User behavior perception method, device, equipment and medium

Abstract

The embodiment of the present invention discloses a user behavior perception method, device, equipment and medium, the method comprising: obtaining user behavior data; associating the user behavior data with a constructed relationship network, determining an associated relationship network associated with the user behavior data, the relationship network including at least one user; determining network risk data of the associated relationship network, judging whether the user behavior is a risky behavior based on the network risk data, and outputting corresponding risk warning information if the user behavior is a risky behavior. The user behavior perception method provided by the embodiment of the present invention associates the user with the constructed associated network through the user behavior data, judges whether the user behavior is a risky behavior based on the associated relationship network associated with the user, determines the user's behavior risk in a timely manner, implements pre-emptive risk control of cheating users, and ensures the user experience of normal users.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of data processing, and in particular to a user behavior perception method, device, equipment and medium. Background Art

[0002] With the rapid development of mobile Internet, e-commerce platforms often use a large amount of subsidies to cultivate user habits and increase user stickiness in order to attract users. However, from another perspective, this also promotes the development and maturity of a black and gray industry. In order to make subsidies more effective and protect the experience of normal users, it is necessary to formulate various anti-cheating strategies based on business characteristics to prevent black and gray industries from swiping, stealing accounts, cheating on subsidies, and stealing wool. Anti-cheating strategies are mainly divided into three types: pre-risk control, in-process risk control, and post-risk control. Throughout the entire business life cycle, the earlier the risks are identified and the black and gray users are intercepted and punished, the less impact on normal users and the better the overall user experience.

[0003] In the process of realizing the present invention, the inventors found that there are at least the following technical problems in the prior art: the existing anti-cheating strategies focus on risk control during and after the event, and determine the user's attributes or whether the user's transaction is a fraudulent transaction based on the user's behavior and the user's historical feature data. At this time, punishing this user may cause user complaints and even certain legal risks. Moreover, sometimes the losses that have been caused are irreversible. Especially for new users, since new users have less historical information, it is difficult to predict the user's attributes based on a small amount of data, and it is impossible to intercept malicious behavior in a timely and effective manner when it occurs. Summary of the invention

[0004] The embodiments of the present invention provide a user behavior perception method, apparatus, device and medium to timely determine the risk attributes of users, so as to implement pre-emptive risk control of cheating users and ensure the user experience of normal users.

[0005] In a first aspect, an embodiment of the present invention provides a user behavior perception method, comprising:

[0006] Acquire user behavior data, where the user behavior data is used to characterize the behavior performed by the user;

[0007] Associating the user behavior data with the constructed relationship network to determine an associated relationship network associated with the user behavior data, wherein the relationship network includes at least one user;

[0008] Determine the network risk data of the associated relationship network, judge whether the user behavior is a risky behavior based on the network risk data, and if the user behavior is a risky behavior, output corresponding risk warning information, wherein the network risk data is used to characterize the network risk degree of the associated relationship network.

[0009] In a second aspect, an embodiment of the present invention further provides a user behavior perception device, including:

[0010] A behavior data acquisition module, used to acquire user behavior data, wherein the user behavior data is used to characterize the behavior performed by the user;

[0011] An associated network determination module, used to associate the user behavior data with the constructed relationship network, and determine an associated relationship network associated with the user behavior data, wherein the relationship network includes at least one user;

[0012] The risk warning output module is used to determine the network risk data of the associated relationship network, and judge whether the user behavior is a risky behavior based on the network risk data. If the user behavior is a risky behavior, the corresponding risk warning information is output. The network risk data is used to characterize the network risk level of the associated relationship network.

[0013] In a third aspect, an embodiment of the present invention further provides a computer device, the device comprising:

[0014] one or more processors;

[0015] A storage device for storing one or more programs;

[0016] When the one or more programs are executed by the one or more processors, the one or more processors implement the user behavior perception method provided by any embodiment of the present invention.

[0017] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements a user behavior perception method as provided in any embodiment of the present invention.

[0018] The embodiment of the present invention obtains user behavior data, which is used to characterize the behavior performed by the user; associates the user behavior data with a constructed relationship network, determines an associated relationship network associated with the user behavior data, and the relationship network includes at least one user; determines network risk data of the associated relationship network, and determines whether the user behavior is a risky behavior based on the network risk data. If the user behavior is a risky behavior, outputs corresponding risk warning information, and can associate the user to a pre-constructed relationship network based on the user behavior, and determine whether the user behavior is a risky behavior based on the associated relationship network associated with the user, thereby timely determining the user's behavior attributes, realizing pre-emptive risk control of cheating users, and ensuring the user experience of normal users. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 is a flow chart of a user behavior perception method provided by Embodiment 1 of the present invention;

[0020] Figure 2 is a flow chart of a user behavior perception method provided by Embodiment 2 of the present invention;

[0021] Figure 3a is a schematic diagram of a user behavior perception method provided by Embodiment 3 of the present invention;

[0022] Figure 3b is a structural diagram of a user behavior perception system provided by Embodiment 3 of the present invention;

[0023] Figure 4 is a structural diagram of a user behavior perception device provided by Embodiment 4 of the present invention;

[0024] Figure 5 It is a structural diagram of a computer device provided in Embodiment 5 of the present invention. DETAILED DESCRIPTION

[0025] The present invention will be further described in detail below in conjunction with the accompanying drawings and embodiments. It is to be understood that the specific embodiments described herein are only used to explain the present invention, rather than to limit the present invention. It should also be noted that, for ease of description, only parts related to the present invention, rather than all structures, are shown in the accompanying drawings.

[0026] Embodiment 1

[0027] Figure 1This is a flow chart of a user behavior perception method provided in the first embodiment of the present invention. This embodiment is applicable to situations where risk assessment of user behavior is performed, and is particularly applicable to situations where risk control of user cheating behavior is performed in an e-commerce trading platform. This method can be executed by a user behavior perception device, and the user behavior perception device can be implemented in software and / or hardware. For example, the user behavior perception device can be configured in a computer device. This embodiment takes an e-commerce trading platform as an example to illustrate the user behavior perception method. Figure 1 As shown, the method includes:

[0028] S110. Obtain user behavior data.

