A method and device for managing information security risk assessment of online transactions

Abstract

The present application provides an information security risk assessment management method and device for online transactions. Based on the behavioral events included in the user transaction behavior monitoring data set, the user transaction behavior monitoring data set is divided into U behavioral data segments, each behavioral data segment is determined as a topological unit, and the topological unit information of the topological unit is determined according to the behavior characterization vector and timing information of the behavior data segment, and the behavior relationship topology of the user transaction behavior monitoring data set is generated. The behavior relationship topology includes the timing information of the behavior data segment in the user transaction behavior monitoring data set. Then, when the risk assessment of the user transaction behavior monitoring data set is performed according to the behavior relationship topology, the event connection information of the user transaction behavior monitoring data set can be identified, the risk of the user transaction behavior monitoring data set can be assessed from the correlation and logic of the event occurrence, and the potential risks can be mined from the rationality of the internal connection of the behavior, so that the risk assessment value can be more accurate.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to an information security risk assessment management method and device for online transactions. Background Art

[0002] With the rapid development of Internet technology, online transaction activities such as e-commerce and online payment are becoming more and more frequent, and user transaction behavior data is characterized by massive, complex and dynamic changes. These transaction behavior data not only record users' transaction habits and consumption preferences, but also imply potential security risks. Therefore, how to efficiently and accurately assess the risks of user transaction behavior has become an important challenge faced by financial institutions, e-commerce platforms and third-party payment institutions. Traditional risk assessment methods often rely on expert experience rules or simple statistical models for local data comparison. These methods are powerless when dealing with large-scale, high-dimensional transaction behavior data. They are difficult to capture the inherent connection, time sequence and potential logical correlation between transaction behaviors, resulting in inaccurate risk assessment results, which are prone to miss potential risks or misreport security threats. In particular, for user transaction behavior monitoring data sets, which contain all transaction records conducted by users within a period of time, these records have both independent event attributes and complex event connections and temporal logic. Traditional risk assessment methods often only focus on the risk characteristics of a single transaction event, while ignoring the connection and occurrence order between events, and cannot comprehensively and systematically assess the overall risk status of user transaction behavior. Summary of the invention

[0003] In view of this, the present application provides an online transaction information security risk assessment management method and device. The technical solution of the present application is implemented as follows:

[0004] On the one hand, the present application provides an information security risk assessment management method for online transactions, comprising: obtaining a user transaction behavior monitoring data set to be assessed, the user transaction behavior monitoring data set comprising a plurality of user transaction behavior data collected from transaction behaviors performed by a target user in a target period; performing time series data segmentation on the user transaction behavior monitoring data set according to the behavior events included in the user transaction behavior monitoring data set, to obtain U behavior data segments of the user transaction behavior monitoring data set, where U is a natural number greater than 0; obtaining time series information of each behavior data segment in the U behavior data segments in the user transaction behavior monitoring data set, and extracting characterization information of the U behavior data segments to obtain a behavior characterization vector of each behavior data segment in the U behavior data segments; for each behavior data segment in the U behavior data segments, taking the behavior data segment as a topological unit of a behavior relationship topology, and determining topological unit information of the topological unit according to the behavior characterization vector and time series information of the behavior data segment, to obtain a behavior relationship topology of the user transaction behavior monitoring data set; performing risk assessment on the user transaction behavior monitoring data set according to the behavior relationship topology of the user transaction behavior monitoring data set.

[0005] On the other hand, the present application provides an information security risk assessment management device, including a memory and a processor, wherein the memory stores a computer program that can be executed on the processor, and the processor implements the steps in the above-mentioned method when executing the program.

[0006] The technical effects of the present application include: when the scheme provided by the present application is executed, a user transaction behavior monitoring data set to be evaluated is obtained, and the user transaction behavior monitoring data set is segmented into time series data according to the behavior events included in the user transaction behavior monitoring data set to obtain U behavior data segments of the user transaction behavior monitoring data set, the time series information of each behavior data segment in the user transaction behavior monitoring data set is obtained, and representation information of the U behavior data segments is extracted to obtain a behavior representation vector of each behavior data segment in the U behavior data segments, for each behavior data segment in the U behavior data segments, the behavior data segment is used as a topological unit of the behavior relationship topology, and the topological unit information of the topological unit is determined according to the behavior representation vector and the time series information of the behavior data segment to obtain the behavior relationship topology of the user transaction behavior monitoring data set, and the user transaction behavior monitoring data set is risk assessed according to the behavior relationship topology of the user transaction behavior monitoring data set. The above divides the user transaction behavior monitoring data set into U behavior data segments based on the behavior events included in the user transaction behavior monitoring data set, determines each behavior data segment as a topological unit, determines the topological unit information of the topological unit according to the behavior characterization vector and timing information of the behavior data segment, and generates a behavior relationship topology of the user transaction behavior monitoring data set. The behavior relationship topology includes the timing information of the behavior data segment in the user transaction behavior monitoring data set. Then, when performing risk assessment of the user transaction behavior monitoring data set based on the behavior relationship topology, the event connection information of the user transaction behavior monitoring data set can be identified, the risk of the user transaction behavior monitoring data set can be evaluated from the correlation and logic of the occurrence of events, and potential risks can be mined from the rationality of the internal connection of the behavior, which can make the risk assessment value more accurate. BRIEF DESCRIPTION OF THE DRAWINGS

[0007] Figure 1 A schematic diagram of the implementation flow of an information security risk assessment management method for online transactions provided in an embodiment of the present application.

[0008] Figure 2 A hardware entity schematic diagram of an information security risk assessment management device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0009] The embodiment of the present application provides an information security risk assessment management method for online transactions, which can be executed by a processor of an information security risk assessment management device, wherein the information security risk assessment management device can refer to a device with data processing capabilities such as a server, a laptop, a tablet computer, a desktop computer, a mobile device, etc.

[0010] Figure 1 A schematic diagram of an implementation flow of an information security risk assessment management method for online transactions provided in an embodiment of the present application is shown in FIG. Figure 1 As shown, the method includes:

[0011] Operation S1: obtaining a user transaction behavior monitoring data set to be evaluated, where the user transaction behavior monitoring data set includes a plurality of user transaction behavior data collected from transaction behaviors performed by a target user in a target period.

[0012] The user transaction behavior monitoring data set to be evaluated obtained in operation S1 contains detailed records of all transaction behaviors performed by the target user within a specific time period. In an online transaction environment, the collection of user transaction behavior data mainly relies on the log records of the transaction system, the user account activity records, and various metadata generated during the transaction process. Specifically, these data can come from e-commerce platforms, payment gateways, banking systems, and any third-party service providers involved in transaction processing. For example, an e-commerce platform (such as an e-commerce website or mobile application) will automatically record relevant transaction information when a user completes operations such as purchases, payments, and refunds. Data collection is usually achieved through automated means, using system logging functions or specialized monitoring tools to capture and store transaction behavior data. These tools can capture data from various data sources in real time or periodically, and perform preliminary processing and formatting to ensure the accuracy and consistency of the data. For example, a payment gateway will record key fields such as the amount, timestamp, transaction type (such as purchase, refund), product details, payer information, and payee information of each transaction.

[0013] The user transaction behavior monitoring dataset contains a wealth of transaction details, which are crucial for subsequent risk assessment. Specifically, the dataset may include but is not limited to the following information:

[0014] Basic transaction information: transaction ID, transaction timestamp, transaction amount, transaction status (successful, failed, pending), transaction type (purchase, transfer, withdrawal, etc.).

[0015] User information: user ID, user name, user account balance, account security level, and link to historical transaction records.

[0016] Product or service information: product ID, product name, product category, price, purchase quantity, discount information.

[0017] Payment information: payment method (credit card, third-party payment platform, digital currency, etc.), payment account details, payment verification status.

[0018] Geolocation information (if available): IP address, approximate geolocation (country, city) of the user at the time of the transaction.

[0019] Device information: the type of device (mobile phone, computer), operating system, and browser type used to initiate the transaction.

