E-commerce operation behavior risk monitoring and early warning method and device

Abstract

The embodiment of the invention provides an e-commerce operation behavior risk monitoring and early warning method and device, and is applied to the technical field of e-commerce risk early warning. The method comprises the following steps: acquiring risk assessment data of a to-be-monitored e-commerce operator; selecting a corresponding monitoring model according to the type of the risk assessment data; performing risk evaluation on the corresponding risk evaluation data by using the corresponding monitoring model; and generating risk monitoring early warning information according to the risk evaluation result. In this way, through establishing a bogus transaction, license information, user evaluation, commodity quality, protocol rules and self-operation business distinguishing multi-dimensional e-commerce operation behavior risk monitoring model and an early warning algorithm, each e-commerce platform is connected to obtain data required by the model, and analysis and early warning are performed by using the algorithm, so that automatic risk monitoring and early warning of e-commerce operation behaviors are realized.

Description

Technical Field

[0001] The present disclosure relates to the technical field of e-commerce risk early warning, and in particular to a method and device for monitoring and early warning of e-commerce business behavior risks. Background Art

[0002] With the rapid development of e-commerce, the risks of e-commerce business operations have received more and more attention from market supervision and management. At present, the risk monitoring of e-commerce business operations is mainly carried out through the traditional market supervision comprehensive information platform, applying the Red Shield electronic logo to the websites of e-commerce operators, and strengthening the supervision of website license display behavior. The monitoring direction is single, and there is a lack of supervision mode for active risk identification, automatic monitoring, big data analysis and early warning. It is impossible to conduct real-time risk detection, monitoring, reporting and early warning, and therefore cannot intervene in the risks of e-commerce business operations in a timely manner. Summary of the invention

[0003] The present invention provides a method and device for monitoring and early warning of risks in e-commerce business behavior.

[0004] According to a first aspect of the present disclosure, a method for monitoring the risk of e-commerce business behavior is provided. The method comprises:

[0005] Obtain risk assessment data of the e-commerce operators to be monitored;

[0006] Selecting a corresponding monitoring model according to the type of risk assessment data;

[0007] Use the corresponding monitoring model to conduct risk assessment on the corresponding risk assessment data;

[0008] Generate risk monitoring and early warning information based on risk assessment results.

[0009] According to the above aspects and any possible implementation, an implementation is further provided.

[0010] The risk assessment data includes the store transaction data, license information, user evaluation data, business commodity information, agreement rule data and self-operated sales commodity information of the e-commerce operator to be monitored;

[0011] The monitoring models include a false transaction monitoring model, a license information monitoring model, a user evaluation monitoring model, a product quality monitoring model, a protocol rule monitoring model and a proprietary business differentiation monitoring model.

[0012] According to the above aspects and any possible implementation, an implementation is further provided.

[0013] Use the fake transaction monitoring model to conduct risk assessment on store transaction data, which can be achieved through the following steps:

[0014] Generate a transaction network based on store transaction data according to preset rules;

[0015] Performing representation learning on the transaction network to obtain a representation matrix;

[0016] According to a pre-trained detection algorithm, an abnormality score is calculated for the representation matrix to obtain an abnormality score value;

[0017] The abnormal score value is used as the risk assessment result of the store transaction data.

[0018] According to the above aspects and any possible implementation, an implementation is further provided.

[0019] The certificate information includes: website display information;

[0020] Use the certificate information monitoring model to conduct risk assessment on certificate information, which can be achieved through the following steps:

[0021] Determining whether the website display information contains an electronic business license display link and icon;

[0022] If the electronic business license display link and icon are included, the electronic business license content is obtained from the electronic business license display link;

[0023] Determine whether the content of the electronic business license can be obtained;

[0024] If the electronic business license content can be obtained, the electronic business license content is compared with the content in the preset electronic business license library; if the comparison is consistent, it is determined whether the website display information contains administrative license information;

[0025] If administrative license information is included, the administrative license information will be compared with the administrative license in the preset business information database; if they are consistent, the license information detection passes.

[0026] According to the above aspects and any possible implementation, an implementation is further provided.

[0027] Use the user evaluation monitoring model to conduct risk assessment on user evaluation data, which can be achieved through the following steps:

[0028] Calculate the falseness of the text features and semantic features of the comments in the user evaluation data to obtain the falseness value of each evaluation;

[0029] Conduct behavioral characteristic analysis on reviewers in user evaluation data to obtain behavioral characteristic values ​​of each reviewer;

[0030] Clustering the reviewers according to the behavior feature values ​​to obtain candidate groups; calculating group feature values ​​of the candidate groups;

[0031] Construct a comment relationship graph based on user evaluation data;

[0032] The falseness value, behavior characteristic value and group characteristic value are iteratively updated using the comment relationship graph. When the number of iterations exceeds a preset number or a preset stop condition is met, the iteration is stopped and the iteratively updated falseness value, behavior characteristic value and group characteristic value are output.

[0033] According to the above aspects and any possible implementation, an implementation is further provided.

