Risk identification method and device, electronic equipment, medium and program product

Abstract

The method comprises the following steps: acquiring a short-term order placement behavior sequence, a long-term account behavior sequence and static data of a user, wherein the short-term order placement behavior sequence comprises features related to order placement behaviors of the user in a preset first historical time period; the long-term account behavior sequence comprises behavior features related to an account of the user in a preset second historical time period; the static data comprises order features related to a current order of the user and historical order statistical features of the user, and the length of the historical time period is greater than the length of the first historical time period; inputting the short-term order placement behavior sequence, the long-term account behavior sequence and the static data of the user into a preset risk identification model, executing the risk identification model, and obtaining a risk identification result output by the risk identification model.

Description

Technical Field

[0001] This disclosure relates to the field of information processing technology, specifically to a risk identification method, apparatus, electronic device, medium, and program product. Background Technology

[0002] With the development of internet services, more and more services are provided to users online, such as online shopping and ride-hailing payments. While providing these services, some malicious users may exploit platform vulnerabilities to engage in fraudulent activities, such as defrauding the platform of advance payments or deliberately refusing to pay. These fraudulent activities can occur at various financial stages of the service. Once these vulnerabilities are exploited by black market groups, it can cause significant financial losses and damage the platform's interests. Therefore, risk identification is necessary to prevent attacks from black market groups when providing services. Current risk identification methods rely on either extensive manual strategies or machine learning models based on user statistical characteristics. Manual strategies require a large amount of human experience and case analysis to summarize patterns and set risk identification strategies, suitable for quickly patching vulnerabilities, but they are labor-intensive and lack generalization. Machine learning models based on user statistical characteristics have limitations. First, new users lack historical completed service orders, limiting the applicability of the machine learning model. Second, when black market groups attempt to bypass the machine learning model, it can no longer adaptively re-identify them, posing a significant risk. Summary of the Invention

[0003] To address the problems in the related technologies, embodiments of this disclosure provide a risk identification method, apparatus, electronic device, medium, and program product.

[0004] Firstly, this disclosure provides a risk identification method.

[0005] Specifically, the risk identification method includes:

[0006] The system acquires a user's short-term order behavior sequence, long-term account behavior sequence, and static data. The short-term order behavior sequence includes features related to the user's order behavior within a preset first historical time period. The long-term account behavior sequence includes behavioral features related to the user's account within a preset second historical time period. The static data includes order features related to the user's current order and the user's historical order statistical features. The duration of the historical time period is longer than the duration of the first historical time period.

[0007] The user's short-term order behavior sequence, long-term account behavior sequence, and static data are input into a preset risk identification model. The risk identification model is then executed to obtain the risk identification result output by the risk identification model.

[0008] In conjunction with the first aspect, in a first implementation of the first aspect of this disclosure, the risk identification result includes a risk score, and the method further includes:

[0009] The process of inputting the user's short-term order behavior sequence, long-term account behavior sequence, and static data into a preset risk identification model, executing the risk identification model, and obtaining the risk identification result output by the risk identification model includes:

[0010] The user's short-term order behavior sequence is input into the first sub-model, and the first sub-model is executed to obtain short-term sequence features.

[0011] The long-term account behavior sequence is input into the second sub-model, and the second sub-model is executed to obtain the long-term sequence features.

[0012] The static data is input into a first multilayer perceptron (MLP), and the first MLP is executed to obtain static features.

[0013] The short-term sequence features, long-term sequence features, and static features are input into the second MLP, and the second MLP is executed to obtain the risk identification result.

[0014] In conjunction with the first implementation of the first aspect, in the second implementation of the first aspect of this disclosure, the risk identification result includes a risk feature vector, and the method further includes:

[0015] The first sub-model and the second sub-model include any of the following models: a Long Short-Term Memory (LSTM) model with an attention mechanism, a Deep Self-Attention Transformer (transformer) model, or a Text Classification Convolutional Neural Network (textCNN) model.

[0016] In conjunction with the various implementations of the first aspect described above, in the third implementation of the first aspect of this disclosure, the acquisition of the user's short-term order behavior sequence and long-term account behavior sequence includes:

[0017] Obtain the user's initial short-term order behavior sequence data and initial long-term account behavior sequence data;

[0018] The user's initial short-term order behavior sequence data and initial long-term account behavior sequence data are preprocessed to obtain the user's short-term order behavior sequence and long-term account behavior sequence.

[0019] In conjunction with the various implementations of the first aspect described above, in the fourth implementation of the first aspect of this disclosure, the preprocessing of the user's initial short-term order behavior sequence data and initial long-term account behavior sequence data to obtain the user's short-term order behavior sequence and long-term account behavior sequence includes:

[0020] The user's initial short-term order behavior sequence data and initial long-term account behavior sequence data are digitized to obtain digitized short-term order behavior sequences and long-term account behavior sequences.

[0021] The digitized short-term order behavior sequence is augmented or deleted to obtain a short-term order behavior sequence of the first preset length.

[0022] The long-term account behavior sequence of the digitized user is subjected to sequence completion or sequence deletion operations to obtain a long-term account behavior sequence of the second preset length.

[0023] In conjunction with the various implementations of the first aspect described above, in the fifth implementation of the first aspect of this disclosure, the step of preprocessing the user's initial short-term order behavior sequence data and initial long-term account behavior sequence data to obtain the user's short-term order behavior sequence and long-term account behavior sequence further includes:

[0024] The user's initial short-term order behavior sequence data and initial long-term account behavior sequence data are embedded and mapped to obtain the user's short-term order behavior sequence and long-term account behavior sequence.

[0025] In conjunction with the various implementations of the first aspect described above, in the sixth implementation of the first aspect of this disclosure, the method further includes:

[0026] Obtain sample data, which includes short-term order behavior sequences, long-term account behavior sequences and static data corresponding to each historical sample order, as well as the actual risk results corresponding to each historical sample order;

[0027] The risk identification model is trained using the sample data.

[0028] In conjunction with the various implementations of the first aspect described above, in the seventh implementation of the first aspect of this disclosure, the method further includes:

[0029] Obtain application sample data from the application to be migrated. The application sample data includes short-term order behavior sequences, long-term account behavior sequences, and static data corresponding to each historical sample order in the application to be migrated, as well as the actual risk results corresponding to each historical sample order.

[0030] The risk identification model is fine-tuned using the application sample data to obtain a risk identification model for use by the application to be migrated.

[0031] In conjunction with the various implementations of the first aspect described above, in the eighth implementation of the first aspect of this disclosure, the risk identification result includes a risk feature vector, and the method further includes:

[0032] Risk analysis is performed based on the aforementioned risk feature vector.

[0033] Secondly, this disclosure provides a risk identification device.