[0029] In order to achieve pre-emptive risk control of user cheating behavior, in this embodiment, the user is associated with the constructed relationship network according to the user's behavior, the associated relationship network associated with the user's behavior is determined, and the user's risk attributes are determined based on the determined associated relationship network, and the user is monitored according to the user's risk attributes.

[0030] In this embodiment, the user behavior data is used to characterize the behavior performed by the user. Optionally, the behavior performed by the user includes user information change behavior, user browsing behavior and / or user transaction behavior, etc. Correspondingly, the user behavior data includes user information change data, user browsing data and / or user transaction data. Exemplarily, when a new user registers or an existing user needs to change personal information, user information change data is generated based on the user information change behavior. When a user browses items through a terminal device and performs certain operations (such as adding to a shopping cart, favorites, etc.), user browsing data is generated based on the device identification, network identification or browsing operation performed by the user of the terminal device used by the user. When the user has transaction behavior, such as generating a new order or canceling an order, user transaction data is generated based on the user's transaction behavior.

[0031] In one embodiment of the present invention, the obtaining of user behavior data includes:

[0032] Get user operation data;

[0033] Filtering candidate user behavior data that meets the user behavior condition according to the data identifier of the user operation data;

[0034] Perform data standardization processing on the candidate user behavior data to obtain user behavior data.

[0035] Optionally, any operation of the user will generate corresponding user operation data, but some operation data will not affect the user's behavior attributes or change the established relationship network. In this embodiment, it is determined whether the operation data is data that can affect the user's behavior attributes or change the established relationship network based on the data identifier of the operation data. Optionally, a data identifier that meets the user behavior conditions can be pre-set. After obtaining the user operation data, it is determined whether the data identifier of the user operation data is a pre-set data identifier. If the data identifier of the user operation data is a pre-set data identifier, the user operation data is used as candidate user behavior data. If the data identifier of the user operation data is not a pre-set data identifier, the user operation data is filtered to clean the user operation data that does not meet the user behavior conditions.

[0036] Since the data format of the acquired user operation data may be different from the data format required when associating the user, after determining the candidate user behavior data, the candidate user behavior data is standardized according to the pre-set data encoding rules to obtain user behavior data in a unified data format, thereby realizing standardized operations on operation data that meet the user behavior conditions.

[0037] S120: Associating the user behavior data with the constructed relationship network to determine the associated relationship network associated with the user behavior data.

[0038] In this embodiment, the relationship network includes at least one user. Optionally, the association relationship between each user can be determined in advance based on the information of existing users, and all users can be divided into multiple relationship networks based on the association relationship between each user, and each user in each relationship network has a certain association relationship. After obtaining the user behavior data, the association relationship network associated with the user behavior data is determined according to the preset association rules.

[0039] In one embodiment of the present invention, associating the user behavior data with the constructed relationship network according to the user behavior data and the preset association rule to determine the association relationship network associated with the user behavior data includes:

[0040] Extracting first characteristic data of the user from the user behavior data, wherein the first characteristic data includes characteristic data preset to characterize characteristics of the user's personal information;

[0041] For each constructed relationship network, the user's first feature data is matched with the first feature data of each user in the relationship network. If the user's first feature data successfully matches the first feature data of any user in the relationship network, the relationship network is used as the associated relationship network.

[0042] Optionally, strongly associated feature data for representing the association relationship between users can be extracted from the user behavior data, and the strongly associated feature data can be used as the first feature data of the user. Optionally, a feature identifier corresponding to the first feature data can be pre-set, and the first feature data of the user can be determined based on the pre-set feature identifier. In this embodiment, the first feature data of the user includes pre-set feature data for characterizing the characteristics of the user's personal information. Optionally, the user's personal information characteristics can be personal information such as mobile phone number, delivery address, bank card number, etc.

[0043] When user behavior data includes user personal information change data, the user to whom the user behavior data belongs can be associated with the established relationship network based on the user's changed personal information to determine whether the relationship network will change after the user changes his personal information. Generally, when there is an association relationship between the personal information of two users, it is believed that the two users may be the same user or have a certain association. For example, when the bank card numbers of user A and user B are the same, it can be determined that user A and user B are the same user.

[0044] In this embodiment, after obtaining the first characteristic data of the user, the first characteristic data of the user is matched with the first characteristic data of each user in each relationship network. If the first characteristic data of the user successfully matches the first characteristic data of any user in a certain relationship network, it is determined that the user and the user in the relationship network are the same user or have a certain correlation, and the user is divided into the relationship network. It should be noted that different personal characteristic information contained in the first characteristic information of the user may be successfully matched with the personal characteristic information of users in different relationship networks. Therefore, in this embodiment, when the first characteristic information of the user successfully matches the first characteristic information of the user in a certain relationship network, the first characteristic information of the user continues to be matched with the first characteristic information of users in other relationship networks until all relationship networks are matched. Matching the first characteristic information of the user with the first characteristic information of each user in all relationship networks can make the update of the relationship network based on the user's behavior more accurate.

[0045] Exemplarily, assuming that the user's first characteristic information includes a mobile phone number, a delivery address and a bank card number, the user's delivery address is the same as the delivery address of user A in relationship network A, and the user's bank card number is the same as the bank card number of user B in relationship network B, then relationship network A and relationship network B are merged into relationship network C through the user, and the associated relationship network associated with the user behavior data is determined to be relationship network C.

[0046] In this embodiment, the user personal information change data may be the user personal information change data generated by the registration of a new user, or the user personal information change data generated by the change of personal information of an existing user. By associating the user with the association relationship network based on the user personal information change data, the user's behavior attributes can be identified in time after the user changes his personal information, and it can be identified whether the registered user is a real new user, or whether the user whose information has changed is a marked risk user, thereby realizing pre-risk control of cheating users.

