Order type determination method and apparatus, computer device, and storage medium

Abstract

The application relates to an order type determination method and device, computer equipment and a storage medium. It relates to the payment and finance field, and comprises the following steps: obtaining order characteristics of a target order based on the characteristic values of the target order in multiple preset order characteristic dimensions; determining an aggregation characteristic value of the target order based on the order characteristics of the target order and the order characteristics of historical orders in a historical order set; the aggregation characteristic value is used to represent the aggregation degree of the target order and the historical orders in the case of distribution according to the order characteristics; combining the characteristic values of the target order in at least one preset order characteristic dimension and the aggregation characteristic value to obtain a target combination feature; and predicting the order type to which the target order belongs by using the target combination feature. The method can improve the prediction accuracy of the order type.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a method, apparatus, computer device, and storage medium for determining order type. Background Technology

[0002] With the development of computer and internet technology, more and more transactions are being conducted online. For example, people can pay for goods online. However, with the continuous development of online transactions, abnormal transaction orders are constantly emerging. For instance, there have been cases of abnormal payments in social media applications.

[0003] In traditional techniques, to predict abnormal trading orders, trading orders are typically scored to determine whether they are abnormal or normal. However, scoring relies heavily on experience and subjective factors, resulting in low reliability and consequently low accuracy in predicting the type of trading order. Summary of the Invention

[0004] Therefore, it is necessary to provide an order type determination method, apparatus, computer equipment, computer-readable storage medium, and computer program product that can improve the accuracy of order type prediction in response to the above-mentioned technical problems.

[0005] On one hand, this application provides a method for determining order type. The method includes: obtaining order features of the target order based on feature values ​​of the target order under multiple preset order feature dimensions; determining a clustering feature value of the target order based on the order features of the target order and the order features of historical orders in a historical order set; the clustering feature value characterizes the degree of clustering between the target order and the historical orders when distributed according to order features; the historical order set includes normal historical orders and abnormal historical orders; combining the feature values ​​of the target order under at least one of the preset order feature dimensions with the clustering feature value to obtain a target combination feature of the target order; and using the target combination feature to predict the order type to which the target order belongs.

[0006] On the other hand, this application also provides an order type determination device. The device includes: an order feature obtaining module, configured to obtain order features of the target order based on feature values ​​of the target order under multiple preset order feature dimensions; a clustering degree obtaining module, configured to determine a clustering degree feature value of the target order based on the order features of the target order and the order features of historical orders in a historical order set; the clustering degree feature value characterizes the degree of clustering between the target order and the historical orders when distributed according to order features; the historical order set includes normal historical orders and abnormal historical orders; a combination feature obtaining module, configured to combine the feature values ​​of the target order under at least one of the preset order feature dimensions with the clustering degree feature value to obtain a target combination feature of the target order; and an order type prediction module, configured to predict the order type to which the target order belongs using the target combination feature.

[0007] In some embodiments, the target order is an order belonging to a target object in a social application; the combined feature obtaining module is further configured to determine the associated object of the target object in the social application; based on the order anomaly information of the associated object within a specified time period, the order anomaly feature of the associated object is encoded; the feature value of the target order under at least one of the preset order feature dimensions, the clustering feature value, and the order anomaly feature are combined to obtain the target combined feature of the target order.

[0008] In some embodiments, the clustering degree obtaining module is further configured to determine the feature value of the target order under the target clustering degree dimension based on the order features of the target order and the order features of historical orders in the historical order set, thereby obtaining the clustering degree feature value of the target order; the combined feature obtaining module is further configured to combine the feature value of the target order under the target order feature dimension with the feature value under the target clustering degree dimension to obtain the target combined feature of the target order; the target order feature dimension and the target clustering degree dimension are obtained by performing redundancy removal processing on the plurality of preset order feature dimensions and the plurality of preset clustering degrees.

[0009] In some embodiments, the apparatus further includes a dimension determination module for determining the target order feature dimension and the target clustering dimension. The dimension determination module is configured to: for each historical order in the historical order set, use a preset clustering calculation method corresponding to multiple preset clustering dimensions to determine the clustering feature value of the historical order under each preset clustering dimension; combine the order features of the historical order with the clustering feature values ​​of the historical order under each preset clustering dimension to obtain the initial combined features of the historical order; for each feature dimension among the preset clustering dimensions and the preset order feature dimensions, statistically analyze the feature values ​​of the feature dimensions in the initial combined features of the historical orders to obtain the dimension weight of the feature dimension; and perform redundancy removal processing on each preset clustering dimension and each preset order feature dimension according to the dimension weight to obtain the target order feature dimension and the target clustering dimension.

[0010] In some embodiments, the dimension determination module is further configured to select at least one preset order feature dimension and at least one preset clustering dimension from each preset clustering dimension and each preset order feature dimension in descending order of dimension weight, forming a feature dimension set; for any two feature dimensions in the feature dimension set, calculate the correlation between the two feature dimensions; if the correlation is greater than a correlation threshold, remove one of the two feature dimensions from the feature dimension set to obtain the target order feature dimension and the target clustering dimension.

[0011] In some embodiments, the combined feature obtaining module is further configured to obtain a clustering reference value; the clustering reference value is obtained by statistically analyzing the clustering feature values ​​of multiple normal orders; the difference between the clustering feature value corresponding to the target order and the clustering reference value is calculated to obtain the clustering difference value of the target order; the feature value of the target order under the target order feature dimension, the feature value under the target clustering dimension, and the clustering difference value of the target order are combined to obtain the target combined feature of the target order.

[0012] In some embodiments, the combined feature obtaining module is further configured to determine normal historical orders whose actual order type is normal orders from the historical order set; calculate the clustering feature value of each normal historical order using a specified clustering degree calculation method to obtain a clustering feature value set; and perform statistics on the clustering feature values ​​in the clustering feature value set to obtain the clustering degree reference value.

[0013] In some embodiments, the order type to which the target order belongs is predicted based on a trained anomaly score prediction model and an anomaly score threshold; the order type prediction module is further configured to input the target combined features into the trained anomaly score prediction model to predict the order anomaly score of the target order; if the order anomaly score of the target order is greater than the anomaly score threshold, the order type to which the target order belongs is determined to be an anomaly order.

[0014] In some embodiments, the apparatus further includes a model training module for obtaining the trained anomaly score prediction model. The model training module is configured to, for each historical order in the historical order set, combine the feature value of the historical order in the target order feature dimension with the feature value of the historical order in the target clustering dimension to obtain the historical combined feature of the historical order; input the historical combined feature of each historical order into the anomaly score prediction model to be trained to obtain the predicted anomaly score of each historical order; and adjust the model parameters of the anomaly score prediction model based on the predicted anomaly score and the actual anomaly score of each historical order to obtain the trained anomaly score prediction model.

[0015] In some embodiments, the model training module is further configured to: adjust the model parameters of the anomaly score prediction model based on the predicted anomaly scores and the actual anomaly scores of each historical order to obtain a parameter-adjusted anomaly score prediction model; use the parameter-adjusted anomaly score prediction model to predict the order types of multiple verification orders to obtain the predicted anomaly scores of each verification order; determine the predicted order type of the verification order based on the predicted anomaly scores of the verification order; determine the number of verification orders in each verification order whose actual order type is anomaly order to obtain a first order number; determine the number of verification orders in each verification order whose predicted order type and actual order type are both anomaly order to obtain a second order number; determine the anomaly order coverage rate of the parameter-adjusted anomaly score prediction model based on the first order number and the second order number; and, if the anomaly order coverage rate is greater than a coverage threshold, determine the parameter-adjusted anomaly score prediction model as the trained anomaly score prediction model.

[0016] In some embodiments, the model training module is further configured to: statistically analyze the predicted anomaly scores of each of the verification orders to obtain an anomaly score threshold; determine the predicted order type of the verification orders based on the predicted anomaly scores and the anomaly score threshold; determine the number of verification orders in each of the verification orders whose predicted order type is an anomaly order to obtain the third order quantity; determine the accuracy representation value of the anomaly score threshold based on the third order quantity and the second order quantity; and, if the anomaly order coverage is greater than the coverage threshold and the accuracy representation value of the anomaly score threshold is less than the representation value threshold, determine the parameter-adjusted anomaly score prediction model as the trained anomaly score prediction model.

[0017] In some embodiments, the model training module is further configured to: generate order loss values ​​corresponding to each of the historical orders based on the predicted anomaly scores and the actual anomaly scores of each of the historical orders; determine the weights of normal orders and anomaly orders; wherein the weights of anomaly orders are greater than the weights of normal orders; use the weights of normal orders and anomaly orders to statistically analyze the order loss values ​​corresponding to each of the historical orders to obtain model loss values; and adjust the model parameters of the anomaly score prediction model based on the model loss values ​​to obtain the trained anomaly score prediction model.

[0018] On the other hand, this application also provides a computer device. The computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the steps in the above-described order type determination method.

[0019] On the other hand, this application also provides a computer-readable storage medium. The computer-readable storage medium stores a computer program thereon, which, when executed by a processor, implements the steps in the above-described order type determination method.

[0020] On the other hand, this application also provides a computer program product. The computer program product includes a computer program that, when executed by a processor, implements the steps in the order type determination method described above.

[0021] The aforementioned order type determination method, apparatus, computer equipment, storage medium, and computer program product, since the historical order set includes both normal and abnormal historical orders, use a clustering feature value to characterize the degree of clustering between the target order and historical orders when distributed according to order characteristics. This clustering feature value reflects the relationship between the target order and normal and abnormal orders. Because the feature value of the target order under the preset order feature dimension reflects the characteristics of the target order itself, the target combination feature, composed of the clustering feature value and the feature value of the target order under the preset order feature dimension, predicts the order type to which the target order belongs. This approach considers not only the characteristics of the order itself but also the relationship between the target order and different types of orders, thus improving the accuracy of order type prediction. Attached Figure Description

[0022] Figure 1 This is a diagram illustrating the application environment of the order type determination method in some embodiments;

[0023] Figure 2 This is a flowchart illustrating the order type determination method in some embodiments;

[0024] Figure 3 This is a distribution map obtained by distributing orders according to order characteristics in some embodiments;

[0025] Figure 4 This is a diagram illustrating the application environment of the order type determination method in some embodiments;

[0026] Figure 5 This is a flowchart illustrating the order type determination method in some embodiments;

[0027] Figure 6 A schematic diagram illustrating the selection of feature dimensions in some embodiments;

[0028] Figure 7 This is a flowchart illustrating the order type determination method in some embodiments;

[0029] Figure 8 This is a structural block diagram of the order type determination device in some embodiments;

[0030] Figure 9 These are internal structural diagrams of the computer device in some embodiments;

[0031] Figure 10 This is a diagram showing the internal structure of a computer device in some embodiments. Detailed Implementation

[0032] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0033] The order type determination method provided in this application embodiment can be applied to, for example, Figure 1 In the application environment shown, terminal 102 communicates with server 104 via a network. A data storage system can store the data that server 104 needs to process. The data storage system can be integrated onto server 104, or it can be located in the cloud or on another server. Terminal 102 can have social applications installed, including but not limited to instant messaging applications for individuals or groups. The social applications installed on terminal 102 can provide payment functionality, allowing users to complete transactions using this function. Server 104 can be the server hosting the backend services of the social applications.

