Order identification and processing method, system, device and storage medium

Abstract

The embodiment of the present invention provides an order identification and processing method, system, device and storage medium, wherein the method includes: determining an order of a target type as a suspicious order and putting it into a suspicious order library, updating a record library based on the suspicious order, the record library includes at least one record, and performing periodic processing with a first preset time length, the periodic processing includes: first processing and / or second processing, the first processing includes: deleting a first target record whose storage time in the record library exceeds the first preset time length, determining each suspicious order associated with the user unique identifier included in the first target record as a normal order and deleting it from the suspicious order library, the second processing includes: deleting a second target record whose storage time in the record library does not exceed the first preset time length, determining each suspicious order associated with the user unique identifier included in the second target record as a malicious order and deleting it from the suspicious order library. The present invention realizes accurate identification and processing of malicious orders.

Description

Technical Field

[0001] The present invention relates to the field of data processing, and in particular to an order identification and processing method, system, device and storage medium. Background Art

[0002] With the rise of Internet e-commerce, the number of online transactions generated through product release platforms such as web pages and public accounts is also increasing. However, some malicious users take advantage of the business logic loopholes of e-commerce platforms to conduct malicious order-brushing behaviors, which has an adverse impact on the normal operation of e-commerce platforms.

[0003] The existing identification of malicious orders is usually carried out by identifying information in the order information that can determine the source of the order, such as account information, delivery address, transaction information, etc. And the similarity of the above information that can determine the source of the order in the order information of different orders is judged, so that multiple orders with high similarity are determined as suspicious orders. However, some malicious users obtain a large number of normal users' e-commerce platform accounts through methods such as acquisition and borrowing, and use normal accounts to conduct malicious order-brushing behavior. Due to the low similarity between the account information, delivery address and transaction information of different accounts, the recognition accuracy of the existing order recognition method is reduced. Summary of the invention

[0004] The purpose of the embodiments of the present invention is to provide an order identification and processing method, system, device and storage medium to accurately identify and process malicious orders. The specific technical solution is as follows:

[0005] An order identification and processing method, the method comprising:

[0006] Orders of the target type are determined as suspicious orders and put into a suspicious order library. The record library is updated based on the suspicious orders. The record library includes at least one record, and each record includes: a user unique identifier and the order quantity of the suspicious order associated with the user unique identifier. The suspicious order associated with the user unique identifier is a suspicious order whose order information includes the user unique identifier.

[0007] The periodic processing is performed with a first preset time period as a period, and the periodic processing includes: a first processing and / or a second processing.

[0008] The first processing includes: deleting the first target record that has been stored in the record library for more than the first preset time period, determining each suspicious order associated with the user unique identifier included in the first target record as a normal order and deleting it from the suspicious order library, and the first target record is: a record including an order quantity less than a preset quantity.

[0009] The second processing includes: deleting the second target record whose storage time in the record library is not longer than the first preset time, determining each suspicious order associated with the user unique identifier included in the second target record as a malicious order and deleting it from the suspicious order library, and the second target record is: a record including an order quantity not less than a preset quantity.

[0010] Optionally, the first process further includes:

[0011] The third target record that has existed in the record library for more than the second preset time period is deleted, and each suspicious order associated with the user unique identifier included in the third target record is determined to be a normal order and deleted from the suspicious order library, wherein the third target record is a record in which the order quantity changes within the first preset time period, and within the third preset time period, the order quantity after the change is less than the preset quantity, the starting time of the third preset time period is the ending time of the first preset time period, the starting time of the second preset time period is consistent with the starting time of the first preset time period, the ending time of the second preset time period is later than the ending time of the third preset time period, and the first preset time period is the same as the third preset time period.

[0012] The fourth target record that has existed in the record library for more than the second preset time period is deleted, and each suspicious order associated with the user unique identifier included in the fourth target record is determined to be a malicious order and deleted from the suspicious order library, wherein the fourth target record is a record in which the order quantity changes within the first preset time period, and within the third preset time period, the order quantity after the change is not less than the preset quantity.

[0013] Optionally, the method further includes:

[0014] The user unique identifier corresponding to the malicious order is added to a preset blacklist.

[0015] Optionally, before determining the target type of order as a suspicious order and putting it into the suspicious order database, the method further includes:

[0016] Determine whether the target type of order carries the user unique identifier in the preset blacklist. If so, determine the target type of order as a malicious order. Otherwise, perform the process of determining the target type of order as a suspicious order and putting it into the suspicious order library.

[0017] Optionally, the method further includes:

[0018] According to the preset signature verification algorithm, the signature string in the initial order is signed and verified.

[0019] When the initial order passes the signature verification, the initial order that meets the preset target type screening condition is determined as an order of the target type, wherein the preset target type screening condition is that all order source data in the order information of the initial order are empty.

