E-commerce platform high-risk user identification method based on time series data analysis

Abstract

The invention discloses an e-commerce platform high-risk user identification method based on time series data analysis. The method comprises the following steps: S1, constructing a user behavior data set; s2, organizing the collected original user behavior data into a behavior sequence according to a time sequence based on the collected original user behavior data set; s3, performing data cleaning on the generated user behavior sequence; s4, carrying out clustering analysis on the preprocessed behavior sequence by adopting a time sequence clustering algorithm in Scikit-learning, and identifying a user group with similar behavior characteristics; s5, dividing the user behavior modes into different risk categories based on a clustering analysis result; s6, automatically labeling new potential high-risk users on the basis of labeled high-risk user data by utilizing a semi-supervised clustering algorithm, and expanding a risk identification range; s7, generating a corresponding risk score; and S8, performing collective management and prevention for high-risk user groups. According to the method, the user groups with similar high-risk characteristics can be identified, and the flexibility and effectiveness of the system in coping with different risk scenes are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of e-commerce platforms, and in particular to a method for identifying high-risk users of e-commerce platforms based on time series data analysis. Background Art

[0002] User behavior analysis of e-commerce platforms is crucial to the security and operation of the platforms. As the user scale of e-commerce platforms continues to expand, users' operational behaviors are becoming more diversified and complex. Traditional risk identification methods are mostly based on static data analysis, and often rely only on a single time point or limited historical data for judgment. It is difficult to accurately capture the dynamic changes in user behavior. Traditional risk identification methods based on static data are prone to miss some potential high-risk behavior patterns when faced with time series data.

[0003] In addition, it is difficult for existing risk identification methods to strike a balance between accuracy and response speed. Traditional methods either tend to pursue high accuracy, resulting in a slower response speed and an inability to handle risks in a timely manner; or they sacrifice recognition accuracy in order to improve speed and are unable to effectively cope with complex multi-user behavior scenarios. When user behavior has obvious time series characteristics, existing technologies cannot accurately identify potential high-risk user groups, which can easily lead to delays or failures in risk management.

[0004] Therefore, how to improve the identification accuracy and response speed of high-risk users based on users' dynamic behavior data and build efficient risk management solutions for different user groups has become an urgent problem facing e-commerce platforms. Summary of the invention

[0005] One purpose of the present invention is to propose a method for identifying high-risk users of e-commerce platforms based on time series data analysis. The present invention can identify user groups with similar high-risk characteristics, thereby improving the flexibility and effectiveness of the system in dealing with different risk scenarios.

[0006] According to an embodiment of the present invention, a method for identifying high-risk users of an e-commerce platform based on time series data analysis includes the following steps:

[0007] S1. Collect users’ browsing history, purchase behavior, payment information and login frequency on e-commerce platforms in real time to build a user behavior dataset;

[0008] S2. Organize the collected original user behavior dataset into behavior sequences in chronological order;

[0009] S3. Perform data cleaning on the generated user behavior sequence, remove invalid or noisy data, and perform standardization processing;

[0010] S4. Use the time series clustering algorithm in Scikit-learn to perform cluster analysis on the preprocessed behavior sequences, and use the dynamic time warping algorithm to perform time series matching on the behavior sequences to identify user groups with similar behavior characteristics;

[0011] S5. Based on the cluster analysis results, user behavior patterns are divided into different risk categories, including normal user groups, potential high-risk user groups, and abnormal user groups;

[0012] S6. Using semi-supervised clustering algorithms, we can automatically label new potential high-risk users based on the labeled high-risk user data to expand the scope of risk identification;

[0013] S7. Further risk analysis is performed on the clustered user groups, and based on the collective abnormal operations within a specific time period, the risk level of the user groups is evaluated and a corresponding risk score is generated;

[0014] S8. Based on the risk scoring results, the system automatically issues warnings and implements corresponding response measures to conduct collective management and prevention of high-risk user groups.

[0015] Optionally, the S1 includes the following steps:

[0016] S11. Collect users’ browsing history, purchase behavior, payment information and login frequency in real time through the backend log system of the e-commerce platform to build a user behavior dataset:

[0017] D={U1,U2,…,U n};

[0018] Among them, U i Represents the behavior data of the i-th user;

[0019] S12. Each user's behavior data U i Include multiple timestamps ij and the corresponding behavior type A ij , including browsing history, browsing history, payment information, or login frequency;

[0020] S13. The browsing history Purchase behavior Payment Information and login frequency They are represented as different behavior categories, forming user U i The complete sequence of behaviors:

[0021]

[0022] Among them, k represents different behavior type categories.

[0023] Optionally, S2 includes the following steps:

[0024] S21. Organize the user behavior dataset D into user behavior sequences in chronological order. i According to the timestamp t ij Operation behavior A ij Sort in chronological order to generate the user's complete behavior sequence matrix:

[0025] S i ={(t i1 ,A i1 ),(t i2 ,A i2 ),…,(t im ,A im )};

[0026] Where m represents user U i The total number of actions performed, t ij is the timestamp of the jth action of the ith user, t i1 <t i2 <… <t im , A ij Represents user U i At time point t ij the type of behavior performed;

[0027] S23. All the user's behavior sequence matrix S i Integrated into the behavior sequence dataset of the e-commerce platform:

[0028]

[0029] Among them, S represents the user behavior sequence dataset of the entire e-commerce platform, α i Represents the weight coefficient, which is used to adjust the contribution of different users in the cluster, β i represents the time correlation coefficient, which is used to adjust the influence of the time dimension on the behavior sequence, γ i Represents user U i The specific risk weight of U i The historical behavior data is set, f(A ij ,t ij ) is a nonlinear function, and the comprehensive behavior type is A ij and timestamp t ij By identifying the collective abnormal operations of user groups in a specific time period, we can identify the potential characteristics of high-risk behaviors.