[0034] Specifically, when terminal 102 receives a payment operation triggered by the payment function provided by a social application, it sends an order for payment to server 104. This order for payment can also be called a transaction order. Taking this order for payment as the target order, when server 104 receives the target order sent by terminal 102, it can respond to the target order triggered by the social application by obtaining the order features of the target order based on the feature values ​​of the target order under multiple preset order feature dimensions. Based on the order features of the target order and the order features of historical orders in the historical order set, it determines the clustering feature value of the target order. It combines the feature values ​​of the target order under at least one preset order feature dimension with the clustering feature value to obtain the target combination feature of the target order. It uses the target combination feature to predict the order type to which the target order belongs. If it is determined that the order type to which the target order belongs is an abnormal order, it provides an abnormal prompt through the social application. For example, server 104 can send an order abnormal prompt message to terminal 102, and terminal 102 can display the order abnormal prompt message in the social application. Among them, the clustering feature value is used to characterize the degree of clustering between target orders and historical orders when they are distributed according to order characteristics. The historical order set includes normal historical orders and abnormal historical orders.

[0035] The terminal 102 can be, but is not limited to, various desktop computers, laptops, smartphones, tablets, IoT devices, and portable wearable devices. IoT devices can include smart home appliances, in-vehicle terminals, smart voice interaction devices, aircraft, and smart in-vehicle equipment. Smart home appliances can include smart speakers, smart TVs, and smart air conditioners, while portable wearable devices can include smartwatches, smart bracelets, and head-mounted devices. The server 104 can be implemented using a standalone server or a server cluster consisting of multiple servers.

[0036] The order type determination method provided in this application embodiment can relate to the field of payment and financial technology. For example, the historical orders and target orders in the order type determination method provided in this application embodiment are both transaction orders in the field of payment and financial technology.

[0037] The order type determination method provided in this application embodiment can relate to the field of blockchain technology. For example, server 104 can be a node in the blockchain. Server 104 can store the order type to which the predicted target order belongs in the blockchain. Server 104 can also store at least one of the following in the blockchain: historical order set, order features of historical orders, order features of the target order, or trained anomaly score prediction model.

[0038] Blockchain is a novel application model of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanisms, and encryption algorithms. Essentially, a blockchain is a decentralized database, a chain of data blocks linked together using cryptographic methods. Each data block contains information about a batch of network transactions, used to verify the validity of the information (anti-counterfeiting) and generate the next block. A blockchain can include an underlying platform, a platform product service layer, and an application service layer.

[0039] The underlying blockchain platform can include basic services and processing modules such as smart contracts. The basic service module is deployed on all blockchain node devices to verify the validity of business requests. After reaching a consensus on valid requests, it records them in storage. For a new business request, the basic service first performs interface adaptation parsing and authentication (interface adaptation), then encrypts the business information using a consensus algorithm (consensus management), and transmits it completely and consistently to the shared ledger (network communication) for recording and storage. The smart contract module is responsible for contract registration and issuance, as well as contract triggering and execution. Developers can define contract logic using a programming language and publish it to the blockchain (contract registration). According to the contract terms, execution is triggered by calling keys or other events to complete the contract logic. It also provides functions for contract upgrades and cancellations.

[0040] The platform's product service layer provides the basic capabilities and implementation frameworks for typical applications. Developers can leverage these basic capabilities, along with the specific characteristics of their business needs, to implement blockchain-based business logic. The application service layer provides blockchain-based application services to business stakeholders.

[0041] The order type determination method provided in this application embodiment can relate to the field of artificial intelligence. For example, server 104 can use a trained anomaly score prediction model to predict the order type of the target order. The anomaly score prediction model belongs to the neural network model in the field of artificial intelligence.

[0042] Artificial intelligence (AI) refers to the theories, methods, technologies, and application systems that utilize digital computers or computers-controlled machines to simulate, extend, and expand human intelligence, perceive the environment, acquire knowledge, and use that knowledge to achieve optimal results. In other words, AI is a comprehensive technology within computer science that attempts to understand the essence of intelligence and produce new intelligent machines that can react in a way similar to human intelligence. AI studies the design principles and implementation methods of various intelligent machines, enabling them to possess perception, reasoning, and decision-making capabilities.

[0043] Artificial intelligence (AI) is a comprehensive discipline encompassing a wide range of fields, including both hardware and software technologies. Fundamental AI technologies generally include sensors, dedicated AI chips, cloud computing, distributed storage, big data processing, operating / interactive systems, and mechatronics. AI software technologies primarily include computer vision, speech processing, natural language processing, and machine learning / deep learning.

[0044] The solutions provided in this application involve technologies such as machine learning in artificial intelligence, and are specifically illustrated through the following embodiments:

[0045] In some embodiments, such as Figure 2 As shown, a method for determining order type is provided. This method can be executed by a terminal or a server, or by both a terminal and a server. This method can be applied to... Figure 1 Taking server 104 as an example, the following steps are included:

[0046] Step 202: Based on the feature values ​​of the target order under multiple preset order feature dimensions, obtain the order features of the target order.

[0047] Social applications include, but are not limited to, instant messaging applications for individuals or groups. A target order can be triggered by a social application logged into by a target individual, and the target order belongs to that target individual. A target order is an order involving resource transfer triggered within a social application, such as, but not limited to, friend transfers, QR code transfers, and sending red envelopes (digital cash gifts). Resources refer to resources existing in an electronic account that can be circulated, such as resources that can be circulated online through an account. An account can include at least one of a bank card number or an internet payment account. Resources can include funds, virtual red envelopes, game currency, or virtual items in the account. Resource transfer refers to transferring resources from one account to another, such as transferring a payment account in a social application logged into by one individual to a payment account in another social application logged into by another individual.

[0048] There are multiple preset order feature dimensions, meaning at least two. These preset order feature dimensions are related to the resource transferor, resource transferee, and the relationship between the resource transferee and the resource transferor. The resource transferor is, for example, the payer, and the resource transferee is, for example, the recipient. Feature dimensions related to the resource transferor include, but are not limited to, at least one of the following: the payer's basic account information, the payer's fund flow, and the act of selling stolen goods. Feature dimensions related to the resource transferee include, but are not limited to, at least one of the following: the recipient's basic account information, the closeness between the payer and the recipient, the payer's fund flow, and the act of selling stolen goods. Feature dimensions related to the relationship between the resource transferee and the resource transferor include, but are not limited to, the closeness between the payer and the recipient. The closeness between the payer and the recipient can be determined based on at least one of their kinship or social relationship. Social relationships include, but are not limited to, offline or online interactions. Online interactions can be, for example, telephone interactions, SMS interactions, or interactions in social applications. For example, the greater the interaction in a social application, the greater the closeness. The feature value under the preset order feature dimensions refers to the value of the preset order feature dimension. The order characteristics of a target order include feature values ​​of the target order under multiple preset order characteristic dimensions. Specifically, when the server determines that a social application triggered the target order, it can determine the data of the target order under multiple preset order characteristic dimensions, encode the data under each preset order characteristic dimension to obtain the feature value of each preset order characteristic dimension, and combine the obtained feature values ​​to obtain the order characteristics of the target order. For example, the multiple preset order characteristic dimensions are the payer's account name, the payee's account name, and the payment amount. In the target order, the payer's account name is "Zhang San", the payee's account name is "Li Si", and the payment amount is 100 RMB. Then, the server can encode "Zhang San", "Li Si", and "100" to obtain the feature values ​​corresponding to "Zhang San", "Li Si", and "100" respectively, and combine the feature values ​​of "Zhang San", "Li Si", and "100" to obtain the order characteristics of the target order.

[0049] In some embodiments, the server can encode data under preset order feature dimensions according to the data type. The data under preset order feature dimensions can include numerical data and non-numerical data. Numerical data is divided into continuous and discrete types, while non-numerical data is divided into categorical and ordinal types. When the data type is non-numerical, the server can use one-hot encoding to obtain the corresponding feature value. If the data type is numerical, the server can normalize the data and use the normalized result as the corresponding feature value. Having obtained the feature values ​​corresponding to the data under each preset order feature dimension, the server can combine these feature values ​​to obtain the order features of the target order.

[0050] Step 204: Based on the order characteristics of the target order and the order characteristics of the historical orders in the historical order set, determine the clustering feature value of the target order; the clustering feature value is used to characterize the degree of clustering between the target order and the historical orders when distributed according to the order characteristics; the historical order set includes normal historical orders and abnormal historical orders.

[0051] In this context, "normal historical orders" refers to historical orders that are genuinely of the normal order type, while "abnormal historical orders" refers to historical orders that are genuinely of the abnormal order type. The set of historical orders contains more normal historical orders than abnormal historical orders. Normal orders are legitimate and legal, such as legitimate transaction orders, while abnormal orders are those with unreasonable or illegal issues, such as transaction orders involving social media fraud. Social media fraud could be, for example, black market actors inducing users to make payments through social media applications.

[0052] The actual order type of each historical order in the historical order collection is known. For example, an order type label can be assigned to each historical order. A historical order with an order type label of 1 indicates that its actual order type is an abnormal order, while a historical order with an order type label of 0 indicates that its actual order type is a normal order. For example, L = {(x1,y1),...,(x n ,y n )}∈R n×d This represents the set of order characteristics for each historical order that has an order type label, where x n y represents the order characteristics of the nth historical order in the historical order set. nLet d represent the order type label of the nth historical order, and d represent the dimension of the order features. The feature space formed by the order features of each historical order in the historical order set can be called the original feature space. For example, if the historical order set includes n historical orders, and each historical order has d data points for its order features, then the original feature space represents the set of n data points with d features.

[0053] The clustering feature value of target orders is used to characterize the degree of clustering between target orders and historical orders in the historical order set when distributed according to order characteristics. For example, the target orders and historical orders in the historical order set can be distributed according to their order characteristics to obtain a distribution map. The clustering feature value of target orders then characterizes the degree of clustering between target orders and surrounding historical orders in the distribution map. Figure 3 The diagram shows a distribution map obtained by distributing orders according to their characteristics. The surrounding historical orders can be the k historical orders closest to the target order in the distribution map, where k is a positive integer greater than or equal to 1 and can be set as needed, such as 10 or 50. A smaller clustering characteristic value indicates a greater degree of clustering, and a larger clustering characteristic value indicates a smaller degree of clustering; that is, the clustering characteristic value and the degree of clustering are negatively correlated. For example, the clustering characteristic value can be an outlier.

[0054] The clustering feature value of the target order can be one or more, or at least two. Each clustering feature value of the target order can be calculated using different preset clustering calculation methods. The preset clustering calculation method is a method that can calculate the clustering feature value, such as an outlier detection function that can calculate outliers. The preset clustering calculation method or outlier detection function includes, but is not limited to, KNN (K Nearest Neighbors) algorithm, K-means clustering algorithm, Avg-KNN algorithm, One-Class SVM (One-Class Support Vector Machine) algorithm, Isolation Forest, etc.

[0055] Specifically, the server can use each of the multiple preset clustering degree calculation methods to calculate the clustering degree feature value of the target order, thereby obtaining multiple clustering degree feature values ​​for the target order. Each preset clustering degree calculation method corresponds one-to-one with a preset clustering degree dimension, and the clustering degree feature value calculated by a preset clustering degree calculation method is the feature value under the preset clustering degree dimension corresponding to that preset clustering degree calculation method.

