Point data analysis method and system based on cloud platform

Abstract

The invention discloses an integral data analysis method and system based on a cloud platform, and relates to the technical field of data processing and analysis, the system is composed of a plurality of functional modules, and the system comprises a data acquisition and preprocessing module for obtaining and preprocessing integral data; wherein the point data at least comprises transaction data, behavior data and activity data; the dynamic association matching module is used for performing dynamic association based on the transaction data and the activity data, calculating an association weight, and obtaining an association dimension by using a dynamic mapping algorithm; the user portrait construction module is used for matching the association dimension with the behavior data, obtaining and extracting key features from the matched data, distributing a label for each user, and constructing a user portrait; wherein the key features at least comprise user online behaviors, point use conditions and activity participation conditions; and carrying out point fraud early warning, obtaining a user portrait and key features, carrying out reverse reasoning fusion to obtain a risk index of the user, and comparing the risk index with a preset risk threshold.

Description

Technical Field

[0001] The present invention relates to the technical field of data processing and analysis, and specifically provides an integral data analysis method and system based on a cloud platform. Background Art

[0002] With the development of the Internet and the rise of e-commerce, enterprises have started to accumulate a large amount of user transaction and behavior data; with the maturity of big data technology, enterprises can process and analyze massive amounts of user data; initial data analysis was mainly based on simple statistical methods, such as calculating the consumption frequency and average consumption amount of users, to evaluate customer loyalty and value; enterprises can not only better understand user behavior, but also improve user satisfaction and loyalty through precision marketing and personalized recommendations; driven by the wave of the digital economy, as of 2023, the global Internet user scale has exceeded 5.3 billion, and the annual average growth rate of e-commerce transaction volume has continued to remain above 15%; this process has not only given birth to new business formats such as mobile payment and online-offline integrated retail, but also enabled enterprises to accumulate massive multi-dimensional user behavior data - from every click interaction of the mobile APP, to the monitoring data of smart wearable devices in offline shopping malls, to the user UGC content on social media platforms, forming a three-dimensional data asset containing structured transaction records and unstructured behavior characteristics; according to the prediction of the International Data Corporation, the total global data volume will reach 175 ZB in 2025, of which 70% is directly related to enterprise user operations.

[0003] Traditional methods rely on fixed thresholds or simple statistical models (such as mean ± standard deviation) for risk judgment and cannot adapt to dynamically changing integral usage scenarios; for example, the sharp increase in integral consumption during promotional activities is likely to trigger false alarms, while the abnormal behavior of long-term silent accounts is likely to be missed; moreover, integral data is scattered in multi-source heterogeneous systems such as transaction systems, behavior logs, and activity platforms, lacking a unified data access and fusion mechanism, resulting in a single analysis dimension and difficulty in capturing user cross-channel behavior characteristics; existing systems mostly adopt an offline batch processing mode, with a long data update cycle (usually at the hour level), making it difficult to meet the real-time risk control requirements; integral fraud behavior often completes fund transfer within minutes, and the lagged response leads to an enlarged loss; the traditional model has limited ability to quantitatively evaluate abnormal behavior. For example, it only judges risks through a single indicator such as integral consumption speed or frequency, ignoring spatio-temporal correlations (such as a user logging in from multiple devices or cross-regional transactions) and sudden changes in behavior patterns (such as high-net-worth users suddenly redeeming a large number of low-value goods). Summary of the Invention

[0004] (I) Technical Problems to be Solved Aiming at the deficiencies of the prior art, the present invention provides an integral data analysis method and system based on a cloud platform, which solves the problems raised in the background art.

[0005] (2) Technical Solution To achieve the above objectives, the present invention is realized through the following technical solutions: An integral data analysis system based on a cloud platform, comprising: A data collection and preprocessing module, which acquires integral data and preprocesses it; Among them, the integral data at least includes transaction data, behavior data, and activity data; A dynamic association matching module, which performs dynamic association based on transaction data and activity data, calculates the association weight, and uses a dynamic mapping algorithm to obtain the association dimension; A user portrait construction module, which matches the association dimension with the behavior data, obtains and extracts key features from the matching data, assigns labels to each user, and constructs a user portrait; Among them, the key features at least include the user's online behavior, integral usage situation, and activity participation situation; Integral fraud warning, which acquires the user portrait and key features, uses reverse inference fusion to obtain the risk index of the user, compares it with a preset risk threshold, determines whether it is greater than the risk threshold, and determines whether there is a risk in the user's behavior based on the judgment result.