[0020] The collected data is usually stored in a structured form, such as a table in a relational database or a document collection in a NoSQL database. To facilitate subsequent processing and analysis, the data will be organized into a sequence data set arranged according to the time point distribution. This means that each transaction record will be sorted according to the timestamp of its occurrence, forming an ordered data stream.

[0021] Assume that there is an e-commerce platform that processes tens of thousands of transactions every day. In order to evaluate whether the transaction behavior of a specific user (such as a user with user ID 12345) in the past month (such as January to February 2023) poses a security risk, the computer system needs to perform operation S1 to collect relevant data.

[0022] First, query the transaction log database of the e-commerce platform for all transaction records with user ID 12345 and transaction time between January 1, 2023 and February 28, 2023. These records may include:

[0023] At 10:00:00 on January 5, 2023, user 12345 used a credit card to purchase electronic products worth 500 yuan, and the transaction was successful.

[0024] At 15:30:00 on January 15, 2023, user 12345 initiated a transfer of 100 yuan to another user account, and the transaction was successful.

[0025] At 08:45:00 on 2023-02-01, user 12345 tried to log in to his account using a different IP address and purchased a product worth 20 yuan. The transaction was successful but triggered an abnormal login warning.

[0026] ... (more transaction records)

[0027] Each record contains the transaction ID, user ID, transaction timestamp, transaction type, transaction amount, payment method, product information, and any warning or abnormal information related to the transaction. The computer system arranges these records in timestamp order to form a complete user transaction behavior monitoring data set for subsequent risk assessment steps.

[0028] Operation S2: According to the behavior events included in the user transaction behavior monitoring data set, the user transaction behavior monitoring data set is segmented into time series data to obtain U behavior data segments of the user transaction behavior monitoring data set, where U is a natural number greater than 0.

[0029] Operation S2 segments the user transaction behavior monitoring data set into time series data segments according to the behavior events, so as to conduct in-depth analysis and risk assessment on each independent event later. When segmenting the time series data, the computer system follows the following basic principles:

[0030] Event independence: Each segment should represent an independent transaction behavior event, and all related data items within the event should be included in the same segment.

[0031] Timing: Segments must be arranged strictly in the order in which transactions occurred to ensure the consistency and accuracy of data analysis.

[0032] Completeness: Each segment should fully record all key information of the event, including transaction type, timestamp, transaction amount, transaction object, etc., to facilitate subsequent risk assessment.

[0033] The specific process of the computer system performing operation S2 may be as follows:

[0034] Event identification: Traverse the user transaction behavior monitoring data set and identify different transaction behavior events based on specific fields in the transaction record (such as transaction type, transaction description, etc.). For example, buying goods, transferring money to friends, withdrawing money to a bank account, etc. can all be considered different transaction behavior events.

[0035] Data aggregation: For each identified transaction behavior event, the system aggregates all related data items into a single segment. These data items may include the transaction timestamp, transaction amount, transaction party information, payment method, etc.

[0036] Time series sorting: After the data aggregation of all events is completed, the system sorts the entire data set according to the timestamp of each segment (usually the time when the transaction starts or ends) to ensure the time series consistency between segments.

[0037] Segment numbering and indexing: To facilitate subsequent processing, the system assigns a unique identifier (such as a segment ID) to each segment and creates an index, so that when you need to access a specific segment, you can quickly locate the corresponding data.

[0038] For example, suppose the user transaction behavior monitoring data set contains multiple transaction records of user A within a period of time, some of which are as follows:

[0039] Record 1: 2023-03-01 10:00, purchased product X, amount 500 yuan.

[0040] Record 2: 2023-03-02 15:00, transferred to friend B, amount 200 yuan.

[0041] Record 3: 2023-03-03 08:30, withdrawal to bank account, amount 300 yuan.

[0042] When executing operation S2, the computer system regards the three transaction records as three independent transaction behavior events and divides them into the following segments:

[0043] Segment 1 (ID: 001): contains all data items of record 1, representing the event of user A purchasing product X.

[0044] Segment 2 (ID: 002): contains all the data items of record 2, representing the event of user A transferring money to friend B.

[0045] Segment 3 (ID: 003): contains all data items of record 3, representing the event of user A withdrawing money to a bank account.

[0046] The system then sorts the segments according to their timestamps (2023-03-01 10:00, 2023-03-02 15:00, 2023-03-03 08:30) to ensure that they are arranged in the order in which the transactions occurred.

[0047] Operation S3: Obtain the time series information of each behavior data segment in the user transaction behavior monitoring data set, and extract the representation information of the U behavior data segments to obtain the behavior representation vector of each behavior data segment in the U behavior data segments.

[0048] Operation S3 is intended to extract the time series information and key features of each behavior data segment from the user transaction behavior monitoring data set, and then generate vectors that characterize the behavior characteristics of these segments. First, the computer system traverses U behavior data segments, and for each segment, extracts its time series information in the user transaction behavior monitoring data set. The time series information mainly includes the occurrence time of the transaction behavior within the segment and the relative order between the segments. This information is crucial for understanding the dynamic changes and pattern recognition of transaction behavior.

[0049] After obtaining the time series information, the computer system further extracts the characterization information for each behavioral data segment. This process involves extracting key features that can describe the characteristics of the transaction behavior in the segment and converting them into a behavior characterization vector. These features may include transaction amount, transaction frequency, transaction type distribution, transaction object type, etc. The transaction amount can be the average amount or total amount of all transactions in the segment. The transaction frequency is the number of transactions that occur per unit time (such as per hour). The transaction type distribution is the proportion of different types of transactions (such as purchases, transfers, and withdrawals) in the segment. The transaction object type is, for example, the identity characteristics of the transaction object (such as individuals, merchants, unknown accounts) and their distribution.

[0050] In order to convert these features into behavior representation vectors, computer systems can use a variety of methods, including but not limited to statistical aggregation, one-hot encoding, word embedding, etc. In practical applications, it is more common to use machine learning algorithms (such as principal component analysis PCA, t-SNE and other dimensionality reduction techniques) or directly learn feature representations through deep learning models (such as autoencoders).

[0051] For example, suppose a segment contains 10 transfer transactions, with an average transaction amount of 500 yuan, a transaction frequency of 5 times per hour, all transaction types are transfers, and all transaction objects are individual users. The computer system can quantify these features into specific values ​​and construct a feature vector, such as [500, 5, 1.0, 0.0, 0.0] (where 1.0 represents the proportion of transfer types, and the last two 0.0s represent the proportion of purchase and withdrawal types, respectively). However, in practical applications, the construction of feature vectors may be more complicated, involving more features and more advanced representation learning methods.

[0052] In order to further improve the accuracy and usefulness of the behavior representation vector, machine learning models (such as neural networks) can be introduced to automatically learn feature representation. For example, a recurrent neural network (RNN) or a long short-term memory network (LSTM) can be used to process time series data to capture the evolution of trading behavior over time; or a convolutional neural network (CNN) can be used to deal with pattern recognition problems in trading records. For example, if a deep learning model is used, the computer system can use the transaction records in each segment (arranged in chronological order) as an input sequence and process it through a trained LSTM network. The LSTM network is able to learn long-term dependencies in sequence data and output a fixed-length vector as the behavior representation vector for the segment. This vector not only contains the key feature information within the segment, but also implies the temporal dynamics of the trading behavior.

[0053] Operation S4: For each of the U behavior data segments, the behavior data segment is used as a topological unit of the behavior relationship topology, and the topological unit information of the topological unit is determined according to the behavior characterization vector and timing information of the behavior data segment to obtain the behavior relationship topology of the user transaction behavior monitoring data set.

[0054] Operation S4 constructs a behavior relationship topology to fully reflect the internal connections and dynamic changes between user transaction behaviors. In this step, the computer system regards each behavior data segment as a topological unit (also called a node or vertex) in the topology, and uses the behavior representation vectors and timing information of these segments to determine the detailed information of each topological unit, and finally forms a complete behavior relationship topology diagram.

