An electronic coupon information abnormality detection method
By constructing a multi-dimensional feature engineering and dynamic adaptive anomaly detection model, the problems of single feature dimensions and model lag in electronic coupon detection are solved, enabling accurate identification and real-time defense against black market gangs, and reducing false positive and false negative rates.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- YUNXUAN (SHANGHAI) INTERNET TECHNOLOGY CO LTD
- Filing Date
- 2026-04-28
- Publication Date
- 2026-07-24
Smart Images
Figure CN122453455A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of internet data security and risk control technology, and in particular to a method for detecting anomalies in electronic coupon information. Background Technology
[0002] With the widespread adoption of e-commerce and mobile payments, electronic coupons have become a core tool for merchants' precision marketing and user operations. However, the huge profits involved have spawned highly professional "coupon hunters" and black market gangs. They use advanced technologies such as automated scripts, emulator group control, device fingerprint tampering (device modification tools), and bulk account registration to launch large-scale, covert "coupon hunting" attacks, resulting in serious losses of platform marketing funds and significant damage to the legitimate rights and interests of normal users.
[0003] Despite existing technologies attempting to incorporate anomaly detection mechanisms, significant technical bottlenecks remain when dealing with increasingly complex cyberattacks. Firstly, the feature dimensions are limited and lack in-depth correlation analysis. Traditional detection methods often focus on isolated analysis of static features (such as a single IP address, single request frequency, or a single user's coupon-claiming behavior), neglecting the temporal continuity of user behavior sequences, the deep attributes of device fingerprints, and the complex coupling relationships between coupon states. More critically, existing solutions struggle to effectively identify the clustering characteristics of cybercrime groups, such as multiple accounts sharing the same physical device, the same payment account, or collaborating within the same network environment. This lack of multi-dimensional correlation information regarding "people-device-behavior-relationships" results in persistently high false positive and false negative rates when facing meticulously disguised group attacks.
[0004] Secondly, the models lack dynamic adaptation and real-time response capabilities. Existing defense systems mostly rely on pre-set static rule bases or machine learning models trained offline based on historical data. Faced with the rapid iteration and evolution of cybercrime methods (such as new simulator technologies and dynamically changing attack strategies), static models often suffer from severe lag, failing to capture subtle changes in user behavior patterns in real time. This leads to the rapid failure of defense strategies and makes it difficult to form a continuous and effective closed-loop protection.
[0005] In summary, how to construct an anomaly detection technology for electronic coupons that can deeply integrate multi-dimensional behavioral sequences and correlation graph features and has real-time dynamic adaptive capabilities has become a key issue that urgently needs to be addressed. Summary of the Invention
[0006] The purpose of this invention is to provide an anomaly detection method for electronic coupon information, which solves the problems of existing electronic coupon anomaly detection technologies, such as single feature dimensions, lack of mining of deep user-device-behavior correlation, and static model lag, which make it difficult to identify hidden black market attacks and result in high false positive and false negative rates.
[0007] To achieve the above-mentioned objectives, the technical solution adopted by this invention is as follows:
[0008] An anomaly detection method for electronic coupon information, characterized by comprising: step S1: real-time collection of multi-source heterogeneous data of the target object during the lifecycle of the electronic coupon; the multi-source heterogeneous data includes user behavior sequence data, device fingerprint data, account attribute data, coupon status data, geographical location data, and network environment data;
[0009] Step S2: Construct multi-dimensional feature engineering based on the multi-source heterogeneous data to generate time-series behavioral features, device deep attribute features, coupon state evolution features, location offset features, and network environment stability features;
[0010] The deep attribute features of the device are generated by parsing the consistency verification of the device hardware layer, system layer and sensor layer information, and include modified device features, simulator features and device co-occurrence features;
[0011] Step S3: Construct a heterogeneous association graph with user accounts, device fingerprints, and payment account identifiers as heterogeneous nodes, and login relationships, binding relationships, shared network environment relationships, and shared geographical location relationships as edges; use a heterogeneous graph attention network to perform message passing and aggregation on the heterogeneous association graph, and extract gang association features that represent the aggregation characteristics of black market gangs.
[0012] Step S4: After standardizing and selecting the time-series behavior features, device deep attribute features, coupon state evolution features, location offset features, network environment stability features, and gang association features, the data is input into the dynamic adaptive anomaly detection model, and the anomaly risk score of the current electronic coupon operation event is output.