[0047] On the basis of the above scheme, the method of associating the user behavior data with the constructed relationship network according to the user behavior data and the preset association rules to determine the association relationship network associated with the user behavior data further includes:

[0048] If the first characteristic data of the user fails to match the first characteristic data of each user in each of the relationship networks, extracting the second characteristic data of the user from the user behavior data, wherein the second characteristic data includes pre-set characteristic data for characterizing user device characteristics and / or user behavior characteristics;

[0049] The similarity between the second characteristic data of the user and the second characteristic data of each user in the relationship network is calculated, and the relationship network whose similarity is greater than a preset similarity threshold is used as the associated relationship network.

[0050] In this embodiment, if the first characteristic data of the user does not match the first characteristic data of each user in each relationship network, the user is associated with the constructed relationship network according to the second characteristic data of the user. Specifically, weakly associated characteristic data used to represent the association relationship between users is extracted from the user behavior data, and the weakly associated characteristic data is used as the second characteristic data of the user. Optionally, a feature identifier corresponding to the second characteristic data can be pre-set, and the second characteristic data of the user can be determined according to the pre-set feature identifier. In this embodiment, the second characteristic data of the user includes pre-set characteristic data for characterizing user equipment and / or user behavior characteristic data. Optionally, the user equipment characteristics can be characteristic information such as terminal characteristics (such as terminal identification) and network characteristics (such as network address) used by the user for browsing. User behavior characteristics can be behavioral characteristics when the user performs browsing behavior or transaction behavior, such as collecting an item, adding it to a shopping cart, purchasing, etc.

[0051] When the user behavior data includes user device feature data and / or user behavior feature data, the user can be associated with the constructed relationship network based on the user device feature data and / or user behavior feature data to determine whether the behavior performed by the user will cause the relationship network to change. When there is an association relationship between the user device feature data and / or user behavior feature data of two users, it is considered that there is a certain association between the two users. Exemplarily, when the user device features of two users are the same, it is determined that there is a certain relationship between the two users. When the similarity between the behavior data features of two users is high, it is determined that the two users have the same behavior features.

[0052] In this embodiment, after obtaining the second characteristic data of the user, the similarity between the second characteristic data of the user and the second characteristic data of each user in each relationship network is calculated according to the preset similarity calculation rule. If the similarity between the second characteristic data of the user and the second characteristic data of any user in a certain relationship network is greater than the preset similarity threshold, it is determined that the user has the same behavioral characteristics as the users in the relationship network, and the user is divided into the relationship network. Optionally, the similarity calculation rule can be a similarity calculation rule such as a cosine similarity algorithm and a Pearson correlation coefficient algorithm. Different similarity thresholds can be set according to different second characteristic data. For example, the similarity threshold corresponding to the user device feature can be set as the first similarity threshold, and the similarity threshold corresponding to the user behavior feature can be set as the second similarity threshold. The first similarity threshold and the second similarity threshold can be the same or different.

[0053] It should be noted that different user device features or user behavior features included in the user's second feature data may be successfully matched with user device features or user behavior features in different relationship networks. Therefore, in this embodiment, when the similarity between the user's second feature data and the second feature data of a user in a certain relationship network is greater than the preset similarity threshold, the similarity between the user's second feature data and the second feature data of users in other relationship networks continues to be calculated until all relationship networks are calculated. Calculating the similarity between the user's second feature data and the second feature data of each user in all relationship networks can make the update of the relationship network based on the user's behavior more accurate.

[0054] Exemplarily, assuming that the user's second feature data includes user device features and user behavior features, the similarity between the user device features and the user device features of user D in relationship network D is greater than the similarity threshold corresponding to the user device features, and the similarity between the user behavior features and the user behavior features of user E in relationship network E is greater than the similarity threshold corresponding to the user behavior features, then relationship network D and relationship network E are merged into relationship network F through the user, and the associated relationship network associated with the user behavior data is determined to be relationship network F.

[0055] S130: Determine network risk data of the associated relationship network, and judge whether the user behavior is a risky behavior based on the network risk data. If the user behavior is a risky behavior, output corresponding risk warning information.

[0056] In this embodiment, the network risk data is used to characterize the network risk level of the associated network. Optionally, the network risk data of the user can be determined based on the associated network to which the user belongs, and then the user's behavior attributes can be determined based on the user's network risk data to determine whether the user's behavior is a risky behavior. When the user's behavior is determined to be a risky behavior, the pre-set risk warning information corresponding to the risky behavior is obtained and displayed, so that the monitoring personnel can understand the user's risky behavior in a timely manner and achieve timely control of the cheating operation of the cheating user. Exemplarily, the correspondence between the network risk data and the behavior attributes can be pre-set. After determining the user's network risk data, the user's behavior attributes are determined based on the pre-set correspondence, and whether the user's behavior is a risky behavior is determined based on the determined behavior attributes.

[0057] Optionally, determine whether the user behavior is risky behavior based on network risk data, and if the user behavior is risky behavior, output corresponding risk warning information, including: monitoring the behavior of each user according to the user's personal risk data, the user's network risk data and pre-set behavior judgment rules, and if it is detected that the user's behavior is a preset risky behavior, output risk warning information.

[0058] In this embodiment, a monitoring risk threshold and a user monitoring rule may be set. When the user's personal risk data and / or network risk data is higher than the preset monitoring risk threshold, the user's behavior is monitored using the behavior judgment rule.

[0059] It can be understood that when the user is a newly registered user, or the user has no historical behavior data, the network risk data of the associated network to which the user belongs will be used as the network risk data of the user. When the user has historical behavior data, the network risk data of the associated network can be updated based on the user's risk characteristic data, and the updated network risk characteristic data will be used as the network risk data of the user.

[0060] In one embodiment of the present invention, the determining of the network risk data of the association relationship network includes:

[0061] The network risk data of the association relationship network is determined according to the risk characteristic data of each user in the association relationship network, wherein the risk characteristic data is used to characterize the risk parameters of user behavior.

[0062] Optionally, after determining the associated relationship network to which the user belongs, the users included in the associated relationship network are updated at the same time, and the network risk data of the associated relationship network can be determined based on the risk characteristic data of each user included in the updated associated relationship network. The risk characteristic data may include characteristic data of risk parameters of the user characterizing the user behavior that are pre-set. The risk characteristic data may be user behavior characteristic data, such as user browsing behavior, transaction behavior and other characteristic data, and may also include other characteristic data.