[0030] Optionally, S4 includes the following steps:

[0031] S41. Preprocess the user behavior sequence data set S′={S′1,S′2,…,S′ n} Perform time series clustering analysis and use the time series clustering algorithm in Scikit-learn to classify the user's behavior sequence S′ i Grouping: users with similar behavior patterns are grouped into the same group based on the time dimension and behavior type of the behavior sequence;

[0032] S42. In the process of time series clustering analysis, the dynamic time warping algorithm is combined with the behavior sequence S′ i and S′ j Perform timing matching, user U i with U j The calculation formula for the behavior sequence similarity is:

[0033]

[0034] Among them, A ik and A jk Represents user U i and U j The type of behavior in the kth operation, t ik and t jk For user U i and U j The behavior timestamp, w k is the weight factor of the behavior type, which is dynamically adjusted according to the risk weight of the behavior, α1 is the nonlinear index of behavior type matching, and λ k is the weight factor of time matching, β1 is the nonlinear adjustment parameter of time matching;

[0035] S43. Based on behavior sequence similarity d DTW (S′ i ,S′ j Divide the user behavior sequence into multiple cluster groups (C1, C2, ..., C p ), each cluster group C p Users with similar behavioral characteristics:

[0036]

[0037] Among them, |C p | is the cluster group C p The number of users in, δ is the adjustment factor of the interaction between the time dimension and the behavior dimension, γ l is the time period risk weight coefficient, which reflects the contribution of behaviors in different time periods to high-risk assessment, and μ is the influence coefficient of the behavior change rate on the matching result.

[0038] Optionally, S5 includes the following steps:

[0039] S51. Clustering user behavior sequences into groups C p Conduct risk classification, and divide user groups into different risk categories based on the similarity of user behavior patterns and historical data, including normal user groups, potential high-risk user groups, and abnormal user groups;

[0040] S52. Cluster each behavior sequence into groups C p According to the user's behavior feature vector V i ={A i1 ,A i2 ,…,A im} and the corresponding time series T i ={t i1 ,t i2 ,…,t im}Calculate the risk score R(C p ):

[0041]

[0042] Among them, w k is the weight factor of the behavior type, α2 is the behavior risk assessment coefficient, and λ k is the weight factor of the time dimension, β2 is the time risk assessment coefficient, t ik and t jk For user U i and U j timestamp;

[0043] S53. The calculated risk score R(C p ) is used as the basis for risk assessment of the user group, according to the set risk threshold θ R , dividing the user groups into three categories:

[0044] When R(C p )<θ R When the number of users is 1, it is determined to be a normal user group;

[0045] When R(C p )≥θ R And R(C p )<θ HR When the user is identified as a potential high-risk user group;

[0046] When R(C p )≥θ HR When the number of users is greater than 100, they are identified as abnormal user groups.

[0047] Optionally, the S6 includes the following steps:

[0048] S61. Based on the labeled high-risk user dataset D HRConstruct a semi-supervised learning model based on the behavior graph network to map the user's operation behavior into the behavior graph G i =(V i ,E i ), where V i Represents user U i The set of operation behavior nodes, E i Represents the time-ordered edge set between behavior nodes;

[0049] S62. In the behavior diagram G i In the example, node v ik Represents user U i The k-th operation behavior, edge e ikj Indicates behavior ik and v ij The temporal relationship between them is used to construct a user behavior graph sequence and combine it with a graph neural network model to learn high-risk features;

[0050] S63. Using graph neural networks to analyze behavior graphs G i Embed nodes and edges, learn the behavioral relationship between users, and combine the semi-supervised learning model through the similarity function d graph (G i ,G HRj ) Risk matching between identified users and high-risk users:

[0051]

[0052] Among them, d graph (G i ,G HRj ) is the behavior graph G i and high-risk user behavior graph G HRj The similarity function between |V i | represents the user to be identified U i The total number of nodes in the behavior graph, |V HRj | represents the total number of nodes in the high-risk user behavior graph, v ik and v HRjk Represents user U i and the behavior nodes of high-risk users, e ikj and e HRjk represents the time order edge, w k is the weight factor, α3 and β3 are nonlinear adjustment parameters, and β3 is the time sequence weight coefficient;

[0053] S64. According to the similarity function d graph (G i ,G HRj), matching the behavior graph of the user to be identified with the behavior graph of the labeled high-risk users, and automatically labeling the risk label of the new high-risk users;

[0054] S65. Automatically mark the new high-risk user data D′ HR = {U′ HR1 ,U′ HR2 ,…,U′ HRn}Merge into the original high-risk user dataset D HR In the next step, we will expand the high-risk user dataset and optimize the semi-supervised learning model:

[0055]

[0056] Among them, D′ HR is the updated high-risk user dataset, D HR is the original high-risk user dataset, |V′ i | is the total number of behavior nodes of the newly labeled user, v′ ik and v′ HRjk are the behavior nodes of the newly labeled users and the labeled high-risk users, respectively. ρ is the dynamic balance coefficient between the new high-risk users and the original high-risk users. θ is the matching adjustment parameter between the time sequence of the new high-risk user behavior and the labeled user behavior.