[0020] Optionally, updating the record library based on the suspicious order includes:

[0021] Determine whether there is a record corresponding to the user unique identifier in the suspicious order in the record library, and if so, update the order quantity to the quantity of suspicious orders currently associated with the user unique identifier in the suspicious order library.

[0022] In the case that there is no record corresponding to the user unique identifier in the suspicious order in the record library, a record corresponding to the user unique identifier in the suspicious order is created in the record library.

[0023] An order identification and processing system, the system comprising:

[0024] A data updating unit is used to determine orders of the target type as suspicious orders and put them into a suspicious order library, and to update a record library based on the suspicious orders. The record library includes at least one record, and each record includes: a user unique identifier and the order quantity of the suspicious order associated with the user unique identifier. The suspicious order associated with the user unique identifier is a suspicious order whose order information includes the user unique identifier.

[0025] The periodic processing unit is used to perform periodic processing with a first preset time period as a period, and the periodic processing includes: a first processing and / or a second processing.

[0026] The first processing includes: deleting the first target record that has been stored in the record library for more than the first preset time period, determining each suspicious order associated with the user unique identifier included in the first target record as a normal order and deleting it from the suspicious order library, and the first target record is: a record including an order quantity less than a preset quantity.

[0027] The second processing includes: deleting the second target record whose storage time in the record library is not longer than the first preset time, determining each suspicious order associated with the user unique identifier included in the second target record as a malicious order and deleting it from the suspicious order library, and the second target record is: a record including an order quantity not less than a preset quantity.

[0028] Optionally, the periodic processing unit is further configured to:

[0029] The third target record that has existed in the record library for more than the second preset time period is deleted, and each suspicious order associated with the user unique identifier included in the third target record is determined to be a normal order and deleted from the suspicious order library, wherein the third target record is a record in which the order quantity changes within the first preset time period, and within the third preset time period, the order quantity after the change is less than the preset quantity, the starting time of the third preset time period is the ending time of the first preset time period, the starting time of the second preset time period is consistent with the starting time of the first preset time period, the ending time of the second preset time period is later than the ending time of the third preset time period, and the first preset time period is the same as the third preset time period.

[0030] The fourth target record that has existed in the record library for more than the second preset time period is deleted, and each suspicious order associated with the user unique identifier included in the fourth target record is determined to be a malicious order and deleted from the suspicious order library, wherein the fourth target record is a record in which the order quantity changes within the first preset time period, and within the third preset time period, the order quantity after the change is not less than the preset quantity.

[0031] Optionally, the order identification and processing system further includes:

[0032] The blacklist generating unit is used to add the user unique identifier corresponding to the malicious order to a preset blacklist.

[0033] Optionally, before determining the target type of order as a suspicious order and putting it into the suspicious order database, the method further includes:

[0034] The order screening unit is used to determine whether the target type of order carries the user unique identifier in the preset blacklist before the data updating unit determines the target type of order as a suspicious order and puts it into the suspicious order library. If so, the target type of order is determined as a malicious order. Otherwise, the process of determining the target type of order as a suspicious order and putting it into the suspicious order library is executed.

[0035] Optionally, the order identification and processing system further includes:

[0036] The order verification unit is used to verify the signature string in the initial order according to a preset signature verification algorithm.

[0037] When the initial order passes the signature verification, the initial order that meets the preset target type screening condition is determined as an order of the target type, wherein the preset target type screening condition is that all order source data in the order information of the initial order are empty.

[0038] Optionally, the data updating unit updates the record base based on the suspicious order and is specifically configured to:

[0039] Determine whether there is a record corresponding to the user unique identifier in the suspicious order in the record library, and if so, update the order quantity to the quantity of suspicious orders currently associated with the user unique identifier in the suspicious order library.

[0040] In the case that there is no record corresponding to the user unique identifier in the suspicious order in the record library, a record corresponding to the user unique identifier in the suspicious order is created in the record library.

[0041] An order identification and processing device, the device comprising:

[0042] processor;

[0043] A memory for storing instructions executable by the processor.

[0044] The processor is configured to execute the instructions to implement the order identification and processing method as described in any one of the above items.

[0045] A computer storage medium. When the instructions in the computer-readable storage medium are executed by a processor of an order identification and processing device, the order identification and processing device can execute any of the order identification and processing methods described above.

[0046] An order identification and processing method, system, device and storage medium provided by an embodiment of the present invention can distinguish and lock different users who generate orders by introducing a user unique identifier. At the same time, since the difference between normal orders and malicious orders lies in the number of orders generated in the same time period. Therefore, in order to avoid confusion between normal orders and malicious orders, the present invention sets a first preset time length as a period, and periodically identifies the number of orders of each user's unique identifier within the period, which can achieve accurate identification and processing of malicious user unique identifiers and malicious orders. It can be seen that the present invention achieves accurate identification and processing of malicious orders.