[0063] In this embodiment, the network risk calculation rules can be pre-set, and the network risk data of the associated network can be calculated based on the risk characteristic data of each user in the associated network. It is also possible to use a deep learning algorithm, by marking training samples, train a network risk data model for calculating network risk data based on the marked training samples and the pre-built neural network architecture, and determine the network risk data of the associated network based on the trained network risk data model.

[0064] In one embodiment of the present invention, determining the network risk data of the association relationship network according to the risk characteristic data of each user in the association relationship network includes:

[0065] The risk characteristic data of each user in the association relationship network is input into a well-trained network risk data model to obtain the network risk data output by the network risk data model.

[0066] Optionally, the risk characteristic data of each user in the associated relationship network can be input into a well-trained network risk data model to obtain network risk data output by the network risk data model, and the network risk data output by the network risk model is used as the network risk data of the associated relationship network. Optionally, the network risk data can be a network risk score.

[0067] The embodiment of the present invention obtains user behavior data; associates the user behavior data with a constructed relationship network, determines an associated relationship network associated with the user behavior data, and the relationship network includes at least one user; determines network risk data of the associated relationship network, and determines whether the user behavior is a risky behavior based on the network risk data. If the user behavior is a risky behavior, corresponding risk warning information is output, and the user can be associated with the pre-constructed relationship network according to the user behavior, and whether the user behavior is a risky behavior according to the associated relationship network associated with the user is determined, and the user's behavior attributes are determined in time, so as to realize pre-risk control of cheating users and ensure the user experience of normal users.

[0068] On the basis of the above scheme, the method further comprises:

[0069] For each user, the user's business authority is determined based on pre-set business conditions, the user's personal risk data, and the user's network risk data. When it is detected that the user initiates a business access request, the business interface corresponding to the business authority is displayed to the user, wherein the personal risk data is used to characterize the user's personal risk level.

[0070] In this embodiment, for each business, a business condition for participating in the business can be pre-set, and the business authority of the user is determined based on the pre-set business condition, the user's personal risk data, and the user's network risk data. Wherein, the user's personal risk data represents the user's personal risk level. Optionally, for each user, the user's personal risk data is determined according to the user's risk feature data and the pre-set personal risk data calculation rules. Wherein, the personal risk data can be the user's personal risk score. Optionally, the business condition for participating in the business can be set to be that the user's personal risk data is lower than the preset personal risk data threshold and the user's network risk data is lower than the preset network risk data threshold. The correspondence between personal risk data, network risk data and business authority can also be set, and the user's business authority is determined according to the pre-set correspondence table. Set corresponding business conditions for each business, determine the user's business authority based on the set business conditions and the user's risk data, and when a business access request initiated by the user is detected, determine the business interface displayed to the user according to the user's business authority, which can achieve pre-risk control of cheating users, ensure that normal users can participate in the business normally, and improve the user experience of normal users.

[0071] For example, the service conditions of service A can be set to personal risk data lower than 5 and network risk data lower than 8. If the personal risk data of user A is 4 and the network risk data is 6, user A is determined to have the authority to participate in service A, and the service A participation interface is displayed to user A. If the personal risk data of user B is 4 and the network risk data is 9, user B is determined not to have the authority to participate in service A, and the service A participation interface is hidden from user B, or a corresponding prompt message is popped up when user B participates in service A.

[0072] On the basis of the above scheme, the method further comprises:

[0073] Collect statistics on user behavior data at regular intervals, and generate user behavior reports based on the user behavior data, the user's personal risk data, and / or the user's network risk data, so as to analyze the user's risk behavior based on the user behavior reports.

[0074] Optionally, the behavior data of users with higher risk data or for each user can be counted regularly to generate a user behavior report containing user behavior data, user personal risk data and user network risk data, so that monitoring personnel can understand user behavior in a timely manner. It is also possible to count the proportion of behaviors with higher risk data among all users regularly, generate corresponding user behavior reports, and adjust user monitoring strategies based on the user behavior reports.

[0075] Embodiment 2

[0076] Figure 2 is a flow chart of a user behavior perception method provided by the second embodiment of the present invention. This embodiment is further optimized on the basis of the above embodiment. Figure 2 As shown, the method includes:

[0077] S210: Obtain historical behavior data of multiple users.

[0078] In this embodiment, a relationship network is pre-built based on the user's historical behavior data, wherein the user's historical behavior data may include the user's historical personal information data, the user's historical browsing data and / or the user's historical transaction data.

[0079] S220: Construct at least one relationship network based on the historical behavior data, where each relationship network includes users with the same behavior characteristics.

[0080] In this embodiment, the user historical behavior data is analyzed to construct at least one relationship network, wherein each relationship network contains users with the same behavior characteristics. It should be noted that for each relationship network, two users in the relationship network have the same behavior characteristics, but all users in the relationship network may not have uniform behavior characteristics. For example, if the relationship network contains user A, user B, user C, and user D, there may be a situation where any of the personal information data of user A and user B is the same, the historical transaction data of user C and user D are highly similar, and the historical browsing data of user A and user C are highly similar, but users A, user B, user C, and user D do not have uniform behavior characteristics.

[0081] In one embodiment of the present invention, constructing at least one relationship network according to the historical behavior data includes:

[0082] Extracting the historical first characteristic data of each user from the historical behavior data of each user, and dividing the users matching the historical first characteristic data into the same relationship network, wherein the historical first characteristic data includes characteristic data preset to characterize the characteristics of the historical personal information of the user;

[0083] The historical second feature data of each user is extracted from the historical behavior data of each user, the similarity between users is calculated based on the historical second feature data, and the relationship network is merged according to the user combination whose similarity is greater than a preset similarity threshold. The historical second feature data includes pre-set feature data for characterizing the user's historical device characteristics and / or the user's historical behavior characteristics.

[0084] Optionally, a relationship network may be constructed based on the user's historical first feature data and historical second feature data. The historical first feature data includes feature data pre-set to characterize the user's historical personal information features, and the historical second feature data includes feature data pre-set to characterize the user's historical device features and / or the user's historical behavior features. For more detailed information about the historical first feature data and the historical second feature data, please refer to the specific content of the first feature data and the second feature data in the above embodiment, which will not be repeated here.