[0057] Optionally, the S8 includes the following steps:

[0058] S81. Based on the risk score result R(C p ) and the updated high-risk user dataset D′ HR , the system automatically classifies the risk of user groups and determines the triggering conditions of response measures. p ) is higher than the set threshold θ R When the system determines that user group C p For high-risk groups, and automatically issue warnings;

[0059] S82. Targeting high-risk groups C p , the system is based on the risk level and high-risk user data set D′ HR Implementation of countermeasures for historical high-risk data in:

[0060] When R(C p )≥θ HR1 And the user belongs to the high-risk user data set D′ HR When gathering, trigger the first level response measures to restrict user U i Transaction behavior and send risk reminders;

[0061] When R(C p )≥θHR2 When the user's historical behavior data shows frequent abnormalities, the second level response measures are triggered, requiring the user to i Perform identity verification and suspend some account functions;

[0062] When R(C p )≥θ HR3 If the user is marked as high risk multiple times, the third level response measures will be triggered, temporarily freezing the user U i 's account;

[0063] S83. The system calculates the user's risk response weight W resp (U i ), the risk response weight is combined with the updated high-risk user data set D′ HR Behavioral characteristics and current risk scores in:

[0064]

[0065] Among them, α4 and β4 are weight coefficients, γ k is the risk characteristic weight, f(A ik ,t ik ) is a function combining behavior type and time, ρ1 represents the dynamic impact of newly labeled high-risk users on the response measures, θ1 is the time matching adjustment parameter, and v′ ik and e′ ikj Represents the differences in behavior nodes and time-order edges between the user and the updated high-risk user set;

[0066] S84. The system responds to the risk weight W resp (U i ) automatically selects appropriate preventive measures and prioritizes user groups with higher response weights.

[0067] The beneficial effects of the present invention are:

[0068] (1) The present invention effectively improves the efficiency and accuracy of identifying high-risk users on e-commerce platforms through a semi-supervised learning model based on time series data analysis and behavior graph networks. By mapping user operation behaviors into behavior graphs and using graph neural networks combined with semi-supervised learning to classify and label user groups, the present invention breaks through the limitations of traditional static data analysis methods, can accurately capture the dynamic behavior relationships between users, and significantly improves the recognition rate of implicit high-risk behavior patterns in multi-user behavior scenarios.

[0069] (2) The present invention introduces Scikit-learn's time series clustering algorithm and combines it with the dynamic time warping algorithm to perform time series matching and clustering on the user's behavior sequences, thus solving the problem of the difficulty in balancing the risk identification accuracy and response speed in the traditional methods. By clustering the user behavior sequences into different risk categories, it is possible to identify user groups with similar high-risk characteristics, thereby improving the flexibility and effectiveness of the system in dealing with different risk scenarios.

[0070] (3) The present invention dynamically expands and optimizes the high-risk user data set, combines it with the risk scoring model, automatically issues warnings and executes corresponding response measures. The system can automatically adjust the risk identification threshold and preventive measures according to the real-time updated data set, ensuring that the response to newly marked high-risk users is more timely and accurate. The mechanism based on the dynamic expansion of high-risk user data not only enhances the platform's collective management capabilities for risky user groups, but also improves the overall efficiency and adaptability of the risk identification system. BRIEF DESCRIPTION OF THE DRAWINGS

[0071] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings:

[0072] Figure 1 A flowchart of a method for identifying high-risk users on an e-commerce platform based on time series data analysis proposed by the present invention;

[0073] Figure 2 This is a schematic diagram of the construction of a behavioral graph network and the application of a graph neural network in a high-risk user identification method for an e-commerce platform based on time series data analysis proposed in the present invention. DETAILED DESCRIPTION

[0074] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, which only illustrate the basic structure of the present invention in a schematic manner, and therefore only show the components related to the present invention.

[0075] refer to Figure 1-2 , a method for identifying high-risk users of an e-commerce platform based on time series data analysis, comprising the following steps:

[0076] S1. Collect users’ browsing history, purchase behavior, payment information and login frequency on e-commerce platforms in real time to build a user behavior dataset;

[0077] In this implementation, S1 includes the following steps:

[0078] S11. Collect users’ browsing history, purchase behavior, payment information and login frequency in real time through the backend log system of the e-commerce platform to build a user behavior dataset:

[0079] D={U1,U2,…,U n};

[0080] Among them, U i Represents the behavior data of the i-th user;

[0081] S12. Each user's behavior data U i Include multiple timestamps ij and the corresponding behavior type A ij , including browsing history, browsing history, payment information, or login frequency;

[0082] S13. Browsing History Purchase behavior Payment Information and login frequency They are represented as different behavior categories, forming user U i The complete sequence of behaviors:

[0083]

[0084] Among them, k represents different behavior type categories.

