Method and system for analyzing brush-up behavior

Abstract

This invention belongs to the fields of e-commerce, data analysis, and platform monitoring technology. It proposes a method and system for analyzing fraudulent order behavior. Specifically, it involves: deploying a customer service interaction collection and unified coding scenario to identify merchant codes; collecting adjacent response time interval sequences and customer service response field sequences for each merchant based on their codes; obtaining rhythmic indicators based on the adjacent response time interval sequences and process transition indicators based on the customer service response field sequences; and finally obtaining the homogeneous product of fraudulent order behavior through the rhythmic and process transition indicators. The homogeneous product of fraudulent order behavior is then used to determine whether a merchant is engaging in fraudulent order behavior. This invention combines the characteristics of human service—affected by information retrieval and input delays, resulting in discrete, multi-peaked rhythms and multi-path processes—with the stable, homogeneous form of scripted rhythm convergence and path reuse. At the merchant level, it achieves the quantification of differences between normal customer service and scripted group control behavior for fraudulent orders, improving merchant management efficiency.

Description

Technical Field

[0001] This invention belongs to the fields of e-commerce, data analysis, and platform supervision technology, and specifically relates to a method and system for analyzing fraudulent order behavior. Background Technology

[0002] In e-commerce platforms, "brushing" (or "fake orders") typically refers to the act of artificially inflating sales or reviews to gain search ranking weight by fabricating or organizing non-genuine transactions, such as using unusual discounts to induce bulk orders, using multiple accounts to leave mutual reviews, or implementing a closed-loop refund system. Merchants engaging in brushing can systematically pollute key platform metrics and product data management, mislead recommendation and pricing strategies for different product categories, increase resource misallocation risks, and ultimately harm consumers' right to know and their rights. It is a platform cancer that fosters unfair competition. Therefore, accurate and effective identification of brushing behavior is not only crucial for maintaining the platform ecosystem and improving data asset quality but also a vital safeguard for consumer rights. Current mainstream brushing identification methods are mostly based on transaction, payment, logistics, and device profiling. While these methods have matured significantly with the development of e-commerce, they still face bottlenecks in situations where privacy compliance models are limited by organizational restructuring. To address this, a new approach based on customer service interaction evidence for identifying fraudulent transactions has emerged. This approach uses customer service conversations as an entry point, starting with the causal and weakly bound relationships between the conversation and the order. It extracts features from customer service scripts, typically including script templates, knowledge base hits, and response latency. The coupling strength and consistency of each node in the after-sales process are used as core evidence to establish a homogeneous identification model across conversations and buyers. This model is then recursively aligned and cross-verified with transaction and logistics evidence, ultimately aggregating at the merchant level to determine the risk of fraudulent transactions. However, this customer service interaction evidence-based fraudulent transaction identification path faces the technical challenge of aligning heterogeneous multi-source robot templates. This leads to instability and a high false positive rate in the judgment of merchant fraudulent transactions based on customer data. The core reason is that while fraudulent organizations constantly change robots and script templates to avoid text similarity, the frequent changes in scripts and response templates by the human-machine module over time cause non-stationary drift and cross-source fragmentation of semantic and template features, resulting in distortion of cross-conversation consistency measurement and drift in homogeneous clustering. Therefore, there is an urgent need for a method and system based on the analysis of fraudulent order behavior. A recursive parsing mechanism needs to be introduced into the cross-session and cross-day fusion of customer service interaction evidence to improve the interpretability of anomaly consistency and the ability to ensure trustworthy transactions. Summary of the Invention

[0003] The purpose of this invention is to propose a method and system for analyzing fraudulent order behavior, in order to solve one or more technical problems existing in the prior art, and at least provide a beneficial option or create conditions. This invention is geared towards platform-level governance scenarios, serving the risk identification and evidence retention of trusted transactions.

[0004] To achieve the above objectives, according to one aspect of the present invention, a method for analyzing fraudulent order behavior is provided, the method comprising the following steps:

[0005] S100, deploy customer service interaction collection and unified coding scenarios, and identify merchant codes from them;

[0006] S200, based on natural days, collects the sequence of adjacent reply time intervals and customer service reply field sequences for each merchant according to the merchant code;

[0007] S300: Obtains rhythmicity indicators based on the sequence of adjacent response time intervals and process transition indicators based on the sequence of customer service response fields;

[0008] S400 obtains homogeneous volume of fraudulent orders through takt time indicators and process transfer indicators;

[0009] S500 determines whether a merchant is engaging in fraudulent order practices based on the volume of similar orders.

[0010] Furthermore, in step S100, the method for deploying customer service interaction collection and unified coding scenarios and identifying merchant codes is as follows: Customer service session data generated by the platform is accessed and anonymized; sessions and messages are encoded based on the unified resource identifier (URL), and candidate merchant identifiers are extracted from session-side metadata and merchant-side routing information. Merchant codes are determined through a weighted fusion of strong and weak binding signals. Candidate identifiers and hit fields are indexed by CID and MID to create a traceable index, forming an evidence graph for subsequent recursive analysis, providing a foundation for merchant rights confirmation and trusted transaction auditing.

[0011] The strong binding signals include one or more of the following: store ID, store domain name, store routing queue ID, payment channel merchant ID, customer service system tenant ID, explicit orders in the session, and merchant affiliation of after-sales orders.

[0012] Weak binding signals include one or more of the following: knowledge base namespace, store tag of quick script, agent group / shift mapping, marketing short link affiliation, brand registration number, application mini-program original ID, and logistics collection entity.

[0013] Preferably, before weighted fusion of strong and weak binding signals, the fusion confidence of the weak binding signal is first gated based on a preset threshold. When the fusion confidence is lower than the threshold, recursion is performed to backtrack to the historical confirmed session for calibration. Then, the strong and weak binding signals are combined to generate a unique merchant code.

[0014] The access and anonymization of session data refers to the process of accessing sessions through message queues provided by the customer service system, such as Kafk or RabbitMQ. Message and routing log data are standardized into a unified JSON structure using ETL or CDC processes and stored in a data warehouse. Then, fields involving personal information, including buyer ID, mobile phone number, address, device ID, and IP address, are anonymized using HMAC-SHA256 hashing, retaining only necessary metadata such as timestamps, message direction, and field keys used for calculations.

[0015] Encoding sessions and messages based on a unified resource identifier refers to generating a globally unique CID session identifier for each session and a MID message identifier for each message. The identifiers are generated using UUID or Snowflake time-series ID algorithms commonly used in the field. The encoding includes the minimum necessary elements such as platform, tenant, channel, timestamp, and sequence number, which are used as subsequent retrieval and index keys.