[0013] Step S5: Execute a hierarchical dynamic adaptive interception strategy based on the anomaly risk score, and use the detection results and subsequent manual review or user appeal results as labeled feedback samples to perform online incremental updates to the dynamic adaptive anomaly detection model.
[0014] As an improvement, the generation of temporal behavior features in step S2 specifically includes:
[0015] The user's actions of receiving, redeeming, transferring, and expiring electronic coupons are constructed into a behavioral sequence according to the time sequence;
[0016] Based on the behavior sequence, extract the behavior interval time, the time periodic fluctuation of behavior frequency, and the Markov transition probability of the behavior path;
[0017] The deviation of the current behavioral sequence from the user's historical habits is evaluated using a Long Short-Term Memory (LSTM) network or a Transformer architecture as part of the temporal behavioral characteristics.
[0018] As an improvement, the generation of the deep attribute features of the device in step S2 further includes:
[0019] Analyze the entropy value of device sensor data and the smoothness of touch trajectory to distinguish between real user operations and automated script operations;
[0020] Extract the distribution of active periods and geographical jumps of devices within historical time slices to identify abnormal human behavior patterns;
[0021] If the same device fingerprint is detected to have initiated a coupon claim request at two different locations geographically separated by more than the physical mobility limit within a very short time interval, a spatiotemporal anomaly feature is generated to mark the device as high-risk.
[0022] As an improvement, step S3, which involves extracting gang association features that characterize the clustering of criminal gangs, specifically includes:
[0023] Calculate the attention weights between different heterogeneous nodes and identify subgraph structures in which multiple accounts are used together on the same device, the same payment account, or the same network environment within a preset time window;
[0024] When high-frequency collaborative coupon-claiming behavior is detected among different user accounts under the same physical device, the same payment account, or the same subnet IP, strong correlation edges are established in the graph;
[0025] The embedding vector of the subgraph structure, along with the graph distance and similarity score between the current request node and the known black market seed nodes, are used together as the gang association features.
[0026] As an improvement, the dynamic adaptive anomaly detection model in step S4 includes:
[0027] A temporal encoder is used to process the temporal behavioral features and extract behavioral pattern latent vectors;
[0028] A graph encoder is used to process the gang association features and extract the gang relationship latent vector;
[0029] The feature fusion layer is used to concatenate the behavior pattern latent vector and the gang relationship latent vector, and combine them with the device deep attribute features, coupon state evolution features, location offset features and network environment stability features to generate a fused feature vector.
[0030] The classifier adopts an ensemble learning architecture, which integrates a rule-based expert system and a deep learning-based detection sub-model. It automatically switches or weights the outputs of each sub-model according to the dynamic confidence of the real-time scene, and outputs the anomaly risk score based on the fused feature vector.
[0031] As an improvement, the dynamic adaptive anomaly detection model described in step S4 has dynamic adaptive capabilities, which are specifically achieved through the following mechanism:
[0032] An online streaming learning module is set up to monitor the statistical distribution drift of the input data in real time. When the evolution of black market attack strategies is detected, causing the data distribution to deviate from the preset benchmark, the model fine-tuning mechanism is triggered.
[0033] By introducing a reinforcement learning feedback loop, the actual interception effect after the risk control strategy in step S5 is executed is used as a reward signal to dynamically optimize the feature selection strategy and classification boundary of the model.
[0034] As an improvement, the step S5, which involves executing a tiered dynamic adaptive interception strategy based on the abnormal risk score, specifically includes:
[0035] The abnormal risk score is compared with a dynamic threshold; the dynamic threshold is adaptively adjusted based on the historical abnormal score distribution statistically analyzed in real time.
[0036] If the abnormal risk score is lower than the first threshold, it is determined to be a normal request and is allowed directly.
[0037] If the abnormal risk score is between the first threshold and the second threshold, it is determined to be a suspicious request and an enhanced verification mechanism is triggered, including pop-up slider verification code, SMS secondary confirmation or facial recognition verification.
[0038] If the abnormal risk score is higher than the second threshold, it is determined to be a malicious attack, the coupon claim request is directly blocked, and the associated user account, device fingerprint and payment account are temporarily or permanently banned.