[0085] S2. Organize the collected original user behavior dataset into behavior sequences in chronological order;

[0086] In this implementation, S2 includes the following steps:

[0087] S21. Organize the user behavior dataset D into user behavior sequences in chronological order. i According to the timestamp t ij Operation behavior A ij Sort in chronological order to generate the user's complete behavior sequence matrix:

[0088] S i ={(t i1 ,A i1 ),(t i2 ,A i2 ),…,(t im ,A im )};

[0089] Where m represents user U i The total number of actions performed, t ij is the timestamp of the jth action of the ith user, t i1 <t i2 <… <t im , A ij Represents user U i At time point t ijthe type of behavior performed;

[0090] S23. All the user's behavior sequence matrix S i Integrated into the behavior sequence dataset of the e-commerce platform:

[0091]

[0092] Among them, S represents the user behavior sequence dataset of the entire e-commerce platform, α i Represents the weight coefficient, which is used to adjust the contribution of different users in the cluster, β i represents the time correlation coefficient, which is used to adjust the influence of the time dimension on the behavior sequence, γ i Represents user U i The specific risk weight of U i The historical behavior data is set, f(A ij ,t ij ) is a nonlinear function, and the comprehensive behavior type is A ij and timestamp t ij By identifying the collective abnormal operations of user groups in a specific time period, we can identify the potential characteristics of high-risk behaviors.

[0093] S3. Perform data cleaning on the generated user behavior sequence, remove invalid or noisy data, and perform standardization processing;

[0094] S4. Use the time series clustering algorithm in Scikit-learn to perform cluster analysis on the preprocessed behavior sequences, and use the dynamic time warping algorithm to perform time series matching on the behavior sequences to identify user groups with similar behavior characteristics;

[0095] In this implementation, S4 includes the following steps:

[0096] S41. Preprocess the user behavior sequence data set S′={S′1,S′2,…,S′ n} Perform time series clustering analysis and use the time series clustering algorithm in Scikit-learn to classify the user's behavior sequence S′ i Grouping: users with similar behavior patterns are grouped into the same group based on the time dimension and behavior type of the behavior sequence;

[0097] S42. In the process of time series clustering analysis, the dynamic time warping algorithm is combined with the behavior sequence S′ i and S′ j Perform timing matching, user U i with U j The calculation formula for the behavior sequence similarity is:

[0098]

[0099] Among them, A ik and A jk Represents user U i and U j The type of behavior in the kth operation, t ik and t jk For user U i and U j The behavior timestamp, w k is the weight factor of the behavior type, which is dynamically adjusted according to the risk weight of the behavior, α1 is the nonlinear index of behavior type matching, and λ k is the weight factor of time matching, β1 is the nonlinear adjustment parameter of time matching;

[0100] S43. Based on behavior sequence similarity d DTW (S′ i ,S′ j Divide the user behavior sequence into multiple cluster groups (C1, C2, ..., C p ), each cluster group C p Users with similar behavioral characteristics:

[0101]

[0102] Among them, |C p | is the cluster group C p The number of users in, δ is the adjustment factor of the interaction between the time dimension and the behavior dimension, γ l is the time period risk weight coefficient, which reflects the contribution of behaviors in different time periods to high-risk assessment, and μ is the influence coefficient of the behavior change rate on the matching result.

[0103] S5. Based on the cluster analysis results, user behavior patterns are divided into different risk categories, including normal user groups, potential high-risk user groups, and abnormal user groups;

[0104] In this implementation, S5 includes the following steps:

[0105] S51. Clustering user behavior sequences into groups C p Conduct risk classification, and divide user groups into different risk categories based on the similarity of user behavior patterns and historical data, including normal user groups, potential high-risk user groups, and abnormal user groups;

[0106] S52. Cluster each behavior sequence into groups C p According to the user's behavior feature vector V i ={A i1 ,A i2 ,…,A im} and the corresponding time series T i ={t i1 ,t i2 ,…,t im}Calculate the risk score R(C p ):

[0107]

[0108] Among them, w k is the weight factor of the behavior type, α2 is the behavior risk assessment coefficient, and λ k is the weight factor of the time dimension, β2 is the time risk assessment coefficient, t ik and t jk For user U i and U j timestamp;

[0109] S53. The calculated risk score R(C p ) is used as the basis for risk assessment of the user group, according to the set risk threshold θ R , dividing the user groups into three categories:

[0110] When R(C p )<θ R When the number of users is 1, it is determined to be a normal user group;

[0111] When R(C p )≥θ R And R(C p )<θ HR When the user is identified as a potential high-risk user group;

[0112] When R(C p )≥θ HR When the number of users is greater than 100, they are identified as abnormal user groups.