[0006] Further, acquire integral data and preprocess it: Acquire integral data by accessing multi-source data; Deduplicate, verify, and convert the integral data into a standard format.

[0007] Further, perform dynamic association and calculate the association weight: Acquire transaction data and activity data, establish dynamic association, store the dynamic association result in the database, and record the association type, source identifier, and association dimension key value; Based on the amount feature in the transaction data, the business rule priority coefficient in the activity data, and the difference between the event occurrence time and the current time, dynamically calculate the association strength between the transaction and the activity; for each amount feature in the transaction data, assign a preset weight coefficient respectively, and multiply the actual value of each amount feature by its corresponding weight coefficient; accumulate the weight product results of all amount features to obtain the preliminary total weight; according to the time difference between the event occurrence time and the current time, introduce a time decay factor to dynamically decay the preliminary total weight, and combine the priority coefficient of the business activity to adjust the decayed total weight to obtain the dynamic association weight.

[0008] Further, the association dimension: Based on the pre-computed correlation weights, the sliding window aggregation technique is used to dynamically aggregate the weight values at each moment within a set time window; taking the activity cut-off time as a benchmark, the time span of the window is determined, and each moment within the window is traversed in chronological order; for each moment, its corresponding weight value is obtained, and the weight values of all moments within the window are accumulated to obtain the correlation dimension value of the window.

[0009] Further, extract key features: Match the correlation dimension with the behavior data to generate the user behavior trajectory; and extract key features from it to construct the user portrait, and obtain the integral acquisition speed, integral increment, and integral consumption frequency of the user within a specific time period.

[0010] Further, integral acquisition speed: Within the specific time window selected by the user, count all the integral acquisition events that occurred during this time period, accumulate the integral values obtained in each event, and divide the total accumulated integral value by the duration of this time window to obtain the average daily or per-unit-time integral acquisition rate of the user within this time period, quantifying the growth efficiency of the user's integral within a specific cycle.

[0011] Further, integral increment within the time period: Obtain the integral increment within a specific time window, and the formula is: In the formula, is the integral increment; is the set of integral consumption events within the time period; is the integral value of a single integral consumption; Considering integral expiration, the enhanced integral increment is obtained, and the formula is: In the formula, is the enhanced integral increment; E is the set of expired integrals; is the integral value of a single expired integral; r is the current expired integral.

[0012] Further, integral consumption frequency: Within the specific time window selected by the user, count the total number of all integral redemption behaviors that occurred during this time period, obtain the accumulated redemption times, and divide by the duration of this time window to obtain the average daily or per-unit-time integral consumption frequency of the user within this time period, and quantify the activity level of the user's integral usage within a specific cycle, identify abnormal high-frequency redemption behaviors, and perform dynamic risk judgment.

[0013] Further, comprehensively evaluate the user's risk level, calculate its risk index, and the formula is: In the formula, is the comprehensive risk index of the user within the time period , and the larger the index, the higher the risk; n is the total number of amount features; is the spatio-temporal decay weight of the i-th amount feature; is a non-linear anomaly quantization function that amplifies features significantly deviating from the normal mode; is the current observed value of the user for the i-th amount feature (such as "the integral consumption within 1 hour"); is the dynamic standard deviation of the i-th amount feature; Set the risk threshold C according to historical data, calculate the risk index of the user, compare it with the risk threshold C, and determine whether there is a potential integral theft behavior. The determination process is as follows: When the risk index is less than 60% of the risk index C, there is no integral theft risk at this time, and continuous identification is carried out; When the risk index is greater than or equal to 60% of the risk index C and less than the risk index C, there is an integral theft risk at this time; When the risk index is greater than or equal to the risk index C, there is a serious integral theft risk at this time, and the preset risk response process is automatically activated.

