Multi-perspective network transaction risk identification method based on data Petri net

Abstract

A multi-perspective network transaction risk identification method based on data Petri nets includes the following steps: S100: Based on the e-commerce transaction process flow and transaction data, data Petri nets are used to perform data interaction analysis and formalize modeling of the transaction process; S200: Process mining is used to perform multi-perspective analysis of each activity in the constructed model and identify outliers; S300: A logistic regression model is used to train these outliers to generate a system model capable of identifying transaction risks. This method can dynamically simulate the entire transaction process, clearly observing the trends of user behavior and the status of each activity point. Combining monitoring results from multiple perspectives can better identify potential risks in the transaction process.

Description

Technical Field

[0001] The present disclosure belongs to the field of computer and Internet technology, and particularly relates to a multi-perspective network transaction risk identification framework method based on data Petri nets. Background Art

[0002] Today is an era of digital innovation. With the rapid development of information and network technologies, the business environment is undergoing dynamic changes. The shift from cash-based transactions to electronic ones is an unstoppable trend. E-commerce provides shared resource platforms, including network infrastructure, payment platforms, security platforms, and management platforms, enabling businesses and individuals to conduct online business efficiently and cost-effectively. It has a profound impact on improving social productivity, driving scientific and technological progress, promoting economic and social upgrading and transformation, and creating new economic growth points and employment opportunities.

[0003] Existing online transaction risk identification methods require a large amount of historical data as support and lack real-time and process-based capabilities. Therefore, it is extremely necessary to be able to comprehensively, real-timely, and dynamically identify the potential risks of online transactions. Summary of the Invention

[0004] In order to solve the above problems, the present disclosure provides a multi-perspective network transaction risk identification method based on data Petri net, which includes the following steps:

[0005] S100: Based on the e-commerce transaction process flow and transaction data, the transaction process is analyzed and formalized using data Petri nets;

[0006] S200: Use process mining to analyze each activity in the model from multiple perspectives and identify anomalies;

[0007] S300: Using a logistic regression model to train the abnormal points to obtain a system model capable of identifying transaction risks.

[0008] Through the above technical solution, this method can dynamically simulate the entire transaction process, clearly observe the direction of user behavior and the situation of each activity point, and combine the monitoring results from multiple perspectives to better identify possible risks in the transaction process. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] Figure 1 This is a flow chart of a multi-perspective network transaction risk identification method based on data Petri nets provided in one embodiment of the present disclosure;

[0010] Figure 2 This is a diagram of the resource interaction process in an e-commerce transaction provided in one embodiment of the present disclosure;

[0011] Figure 3 is a prototype Petri net model in ProM Lite in one embodiment of the present disclosure;

[0012] Figure 4 It is a DPN model of the e-commerce transaction process in one embodiment of the present disclosure;

[0013] Figure 5 It is a partial DPN model in ProM Lite in one embodiment of the present disclosure;

[0014] Figure 6 is a framework diagram of a multi-view detection system in one embodiment of the present disclosure;

[0015] Figure 7 This is an example diagram of control flow analysis results in one embodiment of the present disclosure;

[0016] Figure 8 This is an example diagram of throughput time analysis results in one embodiment of the present disclosure;

[0017] Figure 9 This is a resource analysis result diagram in one embodiment of the present disclosure;

[0018] Figure 10 is a diagram of user behavior pattern mining and detection in one embodiment of the present disclosure;

[0019] Figure 11 This is a data flow analysis result diagram in one embodiment of the present disclosure;

[0020] Figure 12 2 is a diagram of cross-validation results in one embodiment of the present disclosure. DETAILED DESCRIPTION

[0021] In one embodiment, Figure 1 As shown, the present disclosure provides a multi-perspective network transaction risk identification method based on data Petri net, which includes the following steps:

[0022] S100: Based on the e-commerce transaction process flow and transaction data, the transaction process is analyzed and formalized using data Petri nets;

[0023] S200: Use process mining to analyze each activity in the model from multiple perspectives and identify anomalies;

[0024] S300: Using a logistic regression model to train the abnormal points to obtain a system model capable of identifying transaction risks.

[0025] In this embodiment, concepts such as transitions and places in Petri Nets (PN) can effectively describe various behaviors, resources, and their dynamic collaborative relationships within a process. They are well-suited for common phenomena in complex systems, such as synchronization, concurrency, distribution, conflict, and resource sharing. Therefore, the Petri Net model has been introduced into online transaction risk identification.