[0039] As an improvement, the online incremental update of the dynamic adaptive anomaly detection model in step S5 specifically includes:
[0040] The operation events that triggered the blocking action and the results of subsequent manual review or user appeals will be used as tagged feedback samples;
[0041] Regularly extract newly emerging cyberattack samples from interception records, automatically label and add them to the training dataset, and update the cyberattack fingerprint database and attack pattern database in the feature library.
[0042] An online gradient descent algorithm is used to periodically or event-driven incrementally update the network parameters of the dynamic adaptive anomaly detection model based on the feedback samples, and the updated model parameters are hot-deployed to the production environment.
[0043] As an improvement, spatiotemporal constraints are also introduced when constructing the heterogeneous correlation graph in step S3:
[0044] If the login and coupon redemption behavior of the same user account on different devices shows unnatural periodic batch characteristics, then the user node and its associated device nodes will be included in the suspected gang subgraph for key monitoring.
[0045] By introducing coupon state coupling relationships, the generation, receipt, redemption, transfer, and refund status of coupons are used as attributes of edges. Abnormal state transition paths are explored, and the weight of the corresponding edge is increased if an abnormal state transition is found.
[0046] An anomaly detection system for electronic coupon information, characterized in that it includes:
[0047] The data acquisition module is used to collect multi-source heterogeneous data in real time during the process of users receiving and using electronic coupons;
[0048] The feature extraction module is used to preprocess and feature engineer the multi-source heterogeneous data to generate time-series behavioral features, deep device attribute features, coupon state evolution features, location offset features, and network environment stability features.
[0049] The graph construction module is used to construct a heterogeneous association graph of "people-device-behavior-relationships" and to use graph neural networks to extract gang association features that characterize the clustering characteristics of black market gangs;
[0050] The model detection module has a built-in dynamic adaptive anomaly detection model, which is used to perform real-time inference on multimodal feature fusion vectors and calculate anomaly risk scores. It also has online streaming learning and reinforcement learning feedback mechanisms.
[0051] The risk control execution module is used to execute a graded risk control strategy based on the abnormal risk score, and to feed back the results to update the model parameters online, so as to realize the real-time iteration of the defense strategy against new attack methods.
[0052] The beneficial effects of this invention are as follows: by constructing a heterogeneous association graph of "people-device-behavior-relationship" and using a heterogeneous graph attention network to extract gang association features, this method can effectively identify collaborative cheating behavior in which multiple accounts share the same device, payment account or network environment.
[0053] This solves the problem that traditional methods, due to their single feature dimension and lack of deep correlation mining, are unable to detect elaborately disguised group crimes, thus significantly reducing the false positive rate and false negative rate.
[0054] It possesses dynamic adaptive and real-time response capabilities, effectively addressing the evolution of attacks.
[0055] A dynamic adaptive anomaly detection model is introduced, which includes an online streaming learning module and a reinforcement learning feedback loop.
[0056] The system can monitor data distribution drift in real time and automatically trigger model fine-tuning when the attack strategies of black market operators evolve; at the same time, it uses the interception results as feedback samples for online incremental updates.
[0057] It overcomes the shortcomings of existing static rule bases or offline models in terms of lag, and realizes real-time iterative defense against new attack methods.
[0058] Deep fusion of multi-dimensional features to accurately distinguish between normal users and automated attacks.
[0059] A multi-dimensional feature engineering model was constructed, covering temporal behavior features (evaluating behavior deviation based on LSTM / Transformer), deep device attribute features (analyzing hardware / system / sensor consistency, identifying modified devices, simulators, and script operations), and position offset features.
[0060] By fusing multimodal features, it is possible to accurately identify unnatural human behavior patterns (such as abnormal spatiotemporal jumps, abnormal touch trajectory smoothness, etc.), effectively distinguishing between real user operations and automated script attacks.
[0061] Implement a tiered dynamic blocking strategy to balance security and user experience.
[0062] Based on the anomaly risk score, a tiered processing method is implemented: low-risk cases are allowed to pass directly, medium-risk cases trigger enhanced verification (such as sliders or face recognition), and high-risk cases are directly blocked and banned.
[0063] This tiered strategy avoids a "one-size-fits-all" approach to blocking, ensuring the safety of marketing funds while minimizing interference with normal user operations and improving the user experience.