[0034] Specifically, the risk identification device includes:

[0035] The first acquisition module is configured to acquire a user's short-term order behavior sequence, long-term account behavior sequence, and static data. The short-term order behavior sequence includes features related to the user's order behavior within a preset first historical time period. The long-term account behavior sequence includes behavioral features related to the user's account within a preset second historical time period. The static data includes order features related to the user's current order and the user's historical order statistical features. The duration of the historical time period is longer than the duration of the first historical time period.

[0036] The identification module is configured to input the user's short-term order behavior sequence, long-term account behavior sequence and static data into a preset risk identification model, execute the risk identification model, and obtain the risk identification result output by the risk identification model.

[0037] In conjunction with the second aspect, in the first implementation of the second aspect of this disclosure, the identification module is configured as follows:

[0038] The user's short-term order behavior sequence is input into the first sub-model, and the first sub-model is executed to obtain short-term sequence features.

[0039] The long-term account behavior sequence is input into the second sub-model, and the second sub-model is executed to obtain the long-term sequence features.

[0040] The static data is input into a first multilayer perceptron (MLP), and the first MLP is executed to obtain static features.

[0041] The short-term sequence features, long-term sequence features, and static features are input into the second MLP, and the second MLP is executed to obtain the risk identification result.

[0042] In conjunction with the first implementation of the second aspect, in the second implementation of the second aspect of this disclosure, the first sub-model and the second sub-model include any one of the following models: a Long Short-Term Memory (LSTM) model with an attention mechanism, a Deep Self-Attention Transformer (transformer) model, or a Text Classification Convolutional Neural Network (textCNN) model.

[0043] In conjunction with the various implementations of the second aspect described above, in the third implementation of the second aspect of this disclosure, the first acquisition module is configured as follows:

[0044] Obtain the user's initial short-term order behavior sequence data and initial long-term account behavior sequence data;

[0045] The user's initial short-term order behavior sequence data and initial long-term account behavior sequence data are preprocessed to obtain the user's short-term order behavior sequence and long-term account behavior sequence.

[0046] In conjunction with the various implementations of the second aspect described above, in the fourth implementation of the second aspect of this disclosure, the portion of the first acquisition module that preprocesses the user's initial short-term order behavior sequence data and initial long-term account behavior sequence data to obtain the user's short-term order behavior sequence and long-term account behavior sequence is configured as follows:

[0047] The user's initial short-term order behavior sequence data and initial long-term account behavior sequence data are digitized to obtain digitized short-term order behavior sequences and long-term account behavior sequences.

[0048] The digitized short-term order behavior sequence is augmented or deleted to obtain a short-term order behavior sequence of the first preset length.

[0049] The long-term account behavior sequence of the digitized user is subjected to sequence completion or sequence deletion operations to obtain a long-term account behavior sequence of the second preset length.

[0050] In conjunction with the various implementations of the second aspect described above, in the fifth implementation of the second aspect of this disclosure, the portion of the first acquisition module that preprocesses the user's initial short-term order behavior sequence data and initial long-term account behavior sequence data to obtain the user's short-term order behavior sequence and long-term account behavior sequence is configured as follows:

[0051] The user's initial short-term order behavior sequence data and initial long-term account behavior sequence data are embedded and mapped to obtain the user's short-term order behavior sequence and long-term account behavior sequence.

[0052] In conjunction with the various implementations of the second aspect described above, in a sixth implementation of the second aspect of this disclosure, the apparatus further includes:

[0053] The second acquisition module is configured to acquire sample data, which includes short-term order behavior sequences, long-term account behavior sequences and static data corresponding to each historical sample order, as well as the actual risk results corresponding to each historical sample order.

[0054] The training module is configured to train the risk identification model using the sample data.

[0055] In conjunction with the various implementations of the second aspect described above, in a seventh implementation of the second aspect of this disclosure, the apparatus further includes:

[0056] The third acquisition module is configured to acquire application sample data from the application to be migrated. The application sample data includes short-term order behavior sequences, long-term account behavior sequences, and static data corresponding to each historical sample order in the application to be migrated, as well as the actual risk results corresponding to each historical sample order.

[0057] The fine-tuning module is configured to fine-tune the risk identification model using the application sample data to obtain a risk identification model for use by the application to be migrated.

[0058] In conjunction with the various implementations of the second aspect described above, in the eighth implementation of the second aspect of this disclosure, the risk identification result includes a risk feature vector, and the apparatus further includes:

[0059] The analysis module is configured to perform risk analysis based on the risk feature vector.

[0060] Thirdly, embodiments of this disclosure provide an electronic device including a memory and a processor, wherein the memory is used to store one or more computer instructions, wherein the one or more computer instructions are executed by the processor to implement the method as described in any of the first aspects.

[0061] Fourthly, this disclosure provides a computer-readable storage medium having computer instructions stored thereon, which, when executed by a processor, implement the method as described in any of the first aspects.

[0062] Fifthly, this disclosure provides a computer program product including computer instructions that, when executed by a processor, implement the steps of the method as described in any of the first aspects.

[0063] According to the technical solution provided in this disclosure, risk identification is performed based on short-term order behavior sequences, long-term account behavior sequences, and static data. When a new user places an order, even without previously completed service orders, there will still be numerous pre-order attempts, account logins, or registrations—short-term order behavior sequences related to the user's ordering behavior—and long-term account behavior sequences related to the user's account. Therefore, risk identification can be performed based on these behavior sequences, providing better coverage for new users. For black market and gray market activities, frequent attempts to bypass existing risk control systems are precisely the input features of the risk identification model, allowing it to identify risks more effectively. Moreover, compared to single-dimensional behavior sequences, the short-term order behavior sequences, long-term account behavior sequences, and static data input to the risk identification model integrate multiple sequences and their attributes, providing a more comprehensive representation of the user's intent and enabling the risk identification model to more accurately identify potential risks.

[0064] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this disclosure. Attached Figure Description

[0065] Other features, objects, and advantages of this disclosure will become more apparent from the following detailed description of non-limiting embodiments, taken in conjunction with the accompanying drawings. In the drawings:

[0066] Figure 1A A flowchart illustrating a risk identification method according to an embodiment of this disclosure is shown;

[0067] Figure 1B A flowchart illustrating the risk identification method according to an embodiment of this disclosure is shown.

[0068] Figure 2 This diagram shows a structural block diagram of a risk identification device according to an embodiment of the present disclosure;

[0069] Figure 3 This diagram illustrates a structural block diagram of an electronic device according to an embodiment of the present disclosure;

[0070] Figure 4 A schematic diagram of the structure of a computer system suitable for implementing the method according to embodiments of the present disclosure is shown. Detailed Implementation

[0071] In the following, exemplary embodiments of the present disclosure will be described in detail with reference to the accompanying drawings to enable those skilled in the art to readily implement them. Furthermore, for clarity, portions unrelated to the description of exemplary embodiments have been omitted from the drawings.