[0016] Extracting candidate merchant identifiers from session-side metadata and merchant-side routing information involves reading fields such as store domain name, routing queue ID, agent group, knowledge base namespace, template package tag, merchant number, and order or after-sales document attribution from the routing context. These fields are then used to perform lookups and associations in a pre-maintained mapping table to obtain one or more sets of candidate merchant identifiers. The pre-maintained mapping table is a key-value pair mapping relationship established by the platform based on existing master data and configuration. It is used to quickly map routing fields to merchant IDs, such as routing queue ID, merchant number, and knowledge base namespace, when a session arrives. This table can be stored in a relational database or key-value store and is kept consistent with the platform configuration through scheduled synchronization and hot updates, representing a common implementation of data mapping tables in this field.

[0017] The purpose of extracting candidate merchant identifiers is to effectively associate session-side metadata with merchant IDs. This is because many sessions in the data interaction process lack explicit IDs, such as situations where multiple stores share agent seats. Therefore, it's necessary to infer the merchant to which the conversation belongs based on routing context clues. The core is to archive the candidate merchant set, the matching evidence fields, and the timestamp onto the CID. If a candidate clue originates from a particular message, the clue is recorded along with the corresponding MID. This allows for subsequent fusion, gating, or historical backtracking, enabling the retrieval of all candidates and evidence at the session level, ensuring traceability and verifiability. Once the merchant code is confirmed or at least a high-confidence candidate is formed, the session data indexed by the CID and MID can be correctly archived at the merchant level. This allows S200 to aggregate the corresponding adjacent reply time interval sequence and customer service reply field sequence by day for the shop_id.

[0018] The method of establishing merchant codes through a weighted fusion of strong and weak binding signals means that if a strong binding signal matches successfully, it is directly confirmed as the target merchant code. If a strong binding signal is missing or conflicts exist, the weak binding signals are weighted and averaged to obtain a comprehensive support score. If the comprehensive support score exceeds a preset threshold, the corresponding merchant code is determined. Each merchant code has a one-to-one correspondence with each merchant registered on the platform.

[0019] The goal is to ensure that the CID and MID indexes accurately and directly point to the corresponding merchants. Strong and weak signals are used only for merchant differentiation, not for buyer identification, ensuring that buyer-related fields remain anonymized and meet privacy and compliance requirements.

[0020] Further, in step S200, the method for collecting the adjacent reply time interval sequence and customer service reply field sequence of each merchant based on the merchant code, using natural days as the unit, is as follows: any merchant code corresponds to one merchant, and the set of adjacent time differences obtained after sorting all customer service messages of the merchant on that day by time is the adjacent reply time interval sequence; the sequence of occurrence of the original reply field key name or key-value pair recorded in each round of replies of the merchant on that day is the customer service reply field sequence; each merchant obtains several adjacent reply time interval sequences and customer service reply field sequences on each natural day;

[0021] The adjacent time difference set is recorded in the order of message timestamps. It sorts the outbound messages generated by the merchant on the same day and calculates the time difference between two adjacent outbound messages within the same session. It is for any CID session identifier, so that each CID obtains the corresponding time difference sequence.

[0022] The customer service response field sequence is also recorded in message timestamp order. Outbound messages generated by the merchant on the same day are sorted, and within the same CID session identifier, the original response fields are extracted sequentially from the payload of each outbound message. Field key names are primary, and key-value entries are secondary. If only a template ID or message category identifier is available, that identifier is used instead. Fields are recorded in order of appearance to form the response field sequence corresponding to that CID. To reduce interference caused by mechanical duplication and omissions, preset rules are adopted: First, consecutive identical fields are only retained once to suppress duplication; second, when a message is missing a field key name, its template ID or message category identifier is used to fill the gap; third, each field entry is associated with its source MID message identifier to ensure traceability. This ensures that each CID obtains a field sequence corresponding to its outbound response process.

[0023] The core objective of this step is to extract the homogenization trend evaluation input variables for fraudulent order behavior. These two variables, belonging to the merchant side, are used to calculate the suspicion level of fraudulent orders and make a judgment. While it's easy for organizations to change their scripts, creating a significant bottleneck in user-side fraudulent order identification, the uniformity of the merchant's response rhythm and the homogenization of macro-process transfers stem from unified scheduling and process control. These two points, when occurring simultaneously across sessions and agents, have extremely strong distinguishability. Furthermore, considering that fraudulent orders often aim for a large accumulation of orders within a short period, the similar rhythms and identical field flow paths in a large number of sessions within the same day will also show significant differences from the normal customer service environment. A further advantage is that the statistical object is selected from merchant group behavior rather than buyers, which helps to ensure that the fraudulent order identification process remains unaffected even if buyers are anonymous or anonymized. The adjacent response time interval sequence and the customer service response field sequence serve as the smallest unit of evidence, supporting recursive parsing in cross-session aggregation and cross-day comparison to stably support the data consistency verification required for credible transactions.

[0024] Further, in step S300, the method for obtaining the beat index based on the adjacent reply time interval sequence is as follows: each adjacent reply time interval sequence of the same natural day is statistically analyzed by fixed binning, and the statistical value obtained from each binning is the beat value. The ratio of the maximum beat value to the sum of all beat values ​​is the beat concentration. Using the number of conversation messages as the weight, the weighted average of the beat concentration corresponding to all conversations is calculated and recorded as the beat index.

[0025] Preprocessing of the adjacent response time interval sequence requires excluding elements smaller than the minimum response jitter threshold and excluding extremely short intervals in the sequence below this threshold, i.e., excluding automatic receipts and non-interested information such as heartbeats.

[0026] The default bin widths for fixed bin statistics are 0–5s, 5–15s, 15–30s, 30–60s, 1–2min, 2–5min, and >5min. Alternatively, equidistant bins can be used, such as a bin every 20s. For each CID session identifier, its daily interval samples are normalized according to the above bin statistics frequency to obtain the session-level interval distribution. Fixed bin statistics ensure that each element in the adjacent reply time interval sequence is assigned to a unique bin. The maximum beat value refers to the maximum beat value among all bins corresponding to the same session. Therefore, the larger the derived beat concentration value, the more concentrated the reply rhythm. The session message volume can be the length of the adjacent reply time interval sequence or the number of outbound messages.

[0027] The tempo metric aims to test the concentration of customer service response rhythm on the merchant side. Its background is that robots or organized semi-automated agents are often triggered by unified scheduling, resulting in fixed or quasi-fixed response intervals. This significantly increases the proportion of the highest-frequency segment, thereby raising the tempo metric. Conversely, normal customer service responses depend on factors such as the complexity of the question, the time spent querying the system, and the input time, resulting in naturally multi-peaked or widely distributed intervals, making it difficult to achieve a high proportion in a single segment, thus leading to a lower tempo metric. The time-period aggregation results of conversation-level tempo concentration can be recursively analyzed in conjunction with historical data from the same period to eliminate interference from operational impulses in reliable transaction judgment.