[0064] To form a closed-loop protection system and achieve continuous optimization of defense strategies.
[0065] By converting detection results, manual review, and user complaint results into labeled feedback samples, the black market fingerprint database and attack pattern database are automatically updated, and the updated model parameters are hot-deployed using an online gradient descent algorithm.
[0066] A complete closed loop has been established, from data collection, feature extraction, model detection to risk control execution and feedback updates, ensuring that the defense system can continuously evolve as black market methods upgrade. Attached Figure Description
[0067] Figure 1 This is a flowchart of an anomaly detection method for electronic coupon information according to the present invention.
[0068] Figure 2 This is an architecture diagram of an anomaly detection system for electronic coupon information according to the present invention. Detailed Implementation
[0069] To make the content of this invention easier to understand, the technical solutions of the embodiments of this invention will be clearly and completely described below with reference to the accompanying drawings. Identical components are represented by the same reference numerals. It should be noted that the terms "front," "rear," "left," "right," "up," and "down" used in the following description refer to directions in the accompanying drawings, while the terms "inner" and "outer" refer to directions toward or away from the geometric center of a specific component, respectively.
[0070] like Figure 1As shown, an anomaly detection method for electronic coupon information is characterized by the following steps: Step S1: Real-time collection of multi-source heterogeneous data of the target object during the lifecycle of the electronic coupon; the multi-source heterogeneous data includes user behavior sequence data, device fingerprint data, account attribute data, coupon status data, geographical location data, and network environment data; Step S2: Constructing multi-dimensional feature engineering based on the multi-source heterogeneous data to generate time-series behavior features, device deep attribute features, coupon status evolution features, location offset features, and network environment stability features; wherein, the device deep attribute features are generated by parsing the consistency verification of device hardware layer, system layer, and sensor layer information, and include device modification features, simulator features, and device co-occurrence features; Step S3: Constructing a system with user account, device fingerprint identifier, and payment account identifier as heterogeneous nodes, and using... A heterogeneous association graph with login relationships, binding relationships, shared network environment relationships, and shared geographical location relationships as edges is constructed. A heterogeneous graph attention network is used to perform message passing and aggregation on the heterogeneous association graph, extracting gang association features that characterize the aggregation of black market gangs. Step S4: After standardizing and selecting the temporal behavior features, device deep attribute features, coupon state evolution features, location offset features, network environment stability features, and gang association features, the data is input into a dynamic adaptive anomaly detection model, outputting an anomaly risk score for the current electronic coupon operation event. Step S5: Based on the anomaly risk score, a hierarchical dynamic adaptive interception strategy is executed, and the detection results and subsequent manual review or user appeal results are used as labeled feedback samples to perform online incremental updates to the dynamic adaptive anomaly detection model.
[0071] Specifically, the generation of temporal behavioral features in step S2 includes: constructing a behavioral sequence by arranging the user's actions of receiving, redeeming, transferring, and expiring electronic coupons in chronological order; extracting the temporal periodicity of behavioral intervals and frequency, as well as the Markov transition probability of behavioral paths, based on the behavioral sequence; and evaluating the deviation of the current behavioral sequence from the user's historical habits using a Long Short-Term Memory (LSTM) network or Transformer architecture as part of the temporal behavioral features.
[0072] In addition, the generation of deep device attribute features in step S2 specifically includes: analyzing the entropy value of device sensor data and the smoothness of touch trajectory to distinguish between real user operations and automated script operations; extracting the distribution of active time periods and geographical location jump features of the device in historical time slices to identify abnormal human behavior patterns; if the same device fingerprint is detected to appear in two different locations with geographical locations more than the physical movement limit within a very short time interval to initiate a coupon claim request, then a spatiotemporal anomaly feature is generated to mark the device as high risk.
[0073] Secondly, step S3, which involves extracting gang association features to characterize the aggregation of black market gangs, specifically includes: calculating the attention weights between different heterogeneous nodes; identifying subgraph structures where multiple accounts share the same device, payment account, or network environment within a preset time window; when high-frequency collaborative coupon-claiming behavior is detected among different user accounts under the same physical device, payment account, or subnet IP, establishing strong association edges in the graph; and using the embedding vector of the subgraph structure, along with the graph distance and similarity score between the current request node and known black market seed nodes, as the gang association features.