[0055] First, the computer system regards U behavioral data segments as independent topological units in the behavioral relationship topology. Each topological unit not only represents a specific event of the user's transaction behavior, but also contains all the key information of the event, such as transaction type, transaction amount, transaction time, etc. This information is mathematically represented by the behavior representation vector, so that the topological unit has quantifiable characteristics in the topological map.

[0056] Next, the computer system determines the detailed information of the topological unit based on the behavior representation vector and timing information of each behavior data segment. This information includes but is not limited to the position of the topological unit (the order in time sequence), the weight of the topological unit (which may be calculated based on factors such as transaction amount and transaction frequency), and the connection relationship between topological units (indicating the mutual influence or causal relationship between different transaction behaviors).

[0057] Topological unit weight calculation: For example, the weight of the topological unit can be set according to the size of the transaction amount. The larger the transaction amount, the greater the weight of the topological unit, indicating that the transaction behavior is more important in the user's transaction behavior pattern. Calculation formula example: Topological unit weight Wi = α·transaction amount i+β·transaction frequency i, where α and β are weight coefficients, which need to be adjusted according to actual conditions.

[0058] Connection relationship between topological units: The connection relationship between topological units can be determined by analyzing the similarity of timing information and behavior representation vectors. If two topological units are adjacent in time and have similar behavior characteristics, there may be a direct connection relationship between them. This connection relationship can be directed (indicating the order of transaction behaviors) or undirected (indicating the mutual influence between transaction behaviors).

[0059] After determining the detailed information of all topological units, the computer system begins to construct a behavioral relationship topological graph. This graph is a complex network structure, in which topological units represent behavioral data segments and edges represent the connection relationship between topological units. The graph construction process needs to comprehensively consider the location, weight and connection relationship between topological units to ensure that the topological graph can accurately reflect the overall pattern and dynamic changes of user transaction behavior.

[0060] For example, suppose user A performs multiple transactions within a period of time, including purchasing goods, transferring money to friends, withdrawing cash to a bank account, etc. These transaction behaviors are segmented into different behavioral data segments and used as topological units in the behavioral relationship topology.

[0061] Topological unit 1: represents user A who purchased a product worth 500 yuan at time T1. Its behavior representation vector may contain information such as product category and purchase amount, and the topological unit has a higher weight.

[0062] Topological unit 2: represents user A transferring 300 yuan to a friend at time T2 (T2>T1). This topological unit is adjacent to topological unit 1 in time sequence, and since both involve fund flow, there may be a direct connection between them.

[0063] Topological unit 3: represents user A withdrawing 200 yuan from the bank account at time T3 (T3>T2). Although the transaction type is different from the previous two topological units, considering the overall liquidity of funds and the user's trading habits, it may have an indirect connection with the previous topological units.

[0064] The computer system determines the connection relationship between these topological units based on their behavior representation vectors and timing information, and constructs a behavior relationship topological graph. In this graph, the size and color of the topological unit can represent the weight and type of the topological unit (such as purchase, transfer, withdrawal, etc.), and the direction and thickness of the edge can represent the order and importance of the transaction behavior.

[0065] Through such a topological diagram, the computer system can intuitively understand the overall pattern and potential risk points of user transaction behavior. For example, if it is found that a user frequently performs large transfers and withdrawals in a short period of time, and these operations are not directly related to previous purchases, it may indicate abnormal transaction risks and require further risk assessment and monitoring.

[0066] In summary, operation S4 provides comprehensive data support and visual analysis tools for online transaction information security risk assessment by constructing a behavioral relationship topology diagram, which helps to timely discover potential transaction risks and take corresponding prevention and control measures.

[0067] Operation S5: performing risk assessment on the user transaction behavior monitoring dataset according to the behavior relationship topology of the user transaction behavior monitoring dataset.

[0068] Operation S5 performs a comprehensive risk assessment on the overall transaction behavior based on the behavior relationship topology of the user transaction behavior monitoring data set constructed in the previous step. In this step, the computer system uses the topological units, edges, and attribute information of the topological units in the topological graph to identify potential security risk points through a series of complex analysis and calculations, and gives a corresponding risk level assessment.

[0069] As an example of a risk assessment process, the following actions may be included:

[0070] 1. Identification of risky behavior patterns. First, the computer system identifies common risky behavior patterns based on the distribution characteristics of topological units and edges in the behavioral relationship topology. These patterns may include abnormal transaction frequencies, large capital flows, atypical transaction times, and transaction associations with high-risk accounts. For example, if the weight of a topological unit (representing a transaction behavior) is abnormally high (indicating a huge transaction amount), and the topological unit is connected to multiple high-risk topological units (indicating that there are financial transactions with multiple suspicious accounts), it may indicate the risk of money laundering or fraud.

[0071] 2. Application of risk assessment models. In order to more accurately assess risks, computer systems usually use machine learning models to analyze behavioral relationship topology. These models can automatically learn risk features in historical data and predict and classify new transaction behavior data based on these features.

[0072] Common models include support vector machines (SVM), random forests, gradient boosting trees (GBDT), and deep learning models (such as convolutional neural networks (CNNs) or graph neural networks (GNNs). In graph data scenarios, GNNs are particularly suitable because they can handle complex relationships between topological units and capture information in graph structures. Feature engineering is required before the behavioral relationship topology is input into the model. Features may include graph theory indicators such as degree centrality, closeness centrality, and betweenness centrality of topological units, as well as specific attributes such as transaction amount, transaction type, and transaction time in the behavioral representation vector of topological units. Use annotated historical transaction behavior data (including normal transactions and risky transactions) to train the model. The annotation process may involve manual review or combine the results of other risk management systems. The trained model is used to conduct risk assessment on new transaction behavior data and output a risk score or risk level for each transaction behavior or the entire data set.

[0073] 3. Risk threshold setting and decision-making. Based on business needs and security policies, the computer system sets different risk thresholds. When the risk assessment results of a transaction behavior or data set exceed these thresholds, the system will trigger the corresponding security response mechanism, such as increasing the monitoring frequency, requiring additional verification, temporarily freezing the account, etc.

[0074] For example, suppose a user has frequently made large transfers in the past period of time, and these transfer behaviors have formed an obvious abnormal pattern in the behavioral relationship topology: the transfer amount is much higher than the average transaction level of the user, and the transfer objects are mostly unknown accounts in high-risk areas.

[0075] The computer system first analyzes the behavioral relationship topology through the GNN model. The model has learned the risk characteristics in a large amount of historical data and can automatically identify similar abnormal patterns. In this evaluation, the model outputs a high-risk score for the user's transaction behavior.

[0076] The computer system then compares the score with the preset risk threshold. Since the score far exceeds the threshold, the system decides to trigger the security response mechanism. Specific measures may include suspending the user's transfer function, requiring the user to provide further identity verification information, and initiating a manual review process to confirm the authenticity and legality of the transaction. Through such a risk assessment process, the computer system can promptly detect and respond to potential transaction risks and ensure the security and stability of the online trading environment. At the same time, by continuously optimizing the risk assessment model and updating the risk threshold setting, the system can continuously improve its risk identification and response capabilities.

[0077] In one implementation, the above operation S4, i.e., determining the topological unit information of the topological unit according to the behavior characterization vector and the timing information of the segmented behavior data, can be implemented by the following sub-operations:

[0078] Operation S41: Acquiring behavior intensity information of the behavior data segment;

[0079] Operation S42: determining topological unit information of the topological unit according to the behavior characterization vectors, timing information, and behavior intensity information of the behavior data segments.

[0080] Behavior intensity information is one of the key factors in assessing the importance and potential risks of transaction behavior. It is usually associated with the direct economic consequences of the transaction, such as the amount of funds transferred, which directly reflects the economic impact of the behavior. In an online trading environment, each transaction involves a certain amount of resource transfer, which can be currency, goods, services or other forms of assets. The computer system directly obtains the numerical size of these resource transfers, that is, behavior intensity information, by parsing the specific transaction records in the behavior data segment.