[0034] Use the product quality monitoring model to conduct risk assessment on the operating product information through the following steps:

[0035] Compare the operating commodity information with the preset unqualified product information database;

[0036] If the comparison is consistent, the product quality is unqualified.

[0037] According to the above aspects and any possible implementation, an implementation is further provided.

[0038] Use the protocol rule monitoring model to conduct risk assessment on protocol rule data, which can be achieved through the following steps:

[0039] Determine whether the protocol rule data matches the corresponding preset non-compliance rule;

[0040] If it hits, it is not compliant.

[0041] According to the above aspects and any possible implementation, an implementation is further provided.

[0042] Use the self-operated business differentiation monitoring model to conduct risk assessment on self-operated sales product information, which can be achieved through the following steps:

[0043] Inputting the self-operated sales commodity information into a pre-trained self-operated business differentiation monitoring model, and outputting a self-operated business risk value;

[0044] The operating activities whose risk values ​​of the proprietary business are greater than the preset standard threshold are determined as risky activities.

[0045] According to a second aspect of the present disclosure, a device for monitoring the risk of e-commerce business behavior is provided. The device comprises:

[0046] A data acquisition module, used to obtain risk assessment data of the e-commerce operator to be monitored;

[0047] A model determination module, used to select a corresponding monitoring model according to the type of risk assessment data;

[0048] A risk assessment module is used to perform risk assessment on corresponding risk assessment data using corresponding monitoring models;

[0049] The early warning module is used to generate risk monitoring and early warning information based on risk assessment results.

[0050] According to a third aspect of the present disclosure, an electronic device is provided, which includes a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the program, the method described above is implemented.

[0051] According to a fourth aspect of the present disclosure, a computer-readable storage medium is provided, on which a computer program is stored. When the program is executed by a processor, the method according to the first aspect of the present disclosure is implemented.

[0052] The present disclosure relates to an e-commerce business behavior risk monitoring and early warning method and device, which make full use of information technologies such as big data and cloud computing to provide an e-commerce business behavior risk monitoring and early warning system, establish a multi-dimensional e-commerce business behavior risk monitoring model and early warning algorithm such as false transactions, license information, user evaluation, product quality, protocol rules, and self-operated business distinction, connect various e-commerce platforms to obtain the data required by the model, use algorithms for analysis and early warning, and realize automatic risk monitoring and early warning.

[0053] It should be understood that the contents described in the summary of the invention are not intended to limit the key or important features of the embodiments of the present disclosure, nor are they intended to limit the scope of the present disclosure. Other features of the present disclosure will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. The accompanying drawings are used to better understand the present solution and do not constitute a limitation of the present disclosure. In the accompanying drawings, the same or similar reference numerals represent the same or similar elements, among which:

[0055] Figure 1 A flow chart of a method for monitoring and early warning of e-commerce business behavior risks according to an embodiment of the present disclosure is shown;

[0056] Figure 2 A flow chart of using a certificate information monitoring model to perform risk assessment on certificate information according to an embodiment of the present disclosure is shown;

[0057] Figure 3 A flow chart showing the use of a commodity quality monitoring model to perform risk assessment on commodity information according to an embodiment of the present disclosure is shown;

[0058] Figure 4A flow chart showing risk assessment of protocol rule data using a protocol rule monitoring model according to an embodiment of the present disclosure is shown;

[0059] Figure 5 A block diagram of an e-commerce business behavior risk monitoring and early warning device according to an embodiment of the present disclosure is shown;

[0060] Figure 6 A schematic block diagram of an exemplary electronic device capable of implementing embodiments of the present disclosure is shown. DETAILED DESCRIPTION

[0061] In order to make the purpose, technical solution and advantages of the embodiments of the present disclosure clearer, the technical solution in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are part of the embodiments of the present disclosure, not all of the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present disclosure.

[0062] In addition, the term "and / or" in this article is only a description of the association relationship between the associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship.

[0063] In the present disclosure, the e-commerce business behavior risk early warning monitoring is based on the basic data support provided by each e-commerce platform, and a multi-dimensional e-commerce business behavior risk monitoring model and early warning algorithm are established, which are applied to the e-commerce business behavior risk early warning monitoring system. The system automatically monitors risks and issues early warnings based on the e-commerce business behavior model and algorithm.

[0064] Figure 1 The flowchart of the e-commerce business behavior risk monitoring and early warning method 100 according to an embodiment of the present disclosure is shown. The method 100 includes:

[0065] Step 110, obtaining risk assessment data of the e-commerce operator to be monitored.

[0066] In some embodiments, the risk assessment data includes store transaction data, license information, user evaluation data, business commodity information, agreement rule data and self-operated sales commodity information of the e-commerce operator to be monitored.

[0067] Step 120: Select a corresponding monitoring model according to the type of the risk assessment data.

[0068] In some embodiments, the monitoring model includes a false transaction monitoring model, a license information monitoring model, a user evaluation monitoring model, a product quality monitoring model, a protocol rule monitoring model, and a self-operated business distinction monitoring model. The store transaction data corresponds to the false transaction monitoring model, the license information corresponds to the license information monitoring model, the user evaluation data corresponds to the user evaluation monitoring model, the business product information corresponds to the product quality monitoring model, the protocol rule data corresponds to the protocol rule monitoring model, and the self-operated sales product information corresponds to the self-operated business distinction monitoring model.