[0074] Furthermore, the dynamic adaptive anomaly detection model in step S4 includes: a temporal encoder for processing the temporal behavioral features and extracting behavioral pattern latent vectors; a graph encoder for processing the gang association features and extracting gang relationship latent vectors; a feature fusion layer for concatenating the behavioral pattern latent vectors and the gang relationship latent vectors, and combining them with the device deep attribute features, coupon state evolution features, location offset features, and network environment stability features to generate a fused feature vector; and a classifier that adopts an ensemble learning architecture, integrates a rule-based expert system with a deep learning-based detection sub-model, automatically switches or weights the outputs of each sub-model according to the dynamic confidence level of the real-time scenario, and outputs the anomaly risk score based on the fused feature vector.
[0075] The dynamic adaptive anomaly detection model described in step S4 has dynamic adaptive capabilities, which are achieved through the following mechanisms: setting up an online streaming learning module to monitor the statistical distribution drift of the input data in real time; when the evolution of black market attack strategies causes the data distribution to deviate from the preset benchmark, the model fine-tuning mechanism is triggered; and a reinforcement learning feedback loop is introduced, using the actual interception effect after the risk control strategy in step S5 is executed as a reward signal to dynamically optimize the model's feature selection strategy and classification boundary.
[0076] Furthermore, the hierarchical dynamic adaptive interception strategy based on the abnormal risk score in step S5 specifically includes: comparing the abnormal risk score with a dynamic threshold; the dynamic threshold is adaptively adjusted based on the historical abnormal score distribution in real time statistics; if the abnormal risk score is lower than the first threshold, it is determined to be a normal request and is directly allowed; if the abnormal risk score is between the first threshold and the second threshold, it is determined to be a suspicious request and an enhanced verification mechanism is triggered, including pop-up slider verification code, SMS secondary confirmation, or facial recognition verification; if the abnormal risk score is higher than the second threshold, it is determined to be a malicious attack, the coupon request is directly intercepted, and the associated user account, device fingerprint, and payment account are temporarily or permanently banned.
[0077] In addition, the online incremental update of the dynamic adaptive anomaly detection model in step S5 specifically includes: using the operation events that trigger the interception action and the results of subsequent manual review or user appeal as labeled feedback samples; periodically extracting newly emerging black market attack samples from the interception records, automatically labeling and adding them to the training dataset, and updating the black market fingerprint database and attack pattern database in the feature library; using an online gradient descent algorithm to periodically or event-driven incrementally update the network parameters of the dynamic adaptive anomaly detection model based on the feedback samples, and hot-deploying the updated model parameters to the production environment.
[0078] In addition, when constructing the heterogeneous association graph in step S3, spatiotemporal constraints are introduced: if the login and coupon redemption behavior of the same user account on different devices shows unnatural periodic batch characteristics, the user node and its associated device nodes are included in the suspected gang subgraph for key monitoring; coupon state coupling relationship is introduced, and the generation, redemption, cancellation, transfer and refund status of coupons are used as the attributes of edges to explore abnormal state transition paths. If abnormal state transitions are found, the weight of the corresponding edge is increased.
[0079] like Figure 2 As shown, an anomaly detection system for electronic coupon information is characterized by comprising: a data acquisition module for real-time acquisition of multi-source heterogeneous data during the process of users receiving and using electronic coupons; a feature extraction module for preprocessing and feature engineering the multi-source heterogeneous data to generate time-series behavioral features, device deep attribute features, coupon state evolution features, location offset features, and network environment stability features; a graph construction module for constructing a heterogeneous association graph of "people-device-behavior-relationships" and using graph neural networks to extract gang association features representing the aggregation characteristics of black market gangs; a model detection module with a built-in dynamic adaptive anomaly detection model for real-time inference of multimodal feature fusion vectors and calculation of anomaly risk scores, and possessing online streaming learning and reinforcement learning feedback mechanisms; and a risk control execution module for executing hierarchical risk control strategies based on the anomaly risk scores and feeding back the results to update model parameters online, realizing real-time iteration of defense strategies against new attack methods.