[0081] For example, suppose there is a behavioral data segment that contains three transfer transactions performed by user A on April 1, 2023:

[0082] Transfer money to merchant B, the amount is 1,000 yuan.

[0083] Transfer 500 yuan to friend C.

[0084] Transfer to unknown account D, the amount is 2000 yuan.

[0085] The computer system traverses all transaction records in this segment and extracts the transfer amount of each transaction as the behavior intensity information. Therefore, for the above three transactions, the behavior intensity information is 1000 yuan, 500 yuan and 2000 yuan respectively. In practical applications, for the convenience of subsequent processing, the computer system can convert these values ​​into a unified format, such as a floating point vector, in which each element corresponds to the behavior intensity of a transaction. For example, the behavior intensity vector of the above three transactions can be expressed as [1000.0, 500.0, 2000.0].

[0086] Operation S42 is intended to integrate the multi-dimensional information (behavior representation vector, timing information and behavior intensity information) of the behavior data segment to generate a comprehensive topological unit description so as to accurately reflect the transaction behavior characteristics represented by the segment in the behavior relationship topology. The computer system first collects the behavior representation vector, timing information and behavior intensity information of the behavior data segment. Subsequently, it may use a variety of methods to fuse this information to generate topological unit information of the topological unit. A common method is to use a machine learning model or a specific fusion algorithm to integrate these three information sources into a unified representation.

[0087] For example, let's continue with the three transfer transactions of user A. Assume that the following information has been obtained:

[0088] Behavior representation vector: Each transaction can be represented as a behavior representation vector containing multiple features. For example, the feature vector of the first transaction may include an embedded representation of information such as transaction time, counterparty type (merchant), and transaction method. To simplify the explanation, assume that these embedding vectors have been obtained in some way (such as word embedding or autoencoder) and have the same dimension. Assume that the behavior representation vectors of each transaction are v1, v2, and v3. The timestamp of the transaction provides the order in which the transaction occurred, which is also indispensable information when constructing the behavior relationship topology. In this example, the three transactions are arranged in chronological order, and the timing information can be simply represented by the order in which the transactions occurred, or further processed into an embedding vector of the time interval. As above, the behavior intensity information has been given in the form of a numerical vector, that is, [1000.0, 500.0, 2000.0].

[0089] To integrate this information, a computer system might use one of the following strategies:

[0090] Strategy 1: Feature concatenation. The most direct approach is to concatenate the behavior representation vector, the embedding vector of the temporal information (if there is temporal embedding), and the behavior strength information into a longer vector. For example, if the dimension of the behavior representation vector is d, the dimension of the temporal embedding vector is t (if there is no temporal embedding, then t=0), and the behavior strength information can be converted into a 1-dimensional vector, then the final topological unit information vector can be [v1; time_embed1; 1000.0; v2; time_embed2; 500.0; v3; time_embed3; 2000.0] (; indicates vector concatenation). However, this approach can lead to information redundancy and computational inefficiency in terms of vector dimension.

[0091] Strategy 2: Weighted summation. Another approach is to perform weighted summation of different types of information. The computer system can assign different weights to the behavior representation vector, timing information, and behavior intensity information, and then add them together according to the weights. This approach requires pre-defining weights or learning these weights through a machine learning model. For example, if it is assumed that the weights of the behavior representation vector, the timing embedding vector (assuming it exists), and the behavior intensity information are α, β, and γ, respectively, then the topological unit information vector can be calculated as: , where v_avg is the average value (or some form of aggregation) of all behavior representation vectors, time_embed_avg is the average value of the time series embedding vector (if there is time series embedding), and intensity_avg is the average value of the behavior intensity information (but usually the behavior intensity information is not directly averaged, here it is just to illustrate the concept of weighted summation). In practical applications, it is more likely to calculate the weighted sum for each transaction separately, and then perform some form of aggregation.

[0092] Strategy 3: Graph Neural Network (GNN). For more complex situations, computer systems can use graph neural networks (GNN) to process topological unit information in the behavior relationship topology. In this case, each behavioral data segment is regarded as a topological unit in the graph, and the topological unit features are composed of the behavior representation vector, the embedded representation of the timing information (if applicable), and the behavior intensity information. The GNN model can automatically learn the complex relationships between topological units and generate topological unit embeddings containing these relationship information. In this way, the topological unit information not only contains the characteristics of the topological unit itself, but also implies the position of the topological unit in the graph and the interaction with other topological units.

[0093] In the specific implementation of GNN, the computer system first constructs a graph in which the topological units correspond to the behavioral data segments, and the edges can be defined based on some association between transaction behaviors (such as time sequence, same transaction objects, etc.). Then, the graph is iterated using the GNN model. In each iteration, the model updates the embedding representation of the current topological unit based on the information of the neighboring topological units. Finally, each topological unit will get an embedding vector containing its topological unit information.

[0094] Assume that a simple graph convolutional network (GCN) is used as the GNN model. In GCN, the embedding update of the topological unit usually follows the following formula:

[0095] ;

[0096] in, is the embedding representation of topological unit v at layer l, N(v) is the set of neighboring topological units of topological unit v, is the weight matrix of the lth layer, and σ is the activation function (such as ReLU). In this context, the initial embedding of each topological unit can be a vector concatenated by the behavior representation vector, the temporal embedding (if applicable), and the behavior intensity information. As the GCN layers are stacked, the embedding of the topological unit gradually incorporates the information of its neighboring topological units, eventually forming a final embedding representation containing rich topological unit information.

[0097] In summary, operation S4 effectively integrates the multi-dimensional information of behavioral data segments into topological unit information of topological units through sub-operations S41 and S42, providing a solid foundation for information security risk assessment of online transactions. Whether through simple feature concatenation, weighted summation, or complex graph neural network models, computer systems can choose the most appropriate method to achieve this goal according to specific application scenarios and needs.

[0098] In one implementation, the above operation S5, i.e., performing risk assessment on the user transaction behavior monitoring data set according to the behavior relationship topology of the user transaction behavior monitoring data set, can be implemented by the following sub-operations:

[0099] Operation S51: determining a risk behavior comparison library, the risk behavior comparison library including a risk assessment value of each first risk transaction behavior data set in G first risk transaction behavior data sets, and a topological characterization vector or a behavior relationship topology of each first risk transaction behavior data set, the topological characterization vector of the first risk transaction behavior data set is determined according to the behavior relationship topology of the first risk transaction behavior data set, and G is a natural number greater than 0;

[0100] Operation S52: determining a matching coefficient between the user transaction behavior monitoring dataset and each of the G first risk transaction behavior datasets according to the behavior relationship topology of the user transaction behavior monitoring dataset and the topological representation vector or behavior relationship topology of each first risk transaction behavior dataset;

[0101] Operation S53: selecting E first risky transaction behavior data sets from the G first risky transaction behavior data sets according to the matching coefficient, where E is a non-zero natural number not greater than G;

[0102] Operation S54: determining a risk assessment value of the user transaction behavior monitoring dataset according to the risk assessment values ​​of the E first risky transaction behavior datasets.

[0103] In operation S5, the computer system uses the behavior relationship topology of the user transaction behavior monitoring data set to perform risk assessment. This process involves building a risk behavior comparison library, calculating matching coefficients, selecting risk data sets with high similarity, and finally determining the risk assessment value of the user transaction behavior.

[0104] The purpose of operation S51 is to build a risk behavior comparison library containing known risk transaction behavior data sets, which have clear risk assessment values ​​and corresponding topological representation vectors or behavior relationship topologies. This comparison library will serve as a benchmark for subsequent risk assessments. Specifically, it can be implemented using the following process:

[0105] Data Collection: Collect a large amount of historical transaction behavior data, which should cover various types of risky transaction cases, such as fraud, money laundering, misoperation, etc. These datasets are labeled as "the first risky transaction behavior dataset".