[0014] An integral data analysis method based on a cloud platform includes the following steps: Step 1: Obtain integral data and preprocess it; among them, the integral data includes at least transaction data, behavior data, and activity data; Step 2: Based on the transaction data and activity data, perform dynamic association, calculate the association weight in real time, and use the dynamic mapping algorithm to obtain the association dimension; Step 3: Match the association dimension with the behavior data, obtain and extract key features from the matching data, assign labels to each user, and construct a user portrait; among them, the key features include at least the user's online behavior, integral usage situation, and activity participation situation; Step 4: Obtain the user portrait and key features, use reverse inference fusion to obtain the risk index of the user, compare it with the preset risk threshold, and determine whether it is greater than the risk threshold, and determine whether there is a risk in the user's behavior based on the judgment result.

[0015] (III) Beneficial effects The present invention provides an integral data analysis method and system based on a cloud platform, having the following beneficial effects: (1) Through multi-source data dynamic fusion and real-time correlation analysis, the present invention constructs an efficient data processing architecture; the system supports real-time access and standardized processing of transaction data, behavior data, and activity data, eliminates data islands, and forms a unified data pool; the dynamic correlation weight model combines a time decay factor and a business priority coefficient to quantify the correlation strength between transactions and activities in real time, significantly improving the sensitivity and accuracy of abnormal behavior recognition.

[0016] (2) The present invention innovatively designs a real-time risk warning and self-adaptive user portrait system, realizing dynamic risk prevention and control and precise business empowerment; based on sliding window aggregation, a three-level risk response mechanism (low-risk warning → manual review → high-risk account freezing) is constructed, combined with multi-factor authentication such as dynamic verification codes and biometric recognition, to achieve minute-level risk interception; at the same time, the user portrait system uses a spatio-temporal decay feature update mechanism to calculate dynamic indicators such as the speed of obtaining points and enhanced point increments in real time, improving the recognition accuracy of high-value users. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 It is a schematic diagram of the system flow of the present invention; Figure 2 It is a schematic diagram of the overall method of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0018] Next, the technical solutions in the embodiments of the present invention will be clearly and completely described in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