[0080] In the implementation process, firstly, multi-source heterogeneous data generated by users during the lifecycle of electronic coupons is collected in real time, including behavioral sequences, device fingerprints, account attributes, coupon status, geographical location, and network environment. Next, based on this data, a multi-dimensional feature engineering is constructed to generate temporal behavioral features, deep device attribute features, coupon status evolution features, location offset features, and network environment stability features. A heterogeneous association graph is then constructed with user accounts, device fingerprints, and payment accounts as nodes, and relationships such as login, binding, shared network, and geographical location as edges. A heterogeneous graph attention network is used to extract gang-related features. Then, after standardizing and selecting the above features, they are input into a dynamic adaptive anomaly detection model with online streaming learning and reinforcement learning feedback mechanisms to calculate the anomaly risk score of the current operation. Finally, a hierarchical dynamic adaptive interception strategy (such as allowing, enhanced verification, or direct interception) is executed based on the score. The detection results and subsequent manual review or user appeal results are used as feedback samples to incrementally update the model online, achieving continuous adaptive optimization of the detection strategy against new types of black market attacks.
[0081] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.
Claims
1. A method for detecting anomalies in electronic coupon information, characterized in that, include: Step S1: Collect multi-source heterogeneous data of the target object during the lifecycle of the electronic coupon in real time; the multi-source heterogeneous data includes user behavior sequence data, device fingerprint data, account attribute data, coupon status data, geographical location data, and network environment data; Step S2: Construct multi-dimensional feature engineering based on the multi-source heterogeneous data to generate time-series behavioral features, device deep attribute features, coupon state evolution features, location offset features, and network environment stability features; The deep attribute features of the device are generated by parsing the consistency verification of the device hardware layer, system layer and sensor layer information, and include modified device features, simulator features and device co-occurrence features; Step S3: Construct a heterogeneous association graph with user accounts, device fingerprints, and payment account identifiers as heterogeneous nodes, and login relationships, binding relationships, shared network environment relationships, and shared geographical location relationships as edges; use a heterogeneous graph attention network to perform message passing and aggregation on the heterogeneous association graph, and extract gang association features that represent the aggregation characteristics of black market gangs. Step S4: After standardizing and selecting the time-series behavior features, device deep attribute features, coupon state evolution features, location offset features, network environment stability features, and gang association features, the data is input into the dynamic adaptive anomaly detection model, and the anomaly risk score of the current electronic coupon operation event is output. Step S5: Execute a hierarchical dynamic adaptive interception strategy based on the anomaly risk score, and use the detection results and subsequent manual review or user appeal results as labeled feedback samples to perform online incremental updates to the dynamic adaptive anomaly detection model.
2. The method for detecting anomalies in electronic coupon information according to claim 1, characterized in that, The generation of temporal behavior features in step S2 specifically includes: The user's actions of receiving, redeeming, transferring, and expiring electronic coupons are constructed into a behavioral sequence according to the time sequence; Based on the behavior sequence, extract the behavior interval time, the time periodic fluctuation of behavior frequency, and the Markov transition probability of the behavior path; The deviation of the current behavioral sequence from the user's historical habits is evaluated using a Long Short-Term Memory (LSTM) network or a Transformer architecture as part of the temporal behavioral characteristics.
3. The method for detecting anomalies in electronic coupon information according to claim 2, characterized in that, The generation of deep device attribute features in step S2 further includes: Analyze the entropy value of device sensor data and the smoothness of touch trajectory to distinguish between real user operations and automated script operations; Extract the distribution of active periods and geographical jumps of devices within historical time slices to identify abnormal human behavior patterns; If the same device fingerprint is detected to appear in two different locations geographically separated by more than the physical mobility limit within a very short time interval to initiate a coupon claim, a spatiotemporal anomaly feature is generated to mark the device as high-risk.
4. The method for detecting anomalies in electronic coupon information according to claim 3, characterized in that, Step S3, which involves extracting gang association features that characterize the clustering of criminal gangs, specifically includes: Calculate the attention weights between different heterogeneous nodes and identify subgraph structures in which multiple accounts are used together on the same device, the same payment account, or the same network environment within a preset time window; When high-frequency collaborative coupon-claiming behavior is detected among different user accounts under the same physical device, the same payment account, or the same subnet IP, strong correlation edges are established in the graph; The embedding vector of the subgraph structure, along with the graph distance and similarity score between the current request node and the known black market seed nodes, are used together as the gang association features.