[0047] Of course, it is not necessary to achieve all of the advantages described above at the same time to implement any product or method of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0049] Figure 1 A flowchart of an order identification and processing method provided by an embodiment of the present invention;

[0050] Figure 2 A flowchart of an order identification and processing method provided for an optional embodiment of the present invention;

[0051] Figure 3 A block diagram of an order identification and processing system provided for another optional embodiment of the present invention;

[0052] Figure 4 A block diagram of an order identification and processing device provided for another optional embodiment of the present invention. DETAILED DESCRIPTION

[0053] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0054] The embodiment of the present invention provides an order identification and processing method, such as Figure 1 As shown, the order identification and processing method includes:

[0055] S101. Determine an order of the target type as a suspicious order and put it into a suspicious order library. Update a record library based on the suspicious order. The record library includes at least one record. Each record includes: a user unique identifier and the order quantity of the suspicious order associated with the user unique identifier. The suspicious order associated with the user unique identifier is a suspicious order whose order information includes the user unique identifier.

[0056] The above-mentioned record library may be a database deployed in a server. It should be noted that in actual application scenarios, the number of orders and user unique identifiers that need to be identified is huge, and the orders and user unique identifiers are constantly changing. Therefore, by setting up the above-mentioned record library to record and monitor the changes in the above-mentioned order quantity and user unique identifier, the impact on the recognition efficiency caused by the dynamic changes in the order quantity and user unique identifier in actual applications can be reduced.

[0057] Optionally, in an optional embodiment of the present invention, the above-mentioned target type in actual application may be an order type in which the source of the order cannot be determined due to the fact that the type parameters of the order affect the normal operation of the business logic in different application scenarios. For example: non-advertising and cash on delivery type orders. Among them, the above-mentioned non-advertising type is an order type submitted by the user who submits the order through the order submission port set by the non-advertising publisher. The cash on delivery type is an order type in which the payment method of the submitted order is cash on delivery. In the scenario of malicious order brushing in terms of order reception, for the above-mentioned non-advertising type and cash on delivery type malicious orders, the prior art cannot realize the screening of the above-mentioned malicious orders, which leads to the risk of business logic being prone to collapse when facing a large number of orders. Therefore, the present invention realizes the preliminary screening of normal orders and malicious orders based on the above-mentioned target types, which can improve the reliability of the normal operation of the business logic.

[0058] It should be noted that the above-mentioned user unique identifier is a unique identifier used to distinguish different users who submit orders. In actual applications, the specific types of the above-mentioned user unique identifier include but are not limited to: the unique device fingerprint of the device used by the user when generating the order, the gateway address of the wireless communication network used by the user when generating the order, etc. The specific type of the above-mentioned user unique identifier can be set according to the actual application scenario, and the present invention does not make too many restrictions and redundant descriptions on this.

[0059] Optionally, in an optional embodiment of the invention, the above-mentioned user unique identifier can be added by a plug-in deployed on the mobile terminal during the order generation process. For example, after the plug-in deployed on the mobile terminal recognizes the operation of generating an order, it collects the International Mobile Subscriber Identification Number (IMSI) of the current mobile terminal, or the gateway address connected to the current mobile terminal as the above-mentioned user unique identifier. Then, an encrypted string of the user unique identifier is generated through an encryption algorithm. Finally, the encrypted string of the user unique identifier is added to the order information.

[0060] It should be noted that the generation of any order needs to be implemented through electronic devices and the network. The above-mentioned user unique identifier can distinguish and lock the user who generated the order. Therefore, the present invention distinguishes and locks different users who generate orders by introducing the above-mentioned user unique identifier. At the same time, the present invention can record the number of suspicious orders associated with the user unique identifier through the user unique identifier. Since the user unique identifier is unique and cannot be modified, the order quantity of suspicious orders associated with each user unique identifier in the record library of the present application is accurate. In this way, the present invention can further identify suspicious orders based on the order quantity, thereby improving the accuracy of ultimately identifying malicious orders.

[0061] Optionally, in another optional embodiment of the present invention, in addition to the user unique identifier and the number of suspicious orders associated with the user unique identifier, the record may also include the time when the user unique identifier is first entered into the record library. This time can be used as follows: Figure 1 The periodic processing in step S102 shown in the figure. For example, the time when the user unique identifier is first entered into the record library is used as the starting time, and the time is counted from the starting time. When the time when the first preset time is reached, the periodic processing is performed. After the periodic processing, the end time of the periodic processing is determined as the new starting time.

[0062] S102: Perform periodic processing with a first preset time period as a period, where the periodic processing includes: a first processing and / or a second processing.

[0063] The first processing includes: deleting the first target record that has been stored in the record library for more than a first preset time period, determining each suspicious order associated with the user unique identifier included in the first target record as a normal order and deleting it from the suspicious order library, the first target record is: a record including an order quantity less than a preset quantity.