[0056] In some embodiments, the clustering feature value of the target order can also be a clustering feature value calculated using a target clustering calculation method, which belongs to the plurality of preset clustering calculation methods. The order features of the target order can be called target order features, and the order features of historical orders can be called historical order features. Taking K-means as the target clustering calculation method and outliers as the clustering feature value, the process of calculating the clustering feature value using the target clustering calculation method is as follows: The server can calculate the feature difference between the target order feature and each historical order feature, arrange the feature differences in ascending order, and obtain a feature difference sequence. The smaller the feature difference, the earlier the feature difference appears in the feature difference sequence. The server can obtain a preset number of feature differences that appear first in the feature difference sequence, calculate the mean of the obtained feature differences, and determine the result as the clustering feature value of the target order.

[0057] Step 206: Combine the feature values ​​of the target order with the clustering feature values ​​under at least one preset order feature dimension to obtain the target combined feature of the target order.

[0058] Specifically, the server can combine the feature values ​​of the target order under at least one preset order feature dimension with the feature values ​​of the target order under at least one preset clustering dimension to obtain the target combined feature of the target order. For example, the server can combine the feature values ​​of the target order under each preset order feature dimension with the feature values ​​of the target order under each preset clustering dimension to obtain the target combined feature of the target order.

[0059] In some embodiments, the target order is an order belonging to a target object in a social application. The server can determine the associated objects of the target object in the social application, and based on the order anomaly information of the associated objects within a specified time period, encode the order anomaly features of the associated objects. The server combines the feature values ​​of the target order under at least one preset order feature dimension, the feature values ​​of the target order under at least one preset clustering dimension, and the associated order anomaly features to obtain the target combined features of the target order.

[0060] In some embodiments, the server can obtain a clustering reference value, which is obtained by statistically analyzing the clustering feature values ​​of multiple normal orders. The server can calculate the difference between the clustering feature value corresponding to the target order and the clustering reference value to obtain the clustering difference value of the target order. The server can combine the feature values ​​of the target order under at least one preset order feature dimension, the feature values ​​of the target order under at least one preset clustering dimension, and the clustering difference value of the target order to obtain the target combined feature of the target order.

[0061] In some embodiments, the server can combine the feature values ​​of the target order under at least one preset order feature dimension, the feature values ​​of the target order under at least one preset clustering dimension, the order anomaly features of the associated objects, and the clustering difference value of the target order to obtain the target combined feature of the target order.

[0062] In some embodiments, the server can combine the feature values ​​of the target order under the target order feature dimension with the feature values ​​of the target order under the target clustering dimension to obtain the target combined feature of the target order. Here, there is at least one target order feature dimension and at least one target clustering dimension. The target order feature dimension and the target clustering dimension are obtained by deduplicating the redundancy of each preset order feature dimension and each preset clustering dimension. For example, the server can use a greedy algorithm to select preset clustering dimensions to prune the augmented feature space, thereby controlling computational complexity and improving prediction accuracy. The augmented feature space refers to the feature space after expanding other features based on the order features; these other features include, but are not limited to, clustering feature values.

[0063] In some embodiments, the server can combine the feature values ​​of the target order under the target order feature dimension, the feature values ​​of the target order under the target clustering dimension, and the order anomaly features of the associated objects to obtain the target combined feature of the target order.

[0064] In some embodiments, the server can combine the feature values ​​of the target order under the target order feature dimension, the feature values ​​under the target clustering dimension, and the clustering difference value of the target order to obtain the target combined feature of the target order.

[0065] In some embodiments, the server can combine the feature values ​​of the target order under the target order feature dimension, the feature values ​​of the target order under the target clustering dimension, the order anomaly features of the associated objects, and the clustering difference values ​​of the target order to obtain the target combined features of the target order.

[0066] Step 208: Predict the order type to which the target order belongs using the target combination features.

[0067] The order type of the target order can be predicted based on a trained anomaly score prediction model, which is a neural network model used to predict order types. The anomaly score prediction model can be obtained by training an untrained anomaly score prediction model. This model predicts the anomaly score of the target order, which represents the probability that the target order is an anomalous order; the higher the anomaly score, the greater the probability that the target order is an anomalous order.

[0068] Specifically, the server can input the target combined features into a trained anomaly score prediction model to predict the anomaly score of the target order. If the anomaly score of the target order is greater than the anomaly score threshold, the server can determine that the target order belongs to the anomaly order type.

[0069] In some embodiments, if the server determines that the target order belongs to an abnormal order type, the server can also intervene in the target order. Intervention includes, but is not limited to, intercepting the target order or displaying an anomaly notification. For example, if the server determines that the target order belongs to an abnormal order type, it can display an anomaly notification through a social application, such as displaying an anomaly message indicating that the target order is abnormal in the social application logged into by the target object. If the server determines that the target order belongs to an abnormal order type, it can also intercept the target order, for example, by suspending the execution of subsequent business related to the target order, such as suspending the payment business corresponding to the target order. Figure 4 As shown, when a social application on the terminal triggers an order, the server uses an anomaly score prediction model stored in the database to predict the order's anomaly score. If the order is determined to be an anomaly, an anomaly notification is sent to the terminal, and the terminal displays the anomaly notification message "The order is abnormal" in the social application.

[0070] In some embodiments, the server may combine the order anomaly score and the order characteristics of the target order to determine whether to intervene in the order, such as... Figure 5 As shown, the target order is, for example, Figure 5 In the process of generating new transaction orders, the feature layer generates target combination features for the target order. The real-time prediction layer uses an anomaly score prediction model to predict the anomaly score of the target combination features and outputs an order malice score. The order malice score represents the order's anomaly score; the higher the order malice score, the higher the order's anomaly score. In the real-time strategy engine layer, the order malice score is compared with an anomaly score threshold. If the order malice score is greater than the threshold, the process proceeds to the step of judging the order's malice level. In the step of judging the order's malice level, the malice level of the target order is determined based on the order features. If the malice level reaches a specified malice level, the order is blocked or alerted. The malice level can be positively correlated with the transaction amount in the order, and the specified malice level can be preset.

[0071] In the above order type determination method, since the historical order set includes both normal and abnormal historical orders, the clustering feature value is used to characterize the degree of clustering between the target order and historical orders when they are distributed according to order features. Thus, the clustering feature value reflects the relationship between the target order and normal and abnormal orders. Since the feature value of the target order under the preset order feature dimension reflects the characteristics of the target order itself, the target combination feature composed of the clustering feature value and the feature value of the target order under the preset order feature dimension is used to predict the order type to which the target order belongs. In addition to considering the characteristics of the order itself, the relationship between the target order and different types of orders is also considered, which improves the accuracy of order type prediction.

[0072] In some embodiments, the target order is an order belonging to a target object in a social application; combining the feature values ​​of the target order under at least one preset order feature dimension with the clustering feature value to obtain the target combined feature of the target order includes: determining the associated objects of the target object in the social application; encoding the order anomaly features of the associated objects based on the order anomaly information of the associated objects within a specified time period; and combining the feature values, clustering feature values, and order anomaly features of the target order under at least one preset order feature dimension to obtain the target combined feature of the target order.

[0073] The target audience refers to users within the social application. When a target audience logs into the social application, they can trigger a target order within that application; in other words, the target order is triggered within the social application the target audience is logged into. The target audience's associated objects within the social application refer to objects that interact with the target audience within the social application. These associated objects include, but are not limited to, at least one of the target audience's friends or users followed by the target audience within the social application. The specified time period can be set as needed, for example, it can be any one of the last week, the last month, or the last six months. Order anomaly information includes, but is not limited to, at least one of the following: the frequency of abnormal orders, the number of abnormal orders, or the time point when the abnormal order was triggered.

[0074] Specifically, the server can encode order anomaly information of associated objects within a specified time period to obtain the order anomaly characteristics of the associated objects. The server can encode the data included in the order anomaly information based on its data type. Order anomaly information can include numerical data and non-numerical data. Numerical data is divided into continuous and discrete types, while non-numerical data is divided into categorical and ordinal types. When the data type is non-numerical, the server can use one-hot encoding to obtain the corresponding feature value. If the data type is numerical, the server can normalize the data and use the normalized result as the corresponding feature value. Having obtained the feature values ​​corresponding to each data point in the order anomaly information, the server can combine these feature values ​​to form the order anomaly characteristics.

[0075] In some embodiments, the server can combine the feature values, clustering feature values, and order anomaly features of the target order under at least one preset order feature dimension to obtain the target combined feature of the target order. The server can also combine the feature values ​​of the target order under the target order feature dimension, the clustering feature values ​​of the target order under the target clustering dimension, and the order anomaly features of the associated objects to obtain the target combined feature of the target order.

[0076] In some embodiments, the server can obtain a clustering reference value. This reference value is obtained by statistically analyzing the clustering feature values ​​of multiple normal orders. The difference between the clustering feature value corresponding to the target order and the clustering reference value is calculated to obtain the clustering difference value of the target order. The server can combine the feature values ​​of the target order under the target order feature dimension, the clustering feature values ​​of the target order under the target clustering dimension, the clustering difference value of the target order, and the order anomaly features of associated objects to obtain the target combined feature of the target order.

[0077] In this embodiment, the feature values, clustering feature values, and order anomaly features of the target order under at least one preset order feature dimension are combined to obtain the target combined feature of the target order. Since the order anomaly feature is obtained by encoding the order anomaly information of the associated object within a specified time period, the order anomaly feature reflects the situation of the associated object having abnormal orders. Since the associated object of the target object in the social application is an object that interacts with the target object in the social application, the associated object and the target object have a certain correlation in the situation of abnormal orders. Therefore, combining the order anomaly features of the associated object to obtain the target combined feature can enrich the amount of information expressed by the target combined feature, thereby improving the prediction accuracy of order type.

[0078] In some embodiments, determining the clustering feature value of a target order based on the order features of the target order and the order features of historical orders in the historical order set includes: determining the feature value of the target order under the target clustering dimension based on the order features of the target order and the order features of historical orders in the historical order set, thereby obtaining the clustering feature value of the target order; combining the feature value of the target order under at least one preset order feature dimension with the clustering feature value to obtain the target combined feature of the target order includes: combining the feature value of the target order under the target order feature dimension with the feature value under the target clustering dimension, thereby obtaining the target combined feature of the target order; the target order feature dimension and the target clustering dimension are obtained by deduplicating multiple preset order feature dimensions and multiple preset clustering dimensions.

[0079] In this context, "multiple preset order feature dimensions" refers to at least two preset order feature dimensions, such as 3 or 6. There is a one-to-one correspondence between the preset order feature dimensions and the preset clustering degree calculation methods. Different preset order feature dimensions correspond to different preset clustering degree calculation methods. The clustering degree calculation method is used to calculate the clustering degree feature value. The preset clustering degree calculation methods are pre-selected clustering degree calculation methods, including but not limited to at least two of the following: KNN (K Nearest Neighbors) algorithm, K-means clustering algorithm, Avg-KNN algorithm, One-Class SVM (One-Class Support Vector Machine) algorithm, and Isolation Forest. The target clustering degree dimension is selected from these multiple preset order feature dimensions. There can be one or more target clustering dimensions; "multiple" means at least two.