[0106] Risk assessment value determination: For each first risk transaction behavior data set, the computer system needs to determine its risk assessment value. This can be achieved in a variety of ways, such as expert scoring, historical loss statistics, rule-based assessment models, etc. The risk assessment value is usually a quantitative indicator used to indicate the risk level of the transaction behavior.

[0107] Behavior relationship topology construction: For each first risk transaction behavior data set, the computer system constructs its behavior relationship topology according to the process of operations S1 to S4. This includes data segmentation, characterization information extraction, topology unit information determination and overall topology construction.

[0108] Topological representation vector generation (optional process): To improve matching efficiency, the computer system can further convert the behavioral relationship topology into a topological representation vector. This is usually achieved through graph embedding technology, such as using graph neural networks (GNNs) to learn low-dimensional embedding representations of topological units in the graph. These embedded vectors can capture the relationship and structural features between topological units, and are therefore used to calculate matching coefficients in subsequent steps.

[0109] Constructing a control library: Finally, the computer system integrates the risk assessment values, topological representation vectors (or behavioral relationship topology) and other relevant information of all the first risk transaction behavior data sets into the risk behavior control library. This control library will become the basis for subsequent risk assessments.

[0110] For example, assume that the risk behavior control library contains the following two first risk transaction behavior data sets (the detailed topological structure and characterization vectors are omitted here for simplicity):

[0111] Dataset A: A transaction behavior dataset containing multiple large transfers to unknown accounts, with a high risk assessment value (for example, a score of 90 / 100). The behavioral relationship topology of this dataset shows that these transfers occur frequently in a short period of time, and the transfer objects are variable.

[0112] Dataset B: A transaction behavior dataset containing abnormal purchase behaviors with a medium risk assessment value (e.g., a score of 50 / 100). The behavioral relationship topology of this dataset shows that the user purchased multiple high-value items in a short period of time, and these items are inconsistent with the user's regular consumption habits.

[0113] The purpose of operation S52 is to calculate the similarity (matching coefficient) between the user transaction behavior monitoring data set and each first risk transaction behavior data set in the risk behavior comparison library. The following possible processes can be used to achieve this:

[0114] Feature alignment: The computer system aligns the behavioral relationship topology or topological representation vector of the user transaction behavior monitoring data set with the corresponding data in the risk behavior control library to ensure that the two data sets are consistent in feature dimensions when calculating the matching coefficient.

[0115] Similarity calculation: The computer system uses an appropriate similarity measurement method to calculate the matching coefficient. Commonly used similarity measures include cosine similarity, Euclidean distance, Jaccard similarity, etc. For topological representation vectors, cosine similarity is a common choice because it can handle the direction and length information between vectors.

[0116] If the behavior relationship topology is used directly instead of the topological representation vector, the computer system may need to adopt more complex graph similarity measurement methods, such as graph edit distance, graph isomorphism test, or graph kernel-based methods. However, in practical applications, due to computational complexity and efficiency issues, it is usually preferred to use topological representation vectors for calculations.

[0117] Result storage: For each first risk transaction behavior data set in the risk behavior comparison library, the computer system will calculate and store a matching coefficient. These matching coefficients will be used for subsequent risk assessment decisions.

[0118] For example, suppose the user transaction behavior monitoring dataset contains a series of abnormal transfer behaviors, and its topological representation vector has a higher cosine similarity (e.g., 0.85) with the topological representation vector of dataset A, but a lower similarity (e.g., 0.30) with dataset B. This indicates that the currently monitored transaction behavior pattern is closer to the risk pattern in dataset A.

[0119] The purpose of operation S53 is to select a number of first risky transaction behavior data sets with the highest similarity to the user transaction behavior monitoring data set from the risky behavior comparison library according to the matching coefficient. This can be achieved by using the following possible processes:

[0120] Sorting: The computer system first sorts all the first risk transaction behavior data sets in the risk behavior comparison library according to the matching coefficient. The data sets with higher matching coefficients are ranked higher.

[0121] Threshold selection (optional): In order to limit the number of selected datasets and avoid introducing too much noise, the computer system can set a threshold for the matching coefficient. Only datasets with matching coefficients exceeding the threshold will be selected. However, in practical applications, it is more common to directly select the top E datasets based on the sorting results.

[0122] Quantity limit: The computer system selects the first E risky transaction behavior data sets with the highest matching coefficients as the basis for subsequent risk assessment. The value of E can be adjusted according to actual needs and is usually a small positive integer.

[0123] For example, suppose E is set to 2, and after sorting by matching coefficient, dataset A and dataset C (assuming it exists) are ranked first and second respectively. Therefore, the computer system selects dataset A and dataset C as the basis for subsequent risk assessment.

[0124] The purpose of operation S54 is to comprehensively determine the risk assessment value of the user transaction behavior monitoring data set based on the risk assessment value of the selected first risk transaction behavior data set with high similarity. It can be implemented by the following possible processes: A common method is to perform a weighted average on the risk assessment value of the selected first risk transaction behavior data set. The weight can be determined based on the matching coefficient, and the data set with a higher matching coefficient has a greater contribution to the weighted average. Another simplified method is to directly use the value with the highest risk assessment value in the selected first risk transaction behavior data set as the risk assessment value of the user transaction behavior monitoring data set. This method assumes that the highest risk assessment value represents the risk level of the worst case. In some cases, the computer system can also determine the risk assessment value in combination with business rules. For example, if the monitored transaction behavior involves sensitive areas or high-risk accounts, additional penalty items can be added on the basis of the comprehensive risk assessment value.

[0125] For example, assume that the risk assessment values ​​of the two selected first risk transaction behavior datasets A and C are 90 / 100 and 70 / 100 respectively, and their matching coefficients are also relatively high (but the matching coefficient of dataset A is higher). If the weighted average method is used to calculate the comprehensive risk assessment value, and it is assumed that the weight is proportional to the matching coefficient, the final calculated comprehensive risk assessment value will be close to but slightly lower than 90 / 100, because dataset A contributes more to the weighted average. However, if the business rules require an additional risk score (for example, +10 points) to be added to all transactions involving sensitive areas, the final risk assessment value can be higher.

[0126] In summary, operation S5 achieves risk assessment of the user transaction behavior monitoring data set through a series of steps such as building a risk behavior control library, calculating matching coefficients, selecting risk data sets with high similarity, and comprehensively determining risk assessment values. This process fully utilizes the advantages of behavioral relationship topology and machine learning technology (such as GNN for generating topological representation vectors) to improve the accuracy and efficiency of risk assessment. In practical applications, computer systems can adjust the parameters and methods of each link according to specific needs to adapt to different business scenarios and risk management models.

[0127] In one implementation, the above operation S51, i.e. determining the risk behavior comparison library, can be implemented by the following sub-operations:

[0128] Operation S511: Acquire G first risky transaction behavior data sets;

[0129] Operation S512: determining a behavior relationship topology and a risk assessment value of each first risk transaction behavior data set in the G first risk transaction behavior data sets;

[0130] Operation S513: determining a risk behavior comparison library according to the behavior relationship topology and risk assessment values ​​of the G first risk transaction behavior data sets.

[0131] In operation S51, the computer system is responsible for building a risk behavior comparison library, which is a key step in the online transaction information security risk assessment management process. The risk behavior comparison library provides a benchmark and reference for subsequent risk assessments, allowing the computer system to identify potential risks in new transaction behaviors based on known risk patterns.

[0132] The purpose of operation S511 is to collect and organize a certain number of known risky transaction behavior data sets as the basis for building a risk behavior control library. The following possible processes can be used to achieve this:

[0133] The computer system obtains the first risk transaction behavior data set through multiple channels. These data sets may come from internal risk management departments, external security research institutions, shared data from cooperative banks or payment institutions, etc. The data set should cover different types of risk transaction behaviors, such as fraud, money laundering, malicious cash withdrawal, etc.