[0019] Embodiment 1: Please refer to Figure 1 , this embodiment provides an integral data analysis system based on a cloud platform, and the detection system includes: A data collection and preprocessing module, which acquires integral data, including transaction data, behavior data, and activity data, and stores it in a cloud database after preprocessing, and stores the integral data in layers; Acquire integral data: By accessing multi-source data, integrate the integral data from the APP, POS terminals, and third-party APIs (such as WeChat Pay and Alipay) in the multi-source data; the enterprise needs to apply for API access rights to the platform, reach a commercial cooperation agreement with the third-party service provider, clarify the rights and obligations of both parties, especially regarding how to use the data specifications; APP: Obtain users' transaction information, behavioral data, etc. from mobile applications in real time or regularly through SDK or API; POS terminals: Connect to the merchant's point-of-sale system and obtain sales records and customers' integral usage through interfaces or file transfer; Third-party APIs: Such as WeChat Pay, Alipay, etc., obtain users' payment records, integral changes, etc. through the open API interfaces provided by the official Transaction data: All relevant information generated when users purchase goods or services; This type of data is mainly used to analyze users' consumption habits, preferences, and evaluate the effectiveness of the integral program Behavioral data: Operation records generated when users use various channels provided by the enterprise (such as websites, mobile applications, offline stores, etc.), to deeply understand users' behavior patterns and interests Activity data: Relevant information of users' participation in various marketing activities or interactive events organized by the enterprise, to evaluate the activity effect and adjust strategies The preprocessing process is as follows: Due to the diverse sources of integral data, for duplicate integral data entries, perform deduplication, conduct integral data verification, check consistency and accuracy, correct errors, and convert them into a unified standard format for subsequent processing and analysis Deduplication: Generate a unique hash value (such as MD5) for each integral data entry. The combined fields include: User ID + Transaction timestamp (accurate to milliseconds) + Integral change value + Source platform code For example: User123_20250101123045000_+100_PlatformA → The MD5 hash is a1b2c3d4... Set a Bloom filter in the data access layer (such as Kafka message queue) to intercept duplicate hash values; Perform periodic scans on the stored integral data, and use SQL window functions to mark and delete duplicates Integral data verification includes basic logic verification and business rule verification Basic logic verification: The single integral change value needs to be within the preset range (such as -1000 ≤Δ≤ 10000); The transaction time cannot be later than the current system time and must conform to the business cycle (such as the integral validity period of an e-commerce platform ≤ 2 years) Business rule verification: Only allow legitimate sources such as consumption and activity rewards; The order ID needs to be associated (such as binding an order when redeeming goods with points); Verify whether the user account is valid (such as not being cancelled or frozen by risk control) Correct errors: Error types include inconsistent formats, numerical anomalies, duplicate records, and missing values; For example, date formats may have multiple representations (such as YYYY-MM-DD, MM / DD / YYYY), which need to be unified; the consumption amount in the record is negative or abnormally high, which may be an input error; the same event is recorded multiple times on multiple platforms and needs to be deduplicated; for example, when a user shops on platform A and pays through payment software B, and at the same time obtains points rewards from both platforms A and B, deduplication processing is required at this time; complete through associated data; repair using regular expressions. For example, query the registration time according to the user ID to complete the user_register_date field, and unify 2023-10-01 12:30 to 20231001T123000Z); Convert to a unified standard format: Select a unified date and time format through definition, such as YYYY-MM-DD HH:MM:SS; all data related to amounts should be converted to the same currency unit and retain the same number of decimal places; ensure that all text data uses the same character encoding (such as UTF-8) to avoid garbled problems; define unified names and meanings for each field to facilitate subsequent data processing and analysis; at the same time, perform logical verification on the data based on business rules. For example, the transaction amount cannot be negative, and the user's age must be within a reasonable range, etc.; for complex or uncertain data problems, manual intervention is required for review and correction; Points data is stored in layers, including the real-time access layer, the near-line storage layer, and the archive storage layer; Real-time access layer: Record real-time points changes with high frequency access (such as data in the last 7 days), the user's current points balance; Near-line storage layer: Historical points details in the last 3 months, user label data; Archive storage layer: Archived data over 3 months old, log backups; Among them, the triggering conditions are: Time threshold: Points data within 7 days is stored in the real-time access layer; when the points data exceeds 7 days and there is no read operation within 30 days, the points data is stored in the near-line storage layer; when the points data has no read operation for 30 consecutive days, it is stored in the archive storage layer; Dynamic association matching module, based on transaction data and activity data, performs dynamic association, calculates the association weight in real time, and uses the dynamic mapping algorithm to obtain the association dimension; Dynamic association: By obtaining transaction data and activity data and corresponding them one by one, establish a unified dynamic association, store it in the database, and record the association type, source identifier, and association dimension key value; Association type: Set the association type, such as transaction - activity; set the primary key group (e.g., user ID + order number to identify the transaction entity) and the association key group (e.g., activity code + user ID to identify the associated activity); For example, during the "Double 11 Promotion" on a certain e - commerce platform, user A (ID: 10001) completed the following actions: logged in to the App, browsed 3C digital products (mobile phones, headphones); placed an order to buy a flagship mobile phone of a certain brand, generating a corresponding order number; shared the activity page to the WeChat Moments and obtained corresponding points; Source table identifier: Used to distinguish different data sources such as transaction tables and activity tables; Association dimension key values: User ID, order number, activity code, etc.; Create a dynamic association detail table, with fields including: Association weight: Obtain transaction data and activity data, establish a dynamic association, store the dynamic association results in the database, and record the association type, source identifier, and association dimension key values; Based on the amount feature in the transaction data, the business rule priority coefficient in the activity data, and the difference between the event occurrence time and the current time, dynamically calculate the association strength between the transaction and the activity; for each amount feature in the transaction data, assign a preset weight coefficient respectively, and multiply the actual value of each amount feature by its corresponding weight coefficient; accumulate the weight product results of all amount features to obtain the preliminary total weight; according to the time difference between the event occurrence time and the current time, introduce a time decay factor to dynamically decay the preliminary total weight, and combine the priority coefficient of the business activity to adjust the decayed total weight to obtain the dynamic association weight. The formula is: Among them, W is the final association weight, used to measure the association strength; is the weight coefficient of the i - th amount feature, defined by rule configuration; is the value of the i - th amount feature; n is the total number of amount features; is the time decay factor (e.g., = 0.1 means a 10% decay per day); is the time difference between the event occurrence time and the current time (in days); is the business activity priority coefficient (e.g., promotion activity priority = 1.2, ordinary activity = 1.0); For example: If the order amount is 5999 yuan, the activity threshold is 5000 yuan, the discount amount is 300 yuan, the time difference Δt = 0 (the same day), β = 1.2: the final association weight is 431.86; Associated Dimension: Based on the pre-computed association weights, the sliding window aggregation technique is used to dynamically aggregate the weight values at each moment within a set time window; taking the activity deadline as the benchmark, the time span of the window is determined, and each moment within the window is traversed in chronological order; for each moment, its corresponding weight value is obtained, and the weight values of all moments within the window are accumulated to obtain the associated dimension value of the window. The formula for obtaining the associated dimension is: In the formula, Dv is the associated dimension; T is the activity deadline; k is the window size (e.g., 5 minutes); t is the moment; is the weight at the t-th moment within the window; The user profile construction module matches the associated dimension with the behavior data to obtain the matching data, extracts the key features from the matching data, assigns labels to each user, and constructs the user profile; and regularly updates the user profile to reflect the latest changes in user behavior; among them, the key features include user online behavior, integral usage, and participation in activities; Matching Data: Match