[0072] In this disclosure, it should be understood that terms such as “comprising” or “having” are intended to indicate the presence of features, figures, steps, behaviors, components, parts or combinations thereof disclosed in this specification, and are not intended to exclude the possibility of the presence or addition of one or more other features, figures, steps, behaviors, components, parts or combinations thereof.

[0073] It should also be noted that, unless otherwise specified, the embodiments and features described in this disclosure can be combined with each other. This disclosure will now be described in detail with reference to the accompanying drawings and embodiments.

[0074] In this disclosure, the acquisition of user information or user data is done with the user's authorization or confirmation, or by the user's active choice.

[0075] Figure 1A A flowchart illustrating a risk identification method according to an embodiment of this disclosure is shown. Figure 1A As shown, the risk identification method includes the following steps S101-S102:

[0076] In step S101, the user's short-term order behavior sequence, long-term account behavior sequence, and static data are obtained. The short-term order behavior sequence includes features related to the user's order behavior within a preset first historical time period. The long-term account behavior sequence includes behavioral features related to the user's account within a preset second historical time period. The static data includes order features related to the user's current order and the user's historical order statistical features. The duration of the historical time period is longer than the duration of the first historical time period.

[0077] In step S102, the user's short-term order behavior sequence, long-term account behavior sequence, and static data are input into a preset risk identification model, the risk identification model is executed, and the risk identification result output by the risk identification model is obtained.

[0078] As mentioned above, with the development of internet services, more and more services are provided to users online, such as online shopping and ride-hailing payments. When providing services, some malicious users may exploit platform vulnerabilities to engage in fraudulent activities, such as defrauding the platform of advance payments or deliberately refusing to pay. These fraudulent activities can be distributed across various financial aspects of the service. Once these vulnerabilities are exploited by black market groups, it can cause significant financial losses and damage the platform's interests. Therefore, risk identification is necessary to prevent attacks from black market groups when providing services. Current risk identification methods rely on either extensive manual strategies or machine learning models based on user statistical characteristics. Manual strategies require a large amount of human experience and case analysis to summarize patterns and set risk identification strategies, suitable for quickly patching vulnerabilities, but they are labor-intensive and lack generalization. Machine learning models based on user statistical characteristics have limited applicability to new users due to the lack of historical completed service orders. Furthermore, when black market groups attempt to bypass the machine learning model, it can no longer adaptively re-identify them, posing a significant risk.

[0079] Considering the above problems, this embodiment provides a risk identification method. It uses a risk identification model to identify risks based on short-term order behavior sequences, long-term account behavior sequences, and static data. When a new user places an order, even without previously completed service orders, there will still be numerous pre-order attempts, account logins, or registrations—short-term order behavior sequences related to the user's order behavior—and long-term account behavior sequences related to the user's account. Therefore, risk identification can be performed based on these behavior sequences, providing better coverage for new users. For black market and gray market operators, frequent attempts to bypass existing risk control systems are precisely the input features of the risk identification model, allowing it to identify risks more specifically. Furthermore, compared to single-dimensional behavior sequences, the short-term order behavior sequences, long-term account behavior sequences, and static data input to this risk identification model integrate multiple sequences and their attributes, providing a more comprehensive representation of the user's intent and enabling the risk identification model to more accurately identify potential risks.

[0080] In one embodiment of this disclosure, the risk identification method can be applied to computers, computing devices, electronic devices, servers, service clusters, etc., that are capable of performing risk identification.

[0081] In one embodiment of this disclosure, the short-term order behavior sequence refers to features related to a user's order behavior within a short period. "Short-term" refers to a preset first historical time period, which can be a short period of time prior to the current moment, such as 7 days. The order behavior sequence can include the order status of each order within the past 7 days, the time interval between the order placement time of the original order and the current order placement time, the time interval between the original order location and the current order location, and so on. Here, the order can be a ride-hailing order or a shopping order, etc. The order status can be various information such as "order placed but not paid," "order completed," "order in progress," etc. For a ride-hailing order, the order location refers to the pick-up location; for a shopping order, the order location refers to the delivery location.

[0082] In one embodiment of this disclosure, the long-term account behavior sequence refers to the behavioral characteristics related to a user's account over a long period of time. "Long-term" refers to a preset second historical time period, which can be a long period preceding the current moment, such as a historical month or a year. The long-term account behavior sequence may include account switching behaviors within a year, such as account switching, device switching, changing the linked mobile phone number, etc.

[0083] In one embodiment of this disclosure, the static data includes order features related to the user's current order. For example, if the order is a ride-hailing order, these features may include the estimated price, estimated duration, order distance, geographical location, etc.; if the order is a shopping order, these features may include the order price, delivery location, etc. The static data also includes the user's historical order statistics, such as the user's historical completed order volume, historical order completion time, historical order distance, etc.

[0084] In one embodiment of this disclosure, the risk identification model can identify risks based on users' short-term order behavior sequences, long-term account behavior sequences, and static data. The risk identification model can be trained using sample data.

[0085] In this embodiment, short-term order behavior sequences, long-term account behavior sequences, and static data of users can be obtained first. Then, these sequences are input into a preset risk identification model, which is then executed to obtain the risk identification results output by the model. This way, when a new user places an order, even without previously completed service orders, there will still be numerous pre-order attempts, account logins, or registrations—short-term order behavior sequences related to the user's order behavior and long-term account behavior sequences related to the user's account. Therefore, risk identification can be performed based on these behavior sequences, providing better coverage for new users. For black market and gray market operators, frequent attempts to bypass existing risk control systems are precisely the input features of the risk identification model, allowing it to identify risks more specifically. Moreover, compared to single-dimensional behavior sequences, the short-term order behavior sequences, long-term account behavior sequences, and static data input into the risk identification model integrate multiple sequences and their attributes, providing a more comprehensive representation of the user's intent and enabling the risk identification model to more accurately identify potential risks.

[0086] In one embodiment of this disclosure, the risk identification result includes a risk score, and the risk identification method further includes the following steps:

[0087] When the risk score is greater than a preset threshold, risk processing is performed.

[0088] In this implementation, the risk score can be a risk probability value. The higher the risk score, the greater the risk. When the risk score is greater than a preset threshold, it indicates that the current order has a high risk. At this time, risk handling will be carried out, including risk blocking, risk warning and other processing.

[0089] In one embodiment of this disclosure, the risk identification result includes a risk feature vector, and the risk identification method further includes the following steps:

[0090] Risk analysis is performed based on the aforementioned risk feature vector.

[0091] In this implementation, the risk feature vector can be combined with other feature vectors for risk analysis. For example, the risk feature vector can be fused with other feature vectors and then input into a comprehensive risk identification model. The comprehensive risk identification model can be executed to obtain the comprehensive risk result output by the comprehensive risk identification model.

[0092] In one embodiment of this disclosure, step S102 of the risk identification method described above may include the following steps:

[0093] The user's short-term order behavior sequence is input into the first sub-model, and the first sub-model is executed to obtain short-term sequence features.