[0080] Since the order features of a target order are obtained by combining the feature values ​​of the target order under multiple preset order feature dimensions, combining the order features of historical orders with the clustering feature values ​​of historical orders under each preset clustering dimension is equivalent to combining the feature values ​​of the target order under each preset order feature dimension and the clustering feature values ​​of historical orders under each preset clustering dimension.

[0081] Specifically, each preset clustering dimension and each preset order feature dimension is a feature dimension. For each preset clustering dimension and each preset order feature dimension, the server can statistically analyze the feature values ​​of the feature dimensions in the initial combination features of each historical order to obtain the dimension weights corresponding to each feature dimension. Using the dimension weights corresponding to each feature dimension, the server can perform redundancy removal processing on each preset order feature dimension and each preset clustering dimension. For example, the server can remove feature dimensions with smaller dimension weights from each preset clustering dimension and each preset order feature dimension in descending order of dimension weight, and determine the remaining preset order feature dimensions as target order feature dimensions, and the remaining preset clustering dimensions as target clustering dimensions.

[0082] In some embodiments, for each historical order in the historical order set, the server can use multiple preset clustering calculation methods corresponding to preset clustering dimensions to determine the clustering feature value of the historical order under each preset clustering dimension. The order features of the historical order are then combined with the clustering feature values ​​of the historical order under each preset clustering dimension to obtain the initial combined features of the historical order. This expands the original feature space. The clustering feature values ​​of each historical order under each preset clustering dimension can be represented by a matrix, for example, using matrix Φ(X)=[Φ1 ... ≠ Φ1(X) ≠ Φ1(X) ≠ Φ1( T ,...,Φ K (X) T ]∈R n×K This indicates that X represents the order characteristics of each historical order, and K represents the types of preset clustering dimensions. These K types of preset clustering dimensions correspond to different preset clustering calculation methods. Φ K (X) T This represents a vector containing the clustering feature values ​​of each historical order at the Kth preset clustering dimension. The original feature space can be expanded using matrix Φ(X) to obtain an augmented feature space, which includes data from both the original feature space and matrix Φ(X). For example, the augmented feature space X... new It can be represented as X new = [X, S]∈R n×(d+K) , where X new Let X represent the augmented feature space, and let S represent the original feature space. S is the aforementioned Φ(X), which includes the clustering feature values ​​of each historical order.

[0083] For example, a historical order set includes three historical orders: historical order 1, historical order 2, and historical order 3. There are two preset clustering dimensions: preset clustering dimension 1 and preset clustering dimension 2. The preset clustering calculation method for preset clustering dimension 1 is the KNN algorithm, and the preset clustering calculation method for preset clustering dimension 2 is the K-means algorithm. Therefore, for historical order 1, the server can use the KNN algorithm to calculate the clustering feature value of historical order 1 under preset clustering dimension 1, and use the K-means algorithm to calculate the clustering feature value of historical order 1 under preset clustering dimension 2. Similarly, for historical order 2, the server can use the KNN algorithm to calculate the clustering feature value of historical order 2 under preset clustering dimension 1, and use the K-means algorithm to calculate the clustering feature value of historical order 2 under preset clustering dimension 2. Likewise, for historical order 3, the server can use the KNN algorithm to calculate the clustering feature value of historical order 3 under preset clustering dimension 1, and use the K-means algorithm to calculate the clustering feature value of historical order 3 under preset clustering dimension 2. For historical order 1, the server can combine the order features of historical order 1, the clustering feature value of historical order 1 under the preset clustering dimension 1, and the clustering feature value of historical order 1 under the preset clustering dimension 2 to obtain the initial combined features of historical order 1. For each feature dimension in each preset clustering dimension and each preset order feature dimension, the server can statistically analyze the feature value of that feature dimension in the initial combined features of each historical order to obtain the dimension weight corresponding to that feature dimension.

[0084] In some embodiments, the server can combine the feature values ​​of the target order under the target order feature dimension with the clustering feature values ​​under the target clustering dimension to obtain the target combined feature of the target order.

[0085] In this embodiment, since the target order feature dimension and the target clustering degree dimension are obtained by de-redundancy processing of multiple preset order feature dimensions and multiple preset clustering degree dimensions, the redundancy of the feature dimensions is reduced when order type prediction is performed by combining the two feature dimensions, thereby reducing data complexity and improving computational efficiency.

[0086] In some embodiments, the steps of determining the target order feature dimension and the target clustering dimension include: for each historical order in the historical order set, using a preset clustering calculation method corresponding to multiple preset clustering dimensions respectively, determining the clustering feature value of the historical order under each preset clustering dimension; combining the order features of the historical order with the clustering feature values ​​of the historical order under each preset clustering dimension to obtain the initial combined features of the historical order; for each feature dimension in each preset clustering dimension and each preset order feature dimension, statistically analyzing the feature values ​​of the feature dimensions in the initial combined features of each historical order to obtain the dimension weight of the feature dimension; and performing redundancy removal processing on each preset clustering dimension and each preset order feature dimension according to the dimension weight to obtain the target order feature dimension and the target clustering dimension.

[0087] Among them, the dimension weight is related to at least one of the missing rate or information value (IV). For example, the dimension weight is negatively correlated with the missing rate and positively correlated with the information value.

[0088] Specifically, for each feature dimension in each preset clustering dimension and each preset order feature dimension, the feature values ​​of the feature dimensions in the initial combination features of each historical order are statistically analyzed to obtain the dimension weight of the feature dimension. For example, the server can obtain the feature values ​​of the feature dimension from each initial combination feature, determine the missing rate of the feature values ​​of the feature dimension based on the obtained feature values, and determine the dimension weight based on the missing rate. The dimension weight is negatively correlated with the missing rate. The server can remove the feature dimensions with smaller dimension weights in each feature dimension, and use the remaining preset order feature dimensions as the target order feature dimensions, and determine the remaining preset clustering dimensions as the target clustering dimensions.

[0089] In some embodiments, for each feature dimension, the server can obtain the feature value of that feature dimension from each initial combination feature, determine the information value of the feature value of that feature dimension based on the obtained feature value, determine the dimension weight based on the information value, and the dimension weight is positively correlated with the information value.

[0090] In some embodiments, dimension weights are negatively correlated with the missing rate and positively correlated with information value. The server can remove feature dimensions with smaller dimension weights from each feature dimension, thereby removing feature dimensions with high missing rates and low information value. The number of remaining feature dimensions can be preset, that is, the number of feature dimensions to be removed is also preset. For example, if the number of remaining feature dimensions is p, or if each preset clustering dimension is K and each preset order feature dimension is d, then the server can calculate to remove features with high missing rates and low information value from (d+K) feature dimensions, leaving p feature dimensions.

[0091] In this embodiment, for each feature dimension, the feature values ​​under that feature dimension in the initial combination features of each historical order are statistically analyzed to obtain the dimension weight of that feature dimension, thereby improving the accuracy of the dimension weight.

[0092] In some embodiments, the process of removing redundancy from each preset clustering dimension and each preset order feature dimension according to dimension weights to obtain the target order feature dimension and the target clustering dimension includes: selecting at least one preset order feature dimension and at least one preset clustering dimension from each preset clustering dimension and each preset order feature dimension in descending order of dimension weights to form a feature dimension set; calculating the correlation between any two feature dimensions in the feature dimension set; and removing one of the two feature dimensions from the feature dimension set if the correlation is greater than a correlation threshold, thereby obtaining the target order feature dimension and the target clustering dimension.

[0093] The correlation threshold can be preset, for example, to 0.8. The higher the correlation, the more similar the information expressed by the features in the two feature dimensions.

[0094] Specifically, the server can arrange the preset clustering dimensions and preset order feature dimensions in descending order of dimension weight, resulting in a feature dimension sequence. The larger the dimension weight, the earlier the feature dimension appears in the feature dimension sequence. The server can remove feature dimensions that are arranged after a specified position from the preset clustering dimensions and preset order feature dimensions. However, if all preset clustering dimensions in the feature dimension sequence are arranged after the specified position, the first preset clustering dimension after the specified position is not removed. Similarly, if all preset order feature dimensions in the feature dimension sequence are arranged after the specified position, the first preset order feature dimension after the specified position is not removed. The remaining preset order feature dimensions and the remaining preset clustering dimensions are combined into a feature dimension set. The number of remaining feature dimensions can be pre-set, i.e., the number of feature dimensions to be removed is also pre-set, for example, the number of remaining feature dimensions is 's'. The specified position can be set as needed or pre-set.

[0095] In some embodiments, for any two feature dimensions in the feature dimension set, the server can calculate the correlation between the two feature dimensions. If the correlation is greater than a correlation threshold, one of the two feature dimensions is removed from the feature dimension set. For example, the feature dimension with the smaller dimension weight or the feature dimension with lower information value can be removed. Alternatively, the feature dimension to be removed can be selected based on its type. For example, if the two feature dimensions are a preset clustering dimension and a preset order feature dimension, the preset clustering dimension or the preset order feature dimension can be removed to ensure that the remaining feature dimensions after removal include at least one preset order feature dimension and at least one preset clustering dimension. The server can then use the remaining preset order feature dimensions in the feature dimension set after removal as target order feature dimensions and the remaining preset clustering dimensions as target clustering dimensions. The correlation threshold can be set as needed or preset.

[0096] In some embodiments, if the relevance is greater than a relevance threshold, the server can remove the feature dimension with lower information value from the feature dimension set. For example, if the feature dimension set includes p feature dimensions, and the relevance between two feature dimensions in the feature dimension set is >= 0.8, then the feature with higher information value is retained, leaving s feature dimensions.

[0097] In this embodiment, when the relevance is greater than the relevance threshold, one of the two feature dimensions is removed from the feature dimension set to obtain the target order feature dimension and the target clustering dimension. This reduces the redundancy of feature dimensions, thereby reducing data complexity and improving computational efficiency.

[0098] In some embodiments, combining the feature values ​​of the target order under the target order feature dimension with the feature values ​​under the target clustering dimension to obtain the target combined feature of the target order includes: obtaining a clustering reference value; the clustering reference value is obtained by statistically analyzing the clustering feature values ​​of multiple normal orders; calculating the difference between the clustering feature value corresponding to the target order and the clustering reference value to obtain the clustering difference value of the target order; and combining the feature values ​​of the target order under the target order feature dimension, the feature values ​​under the target clustering dimension, and the clustering difference value of the target order to obtain the target combined feature of the target order.

[0099] The clustering reference value is obtained by statistically analyzing the clustering feature values ​​of multiple normal orders. The clustering reference value includes, but is not limited to, at least one of the median, mode, or mean of the clustering feature values ​​of multiple normal orders.

[0100] Specifically, the server can calculate the difference between the clustering feature value and the clustering reference value corresponding to the target order, and determine the calculated difference as the clustering difference value of the target order. The server can combine the feature values ​​of the target order under each feature dimension, the feature values ​​of the target order under each target clustering dimension, and the clustering difference value of the target order to obtain the target combined feature of the target order. For example, if the target order has two feature dimensions, z1 and z2, and two target clustering dimensions, z3 and z4, and the feature values ​​of the target order under z1, z2, z3, and z4 are a1, a2, a3, and a4 respectively, and the clustering difference value of the target order is s, then the target combined feature of the target order can be (a1, a2, a3, a4, s).