[0026] This method combines the relevant definitions and triggering rules of DPN and proposes a method for constructing a risk identification model for e-commerce transactions. This method then dynamically simulates the constructed model and analyzes and monitors the entire e-commerce transaction process. A machine learning algorithm is then used to train the combinations of outliers identified through multi-perspective analysis, ultimately resulting in a model for identifying online transaction risks.

[0027] The method for constructing a network transaction risk identification model involves first establishing the overall transaction process flow and building a prototype Petri net model. This prototype Petri net model is then expanded into a DPN model based on the data interactions and rules between activities. This method dynamically simulates the entire transaction process, clearly observing the trends and anomalies of each activity during the transaction. Furthermore, by combining detection results from multiple perspectives, it can better identify potential risks within the transaction process.

[0028] In another embodiment, step S100 further includes the following steps:

[0029] S101: Establish e-commerce transaction process flow and build a prototype Petri net model;

[0030] S102: Expand the prototype Petri net model into a data Petri net model according to the data interactions and rules between activities.

[0031] For this embodiment, Figure 2 It shows that e-commerce transactions are a process of multi-party data exchange. We can see that buyers will browse, select, and perform a series of operations on the e-commerce platform to purchase goods or services. Buyers (Buyer), e-commerce platforms (BSC), and sellers (Seller) interact with each other. Information on users, merchants, orders, etc. are all stored in the background database of the platform system. The platform integrates the third-party payment SDK (TP) released by the third-party cashier. In third-party payment, the user chooses a payment method to pay the cashier server (CS). The cashier server will record the payment information, notify the merchant that the payment is completed, and record it in the cashier's background server. Among them, Binfo is the buyer's personal information table, OPT is the current behavior mode, order CIt only contains order information related to the merchant (for example, the type and quantity of goods the user wants to buy), Minfo is the merchant's information, order F It is the formal order information (including order ID, amount and other detailed order information), TN is the unique mark generated by the cash register server corresponding to the current order transaction, NTF represents the payment completion notification information, and BSinvoice is the invoice information, which contains the transaction information of the buyer and seller.

[0032] In another embodiment, step S101 further includes the following step: using a process mining tool ProM Lite to process event log data of the e-commerce transaction process flow to obtain a prototype Petri net model.

[0033] For this example, ProM Lite was used to process Figure 2 The event log of the e-commerce transaction process flow is obtained Figure 3 The prototype Petri net model shown in Figure 1 is constructed based on this and according to the data interaction. Figure 4 The data Petri net model shown in Figure 1 is a 3D data model. Its transitions, meanings, resources, and variable values ​​are detailed in Tables 1, 2, and 3. Table 1 shows the variable definitions and meanings in the model, Table 2 shows the transitions and resources in the Petri net, and Table 3 shows the data interactions in the model. Figure 5 Part of the DPN model built in ProM Lite is shown.

[0034] variable Variable meaning illustrate V0 Completeness_status User information completeness V1 Credit_score Credit rating V2 Password Valid password V2’ Password_1 Enter password in real time V3 Goods_id Product ID before payment V3’ Goods_id_1 Product ID after payment V4 Goods_type Product category before payment V4’ Goods_type_1 Product category after payment V5 Intention to sell Agree to sale V6 Notify_url_address Notification URL V7 Total_amount Total amount before payment V7 Total_amount_1 Total amount after payment V8 Payment_status Payment Status V9 Address Address before payment V9’ Address_1 Address after payment V10 Transaction_number Transaction Code V10’ Transaction_number_1 Enter transaction code V11 TN(CS_signature_status) Cash register server signature V12 TN(S_signature_status) Seller's signature V13 TN(B_signature_status) Buyer's signature V14 CS_finish Payment Signature V15 LoginIP Login IP address V16 LoginDT Login location V17 Current behavior Real-time trading behavior V18 Similarity_behavior Behavior detection similarity

[0035] Table 1

[0036]

[0037]

[0038] Table 2

[0039]

[0040]

[0041] Table 3

[0042] In another embodiment, step S200 further includes the following steps:

[0043] S201: Cleaning and mining the historical event log data of the e-commerce transaction process flow to obtain a user behavior pattern library;

[0044] S202: Using process mining to perform consistency detection analysis from the perspectives of control flow, resources, and throughput time to obtain a user outlier detection dataset;

[0045] S203: From a data flow perspective, the user behavior pattern library is used to perform detection analysis including a user behavior pattern matching function to obtain a user anomaly detection dataset.

