obtained in the previous two embodiments. In this embodiment, the request for a certain user account is combined with a preset hierarchical nonlinear function. The behavioral fingerprint is the input of the preset hierarchical nonlinear function, and the initial weight data set of a certain user account affects the value of the parameter value of the preset hierarchical nonlinear function. The hierarchical nonlinear function is a cubic function about the fingerprint of the request behavior. The image of the hierarchical nonlinear function is detailed in Picture 11.

[0094] The value ranges of α, β, and γ are continuous and have no overlapping regions. The value range of Ω includes the sum of the value ranges of α, β, and γ.

[0095] For the convenience of presentation, may wish to name the request behavior fingerprint as x, and name the preset hierarchical nonlinear function as P (x) , The value range of α is set to (-3, -2), the value range of β is set to (-2, 0), and the value range of γ is set to (0, 3).

[0096] When the request behavior fingerprint x has a value between (-3, -2), the request behavior fingerprint is in line with the normal user’s conventional manual snapping behavior, and the calculated abnormality structure scores are all within the normal access score range, which means the request Behavioral fingerprint x is a panic buying behavior that participates in a lower click frequency. In addition, the calculated abnormality structure score is in a proportional relationship with the request behavior fingerprint of the user account.

[0097] When the value of the request behavior fingerprint x is between (-2, 0), the request behavior fingerprint is consistent with the more intense manual snap-up behavior of normal users. In the initial stage when the request behavior fingerprint x takes a value of (-2, 0), as the value of the request behavior fingerprint increases, the rate of increase of the abnormality structure score becomes smaller and smaller. The image of the hierarchical nonlinear function in this process See Picture 12. With the continuous increase of the value of the request behavior fingerprint, the speed of the abnormality structure score increases gradually from positive growth to zero. The image of the hierarchical nonlinear function in this process is detailed in Figure 13. As the value of the request behavior fingerprint continues to increase, the rate of increase of the abnormality structure score gradually changes from zero to a negative number, indicating that the request behavior fingerprint is gradually approaching the average expected value of normal users’ fierce manual snapping behavior during this process. , The image of the hierarchical nonlinear function of this process is detailed in Picture 14. As the value of the request behavior fingerprint continues to increase, the rate of increase of the abnormality structure score gradually changes from zero to a positive number, which means that the request behavior fingerprint is gradually moving away from the more intense manual snapping behavior of normal users during this process. The average expected value, the image of the hierarchical nonlinear function in this interval, see Figure 15.

[0098] When the request behavior fingerprint x has a value between (0, 3), the request behavior fingerprint gradually exceeds the more intense manual snapping behavior of normal users. As the value of the request behavior fingerprint continues to increase, the rate of increase of the abnormality structure score gradually increases significantly. The characteristics of the function image of the hierarchical nonlinear function in this interval can be referred to Figure 16.

[0099] In one embodiment, such as Figure 5 As shown, step S14 includes the following steps S51-S55:

[0100] In step S51, when the abnormality structure score of a certain user account exceeds a preset abnormality threshold, it is determined that the user account is an abnormal access account;

[0101] In step S52, all requests issued by the abnormal access account are intercepted.

[0102] In an embodiment, when the abnormality structure score of a certain user account exceeds a preset abnormality threshold, the user account is determined to be an abnormal access account, and all requests issued by the abnormal access account are intercepted. For example, in the case where the number of requests is always fixed and orderly or bursts with high density, such as Figure 16 On the right part of the image in the image, its abnormality structure score significantly exceeded the preset abnormality threshold. The abnormal access account used an improper rush purchase procedure for rush purchase, which damaged the fairness of the rush purchase activity and reduced most of it The user’s panic buying experience intercepts all requests from the abnormal access account.

[0103] In one embodiment, Image 6 It is a block diagram showing a device for intelligently identifying snap-purchase behavior according to an exemplary embodiment. Such as Image 6 As shown, the device includes a construction module 61, an acquisition module 62, a calculation module 63, and an interception module 64.