[0134] After obtaining the raw data, the computer system needs to clean and preprocess the data to remove duplicate, erroneous or irrelevant records. This step is critical to ensuring data quality, as dirty data can affect the accuracy of subsequent risk assessments. For unlabeled or incompletely labeled data sets, the computer system needs to perform manual or automatic labeling. The labeled content usually includes the risk assessment value of the transaction behavior (such as high, medium, and low risk levels) and other related attributes (such as transaction type, transaction amount, transaction time, etc.). This labeled information will serve as the basis for subsequent construction of the behavior relationship topology and determination of the risk assessment value. Finally, the computer system integrates all the cleaned and labeled first risk transaction behavior data sets together to form a set of G data sets. Each data set represents a known risk transaction behavior pattern.

[0135] For example, suppose that the computer system obtains a total of 100 first-risk transaction behavior data sets (i.e., G=100) from the internal risk management department and external security research institutions. These data sets cover a variety of risk types, such as credit card fraud (30 data sets), phishing (20 data sets), money laundering (40 data sets), and malicious cash withdrawal (10 data sets). In the data cleaning stage, the computer system deleted duplicate transaction records, corrected incorrect transaction amounts, and eliminated information that was not relevant to risk assessment (such as user personal information). In the data annotation stage, the expert team conducted a detailed risk assessment of each data set and annotated the corresponding risk assessment value (such as high risk is 90 / 100, medium risk is 50 / 100, and low risk is 10 / 100). Finally, these 100 data sets were integrated into a unified set for the subsequent construction of a risk behavior control library.

[0136] The purpose of operation S512 is to construct a behavior relationship topology for each first risk transaction behavior data set and determine its accurate risk assessment value. These two steps are the core content of building a risk behavior control library. It can be implemented by the following possible process: First, the computer system performs time series data segmentation on each first risk transaction behavior data set according to the method in operation S2. This step divides the data set into multiple behavior data segments, each segment represents an independent transaction behavior event. Next, the computer system extracts characterization information for each behavior data segment and generates a corresponding behavior characterization vector. These vectors contain key feature information of the transaction behavior in the segment. Then, the computer system determines the topological unit information (such as the position, weight, connection relationship, etc. of the topological unit) of each segment based on the behavior characterization vector and the time series information. This step is the key to building the behavior relationship topology. Finally, the computer system integrates all the topological unit information to form the behavior relationship topology of each first risk transaction behavior data set. This topological diagram intuitively shows the inherent connection and dynamic changes between transaction behaviors. For some data sets, the computer system may rely on the experience and knowledge of the expert team to determine the risk assessment value. Experts will conduct a comprehensive assessment based on factors such as the transaction behavior characteristics, historical loss records, and industry standards of the data set. For large data sets or situations that require automated processing, computer systems can use machine learning models (such as random forests, gradient boosting trees, neural networks, etc.) to predict risk assessment values. These models can learn risk characteristics from historical data and quickly and accurately assess the risk of new transaction behavior data sets. In some cases, the computer system may combine the results of expert evaluation and model prediction to comprehensively determine the risk assessment value. For example, a weight coefficient can be set to adjust the contribution ratio of expert evaluation and model prediction in the final risk assessment value.

[0137] For example, taking one of the first risk transaction behavior data sets (such as a money laundering activity data set) as an example, the computer system first divides it into multiple behavior data segments, each segment representing a money laundering transaction behavior. Then, the characterization information of each segment is extracted to generate a behavior characterization vector containing key features such as transaction amount, transaction object, and transaction time. Next, the topological unit information of each segment is determined based on these characterization vectors and timing information, and the behavior relationship topology of the entire money laundering activity data set is constructed. In terms of determining the risk assessment value, the computer system may first rely on the experience and knowledge of the expert team to make a preliminary assessment of the risk level of the money laundering activity (such as high risk). Then, the trained machine learning model is used to make further risk assessment predictions for the money laundering activity data set. Finally, the computer system may combine the results of expert evaluation and model prediction to comprehensively determine the risk assessment value of the data set (such as 90 / 100).

[0138] The purpose of operation S513 is to integrate the behavior relationship topology and risk assessment value of G first risk transaction behavior data sets into a unified risk behavior comparison library to provide a benchmark and reference for subsequent risk assessment. The following possible process can be used for implementation: the computer system first designs the data storage structure of the risk behavior comparison library. This structure needs to be able to efficiently store and retrieve the behavior relationship topology, risk assessment value and other relevant information (such as data set source, annotation time, etc.) of each first risk transaction behavior data set. Common data storage structures include relational databases, NoSQL databases or graph databases. For complex data structures such as behavior relationship topology, graph databases may be a more appropriate choice. Then, the computer system stores the behavior relationship topology and risk assessment value of each first risk transaction behavior data set in the risk behavior comparison library according to the designed storage structure. During the storage process, the computer system needs to ensure the integrity and consistency of the data to avoid data loss or duplication. In order to improve the efficiency of subsequent risk assessment, the computer system also needs to index and query the risk behavior comparison library. This includes creating appropriate indexes to speed up query operations, optimizing query statements to reduce computational burdens, etc. Through these optimization measures, the computer system can respond to risk assessment requests more quickly and provide more accurate risk assessment results. Finally, the computer system needs to regularly maintain and update the risk behavior control library. This includes checking the integrity of the data, correcting erroneous data records, adding new risk transaction behavior data sets, etc. As new risk patterns and transaction behaviors emerge, the risk behavior control library needs to be continuously updated to maintain its effectiveness and accuracy.

[0139] For example, after completing the construction of the behavioral relationship topology and determining the risk assessment value of all G first risk transaction behavior data sets, the computer system integrates these data sets into a unified risk behavior comparison library. The comparison library uses a graph database as a storage structure to efficiently handle complex data types such as behavioral relationship topology. Each first risk transaction behavior data set has a unique identifier (such as a data set ID) in the comparison library for fast retrieval and query. During the warehousing process, the computer system ensures the integrity and consistency of the data and avoids the problem of data loss or duplication. At the same time, the computer system also performs indexing and query optimization processing on the entire comparison library to improve the efficiency of subsequent risk assessment. The resulting risk behavior comparison library has become one of the important tools in the online transaction information security risk assessment management process, providing strong support for timely discovery and response to potential risks.

[0140] In one implementation, the above operation S511, i.e. obtaining G first risky transaction behavior data sets, can be implemented by the following sub-operations:

[0141] Operation S5111: Acquire A labeled transaction behavior data sets and B transaction behavior data sets to be selected, where A and B are both natural numbers greater than 0;

[0142] Operation S5112: according to the A labeled transaction behavior data sets, determine a plurality of transaction behavior data sets to be selected from the B transaction behavior data sets to be selected as the first risk transaction behavior data set.

[0143] In operation S511, the core task of the computer system is to screen out a first risk transaction behavior data set with potential risk characteristics from a wide range of data sources. This process involves analyzing, evaluating and screening a large amount of transaction behavior data to build a risk behavior control library required for subsequent risk assessment.

[0144] The purpose of operation S5111 is to collect and prepare data sets for screening and evaluation, including labeled transaction behavior data sets (labeled data sets) and candidate transaction behavior data sets that have not been evaluated in detail (candidate data sets). This can be achieved by the following possible process: the computer system first obtains A labeled transaction behavior data sets from multiple channels. These data sets may come from internal risk management departments, external security research institutions, cooperative financial institutions, etc. Each labeled data set contains multiple transaction behavior records, and each record is accompanied by detailed risk assessment labeling information, such as fraud, money laundering, misoperation and other risk types and their corresponding risk assessment values.

[0145] For example, suppose A=10, and the computer system collects 10 labeled transaction behavior data sets from three different financial institutions. Each data set contains thousands of transaction records, such as credit card transactions, bank transfers, online payments, etc. Each record not only contains basic transaction information (such as transaction time, transaction amount, transaction object, etc.), but also comes with a risk assessment value (such as high risk = 90 / 100, medium risk = 50 / 100, low risk = 10 / 100) annotated by an expert team based on transaction characteristics and historical experience.