the associated dimension with the behavior data, associate the behavior data according to the user ID and identifier, generate a complete user behavior trajectory, and identify the key variables that can reflect the user's interests and behavior patterns; User online behavior: access frequency, stay time, and preferred content, etc.; Integral usage: integral acquisition speed, consumption frequency, preferred redeemed goods or services, etc.; Participation in activities: enthusiasm for participating in activities, preferred activity types, etc.; Extract Key Features: Extract the key features from the matched integral data for constructing the user profile; integrate the data from different channels to ensure that the behavior trajectory of each user can be presented completely, map the user ID to ensure that all data contains the user ID and use it as the main association field, and for data with time attributes, such as transaction records and browsing records, align the timestamps to accurately reflect the user's real-time behavior; The integral acquisition speed of the user within a specific time period, calculate the integral increment of the user within a specific time window, as well as the integral consumption frequency, count the time interval between each integral redemption of the user, count the categories of goods redeemed by the user, and calculate the redemption frequency of each category, which reflects the user's interest and participation in promotional activities; Integral Acquisition Speed: Within a specific time window selected by the user, count all the integral acquisition events that occurred during this time period, and accumulate the integral values obtained in each event. Subsequently, divide the total accumulated integral value by the duration of this time window (in days, hours, etc.) to obtain the average daily or per-unit-time integral acquisition rate of the user during this time period; this indicator is used to quantify the growth efficiency of the user's integral within a specific period, providing a basis for dynamic behavior characteristics for subsequent risk analysis and user profiling. The integral acquisition speed of the user within a specific time window is calculated by the formula: In the formula, is the integral acquisition speed; is the time period for all integral acquisition event sets; and are two different time periods respectively, and > ≥0; is the integral value obtained in a single time; f is the current integral acquisition event; For example: If the user accumulates 1500 points in 7 days, then the integral acquisition speed is 1500 points divided by 7 days. That is, when the user obtains 1500 points in 7 days → ( = 1500 / 7 ≈ 214.3) points / day; Integral increment within a time period: To obtain the integral increment within a specific time window, the formula is: In the formula, is the integral increment; is the set of integral consumption events within the time period; is the integral value consumed in a single integral consumption; Considering integral expiration, the enhanced integral increment is obtained by the formula: In the formula, is the enhanced integral increment; E is the set of expired integrals; is the integral value of a single expired integral; r is the current expired integral; Integral consumption frequency: Within a specific time window selected by the user, count the total number of all points redemption behaviors that occurred during this time period. Subsequently, divide the accumulated number of redemptions by the duration of this time window (in units such as days, weeks, etc.) to obtain the average daily or per-unit-time points consumption frequency of the user within this time period. For example, if a user has accumulated 15 points redemptions within 30 days, then the points consumption frequency is 15 times divided by 30 days, approximately equal to 0.5 times per day. This indicator is used to quantify the activity level of a user's points usage within a specific period, provide a basis for dynamic risk judgment to identify abnormally high-frequency redemption behaviors (such as intensive redemptions within a short period), and support the refined construction of user portraits; among them, the speed of points redemption behavior within a specific time window, the formula is: In the formula, is the points consumption frequency, times / week; A real-time example of Flink code for sliding window calculation is as follows: ```python Count the number of redemptions in the past 30 days SELECT user_id, COUNT() / 30.0 AS redemption_freq FROM redemption_events WHERE event_time BETWEEN NOW() - INTERVAL '30' DAY AND NOW() GROUP BY user_id ``` Assign labels: Based on the extracted key features, build a unique user portrait for each user, and assign multiple labels to them according to their behavioral characteristics, such as "high-frequency consumer", "loyal member", "discount-sensitive", etc., in order to quickly identify user types; Build user portraits: By integrating data from the APP, website, POS system, and third-party payment platforms, covering the user's basic information, transaction records, browsing behaviors, etc.; cleaning duplicate and error data, filling in missing values, standardizing date and currency formats; associating all data by user ID to form a complete behavioral track for each user; calculating access frequency, stay time, and preferred content; analyzing the points acquisition speed, consumption frequency, and points preferences; counting participation frequency, preferred activity types, and interaction behaviors; creating portraits for each user based on the extracted features and assigning corresponding labels; For example: An e-commerce platform constructs user portraits based on users' behavioral data and assigns tags to each user, such as "high-value customer", "price-sensitive", etc.; establishes an automated process to regularly refresh user portraits to ensure they reflect the latest changes in user behavior; Integral fraud warning: Obtain the user portrait and key features, and use reverse reasoning fusion to obtain the user's risk index. Compare it with the preset risk threshold to determine whether it is greater than the risk threshold; Based on the known normal behavior patterns and abnormal behavior patterns, reverse-derive whether the current user behavior is abnormal; Based on historical data, define normal user behavior patterns, the normal integral acquisition speed, consumption frequency, and preferred content. Normal integral acquisition speed: The average integral obtained per day is within a reasonable range; Normal integral consumption frequency: The average time interval between each integral redemption is within a reasonable range; Normal preferred content: The categories of goods that users usually browse and purchase are relatively fixed; To comprehensively evaluate the user's risk level, calculate its risk index. The formula is: In the formula, is the comprehensive risk index of the user within the time period , the larger the index, the higher the risk; n is the total number of amount features; is the spatio-temporal attenuation weight of the i-th amount feature; is a non-linear anomaly quantization function that amplifies features significantly deviating from the normal pattern; is the current observed value of the user for the i-th amount feature (such as "integral consumption within 1 hour"); is the dynamic standard deviation of the i-th amount feature; Set the risk threshold C according to historical data, calculate the user's risk index, and compare it with the risk threshold C to determine whether there is potential integral fraud behavior. The judgment process is as follows: When the risk index is less than 60% of the risk index C, there is no integral fraud risk at this time, and continuous identification is carried out; When the risk index is greater than or equal to 60% of the risk index C and less than the risk index C, there is an integral fraud risk at this time. Further intelligent warning and manual research and judgment are carried out, and structured warning information is pushed to the risk control center platform synchronously, triggering the AI-assisted research and judgment process, and marking key decision points for the manual review team, such as "whether it is a misjudgment" and "whether to upgrade the handling"; When the risk index is greater than or equal to the risk index C, there is a serious risk of integral fraud at this time, and it may use system vulnerabilities to carry out attack behaviors. The preset risk response process is automatically activated, and the sensitive operation permissions such as integral redemption, cash withdrawal, and transfer of high-risk accounts are immediately frozen to prevent the abnormal behavior from spreading further. The operation trajectory is recorded through an asynchronous queue for subsequent auditing; a dynamic verification code, biometric identification, or behavior verification (dragging the slider + trajectory analysis) is forcibly pushed to the user's registered device, and the user is required to complete the composite authentication within a limited time; based on the user association graph (such as device, IP, payment method), the sensitive operation permissions of its associated account group are temporarily isolated to block the potential gang crime chain, and at the same time, a parallel risk scan is started for the associated accounts. For example: In an e-commerce platform, user user_123 has the following key features: Integral acquisition speed: The daily integral acquisition speed is 3 times the normal range; Integral consumption frequency: The average time interval between each integral redemption is 1 / 2 of the normal range; Change in preferred content: The category of the last redeemed product does not match the historical preference; Change in geographical location: The last few logins come from different IP addresses; Change in device information: The types of devices used in the last few logins are different. It is hoped to use the above method for integral fraud warning: Data collection and user profiling, collecting the user's transaction records, online behavior data, integral usage, and participation in activities; Building a user profile and extracting key features; Reverse reasoning and fusion, defining normal and abnormal behavior patterns.