[0028] Further, in step S300, the method for obtaining the process transfer index based on the customer service response field sequence is as follows: For any customer service response field, map it to a field state according to its field key name or key value entry. If any field state is different from its previous field state, then they are grouped into a pair in chronological order and recorded as a transfer pair. Count the number of occurrences of different transfer pairs in all sessions and normalize them to obtain a reference transfer distribution. Count the number of occurrences of different transfer pairs in any session and normalize them to obtain a session transfer distribution. If the session transfer distribution value of any transfer pair in the session transfer distribution is greater than the corresponding reference transfer distribution value in the reference transfer distribution, then replace the session transfer distribution value with the reference transfer distribution value. Record the sum of the session transfer distribution values ​​in the session as the session-level overlap rate. Using the session message volume as the weight, calculate the weighted average of the session-level overlap rates corresponding to all sessions and record it as the process transfer index.

[0029] The mapping of field key names and key-value entries to field states is achieved either by looking up the field key names or key-value enumerations in a dictionary table to map them to the corresponding field states, or by using a regular expression rule library to perform pattern matching on the key names and key-value entries, mapping a matched entry to a preset field state. Field states are preset status labels.

[0030] When the field key name is not missing, the field key name is used for mapping first; if it is missing, the key value entry is used for mapping.

[0031] The reference transition distribution is a normalized sequence of percentage values ​​for the frequency of different transition pairs. Each percentage value corresponds to a transition pair. The reference transition distribution value represents the percentage value corresponding to any transition pair in the reference transition distribution. The session transition distribution is similar.

[0032] The process transition metric reflects the homogeneity of the merchant's customer service dialogue process. It detects the degree to which different sessions repeatedly run along the same field status transition path. If the merchant uses a unified scripted process, transition pairs will appear frequently and proportionally in a large number of sessions, making the session transition distribution highly overlap with the merchant's reference transition distribution for the day. Therefore, the higher the session-level overlap rate, the higher the degree to which the session follows the main process of the day. Combining this with a weighted average of session message volume yields a merchant-level process transition metric, with higher values ​​indicating a more convergent and homogeneous overall process for the day. The overlap between the reference transition distribution and the session transition distribution can be recursively analyzed across days within the monitoring window to enhance the measurement of the consistency of trusted transaction processes.

[0033] Furthermore, in step S400, the method for obtaining the homogeneous volume of fraudulent orders through the cycle time index and process transfer index is as follows:

[0034] Let a time period be defined as the monitoring period PETH, PETH∈[28,56] natural days; for any natural day, the taktivity index and process transfer index of each merchant are Z-score standardized and recorded as taktivity Z-score score and process transfer Z-score score, respectively.

[0035] Z-score standardization is equivalent to measuring the degree of outlier of a single merchant relative to the group baseline under the same environmental and disturbance conditions on that day. Its fitting scenario is that normal customer service behavior is dominated by endogenous random factors such as human-machine response and input time, and its daily distribution is approximately stable according to the law of large numbers. However, scripts or group control are driven by a unified scheduling clock and finite process control, often resulting in systematic shifts in both the beat and process dimensions. Therefore, the large Z-value after standardization is not simply a difference in dimensions but an amplified representation of the abrupt change in mechanism from endogenous randomness to exogenous control. Furthermore, after threshold standardization, the two heterogeneous signals of beat rate and process transition can be identified as anomalies deviating from the norm within the same scoring model.

[0036] For any merchant, the average of all peak values ​​of the beat rate Z-score during the monitoring period is recorded as the mean of the beat rate index, and the maximum value of the process transfer Z-score is recorded as the extreme value of the transfer index.

[0037] For any merchant, calculate the ratio of the number of natural days with a tempo Z-score and a process transition Z-score greater than 3 to the total number of natural days during the monitoring period. Record these ratios as the first anomaly rate and the second anomaly rate, respectively. Record the medians of the first and second anomaly rates historically as the first anomaly median and the second anomaly median, respectively. Setting a threshold of 3 is a commonly used empirical rule in statistics, indicating the presence of significant outliers. The percentage of days exceeding the threshold is then used as the anomaly rate, effectively distinguishing between occasional noise and persistent mechanistic shifts. The principle is that the proportion of occasional peaks within the monitoring period... The rate is usually very low, but continuous scripted operation can easily form a stable high proportion; subsequently, the historical median is used as a robust baseline, and the judgment is required that both the takt rate and the process anomaly rate exceed their respective medians, thereby reducing false alarms caused by single-dimensional disturbances such as peak traffic or temporary adjustments to customer service SOPs; for any merchant, if its first anomaly rate is greater than the first anomaly median and its second anomaly rate is greater than the second anomaly median, then the merchant is recorded as a high-risk merchant; for any high-risk merchant, the standard deviation of all changes in the process transfer Z-score scores of two adjacent natural days is recorded as the process transfer variability;

[0038] For any non-high-risk merchant, the homogeneous volume of their fraudulent orders is the average value of the takt rate index; for any high-risk merchant, the homogeneous volume of their fraudulent orders is the sum of the product of the extreme value of the transfer index and the variability of the process transfer, and the average value of the takt rate index.

[0039] The abnormal pulses and continuous drifts of the two denoised sequences, beat and process, are recursively analyzed across days to distinguish one-time peaks from stable scripted signals, thereby improving the reliability of homogeneous integrals for trusted transactions.

[0040] Since the aforementioned process transition variability is obtained based on the takt time Z-score and the process transition Z-score, Z-score standardization of the takt time and process transition indicators can effectively eliminate outliers that deviate significantly from the mean. Therefore, the merchant's order-brushing behavior can be characterized based on the takt time Z-score and the process transition Z-score, ultimately evaluating whether the merchant is suspected of order-brushing. However, since relying on Z-score standardization to determine whether a merchant has abnormal behavior cannot fully capture the nonlinear fluctuations in order-brushing behavior, such as sudden increases or abnormal patterns in a short period of time, the theoretical risk deviation value does not match the actual order-brushing behavior, reducing the accuracy of determining order-brushing suspicion. Therefore, it is necessary to further consider the influencing factors of nonlinear fluctuations. In order to improve the robustness and accuracy of the determination, this invention proposes a better solution.

[0041] Furthermore, in step S400, the method for obtaining the homogeneous volume of fraudulent orders through the cycle time index and process transfer index is as follows:

[0042] Let a time period be defined as the monitoring period PETH, where PETH ∈ [28, 56] natural days. For any merchant, let all beat-related indicators and process transition indicators constitute the beat time series and process time series, respectively. Let the 5th percentile of the beat time series and process time series be defined as the beat jitter threshold and process response threshold, respectively. The 5th percentile refers to the value at which 5% of the observations, arranged from smallest to largest, do not exceed its value.

[0043] The calculation principle for the beat jitter threshold and process response threshold is as follows: the extremely short intervals in the customer service link are mostly generated by system-level automatic events, usually automatic receipts and heartbeat detection. The mechanism is near-zero waiting time triggered by machines rather than decision delays in human-computer interaction. Therefore, using the 5th percentile as the lower threshold is equivalent to retaining 95% of the core samples that can reflect human or semi-automatic decisions under the same conditions on the same day, eliminating short-beat noise that is physically impossible to be generated by continuous human input, and establishing a clean baseline for the comparability and joint discrimination of the two subsequent indicators.