[0064] The second processing includes: deleting the second target record whose storage time in the record library does not exceed the first preset time, determining each suspicious order associated with the user unique identifier included in the second target record as a malicious order and deleting it from the suspicious order library, and the second target record is: a record including an order quantity not less than a preset quantity.

[0065] It should be noted that in actual applications, the addition and deletion of orders and user unique identifiers in the database are performed dynamically, which results in dynamic changes in the data in the above records. Therefore, through the above periodic processing, it is possible to avoid the situation where orders are missed, thereby improving the accuracy of identifying malicious orders.

[0066] Optionally, in an optional embodiment of the present invention, for normal orders, the same user unique identifier can correspond to multiple orders. However, for malicious orders such as malicious order brushing, invalid orders, etc., the characteristic is that multiple orders are generated by one user unique identifier. The difference between normal orders and abnormal orders lies in the number of orders generated in the same time period. Therefore, in order to avoid confusion between normal orders and malicious orders, the present invention sets the above-mentioned first preset time length as a period, and periodically identifies the number of orders of each user unique identifier within the period, which can achieve accurate identification of malicious user unique identifiers and malicious orders. It should be noted that in actual applications, the above-mentioned first preset time length and the above-mentioned preset number can be set by themselves according to historical data. The present invention does not limit the specific duration of the first preset time length, and does not limit the specific value of the preset number.

[0067] Optionally, in another optional embodiment of the present invention, the method for obtaining the storage duration of the above-mentioned target record in the record library may be: obtaining the moment when the user unique identifier in the target record is first entered into the record library, and determining the difference between the current moment and the moment when it is first entered into the record library as the above-mentioned storage duration.

[0068] Optionally, in another optional embodiment of the present invention, after deleting the above malicious orders from the suspicious order library, the above malicious orders may be added to a preset cheating library for subsequent analysis of the malicious orders.

[0069] The present invention introduces the above-mentioned user unique identifier to distinguish and lock different users who generate orders. At the same time, since the difference between normal orders and malicious orders lies in the number of orders generated in the same time period. Therefore, in order to avoid confusion between normal orders and malicious orders, the present invention sets the above-mentioned first preset time length as a period, and periodically identifies the number of orders of each user unique identifier within the period, which can realize accurate identification and processing of malicious user unique identifiers and malicious orders. It can be seen that the present invention realizes the identification and processing of malicious orders.

[0070] Optionally, the first process further includes:

[0071] The third target record that has existed in the record library for more than the second preset time period will be deleted, and each suspicious order associated with the user unique identifier included in the third target record will be determined as a normal order and deleted from the suspicious order library, wherein the third target record is a record in which the order quantity changes within the first preset time period, and the order quantity after the change within the third preset time period is less than the preset quantity, the starting time of the third preset time period is the end time of the first preset time period, the starting time of the second preset time period is consistent with the starting time of the first preset time period, the end time of the second preset time period is later than the end time of the third preset time period, and the first preset time period is the same as the third preset time period.

[0072] The fourth target record that has existed in the record library for more than the second preset time period will be deleted, and each suspicious order associated with the user unique identifier included in the fourth target record will be determined as a malicious order and deleted from the suspicious order library, wherein the fourth target record is a record in which the order quantity changes within the first preset time period, and the order quantity after the change is not less than the preset quantity within the third preset time period.

[0073] It should be noted that each periodic processing is processed according to the number of suspicious orders that are recorded in the suspicious order library before the start time of the period. In actual application scenarios, the addition and deletion of suspicious orders in the suspicious order library is carried out continuously, that is, the number of orders in the record is constantly changing. Therefore, the present invention avoids the omission of malicious orders due to the change in the number of orders by identifying the change in the number of suspicious orders in two adjacent periods, and improves the accurate identification and processing of the orders.

[0074] Optionally, the second process further includes:

[0075] The user's unique identifier corresponding to the malicious order is added to the preset blacklist.

[0076] Optionally, before determining an order of the target type as a suspicious order and putting it into the suspicious order database, Figure 1 The method shown also includes:

[0077] Determine whether the target type of order carries a unique user identifier in a preset blacklist. If so, determine the target type of order as a malicious order. Otherwise, determine the target type of order as a suspicious order and put it into a suspicious order library.

[0078] It should be noted that in actual applications, the number of orders of the above target types is huge. If the above periodic processing is performed on each order of the target type, the efficiency of order identification will be reduced. Therefore, the present invention can filter the orders of the target type associated with the unique identifier of the user who has been determined to generate malicious orders by setting the above blacklist, thereby reducing the number of orders of the target type to be identified, and then improving the efficiency of order identification.

[0079] Optional, as above Figure 1 The order identification and processing method shown also includes:

[0080] According to the preset signature verification algorithm, the signature string in the initial order is signed and verified.