[0146] At the same time, the computer system also obtains B candidate transaction behavior data sets from a wider range of channels (such as public data sources, partner shared data, etc.). These data sets are not labeled with detailed risk assessments, but contain a large number of potential transaction behavior records, which may contain known and unknown risk patterns.

[0147] For example, assuming B=100, the computer system collects 100 candidate transaction behavior data sets from multiple different sources. These data sets cover a wider range of transaction types and scenarios, such as cross-border e-commerce transactions, mobile payments, etc. Each data set contains a large number of transaction records, but lacks detailed risk assessment annotations.

[0148] The purpose of operation S5112 is to use the labeled transaction behavior data set as a benchmark to screen out the first risk transaction behavior data set with potential risk characteristics from a large number of candidate data sets to expand the risk behavior comparison library. The following possible process can be used to implement it: First, the computer system extracts and represents features of A labeled transaction behavior data sets and B candidate transaction behavior data sets. This step involves converting the original data in the transaction record (such as transaction time, transaction amount, transaction object, etc.) into a format that can be used for machine learning and data analysis (such as feature vectors, graph structures, etc.). For each transaction record, the computer system can extract a series of numerical features (such as transaction amount, transaction frequency) and categorical features (such as transaction type, transaction object type), and convert them into feature vectors. For example, one-hot encoding is used to process categorical features, and normalization or standardization is used to process numerical features.

[0149] For scenarios that require capturing complex relationships between transaction behaviors, computer systems can use graph structures to represent transaction behavior datasets. Each topological unit represents a transaction behavior record, and the edges represent the relationship between records (such as time sequence, same transaction objects, etc.). The feature vector of the topological unit can contain attribute information such as transaction amount and transaction type.

[0150] Next, the computer system needs to define a similarity measurement method to compare the similarity between the labeled transaction behavior dataset and the candidate transaction behavior dataset. This similarity measurement can be based on the distance of feature vectors (such as Euclidean distance, cosine similarity) or the similarity of graph structures (such as graph edit distance, graph isomorphism test).

[0151] Similarity measurement based on feature vectors: If feature vectors are used to represent transaction records, the computer system can use methods such as cosine similarity or Manhattan distance to calculate the similarity between feature vectors. For example, for a record r_labeled in the labeled dataset D_labeled and a record r_candidate in the candidate dataset D_candidate, their feature vectors are v_labeled and v_candidate respectively, then the cosine similarity between them can be calculated as:

[0152] ;

[0153] If a graph structure is used to represent the transaction behavior dataset, the computer system may need to use more complex graph similarity measurement methods, such as graph kernel functions, graph edit distances, or embedding representations based on graph neural networks. These methods can capture complex patterns and relationships in graph structures. Finally, the computer system selects records or datasets with high similarity to the A labeled transaction behavior dataset from the B candidate transaction behavior datasets based on the similarity measurement results as the first risky transaction behavior dataset. The screening process may involve setting a similarity threshold or selecting several records / datasets with high similarity rankings. The computer system can set a similarity threshold (such as 0.7) and screen out all candidate records / datasets whose similarity to at least one labeled dataset exceeds the threshold.

[0154] Another method is to directly select several records / datasets with the highest similarity ranking as the first risky transaction behavior dataset. For example, select the top N records or the top M datasets with the highest similarity in each candidate dataset with the labeled dataset. For example, assume that the computer system has completed the feature extraction and representation steps and defined the cosine similarity based on the feature vector as the similarity measurement method. Next, it starts to screen the first risky transaction behavior dataset from B=100 candidate transaction behavior datasets. The computer system sets a similarity threshold (such as 0.6) and traverses the similarity calculation between each candidate dataset and A=10 labeled datasets. For each candidate dataset D_i (i=1,...,100), the computer system calculates the cosine similarity between it and each labeled dataset D_j (j=1,...,10) and records the maximum similarity value max_sim_i. If max_sim_i is greater than or equal to the threshold 0.6, D_i is preliminarily screened as a candidate for the first risky transaction behavior dataset. Finally, the computer system further selects a certain number of data sets from the candidate data sets as the final first risk transaction behavior data set based on business requirements and screening efficiency.

[0155] Through the above process, the computer system successfully screened out the first risky transaction behavior data set with potential risk characteristics from a large number of candidate transaction behavior data sets, providing important data support for building a risk behavior control library. These data sets will serve as a benchmark and reference for subsequent risk assessments, helping the computer system to more accurately identify and respond to information security risks in online transactions.

[0156] In one implementation, the above operation S5112, i.e., determining a plurality of candidate transaction behavior data sets from B candidate transaction behavior data sets as the first risk transaction behavior data set according to A labeled transaction behavior data sets, can be implemented by the following sub-operations:

[0157] Operation S51121: for the yth transaction behavior data set to be selected among the B transaction behavior data sets to be selected, determining a matching coefficient between the yth transaction behavior data set to be selected and each labeled transaction behavior data set among the A labeled transaction behavior data sets, where y is a non-zero natural number not greater than B;

[0158] Operation S51122: when the matching coefficient between the yth transaction behavior dataset to be selected and some of the labeled transaction behavior datasets in the A labeled transaction behavior datasets is greater than a second critical matching coefficient, the yth transaction behavior dataset to be selected is determined as a first risky transaction behavior dataset.

[0159] In operation S5112, the core task of the computer system is to evaluate and screen out potential first risk transaction behavior data sets based on the labeled transaction behavior data sets (A data sets), which will be selected from the transaction behavior data sets to be selected (B data sets). This process involves in-depth analysis and comparison of a large amount of data to identify data sets with high risk characteristics.

[0160] The purpose of operation S51121 is to quantitatively evaluate the similarity or matching degree between the transaction behavior dataset to be selected and the labeled transaction behavior dataset, so as to provide a quantitative basis for subsequent screening. The following possible process can be used for implementation: First, the computer system needs to extract and represent the features of the yth transaction behavior dataset to be selected and the A labeled transaction behavior datasets. This usually involves extracting key information (such as transaction amount, transaction time, transaction type, transaction object, etc.) from the transaction records and converting them into numerical or categorical features. Then, these features are further converted into feature vectors or higher-order data structures (such as graph structures) for subsequent similarity calculations. Next, the computer system needs to define a similarity or matching calculation method for quantitatively evaluating the similarity between the yth candidate dataset and each labeled dataset. This calculation method can be based on the distance metric of the feature vector (such as Euclidean distance, Manhattan distance, cosine similarity, etc.), or it can be based on the output of a more complex machine learning model or graph neural network (GNN). If the feature vector is used to represent the transaction record, the computer system can calculate the cosine similarity or Manhattan distance between the two vectors as the matching coefficient between them.

[0161] If the structure of the transaction behavior dataset is more complex, or if it is necessary to capture nonlinear relationships in the data, the computer system can use machine learning models (such as neural networks, support vector machines SVM, etc.) to train a matching prediction model. This model can learn the relationship between the characteristics of the labeled dataset and the risk level, and give a matching score to the new candidate dataset. For datasets containing complex transaction behavior networks, graph neural networks (GNNs) may be a more appropriate choice. GNNs can process graph-structured data, learn the feature representations of topological units and edges, and predict the labels or attributes of topological units or the entire graph. In this case, the computer system can represent the transaction behavior dataset as a graph structure and use GNN to calculate the graph-level matching between the candidate dataset and the labeled dataset. For the yth candidate dataset, the computer system will calculate A matching coefficients with A labeled datasets to form a matching coefficient matrix or vector. This matrix / vector will be used for subsequent screening decisions.

[0162] For example, suppose B=100 (there are 100 candidate datasets) and A=10 (there are 10 labeled datasets). For the first candidate dataset (y=1), the computer system first extracts its feature vector and calculates the cosine similarity with the feature vector of each labeled dataset to obtain 10 matching coefficients. These coefficients form a matching coefficient vector, such as [0.75, 0.58, 0.82,..., 0.45]. This vector quantifies the similarity between the first candidate dataset and each labeled dataset.