[0085] In this embodiment, each relationship network with the same strong correlation feature is first constructed through the user's historical first feature data, and then the similarity between the weak correlation features of each user is analyzed based on the user's second feature data, and each relationship network is merged based on the similarity between the weak correlation features of each user. The relationship network is constructed based on the user's historical first feature data and the user's historical second feature data, so that the construction of the relationship network is more accurate, and then the user behavior attribute judgment based on the relationship network is more accurate.

[0086] Specifically, the historical first feature data of the user is extracted from the historical behavior data of the user. If any data in the first feature data of two users is the same, it is determined that the first feature data of the two users match, and the two users are divided into the same relationship network. Exemplarily, if the historical first feature data of user A is {mobile phone number: a, collection address: b, bank card number: c}, and the historical first feature data of user B is {mobile phone number: d, collection address: e, bank card number: c}, then the bank card number of user A is the same as the bank card number of user B, then it is determined that the first feature data of user A and user B match, and user A and user B are divided into the same relationship network.

[0087] After constructing a relationship network based on the historical first feature data of each user, the similarity between users is calculated based on the historical second feature data of each user, and a user combination whose similarity is greater than a preset similarity threshold is determined, and the relationship networks to which each user in the user combination belongs are merged to obtain a merged relationship network. Exemplarily, if the similarity between the historical second feature data of user H and the historical second feature data of user I is higher than the preset similarity threshold, the relationship network to which user H belongs is relationship network M, and user I belongs to relationship network N, then relationship network M and relationship network N are merged to obtain a merged relationship network K. In this embodiment, the method for calculating the similarity between the historical second feature data of each user can be referred to the above embodiment, and will not be repeated here.

[0088] S230: For each relationship network, determine network risk data of the relationship network according to risk characteristic data of users included in the relationship network.

[0089] After building a relationship network based on the user's historical behavior data, the network risk data of each relationship network is calculated. Optionally, the network risk data of the relationship network is calculated based on the pre-set network risk data calculation rules and the risk characteristic data of each user in the relationship network. A deep learning algorithm can also be used to build a network risk data model to determine the network risk data of the relationship network. In this embodiment, a more detailed scheme for determining the network risk data of the relationship network can be found in the above embodiment, which will not be repeated here.

[0090] S240: Obtain user behavior data.

[0091] S250: Associating the user behavior data with the constructed relationship network to determine the associated relationship network associated with the user behavior data.

[0092] S260: Determine network risk data of the associated relationship network, and judge whether the user behavior is a risky behavior based on the network risk data. If the user behavior is a risky behavior, output corresponding risk warning information.

[0093] The technical solution of the embodiment of the present invention adds an operation of constructing a relationship network based on the user's historical behavior data on the basis of the above embodiment. By constructing a relationship network including users with the same behavior characteristics through the user's historical behavior data, the construction of the relationship network is more accurate, and the judgment of the user behavior attributes based on the constructed network is further accurate.

[0094] Embodiment 3

[0095] Figure 3aSchematic diagram of a user behavior perception method provided by Embodiment 3 of the present invention. This embodiment provides a preferred embodiment based on the above embodiment. Optionally, the user behavior perception method provided by this embodiment can be executed by a user behavior perception system. Figure 3b is a schematic diagram of the structure of a user behavior perception system provided by Embodiment 3 of the present invention. Figure 3b As shown, the user behavior perception system includes a data layer 310, a core layer 320 and a processing layer 330, and the three layers communicate with each other through interfaces or message queues.

[0096] Among them, the data layer 310 is all kinds of data that the system needs to access, mainly including offline data, real-time data, streaming data and external data. The data layer is the foundation of the entire system, and the relationship network is built based on such huge and multi-dimensional data. The core layer 320 is mainly divided into three parts: offline network construction, real-time network detection and configuration management. The offline network construction module mainly divides all users into different relationship networks from multiple dimensions, such as mobile phone number, IP address, delivery address, bank card, and device fingerprint based on the data of the data layer, and scores each relationship network according to the user's historical risk score. The real-time network detection module mainly collects the user behavior data of concern, and associates it with the offline relationship network in real time to obtain the user's risk score. Configuration management mainly provides the configuration management function of the entire system, so as to tune the entire system. The processing layer 430 mainly provides the ability of risk perception and subsequent processing. If the system detects that a user is at risk, the corresponding processing layer submodule is called according to the configuration for subsequent processing. The processing layer submodule is mainly divided into a monitoring system, a reporting system, a large screen monitoring, a workbench, and a notification system. The monitoring system is used to monitor users according to the set monitoring rules, and the reporting system is used to generate reports at regular intervals. The large-screen monitoring is used to display monitoring results, and the workbench is used to receive information input by monitoring personnel or to display monitoring information to monitoring personnel. The notification system is used for communication and data transmission between systems.

[0097] like Figure 3a As shown, the method includes:

[0098] S310: Perform association analysis based on user mobile phone numbers, network addresses, delivery addresses, device IDs, bank card information, and other information, and divide all users into relationship networks.

[0099] Considering the huge number of users in the e-commerce platform, we can use an offline method to calculate the association between users and divide all users into relationship networks, each of which contains at least one user. After that, we only need to perform incremental updates regularly to update the constructed relationship network according to the user behaviors sent later.

[0100] S320: Score each relationship network according to the risk characteristics of the users in each network to obtain a network risk score for each relationship network.

[0101] Optionally, the network risk score of each relationship network can be calculated by training a complete network scoring model. It is understandable that the main factor affecting the score of each network is the users who have cheated in the past.

[0102] S330. Receive all user information changes, user operation behavior data, and user transaction data in real time through message queues, and perform data processing.

[0103] In this embodiment, after receiving changes in user information, user operation behavior data, and user transaction data, irrelevant data is filtered according to the system configuration, data that does not meet the requirements is cleaned and standardized, sensitive data is desensitized, and S340 is executed.

[0104] S340: Push the processed data to the offline network construction module.