[0044] After removing beat-related indicators from the beat time series that are below the beat-related jitter threshold and process transfer indicators from the process time series that are below the process response threshold, an autoregressive integral moving average time series model is used to fit the updated two time series to generate first-order predicted values. The corresponding first-order predicted value residual value sequences are obtained for the two time series. Here, the autoregressive integral moving average time series model is the tsa.arima.model.ARIMA() function in the statsmodels library in Python.

[0045] The application of the autoregressive integral moving average time series model effectively distinguishes between the slow-changing trends driven by stable work rhythms and platform activities within the day and week, and the slow-changing trends caused by script-induced rhythm locking and process skeleton convergence, which are mechanistic slow-changing trends brought about by exogenous control. The purpose is to avoid misjudging regular peaks caused by promotions as fraudulent orders.

[0046] The residual values ​​for both time series are calculated by subtracting the predicted values ​​from the actual values, thus obtaining residual value sequences for the first time for each time series. The residual sequences are then smoothed using a Kalman filter (implemented via the `smooth()` function of the `kalman` library in Python), resulting in a second residual value sequence. The time series obtained by adding the first-order predicted values ​​for each day within the two time series to the new residual values ​​are denoted as the beat denoising sequence and the process denoising sequence, respectively.

[0047] The calculation principle of the beat denoising sequence and the process denoising sequence is as follows: Kalman filtering helps to achieve the optimal estimation in the state space. It retains the interpretable continuous deviation in the trade-off between process noise and observation noise. Then, it is recombined with the first-order prediction to obtain the beat denoising sequence and the process denoising sequence. This is equivalent to splitting the time series into the predictable part that meets the prediction and the abnormal part that exceeds the prediction, and integrating them into a signal that can be directly used for discrimination. This makes the subsequent judgment both faithfully reflect the real deviation and do not over-respond to the instantaneous disturbance, thus improving the detection capability and accuracy of scripted continuous operation.

[0048] For any merchant, the median of the denoised beat sequence is denoted as the adaptive beat median; the adaptive beat median and standard deviation of all merchants are denoted as the platform beat median and platform beat variability, respectively; for any merchant, the absolute value of the quotient of the difference between its adaptive beat median and the platform beat median and the platform beat variability is denoted as the heterogeneous fluctuation value.

[0049] Since different categories and agent allocations determine the endogenous median level of each merchant's normal operating rhythm, while the overall platform load on the same day brings exogenous resonance, it is necessary to first characterize the individual steady state using the denoised median of each merchant, and then construct the group steady state using the median and standard deviation of all merchants on the platform. These two forms a dual baseline of individual and group. The difference between the merchant's and the platform's baselines is standardized according to the platform's variability to obtain heterogeneous fluctuation values, which quantifies whether the merchant's value is still abnormally high under the current exogenous environment. Decoupling the perturbation between individual heterogeneity and global commonality can, on the data level, avoid the overall upward shift of static thresholds during high concurrency, which would cause false alarms, and also identify merchants that are still outliers in the context of a general increase in platform prices, providing a mathematical basis for robust comparisons across categories and periods.

[0050] If the percentage of values ​​in a merchant's denoised beat sequence that are greater than the sum of its adaptive beat median and heterogeneous fluctuation value exceeds 75%, then the merchant is considered a high-risk merchant.

[0051] Using the proportion of days with values ​​above the adaptive median and heterogeneous fluctuations exceeding the upper quartile as a high-risk threshold, the emphasis is on the prevalence of significantly higher values ​​on most days rather than occasional spikes. This is to align with the natural law of scripted operations pursuing continuous output. For high-risk merchants, beat denoising and process denoising are Z-normalized and jointly isolated in two-dimensional space using Isolation Forest. Mathematically, this allows for the identification of outliers simultaneously occurring in both beat and process—two orthogonal physical quantities—through random segmentation, thus identifying the coupling anomalies between the unified clock and the unified process during morning readings. This is to subsequently add the fused anomaly score as a multiplicative amplification term to the adaptive beat median, reflecting a fit where consistently high beats are the primary reference, and coupling anomaly triggering amplification is a secondary reference.

[0052] For any high-risk merchant, the values ​​of both the beat denoising sequence and the process denoising sequence are Z-score standardized to form a two-dimensional feature vector. The Isolation Forest anomaly detection algorithm is used to construct a random forest to separate outliers in the two-dimensional feature vector, and the fused anomaly score corresponding to the two-dimensional feature vector is output. The Isolation Forest anomaly detection algorithm is implemented using the IsolationForest() function in the scikit-learn library in Python. It does not require assumptions about the data distribution, has low computational complexity, can efficiently isolate anomalies, and captures synchronous anomalies between order and response rhythm through random subspace segmentation.

[0053] For any non-high-risk merchant, the homogeneous amount of their fraudulent orders is the adaptive beat median; for any high-risk merchant, the homogeneous amount of their fraudulent orders is the adaptive beat median × (1 + fusion anomaly score).

[0054] Beneficial effects: By constructing a daily time series for merchants using rhythm and process as the two smallest verifiable signals, this method effectively quantifies the risk of abnormal convergence issues in the response rhythm and process transfer in the customer service interaction chain when e-commerce platforms are operating in a high-concurrency environment with rapidly changing copywriting. It reduces the shortcomings of relying solely on content analysis techniques such as text similarity and keyword hits, which are easily circumvented by synonym rewriting. This provides a valid mathematical basis for further identifying continuous scripted operations on the merchant side, greatly improving the ability to identify group-controlled bursts within a short window, cross-session, and cross-agent synchronous surges. Ultimately, this results in better robustness and fault tolerance in the merchant-level order-brushing judgment results.

[0055] Further, in step S500, the method for determining whether a merchant has engaged in fraudulent order activity based on the homogeneous volume of fraudulent orders is as follows: the upper quartile value of the homogeneous volume of fraudulent orders for each merchant in a natural day is the basic threshold value of the volume; within the backtesting period, the median value of the basic threshold value of the homogeneous volume of fraudulent orders is the dynamic threshold value of the volume; if the homogeneous volume of fraudulent orders for a merchant in that natural day is greater than both the basic threshold value and the dynamic threshold value, then a homogeneous risk is marked as occurring; when the proportion of homogeneous risk occurrences within the backtesting period exceeds a preset threshold, it is determined that the merchant has engaged in fraudulent order activity, and the merchants determined to have engaged in fraudulent order activity are sent to the administrator client or stored on the server.

[0056] During risk confirmation, the index of key segments obtained from recursive parsing is simultaneously solidified, and a replayable credible transaction risk label is output to support auditing and appeals.

[0057] The backtesting period is set to 2-8 weeks; the preset range for the proportion of homogeneous risks occurring within the backtesting period is 30%-50%.