[0081] When the initial order passes the signature verification, the initial order that meets the preset target type screening condition will be determined as an order of the target type, wherein the preset target type screening condition is that all order source data in the order information of the initial order are empty.

[0082] Optionally, in an optional embodiment of the present invention, the order source data may be data indicating the source of the order, such as payment information, order platform identification, etc.

[0083] In order to facilitate the understanding of the above target types, an optional embodiment of the present invention is specifically described here:

[0084] In the order information of setting an order, the order source data includes the ordering platform identifier and payment information.

[0085] If the above order is generated through a forged port, the above order platform identifier is empty. At this time, the e-commerce platform cannot index according to the order platform identifier to find relevant information of the account, such as the name of the account registrant, identity certificate number and other data. At the same time, if the above payment information is empty. The e-commerce platform cannot determine the information of the transaction party based on the transaction party's account, and if the payment method is cash on delivery, the e-commerce platform cannot receive the transaction amount, resulting in economic losses.

[0086] Therefore, if the e-commerce platform does not screen the target type of orders, but directly ships the goods based on the order information, then since the user identity cannot be locked, in the event of malicious order fraud and malicious order return, the e-commerce platform will incur additional costs in order management and shipping fees, resulting in economic losses.

[0087] Optionally, in an optional embodiment of the present invention, the above-mentioned signature string can be a character string used to verify whether the order data of the above-mentioned initial order has been tampered with. The generation process can be: the user end uses a preset signature generation algorithm to generate a signature according to the initial order, and generates the signature after encrypting the signature using the public key sent by the server. Among them, the above-mentioned preset signature algorithm and the above-mentioned preset signature verification algorithm can be the same algorithm or different algorithms. However, when the preset signature algorithm is different from the preset signature verification algorithm, the preset signature verification algorithm needs to be set to an algorithm that can interpret the signature rules of the preset signature algorithm.

[0088] Those skilled in the art will appreciate that there are many types of the above-mentioned preset signature verification algorithms, such as digital signature algorithm, message digest algorithm 5 (Message-Digest Algorithm 5, MD5), etc. The present invention does not make too many restrictions and redundant descriptions on the specific types and construction processes of the preset signature verification algorithms.

[0089] Optionally, in another optional embodiment of the present invention, there are multiple types of the above-mentioned order platform identification, such as the identification of the landing page that generates the order. When a user generates an order through an order platform, if the order platform is set by the order recipient, the order platform will add the order platform identification pre-set by the order recipient to the order. In order to avoid being traced, the user who generates the malicious order will use technical means to prevent the order platform from writing the above-mentioned order platform identification. Therefore, by setting the above-mentioned preset target type screening conditions, it is possible to accurately screen the orders of the target type, thereby improving the accuracy of the final identification of malicious orders.

[0090] Optionally, update the record base based on suspicious orders, including:

[0091] Determine whether there is a record corresponding to the user unique identifier in the suspicious order in the record library. If so, update the order quantity to the quantity of suspicious orders associated with the user unique identifier in the current suspicious order library.

[0092] In the case that there is no record corresponding to the user unique identifier in the suspicious order in the record library, a record corresponding to the user unique identifier in the suspicious order is created in the record library.

[0093] Optionally, in an optional embodiment of the present invention, the step of deleting suspicious orders that have existed in the suspicious order library for more than the second preset time period will change the number of suspicious orders associated with the user's unique identifier in the current suspicious order library. Therefore, if the above-mentioned order quantity is updated by simply adding one to the number in the record library, it will result in that in actual applications, the above-mentioned first processing or second processing will not be able to find suspicious orders that have been deleted from the suspicious order library because the storage time has exceeded the second preset time period. As a result, in the actual application process, the execution reliability of the above-mentioned first processing or second processing is reduced. Therefore, the present invention can achieve the effect of improving the execution reliability of the first processing or the second processing through the above-mentioned step of updating the order quantity to the number of suspicious orders associated with the user's unique identifier in the current suspicious order library.

[0094] In order to facilitate the understanding of the above order quantity update operation, an optional embodiment of the present invention is specifically described here:

[0095] Assume that there is a target record in the record library at the first moment, and the order quantity in the target record is 6.

[0096] After the target record is subjected to the first processing or the second processing, two suspicious orders corresponding to the user unique identifier of the target record are deleted from the suspicious order library. That is, at the second moment after the first moment, the number of suspicious orders corresponding to the target record in the suspicious order library is 4. However, the current number of orders in the target record is still 6 at the second moment.

[0097] Assume that at the third moment, a suspicious order is entered into the warehouse, and the user unique identifier of the suspicious order library corresponds to the target record. After the suspicious order is entered into the warehouse, the order quantity of the suspicious order corresponding to the target record in the suspicious order library at the third moment is 5. The order quantity of the target record is updated according to the order quantity at the third moment. That is, the order quantity in the target record at the third moment is 6.