[0105] The user behavior perception system pushes the real-time received user information changes, user operation behavior data or user transaction data to the offline network construction module in an asynchronous manner, so that the offline network construction module updates the relationship network in the background.

[0106] S350: Associating the processed data with the constructed relationship network.

[0107] After basic data processing, the user behavior perception system associates the data with the constructed relationship network.

[0108] S360: Determine whether the current user is associated with an existing relationship network.

[0109] Based on the association results, determine whether the user behavior associates the user with an existing relationship network or causes a change in the established relationship network. The user behavior perception system mainly determines whether a new connection is established between the user and the established relationship network due to the currently received data. If the change in user information, user operation behavior data or user transaction data does not cause a change in the structure of the established relationship network, then the change data is deemed invalid data, and the user behavior perception system will not have any subsequent operations. Execute S380. On the other hand, if the change in user information, user operation behavior data or user transaction data causes a change in the structure of the established relationship network, execute S370.

[0110] S370: Obtain the network risk score of the current user through the network risk score of the relationship network to which the current user belongs, and call the corresponding processing layer to perform functional processing according to the network risk score of the user and the configuration.

[0111] After determining the relationship network to which the current user belongs, the risk score of the relationship network to which the current user belongs can be used to obtain the risk score of the current user, and the corresponding processing layer can be called for functional processing based on the user's risk score and configuration, thereby achieving monitoring, alarming, and notifying corresponding operators of risky users.

[0112] S380, end.

[0113] The embodiment of the present invention constructs a relationship network offline based on multiple dimensions such as user history data, behavior history data, and transaction history data. As long as certain behaviors of unknown users occur, such as logging in with different IP addresses, updating personal information, binding bank cards, adding new delivery addresses, etc., the system will associate the unknown user behavior data with the existing relationship network in real time. If the behavior data of an unknown user can be used to associate this user with existing risky users, then it can be considered that this unknown user is very likely to be a risky user and may cheat in the future. Such users will be marked and monitored, and for some business scenarios, such users may not even be allowed to participate. The offline relationship network construction and real-time relationship network detection are applied to the anti-cheating system for e-commerce transactions to achieve pre-risk control of cheating users.

[0114] Embodiment 4

[0115] Figure 4 Schematic diagram of the structure of a user behavior perception device provided by the fourth embodiment of the present invention. The user behavior perception device can be implemented in software and / or hardware, for example, the user behavior perception device can be configured in a computer device. Figure 4 As shown, the device includes a behavior data acquisition module 410, an associated network determination module 420 and a risk warning output module 430, wherein:

[0116] The behavior data acquisition module 410 is used to acquire user behavior data, where the user behavior data is used to characterize the behavior performed by the user;

[0117] An associated network determination module 420 is used to associate the user behavior data with the established relationship network, and determine an associated relationship network associated with the user behavior data, wherein the relationship network includes at least one user;

[0118] The risk warning output module 430 is used to determine the network risk data of the associated relationship network, and judge whether the user behavior is a risky behavior based on the network risk data. If the user behavior is a risky behavior, the corresponding risk warning information is output. The network risk data is used to characterize the network risk level of the associated relationship network.

[0119] The embodiment of the present invention obtains user behavior data through a behavior data acquisition module, and the associated network determination module associates the user behavior data with the constructed relationship network to determine the associated relationship network associated with the user behavior data. The risk warning output module determines the network risk data of the associated relationship network, and judges whether the user behavior is a risky behavior based on the network risk data. If the user behavior is a risky behavior, the corresponding risk warning information is output. The user can be associated with the pre-constructed relationship network according to the user behavior, and whether the user behavior is a risky behavior can be judged according to the associated relationship network associated with the user. The user's behavior attributes are determined in time, and the pre-risk control of cheating users is realized, and the user experience of normal users is guaranteed.

[0120] Based on the above solution, the associated network determination module 420 is specifically used to:

[0121] Extracting first characteristic data of the user from the user behavior data, wherein the first characteristic data includes characteristic data preset to characterize characteristics of the user's personal information;

[0122] For each constructed relationship network, the user's first feature data is matched with the first feature data of each user in the relationship network. If the user's first feature data successfully matches the first feature data of any user in the relationship network, the relationship network is used as the associated relationship network.

[0123] Based on the above solution, the associated network determination module 420 is specifically used to:

[0124] If the first characteristic data of the user fails to match the first characteristic data of each user in each of the relationship networks, extracting the second characteristic data of the user from the user behavior data, wherein the second characteristic data includes pre-set characteristic data for characterizing user device characteristics and / or user behavior characteristics;

[0125] The similarity between the second characteristic data of the user and the second characteristic data of each user in the relationship network is calculated, and the relationship network whose similarity is greater than a preset similarity threshold is used as the associated relationship network.

[0126] Based on the above solution, the risk warning output module 430 is specifically used for:

[0127] The network risk data of the association relationship network is determined according to the risk characteristic data of each user in the association relationship network, wherein the risk characteristic data is used to characterize the risk parameters of user behavior.

[0128] Based on the above solution, the risk warning output module 430 is specifically used for:

[0129] The risk characteristic data of each user in the association relationship network is input into a well-trained network risk data model to obtain the network risk data output by the network risk data model.

[0130] Based on the above solution, the behavior data acquisition module 410 is specifically used for:

[0131] Get user operation data;

[0132] Filtering candidate user behavior data that meets the user behavior condition according to the data identifier of the user operation data;

[0133] Perform data standardization processing on the candidate user behavior data to obtain user behavior data.

[0134] Based on the above solution, the device further includes a relationship network construction module, which is used to:

[0135] Before associating the user behavior data with the constructed relationship network, obtaining historical behavior data of multiple users;

[0136] constructing at least one relationship network according to the historical behavior data, each of the relationship networks comprising users with the same behavior characteristics;

[0137] For each relationship network, the network risk data of the relationship network is determined according to the risk characteristic data of the users included in the relationship network.