[0101] In some embodiments, the server can determine normal historical orders whose actual order type is normal from the historical order set, use a specified clustering degree calculation method to statistically analyze the clustering degree feature values ​​of each normal historical order to obtain a clustering degree statistical value set, and determine a clustering degree reference value based on the clustering degree statistical value set.

[0102] In this embodiment, since the clustering reference value is obtained by statistically analyzing the clustering feature values ​​of multiple normal orders, the clustering difference value of the target order reflects the relationship between the clustering feature values ​​of the target order and the statistical values ​​of the clustering feature values ​​of normal orders. Therefore, the clustering difference value of the target order can, to some extent, reflect whether the target order belongs to a normal order or an abnormal order. Thus, the feature values ​​of the target order under the target order feature dimension, the feature values ​​under the target clustering dimension, and the clustering difference value of the target order are combined to obtain the target combined feature of the target order. This expands the feature space, enriches the information expressed by the target combined feature, and improves the prediction accuracy of the order type.

[0103] In some embodiments, obtaining a clustering reference value includes: determining normal historical orders whose actual order type is normal from a set of historical orders; calculating the clustering feature value of each normal historical order using a specified clustering calculation method to obtain a set of clustering feature values; and performing statistics on the clustering feature values ​​in the set of clustering feature values ​​to obtain a clustering reference value.

[0104] The specified clustering degree calculation method can be any preset clustering degree calculation method. Since different preset clustering degree calculation methods have different calculation accuracies, the preset clustering degree calculation method with the highest calculation accuracy can be determined as the specified clustering degree calculation method.

[0105] Specifically, the server can retrieve multiple normal historical orders from the historical order set. For example, it can retrieve all normal historical orders in the historical order set. The server can use a specified clustering degree calculation method to calculate the clustering degree feature value of each normal historical order, form a clustering degree feature value set from the calculated clustering degree feature values, and perform statistics on the clustering degree feature values ​​in the clustering degree feature value set to obtain a clustering degree reference value.

[0106] In some embodiments, the server may determine at least one of the median or mode in the set of clustering feature values ​​as the clustering reference value. Alternatively, the server may calculate the mean of each clustering feature value in the set of clustering feature values ​​and determine the result as the clustering reference value.

[0107] In this embodiment, the clustering feature values ​​in the clustering feature value set are statistically analyzed to obtain the clustering reference value, thereby improving the accuracy of the clustering reference value.

[0108] In some embodiments, the order type of the target order is predicted based on a trained anomaly score prediction model and an anomaly score threshold; predicting the order type of the target order using target combination features includes: inputting the target combination features into the trained anomaly score prediction model to predict the order anomaly score of the target order; and determining that the order type of the target order is an anomaly order if the order anomaly score of the target order is greater than the anomaly score threshold.

[0109] The trained anomaly score prediction model is obtained by training the model to be trained using each historical order in the historical order set. The anomaly score prediction model to be trained is a neural network, which can be an existing neural network or a custom neural network, including but not limited to LightGBM (Light Gradient Boosting Machine) or XGBoost. Compared to XGBoost, LightGBM has the advantages of faster training speed and lower memory consumption. LightGBM has the advantage of balanced data, allowing adjustment of the weights of positive and negative samples by setting parameters. LightGBM can perform post-pruning, selecting better clustering feature dimensions in subsequent processes. The ensemble and regularization mechanisms in LightGBM can achieve low variance without introducing large biases, minimizing bias variance.

[0110] Specifically, the server can input the target combined features into a trained anomaly score prediction model to predict the anomaly score of the target order. If the anomaly score of the target order is greater than the anomaly score threshold, the order type of the target order is determined to be an anomaly order.

[0111] In some embodiments, if the order anomaly score of a target order is greater than an anomaly score threshold, the degree of anomaly of the target order is determined; if the degree of anomaly of the target order reaches the anomaly degree threshold, the order type of the target order is determined to be an anomalous order. The anomaly degree threshold can be set as needed. The server can use the order anomaly score of the target order to determine the degree of anomaly of the target order; for example, the degree of anomaly of the target order is positively correlated with the order anomaly score. The server can also combine the order anomaly score of the target order with the order characteristics of the target order to determine the degree of anomaly of the target order; for example, the degree of anomaly of the target order is positively correlated with the amount in the order characteristics of the target order.

[0112] In some embodiments, for each historical order in the historical order set, the server can combine the feature value of the historical order under the target order feature dimension with the feature value of the historical order under the target clustering dimension to obtain the historical combined feature of the historical order; or, the server can combine the feature value of the historical order under the target order feature dimension, the feature value of the historical order under the target clustering dimension, and the order anomaly features of the associated objects of the object to which the historical order belongs to obtain the historical combined feature of the historical order; or, the server can combine the feature value of the historical order under the target order feature dimension, the feature value of the historical order under the target clustering dimension, the order anomaly features of the associated objects of the object to which the historical order belongs, and the clustering difference value of the historical order to obtain the historical combined feature of the historical order. Figure 6 As shown, k clustering feature values ​​1 to k obtained from k preset clustering calculation methods are combined with the original features (i.e., order features). Feature selection is used to retain the feature values ​​under the target clustering dimension and the feature values ​​under the target order feature dimension, thus obtaining the historical combination features of historical orders. The server can use the historical combination features corresponding to each historical order to train the anomaly score prediction model to be trained, obtaining a trained anomaly score prediction model. In this embodiment, the order type of the target order is predicted based on the trained anomaly score prediction model, improving the order type prediction efficiency.

[0113] In some embodiments, the step of obtaining a trained anomaly score prediction model includes: for each historical order in the historical order set, combining the feature value of the historical order in the target order feature dimension with the feature value of the historical order in the target clustering dimension to obtain the historical combined feature of the historical order; inputting the historical combined feature of each historical order into the anomaly score prediction model to be trained to obtain the predicted anomaly score of each historical order; and adjusting the model parameters of the anomaly score prediction model based on the predicted anomaly score and the actual anomaly score of each historical order to obtain the trained anomaly score prediction model.

[0114] Specifically, when the actual order type of a historical order is an abnormal order, the actual abnormal score of the historical order can be 1; when the actual order type of a historical order is a normal order, the actual abnormal score of the historical order can be 0. The range of the predicted abnormal score output by the abnormal score prediction model can be [0,1].

[0115] Specifically, for each historical order in the historical order set, the server can combine the feature value of the historical order under the target order feature dimension with the feature value of the historical order under the target clustering dimension to obtain the historical combined feature of the historical order; or, the server can combine the feature value of the historical order under the target order feature dimension, the feature value of the historical order under the target clustering dimension, and the order anomaly features of the related objects of the object to which the historical order belongs to to obtain the historical combined feature of the historical order; or, the server can combine the feature value of the historical order under the target order feature dimension, the feature value of the historical order under the target clustering dimension, the order anomaly features of the related objects of the object to which the historical order belongs, and the clustering difference value of the target order to obtain the historical combined feature of the historical order.

[0116] In some embodiments, during the training of the anomaly score prediction model, for each historical order, the server can input the historical combination features of the historical order into the anomaly score prediction model, and determine the output of the anomaly score prediction model as the predicted anomaly score of that historical order. The server can adjust the model parameters of the anomaly score prediction model based on the predicted anomaly scores and the actual anomaly scores of each historical order until the model converges, thus obtaining the trained anomaly score prediction model. Model convergence includes, but is not limited to, at least one of the following: the change in model parameters is less than a preset change, and the model loss value is less than a preset loss value. The preset change and preset loss values ​​can be preset as needed.

[0117] In some embodiments, the server can adjust the model parameters of the anomaly score prediction model based on the predicted anomaly scores of each historical order and the actual anomaly scores of each historical order. The server can then obtain an anomaly score prediction model with adjusted parameters, verify the accuracy of the anomaly score prediction model with adjusted parameters, and determine the anomaly score prediction model with adjusted parameters as the trained anomaly score prediction model if the accuracy is greater than the accuracy threshold.

[0118] In this embodiment, since the historical order set includes both normal and abnormal historical orders, the abnormal score prediction model is trained using each historical order in the historical order set, thereby obtaining a trained abnormal score prediction model and improving the accuracy of the training.

[0119] In some embodiments, adjusting the model parameters of the anomaly score prediction model based on the predicted anomaly scores and the actual anomaly scores of each historical order to obtain a trained anomaly score prediction model includes: adjusting the model parameters of the anomaly score prediction model based on the predicted anomaly scores and the actual anomaly scores of each historical order to obtain a parameter-adjusted anomaly score prediction model; using the parameter-adjusted anomaly score prediction model to predict the order types of multiple verification orders to obtain the predicted anomaly scores of each verification order; determining the predicted order type of the verification order based on the predicted anomaly scores of the verification order; determining the number of verification orders in each verification order whose actual order type is anomaly order to obtain a first order number; determining the number of verification orders in each verification order whose predicted order type and actual order type are both anomaly order to obtain a second order number; determining the anomaly order coverage of the parameter-adjusted anomaly score prediction model based on the first order number and the second order number; and determining the parameter-adjusted anomaly score prediction model as a trained anomaly score prediction model if the anomaly order coverage is greater than a coverage threshold.

[0120] The accuracy of the parameter-adjusted anomaly score prediction model can be measured by the anomaly order coverage rate. The anomaly order coverage rate represents the ratio of the number of second-order orders to the number of first-order orders. The number of second-order orders refers to the number of validation orders in each validation order set where both the predicted and actual order types are anomaly orders. The number of first-order orders refers to the number of validation orders in each validation order set where the actual order type is anomaly order. Each validation order is used to verify the accuracy of the parameter-adjusted anomaly score prediction model. The coverage threshold can be set as needed, for example, to 90% or 95%. The anomaly order coverage rate is less than or equal to 1; the closer the anomaly order coverage rate is to 1, the higher the accuracy of the anomaly score prediction model.

[0121] Specifically, the process of generating verification combined features is consistent with the process of generating historical combined features. For example, if the historical combined features of a historical order are obtained by combining the feature values ​​of the historical order under the target order feature dimension with the feature values ​​of the historical order under the target clustering dimension, then for each verification order, the server can combine the feature values ​​of the verification order under the target order feature dimension with the feature values ​​of the verification order under the target clustering dimension to obtain the verification combined features of that verification order. Similarly, if the historical combined features of a historical order are obtained by combining the feature values ​​of the historical order under the target order feature dimension, the feature values ​​of the historical order under the target clustering dimension, and the order anomaly features of the associated objects of the object to which the historical order belongs, then the server can combine the feature values ​​of the verification order under the target order feature dimension, the feature values ​​of the verification order under the target clustering dimension, and the order anomaly features of the associated objects of the object to which the verification order belongs to to obtain the verification combined features of that verification order. If the historical combined features of a historical order are obtained by combining the feature values ​​of the historical order under the target order feature dimension, the feature values ​​of the historical order under the target clustering dimension, the order anomaly features of the related objects of the historical order, and the clustering difference values ​​of the historical order, then the server can combine the feature values ​​of the verification order under the target order feature dimension, the feature values ​​of the verification order under the target clustering dimension, the order anomaly features of the related objects of the verification order, and the clustering difference values ​​of the verification order to obtain the verification combined features of the verification order. Similarly, the process of generating the target combined features is the same as the process of generating the historical combined features.