[0069] Step 130: Use the corresponding monitoring model to perform risk assessment on the corresponding risk assessment data.

[0070] In some embodiments, a false transaction monitoring model is used to perform risk assessment on store transaction data, which is achieved through the following steps: generating a transaction network based on store transaction data according to preset rules; performing representation learning on the transaction network to obtain a representation matrix; performing anomaly score calculation on the representation matrix according to a pre-trained detection algorithm to obtain anomaly score values; and using the anomaly score values ​​as risk assessment results for store transaction data.

[0071] Specifically, as follows:

[0072] First, use the following attributes to describe each transaction: transaction ID, txn; purchasing user, buyer; user email address, email; user delivery address, addr; user payment token (credit card ID, Alipay ID or WeChat ID, etc.), pmt. Next, build a transaction network G, which is represented by a graph and defined as G = (V, E). Where V = {v1, v2, ..., v n} is a set of vertices, E = {e1, e2, …, e n} is the set of edges. v i With type here If a transaction txn occurs between other types of vertices {pmt, email, addr, buyer}, an edge is added between the two vertices. Each txn vertex has some attributes to describe the transaction, including the type of transaction goods, quantity information, logistics information (logistics order number, whether the logistics is real, delivery time and distance ratio, etc.), browsing information (the time the ordering user browses the store, the time the ordering user browses the ordered goods, whether there is communication between the ordering user and the store customer service, etc.), user evaluation information (whether the evaluation text and evaluation picture are consistent with the product information, etc.).

[0073] All transactions within a period of time will be analyzed, and according to the above method, a transaction network G can be constructed. Network Representation Learning (NRL) is used to capture the topological relationship information between nodes (vertices).

[0074] Given a transaction network, the goal of the NRL method is to learn a low-dimensional representation matrix Its i-th row D i It represents the node v in the transaction network i In this way, the topological information of the transaction network G can be captured by dense vectors, i.e., node embeddings. There are many algorithms that can achieve representation learning of heterogeneous networks. Based on the efficiency, effectiveness, and simplicity of the algorithm, for example, the Metapath2vec algorithm is selected for representation learning.

[0075] For D, the Isolation Forest algorithm is used for detection. Each line is a sample, which is a d-dimensional vector. For nodes of type txn, its feature vector is added with its own attributes. All txn nodes are picked out for separate detection.

[0076] The detection algorithm process is divided into two steps. The first is training, extracting multiple samples and constructing multiple binary trees (Isolation Tree, iTree). The second is detection, integrating the results of multiple binary trees and calculating the anomaly score of each data point.

[0077] When building an iTree, we first extract a batch of samples from the entire data, then randomly select a feature as the starting node, and randomly select a value between the maximum and minimum values ​​of the feature. The data in the sample that is less than the value is moved to the left branch, and the data that is greater than or equal to the value is moved to the right branch.

[0078] Then, repeat the above steps in the left and right branches until the following conditions are met:

[0079] 1. The data cannot be divided any further, that is, it contains only one piece of data, or all the data are the same.

[0080] 2. The binary tree reaches the maximum depth specified.

[0081] When calculating the anomaly score of data x, we first need to estimate its path length (also called depth) in each iTree. Specifically, we first follow an iTree from the root node to the bottom according to the values ​​of different features until we reach a leaf node. Assuming that the number of samples in the iTree training samples that also fall on the leaf node where x is located is T.size, the path length h(x) of data x on this iTree can be calculated using the following formula:

[0082] h(x)=e+C(T.size)

[0083] In the formula, e represents the number of edges that data x passes through from the root node to the leaf node of iTree, and C(T.size) can be considered as a correction value, which represents the average path length in a binary tree constructed with T.size sample data. In general, the calculation formula of C(n) is as follows:

[0084]

[0085] Among them, H(n-1) can be estimated by ln(n-1)+0.5772156649.

[0086] The final anomaly score Score(x) of data x is:

[0087]

[0088] In the formula, E(h(x)) represents the mean path length of data x in multiple iTrees, ψ represents the number of training samples of a single iTree, and C(ψ) represents the average path length of the binary tree constructed with ψ pieces of data.

[0089] If the average path length of data x in multiple iTrees is shorter, the score is closer to 1, indicating that data x is more abnormal; if the average path length of data x in multiple iTrees is longer, the score is closer to 0, indicating that data x is more normal. Set a threshold θ, when Score(x)>θ, it is considered that false transactions have occurred.

[0090] In the above algorithm, the Isolation Forest algorithm has two main parameters: one is the number of binary trees; the other is the number of samples extracted when training a single iTree. For example, the number of binary trees is selected as 100, and the number of samples is selected as 256. θ is selected as 0.8.