[0094] The long-term account behavior sequence is input into the second sub-model, and the second sub-model is executed to obtain the long-term sequence features.

[0095] The static data is input into a first multilayer perceptron (MLP), and the first MLP is executed to obtain static features.

[0096] The short-term sequence features, long-term sequence features, and static features are input into the second MLP, and the second MLP is executed to obtain the risk identification result.

[0097] In this embodiment, the risk identification model includes a first sub-model, a second sub-model, a first MLP (Multilayer Perceptron), and a second MLP. The first and second sub-models are used to extract important features from the behavioral sequence and extract the relationship features between the sequences. The first MLP is used to extract features from the static data, and the second MLP can perform risk identification based on the extracted short-term sequence features, long-term sequence features, and static features.

[0098] In this implementation, the MLP is also called an Artificial Neural Network (ANN), which includes an input layer, an output layer, and multiple hidden layers between the input and output layers. The simplest MLP may contain only one hidden layer.

[0099] In one embodiment of this disclosure, the first sub-model and the second sub-model can be an LSTM (Long Short-Term Memory) model with an attention mechanism, a transformer (deep self-attention transform network) model, or a textCNN (text Convolutional Neural Networks).

[0100] In this implementation, the LSTM model is a temporal recurrent neural network, primarily designed to address the vanishing and exploding gradient problems during long sequence training. The LSTM model mainly includes a forgetting phase, a selective memory phase, and an output phase. The forgetting phase selectively forgets the input from the previous node; simply put, it "forgets the unimportant and remembers the important." The selective memory phase selectively "memorizes" the input from this phase, emphasizing important features and minimizing less important ones. The output phase determines which features will be used as the output for the current state. An LSTM model with an attention mechanism allows each step to focus on a larger feature set and select important features, enabling the extraction of more comprehensive features representing the user's temporal historical behavior, thereby identifying potential risks.

[0101] In this implementation, the Transformer model relies entirely on self-attention to compute the representations of the input and output, rather than using sequence-aligned recurrent neural networks or convolutional neural networks. Here, "transduction" refers to transforming an input sequence into an output sequence. The Transformer uses an attention mechanism to handle the dependencies between the input and output and is completely recursive.

[0102] In this implementation, the textCNN model includes a convolutional layer and a pooling layer to extract effective features from the sequence data.

[0103] In one embodiment of this disclosure, the step S101 of the risk identification method described above, which involves obtaining the user's short-term order behavior sequence and long-term account behavior sequence, may further include the following steps:

[0104] Obtain the user's initial short-term order behavior sequence data and initial long-term account behavior sequence data;

[0105] The user's initial short-term order behavior sequence data and initial long-term account behavior sequence data are preprocessed to obtain the user's short-term order behavior sequence and long-term account behavior sequence.

[0106] In this embodiment, the user's initial short-term order behavior sequence data and initial long-term account behavior sequence data may have missing values ​​due to various reasons. In order to facilitate the risk identification model to identify risks, the user's initial short-term order behavior sequence data and initial long-term account behavior sequence data can be preprocessed. This preprocessing refers to data format conversion, data supplementation, and other processing. The user's initial short-term order behavior sequence data and initial long-term account behavior sequence data can be preprocessed to obtain short-term order behavior sequence and long-term account behavior sequence that meet the requirements of the risk identification model.

[0107] In one embodiment of this disclosure, the risk identification method described above, which preprocesses the user's initial short-term order behavior sequence data and initial long-term account behavior sequence data to obtain the user's short-term order behavior sequence and long-term account behavior sequence, may include the following steps:

[0108] The user's initial short-term order behavior sequence data and initial long-term account behavior sequence data are digitized to obtain digitized short-term order behavior sequences and long-term account behavior sequences.

[0109] The digitized short-term order behavior sequence is augmented or deleted to obtain a short-term order behavior sequence of the first preset length.

[0110] The long-term account behavior sequence of the digitized user is subjected to sequence completion or sequence deletion operations to obtain a long-term account behavior sequence of the second preset length.

[0111] In this embodiment, each data item in the user's initial short-term order behavior sequence data and initial long-term account behavior sequence data can be identified with a unique digital ID to obtain digitized short-term order behavior sequence and long-term account behavior sequence.

[0112] In this implementation, because each user is different, the number of short-term order behavior sequence data and long-term account behavior sequence data acquired for each user will differ. For example, regarding a user's short-term order behavior sequence, within the past 7 days, some users may have placed 7 orders, resulting in 7 behavior sequence data points, while others may have placed 5 orders, resulting in 5 behavior sequence data points. To ensure the accuracy of subsequent risk identification, it is necessary to acquire user short-term order behavior sequences and long-term account behavior sequences of equal length. The length of the short-term order behavior sequence can be set to a first preset length, and the length of the long-term account behavior sequence can be set to a second preset length. If the length of the obtained digitized short-term order behavior sequence is less than the first preset length, the digitized short-term order behavior sequence is completed to obtain a short-term order behavior sequence of the first preset length. If the length of the obtained digitized short-term order behavior sequence is greater than the first preset length, the extra short-term order behavior sequence is deleted to obtain a short-term order behavior sequence of the first preset length. If the length of the obtained digitized long-term account behavior sequence is less than the second preset length, the digitized long-term account behavior sequence is completed to obtain a long-term account behavior sequence of the second preset length. If the length of the obtained digitized long-term account behavior sequence is greater than the second preset length, the extra long-term account behavior sequence is deleted to obtain a long-term account behavior sequence of the second preset length.

[0113] In this implementation, during completion, the mean or default value of each sequence can be used for completion. During deletion, one or more sequences can be randomly selected for deletion, or the sequence that is furthest from the current time can be deleted.

[0114] In one embodiment of this disclosure, the risk identification method described above, which preprocesses the user's initial short-term order behavior sequence data and initial long-term account behavior sequence data to obtain a portion of the user's short-term order behavior sequence and long-term account behavior sequence, may further include the following steps:

[0115] Embedding mapping is performed on the first preset length short-term order behavior sequence and the second preset length long-term account behavior sequence to obtain the mapped short-term order behavior sequence and long-term account behavior sequence.

[0116] In this implementation, embedding mapping can map high-dimensional spatial data to low-dimensional vector spatial data, while preserving the semantic relationships of the original samples in the vector space as much as possible. Applying embedding mapping to the first preset length of short-term order behavior sequences and the second preset length of long-term account behavior sequences yields more effective low-dimensional short-term order behavior sequences and long-term account behavior sequences.

[0117] In one embodiment of this disclosure, the risk identification method may further include the following steps:

[0118] Obtain sample data, which includes short-term order behavior sequences, long-term account behavior sequences and static data corresponding to each historical sample order, as well as the actual risk results corresponding to each historical sample order;

[0119] The risk identification model is trained using the sample data.