[0138] Based on the above solution, the relationship network construction module is specifically used to:

[0139] Extracting the historical first characteristic data of each user from the historical behavior data of each user, and dividing the users matching the historical first characteristic data into the same relationship network, wherein the historical first characteristic data includes characteristic data preset to characterize the characteristics of the historical personal information of the user;

[0140] The historical second feature data of each user is extracted from the historical behavior data of each user, the similarity between the users is calculated based on the historical second feature data, and the relationship network is merged according to the user combination whose similarity is greater than a preset similarity threshold, and the historical second feature data includes pre-set feature data for characterizing the user's historical device characteristics and / or the user's historical behavior characteristics.

[0141] On the basis of the above scheme, the device further comprises:

[0142] The business authority determination module is used to determine the business authority of each user based on pre-set business conditions, the user's personal risk data, and the user's network risk data. When it is detected that the user initiates a business access request, the business interface corresponding to the business authority is displayed to the user, wherein the personal risk data is used to characterize the user's personal risk level.

[0143] On the basis of the above scheme, the device further comprises:

[0144] The behavior report generation module is used to regularly collect statistics on user behavior data, form a user behavior report based on the user behavior data, the user's personal risk data and / or the user's network risk data, and analyze the user's risk behavior based on the user behavior report.

[0145] The user behavior perception device provided in the embodiment of the present invention can execute the user behavior perception method provided in any embodiment, and has the corresponding functional modules and beneficial effects of the execution method.

[0146] Embodiment 5

[0147] Figure 5 It is a structural diagram of a computer device provided in Embodiment 5 of the present invention. Figure 5 A block diagram of an exemplary computer device 512 suitable for use in implementing embodiments of the present invention is shown. Figure 5 The computer device 512 shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0148] like Figure 5 As shown, the computer device 512 is in the form of a general-purpose computing device. The components of the computer device 512 may include, but are not limited to: one or more processors 516, a system memory 528, and a bus 518 that connects various system components (including the system memory 528 and the processor 516).

[0149] Bus 518 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a local bus to processor 516, or a bus structure using any of a variety of bus architectures. These architectures include, by way of example, but are not limited to, an Industry Standard Architecture (ISA) bus, a Micro Channel Architecture (MAC) bus, an Enhanced ISA bus, a Video Electronics Standards Association (VESA) local bus, and a Peripheral Component Interconnect (PCI) bus.

[0150] The computer device 512 typically includes a variety of computer system readable media. These media can be any available media that can be accessed by the computer device 512, including volatile and non-volatile media, removable and non-removable media.

[0151] System memory 528 may include computer system readable media in the form of volatile memory, such as random access memory (RAM) 530 and / or cache memory 532. Computer device 512 may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, storage device 534 may be used to read and write non-removable, non-volatile magnetic media ( Figure 5 not shown, usually called a "hard drive"). Although Figure 5 Not shown, a disk drive for reading and writing to a removable non-volatile disk (e.g., a "floppy disk"), and an optical disk drive for reading and writing to a removable non-volatile optical disk (e.g., a CD-ROM, a DVD-ROM, or other optical media) may be provided. In these cases, each drive may be connected to the bus 518 via one or more data medium interfaces. The memory 528 may include at least one program product having a set (e.g., at least one) of program modules that are configured to perform the functions of the various embodiments of the present invention.

[0152] A program / utility 540 having a set (at least one) of program modules 542 may be stored, for example, in the memory 528, such program modules 542 including, but not limited to, an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment. The program modules 542 generally perform the functions and / or methods of the embodiments described herein.

[0153] The computer device 512 may also communicate with one or more external devices 514 (e.g., keyboard, pointing device, display 524, etc.), may also communicate with one or more devices that enable a user to interact with the computer device 512, and / or communicate with any device that enables the computer device 512 to communicate with one or more other computing devices (e.g., network card, modem, etc.). Such communication may be performed via an input / output (I / O) interface 522. In addition, the computer device 512 may also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN) and / or public network, such as the Internet) via a network adapter 520. As shown, the network adapter 520 communicates with other modules of the computer device 512 via a bus 518. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the computer device 512, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0154] The processor 516 executes various functional applications and data processing by running the program stored in the system memory 528, for example, implementing the user behavior perception method provided in the embodiment of the present invention, which includes:

[0155] Acquire user behavior data, where the user behavior data is used to characterize the behavior performed by the user;

[0156] Associating the user behavior data with the constructed relationship network to determine an associated relationship network associated with the user behavior data, wherein the relationship network includes at least one user;

[0157] Determine the network risk data of the associated relationship network, judge whether the user behavior is a risky behavior based on the network risk data, and if the user behavior is a risky behavior, output corresponding risk warning information, wherein the network risk data is used to characterize the network risk degree of the associated relationship network.

[0158] Of course, those skilled in the art can understand that the processor can also implement the technical solution of the user behavior perception method provided by any embodiment of the present invention.

[0159] Embodiment 6

[0160] Embodiment 6 of the present invention further provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the user behavior perception method provided in the embodiment of the present invention is implemented. The method includes:

[0161] Acquire user behavior data, where the user behavior data is used to characterize the behavior performed by the user;

[0162] Associating the user behavior data with the constructed relationship network to determine an associated relationship network associated with the user behavior data, wherein the relationship network includes at least one user;

[0163] Determine the network risk data of the associated relationship network, judge whether the user behavior is a risky behavior based on the network risk data, and if the user behavior is a risky behavior, output corresponding risk warning information, wherein the network risk data is used to characterize the network risk degree of the associated relationship network.

[0164] Of course, the computer-readable storage medium provided by an embodiment of the present invention stores a computer program which is not limited to the method operations described above, but can also execute related operations in the user behavior perception method provided by any embodiment of the present invention.

[0165] The computer storage medium of the embodiment of the present invention can adopt any combination of one or more computer-readable media. The computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. The computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples (non-exhaustive list) of computer-readable storage media include: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this document, a computer-readable storage medium can be any tangible medium containing or storing a program, which can be used by an instruction execution system, device or device or used in combination with it.