[0113] S6. Using semi-supervised clustering algorithms, we can automatically label new potential high-risk users based on the labeled high-risk user data to expand the scope of risk identification;

[0114] In this implementation, S6 includes the following steps:

[0115] S61. Based on the labeled high-risk user dataset D HR Construct a semi-supervised learning model based on the behavior graph network to map the user's operation behavior into the behavior graph G i =(V i ,E i ), where V i Represents user U i The set of operation behavior nodes, E i Represents the time-ordered edge set between behavior nodes;

[0116] S62. In the behavior diagram G i In the example, node v ik Represents user U i The k-th operation behavior, edge e ikj Indicates behavior ik and v ij The temporal relationship between them is used to construct a user behavior graph sequence and combine it with a graph neural network model to learn high-risk features;

[0117] S63. Using graph neural networks to analyze behavior graphs G i Embed nodes and edges, learn the behavioral relationship between users, and combine the semi-supervised learning model through the similarity function d graph (G i ,G HRj ) Risk matching between identified users and high-risk users:

[0118]

[0119] Among them, d graph (G i ,G HRj ) is the behavior graph G i and high-risk user behavior graph G HRj The similarity function between |V i | represents the user to be identified U i The total number of nodes in the behavior graph, |V HRj | represents the total number of nodes in the high-risk user behavior graph, v ik and v HRjk Represents user U i and the behavior nodes of high-risk users, e ikj and e HRjk represents the time order edge, w k is the weight factor, α3 and β3 are nonlinear adjustment parameters, and β3 is the time sequence weight coefficient;

[0120] S64. According to the similarity function d graph (G i ,G HRj ), matching the behavior graph of the user to be identified with the behavior graph of the labeled high-risk users, and automatically labeling the risk label of the new high-risk users;

[0121] S65. Automatically mark the new high-risk user data D′ HR = {U′ HR1 ,U′ HR2 ,…,U′ HRn}Merge into the original high-risk user dataset D HR In the next step, we will expand the high-risk user dataset and optimize the semi-supervised learning model:

[0122]

[0123] Among them, D′ HR is the updated high-risk user dataset, D HR is the original high-risk user dataset, |V′ i | is the total number of behavior nodes of the newly labeled user, v′ ik and v′ HRjk are the behavior nodes of the newly labeled users and the labeled high-risk users, respectively. ρ is the dynamic balance coefficient between the new high-risk users and the original high-risk users. θ is the matching adjustment parameter between the time sequence of the new high-risk user behavior and the labeled user behavior.

[0124] S7. Further risk analysis is performed on the clustered user groups, and based on the collective abnormal operations within a specific time period, the risk level of the user groups is evaluated and a corresponding risk score is generated;

[0125] S8. Based on the risk scoring results, the system automatically issues warnings and implements corresponding response measures to conduct collective management and prevention of high-risk user groups.

[0126] In this implementation, S8 includes the following steps:

[0127] S81. Based on the risk score result R(C p ) and the updated high-risk user dataset D′ HR , the system automatically classifies the risk of user groups and determines the triggering conditions of response measures. p ) is higher than the set threshold θ R When the system determines that user group C p For high-risk groups, and automatically issue warnings;

[0128] S82. Targeting high-risk groups C p , the system is based on the risk level and high-risk user data set D′ HR Implementation of countermeasures for historical high-risk data in:

[0129] When R(C p )≥θ HR1 And the user belongs to the high-risk user data set D′ HR When gathering, trigger the first level response measures to restrict user U i Transaction behavior and send risk reminders;

[0130] When R(C p )≥θ HR2 When the user's historical behavior data shows frequent abnormalities, the second level response measures are triggered, requiring the user to iPerform identity verification and suspend some account functions;

[0131] When R(C p )≥θ HR3 If the user is marked as high risk multiple times, the third level response measures will be triggered, temporarily freezing the user U i 's account;

[0132] S83. The system calculates the user's risk response weight W resp (U i ), the risk response weight is combined with the updated high-risk user data set D′ HR Behavioral characteristics and current risk scores in:

[0133]

[0134]

[0135] Among them, α4 and β4 are weight coefficients, γ k is the risk characteristic weight, f(A ik ,t ik ) is a function combining behavior type and time, ρ1 represents the dynamic impact of newly labeled high-risk users on the response measures, θ1 is the time matching adjustment parameter, and v′ ik and e′ ikj Represents the differences in behavior nodes and time-order edges between the user and the updated high-risk user set;

[0136] S84. The system responds to the risk weight W resp (U i ) automatically selects appropriate preventive measures and prioritizes user groups with higher response weights.

[0137] Embodiment 1:

[0138] In July 2024, a large e-commerce platform "A Mall" located in Guangzhou launched the high-risk user identification system of the present invention. A Mall has tens of millions of user operations every day, including browsing, ordering and payment behaviors. In order to cope with the growing high-risk behaviors of malicious order brushing and false refunds, the platform decided to apply the method of the present invention to identify potential high-risk users through time series data analysis and the semi-supervised learning model of the behavior graph network.

[0139] During the promotion on July 15, the platform's operations team noticed that some users frequently submitted large orders in a short period of time, and then canceled a large number of orders before they were shipped. This behavior caused inventory and logistics losses to the platform. In order to prevent the further spread of such behavior, the platform hopes to use an automated high-risk user identification system to provide early warning and take corresponding measures.

[0140] The system first collects user behavior data of the platform in real time, including users' browsing history, order operations, payment information and order cancellations. The operation data of user ID12345678 caught the attention of the system. The user browsed 100 items continuously between 10:00 and 10:30 am on July 15, and placed orders for 50 of them within 10 minutes, with a total amount of up to 150,000 yuan. The system detected through the time series clustering algorithm that this behavior of placing a large number of orders in a short period of time is highly consistent with the common behavior patterns of the high-risk user groups marked by the platform.