[0091] In some embodiments, the certificate information includes: website display information; Figure 2The flowchart of using the license information monitoring model to conduct risk assessment on license information is implemented by the following steps: judging whether the website display information contains an electronic business license display link and icon; if the electronic business license display link and icon are contained, obtaining the electronic business license content from the electronic business license display link; judging whether the electronic business license content can be obtained; if the electronic business license content can be obtained, comparing the electronic business license content with the content in the preset electronic business license library; if the comparison is consistent, judging whether the website display information contains administrative license information; if the administrative license information is contained, comparing the administrative license information with the administrative license in the preset business information library; if the comparison is consistent, the license information detection is passed. After the e-commerce operator is established and registered, an electronic business license is generated. It is stored in the electronic business license library of the Market Supervision Bureau (National Enterprise Credit Information Publicity System). After obtaining the electronic business license, the display link and logo icon can be obtained. The electronic business license display link and icon can be embedded in the web page for public display. Enterprises that have obtained an "electronic license" will have the Industrial and Commercial Red Shield logo embedded on their website. If you see the Red Shield logo, you can be sure that the website is a legal enterprise registered with the industrial and commercial department. Click on the logo to view its registration information and annual inspection information. Therefore, you can verify the authenticity of the market entity's electronic business license in real time, query the market entity's identity information and status, and simultaneously compare and check the relevant information of the electronic business license holder.

[0092] In some embodiments, a user evaluation monitoring model is used to perform risk assessment on user evaluation data, which is achieved through the following steps: calculating the falsity of text features and semantic features of the comment content in the user evaluation data to obtain a falsity value for each evaluation; analyzing the behavioral characteristics of the commentators in the user evaluation data to obtain a behavioral characteristic value for each commentator; clustering the commentators based on the behavioral characteristic values ​​to obtain candidate groups; calculating the group characteristic values ​​of the candidate groups; constructing a comment relationship graph based on the user evaluation data; and iteratively updating the falsity value, behavioral characteristic value, and group characteristic value using the comment relationship graph. When the number of iterations exceeds a preset number or a preset stop condition is met, the iteration is stopped, and the iteratively updated falsity value, behavioral characteristic value, and group characteristic value are output.

[0093] Specifically, as follows:

[0094] First, we collect reviews and related information of all products from all e-commerce platforms within a certain period of time, and use the store name, product number, and commentator ID to identify each review. We calculate a quantity, the falsehood, based on the textual and semantic features of the review to measure the possibility of whether the review is a false review.

[0095] The text features of a review include the length of the review text (the number of words contained in the review text), text complexity (the complexity of the vocabulary used in the text), helpfulness votes (the number of supports that the reviewer thinks the review is useful), early time window (whether a review is an early review of a product or service), similarity of the review content (the degree of similarity between a review and other reviews of the same product or service), review replies (the number of replies to a review, reflecting the degree of its popularity), coherence with other reviews (the degree of consistency between a review and other reviews of the same product or service), and consistency between the initial review and follow-up review (the time interval between the initial review and the follow-up review and the degree of content progression).

[0096] The semantic features of comments are also an important aspect of distinguishing fake comments. The sentiment analysis method is used to analyze the comments, because research shows that fake comments contain more sentiment words than real comments, and the performance in the corpus is more positive or negative than real comments. The process of sentiment analysis is as follows. The first step is to segment the comments, using Chinese word segmentation technology to segment the comments into individual words. The second step is to perform part-of-speech tagging and remove stop words. The third step is to extract the topic, using the word segmentation results and the Apriori algorithm to obtain the frequent item set of the comment topic. The fourth step is to calculate the sentiment tendency of the comment, that is, to select a sentiment analysis word set and calculate the number of "Chinese positive comments", "Chinese negative comments", "Chinese positive sentiment" and "Chinese negative sentiment" words that appear in the comments as the semantic feature value of the comment.

[0097] Based on the textual and semantic features of the reviews, a logistic regression model is used to classify and preliminarily identify fake and real reviews. For a review, the probability value calculated by the model is used as the initial value of the falsehood FR of the review.

[0098] Secondly, based on the reviewer's behavioral characteristics, the possibility of him being a fake reviewer is calculated. The reviewer's behavioral characteristics f are implemented through the following steps:

[0099] 1. User Registration Rate (RUR)

[0100]

[0101] Here | i | represents the number of registered accounts of a user, and λ1 represents the threshold of registered accounts that a single IP of a commentator can register. Since there is no direct way to calculate the exact number of registered accounts of a given user, IP addresses are used to distinguish users.

[0102] 2. User registration window (URW)

[0103]

[0104] Where avg(|ti|) = avg(|max_create_timei - min_create_timei|) / user_cnt. It represents the average time interval between two accounts registered by a user. γ1 represents the threshold of avg(|ti|), which means that if avg(|ti|) is greater than γ i , set the value of URW to 0.

[0105] 3. Review ratio (RR)

[0106]

[0107] In the formula |u r | represents the number of comments posted by the user. λ2 represents |u r |Threshold based on analysis results.

[0108] 4. Ratio of review per merchant (RRM)

[0109]

[0110] In the formula It represents the number of comments posted by users on the merchant. λ3 is the threshold of the number of store user comments.