[0122] In some embodiments, for each verification order, the server can input the verification combination features of the verification order into a parameter-adjusted anomaly score prediction model to predict the predicted anomaly score of the verification order. The server can compare the predicted anomaly score of the verification order with an anomaly score threshold. If the predicted anomaly score of the verification order is greater than or reaches the anomaly score threshold, the server determines that the predicted order type of the verification order is an anomaly order.

[0123] In some embodiments, if the predicted anomaly score of a verified order is greater than an anomaly score threshold, the degree of anomaly of the verified order is determined; if the degree of anomaly of the verified order reaches the anomaly degree threshold, the order type to which the verified order belongs is determined to be an anomalous order. The anomaly degree threshold can be set as needed. The server can use the predicted anomaly score of the verified order to determine the degree of anomaly, for example, the degree of anomaly of the verified order is positively correlated with the predicted anomaly score. The server can also combine the predicted anomaly score of the verified order with the order characteristics of the verified order to determine the degree of anomaly, for example, the degree of anomaly of the verified order is positively correlated with the amount in the order characteristics of the verified order.

[0124] In some embodiments, the server can count the number of verified orders whose actual order type is an anomalous order, obtaining a first order count, and count the number of verified orders whose predicted order type and actual order type are both anomalous, obtaining a second order count. The server can calculate the ratio of the second order count to the first order count, and determine the calculated ratio as the anomalous order coverage of the parameter-adjusted anomalous score prediction model. For example, anomalous order coverage = second order count / first order count. If the anomalous order coverage is greater than a coverage threshold, the server can determine the parameter-adjusted anomalous score prediction model as the trained anomalous score prediction model.

[0125] In this embodiment, since the first order quantity is the number of verified orders in each verified order whose actual order type is an abnormal order, and the second order quantity is the number of verified orders in each verified order whose predicted order type and actual order type are both abnormal orders, the abnormal order coverage of the abnormal score prediction model after parameter adjustment is determined based on the first order quantity and the second order quantity, thereby improving the accuracy of the abnormal order coverage.

[0126] In some embodiments, determining the predicted order type of a verification order based on the predicted anomaly score of the verification order includes: statistically analyzing the predicted anomaly scores of each verification order to obtain an anomaly score threshold; determining the predicted order type of the verification order based on the predicted anomaly score and the anomaly score threshold; and determining the parameter-adjusted anomaly score prediction model as a trained anomaly score prediction model when the anomaly order coverage is greater than the coverage threshold, which includes: determining the number of verification orders in each verification order whose predicted order type is anomaly order to obtain the number of third orders; determining the accuracy representation value of the anomaly score threshold based on the number of third orders and the number of second orders; and determining the parameter-adjusted anomaly score prediction model as a trained anomaly score prediction model when the anomaly order coverage is greater than the coverage threshold and the accuracy representation value of the anomaly score threshold is less than the representation value threshold.

[0127] Specifically, the accuracy of the anomaly score prediction model can also be reflected by the accuracy representation value of the anomaly score threshold. The server can count the number of verified orders predicted as anomaly orders among all verified orders, and determine this count as the third order quantity. The server can calculate the ratio of the third order quantity to the second order quantity, and determine this ratio as the accuracy representation value of the anomaly score threshold for the parameter-adjusted anomaly score prediction model. For example, the accuracy representation value of the anomaly score threshold = third order quantity / second order quantity. Since the ratio of the third order quantity to the second order quantity is greater than or equal to 1, the accuracy representation value of the anomaly score threshold is also greater than or equal to 1. The closer the accuracy representation value is to 1, the higher the accuracy of the anomaly score threshold, and thus the higher the accuracy of the anomaly score prediction model. The representation value threshold can be set as needed, for example, 1.1 or 1.2, etc.

[0128] In some embodiments, the server can calculate the ratio of the number of verified orders with predicted anomaly scores greater than a specified anomaly score to the total number of verified orders. If the ratio reaches a ratio threshold, the specified anomaly score is determined as the anomaly score threshold. If the ratio is less than the ratio threshold, the specified anomaly score is updated, and the server returns to calculating the ratio of the number of verified orders with predicted anomaly scores greater than the specified anomaly score to the total number of verified orders, until the ratio reaches the ratio threshold. The total number of verified orders refers to the number of all verified orders. The percentage threshold can be preset, for example, to 95% or 98%.

[0129] In this embodiment, when the abnormal order coverage rate is greater than the coverage threshold and the accuracy representation value of the abnormal score threshold is less than the representation value threshold, the abnormal score prediction model with adjusted parameters is determined as the trained abnormal score prediction model, thereby improving the accuracy of the trained abnormal score prediction model.

[0130] In some embodiments, adjusting the model parameters of the anomaly score prediction model based on the predicted anomaly scores and the actual anomaly scores of each historical order to obtain a trained anomaly score prediction model includes: generating order loss values ​​corresponding to each historical order based on the predicted anomaly scores and the actual anomaly scores of each historical order; determining the weights of normal orders and anomaly orders; ensuring that the weights of anomaly orders are greater than the weights of normal orders; statistically analyzing the order loss values ​​corresponding to each historical order using the weights of normal orders and anomaly orders to obtain model loss values; and adjusting the model parameters of the anomaly score prediction model based on the model loss values ​​to obtain a trained anomaly score prediction model.

[0131] In this system, the weight of a normal order is the weight corresponding to a normal order, and the weight of an abnormal order is the weight corresponding to an abnormal order. The number of normal orders in the historical order set is greater than the number of abnormal orders. The weight of an abnormal order is greater than the weight of a normal order; for example, the weight of an abnormal order is 0.6, and the weight of a normal order is 0.4. The weights of abnormal orders and normal orders can be determined based on the proportion of normal orders and the proportion of abnormal orders in the historical order set.

[0132] Specifically, the server can count the number of normal orders in the historical order set to obtain the normal order count, count the number of abnormal orders in the historical order set to obtain the abnormal order count, count the total number of historical orders included in the historical order set to obtain the total number of orders, calculate the ratio of normal orders to total orders to obtain the normal order percentage, calculate the ratio of abnormal orders to total orders to obtain the abnormal order percentage, determine the normal order weight based on the normal order percentage, and the normal order percentage and normal order weight are negatively correlated, the larger the normal order percentage, the smaller the normal order weight. Similarly, the abnormal order percentage and abnormal order weight are negatively correlated, the larger the abnormal order percentage, the smaller the abnormal order weight. For example, the abnormal order percentage can be determined as the normal order weight, and the normal order percentage can be determined as the abnormal order weight.

[0133] In some embodiments, for each historical order, the server can generate an order loss value corresponding to the historical order based on the predicted anomaly score and the actual anomaly score of the historical order. The weight of normal orders is used as the weight of the order loss value of normal historical orders, and the weight of abnormal orders is used as the weight of the order loss value of abnormal historical orders. The order loss values ​​corresponding to each historical order are weighted and summed, and the result of the weighted summation is determined as the model loss value. The model parameters of the anomaly score prediction model are adjusted in the direction that reduces the model loss value until the model converges, thus obtaining the trained anomaly score prediction model.

[0134] In this embodiment, since orders are usually normal and abnormal orders are relatively rare—for example, in social application payment scenarios, the daily sample size of normal transactions is far higher than that of fraudulent transactions, typically by several orders of magnitude—outliers in the data often only constitute a small portion of the dataset (data imbalance). This means that the number of normal orders in the historical order set is greater than the number of abnormal orders. Setting the weight of abnormal orders to be greater than that of normal orders increases the influence of the loss value generated by abnormal orders on the total loss value, thereby reducing the inaccuracy of loss values ​​caused by sample imbalance (i.e., fewer abnormal orders and more normal orders), and improving the accuracy of model training. Therefore, the order type determination method provided in this application enriches the feature space, solves the data imbalance problem, effectively improves the accuracy and stability of identification, and reduces the risk and loss of fraud for platforms and users.

[0135] In some embodiments, such as Figure 7 As shown, a method for determining order type is provided. This method can be executed by a terminal or a server, or by both a terminal and a server. Taking the application of this method to a server as an example, the method includes the following steps:

[0136] Step 702: For each historical order in the historical order set, use the preset clustering calculation methods corresponding to multiple preset clustering dimensions to determine the clustering feature value of the historical order under each preset clustering dimension.

[0137] Step 704: Combine the order features of historical orders with the clustering feature values ​​of historical orders under each preset clustering dimension to obtain the initial combined features of historical orders.

[0138] Step 706: For each feature dimension in each preset clustering degree dimension and each preset order feature dimension, the feature values ​​of the feature dimensions in the initial combination features of each historical order are statistically analyzed to obtain the dimension weight of the feature dimension.

[0139] Step 708: Select the target order feature dimension and the target clustering dimension from each preset clustering dimension and each preset order feature dimension in descending order of dimension weight.

[0140] Step 710: For each historical order in the historical order set, combine the feature value of the historical order in the target order feature dimension with the feature value of the historical order in the target clustering dimension to obtain the historical combined feature of the historical order.

[0141] Step 712: Input the historical combination features of each historical order into the anomaly score prediction model to be trained to obtain the predicted order type of each historical order.

[0142] Step 714: Based on the predicted order type and the actual order type of each historical order, adjust the model parameters of the anomaly score prediction model to obtain the trained anomaly score prediction model.

[0143] Step 716: In response to the target order triggered by the social application, obtain the order features of the target order based on the feature values ​​of the target order under multiple preset order feature dimensions.

[0144] Step 718: Determine the clustering feature value of the target order based on the order characteristics of the target order and the order characteristics of historical orders in the historical order set.

[0145] Step 720: Combine the feature values ​​of the target order under the target order feature dimension with the clustering feature values ​​under the target clustering dimension to obtain the target combined feature of the target order.

[0146] Step 722: Input the target combined features into the trained anomaly score prediction model to predict the anomaly score of the target order.

[0147] Step 724: Determine whether the abnormal score of the target order is greater than the abnormal score threshold. If so, proceed to step 726.

[0148] Step 726: Determine the degree of abnormality of the target order based on the order abnormality score and the order characteristics of the target order.

[0149] Step 728: Determine whether the abnormality level of the target order reaches the abnormality level threshold. If so, proceed to step 730.

[0150] Step 730: Intervene in orders through social applications.

[0151] With the increasing growth of payment services on social applications, black market activities are becoming more frequent, constantly impacting user confidence in social application payments. The order type determination method provided in this application expands the original feature space (which refers to order features) by using clustering degree feature values, thus enriching the representation of the feature space. Applied to the field of social application payments, this method can improve the accuracy of order type prediction, thereby accurately identifying abnormal orders in the social application payment field.

[0152] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0153] Based on the same inventive concept, this application also provides an order type determining apparatus for implementing the order type determining method described above. The solution provided by this apparatus is similar to the implementation described in the above method; therefore, the specific limitations in one or more of the order type determining apparatus embodiments provided below can be found in the limitations of the order type determining method described above, and will not be repeated here.