[0141] In the embodiment, the behavior of user ID 12345678 is mapped into a behavior graph, where the nodes are different operations (browsing, ordering, and paying) and the time sequence is the edge, showing the user's short-term and high-frequency operations. Combined with the dynamic time warping (DTW) algorithm, the system calculates that the user's behavior is 0.92 (with a score range of 0-1) similar to the behavior of historical high-risk users, which is significantly higher than the threshold of 0.75 set by the system.

[0142] Subsequently, the system further analyzed the user's behavior graph through a graph neural network. Combining the behavior type and time sequence, the system calculated that the risk score of user ID 12345678 was 85 points, which was much higher than the set high-risk threshold of 80 points. The system automatically generated a detailed risk report, which included:

[0143] User ID: 12345678;

[0144] Operation time period: 10:00-10:30, July 15, 2024;

[0145] Behavior type: browsing, ordering, and payment;

[0146] Risk score: 85 points;

[0147] Description of abnormal behavior: placing and paying a large number of orders in a short period of time;

[0148] Through the early warning mechanism, the system automatically sent an alert to the platform administrator. The alert content included the user's operation details and the identification results of high-risk behaviors. Based on the system prompts, the administrator immediately took measures to restrict the user's transactions and required further verification of his identity.

[0149] From July 15 to July 20, the platform discovered multiple high-risk users similar to user ID 12345678. In the embodiment, user ID 98765432 canceled 50 paid orders between 3 and 4 p.m. on July 16, with a total amount of RMB 200,000. Through time series clustering analysis, the system found that the behavior of user ID 98765432 had similar operating modes to historical high-risk users, especially in the frequency of order cancellations, which was highly similar to user ID 12345678. Through risk scoring, the user's risk score was 88 points. The system also issued an alarm in time and temporarily froze the user's account.

[0150] During this promotion, the platform identified a total of 50 high-risk users, the system generated a detailed behavioral analysis report, and automatically took measures to restrict transactions and verify the identities of 30 of these users, effectively reducing potential malicious order-placing and false returns. The platform successfully prevented losses worth 5 million yuan through the method of the present invention.

[0151] In order to prove the effectiveness of the method of the present invention, the platform conducted a comparative test between the high-risk user identification method of the present invention and the traditional static data analysis method. The test data was based on 50,000 user operation behaviors from July 15 to July 20. The following Table 1 shows the comparison results of the two methods:

[0152] Table 1 Comparison table of high-risk user identification

[0153]

[0154] As can be seen from Table 1, the number of high-risk users identified by the method of the present invention is significantly higher than that of the traditional method, and the misjudgment rate is lower. Taking user ID 12345678 as an example, the traditional static analysis method failed to timely identify its high-frequency operation behavior in a short period of time, resulting in missed opportunities for timely warnings. The method of the present invention combines time series clustering with behavior graph networks to achieve in-depth analysis of user operation behaviors and effectively capture potential high-risk behaviors.

[0155] In order to further verify the beneficial effects of the present invention, the platform administrator conducted follow-up tracking on the identified high-risk users and found that 80% of them did engage in malicious order brushing and false returns in subsequent operations. The data further proved the high accuracy and timeliness of the method of the present invention in identifying high-risk users.

[0156] In the embodiment, user ID 24680123 submitted multiple large orders on July 18 and canceled the orders in a short period of time. The system quickly detected that his operation was highly similar to the operation pattern of historical high-risk users, and froze the user account in time through the early warning mechanism. The platform administrator found in the subsequent investigation that the purpose of the user's operation was indeed to obtain platform coupons through false transactions. If not identified in time, the behavior would cause the platform to lose hundreds of thousands of yuan.

[0157] Through the method of the present invention, "A Mall" effectively identified and managed a large number of potential high-risk users during the promotion period, which not only significantly reduced the platform's losses, but also improved the overall risk management capabilities of the platform. Compared with traditional methods, the present invention has significant advantages in the accuracy of high-risk user identification, response speed and automated execution of preventive measures, proving that the method of the present invention has important application value and promotion potential in e-commerce platforms.

[0158] The present invention effectively improves the efficiency and accuracy of identifying high-risk users on e-commerce platforms through a semi-supervised learning model based on time series data analysis and behavior graph networks. By mapping user operation behaviors into behavior graphs and using graph neural networks combined with semi-supervised learning to classify and label user groups, it breaks through the limitations of traditional static data analysis methods, can accurately capture the dynamic behavior relationships between users, and significantly improves the recognition rate of implicit high-risk behavior patterns in multi-user behavior scenarios.

[0159] The present invention introduces Scikit-learn's time series clustering algorithm and combines it with the dynamic time warping algorithm to perform time series matching and clustering of user behavior sequences, solving the problem of difficulty in balancing risk identification accuracy and response speed in traditional methods. By clustering user behavior sequences into different risk categories, user groups with similar high-risk characteristics can be identified, thereby improving the flexibility and effectiveness of the system in dealing with different risk scenarios.

[0160] The present invention dynamically expands and optimizes the high-risk user data set, combines it with the risk scoring model, automatically issues early warnings and executes corresponding response measures. The system can automatically adjust the risk identification threshold and preventive measures according to the real-time updated data set, ensuring that the response to newly marked high-risk users is more timely and accurate. The mechanism based on the dynamic expansion of high-risk user data not only enhances the platform's collective management capabilities for risky user groups, but also improves the overall efficiency and adaptability of the risk identification system.