[0111] 5. Review content similarity of each merchant (RMCS, review per merchant content similarity)

[0112]

[0113] in and They represent the 1st and kth comments published by the user in the i-th store respectively. Represents the average similarity of reviews posted by a user to a store. If a user posts only one review, RMCS is 0.

[0114] 6. Review content similarity (RCS)

[0115] RCS(u)=avg(RMCS(u,m i ))

[0116] Here avg(RMCS(u,m i )) refers to the mean of RMCS.

[0117] 7. Review per merchant time window (RMTW)

[0118]

[0119] in and They represent the latest and earliest time that a user comments on a store. γ2 is the time interval threshold for a user to comment on a store.

[0120] 8. Review time window (RTW)

[0121] RTW(u)=avg(RMTW(u,m i ))

[0122] Where avg(RMTW(u,m i )) refers to the average value of RMTW.

[0123] Then the falseness F of the reviewer u R (u) can be calculated as:

[0124]

[0125] Where w i It is the weight value of each feature, which can all be 1, or determined according to the actual situation.

[0126] Then, to identify fake review groups, we use the following process:

[0127] Cluster all reviewers using the 8 eigenvalues ​​mentioned above. The clustering method can be k-means, hierarchical clustering, spectral clustering, etc. After clustering, calculate the center point of each class (using the same method as k-means to calculate the center point). For each class, calculate the maximum distance from the point in the class (i.e., reviewer) to the center point. All points less than half of the maximum distance constitute a candidate group. Identify whether the reviewer belongs to a review group based on the behavioral characteristics of the reviewer in the candidate group.

[0128] The commonly used features for identifying fake review groups are shown below, where g represents a candidate group.

[0129] 1. Ratio of group review per merchant (RGM)

[0130]

[0131] here represents the total number of reviews of the group on the merchant. λ4 represents the threshold of the number of reviews posted by fake reviewers.

[0132] 2. Group review per merchant content similarity (GMCS)

[0133]

[0134] in Indicates the average similarity of the comments in a group.

[0135] 3. Group review per merchant timewindow (GMTW)

[0136]

[0137] in Indicates the last time a candidate reviewer group wrote a review for a store. It indicates that the candidate reviewer group has made a review on the store for the first time. γ3 is the threshold of the time window in which the reviewer makes multiple reviews on the same store.

[0138] 4. Group size ratio (GSR)

[0139]

[0140] where |g j | represents the number of fake reviewers in a group (F R The number of values ​​greater than 0.8) and |max(g)| represent the maximum number of fake reviewers in all groups.

[0141] For each group g j , calculate the above features, if the average value of the above features is greater than 0.8, it is considered to belong to a comment group and is given an ID.

[0142] In order to more accurately calculate the falsehood of the comments, we first construct a comment relationship graph. The comment relationship graph is represented by a graph G, defined as G = (V, E). Where V = {v1, v2, ..., v n} is a set of vertices, E={e ij , for i, j∈{1,…,n}} is the set of edges. i With type here Where RW stands for Reviewer, R stands for Review, and P stands for Product. i ), published about product v j A comment from v k , then the vertex v i and v k There is an edge e between ik , v j and v k There is an edge e between jk All Reviewer-type nodes (vertices) have an attribute φ(v)∈{0, 1, …, m}, indicating which review group they belong to (0 means they do not belong to any review group). All Product-type nodes (vertices) have an attribute ψ(v), indicating which store they belong to.

[0143] Define the set PW(i) as the set of all reviews of the product reviewed by review i, and define the falsehood of the set PW(i) as:

[0144]

[0145] Define the set PRW(i) as the set of all products reviewed by reviewer i.

[0146]

[0147] Define the set GR(k) as all the reviews posted by all reviewers in review group k, GRW(k) represents all the reviewers in review group k, and GP(k) represents the products reviewed by all the reviews in review group k.

[0148] RRW(i) is the set of all reviews by reviewer i,

[0149]

[0150] Define the set RP(k) as all reviews of product k, and RWP(k) as all reviewers who have reviewed product k. Then

[0151]

[0152]

[0153] According to Figure G, use the following steps to update F R , F RW , F RG :

[0154] Step 1: The falsity F of all terms (R, RW, RG) R, F RW , F RG Initialized to zero.

[0155] Step 2: Calculate the initial falsity of each item.

[0156] F R , F RW The initial value of can be calculated using the method given above;

[0157] F R =F RP , which is the average value of the falsehood of all reviews of the product;

[0158] That is, the average falsehood of all reviewers in the group.

[0159] Step 3: Iteratively update F according to graph G R , F RW , F RG , we use represents the updated falsehood, And F R , F RW , F RG Indicates the falseness before updating.

[0160] 1) For each R node R k ,

[0161]

[0162] Where F PR (i) refers to the falseness of the product corresponding to this review, F RWR (i) refers to the falsehood of the commenter corresponding to this comment.

[0163] 2) For all RW nodes, calculate:

[0164]

[0165] 3) For all P, calculate:

[0166]

[0167] 4) Calculate for all RGs:

[0168]

[0169] Step 4: When the number of iterations reaches 10, or

[0170]

[0171] Stop the calculation when , otherwise continue the iterative calculation.