[0120] In this implementation, the sample data may include positive samples (i.e., samples where the actual risk outcome is risky) and negative samples (i.e., samples where the actual risk outcome is risk-free). The short-term order behavior sequence corresponding to each historical sample order refers to the short-term order behavior sequence related to user order behavior within a first historical time period prior to the generation time of the historical sample order. The long-term account behavior sequence corresponding to each historical sample order refers to the long-term account behavior sequence related to user account switching behavior within a second historical time period prior to the generation time of the historical sample order. The static data corresponding to each historical sample order refers to the order data of the historical sample orders and the user statistics data of the users corresponding to the historical sample orders.

[0121] In this implementation, the initial risk identification model can be trained using sample data from each user, and the parameters in the risk identification model can be continuously adjusted until the accuracy of the obtained risk identification model meets the preset conditions, such as the accuracy being greater than a preset threshold.

[0122] In one embodiment of this disclosure, the risk identification method may further include the following steps:

[0123] Obtain application sample data from the application to be migrated. The application sample data includes short-term order behavior sequences, long-term account behavior sequences, and static data corresponding to each historical sample order in the application to be migrated, as well as the actual risk results corresponding to each historical sample order.

[0124] The risk identification model is fine-tuned using the application sample data to obtain a risk identification model for use by the application to be migrated.

[0125] In this implementation, based on the concept of transfer learning, the pre-trained risk identification model from the main platform can be applied to the mini-program application awaiting migration. Since the sample data from the main platform channel and the sample data from the application awaiting migration have a high overall similarity, and the risk identification model trained using the sample data from the main platform channel already possesses the ability to extract both shallow and deep abstract features, fine-tuning the pre-trained risk identification model using the application sample data from the application awaiting migration can yield a risk identification model more suitable for use in that application.

[0126] In this implementation, the risk identification model is trained using application sample data from the application to be migrated, and the parameters in the risk identification model are fine-tuned so that the fine-tuned risk identification model can more accurately identify the risks in the application to be migrated.

[0127] For example, this disclosure provides a risk identification method, which may include the following steps:

[0128] Step S1: Train the risk identification model.

[0129] Specifically, sample data can be obtained, including short-term order behavior sequences, long-term account behavior sequences, and static data corresponding to each historical sample order, as well as the actual risk results corresponding to each historical sample order. The risk identification model can be trained using the sample data.

[0130] Step S2: When the user places an order, such as Figure 1B As shown, it is possible to obtain the user's initial short-term order behavior sequence data, initial long-term account behavior sequence data, and static data, and to preprocess the user's initial short-term order behavior sequence data and initial long-term account behavior sequence data.

[0131] Specifically, the user's initial short-term order behavior sequence data and initial long-term account behavior sequence data can be digitized to obtain digitized short-term order behavior sequences and long-term account behavior sequences; the digitized short-term order behavior sequences can be augmented or deleted to obtain short-term order behavior sequences of a first preset length; the digitized user's long-term account behavior sequences can be augmented or deleted to obtain long-term account behavior sequences of a second preset length; and the first preset length short-term order behavior sequences and the second preset length long-term account behavior sequences can be embedded and mapped to obtain mapped short-term order behavior sequences and long-term account behavior sequences.

[0132] Step S3: Input the preprocessed initial short-term sequence data and initial long-term sequence data, as well as the static data, into the risk identification model for risk identification. The risk identification model includes a first sub-model, a second sub-model, a first MLP, and a second MLP.

[0133] Specifically, such as Figure 1B As shown, the preprocessed short-term order behavior sequence can be input into the first sub-model, executed, and short-term sequence features can be obtained; the preprocessed long-term account behavior sequence can be input into the second sub-model, executed, and long-term sequence features can be obtained; the short-term and long-term sequence features can be merged together; the static data can be input into the first multilayer perceptron (MLP), executed, and static features can be obtained; the merged short-term and long-term sequence features, combined with the static features, can be input into the second MLP, executed, and the risk identification result can be obtained. The first and second sub-models can include any of the following models: a Long Short-Term Memory (LSTM) model with an attention mechanism, a deep self-attention transform network (transformer) model, or a text classification convolutional neural network (textCNN) model.

[0134] Step S4: Perform risk management based on the risk identification results.

[0135] Specifically, the risk identification result includes a risk score. When the risk score exceeds a preset threshold, risk processing measures such as risk blocking are implemented. The risk identification result also includes a risk feature vector, which can be used for further risk analysis.

[0136] Step S5: Transfer the trained risk identification model to other applications.

[0137] Specifically, application sample data can be obtained from the application to be migrated. The application sample data includes short-term order behavior sequences, long-term account behavior sequences and static data corresponding to each historical sample order in the application to be migrated, as well as the actual risk results corresponding to each historical sample order. The risk identification model can be fine-tuned using the application sample data to obtain a risk identification model for use by the application to be migrated.

[0138] Figure 2 A structural block diagram of a risk identification device according to an embodiment of the present disclosure is shown. This device can be implemented as part or all of an electronic device through software, hardware, or a combination of both.

[0139] like Figure 2 As shown, the risk identification device 200 includes a first acquisition module 201 and an identification module 202.

[0140] The first acquisition module 201 is configured to acquire a user's short-term order behavior sequence, long-term account behavior sequence, and static data. The short-term order behavior sequence includes features related to the user's order behavior within a preset first historical time period. The long-term account behavior sequence includes behavioral features related to the user's account within a preset second historical time period. The static data includes order features related to the user's current order and the user's historical order statistical features. The duration of the historical time period is longer than the duration of the first historical time period.

[0141] The identification module 202 is configured to input the user's short-term order behavior sequence, long-term account behavior sequence and static data into a preset risk identification model, execute the risk identification model, and obtain the risk identification result output by the risk identification model.

[0142] As mentioned above, with the development of internet services, more and more services are provided to users online, such as online shopping and ride-hailing payments. When providing services, some malicious users may exploit platform vulnerabilities to engage in fraudulent activities, such as defrauding the platform of advance payments or deliberately refusing to pay. These fraudulent activities can be distributed across various financial aspects of the service. Once these vulnerabilities are exploited by black market groups, it can cause significant financial losses and damage the platform's interests. Therefore, risk identification is necessary to prevent attacks from black market groups when providing services. Current risk identification methods rely on either extensive manual strategies or machine learning models based on user statistical characteristics. Manual strategies require a large amount of human experience and case analysis to summarize patterns and set risk identification strategies, suitable for quickly patching vulnerabilities, but they are labor-intensive and lack generalization. Machine learning models based on user statistical characteristics have limited applicability to new users due to the lack of historical completed service orders. Furthermore, when black market groups attempt to bypass the machine learning model, it can no longer adaptively re-identify them, posing a significant risk.