[0058] Preferably, the basic threshold for accumulated volume is calculated separately by category or business type. That is, within the same natural day, the merchants are grouped by the set of product categories to which they belong, and the upper quartile value of the homogeneous accumulated volume of brushing orders of merchants in each group is calculated as the basic threshold of that group, so as to reduce the impact of cross-category differences.

[0059] When a merchant is determined to have engaged in fraudulent order activity, evidence is collected and indexed, including rhythmic indicators of the homogeneous accumulation of fraudulent orders within a natural day, process transfer indicators, threshold values, a list of session identifiers and MID message identifiers that match CIDs, and corresponding timestamps, for use in post-event audits and appeal reviews.

[0060] Preferably, all undefined variables in this invention, if not explicitly defined, can be manually set thresholds.

[0061] This invention also provides a system for analyzing fraudulent order behavior. The system includes a processor, a memory, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the steps in the fraudulent order behavior analysis method. The system can run on computing devices such as desktop computers, laptops, handheld computers, and cloud data centers. The runnable system may include, but is not limited to, processors, memory, and server clusters. The processor executes the computer program within the following system units:

[0062] The merchant identification unit is used to deploy customer service interaction collection and unified coding scenarios, and to identify merchant codes from them.

[0063] The raw data collection unit is used to collect the sequence of adjacent reply time intervals and the sequence of customer service reply fields for each merchant, based on the merchant code and using natural days as the unit.

[0064] The indicator construction unit is used to obtain rhythmic indicators based on the sequence of adjacent reply time intervals and process transition indicators based on the sequence of customer service reply fields.

[0065] The Homogeneous Analysis Unit for Fake Orders is used to obtain the homogeneous volume of fake orders through rhythm indicators and process transfer indicators.

[0066] The order-brushing behavior judgment unit is used to determine whether a merchant has engaged in order-brushing behavior based on the homogeneous accumulation of orders.

[0067] The beneficial effects of this invention are as follows: This invention provides a method and system for analyzing fraudulent order behavior. It uses customer service rhythm and process as the two smallest verifiable signals as the core of data research. It combines the characteristics of manual service—affected by information retrieval and input delays, resulting in discrete, multi-peaked rhythms and multi-path processes—with scripts and group control constrained by unified scheduling and limited process control, inevitably forming a stable, homogeneous pattern of rhythm convergence and path reuse. This allows for the quantification of differences between normal customer service and scripted group control behavior at the merchant level, thereby significantly improving the ability to identify and warn of short-term bursts and medium-to-long-term latent fraudulent orders. Furthermore, it reduces operational and compliance risks caused by false positives, missed positives, and unverifiable issues resulting from text-based adversarial template variations, device fingerprint drift, and buyer-side anonymization. This provides a reliable reference for platform pricing recommendations and governance strategies, improving merchant management efficiency. Attached Figure Description

[0068] The above and other features of the present invention will become more apparent from the detailed description of the embodiments shown in conjunction with the accompanying drawings. In the accompanying drawings, the same reference numerals denote the same or similar elements. Obviously, the drawings described below are merely some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without any creative effort. In the drawings:

[0069] Figure 1 The flowchart shown is a method for analyzing fraudulent order behavior.

[0070] Figure 2 The diagram shown is a structural diagram of a fraudulent order behavior analysis system. Detailed Implementation

[0071] The following will provide a clear and complete description of the concept, specific structure, and technical effects of the present invention in conjunction with the embodiments and accompanying drawings, so as to fully understand the purpose, solution, and effects of the present invention. It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other.

[0072] like Figure 1 The diagram shown is a flowchart of the method for analyzing fraudulent order behavior. The following section will combine... Figure 1 The present invention describes a method for analyzing fraudulent order behavior according to an embodiment of the present invention, the method comprising the following steps:

[0073] S100, deploy customer service interaction collection and unified coding scenarios, and identify merchant codes from them;

[0074] S200, based on natural days, collects the sequence of adjacent reply time intervals and customer service reply field sequences for each merchant according to the merchant code;

[0075] S300: Obtains rhythmicity indicators based on the sequence of adjacent response time intervals and process transition indicators based on the sequence of customer service response fields;

[0076] S400 obtains homogeneous volume of fraudulent orders through takt time indicators and process transfer indicators;

[0077] S500 determines whether a merchant is engaging in fraudulent order practices based on the volume of similar orders.

[0078] Furthermore, in step S100, the method for arranging customer service interaction collection and unified coding scenarios and identifying merchant codes from them is as follows: the customer service session data generated by the platform is accessed and desensitized; the sessions and messages are encoded based on the unified resource identifier, and candidate merchant identifiers are extracted from the session-side metadata and the merchant-side routing information. The merchant code is determined by weighted fusion of strong binding signals and weak binding signals.

[0079] The strong binding signals include store ID, store domain name, store routing queue ID, payment channel merchant ID, customer service system tenant ID, and the merchant affiliation of explicit orders and after-sales orders within the session;

[0080] Weak binding signals include knowledge base namespace, store tag of quick script, agent group / shift mapping, marketing short link affiliation, brand registration number, original ID of application mini program, and logistics collection entity;

[0081] Preferably, before weighted fusion of strong and weak binding signals, the fusion confidence of the weak binding signal is first gated based on a preset threshold. When the fusion confidence is lower than the threshold, recursion is performed to backtrack to the historical confirmed session for calibration. Then, the strong and weak binding signals are combined to generate a unique merchant code.

[0082] The access and anonymization of session data refers to the process of accessing sessions through message queues provided by the customer service system, such as Kafk or RabbitMQ. Message and routing log data are standardized from heterogeneous fields into a unified JSON structure using ETL or CDC processes and stored in a data warehouse. Fields involving personal information, including buyer ID, phone number, address, device ID, and IP address, are then anonymized using HMAC-SHA256 hashing, retaining only necessary metadata such as timestamps, message direction, and field keys required for calculations.

[0083] Encoding sessions and messages based on a unified resource identifier refers to generating a globally unique CID session identifier for each session and a MID message identifier for each message. The identifiers are generated using UUID or Snowflake time-series ID algorithms commonly used in the field. The encoding includes the minimum necessary elements such as platform, tenant, channel, timestamp, and sequence number, which are used as subsequent retrieval and index keys.

[0084] Extracting candidate merchant identifiers from session-side metadata and merchant-side routing information involves reading the store domain name, routing queue ID, agent group, knowledge base namespace, template package tag, merchant number, and the explicit document attribution field of the order or after-sales order from the routing context. This data is then looked up and associated using a pre-maintained mapping table to obtain multiple sets of candidate merchant identifiers. The pre-maintained mapping table is a key-value pair mapping relationship established by the platform based on existing master data and configuration. It is used to quickly map routing fields to merchant IDs, including the routing queue ID, merchant number, and knowledge base namespace, when a session arrives. This table can be stored in a relational database or key-value store and is kept consistent with the platform configuration through scheduled synchronization and hot updates, representing a common implementation of data mapping tables in this field.