[0098] If the order quantity update operation is not performed, and the current order quantity of the target record is simply increased by 1, the order quantity of the target record at the third moment is 7. It can be seen that since the first process or the second process is executed according to the order quantity in the record, the accuracy of the order quantity in the record can be ensured through the order quantity update operation, thereby improving the execution reliability of the first process or the second process.

[0099] Optionally, in another optional embodiment of the present invention, when a record corresponding to the user unique identifier in the suspicious order is created in the record library, the order quantity in the created record may be assigned a value of one.

[0100] In order to facilitate the above Figure 1 The order identification and processing method shown in this article is combined with the following Figure 2 An alternative embodiment of the present invention is shown to illustrate:

[0101] Step S201, obtaining the target initial order, and triggering step S202.

[0102] Step S202, using a preset signature verification algorithm, determines whether the data of the target initial order has been tampered with. If yes, step S219 is triggered, if no, step S203 is triggered.

[0103] Step S203, reading each order source data in the target initial order, and triggering step S204.

[0104] Step S204, determining whether each order source data satisfies the preset target type screening condition. If yes, step S205 is triggered, if no, step S220 is triggered.

[0105] Step S205, determining the target initial order as an order of the target type, and triggering step S206.

[0106] Step S206, determining whether the user unique identifier of the target type of order exists in the preset blacklist, if so, triggering step S221, if not, triggering step S207.

[0107] Step S207: determine the target type of order as a suspicious order, and put the suspicious order into a suspicious order database, and trigger step S208.

[0108] Step S208, determining whether there is a record corresponding to the user unique identifier of the suspicious order in the record library, if so, triggering step S209, if not, triggering step S210.

[0109] Step S209, read the order quantity of the suspicious order corresponding to the user unique identifier of the suspicious order in the suspicious order library, and use the order quantity to update the number of suspicious orders in the record corresponding to the user unique identifier in the record library, and trigger step S211.

[0110] Optionally, in an optional embodiment of the present invention, when a record is updated, the first entry time of the user's unique identifier is not updated.

[0111] Step S210, creating a record corresponding to the user unique identifier of the suspicious order in the record library, setting the number of suspicious orders in the record to one, and triggering step S211.

[0112] Optionally, in an optional embodiment of the present invention, the data in the above record includes the user's unique identifier and the time when the user's unique identifier is first entered.

[0113] Step S211, starting the calculation cycle from the first entry time of the user's unique identifier in the record, and triggering step S212.

[0114] It should be noted that in the above Figure 2 In step S211 shown in FIG. 1 , after the calculation cycle is started, if the device corresponding to the user unique identifier in the record generates a new initial order, the following steps are repeated. Figure 2 The steps shown are steps S201 to step S209.

[0115] Step S212, determining whether the number of orders in the record is not less than a preset threshold value during the period when the storage time of the record is less than the cycle. If yes, triggering step S213. If no, triggering step S214.

[0116] Step S213, the record is deleted from the record library, and each suspicious order associated with the record in the suspicious order library is determined as a malicious order, and step S215 is triggered.

[0117] Step S214, determine whether the duration of the record in the record library is greater than the period. If so, trigger step S216, if not, trigger step S217

[0118] Step S215, adding the user unique identifier of the malicious order to a preset blacklist, and triggering step S222.

[0119] Step S216, the record is deleted from the record library, and each suspicious order associated with the record in the suspicious order library is determined as a normal order, and step S218 is triggered.

[0120] Step S217, determine each suspicious order associated with the record in the suspicious order database as a normal order, and determine whether the maximum storage time of each normal order is not less than the preset time. If yes, trigger step S218, if no, repeat triggering S217.

[0121] Step S218, adding each normal order to the normal order library.

[0122] Step S219, determining the target initial order as a malicious order, and triggering step S222.

[0123] Step S220: determine the target initial order as a normal order, and trigger step S218.

[0124] Step S221, determining the target type of order as a malicious order, and triggering step S222.

[0125] Step S222, adding each malicious order to a malicious order library.

[0126] It should be noted that the above Figure 2 Steps S208 to S210 are as follows. Figure 1 The optional embodiment of step S101 shown in FIG. Figure 2 Steps S211, S212, S213, S214 and S216 are as shown in Figure 1 An optional embodiment of step S102 is shown.

[0127] Corresponding to the above method embodiment, the present invention also provides an order identification and processing system, such as Figure 3 As shown, the order identification and processing system includes:

[0128] The data updating unit 301 is used to determine the target type of order as a suspicious order and put it into the suspicious order library, and update the record library based on the suspicious order. The record library includes at least one record, and each record includes: a user unique identifier and the order quantity of the suspicious order associated with the user unique identifier. The suspicious order associated with the user unique identifier is a suspicious order whose order information includes the user unique identifier.