[0154] In some embodiments, such as Figure 8 As shown, an order type determination device is provided, including: an order feature acquisition module 802, a clustering degree acquisition module 804, a combined feature acquisition module 806, and an order type prediction module 808, wherein:

[0155] The order feature acquisition module 802 is used to obtain the order features of the target order based on the feature values ​​of the target order under multiple preset order feature dimensions.

[0156] The clustering degree module 804 is used to determine the clustering degree feature value of the target order based on the order characteristics of the target order and the order characteristics of the historical orders in the historical order set. The clustering degree feature value is used to characterize the degree of clustering between the target order and the historical orders when they are distributed according to the order characteristics. The historical order set includes normal historical orders and abnormal historical orders.

[0157] The combined feature module 806 is used to combine the feature values ​​of the target order with the clustering feature values ​​under at least one preset order feature dimension to obtain the target combined feature of the target order.

[0158] The order type prediction module 808 is used to predict the order type to which the target order belongs by utilizing the target combination features.

[0159] In some embodiments, the target order is an order belonging to a target object in a social application; the combined feature obtaining module is also used to determine the associated objects of the target object in the social application; based on the order anomaly information of the associated objects within a specified time period, the order anomaly features of the associated objects are encoded; the feature values, clustering feature values ​​and order anomaly features of the target order under at least one preset order feature dimension are combined to obtain the target combined feature of the target order.

[0160] In some embodiments, the clustering degree obtaining module is further configured to determine the feature value of the target order under the target clustering degree dimension based on the order features of the target order and the order features of historical orders in the historical order set, thereby obtaining the clustering degree feature value of the target order; the combined feature obtaining module is further configured to combine the feature value of the target order under the target order feature dimension with the feature value under the target clustering degree dimension to obtain the target combined feature of the target order; the target order feature dimension and the target clustering degree dimension are obtained by deduplicating multiple preset order feature dimensions and multiple preset clustering dimensions.

[0161] In some embodiments, the apparatus further includes a dimension determination module for determining the target order feature dimension and the target clustering dimension. The dimension determination module is configured to, for each historical order in the historical order set, use a preset clustering calculation method corresponding to multiple preset clustering dimensions to determine the clustering feature value of the historical order under each preset clustering dimension; combine the order features of the historical order with the clustering feature values ​​of the historical order under each preset clustering dimension to obtain the initial combined features of the historical order; for each feature dimension in each preset clustering dimension and each preset order feature dimension, statistically analyze the feature values ​​of the feature dimensions in the initial combined features of each historical order to obtain the dimension weight of the feature dimension; and perform redundancy removal processing on each preset clustering dimension and each preset order feature dimension according to the dimension weight to obtain the target order feature dimension and the target clustering dimension.

[0162] In some embodiments, the dimension determination module is further configured to select at least one preset order feature dimension and at least one preset clustering dimension from each preset clustering dimension and each preset order feature dimension in descending order of dimension weight, to form a feature dimension set; for any two feature dimensions in the feature dimension set, calculate the correlation between any two feature dimensions; if the correlation is greater than the correlation threshold, remove one of the two feature dimensions from the feature dimension set to obtain the target order feature dimension and the target clustering dimension.

[0163] In some embodiments, the combined feature obtaining module is further configured to obtain a clustering reference value; the clustering reference value is obtained by statistically analyzing the clustering feature values ​​of multiple normal orders; the difference between the clustering feature value corresponding to the target order and the clustering reference value is calculated to obtain the clustering difference value of the target order; the feature value of the target order under the target order feature dimension, the feature value under the target clustering dimension, and the clustering difference value of the target order are combined to obtain the target combined feature of the target order.

[0164] In some embodiments, the combined feature obtaining module is further configured to determine normal historical orders whose actual order type is normal from the historical order set; calculate the clustering feature value of each normal historical order using a specified clustering degree calculation method to obtain a clustering feature value set; and perform statistics on the clustering feature values ​​in the clustering feature value set to obtain a clustering degree reference value.

[0165] In some embodiments, the order type of the target order is predicted based on a trained anomaly score prediction model and an anomaly score threshold; the order type prediction module is further configured to input the target combined features into the trained anomaly score prediction model to predict the order anomaly score of the target order; if the order anomaly score of the target order is greater than the anomaly score threshold, the order type of the target order is determined to be an anomaly order.

[0166] In some embodiments, the apparatus further includes a model training module for obtaining a trained anomaly score prediction model. The model training module is configured to, for each historical order in the historical order set, combine the feature values ​​of the historical order in the target order feature dimension with the feature values ​​of the historical order in the target clustering dimension to obtain historical combined features of the historical order; input the historical combined features of each historical order into the anomaly score prediction model to be trained to obtain the predicted anomaly score of each historical order; and adjust the model parameters of the anomaly score prediction model based on the predicted anomaly scores and the actual anomaly scores of each historical order to obtain the trained anomaly score prediction model.

[0167] In some embodiments, the model training module is further configured to: adjust the model parameters of the anomaly score prediction model based on the predicted anomaly scores and the actual anomaly scores of each historical order to obtain a parameter-adjusted anomaly score prediction model; use the parameter-adjusted anomaly score prediction model to predict the order types of multiple verification orders to obtain the predicted anomaly scores of each verification order; determine the predicted order type of the verification order based on the predicted anomaly scores of the verification order; determine the number of verification orders in each verification order whose actual order type is anomaly order to obtain a first order number; determine the number of verification orders in each verification order whose predicted order type and actual order type are both anomaly order to obtain a second order number; determine the anomaly order coverage of the parameter-adjusted anomaly score prediction model based on the first order number and the second order number; and determine the trained anomaly score prediction model if the anomaly order coverage is greater than a coverage threshold.

[0168] In some embodiments, the model training module is further configured to: statistically analyze the predicted anomaly scores of each verification order to obtain an anomaly score threshold; determine the predicted order type of the verification order based on the predicted anomaly scores and the anomaly score threshold; determine the number of verification orders whose predicted order type is anomaly order to obtain the number of third orders; determine the accuracy representation value of the anomaly score threshold based on the number of third orders and the number of second orders; and determine the trained anomaly score prediction model as the anomaly score prediction model if the anomaly order coverage is greater than the coverage threshold and the accuracy representation value of the anomaly score threshold is less than the representation value threshold.

[0169] In some embodiments, the model training module is further configured to generate order loss values ​​corresponding to each historical order based on the predicted anomaly scores and the actual anomaly scores of each historical order; determine the weights of normal orders and anomaly orders; the weights of anomaly orders are greater than the weights of normal orders; use the weights of normal orders and anomaly orders to statistically analyze the order loss values ​​corresponding to each historical order to obtain the model loss value; and adjust the model parameters of the anomaly score prediction model based on the model loss value to obtain the trained anomaly score prediction model.

[0170] The modules in the aforementioned order type determination device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the operations corresponding to each module.

[0171] In some embodiments, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 9As shown, the computer device includes a processor, memory, input / output interfaces (I / O), and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides the environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The database stores data involved in the order type determination method. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communicating with external terminals via a network connection. When the computer program is executed by the processor, it implements an order type determination method.

[0172] In some embodiments, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 10 As shown, the computer device includes a processor, memory, input / output interfaces, a communication interface, a display unit, and an input device. The processor, memory, and input / output interfaces are connected via a system bus, and the communication interface, display unit, and input device are also connected to the system bus via the input / output interfaces. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The input / output interfaces are used for exchanging information between the processor and external devices. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, NFC (Near Field Communication), or other technologies. When executed by the processor, the computer program implements an order type determination method. The display unit of the computer device is used to form a visually visible image. It can be a display screen, a projection device, or a virtual reality imaging device. The display screen can be an LCD screen or an e-ink screen. The input device of the computer device can be a touch layer covering the display screen, or buttons, trackballs, or touchpads set on the casing of the computer device, or external keyboards, touchpads, or mice, etc.

[0173] Those skilled in the art will understand that Figure 9 and Figure 10The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application applies. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0174] In some embodiments, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the order type determination method described above.

[0175] In some embodiments, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the steps in the order type determination method described above.

[0176] In some embodiments, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the order type determination method described above.

[0177] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data shall comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0178] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0179] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0180] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A method for determining order type, characterized in that, The method includes: The order features of the target order are obtained based on the feature values ​​of the target order under multiple preset order feature dimensions; the target order is an order belonging to a target object in a social application. Based on the order characteristics of the target order and the order characteristics of historical orders in the historical order set, a clustering feature value for the target order is determined; the clustering feature value is used to characterize the degree of clustering between the target order and the historical orders when distributed according to order characteristics; the historical order set includes normal historical orders and abnormal historical orders; Identify the associated objects of the target object in the social application; Based on the order anomaly information of the associated object within a specified time period, the order anomaly characteristics of the associated object are encoded. The target combined features of the target order are obtained by combining the feature values ​​of the target order under at least one of the preset order feature dimensions, the clustering feature values, and the order anomaly features. The target order type is predicted using the target combination features.

2. The method according to claim 1, characterized in that, The determination of the clustering feature value of the target order based on the order characteristics of the target order and the order characteristics of historical orders in the historical order set includes: Based on the order characteristics of the target order and the order characteristics of historical orders in the historical order set, the feature value of the target order under the target clustering dimension is determined, and the clustering feature value of the target order is obtained. The step of combining the feature values ​​of the target order under at least one of the preset order feature dimensions with the clustering feature value to obtain the target combined feature of the target order includes: The target order's feature value under the target order feature dimension is combined with the feature value under the target clustering dimension to obtain the target combined feature of the target order; the target order feature dimension and the target clustering dimension are obtained by deredundancy processing of the multiple preset order feature dimensions and multiple preset clustering dimensions.

3. The method according to claim 2, characterized in that, The steps for determining the target order feature dimension and the target clustering dimension include: For each historical order in the historical order set, a preset clustering degree calculation method corresponding to multiple preset clustering degree dimensions is used to determine the clustering degree feature value of the historical order under each preset clustering degree dimension; The order features of the historical orders are combined with the clustering feature values ​​of the historical orders under each of the preset clustering dimensions to obtain the initial combined features of the historical orders; For each of the preset clustering degree dimensions and preset order feature dimensions, the feature values ​​of the feature dimensions in the initial combination features of each historical order are statistically analyzed to obtain the dimension weight of the feature dimension. Redundancy is removed from each of the preset clustering degree dimensions and each of the preset order feature dimensions based on the dimension weights to obtain the target order feature dimension and the target clustering dimension.

4. The method according to claim 3, characterized in that, The step of performing redundancy removal processing on each of the preset clustering degree dimensions and each of the preset order feature dimensions according to the dimension weights to obtain the target order feature dimension and the target clustering dimension includes: In descending order of dimension weight, at least one preset order feature dimension and at least one preset clustering dimension are selected from each preset clustering dimension and each preset order feature dimension to form a feature dimension set. For any two feature dimensions in the feature dimension set, calculate the correlation between the two feature dimensions. If the relevance is greater than the relevance threshold, remove one of the two feature dimensions from the feature dimension set to obtain the target order feature dimension and the target clustering dimension.