[0172] After the calculation is completed, check each Reviewi. If F R (i)>0.8, it is considered a fake review. Check each Reviewer j, if F RW (j)>0.8, it is considered a fake reviewer. Check each Reviewer group j. If F RG (j)>0.8, it is considered to be a fake reviewer group. Check each product k. If F P (k)>0.8, it is considered that there are many false reviews for this product and there may be risks. For each store, calculate the average falseness of its products. If it is greater than 0.8, it is considered that this store may have risks. Warnings should be issued in all the above situations.

[0173] In some embodiments, Figure 3 The flowchart of using the commodity quality monitoring model to conduct risk assessment on the operating commodity information is implemented through the following steps: comparing the operating commodity information with the preset unqualified product information database; if the comparison is consistent, the commodity quality is unqualified. Obtain the penalty decision from the market behavior supervision system, extract the commodity information in the penalty decision, including the commodity name, specification and manufacturer, etc. to build an unqualified product information database, and then match the operating commodity information with it. If the match is consistent, the commodity quality is considered unqualified.

[0174] In some embodiments, Figure 4 The flowchart of using the protocol rule monitoring model to conduct risk assessment on protocol rule data is shown, which is implemented by the following steps: determine whether the protocol rule data hits the preset corresponding non-compliance rules; if it hits, it is non-compliant. First, obtain the display information of the e-commerce website to see whether the platform agreement and transaction rules can be obtained. If yes, download the agreement content. If it can be downloaded, determine whether the agreement content contains transaction, franchising, entry and operation content. If it does, further determine whether the agreement content contains user information query, correction, deletion and user cancellation methods. If there is such information, further determine whether there are unfair terms and the ownership of the right of interpretation. If there are no unfair terms and the ownership of the right of interpretation, determine whether the user cancellation settings are reasonable, whether the transaction rules include transaction steps, precautions and download methods, whether the transaction rules can be downloaded, and whether there are no unfair terms and the ownership of the right of interpretation in the transaction rules. If the above judgments are passed, it is considered that the protocol rule monitoring has passed. Otherwise, if any of the above rules fails, an early warning is required.

[0175] In some embodiments, a self-operated business differentiation monitoring model is used to conduct a risk assessment on self-operated sales commodity information, which is achieved through the following steps: the self-operated sales commodity information is input into a pre-trained self-operated business differentiation monitoring model, and a self-operated business risk value is output; and business operations in the self-operated business risk value that are greater than a preset standard threshold are determined as risky activities.

[0176] Specifically, it is achieved through the following steps:

[0177] Extract information from the store page to see if there is a self-operated mark. For stores with self-operated marks, check their shipping addresses. The shipping addresses of all self-operated stores should be the same. If the shipping addresses of any stores are inconsistent, an early warning will be issued. For stores without self-operated marks, if the shipping address is the same as the self-operated shipping address, an early warning will be issued.

[0178] 3. Bind the e-commerce business behavior risk monitoring model established in step ① with the early warning algorithm in step ②, and then conduct model algorithm evaluation in the next step;

[0179] 4. Model algorithm evaluation is for the risk monitoring model of the bound algorithm. By setting risk samples and normal samples to input into the model, the model is verified and evaluated. The samples are test data set according to the risk monitoring model of e-commerce business behavior, simulating the data in the e-commerce business process, such as order logistics data of e-commerce operators in the transaction process, consumers' text and picture evaluation data on a certain type of goods, and data on discrepancies between certificates and licenses, etc. Among them:

[0180] a. Risk sample

[0181] Risk samples simulate abnormal data in the e-commerce operation process. By inputting abnormal risk sample data, we can see whether the risk monitoring model can automatically monitor and warn based on the early warning algorithm. For example, by setting abnormal order logistics data in the transaction process of e-commerce operators as risk samples and inputting them into the model, the expected result is that the system automatically warns and determines that the e-commerce operator has the risk of false transaction operation behavior.

[0182] b. Normal samples

[0183] Normal samples simulate normal data in the e-commerce business process. By inputting normal risk sample data, we can see whether the risk monitoring model does not perform monitoring and early warning according to the early warning algorithm. For example, if the data of the e-commerce operator's license and certificate are set as normal samples, after entering the model, the expected result is that the system will not prompt the e-commerce operator that there is a risk of operating behavior that is inconsistent with the license and certificate.

[0184] By setting up different risk samples and normal samples, the e-commerce business behavior risk monitoring model and early warning algorithm are verified and evaluated, and continuously updated.