[0020] Embodiment 2: Please refer to Figure 2 , based on Embodiment 1, this embodiment also provides a method for integral data analysis based on a cloud platform, including the following specific steps: Step 1: Obtain integral data and preprocess it; among them, the integral data includes at least transaction data, behavior data, and activity data; Step 2: Based on the transaction data and activity data, perform dynamic association, calculate the association weight in real time, and use the dynamic mapping algorithm to obtain the association dimension; Step 3: Match the association dimension with the behavior data, obtain and extract key features from the matching data, assign a label to each user, and build a user profile; among them, the key features include at least the user's online behavior, integral usage, and participation in activities; Step 4: Obtain the user profile and key features, use reverse reasoning and fusion to obtain the risk index of the user, compare it with the preset risk threshold, determine whether it is greater than the risk threshold, and determine whether the user's behavior is risky based on the judgment result.

[0021] The above embodiments can be implemented in whole or in part by software, hardware, firmware, or any combination thereof. When implemented using software, the above embodiments can be implemented in whole or in part in the form of a computer program product. Those of ordinary skill in the art will realize that the units and algorithm steps of the examples described in connection with the embodiments disclosed herein can be implemented in electronic hardware, or in a combination of computer software and electronic hardware. Whether these functions are executed in hardware or software depends on the specific application and design constraints of the technical solution.