5. The method according to claim 2, characterized in that, The step of combining the feature values ​​of the target order under the target order feature dimension with the feature values ​​under the target clustering dimension to obtain the target combined feature of the target order includes: Obtain a clustering reference value; the clustering reference value is obtained by statistically analyzing the clustering feature values ​​of multiple normal orders. The difference between the clustering feature value corresponding to the target order and the clustering reference value is calculated to obtain the clustering difference value of the target order; The target combined features of the target order are obtained by combining the feature values ​​of the target order under the target order feature dimension, the feature values ​​under the target clustering dimension, and the clustering difference value of the target order.

6. The method according to claim 5, characterized in that, The acquisition of the clustering reference value includes: Identify normal historical orders whose actual order type is normal from the historical order set; The clustering characteristic value of each of the normal historical orders is calculated using a specified clustering degree calculation method to obtain a set of clustering degree characteristic values; The clustering feature values ​​in the set of clustering feature values ​​are statistically analyzed to obtain the clustering reference value.

7. The method according to claim 1, characterized in that, The order type to which the target order belongs is predicted based on a trained anomaly score prediction model and anomaly score threshold. The step of predicting the order type of the target order using the target combination features includes: The target combined features are input into the trained anomaly score prediction model to predict the order anomaly score of the target order. If the order anomaly score of the target order is greater than the anomaly score threshold, the order type of the target order is determined to be an abnormal order.

8. The method according to claim 7, characterized in that, The steps to obtain the trained anomaly score prediction model include: For each historical order in the historical order set, the feature value of the historical order in the target order feature dimension is combined with the feature value of the historical order in the target clustering dimension to obtain the historical combined feature of the historical order; The historical combination features of each historical order are input into the anomaly score prediction model to be trained to obtain the predicted anomaly score of each historical order. Based on the predicted anomaly scores and the actual anomaly scores of each historical order, the model parameters of the anomaly score prediction model are adjusted to obtain the trained anomaly score prediction model.

9. The method according to claim 8, characterized in that, The step of adjusting the model parameters of the anomaly score prediction model based on the predicted anomaly scores and the actual anomaly scores of each historical order to obtain the trained anomaly score prediction model includes: Based on the predicted anomaly scores of each historical order and the actual anomaly scores of each historical order, the model parameters of the anomaly score prediction model are adjusted to obtain the parameter-adjusted anomaly score prediction model. The anomaly score prediction model with the parameters adjusted is used to predict the order type to which multiple verified orders belong, and the predicted anomaly score of each verified order is obtained. The predicted order type of the verified order is determined based on the predicted anomaly score of the verified order; The number of verified orders in each of the verified orders whose actual order type is an abnormal order is determined to obtain the first order number; the number of verified orders in each of the verified orders whose predicted order type and actual order type are both abnormal orders is determined to obtain the second order number. Based on the first order quantity and the second order quantity, determine the abnormal order coverage of the abnormal score prediction model after parameter adjustment; If the abnormal order coverage rate is greater than the coverage threshold, the abnormal score prediction model with adjusted parameters is determined as the trained abnormal score prediction model.

10. The method according to claim 9, characterized in that, The step of determining the predicted order type of the verification order based on the predicted anomaly score of the verification order includes: An anomaly score threshold is obtained by statistically analyzing the predicted anomaly scores of each of the aforementioned verified orders. Based on the predicted anomaly score and anomaly score threshold of the verified order, the predicted order type of the verified order is determined; The step of determining the parameter-adjusted anomaly score prediction model as the trained anomaly score prediction model when the anomaly order coverage rate is greater than the coverage rate threshold includes: Determine the number of verified orders whose predicted order type is abnormal among all the verified orders to obtain the third order number; Based on the number of the third order and the number of the second order, determine the accuracy characterization value of the anomaly score threshold; If the abnormal order coverage rate is greater than the coverage threshold and the accuracy representation value of the abnormal score threshold is less than the representation value threshold, the abnormal score prediction model with adjusted parameters is determined as the trained abnormal score prediction model.

11. The method according to claim 8, characterized in that, The step of adjusting the model parameters of the anomaly score prediction model based on the predicted anomaly scores and the actual anomaly scores of each historical order to obtain the trained anomaly score prediction model includes: Based on the predicted anomaly score and the actual anomaly score of each historical order, an order loss value corresponding to each historical order is generated. Determine the weight of normal orders and the weight of abnormal orders; the weight of abnormal orders is greater than the weight of normal orders. By using the normal order weight and the abnormal order weight, the order loss value corresponding to each of the historical orders is statistically analyzed to obtain the model loss value; The model parameters of the anomaly score prediction model are adjusted based on the model loss value to obtain the trained anomaly score prediction model.

12. An order type determination device, characterized in that, The device includes: The order feature acquisition module is used to obtain the order features of the target order based on the feature values ​​of the target order under multiple preset order feature dimensions; the target order is an order belonging to a target object in a social application; The clustering degree acquisition module is used to determine the clustering degree feature value of the target order based on the order characteristics of the target order and the order characteristics of historical orders in the historical order set; the clustering degree feature value is used to characterize the degree of clustering between the target order and the historical orders when distributed according to the order characteristics; the historical order set includes normal historical orders and abnormal historical orders; The associated object determination module is used to determine the associated objects of the target object in the social application; The order anomaly feature encoding module is used to encode the order anomaly features of the associated object based on the order anomaly information of the associated object within a specified time period. The combined feature acquisition module is used to combine the feature values ​​of the target order under at least one of the preset order feature dimensions, the clustering feature values, and the order anomaly features to obtain the target combined features of the target order; The order type prediction module is used to predict the order type to which the target order belongs by utilizing the target combination features.

13. The order type determining device according to claim 12, characterized in that, The clustering degree obtaining module is further used to determine the feature value of the target order under the target clustering degree dimension based on the order features of the target order and the order features of historical orders in the historical order set, and obtain the clustering degree feature value of the target order; The combined feature obtaining module is further configured to combine the feature value of the target order under the target order feature dimension with the feature value under the target clustering dimension to obtain the target combined feature of the target order; the target order feature dimension and the target clustering dimension are obtained by performing redundancy removal processing on the multiple preset order feature dimensions and multiple preset clustering dimensions.

14. The order type determining device according to claim 13, characterized in that, The device further includes a dimension determination module, which is used to determine the clustering feature value of each historical order in the historical order set by using a preset clustering calculation method corresponding to a plurality of preset clustering dimensions. The order features of the historical orders are combined with the clustering feature values ​​of the historical orders under each of the preset clustering dimensions to obtain the initial combined features of the historical orders; For each of the preset clustering degree dimensions and preset order feature dimensions, the feature values ​​of the feature dimensions in the initial combination features of each historical order are statistically analyzed to obtain the dimension weight of the feature dimension. Redundancy is removed from each of the preset clustering degree dimensions and each of the preset order feature dimensions based on the dimension weights to obtain the target order feature dimension and the target clustering dimension.

15. The order type determining device according to claim 14, characterized in that, The dimension determination module is further configured to select at least one preset order feature dimension and at least one preset clustering dimension from the preset clustering degree dimensions and the preset order feature dimensions, according to the dimension weights in descending order. Composition of feature dimension set; For any two feature dimensions in the feature dimension set, calculate the correlation between the two feature dimensions. If the relevance is greater than the relevance threshold, remove one of the two feature dimensions from the feature dimension set to obtain the target order feature dimension and the target clustering dimension.

16. The order type determination device according to claim 13, characterized in that, The combined feature acquisition module is also used to obtain a clustering reference value; the clustering reference value is obtained by statistically analyzing the clustering feature values ​​of multiple normal orders. The difference between the clustering feature value corresponding to the target order and the clustering reference value is calculated to obtain the clustering difference value of the target order; The target combined features of the target order are obtained by combining the feature values ​​of the target order under the target order feature dimension, the feature values ​​under the target clustering dimension, and the clustering difference value of the target order.

17. The order type determination device according to claim 16, characterized in that, The combined feature obtaining module is also used to determine normal historical orders whose actual order type is normal orders from the historical order set; The clustering characteristic value of each of the normal historical orders is calculated using a specified clustering degree calculation method to obtain a set of clustering degree characteristic values; The clustering feature values ​​in the set of clustering feature values ​​are statistically analyzed to obtain the clustering reference value.

18. The order type determining device according to claim 12, characterized in that, The order type to which the target order belongs is predicted based on a trained anomaly score prediction model and anomaly score threshold. The order type prediction module is also used to input the target combination features into the trained anomaly score prediction model to predict the order anomaly score of the target order. If the order anomaly score of the target order is greater than the anomaly score threshold, the order type of the target order is determined to be an abnormal order.

19. The order type determining device according to claim 18, characterized in that, The device further includes a model training module, which is used to combine the feature value of the historical order in the target order feature dimension with the feature value of the historical order in the target clustering dimension for each historical order in the historical order set, so as to obtain the historical combined feature of the historical order. The historical combination features of each historical order are input into the anomaly score prediction model to be trained to obtain the predicted anomaly score of each historical order. Based on the predicted anomaly scores and the actual anomaly scores of each historical order, the model parameters of the anomaly score prediction model are adjusted to obtain the trained anomaly score prediction model.

20. The order type determining device according to claim 19, characterized in that, The model training module is also used to adjust the model parameters of the anomaly score prediction model based on the predicted anomaly score of each historical order and the actual anomaly score of each historical order, so as to obtain the parameter-adjusted anomaly score prediction model. The anomaly score prediction model with the parameters adjusted is used to predict the order type to which multiple verified orders belong, and the predicted anomaly score of each verified order is obtained. The predicted order type of the verified order is determined based on the predicted anomaly score of the verified order; The number of verified orders in each of the verified orders whose actual order type is an abnormal order is determined to obtain the first order number; the number of verified orders in each of the verified orders whose predicted order type and actual order type are both abnormal orders is determined to obtain the second order number. Based on the first order quantity and the second order quantity, determine the abnormal order coverage of the abnormal score prediction model after parameter adjustment; If the abnormal order coverage rate is greater than the coverage threshold, the abnormal score prediction model with adjusted parameters is determined as the trained abnormal score prediction model.

21. The order type determination device according to claim 20, characterized in that, The model training module is also used to perform statistical analysis based on the predicted anomaly scores of each of the verified orders to obtain anomaly score thresholds; Based on the predicted anomaly score and anomaly score threshold of the verified order, the predicted order type of the verified order is determined; Determine the number of verified orders whose predicted order type is abnormal among all the verified orders to obtain the third order number; Based on the number of the third order and the number of the second order, determine the accuracy characterization value of the anomaly score threshold; If the abnormal order coverage rate is greater than the coverage threshold and the accuracy representation value of the abnormal score threshold is less than the representation value threshold, the abnormal score prediction model with adjusted parameters is determined as the trained abnormal score prediction model.

22. The order type determination device according to claim 19, characterized in that, The model training module is also used to generate order loss values ​​corresponding to each of the historical orders based on the predicted anomaly scores and the actual anomaly scores of each of the historical orders. Determine the weight of normal orders and the weight of abnormal orders; The weight of the abnormal order is greater than the weight of the normal order; By using the normal order weight and the abnormal order weight, the order loss value corresponding to each of the historical orders is statistically analyzed to obtain the model loss value; The model parameters of the anomaly score prediction model are adjusted based on the model loss value to obtain the trained anomaly score prediction model.

23. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the method of any one of claims 1 to 11.

24. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method of any one of claims 1 to 11.

25. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the method of any one of claims 1 to 11.

Images