5. The method for detecting anomalies in electronic coupon information according to claim 1, characterized in that, The dynamic adaptive anomaly detection model mentioned in step S4 includes: A temporal encoder is used to process the temporal behavioral features and extract behavioral pattern latent vectors; A graph encoder is used to process the gang association features and extract the gang relationship latent vector; The feature fusion layer is used to concatenate the behavior pattern latent vector and the gang relationship latent vector, and combine them with the device deep attribute features, coupon state evolution features, location offset features and network environment stability features to generate a fused feature vector. The classifier adopts an ensemble learning architecture, which integrates a rule-based expert system and a deep learning-based detection sub-model. It automatically switches or weights the outputs of each sub-model according to the dynamic confidence of the real-time scene, and outputs the anomaly risk score based on the fused feature vector.
6. The method for detecting anomalies in electronic coupon information according to claim 5, characterized in that, The dynamic adaptive anomaly detection model described in step S4 has dynamic adaptive capabilities, which are specifically achieved through the following mechanism: An online streaming learning module is set up to monitor the statistical distribution drift of the input data in real time. When the evolution of black market attack strategies is detected, causing the data distribution to deviate from the preset benchmark, the model fine-tuning mechanism is triggered. By introducing a reinforcement learning feedback loop, the actual interception effect after the risk control strategy in step S5 is executed is used as a reward signal to dynamically optimize the feature selection strategy and classification boundary of the model.
7. The method for detecting anomalies in electronic coupon information according to claim 1, characterized in that, Step S5, which involves executing a tiered dynamic adaptive interception strategy based on the anomaly risk score, specifically includes: The abnormal risk score is compared with a dynamic threshold; the dynamic threshold is adaptively adjusted based on the historical abnormal score distribution statistically analyzed in real time. If the abnormal risk score is lower than the first threshold, it is determined to be a normal request and is allowed directly. If the abnormal risk score is between the first threshold and the second threshold, it is determined to be a suspicious request and an enhanced verification mechanism is triggered, including pop-up slider verification code, SMS secondary confirmation or facial recognition verification. If the abnormal risk score is higher than the second threshold, it is determined to be a malicious attack, the coupon claim request is directly blocked, and the associated user account, device fingerprint and payment account are temporarily or permanently banned.
8. The method for detecting anomalies in electronic coupon information according to claim 7, characterized in that, Step S5, which involves performing online incremental updates to the dynamic adaptive anomaly detection model, specifically includes: The operation events that triggered the blocking action and the results of subsequent manual review or user appeals will be used as tagged feedback samples; Regularly extract newly emerging cyberattack samples from interception records, automatically label and add them to the training dataset, and update the cyberattack fingerprint database and attack pattern database in the feature library. An online gradient descent algorithm is used to periodically or event-driven incrementally update the network parameters of the dynamic adaptive anomaly detection model based on the feedback samples, and the updated model parameters are hot-deployed to the production environment.
9. The method for detecting anomalies in electronic coupon information according to claim 4, characterized in that, In step S3, when constructing the heterogeneous correlation graph, spatiotemporal constraints are also introduced: If the login and coupon redemption behavior of the same user account on different devices shows unnatural periodic batch characteristics, then the user node and its associated device nodes will be included in the suspected gang subgraph for key monitoring. By introducing coupon state coupling relationships, the generation, receipt, redemption, transfer, and refund status of coupons are used as attributes of edges. Abnormal state transition paths are explored, and the weight of the corresponding edge is increased if an abnormal state transition is found.
10. An anomaly detection system for electronic coupon information, characterized in that, include: The data acquisition module is used to collect multi-source heterogeneous data in real time during the process of users receiving and using electronic coupons; The feature extraction module is used to preprocess and feature engineer the multi-source heterogeneous data to generate time-series behavioral features, deep device attribute features, coupon state evolution features, location offset features, and network environment stability features. The graph construction module is used to construct a heterogeneous association graph of "people-device-behavior-relationships" and to use graph neural networks to extract gang association features that characterize the clustering characteristics of black market gangs; The model detection module has a built-in dynamic adaptive anomaly detection model, which is used to perform real-time inference on multimodal feature fusion vectors and calculate anomaly risk scores. It also has online streaming learning and reinforcement learning feedback mechanisms. The risk control execution module is used to execute a graded risk control strategy based on the abnormal risk score, and to feed back the results to update the model parameters online, so as to realize the real-time iteration of the defense strategy against new attack methods.