[0022] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units. They may be located in one place or distributed to multiple network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0023] As described above, the above are only specific embodiments of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art within the technical scope disclosed in the present application can easily think of changes or substitutions, which should all be covered within the protection scope of the present application.

Claims

1. An integral data analysis system based on a cloud platform, characterized in that: The system includes: A data collection and preprocessing module that acquires integral data and preprocesses it; Among them, the integral data at least includes transaction data, behavior data, and activity data; A dynamic association matching module that performs dynamic association based on transaction data and activity data, calculates the association weight, and uses a dynamic mapping algorithm to obtain the association dimension; A user portrait construction module that matches the association dimension with the behavior data, obtains and extracts key features from the matching data, assigns labels to each user, and constructs a user portrait; Among them, the key features at least include the user's online behavior, integral usage situation, and participation in activities; Integral fraud warning, obtains the user portrait and key features, uses reverse inference fusion to obtain the risk index of the user, compares it with a preset risk threshold, determines whether it is greater than the risk threshold, and determines whether there is a risk in the user's behavior based on the judgment result.

2. The integral data analysis system based on a cloud platform according to claim 1, characterized in that: The process of acquiring integral data and preprocessing it is as follows: Integral data is acquired by accessing multi-source data; The integral data is de-duplicated, verified, and converted into a standard format.

3. The integral data analysis system based on a cloud platform according to claim 1, wherein: The process of performing dynamic association and calculating the association weight is as follows: Acquire transaction data and activity data, establish dynamic association, store the dynamic association result in the database, and record the association type, source identifier, and association dimension key value; Based on the amount feature in the transaction data, the business rule priority coefficient in the activity data, and the difference between the event occurrence time and the current time, dynamically calculate the association strength between the transaction and the activity; for each amount feature in the transaction data, assign a preset weight coefficient respectively, and multiply the actual value of each amount feature by its corresponding weight coefficient; Accumulate the weight product results of all amount features to obtain the preliminary total weight; According to the time difference between the event occurrence time and the current time, introduce a time decay factor to dynamically decay the preliminary total weight, and combine the priority coefficient of the business activity to adjust the decayed total weight to obtain the dynamic association weight.