[0085] The method of establishing merchant codes through a weighted fusion of strong and weak binding signals means that if a strong binding signal matches successfully, it is directly confirmed as the target merchant code. If a strong binding signal is missing or conflicts exist, the weak binding signals are weighted and averaged to obtain a comprehensive support score. If the comprehensive support score exceeds a preset threshold, the corresponding merchant code is determined. Each merchant code has a one-to-one correspondence with each merchant registered on the platform.

[0086] Further, in step S200, the method for collecting the adjacent reply time interval sequence and customer service reply field sequence of each merchant based on the merchant code, using natural days as the unit, is as follows: any merchant code corresponds to one merchant, and the set of adjacent time differences obtained after sorting all customer service messages of the merchant on that day by time is the adjacent reply time interval sequence; the sequence of occurrence of the original reply field key name or key-value pair recorded in each round of replies of the merchant on that day is the customer service reply field sequence; each merchant obtains several adjacent reply time interval sequences and customer service reply field sequences on each natural day;

[0087] The adjacent time difference set is recorded in the order of message timestamps. It sorts the outbound messages generated by the merchant on the same day and calculates the time difference between two adjacent outbound messages within the same session. It is for any CID session identifier, so that each CID obtains the corresponding time difference sequence.

[0088] The customer service response field sequence is also recorded in message timestamp order. Outbound messages generated by the merchant on the same day are sorted, and within the same CID session identifier, the original response fields are extracted sequentially from the payload of each outbound message. Field key names are primary, and key-value entries are secondary. If only a template ID or message category identifier is available, that identifier is used instead. Fields are recorded in order of appearance to form the response field sequence corresponding to that CID. To reduce interference caused by mechanical duplication and omissions, preset rules are adopted: First, consecutive identical fields are only retained once to suppress duplication; second, when a message is missing a field key name, its template ID or message category identifier is used to fill the gap; third, each field entry is associated with its source MID message identifier to ensure traceability. This ensures that each CID obtains a field sequence corresponding to its outbound response process.

[0089] Further, in step S300, the method for obtaining the beat index based on the adjacent reply time interval sequence is as follows: each adjacent reply time interval sequence of the same natural day is statistically analyzed by fixed binning, and the statistical value obtained from each binning is the beat value. The ratio of the maximum beat value to the sum of all beat values ​​is the beat concentration. Using the number of conversation messages as the weight, the weighted average of the beat concentration corresponding to all conversations is calculated and recorded as the beat index.

[0090] Preprocessing of the adjacent response time interval sequence requires excluding elements smaller than the minimum response jitter threshold and excluding extremely short intervals in the sequence below this threshold, i.e., excluding automatic receipts and non-interested information such as heartbeats.

[0091] The default bin widths for fixed bin statistics are 0–5s, 5–15s, 15–30s, 30–60s, 1–2min, 2–5min, and >5min. Fixed bin statistics ensure that each element in the adjacent reply time interval sequence is assigned to a unique bin. The maximum beat value refers to the maximum beat value among all bins corresponding to the same session. Therefore, the larger the resulting beat concentration value, the more concentrated the reply rhythm. The session message volume can be expressed as the length of the adjacent reply time interval sequence or the number of outbound messages.

[0092] Further, in step S300, the method for obtaining the process transfer index based on the customer service response field sequence is as follows: For any customer service response field, map it to a field state according to its field key name or key value entry. If any field state is different from its previous field state, then they are grouped into a pair in chronological order and recorded as a transfer pair. Count the number of occurrences of different transfer pairs in all sessions and normalize them to obtain a reference transfer distribution. Count the number of occurrences of different transfer pairs in any session and normalize them to obtain a session transfer distribution. If the session transfer distribution value of any transfer pair in the session transfer distribution is greater than the corresponding reference transfer distribution value in the reference transfer distribution, then replace the session transfer distribution value with the reference transfer distribution value. Record the sum of the session transfer distribution values ​​in the session as the session-level overlap rate. Using the session message volume as the weight, calculate the weighted average of the session-level overlap rates corresponding to all sessions and record it as the process transfer index.

[0093] The mapping of field key names and key-value entries to field states is achieved either by looking up the field key names or key-value enumerations in a dictionary table to map them to the corresponding field states, or by using a regular expression rule library to perform pattern matching on the key names and key-value entries, mapping a matched entry to a preset field state. Field states are preset status labels.

[0094] When the field key name is not missing, the field key name is used for mapping first; if it is missing, the key value entry is used for mapping.

[0095] The reference transition distribution is a normalized sequence of percentage values ​​for the frequency of different transition pairs. Each percentage value corresponds to a transition pair. The reference transition distribution value represents the percentage value corresponding to any transition pair in the reference transition distribution. The session transition distribution is similar.

[0096] Furthermore, in step S400, the method for obtaining the homogeneous volume of fraudulent orders through the cycle time index and process transfer index is as follows:

[0097] Set a time period as the monitoring period PETH, with a value of 28 natural days; for any natural day, perform Z-score standardization on the taktivity index and process transition index of each merchant, and record them as the taktivity Z-score score and the process transition Z-score score, respectively.

[0098] For any merchant, the average of all peak values ​​of the beat rate Z-score during the monitoring period is recorded as the mean of the beat rate index, and the maximum value of the process transfer Z-score is recorded as the extreme value of the transfer index.

[0099] For any merchant, calculate the ratio of the number of natural days with a rhythmic Z-score score and a process transfer Z-score score greater than 3 to the total number of natural days during the monitoring period. Record these ratios as the first anomaly rate and the second anomaly rate, respectively. Record the medians of the first and second anomaly rates in history as the first anomaly median and the second anomaly median, respectively. For any merchant, if both the first anomaly rate and the second anomaly rate are greater than the second anomaly median, then the merchant is classified as a high-risk merchant. For any high-risk merchant, the standard deviation of all changes in the process transfer Z-score scores between two consecutive natural days is recorded as the process transfer variability.

[0100] For any non-high-risk merchant, the homogeneous volume of their fraudulent orders is the average value of the takt rate index; for any high-risk merchant, the homogeneous volume of their fraudulent orders is the sum of the product of the extreme value of the transfer index and the variability of the process transfer, and the average value of the takt rate index.

[0101] Furthermore, in step S400, the method for obtaining the homogeneous volume of fraudulent orders through the cycle time index and process transfer index is as follows:

[0102] Let a time period be designated as the monitoring period PETH, with a value of 28 calendar days. For any merchant, all tempo indicators and process transition indicators are denoted as the tempo time series and process time series, respectively. The 5th percentile of the tempo time series and process time series is denoted as the tempo jitter threshold and process response threshold, respectively. The 5th percentile refers to the value at which 5% of the observations, arranged in ascending order, do not exceed this value.