[0143] Considering the above problems, this embodiment provides a risk identification method. It uses a risk identification model to identify risks based on short-term order behavior sequences, long-term account behavior sequences, and static data. When a new user places an order, even without previously completed service orders, there will still be numerous pre-order attempts, account logins, or registrations—short-term order behavior sequences related to the user's order behavior—and long-term account behavior sequences related to the user's account. Therefore, risk identification can be performed based on these behavior sequences, providing better coverage for new users. For black market and gray market operators, frequent attempts to bypass existing risk control systems are precisely the input features of the risk identification model, allowing it to identify risks more specifically. Furthermore, compared to single-dimensional behavior sequences, the short-term order behavior sequences, long-term account behavior sequences, and static data input to this risk identification model integrate multiple sequences and their attributes, providing a more comprehensive representation of the user's intent and enabling the risk identification model to more accurately identify potential risks.

[0144] In one embodiment of this disclosure, the risk identification device can be applied to computers, computing devices, electronic devices, servers, service clusters, etc., that are capable of performing risk identification.

[0145] In one embodiment of this disclosure, the short-term order behavior sequence refers to features related to a user's order behavior within a short period. "Short-term" refers to a preset first historical time period, which can be a short period of time prior to the current moment, such as 7 days. The order behavior sequence can include the order status of each order within the past 7 days, the time interval between the order placement time of the original order and the current order placement time, the time interval between the original order location and the current order location, and so on. Here, the order can be a ride-hailing order or a shopping order, etc. The order status can be various information such as "order placed but not paid," "order completed," "order in progress," etc. For a ride-hailing order, the order location refers to the pick-up location; for a shopping order, the order location refers to the delivery location.

[0146] In one embodiment of this disclosure, the long-term account behavior sequence refers to the behavioral characteristics related to a user's account over a long period of time. "Long-term" refers to a preset second historical time period, which can be a long period preceding the current moment, such as a historical month or a year. The long-term account behavior sequence may include account switching behaviors within a year, such as account switching, device switching, changing the linked mobile phone number, etc.

[0147] In one embodiment of this disclosure, the static data includes order features related to the user's current order. For example, if the order is a ride-hailing order, these features may include the estimated price, estimated duration, order distance, geographical location, etc.; if the order is a shopping order, these features may include the order price, delivery location, etc. The static data also includes the user's historical order statistics, such as the user's historical completed order volume, historical order completion time, historical order distance, etc.

[0148] In one embodiment of this disclosure, the risk identification model can identify risks based on users' short-term order behavior sequences, long-term account behavior sequences, and static data. The risk identification model can be trained using sample data.

[0149] In one embodiment of this disclosure, the risk identification result output by the risk identification model includes a risk score. When the risk score is greater than a preset threshold, risk processing is performed. The risk score can be a risk probability value; the higher the risk score, the greater the risk. When the risk score is greater than the preset threshold, it indicates that the current order has a high risk, and risk processing will be performed at this time. This risk processing includes risk blocking, risk warning, and other processing.

[0150] In this embodiment, short-term order behavior sequences, long-term account behavior sequences, and static data of users can be obtained first. Then, these sequences are input into a preset risk identification model, which is then executed to obtain the risk identification results output by the model. This way, when a new user places an order, even without previously completed service orders, there will still be numerous pre-order attempts, account logins, or registrations—short-term order behavior sequences related to the user's order behavior and long-term account behavior sequences related to the user's account. Therefore, risk identification can be performed based on these behavior sequences, providing better coverage for new users. For black market and gray market operators, frequent attempts to bypass existing risk control systems are precisely the input features of the risk identification model, allowing it to identify risks more specifically. Moreover, compared to single-dimensional behavior sequences, the short-term order behavior sequences, long-term account behavior sequences, and static data input into the risk identification model integrate multiple sequences and their attributes, providing a more comprehensive representation of the user's intent and enabling the risk identification model to more accurately identify potential risks.

[0151] In one embodiment of this disclosure, the identification module 202 is configured as follows:

[0152] The user's short-term order behavior sequence is input into the first sub-model, and the first sub-model is executed to obtain short-term sequence features.

[0153] The long-term account behavior sequence is input into the second sub-model, and the second sub-model is executed to obtain the long-term sequence features.

[0154] The static data is input into a first multilayer perceptron (MLP), and the first MLP is executed to obtain static features;

[0155] The short-term sequence features, long-term sequence features, and static features are input into the second MLP, and the second MLP is executed to obtain the risk identification result.

[0156] In this embodiment, the risk identification model includes a first sub-model, a second sub-model, a first MLP (Multilayer Perceptron), and a second MLP. The first and second sub-models are used to extract important features from the behavioral sequence and extract the relationship features between the sequences. The first MLP is used to extract features from the static data, and the second MLP can perform risk identification based on the extracted short-term sequence features, long-term sequence features, and static features.

[0157] In this implementation, the MLP is also called an Artificial Neural Network (ANN), which includes an input layer, an output layer, and multiple hidden layers between the input and output layers. The simplest MLP may contain only one hidden layer.

[0158] In one embodiment of this disclosure, the first sub-model and the second sub-model can be an LSTM (Long Short-Term Memory) model with an attention mechanism, a transformer (deep self-attention transform network) model, or a textCNN (text Convolutional Neural Networks).

[0159] In this implementation, the LSTM model is a temporal recurrent neural network, primarily designed to address the vanishing and exploding gradient problems during long sequence training. The LSTM model mainly includes a forgetting phase, a selective memory phase, and an output phase. The forgetting phase selectively forgets the input from the previous node; simply put, it "forgets the unimportant and remembers the important." The selective memory phase selectively "memorizes" the input from this phase, emphasizing important features and minimizing less important ones. The output phase determines which features will be used as the output for the current state. An LSTM model with an attention mechanism allows each step to focus on a larger feature set and select important features, enabling the extraction of more comprehensive features representing the user's temporal historical behavior, thereby identifying potential risks.

[0160] In this implementation, the Transformer model relies entirely on self-attention to compute the representations of the input and output, rather than using sequence-aligned recurrent neural networks or convolutional neural networks. Here, "transduction" refers to transforming an input sequence into an output sequence. The Transformer uses an attention mechanism to handle the dependencies between the input and output and is completely recursive.

[0161] In this implementation, the textCNN model includes a convolutional layer and a pooling layer to extract effective features from the sequence data.

[0162] In one embodiment of this disclosure, the first acquisition module 201 is configured to:

[0163] Obtain the user's initial short-term order behavior sequence data and initial long-term account behavior sequence data;

[0164] The user's initial short-term order behavior sequence data and initial long-term account behavior sequence data are preprocessed to obtain the user's short-term order behavior sequence and long-term account behavior sequence.