4. The integrated data analysis system based on a cloud platform according to claim 3, wherein: The association dimension includes: Based on the pre-calculated association weight, adopt a sliding window aggregation technique to dynamically aggregate the weight values at each moment within a set time window; take the activity deadline as the benchmark to determine the time span of the window, and traverse each moment within the window in chronological order; for each moment, obtain its corresponding weight value, and accumulate the weight values of all moments within the window to obtain the association dimension value of this window.

5. The integral data analysis system based on a cloud platform according to claim 1, wherein: The process of extracting key features is as follows: Match the association dimension with the behavior data to generate a user behavior trajectory; and perform key feature extraction on it, construct a user portrait, and obtain the integral acquisition speed, integral increment, and integral consumption frequency of the user within a specific time period.

6. The integral data analysis system based on a cloud platform according to claim 5, wherein: The process of the integral acquisition speed is as follows: Within a specific time window selected by the user, count all integral acquisition events that occurred during this time period, accumulate the integral values obtained in each event, and divide the accumulated total integral value by the duration of this time window to obtain the average daily or per unit time integral acquisition rate of the user within this time period, and quantify the integral growth efficiency of the user within a specific period.

7. The integrated data analysis system based on a cloud platform according to claim 6, wherein: The integral increment within the time period includes: Obtain the integral increment within a specific time window, and the formula is: In the formula, is the integral increment; is the set of integral consumption events within the time period; is the integral value consumed for a single integral consumption; is the integral value obtained for a single time; f is the current integral acquisition event; j represents the integral consumption event; is the time period is the set of all integral acquisition events within; Considering integral expiration, the enhanced integral increment is obtained, and the formula is: In the formula, is the increased integral increment; E is the set of expired integrals; is the integral value of a single expired integral; r is the current expired integral.

8. The integrated data analysis system based on a cloud platform according to claim 7, wherein: The integral consumption frequency process is as follows: Within the specific time window selected by the user, count the total number of all integral redemption behaviors that occurred during this period, obtain the cumulative redemption times, and divide by the duration of this time window to get the average daily or per-unit-time integral consumption frequency of the user within this period, quantify the activity level of the user's integral usage within a specific period, identify abnormally high-frequency redemption behaviors, and perform dynamic risk judgment.

9. The integral data analysis system based on a cloud platform according to claim 8, wherein: The process of obtaining the risk index is as follows: Comprehensively evaluate the user's risk level, calculate its risk index, and the formula is: Wherein, is the comprehensive risk index of the user within the time period ; is the spatio-temporal attenuation weight of the i-th amount feature; is the non-linear anomaly quantization function; is the current observed value of the user for the i-th amount feature; is the dynamic standard deviation of the i-th amount feature; Dv is the associated dimension; is the integral acquisition speed; is the integral consumption frequency; n is the total number of amount features; is the time decay factor; W is the final correlation weight; i is the current amount feature; Set the risk threshold C according to historical data, calculate the user's risk index, compare it with the risk threshold C, and judge whether there is a potential integral theft behavior. The judgment process is as follows: When the risk index is less than 60% of the risk index C, there is no risk of integral theft at this time, and continuous identification is carried out; When the risk index is greater than or equal to 60% of the risk index C and less than the risk index C, there is a risk of integral theft at this time; When the risk index is greater than or equal to the risk index C, there is a serious risk of integral theft at this time, and the preset risk response is automatically activated.

10. An integral data analysis method based on a cloud platform, characterized in that: It includes the following steps: Step 1: Obtain integral data and preprocess it; among them, the integral data includes at least transaction data, behavior data, and activity data; Step 2: Based on the transaction data and activity data, perform dynamic association, calculate the correlation weight in real time, and use the dynamic mapping algorithm to obtain the correlation dimension; Step 3: Match the correlation dimension with the behavior data, obtain and extract key features from the matching data, assign labels to each user, and construct a user portrait; among them, the key features include at least the user's online behavior, integral usage situation, and participation in activities; Step 4: Obtain the user portrait and key features, use reverse reasoning fusion to obtain the user's risk index, compare it with the preset risk threshold, and judge whether it is greater than the risk threshold. Based on the judgment result, determine whether the user's behavior is risky.

Images