[0046] In this embodiment, according to Figure 6 As shown in the figure, the method can be mainly divided into three parts: cleaning event log data and obtaining a user behavior pattern library; multi-perspective consistency verification of process mining including control flow, resources, throughput time, and data flow analysis based on data Petri nets including user pattern matching function.

[0047] In another embodiment, the process mining in step S200 uses a process mining tool ProM Lite.

[0048] In this embodiment, process mining builds an important bridge between data mining and business process management and is widely used to monitor the operation of business processes in real time. We intend to use the process mining tool ProM Lite as a secondary development experimental platform. This software provides a large number of plug-ins. Plug-ins such as Reply a Log on Petri Net for Conformance Analysis, Replay a Log for Performance / Conformance Analysis, Multi-Perspective Explorer, and Conformance Checking of DPN are used to detect control flow, time flow, resource flow, and data flow from multiple perspectives of the process flow. A full-sequence pattern matching algorithm is used for user static attribute data, while dynamic user attribute data is used. Finally, the user anomaly detection feature points obtained from multi-perspective detection are used as a dataset. Using Python programming tools, a logistic regression model is trained to obtain a classification model that can make judgments based on the event logs of the current transaction, thereby achieving the goal of determining whether a user has an anomaly.

[0049] In another embodiment, the detection and analysis from the control flow perspective in step S202 is performed using compliance checking in ProM Lite.

[0050] In this embodiment, control flow analysis is performed using conformance checking. Its goal is to find the commonalities and differences between the modeled behavior and the observed behavior. Deviations from the model often indicate anomalies. The results of using the reply alog on Petri Net for conformance analysis plug-in to complete the control flow detection are as follows: Figure 7 As shown in the figure, Alignment represents the control flow consistency test results of the activity sequence. Activities marked with light colors represent normal operations, while dark colors represent situations where the current event log does not match the model.

[0051] In another embodiment, the throughput time perspective detection analysis in step S202 is performed by measuring the time intervals between activities.

[0052] In this example, the time perspective focuses on the time and frequency of the time period. Throughput time analysis is performed by measuring the time interval between activities. If the execution time of a log does not conform to the standard model, it will be marked as an anomaly. The results of the analysis using the plug-in replay a log for performance / conformance analysis are as follows: Figure 8 shown.

[0053] In another embodiment, the detection and analysis of the resource perspective in step S202 is performed using a consistency checker of a property plug-in in ProM Lite.

[0054] In this embodiment, the resource information in the log hides the connections between the various participants. Attackers often commit fraud by invading the system and forging identities. The results of the consistency checker using the property plug-in in ProM Lite are as follows: Figure 9 shown.

[0055] from Figure 9 As can be seen, different activities are completed by different executors and are displayed in different colors. For example, "Unk" indicates an unknown executor, "sel" indicates a seller, "BUY" indicates a buyer, and "BCS" indicates that the executor is the e-commerce platform BCS. We consider cases where the executor is unknown to be suspicious.

[0056] In another embodiment, the detection and analysis from the data stream perspective in step S203 is an analysis of the behavior pattern of the user's real-time input.

[0057] In this embodiment, the data-aware approach provides relevant information for each activity embedded in the process model. Data stored in database tables rather than event logs must be converted into variables that can be analyzed and judged by the DPN using relevant algorithms or functions.

[0058] We use the user's real-time input behavior pattern as one of the criteria for determining whether the current transaction is abnormal or not. Figure 10 This paper describes the principles of user behavior pattern mining and detection. For activity U in the model, which detects user behavior, the input variable is the user's real-time activity sequence. Based on the user's normal behavior pattern set, a similarity matching algorithm is used to match and detect it, obtaining a behavior similarity value V18 and storing it in the event log. Finally, a conformance checking of DPN plug-in is used to match and analyze the event log and the data Petri net. The results are shown in the figure below. Figure 11 shown.

[0059] In another embodiment, step S300 further includes the following step: testing the logistic regression model by cross-validation based on the obtained user abnormal detection point dataset.