[0185] 5. Set samples based on the data from the simulated e-commerce business process. If a risk sample is entered, the system will automatically issue an alert. If a normal sample is entered, the system will operate normally, achieving the expected results. If the system does not automatically issue an alert when risk sample data is entered, or automatically issues an alert when normal sample data is entered, then the model or alert algorithm does not meet the standards;

[0186] 6. By continuously entering new risk samples and normal samples, the e-commerce business behavior risk monitoring model or early warning algorithm is continuously improved to ensure a high accuracy rate and form the final e-commerce business behavior risk monitoring model and early warning algorithm;

[0187] 7. Obtain the data streams required for the e-commerce risk monitoring model from each e-commerce service platform, including the consumer purchase data, consumer and customer service interaction data, consumer evaluation data, e-commerce business data, e-commerce operator license data, platform agreement rules data, e-commerce platform self-operated business data, and e-commerce product order logistics data;

[0188] 8. Receive the above data information generated in the e-commerce business process in real time, and automatically obtain the data required by the e-commerce risk monitoring model according to the set period by setting the data mapping cycle. The data can be used by the e-commerce risk monitoring model. The historical data is stored in the risk monitoring historical database by establishing a risk monitoring historical database;

[0189] 9. The final e-commerce business behavior risk monitoring model and early warning algorithm formed in step 6 are associated with the data generated during the e-commerce business process in step 7. Historical data monitoring and analysis calls the risk monitoring historical database in step 8;

[0190] 10. Based on the real data of e-commerce business operations, the risk threshold of each indicator data of e-commerce business operations is calculated through the e-commerce business operation risk monitoring model and early warning algorithm.

[0191] Step 140, generating risk monitoring and early warning information according to the risk assessment results.

[0192] In some embodiments, the system will automatically compare the risk threshold of each indicator data of e-commerce business behavior calculated by the early warning algorithm with the set standard threshold, and generate a result. When the risk threshold of each indicator data of e-commerce business behavior calculated is greater than the pre-set standard prediction, the e-commerce business behavior is determined to be a risk activity and an automatic early warning is issued; the system can pre-set early warning rules, automatically warn and send risk early warning reports, and the report content can be customized according to the risk monitoring requirements of e-commerce business behavior in different dimensions, and the report format and report method can be set; the report format mainly includes risk warning instructions, judgment results, judgment basis, recommended handling methods, etc., and different fields can be selected to form a report format. The reporting method mainly includes mobile terminal push, SMS push, email push, etc., and one or more risk report push methods can be selected; when it is determined to be an e-commerce business behavior risk according to the model and early warning algorithm, the system automatically classifies and consolidates the data involved in the risk to form Internet electronic data evidence, and sends the risk report to relevant personnel according to the predetermined information sending format and method.

[0193] By establishing a risk early warning monitoring model and early warning algorithm for e-commerce business behavior, and pre-setting standard thresholds, risk reporting formats and methods in the early warning monitoring system for e-commerce business behavior risks, it is possible to monitor and warn of e-commerce business behavior risks in real time, and provide a risk monitoring and processing method for e-commerce business behavior, thereby improving the automatic monitoring, early warning, evidence consolidation, and processing capabilities of e-commerce business behavior risks, and improving the efficiency of e-commerce business behavior supervision. When an e-commerce business behavior risk is determined based on the model and early warning algorithm, the system automatically classifies and consolidates the data involved in the risk to form Internet electronic data evidence.

[0194] It should be noted that, for the aforementioned method embodiments, for the sake of simplicity, they are all described as a series of action combinations, but those skilled in the art should be aware that the present disclosure is not limited by the order of the actions described, because according to the present disclosure, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all optional embodiments, and the actions and modules involved are not necessarily required by the present disclosure.

[0195] The above is an introduction to the method embodiment. The following is a further explanation of the scheme disclosed in the present invention through an apparatus embodiment.

[0196] Figure 5 FIG. 5 shows a block diagram of an e-commerce business behavior risk monitoring and early warning device 500 according to an embodiment of the present disclosure. Figure 5 As shown, the device 500 includes:

[0197] The data acquisition module 510 is used to acquire risk assessment data of the e-commerce operator to be monitored;

[0198] A model determination module 520, configured to select a corresponding monitoring model according to the type of risk assessment data;

[0199] A risk assessment module 530 is used to perform risk assessment on corresponding risk assessment data using a corresponding monitoring model;

[0200] The early warning module 540 is used to generate risk monitoring early warning information according to the risk assessment results.

[0201] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the described module can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0202] According to an embodiment of the present disclosure, the present disclosure also provides an electronic device and a readable storage medium.

[0203] Figure 6 A schematic block diagram of an electronic device 600 that can be used to implement an embodiment of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present disclosure described and / or required herein.

[0204] The electronic device 600 includes a computing unit 601, which can perform various appropriate actions and processes according to a computer program stored in a ROM 602 or a computer program loaded from a storage unit 608 into a RAM 603. In the RAM 603, various programs and data required for the operation of the electronic device 600 can also be stored. The computing unit 601, the ROM 602, and the RAM 603 are connected to each other via a bus 604. An I / O interface 605 is also connected to the bus 604.

[0205] Multiple components in the electronic device 600 are connected to the I / O interface 605, including: an input unit 606, such as a keyboard, a mouse, etc.; an output unit 607, such as various types of displays, speakers, etc.; a storage unit 608, such as a disk, an optical disk, etc.; and a communication unit 609, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 609 allows the electronic device 600 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0206] The computing unit 601 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 601 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 601 performs the various methods and processes described above, such as method 100. For example, in some embodiments, the method 100 may be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as a storage unit 608. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 600 via ROM 602 and / or communication unit 609. When the computer program is loaded into RAM 603 and executed by the computing unit 601, one or more steps of the method 100 described above may be performed. Alternatively, in other embodiments, the computing unit 601 may be configured to perform the method 100 in any other appropriate manner (e.g., by means of firmware).