[0103] After removing beat-related indicators from the beat time series that are below the beat-related jitter threshold and process transfer indicators from the process time series that are below the process response threshold, an autoregressive integral moving average time series model is used to fit the updated two time series to generate first-order predicted values. The corresponding first-order predicted value residual value sequences are obtained for the two time series. Here, the autoregressive integral moving average time series model is the tsa.arima.model.ARIMA() function in the statsmodels library in Python.

[0104] The residual values ​​for both time series are calculated by subtracting the predicted values ​​from the actual values, thus obtaining residual value sequences for the first time for each time series. The residual sequences are then smoothed using a Kalman filter (implemented via the `smooth()` function of the `kalman` library in Python), resulting in a second residual value sequence. The time series obtained by adding the first-order predicted values ​​for each day within the two time series to the new residual values ​​are denoted as the beat denoising sequence and the process denoising sequence, respectively.

[0105] For any merchant, the median of the denoised beat sequence is denoted as the adaptive beat median; the adaptive beat median and standard deviation of all merchants are denoted as the platform beat median and platform beat variability, respectively; for any merchant, the absolute value of the quotient of the difference between its adaptive beat median and the platform beat median and the platform beat variability is denoted as the heterogeneous fluctuation value.

[0106] If the percentage of values ​​in a merchant's denoised beat sequence that are greater than the sum of its adaptive beat median and heterogeneous fluctuation value exceeds 75%, then the merchant is considered a high-risk merchant.

[0107] For any high-risk merchant, the values ​​of both the beat denoising sequence and the process denoising sequence are Z-score standardized to form a two-dimensional feature vector. The Isolation Forest anomaly detection algorithm is used to construct a random forest to separate outliers in the two-dimensional feature vector, and the fused anomaly score corresponding to the two-dimensional feature vector is output. The Isolation Forest anomaly detection algorithm is implemented using the IsolationForest() function in the scikit-learn library in Python. It does not require assumptions about the data distribution, has low computational complexity, can efficiently isolate anomalies, and captures synchronous anomalies between order and response rhythm through random subspace segmentation.

[0108] For any non-high-risk merchant, the homogeneous amount of their fraudulent orders is the adaptive beat median; for any high-risk merchant, the homogeneous amount of their fraudulent orders is the adaptive beat median × (1 + fusion anomaly score).

[0109] Further, in step S500, the method for determining whether a merchant has engaged in fraudulent order activity based on the homogeneous volume of fraudulent orders is as follows: the upper quartile value of the homogeneous volume of fraudulent orders for each merchant in a natural day is the basic threshold value of the volume; within the backtesting period, the median value of the basic threshold value of the homogeneous volume of fraudulent orders is the dynamic threshold value of the volume; if the homogeneous volume of fraudulent orders for a merchant in that natural day is greater than both the basic threshold value and the dynamic threshold value, then a homogeneous risk is marked as occurring; when the proportion of homogeneous risk occurrences within the backtesting period exceeds a preset threshold, it is determined that the merchant has engaged in fraudulent order activity, and the merchants determined to have engaged in fraudulent order activity are sent to the administrator client or stored on the server.

[0110] The backtesting period is set at 4 weeks; the preset percentage of homogeneous risks occurring within the backtesting period is 30%.

[0111] Preferably, the basic threshold for accumulated volume is calculated separately by category or business type. That is, within the same natural day, the merchants are grouped by the set of product categories to which they belong, and the upper quartile value of the homogeneous accumulated volume of brushing orders of merchants in each group is calculated as the basic threshold of that group, so as to reduce the impact of cross-category differences.

[0112] When a merchant is determined to have engaged in fraudulent order activity, evidence is collected and indexed, including rhythmic indicators of the homogeneous accumulation of fraudulent orders within a natural day, process transfer indicators, threshold values, a list of session identifiers and MID message identifiers that match CIDs, and corresponding timestamps, for use in post-event audits and appeal reviews.

[0113] The brushing behavior analysis system provided in the embodiments of the present invention, such as Figure 2 The diagram shown is a structural diagram of the order-brushing behavior analysis system of the present invention. The order-brushing behavior analysis system of this embodiment includes: a processor, a memory, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the steps in the above-described order-brushing behavior analysis method embodiment.

[0114] The system includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program in units of the following system:

[0115] The merchant identification unit is used to deploy customer service interaction collection and unified coding scenarios, and to identify merchant codes from them.

[0116] The raw data collection unit is used to collect the sequence of adjacent reply time intervals and the sequence of customer service reply fields for each merchant, based on the merchant code and using natural days as the unit.

[0117] The indicator construction unit is used to obtain rhythmic indicators based on the sequence of adjacent reply time intervals and process transition indicators based on the sequence of customer service reply fields.

[0118] The Homogeneous Analysis Unit for Fake Orders is used to obtain the homogeneous volume of fake orders through rhythm indicators and process transfer indicators.

[0119] The order-brushing behavior judgment unit is used to determine whether a merchant has engaged in order-brushing behavior based on the homogeneous accumulation of orders.

[0120] The order-brushing behavior analysis system can run on computing devices such as desktop computers, laptops, PDAs, and cloud servers. The system that can run on the order-brushing behavior analysis system may include, but is not limited to, processors and memory. Those skilled in the art will understand that the examples given are merely illustrations of order-brushing behavior analysis systems and do not constitute a limitation on the system. It may include more or fewer components, or a combination of certain components, or different components. For example, the order-brushing behavior analysis system may also include input / output devices, network access devices, buses, etc.

[0121] The processor referred to can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor can be a microprocessor or any conventional processor. The processor is the control center of the order-brushing behavior analysis system, connecting various parts of the system via various interfaces and lines.

[0122] The memory can be used to store the computer programs and / or modules. The processor implements various functions of the order-brushing behavior analysis system by running or executing the computer programs and / or modules stored in the memory and calling the data stored in the memory. The memory may mainly include a program storage area and a data storage area. The program storage area may store the operating system, at least one application program required for a function (such as sound playback function, image playback function, etc.), etc.; the data storage area may store data created based on the use of the mobile phone (such as audio data, phonebook, etc.). In addition, the memory may include high-speed random access memory, and may also include non-volatile memory, such as hard disk, memory, plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, at least one disk storage device, flash memory device, or other volatile solid-state storage device.

[0123] Although the invention has been described in considerable detail and particularly with regard to several of the described embodiments, it is not intended to limit itself to any of these details or embodiments or any particular embodiment, thereby effectively covering the intended scope of the invention. Furthermore, the invention has been described above with respect to embodiments foreseeable by the inventors in order to provide a useful description, and non-substantial modifications to the invention that have not yet been foreseen may still represent equivalent modifications.