[0161] The above description is only a preferred specific implementation manner of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can make equivalent replacements or changes according to the technical scheme and inventive concept of the present invention within the technical scope disclosed by the present invention, which should be covered by the protection scope of the present invention.

Claims

1. A method for identifying high-risk users on an e-commerce platform based on time series data analysis, characterized in that: The steps include: S1. Collect users’ browsing history, purchase behavior, payment information and login frequency on e-commerce platforms in real time to build a user behavior dataset; S2. Organize the collected original user behavior dataset into behavior sequences in chronological order; S3. Clean the generated user behavior sequence, remove invalid or noisy data, and perform standardization; S4. Use the time series clustering algorithm in Scikit-learn to perform cluster analysis on the preprocessed behavior sequences, and use the dynamic time warping algorithm to perform time series matching on the behavior sequences to identify user groups with similar behavior characteristics; S5. Based on the cluster analysis results, user behavior patterns are divided into different risk categories, including normal user groups, potential high-risk user groups, and abnormal user groups; S6. Using semi-supervised clustering algorithms, we can automatically label new potential high-risk users based on the labeled high-risk user data to expand the scope of risk identification; S7. Further risk analysis is performed on the clustered user groups, and based on the collective abnormal operations within a specific time period, the risk level of the user groups is evaluated and a corresponding risk score is generated; S8. Based on the risk scoring results, the system automatically issues warnings and implements corresponding response measures to conduct collective management and prevention of high-risk user groups.

2. According to claim 1, a method for identifying high-risk users of an e-commerce platform based on time series data analysis is characterized in that: The S1 comprises the following steps: S11. Collect users’ browsing history, purchase behavior, payment information and login frequency in real time through the backend log system of the e-commerce platform to build a user behavior dataset: D={U1,U2,…,U n }; Among them, U i Represents the behavior data of the i-th user; S12. Each user's behavior data U i Include multiple timestamps ij and the corresponding behavior type A ij , including browsing history, browsing history, payment information, or login frequency; S13. The browsing history Purchase behavior Payment Information and login frequency They are represented as different behavior categories, forming user U i The complete sequence of behaviors: Among them, k represents different behavior type categories.

3. According to claim 1, a method for identifying high-risk users of an e-commerce platform based on time series data analysis is characterized in that: The S2 comprises the following steps: S21. Organize the user behavior dataset D into user behavior sequences in chronological order. i According to the timestamp t ij Operation behavior A ij Sort in chronological order to generate the user's complete behavior sequence matrix: S i ={(t i1 ,A i1 ),(t i2 ,A i2 ),…,(t im ,A im )}; Where m represents user U i The total number of behaviors performed, t ij is the timestamp of the jth action of the ith user, t i1 <t i2 <… <t im , A ij Represents user U i At time point t ij the type of behavior performed; S23. All the user's behavior sequence matrix S i Integrated into the behavior sequence dataset of the e-commerce platform: Among them, S represents the user behavior sequence dataset of the entire e-commerce platform, α i Represents the weight coefficient, which is used to adjust the contribution of different users in the cluster, β i represents the time correlation coefficient, which is used to adjust the influence of the time dimension on the behavior sequence, γ i Represents user U i The specific risk weight of U i The historical behavior data is set, f(A ij ,t ij ) is a nonlinear function, and the comprehensive behavior type is A ij and timestamp t ij By identifying the collective abnormal operations of user groups in a specific time period, we can identify the potential characteristics of high-risk behaviors.

4. According to claim 1, a method for identifying high-risk users of an e-commerce platform based on time series data analysis is characterized in that: The S4 comprises the following steps: S41. Preprocess the user behavior sequence data set S′={S′1,S′2,…,S′ n } Perform time series clustering analysis and use the time series clustering algorithm in Scikit-learn to classify the user's behavior sequence S′ i Grouping: users with similar behavior patterns are grouped into the same group based on the time dimension and behavior type of the behavior sequence; S42. In the process of time series clustering analysis, the dynamic time warping algorithm is combined with the behavior sequence S′ i and S′ j Perform timing matching, user U i with U j The calculation formula for the behavior sequence similarity is: Among them, A ik and A jk Represents user U i and U j The type of behavior in the kth operation, t ik and t jk For user U i and U j The behavior timestamp, w k is the weight factor of the behavior type, which is dynamically adjusted according to the risk weight of the behavior, α1 is the nonlinear index of behavior type matching, and λ k is the weight factor of time matching, β1 is the nonlinear adjustment parameter of time matching; S43. Based on behavior sequence similarity d DTW (S′ i ,S′ j Divide the user behavior sequence into multiple cluster groups (C1, C2, ..., C p ), each cluster group C p Users with similar behavioral characteristics: Among them, |C p | is the cluster group C p The number of users in, δ is the adjustment factor of the interaction between the time dimension and the behavior dimension, γ l is the time period risk weight coefficient, which reflects the contribution of behaviors in different time periods to high-risk assessment, and μ is the influence coefficient of the behavior change rate on the matching result.