[0207] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0208] The program code for implementing the method of the present disclosure may be written in any combination of one or more programming languages. These program codes may be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0209] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0210] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0211] The systems and techniques described herein may be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), and the Internet.

[0212] A computer system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The relationship of client and server is generated by computer programs running on respective computers and having a client-server relationship with each other. The server may be a cloud server, a server of a distributed system, or a server combined with a blockchain.

[0213] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this disclosure can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solutions disclosed in this disclosure can be achieved, and this document does not limit this.

[0214] The above specific implementations do not constitute a limitation on the protection scope of the present disclosure. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present disclosure shall be included in the protection scope of the present disclosure.

Claims

1. A method for monitoring and early warning of e-commerce business behavior risks, characterized in that: include: Obtain risk assessment data of the e-commerce operators to be monitored; Selecting a corresponding monitoring model according to the type of risk assessment data; Use the corresponding monitoring model to conduct risk assessment on the corresponding risk assessment data; Generate risk monitoring and early warning information based on risk assessment results.

2. The method according to claim 1, characterized in that The risk assessment data includes the store transaction data, license information, user evaluation data, business commodity information, agreement rule data and self-operated sales commodity information of the e-commerce operator to be monitored; The monitoring models include a false transaction monitoring model, a license information monitoring model, a user evaluation monitoring model, a product quality monitoring model, a protocol rule monitoring model and a proprietary business differentiation monitoring model.

3. The method according to claim 2, characterized in that Use the fake transaction monitoring model to conduct risk assessment on store transaction data, which can be achieved through the following steps: Generate a transaction network based on store transaction data according to preset rules; Performing representation learning on the transaction network to obtain a representation matrix; According to a pre-trained detection algorithm, an abnormality score is calculated for the representation matrix to obtain an abnormality score value; The abnormal score value is used as the risk assessment result of the store transaction data.

4. The method according to claim 2, characterized in that: The certificate information includes: website display information; Use the certificate information monitoring model to conduct risk assessment on certificate information, which can be achieved through the following steps: Determining whether the website display information contains an electronic business license display link and icon; If the electronic business license display link and icon are included, the electronic business license content is obtained from the electronic business license display link; Determine whether the content of the electronic business license can be obtained; If the electronic business license content can be obtained, the electronic business license content is compared with the content in the preset electronic business license library; if the comparison is consistent, it is determined whether the website display information contains administrative license information; If administrative license information is included, the administrative license information will be compared with the administrative license in the preset business information database; if they are consistent, the license information detection passes.

5. The method according to claim 2, characterized in that: Use the user evaluation monitoring model to conduct risk assessment on user evaluation data, which can be achieved through the following steps: Calculate the falseness of the text features and semantic features of the comments in the user evaluation data to obtain the falseness value of each evaluation; Conduct behavioral characteristic analysis on reviewers in user evaluation data to obtain behavioral characteristic values ​​of each reviewer; Clustering the reviewers according to the behavioral feature values ​​to obtain a candidate group; Calculating a group characteristic value of the candidate group; Construct a comment relationship graph based on user evaluation data; The falseness value, behavior characteristic value and group characteristic value are iteratively updated using the comment relationship graph. When the number of iterations exceeds a preset number or a preset stop condition is met, the iteration is stopped and the iteratively updated falseness value, behavior characteristic value and group characteristic value are output.

6. The method according to claim 2, characterized in that Use the product quality monitoring model to conduct risk assessment on the operating product information through the following steps: Compare the operating commodity information with the preset unqualified product information database; If the comparison is consistent, the product quality is unqualified.

7. The method according to claim 2, characterized in that Use the protocol rule monitoring model to conduct risk assessment on protocol rule data, which can be achieved through the following steps: Determine whether the protocol rule data matches the corresponding preset non-compliance rule; If it hits, it is not compliant.

8. The method according to claim 2, characterized in that: Use the self-operated business differentiation monitoring model to conduct risk assessment on self-operated sales product information, which can be achieved through the following steps: Inputting the self-operated sales commodity information into a pre-trained self-operated business differentiation monitoring model, and outputting a self-operated business risk value; The operating activities whose risk values ​​of the proprietary business are greater than the preset standard threshold are determined as risky activities.

9. An e-commerce business behavior risk monitoring and early warning device, characterized in that: include: A data acquisition module, used to obtain risk assessment data of the e-commerce operator to be monitored; A model determination module, used to select a corresponding monitoring model according to the type of risk assessment data; A risk assessment module is used to perform risk assessment on corresponding risk assessment data using corresponding monitoring models; The early warning module is used to generate risk monitoring and early warning information based on risk assessment results.

10. An electronic device, characterized in that: include: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method of any one of claims 1 to 8.

Images