Claims

1. A method of analyzing a fake trading behavior, characterized by, The method includes the following steps: S100, deploy customer service interaction collection and unified coding scenarios, and identify merchant codes from them; S200, based on natural days, collects the sequence of adjacent reply time intervals and customer service reply field sequences for each merchant according to the merchant code; S300: Obtains rhythmicity indicators based on the sequence of adjacent response time intervals and process transition indicators based on the sequence of customer service response fields; S400 obtains homogeneous volume of fraudulent orders through takt time indicators and process transfer indicators; S500 determines whether a merchant is engaging in fraudulent order practices based on the volume of similar fraudulent orders. In step S100, the method for setting up customer service interaction collection and unified coding scenarios and identifying merchant codes from them is as follows: the customer service session data generated by the platform is accessed and desensitized; the sessions and messages are encoded based on the unified resource identifier, and candidate merchant identifiers are extracted from the session-side metadata and the merchant-side routing information. The merchant code is determined by weighted fusion of strong binding signals and weak binding signals. In step S200, the method for collecting the adjacent reply time interval sequence and customer service reply field sequence of each merchant based on the merchant code, using natural days as the unit, is as follows: any merchant code corresponds to one merchant, and the set of adjacent time differences obtained after sorting all customer service messages of the merchant on that day by time is the adjacent reply time interval sequence; the sequence of occurrence of the original reply field key name or key-value pair recorded in each round of replies of the merchant on that day is the customer service reply field sequence; each merchant obtains several adjacent reply time interval sequences and customer service reply field sequences on each natural day; In step S300, the method for obtaining the beat index based on the adjacent reply time interval sequence is as follows: each adjacent reply time interval sequence of the same natural day is statistically analyzed by fixed binning, and the statistical value obtained by each binning is the beat value. The ratio of the maximum beat value to the sum of all beat values ​​is the beat concentration. The weighted average of the beat concentration of all sessions is calculated using the number of session messages as the weight and recorded as the beat index. The method for obtaining process transition metrics based on customer service response field sequences is as follows: For any customer service response field, map it to a field state according to its field key name or key-value entry. If any field state is different from its previous field state, they are grouped into a pair in chronological order and recorded as a transition pair. Count the number of occurrences of different transition pairs in all sessions and normalize them to obtain a reference transition distribution. Count the number of occurrences of different transition pairs in any session and normalize them to obtain a session transition distribution. If the session transition distribution value of any transition pair in the session transition distribution is greater than the corresponding reference transition distribution value in the reference transition distribution, replace the session transition distribution value with the reference transition distribution value. The sum of the session transition distribution values ​​in the session is recorded as the session-level overlap rate. Using the session message volume as the weight, calculate the weighted average of the session-level overlap rates corresponding to all sessions and record it as the process transition metric.

2. The method for analyzing fraudulent order behavior according to claim 1, characterized in that, In step S400, the method for obtaining the homogeneous volume of fraudulent orders through the takt time index and the process transfer index is as follows: for any natural day, the takt time index and the process transfer index of each merchant are Z-score standardized and recorded as the takt time Z-score score and the process transfer Z-score score, respectively. For any merchant, record During the monitoring period The average of all peak values ​​of the beat rate Z-score is the mean of the beat rate index. The maximum value of the process transfer Z-score is recorded as the extreme value of the transfer index. The ratio of the number of natural days with a beat rate Z-score greater than 3 and the process transfer Z-score greater than 3 to the total number of natural days during the monitoring period is calculated. This ratio is recorded as the first anomaly rate and the second anomaly rate, respectively. The median of the first anomaly rate and the second anomaly rate in history is recorded as the first anomaly median and the second anomaly median, respectively. For any merchant, if its first anomaly rate is greater than the first anomaly median and its second anomaly rate is greater than the second anomaly median, then the merchant is recorded as a high-risk merchant; for any high-risk merchant, the standard deviation of all changes in the process transfer Z-score scores between two consecutive natural days is recorded as the process transfer variability. For any non-high-risk merchant, the homogeneous volume of their fraudulent orders is the average value of the takt rate indicator; for any high-risk merchant, the homogeneous volume of their fraudulent orders is the sum of the product of the extreme value of the transfer indicator and the variability of the process transfer, and the average value of the takt rate indicator.

3. The method for analyzing fraudulent order behavior according to claim 1, characterized in that, In step S400, the method for obtaining the homogeneous product of order-brushing through the beat index and process transfer index is as follows: all beat indices and process transfer indices of any merchant constitute the beat time series and process time series respectively, and the 5th percentile of the beat time series and process time series are recorded as the beat jitter threshold and process response threshold respectively; beat indices in the beat time series that are less than the beat jitter threshold and process transfer indices in the process time series that are less than the process response threshold are removed, and the two updated time series are fitted with an autoregressive integral moving average time series model to generate first-order predicted values; The residuals are calculated by subtracting the predicted values ​​from the actual values ​​of the two time series, resulting in a residual sequence. A Kalman filter is then used to smooth and update the residual sequence. ； The time series obtained by adding the first-order predicted value corresponding to each natural day in the two time series to the new residual value are respectively denoted as the beat denoising series and the process denoising series; the median of the beat denoising series is denoted as the adaptive beat median; the adaptive beat median and standard deviation of all merchants are respectively denoted as the platform beat median and the platform beat variability. For any merchant, the absolute value of the quotient of the difference between its adaptive tempo median and the platform tempo median and the platform tempo variability is denoted as the heterogeneous fluctuation value; if the proportion of values ​​in a merchant's denoised tempo sequence that are greater than the sum of its adaptive tempo median and heterogeneous fluctuation value exceeds 75%, then the merchant is considered a high-risk merchant. For any high-risk merchant, the values ​​of both the beat denoising sequence and the process denoising sequence are Z-score standardized to form a two-dimensional feature vector. The Isolation Forest anomaly detection algorithm is used to construct a random forest to separate outliers in the two-dimensional feature vector and output the fusion anomaly score corresponding to the two-dimensional feature vector. For any non-high-risk merchant, the homogeneous amount of their fraudulent orders is the adaptive beat median; for any high-risk merchant, the homogeneous amount of their fraudulent orders is the adaptive beat median × (1 + fusion anomaly score).

4. The method for analyzing fraudulent order behavior according to claim 1, characterized in that, In step S500, the method for determining whether a merchant is engaging in fraudulent order behavior based on the homogeneous volume of fraudulent orders is as follows: the upper quartile value of the homogeneous volume of fraudulent orders for each merchant in a natural day is the basic threshold value of the volume; during the backtesting period, the median value of the basic threshold value of the homogeneous volume of fraudulent orders is the dynamic threshold value of the volume. If a merchant's total volume of similar fraudulent transactions on a given day exceeds both the base threshold and the dynamic threshold, a single instance of similar risk is flagged. If the proportion of similar risk occurrences exceeds a preset threshold during the backtesting period, the merchant is identified as engaging in fraudulent transactions, and the list of merchants identified as engaging in such transactions is sent to the administrator's client or stored on the server.

5. A system for analyzing fraudulent order behavior, characterized in that: The order-brushing behavior analysis system includes: a processor, a memory, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the steps of the order-brushing behavior analysis method according to any one of claims 1-4. The order-brushing behavior analysis system runs on a desktop computer, a laptop computer, a handheld computer, or a cloud data center computing device.

Images