[0165] In this embodiment, the user's initial short-term order behavior sequence data and initial long-term account behavior sequence data may have missing values ​​due to various reasons. In order to facilitate the risk identification model to identify risks, the user's initial short-term order behavior sequence data and initial long-term account behavior sequence data can be preprocessed. This preprocessing refers to data format conversion, data supplementation, and other processing. The user's initial short-term order behavior sequence data and initial long-term account behavior sequence data can be preprocessed to obtain short-term order behavior sequence and long-term account behavior sequence that meet the requirements of the risk identification model.

[0166] In one embodiment of this disclosure, the part of the first acquisition module 201 that preprocesses the user's initial short-term order behavior sequence data and initial long-term account behavior sequence data to obtain the user's short-term order behavior sequence and long-term account behavior sequence is configured as follows:

[0167] The user's initial short-term order behavior sequence data and initial long-term account behavior sequence data are digitized to obtain digitized short-term order behavior sequences and long-term account behavior sequences.

[0168] The digitized short-term order behavior sequence is augmented or deleted to obtain a short-term order behavior sequence of the first preset length.

[0169] The long-term account behavior sequence of the digitized user is subjected to sequence completion or sequence deletion operations to obtain a long-term account behavior sequence of the second preset length.

[0170] In this embodiment, each data item in the user's initial short-term order behavior sequence data and initial long-term account behavior sequence data can be identified with a unique digital ID to obtain digitized short-term order behavior sequence and long-term account behavior sequence.

[0171] In this implementation, because each user is different, the number of short-term order behavior sequence data and long-term account behavior sequence data acquired for each user will differ. For example, regarding a user's short-term order behavior sequence, within the past 7 days, some users may have placed 7 orders, resulting in 7 behavior sequence data points, while others may have placed 5 orders, resulting in 5 behavior sequence data points. To ensure the accuracy of subsequent risk identification, it is necessary to acquire user short-term order behavior sequences and long-term account behavior sequences of equal length. The length of the short-term order behavior sequence can be set to a first preset length, and the length of the long-term account behavior sequence can be set to a second preset length. If the length of the obtained digitized short-term order behavior sequence is less than the first preset length, the digitized short-term order behavior sequence is completed to obtain a short-term order behavior sequence of the first preset length. If the length of the obtained digitized short-term order behavior sequence is greater than the first preset length, the extra short-term order behavior sequence is deleted to obtain a short-term order behavior sequence of the first preset length. If the length of the obtained digitized long-term account behavior sequence is less than the second preset length, the digitized long-term account behavior sequence is completed to obtain a long-term account behavior sequence of the second preset length. If the length of the obtained digitized long-term account behavior sequence is greater than the second preset length, the extra long-term account behavior sequence is deleted to obtain a long-term account behavior sequence of the second preset length.

[0172] In this implementation, during completion, the mean or default value of each sequence can be used for completion. During deletion, one or more sequences can be randomly selected for deletion, or the sequence that is furthest from the current time can be deleted.

[0173] In one embodiment of this disclosure, the part of the first acquisition module 201 that preprocesses the user's initial short-term order behavior sequence data and initial long-term account behavior sequence data to obtain the user's short-term order behavior sequence and long-term account behavior sequence is configured as follows:

[0174] Embedding mapping is performed on the first preset length short-term order behavior sequence and the second preset length long-term account behavior sequence to obtain the mapped short-term order behavior sequence and long-term account behavior sequence.

[0175] In this implementation, embedding mapping can map high-dimensional spatial data to low-dimensional vector spatial data, while preserving the semantic relationships of the original samples in the vector space as much as possible. Applying embedding mapping to the first preset length of short-term order behavior sequences and the second preset length of long-term account behavior sequences yields more effective low-dimensional short-term order behavior sequences and long-term account behavior sequences.

[0176] In one embodiment of this disclosure, the apparatus further includes:

[0177] The second acquisition module is configured to acquire sample data, which includes short-term order behavior sequences, long-term account behavior sequences and static data corresponding to each historical sample order, as well as the actual risk results corresponding to each historical sample order.

[0178] The training module is configured to train the risk identification model using the sample data.

[0179] In this implementation, the sample data may include positive samples (i.e., samples where the actual risk outcome is risky) and negative samples (i.e., samples where the actual risk outcome is risk-free). The short-term order behavior sequence corresponding to each historical sample order refers to the short-term order behavior sequence related to user order behavior within a first historical time period prior to the generation time of the historical sample order. The long-term account behavior sequence corresponding to each historical sample order refers to the long-term account behavior sequence related to user account switching behavior within a second historical time period prior to the generation time of the historical sample order. The static data corresponding to each historical sample order refers to the order data of the historical sample orders and the user statistics data of the users corresponding to the historical sample orders.

[0180] In this implementation, the initial risk identification model can be trained using sample data from each user, and the parameters in the risk identification model can be continuously adjusted until the accuracy of the obtained risk identification model meets the preset conditions, such as the accuracy being greater than a preset threshold.

[0181] In one embodiment of this disclosure, the apparatus further includes:

[0182] The third acquisition module is configured to acquire application sample data from the application to be migrated. The application sample data includes short-term order behavior sequences, long-term account behavior sequences, and static data corresponding to each historical sample order in the application to be migrated, as well as the actual risk results corresponding to each historical sample order.

[0183] The fine-tuning module is configured to fine-tune the risk identification model using the application sample data to obtain a risk identification model for use by the application to be migrated.

[0184] In one embodiment of this disclosure, the risk identification result includes a risk feature vector, and the device further includes:

[0185] The analysis module is configured to perform risk analysis based on the risk feature vector.

[0186] In this implementation, the risk feature vector can be combined with other feature vectors for risk analysis. For example, the risk feature vector can be fused with other feature vectors and then input into a comprehensive risk identification model. The comprehensive risk identification model can be executed to obtain the comprehensive risk result output by the comprehensive risk identification model.

[0187] In this implementation, based on the concept of transfer learning, the pre-trained risk identification model from the main platform can be applied to the mini-program application awaiting migration. Since the sample data from the main platform channel and the sample data from the application awaiting migration have a high overall similarity, and the risk identification model trained using the sample data from the main platform channel already possesses the ability to extract both shallow and deep abstract features, fine-tuning the pre-trained risk identification model using the application sample data from the application awaiting migration can yield a risk identification model more suitable for use in that application.

[0188] In this implementation, the risk identification model is trained using application sample data from the application to be migrated, and the parameters in the risk identification model are fine-tuned so that the fine-tuned risk identification model can more accurately identify the risks in the application to be migrated.

[0189] This disclosure also discloses an electronic device, Figure 3 A structural block diagram of an electronic device according to an embodiment of the present disclosure is shown.

[0190] like Figure 3 As shown, the electronic device 300 includes a memory 301 and a processor 302, wherein the memory 301 is used to store one or more computer instructions, wherein the one or more computer instructions are executed by the processor 302 to implement the method according to an embodiment of the present disclosure.

[0191] Figure 4 A schematic diagram of the structure of a computer system suitable for implementing the method according to embodiments of the present disclosure is shown.