[0166] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, which carry computer-readable program code. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0167] Program code embodied on a computer readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0168] Computer program code for performing the operations of the present invention may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0169] Note that the above are only preferred embodiments of the present invention and the technical principles used. Those skilled in the art will understand that the present invention is not limited to the specific embodiments described herein, and that various obvious changes, readjustments and substitutions can be made by those skilled in the art without departing from the scope of protection of the present invention. Therefore, although the present invention has been described in more detail through the above embodiments, the present invention is not limited to the above embodiments, and may include more other equivalent embodiments without departing from the concept of the present invention, and the scope of the present invention is determined by the scope of the appended claims.

Claims

1. A method for perceiving user fraudulent transaction behavior, characterized in that: include: Acquire user behavior data, where the user behavior data is used to characterize the behavior performed by the user; Associating the user behavior data with the constructed relationship network to determine associated relationship networks associated with the user behavior data, each of the relationship networks containing users with the same behavior characteristics; Determine network risk data of the associated relationship network, determine whether the user behavior is a fraudulent transaction behavior based on the network risk data, and if the user behavior is a fraudulent transaction behavior, output corresponding risk warning information, wherein the network risk data is used to characterize the network risk degree of the associated relationship network; The step of associating the user behavior data with the constructed relationship network to determine the associated relationship network associated with the user behavior data includes: Extracting first characteristic data of the user from the user behavior data, wherein the first characteristic data includes characteristic data preset to characterize characteristics of the user's personal information, and the user's personal information characteristics include personal information change data; For each established relationship network, the first characteristic data of the user is matched with the first characteristic data of each user in the relationship network. If the first characteristic data of the user successfully matches the first characteristic data of any user in the relationship network, the relationship network is used as the associated relationship network; If the first characteristic data of the user fails to match the first characteristic data of each user in each of the relationship networks, extracting the second characteristic data of the user from the user behavior data, wherein the second characteristic data includes pre-set characteristic data for characterizing user device characteristics, user browsing behavior characteristics, and user transaction behavior characteristics; The similarity between the second characteristic data of the user and the second characteristic data of each user in the relationship network is calculated, and the relationship network whose similarity is greater than a preset similarity threshold is used as the associated relationship network.

2. The method according to claim 1, characterized in that The determining of the network risk data of the association relationship network includes: The network risk data of the association relationship network is determined according to the risk characteristic data of each user in the association relationship network, wherein the risk characteristic data is used to characterize the risk parameters of user behavior.

3. The method according to claim 2, characterized in that The determining the network risk data of the association relationship network according to the risk characteristic data of each user in the association relationship network includes: The risk characteristic data of each user in the association relationship network is input into a well-trained network risk data model to obtain the network risk data output by the network risk data model.

4. The method according to claim 1, characterized in that The obtaining of user behavior data includes: Get user operation data; Filtering candidate user behavior data that meets the user behavior condition according to the data identifier of the user operation data; Perform data standardization processing on the candidate user behavior data to obtain user behavior data.

5. The method according to claim 1, characterized in that Before associating the user behavior data with the established relationship network, it also includes: Get historical behavior data of multiple users; constructing at least one relationship network based on the historical behavior data; For each relationship network, the network risk data of the relationship network is determined according to the risk characteristic data of the users included in the relationship network.

6. The method according to claim 5, characterized in that The step of constructing at least one relationship network according to the historical behavior data includes: Extracting the historical first characteristic data of each user from the historical behavior data of each user, and dividing the users matching the historical first characteristic data into the same relationship network, wherein the historical first characteristic data includes characteristic data preset to characterize the characteristics of the historical personal information of the user; The historical second feature data of each user is extracted from the historical behavior data of each user, the similarity between the users is calculated based on the historical second feature data, and the relationship network is merged according to the user combination whose similarity is greater than a preset similarity threshold, and the historical second feature data includes pre-set feature data for characterizing the user's historical device characteristics and / or the user's historical behavior characteristics.

7. The method according to any one of claims 1 to 6, characterized in that: Also includes: For each user, the user's business authority is determined based on pre-set business conditions, the user's personal risk data, and the user's network risk data. When it is detected that the user initiates a business access request, the business interface corresponding to the business authority is displayed to the user, wherein the personal risk data is used to characterize the user's personal risk level.

8. The method according to any one of claims 1 to 6, characterized in that: Also includes: Collect statistics on user behavior data at regular intervals, and generate user behavior reports based on the user behavior data, the user's personal risk data, and / or the user's network risk data, so as to analyze the user's risk behavior based on the user behavior reports.

9. A device for sensing user fraudulent transaction behavior, characterized in that: include: A behavior data acquisition module, used to acquire user behavior data, wherein the user behavior data is used to characterize the behavior performed by the user; An associated network determination module, used to associate the user behavior data with the constructed relationship network, and determine the associated relationship network associated with the user behavior data, each of which contains users with the same behavior characteristics; A risk warning output module, used to determine the network risk data of the associated relationship network, determine whether the user behavior is a fraudulent transaction behavior based on the network risk data, and output corresponding risk warning information if the user behavior is a fraudulent transaction behavior, wherein the network risk data is used to characterize the network risk degree of the associated relationship network; Wherein, the associated network determination module is specifically used for: Extracting first characteristic data of the user from the user behavior data, wherein the first characteristic data includes characteristic data preset to characterize characteristics of the user's personal information, and the user's personal information characteristics include personal information change data; For each established relationship network, the first characteristic data of the user is matched with the first characteristic data of each user in the relationship network. If the first characteristic data of the user successfully matches the first characteristic data of any user in the relationship network, the relationship network is used as the associated relationship network; If the first characteristic data of the user fails to match the first characteristic data of each user in each of the relationship networks, extracting the second characteristic data of the user from the user behavior data, wherein the second characteristic data includes pre-set characteristic data for characterizing user device characteristics, user browsing behavior characteristics, and user transaction behavior characteristics; The similarity between the second characteristic data of the user and the second characteristic data of each user in the relationship network is calculated, and the relationship network whose similarity is greater than a preset similarity threshold is used as the associated relationship network.

10. A computer device, characterized in that: The device comprises: one or more processors; A storage device for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the user fraud transaction behavior perception method as described in any one of claims 1-8.

11. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method for perceiving user fraudulent transaction behavior as described in any one of claims 1 to 8 is implemented.

Images