5. According to claim 1, a method for identifying high-risk users of an e-commerce platform based on time series data analysis is characterized in that: The S5 comprises the following steps: S51. Clustering user behavior sequences into groups C p Conduct risk classification, and divide user groups into different risk categories based on the similarity of user behavior patterns and historical data, including normal user groups, potential high-risk user groups, and abnormal user groups; S52. Cluster each behavior sequence into groups C p According to the user's behavior feature vector V i ={A i1 ,A i2 ,…,A im } and the corresponding time series T i ={t i1 ,t i2 ,…,t im }Calculate the risk score R(C p ): Among them, w k is the weight factor of the behavior type, α2 is the behavior risk assessment coefficient, and λ k is the weight factor of the time dimension, β2 is the time risk assessment coefficient, t ik and t jk For user U i and U j timestamp; S53. The calculated risk score R(C p ) is used as the basis for risk assessment of the user group, according to the set risk threshold θ R , dividing the user groups into three categories: When R(C p )<θ R When the number of users is 1, it is determined to be a normal user group; When R(C p )≥θ R And R(C p )<θ HR When the user is identified as a potential high-risk user group; When R(C p )≥θ HR When the number of users is greater than 100, they are identified as abnormal user groups.

6. According to claim 1, a method for identifying high-risk users of an e-commerce platform based on time series data analysis is characterized in that: The S6 comprises the following steps: S61. Based on the labeled high-risk user dataset D HR Construct a semi-supervised learning model based on the behavior graph network to map the user's operation behavior into the behavior graph G i =)V i ,E i ), where V i Represents user U i The set of operation behavior nodes, E i Represents the time-ordered edge set between behavior nodes; S62. In the behavior diagram G i In the example, node v ik Represents user U i The k-th operation behavior, edge e ikj Indicates behavior ik and v ij The temporal relationship between them is used to construct a user behavior graph sequence and combine it with a graph neural network model to learn high-risk features; S63. Using graph neural networks to analyze behavior graphs G i Embed nodes and edges, learn the behavioral relationship between users, and combine the semi-supervised learning model through the similarity function d graph (G i ,G HRj ) Risk matching between identified users and high-risk users: Among them, d graph (G i ,G HRj ) is the behavior graph G i and high-risk user behavior graph G HRj The similarity function between |V i | represents the user to be identified U i The total number of nodes in the behavior graph, |V HRj | represents the total number of nodes in the high-risk user behavior graph, v ik and v HRjk Represents user U i and the behavior nodes of high-risk users, e ikj and e HRjk represents the time order edge, w k is the weight factor, α3 and β3 are nonlinear adjustment parameters, and β3 is the time sequence weight coefficient; S64. According to the similarity function d graph (G i ,G HRj ), matching the behavior graph of the user to be identified with the behavior graph of the labeled high-risk users, and automatically labeling the risk label of the new high-risk users; S65. Automatically mark the new high-risk user data D′ HR = {U′ HR1 ,U′ HR2 ,…,U′ HRn }Merge into the original high-risk user dataset D HR In the next step, we will expand the high-risk user dataset and optimize the semi-supervised learning model: Among them, D′ HR is the updated high-risk user dataset, D HR is the original high-risk user dataset, |V′ i | is the total number of behavior nodes of the newly labeled user, v′ ik and v′ HRjk are the behavior nodes of the newly labeled users and the labeled high-risk users, respectively. ρ is the dynamic balance coefficient between the new high-risk users and the original high-risk users. θ is the matching adjustment parameter between the time sequence of the new high-risk user behavior and the labeled user behavior.

7. According to claim 1, a method for identifying high-risk users of an e-commerce platform based on time series data analysis is characterized in that: The S8 comprises the following steps: S81. Based on the risk score result R(C p ) and the updated high-risk user dataset D′ HR , the system automatically classifies the risk of user groups and determines the triggering conditions of response measures. p ) is higher than the set threshold θ R When the system determines that user group C p For high-risk groups, and automatically issue warnings; S82. Targeting high-risk groups C p , the system is based on the risk level and high-risk user data set D′ HR Implementation of countermeasures for historical high-risk data in: When R(C p )≥θ HR1 And the user belongs to the high-risk user data set D′ HR When gathering, trigger the first level response measures to restrict user U i Transaction behavior and send risk reminders; When R(C p )≥θ HR2 When the user's historical behavior data shows frequent abnormalities, the second level response measures are triggered, requiring the user to i Perform identity verification and suspend some account functions; When R(C p )≥θ HR3 If the user is marked as high risk multiple times, the third level response measures will be triggered, temporarily freezing the user U i 's account; S83. The system calculates the user's risk response weight W resp (U i ), the risk response weight is combined with the updated high-risk user data set D′ HR Behavioral characteristics and current risk scores in: Among them, α4 and β4 are weight coefficients, γ k is the risk characteristic weight, f(A ik ,t ik ) is a function combining behavior type and time, ρ1 represents the dynamic impact of newly labeled high-risk users on the response measures, θ1 is the time matching adjustment parameter, and v′ ik and e′ ikj Represents the differences in behavior nodes and time-order edges between the user and the updated high-risk user set; S84. The system responds to the risk weight W resp (U i ) Automatically select appropriate preventive measures and give priority to user groups with higher response weights; S85. For the updated high-risk user dataset D′ HR For users in the system, the system implements real-time monitoring and dynamically adjusts the risk threshold θ HR , and collectively manage high-risk user groups.

Images