[0129] The periodic processing unit 302 is used to perform periodic processing with a first preset time period as a period, and the periodic processing includes: a first processing and / or a second processing.

[0130] The first processing includes: deleting the first target record that has been stored in the record library for more than a first preset time period, determining each suspicious order associated with the user unique identifier included in the first target record as a normal order and deleting it from the suspicious order library, the first target record is: a record including an order quantity less than a preset quantity.

[0131] The second processing includes: deleting the second target record whose storage time in the record library does not exceed the first preset time, determining each suspicious order associated with the user unique identifier included in the second target record as a malicious order and deleting it from the suspicious order library, and the second target record is: a record including an order quantity not less than a preset quantity.

[0132] Optionally, the periodic processing unit 302 is further configured to:

[0133] The third target record that has existed in the record library for more than the second preset time period will be deleted, and each suspicious order associated with the user unique identifier included in the third target record will be determined as a normal order and deleted from the suspicious order library, wherein the third target record is a record in which the order quantity changes within the first preset time period, and the order quantity after the change within the third preset time period is less than the preset quantity, the starting time of the third preset time period is the end time of the first preset time period, the starting time of the second preset time period is consistent with the starting time of the first preset time period, the end time of the second preset time period is later than the end time of the third preset time period, and the first preset time period is the same as the third preset time period.

[0134] The fourth target record that has existed in the record library for more than the second preset time period will be deleted, and each suspicious order associated with the user unique identifier included in the fourth target record will be determined as a malicious order and deleted from the suspicious order library, wherein the fourth target record is a record in which the order quantity changes within the first preset time period, and the order quantity after the change is not less than the preset quantity within the third preset time period.

[0135] Optional, as above Figure 3 The order identification and processing system shown also includes:

[0136] The blacklist generation unit is used to add the user unique identifier corresponding to the malicious order to a preset blacklist.

[0137] Optional, as above Figure 3 The order identification and processing system shown also includes:

[0138] The order screening unit is used to determine whether the target type of order carries a user unique identifier in a preset blacklist before the data updating unit 301 determines the target type of order as a suspicious order and puts it into the suspicious order library. If so, the target type of order is determined as a malicious order. Otherwise, the target type of order is determined as a suspicious order and put into the suspicious order library.

[0139] Optional, as above Figure 3 The order identification and processing system shown also includes:

[0140] The order verification unit is used to verify the signature string in the initial order according to a preset signature verification algorithm.

[0141] When the initial order passes the signature verification, the initial order that meets the preset target type screening condition will be determined as an order of the target type, wherein the preset target type screening condition is that all order source data in the order information of the initial order are empty.

[0142] Optionally, the data updating unit 301 updates the record base based on the suspicious order and is specifically configured as follows:

[0143] Determine whether there is a record corresponding to the user unique identifier in the suspicious order in the record library. If so, update the order quantity to the quantity of suspicious orders associated with the user unique identifier in the current suspicious order library.

[0144] In the case that there is no record corresponding to the user unique identifier in the suspicious order in the record library, a record corresponding to the user unique identifier in the suspicious order is created in the record library.

[0145] The embodiment of the present invention also provides an order identification and processing device, such as Figure 4 As shown, the order identification and processing device includes:

[0146] Processor 401;

[0147] The memory 402 is used to store instructions executable by the processor 401 .

[0148] The processor 401 is configured to execute instructions to implement any of the order identification and processing methods described above.

[0149] An embodiment of the present invention also provides a computer storage medium. When the instructions in the computer-readable storage medium are executed by a processor of an order identification and processing device, the order identification and processing device can execute any of the order identification and processing methods described above.

[0150] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip. The memory is an example of a computer-readable medium.

[0151] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0152] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0153] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. It should also be noted that the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0154] Each embodiment in this specification is described in a related manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0155] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included within the scope of the claims of the present application.

Claims

1. An order identification and processing method, characterized in that: The method comprises: Determine the target type of order as a suspicious order and put it into a suspicious order library, and update the record library based on the suspicious order, wherein the record library includes at least one record, each of which includes: a user unique identifier and the order quantity of the suspicious order associated with the user unique identifier, wherein the suspicious order associated with the user unique identifier is a suspicious order including the user unique identifier in the order information; Performing periodic processing with a first preset time period as a period, wherein the periodic processing includes: a first processing and / or a second processing; The first processing includes: deleting a first target record whose storage time in the record library exceeds the first preset time, determining each suspicious order associated with the user unique identifier included in the first target record as a normal order and deleting it from the suspicious order library, the first target record being: a record including an order quantity less than a preset quantity; The second processing includes: deleting a second target record whose storage time in the record library is not longer than the first preset time, determining each suspicious order associated with the user unique identifier included in the second target record as a malicious order and deleting it from the suspicious order library, the second target record being a record including an order quantity not less than a preset quantity; Wherein, the first process further includes: The third target record that has existed in the record library for more than the second preset time period is deleted, and each suspicious order associated with the user unique identifier included in the third target record is determined to be a normal order and deleted from the suspicious order library, wherein the third target record is a record in which the order quantity changes within the first preset time period, and within the third preset time period, the order quantity after the change is less than the preset quantity, the starting time of the third preset time period is the ending time of the first preset time period, the starting time of the second preset time period is consistent with the starting time of the first preset time period, the ending time of the second preset time period is later than the ending time of the third preset time period, and the first preset time period is the same as the third preset time period.