[0060] In this embodiment, during the multi-perspective detection process, each perspective provides a conclusion on whether the current transaction is fraudulent. The logistic regression model uses these perspectives' detection conclusions as features. Therefore, this paper obtained 79 anomaly detection features from the data Petri net and data mining process. These features are used to detect whether the current transaction is abnormal from multiple perspectives. These features are used as feature vectors in the logistic regression model. Table 4 shows some of these features and their meanings.

[0061]

[0062] Table 4

[0063] This section uses a user anomaly detection point dataset to test the logistic regression model through cross-validation. The dataset splitting experiment shows that the logistic regression model achieves the best overall performance when the dataset is split at an 8:2 ratio. Therefore, during cross-validation, the dataset is split into five parts, ensuring an 8:2 ratio between the training set and the test set in each round of testing, which improves the model's predictive power.

[0064] Figure 12The figure shows the prediction results of user anomaly detection using a logistic regression model after cross-validation. Three indicators are used in the experiment to evaluate the model performance: precision, recall, and F-score. The leftmost bar represents precision, the middle bar represents recall, and the rightmost bar represents F-score. The figure shows the prediction results of five groups of tests.

[0065] The average values ​​of the five test results were calculated and recorded, as shown in Table 5. Table 5 shows the prediction results of the logistic regression model. As can be seen from the table, the logistic regression model has high accuracy, precision, recall, F-score, and AUC. Therefore, this logistic regression model has high accuracy in predicting whether the current user has an abnormality and is very capable of accurately determining the occurrence of user abnormalities.

[0066] Performance indicators precision recall f-score accuracy AUC average value 0.912 0.833 0.827 0.896 0.935

[0067] Table 5

[0068] Although the embodiments of the present invention have been described above with reference to the accompanying drawings, the present invention is not limited to the above-mentioned specific embodiments and application fields. The above-mentioned specific embodiments are merely illustrative and instructive, and are not restrictive. A person skilled in the art, guided by this specification and without departing from the scope of protection of the claims of the present invention, may also devise various forms, all of which fall within the scope of protection of the present invention.

Claims

1. A multi-perspective network transaction risk identification method based on data Petri nets, comprising the following steps: S100: Based on the e-commerce transaction process flow and transaction data, the prototype Petri net model is expanded into a data Petri net model. Combined with the relevant definitions and triggering rules of the data Petri net model, the data interaction analysis of the transaction process is carried out and formalized modeling is carried out using the data Petri net model. S200: Use process mining to analyze each activity in the model from multiple perspectives and identify anomalies; S300: Using a logistic regression model to train the abnormal points to obtain a system model capable of identifying transaction risks; The step S200 further includes the following steps: S201: Cleaning and mining the historical event log data of the e-commerce transaction process flow to obtain a user behavior pattern library; S202: Using process mining to perform consistency detection analysis from the perspectives of control flow, resources, and throughput time, a user outlier detection dataset is obtained, where: Control flow analysis is performed using compliance checking, with the goal of finding commonalities and differences between modeled and observed behavior. Deviations from the model often indicate anomalies. S203: From a data flow perspective, using the user behavior pattern library, perform detection analysis including a user behavior pattern matching function to obtain a user outlier detection dataset; The step S300 further includes the following steps: testing the logistic regression model by cross-validation based on the obtained user outlier detection dataset; During the multi-view detection process, each view gives a conclusion on whether the current transaction is fraudulent; The logistic regression model uses the detection conclusions of these perspectives as features; These features were used as feature vectors for the logistic regression model.

2. The method according to claim 1, wherein step S100 further comprises the following steps: S101: Establish e-commerce transaction process flow and build a prototype Petri net model; S102: Expand the prototype Petri net model into a data Petri net model according to the data interactions and rules between activities.

3. The method according to claim 1, wherein step S101 further comprises the following step: using a process mining tool ProM Lite to process event log data of the e-commerce transaction process flow to obtain a prototype Petri net model.

4. The method according to claim 1, wherein the process mining in step S200 adopts the process mining tool ProMLite.

5. According to the method of claim 1, the detection and analysis from the control flow perspective in step S202 is performed using compliance checking in ProMLite.

6. According to the method of claim 1, the detection and analysis of the resource perspective in step S202 is performed using a consistency checker of a property plug-in in ProMLite. 7 . The method according to claim 1 , wherein the throughput time perspective detection and analysis in step S202 is performed by measuring the time interval between activities.

8. The method according to claim 1, wherein the detection and analysis from the data stream perspective in step S203 is an analysis of the behavior pattern of the user's real-time input.

Images