[0192] like Figure 4As shown, the computer system 400 includes a processing unit 401, which can execute various processes described above based on a program stored in a read-only memory (ROM) 402 or a program loaded from a storage section 408 into a random access memory (RAM) 403. The RAM 403 also stores various programs and data required for the operation of the system 400. The processing unit 401, ROM 402, and RAM 403 are interconnected via a bus 404. An input / output (I / O) interface 405 is also connected to the bus 404.

[0193] The following components are connected to I / O interface 405: an input section 406 including a keyboard, mouse, etc.; an output section 407 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 408 including a hard disk, etc.; and a communication section 409 including a network interface card such as a LAN card, modem, etc. The communication section 409 performs communication processing via a network such as the Internet. A drive 410 is also connected to I / O interface 405 as needed. A removable medium 411, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on drive 410 as needed so that computer programs read from it can be installed into storage section 408 as needed. The processing unit 401 can be implemented as a CPU, GPU, TPU, FPGA, NPU, etc.

[0194] In particular, according to embodiments of this disclosure, the methods described above can be implemented as computer software programs. For example, embodiments of this disclosure include a computer program product comprising computer instructions that, when executed by a processor, implement the steps of the methods described above. In such embodiments, the computer program product can be downloaded and installed from a network via communication section 409, and / or installed from removable media 411.

[0195] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0196] The units or modules described in the embodiments of this disclosure can be implemented in software or programmable hardware. The described units or modules can also be located in a processor, and the names of these units or modules do not necessarily constitute a limitation on the unit or module itself.

[0197] In another aspect, this disclosure also provides a computer-readable storage medium, which may be a computer-readable storage medium included in the electronic device or computer system described above; or it may be a standalone computer-readable storage medium not assembled into a device. The computer-readable storage medium stores one or more programs, which are used by one or more processors to perform the methods described in this disclosure.

[0198] The above description is merely a preferred embodiment of this disclosure and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of the invention involved in this disclosure is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the inventive concept. For example, technical solutions formed by substituting the above-described features with (but not limited to) technical features disclosed in this disclosure that have similar functions.

Claims

1. A risk identification method, comprising: The system acquires a user's short-term order behavior sequence, long-term account behavior sequence, and static data. The short-term order behavior sequence includes features related to the user's order behavior within a preset first historical time period. The long-term account behavior sequence includes behavioral features related to the user's account within a preset second historical time period. The static data includes order features related to the user's current order and the user's historical order statistical features. The duration of the second historical time period is longer than the duration of the first historical time period. The user's short-term order behavior sequence is input into the first sub-model, and the first sub-model is executed to obtain short-term sequence features. The long-term account behavior sequence is input into the second sub-model, and the second sub-model is executed to obtain the long-term sequence features. The static data is input into the first MLP, and the first MLP is executed to obtain static features; The short-term sequence features, long-term sequence features, and static features are input into the second MLP, and the second MLP is executed to obtain the risk identification result.

2. The method according to claim 1, wherein, The first sub-model and the second sub-model include any of the following models: a Long Short-Term Memory (LSTM) model with an attention mechanism, a Deep Self-Attention Transformer (transformer) model, or a Text Classification Convolutional Neural Network (textCNN) model.

3. The method according to claim 1, wherein, The acquisition of the user's short-term order behavior sequence and long-term account behavior sequence includes: Obtain the user's initial short-term order behavior sequence data and initial long-term account behavior sequence data; The user's initial short-term order behavior sequence data and initial long-term account behavior sequence data are preprocessed to obtain the user's short-term order behavior sequence and long-term account behavior sequence.

4. The method according to claim 3, wherein, The step of preprocessing the user's initial short-term order behavior sequence data and initial long-term account behavior sequence data to obtain the user's short-term order behavior sequence and long-term account behavior sequence includes: The user's initial short-term order behavior sequence data and initial long-term account behavior sequence data are digitized to obtain digitized short-term order behavior sequences and long-term account behavior sequences. The digitized short-term order behavior sequence is augmented or deleted to obtain a short-term order behavior sequence of the first preset length. The digitized long-term account behavior sequence is subjected to sequence completion or sequence deletion operations to obtain a long-term account behavior sequence of the second preset length.

5. The method according to claim 4, wherein, The step of preprocessing the user's initial short-term order behavior sequence data and initial long-term account behavior sequence data to obtain the user's short-term order behavior sequence and long-term account behavior sequence further includes: Embedding mapping is performed on the first preset length short-term order behavior sequence and the second preset length long-term account behavior sequence to obtain the mapped short-term order behavior sequence and long-term account behavior sequence.

6. The method according to claim 1, wherein, The method further includes: Obtain sample data, which includes short-term order behavior sequences, long-term account behavior sequences and static data corresponding to each historical sample order, as well as the actual risk results corresponding to each historical sample order; The risk identification model is trained using the sample data.

7. The method according to claim 1, wherein, The method further includes: Obtain application sample data from the application to be migrated. The application sample data includes short-term order behavior sequences, long-term account behavior sequences, and static data corresponding to each historical sample order in the application to be migrated, as well as the actual risk results corresponding to each historical sample order. The risk identification model is fine-tuned using the application sample data to obtain a risk identification model for use by the application to be migrated.

8. The method according to claim 1, wherein, The risk identification result includes a risk feature vector, and the method further includes: Risk analysis is performed based on the aforementioned risk feature vector.

9. A risk identification device, comprising: The first acquisition module is configured to acquire a user's short-term order behavior sequence, long-term account behavior sequence, and static data. The short-term order behavior sequence includes features related to the user's order behavior within a preset first historical time period. The long-term account behavior sequence includes behavioral features related to the user's account within a preset second historical time period. The static data includes order features related to the user's current order and the user's historical order statistical features. The duration of the second historical time period is longer than the duration of the first historical time period. The identification module is configured to input the user's short-term order behavior sequence, long-term account behavior sequence, and static data into a preset risk identification model, execute the risk identification model, and obtain the risk identification result output by the risk identification model. This includes: inputting the user's short-term order behavior sequence into a first sub-model, executing the first sub-model to obtain short-term sequence features; inputting the long-term account behavior sequence into a second sub-model, executing the second sub-model to obtain long-term sequence features; inputting the static data into a first MLP, executing the first MLP to obtain static features; and inputting the short-term sequence features, long-term sequence features, and static features into a second MLP, executing the second MLP to obtain the risk identification result.

10. An electronic device comprising a memory and a processor; wherein, The memory is used to store one or more computer instructions, wherein the one or more computer instructions are executed by the processor to implement the steps of the method according to any one of claims 1 to 8.

11. A readable storage medium having stored thereon computer instructions that, when executed by a processor, implement the steps of the method according to any one of claims 1 to 8.

12. A computer program product comprising computer instructions that, when executed by a processor, implement the steps of the method according to any one of claims 1 to 8.

Images