[0104] The construction module 61 is used to construct a corresponding initial weight data set for the user account;

[0105] The obtaining module 62 is configured to obtain the request behavior fingerprint of the user account;

[0106] The calculation module 63 is configured to substitute the request behavior fingerprint of the user account into a preset hierarchical nonlinear function for calculation to obtain the abnormality structure score of the user account;

[0107] The interception module 64 is used for intercepting the snap purchase behavior of a user account when the abnormality structure score of a user account is lower than a certain threshold.

[0108] Such as Figure 7 As shown, the construction module 61 includes a construction sub-module 71 and an update sub-module 72.

[0109] The construction sub-module 71 is used for the historical browsing records, geographic location information, IP address information, shopping history data, daily life time data, the first time to participate in the spike product activity, the number of seconds to participate in the product activity, and the number of successful spikes based on the user account’s historical browsing records Times to construct the initial weight data set of the user account;

[0110] The update submodule 72 is configured to update the initial weight data set in real time when the data content in the initial weight data set changes.

[0111] Such as Figure 8 As shown, the acquisition module 62 includes an acquisition sub-module 81, a sampling sub-module 82, and an analysis sub-module 83.

[0112] The obtaining submodule 81 is used to obtain the status of the smart device logged in the same user account, and name the above content as the first factor;

[0113] The sampling sub-module 82 is used to sample the number of requests of a certain device at multiple different moments before the spike time point, and name the foregoing content as the second factor;

[0114] The analysis sub-module 83 is configured to calculate the degree of densification of a certain user account request behavior based on the first factor and the second factor, and then analyze the request behavior fingerprint of the certain user account.

[0115] Such as Picture 9 As shown, the calculation module 63 includes the first calculation submodule 81, the second calculation submodule 82, and the third calculation submodule 83.

[0116] The first calculation sub-module 81 is used for when the request behavior fingerprint of the user account is in the value range of α, the calculated abnormality structure score and the request behavior fingerprint of the user account are in a proportional relationship, and the abnormality is in the α range Degree structure scores are all within the normal access score range;

[0117] The second calculation sub-module 82 is used for when the request behavior fingerprint of the user account is in the value range of β, the calculated abnormality structure score and the request behavior fingerprint of the user account have a first proportional relationship and then an inverse proportional relationship, which is in β The abnormality structure scores of the value range of are all within the normal access score range;

[0118] The third calculation submodule 83 is used for when the request behavior fingerprint of the user account is within the value range of γ, the calculated abnormality structure score is in a direct proportional relationship with the request behavior fingerprint of the user account, wherein the positive ratio The relationship increases significantly with the increase of behavior fingerprints, and the abnormality structure score in the value range of γ may be in the abnormal access score range.

[0119] Such as Picture 10 As shown, the interception module 64 includes a determination sub-module 101 and an interception sub-module 102.

[0120] The determination submodule 101 is configured to determine that the user account is an abnormal access account when the abnormality structure score of a certain user account exceeds a preset abnormality threshold;

[0121] The interception submodule 102 is used to intercept all requests issued by the abnormal access account.

[0122] Those skilled in the art should understand that the embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may be in the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, optical storage, etc.) containing computer-usable program codes.

[0123] The present invention is described with reference to flowcharts and/or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and/or block in the flowchart and/or block diagram, and the combination of processes and/or blocks in the flowchart and/or block diagram can be implemented by computer program instructions. These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing equipment to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing equipment can be generated In the process Figure one Process or multiple processes and/or boxes Figure one A device with functions specified in a block or multiple blocks.

[0124] These computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing equipment to work in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including the instruction device. The device is implemented in the process Figure one Process or multiple processes and/or boxes Figure one Functions specified in a box or multiple boxes.

[0125] These computer program instructions can also be loaded on a computer or other programmable data processing equipment, so that a series of operation steps are executed on the computer or other programmable equipment to produce computer-implemented processing, so as to execute on the computer or other programmable equipment. Instructions are provided to implement the process Figure one Process or multiple processes and/or boxes Figure one Steps of functions specified in a box or multiple boxes.

[0126] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. In this way, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalent technologies, the present invention is also intended to include these modifications and variations.