2. The method according to claim 1, characterized in that The first process further includes: The fourth target record that has existed in the record library for more than the second preset time period is deleted, and each suspicious order associated with the user unique identifier included in the fourth target record is determined to be a malicious order and deleted from the suspicious order library, wherein the fourth target record is a record in which the order quantity changes within the first preset time period, and within the third preset time period, the order quantity after the change is not less than the preset quantity.

3. The method according to claim 2, characterized in that The method further comprises: The user unique identifier corresponding to the malicious order is added to a preset blacklist.

4. The method according to claim 3, characterized in that Before determining the target type of order as a suspicious order and putting it into the suspicious order library, the method further includes: Determine whether the target type of order carries the user unique identifier in the preset blacklist. If so, determine the target type of order as a malicious order. Otherwise, perform the process of determining the target type of order as a suspicious order and putting it into the suspicious order library.

5. The method according to claim 1, characterized in that The method further comprises: According to the preset signature verification algorithm, the signature string in the initial order is verified; When the initial order passes the signature verification, the initial order that meets the preset target type screening condition is determined as an order of the target type, wherein the preset target type screening condition is that all order source data in the order information of the initial order are empty.

6. The method according to claim 1, characterized in that The updating of the record library based on the suspicious order includes: Determine whether there is a record corresponding to the user unique identifier in the suspicious order in the record library, and if so, update the order quantity to the quantity of the suspicious orders currently associated with the user unique identifier in the suspicious order library; In the case that there is no record corresponding to the user unique identifier in the suspicious order in the record library, a record corresponding to the user unique identifier in the suspicious order is created in the record library.

7. An order identification and processing system, characterized in that: The system comprises: a data updating unit, configured to determine an order of a target type as a suspicious order and put it into a suspicious order library, and update a record library based on the suspicious order, wherein the record library includes at least one record, and each record includes: a user unique identifier and an order quantity of the suspicious order associated with the user unique identifier, wherein the suspicious order associated with the user unique identifier is a suspicious order including the user unique identifier in the order information; A periodic processing unit, configured to perform periodic processing with a first preset time period as a period, wherein the periodic processing includes: a first processing and / or a second processing; The first processing includes: deleting a first target record whose storage time in the record library exceeds the first preset time, determining each suspicious order associated with the user unique identifier included in the first target record as a normal order and deleting it from the suspicious order library, the first target record being: a record including an order quantity less than a preset quantity; The second processing includes: deleting a second target record whose storage time in the record library is not longer than the first preset time, determining each suspicious order associated with the user unique identifier included in the second target record as a malicious order and deleting it from the suspicious order library, the second target record being a record including an order quantity not less than a preset quantity; Wherein, the first process further includes: The third target record that has existed in the record library for more than the second preset time period is deleted, and each suspicious order associated with the user unique identifier included in the third target record is determined to be a normal order and deleted from the suspicious order library, wherein the third target record is a record in which the order quantity changes within the first preset time period, and within the third preset time period, the order quantity after the change is less than the preset quantity, the starting time of the third preset time period is the ending time of the first preset time period, the starting time of the second preset time period is consistent with the starting time of the first preset time period, the ending time of the second preset time period is later than the ending time of the third preset time period, and the first preset time period is the same as the third preset time period.

8. The system according to claim 7, characterized in that The data updating unit updates the record base based on the suspicious order and is specifically configured as follows: Determine whether there is a record corresponding to the user unique identifier in the suspicious order in the record library, and if so, update the order quantity to the quantity of the suspicious orders currently associated with the user unique identifier in the suspicious order library; In the case that there is no record corresponding to the user unique identifier in the suspicious order in the record library, a record corresponding to the user unique identifier in the suspicious order is created in the record library.

9. An order identification and processing device, characterized in that: The device comprises: processor; a memory for storing instructions executable by the processor; The processor is configured to execute the instructions to implement the order identification and processing method as described in any one of claims 1 to 6.

10. A computer storage medium, characterized in that: When the instructions in the computer-readable storage medium are executed by a processor of an order identification and processing device, the order identification and processing device is enabled to execute the order identification and processing method as described in any one of claims 1 to 6.

Images