[0163] The purpose of operation S51122 is to screen out the first risky transaction behavior data set with high-risk characteristics based on the quantitative evaluation of the matching coefficient. It can be implemented by the following possible process: the computer system needs to pre-set a second critical matching coefficient (threshold_match) for screening high-risk data sets in the candidate data sets. This critical value can be determined based on historical data, expert opinions or business needs. For each candidate data set y, the computer system compares the matching coefficient between it and the A labeled data sets with the second critical matching coefficient. If at least one matching coefficient is greater than the critical value, or meets other preset conditions (such as the top N data sets in terms of matching coefficient), the candidate data set is deemed to have potential high-risk characteristics. When the yth candidate data set meets the screening conditions, the computer system marks it as the first risky transaction behavior data set, and may add it to the risk behavior control library for subsequent risk assessment and monitoring.

[0164] For example, continuing the above example, assume that the second critical matching coefficient (threshold_match) is set to 0.6. For the first candidate data set, its matching coefficient vector is [0.75, 0.58, 0.82, ..., 0.45]. In this vector, there are multiple matching coefficients exceeding the critical value of 0.6 (such as 0.75 and 0.82). Therefore, according to operation S51122, the computer system regards the first candidate data set as having potential high-risk characteristics and determines it as the first risky transaction behavior data set. This process will be repeated for each of the B candidate data sets until all potential high-risk data sets are screened out.

[0165] Through the implementation of the above two sub-operations, the computer system can effectively screen out the first risky transaction behavior data set with potential high-risk characteristics from a large number of candidate transaction behavior data sets. These data sets will serve as an important part of the risk behavior control library and provide strong data support for subsequent risk assessment and monitoring. At the same time, this process also demonstrates the wide application and important role of machine learning, feature engineering and data mining technologies in online transaction information security risk assessment management.

[0166] In one implementation, the above operation S51121, i.e., determining the matching coefficient between the yth transaction behavior data set to be selected and each of the labeled transaction behavior data sets in the A labeled transaction behavior data sets, can be implemented by the following sub-operations:

[0167] Operation S511211: determining a topological characterization vector of the yth transaction behavior data set to be selected and a topological characterization vector of each labeled transaction behavior data set in the A labeled transaction behavior data sets;

[0168] Operation S511212: Determine a matching coefficient between the yth transaction behavior dataset to be selected and each labeled transaction behavior dataset in the A labeled transaction behavior datasets based on the topological characterization vector of the yth transaction behavior dataset to be selected and the topological characterization vector of each labeled transaction behavior dataset in the A labeled transaction behavior datasets.

[0169] In operation S51121, the core task of the computer system is to calculate the matching coefficient between the yth transaction behavior data set to be selected and the A labeled transaction behavior data sets. To achieve this goal, the system first needs to generate topological representation vectors for these data sets, which can capture the complex structural information and behavior patterns in the transaction behavior data sets. Subsequently, the system uses these topological representation vectors to calculate the matching coefficient to quantify the similarity or correlation between the candidate data set and the labeled data set.

[0170] The purpose of operation S511211 is to convert the transaction behavior data set (including the candidate data set and the annotated data set) into a topological representation vector for subsequent calculation of similarity or matching coefficient. The following possible process can be used for implementation: For each data set (whether it is a candidate data set or annotated data set), the computer system first needs to construct its behavior relationship topology. This step usually involves time segmentation of transaction records, extraction of representation information, and determination of topological unit information (such as the definition of topological units and edges, setting of topological unit attributes, etc.). Through this series of operations, the system can convert the original transaction behavior data set into a graph structure or a similar data structure, in which the topological unit represents the transaction behavior event and the edge represents the relationship between the events (such as time sequence, causal relationship, etc.). After constructing the behavior relationship topology, the computer system needs to use machine learning technology (especially graph embedding technology) to generate a topological representation vector for each data set. The topological representation vector is a low-dimensional numerical vector that can capture the key structure and feature information in the topological graph while maintaining certain key properties of the original data (such as the similarity between topological units, community structure, etc.).

[0171] A common approach is to use graph neural networks (GNNs) to learn topological unit embeddings of topological graphs. GNNs update the embedding representation of each topological unit by iteratively aggregating the information of neighboring topological units, and finally obtain a topological unit embedding vector that contains global structural information. For the entire dataset (or representation of the graph), the system can use pooling operations (such as sum pooling, average pooling, or maximum pooling) to aggregate the embedding vectors of all topological units into a global topological representation vector.

[0172] In addition to GNN, there are other graph embedding methods to choose from, such as DeepWalk, Node2vec, LINE, etc. These methods generate embedding vectors of topological units through techniques such as random walks, matrix decomposition, or edge sampling, and further aggregate them into global topological representation vectors.

[0173] For example, suppose the yth transaction behavior dataset contains all the transaction records of the user within a week, which covers various types of transaction behaviors such as shopping, transfer, and recharge. The computer system first segments these transaction records in time sequence and extracts the key features of each segment (such as transaction amount, transaction type, transaction time, etc.). Subsequently, the system constructs a behavioral relationship topology graph based on the relationship between these features and segments. In the topology graph, each topological unit represents a transaction behavior segment, and the edges between topological units represent the time sequence or causal relationship between segments.

[0174] Next, the computer system uses graph neural networks (such as GCN, GraphSAGE, etc.) to learn the embedded representation of topological units in the topological graph. Through multiple iterations and aggregation operations, the system finally obtains the embedding vector of each topological unit. In order to obtain the topological representation vector of the entire data set, the system uses the average pooling method to aggregate the embedding vectors of all topological units. Similarly, for A labeled transaction behavior data sets, the system also performs the same operation to generate their topological representation vectors.

[0175] The purpose of operation S511212 is to quantitatively evaluate the similarity or matching degree between the yth candidate transaction behavior data set and the A labeled transaction behavior data sets. It can be implemented by the following possible process: After obtaining the topological representation vectors of all data sets, the computer system needs to define a method for calculating the similarity or matching coefficient. This method is usually based on the distance measurement or similarity measurement between vectors. A common choice is to use cosine similarity to calculate the similarity between two vectors. Cosine similarity measures the degree of proximity of two vectors in direction without considering their size. Another option is to use Euclidean distance to quantify the difference between two vectors. However, in the context of similarity or matching coefficient, Euclidean distance usually needs to be converted into a similarity measure (such as by exponential function). But it is more common to directly use its reciprocal or some normalized form to represent the similarity, although this method may not be as intuitive as cosine similarity. In addition to cosine similarity and Euclidean distance, there are many other similarity measurement methods to choose from, such as Manhattan distance, Jaccard similarity, Pearson correlation coefficient, etc. Which measurement method to choose depends on the specific application scenario and data characteristics.

[0176] For example, continuing with the previous example, the computer system has generated a topological characterization vector v_y for the yth candidate transaction behavior dataset and a set of topological characterization vectors {v_1, v_2, ..., v_A} for A labeled transaction behavior datasets. In order to calculate the matching coefficient between the yth candidate dataset and each labeled dataset, the system uses cosine similarity as a similarity measurement method. For the yth candidate dataset and the jth labeled dataset (j=1,...,A), the system calculates the cosine similarity between them as the matching coefficient. This process will generate a matching coefficient vector or matrix, which contains the matching coefficients between the yth candidate dataset and all labeled datasets.

[0177] By implementing the above two sub-operations, the computer system can effectively calculate the matching coefficient between the yth candidate transaction behavior data set and the A labeled transaction behavior data sets. These matching coefficients will serve as an important basis for subsequent screening of high-risk data sets, helping the system to quickly and accurately identify potential first-risk transaction behavior data sets from a large number of candidate data sets.

[0178] In one implementation, the above operation S511211, i.e., determining the topological characterization vector of the yth transaction behavior data set to be selected and the topological characterization vector of each labeled transaction behavior data set in the A labeled transaction behavior data sets, can be implemented by the following sub-operations:

[0179] Operation S5112111: determining the behavior relationship topology of the yth transaction behavior data set to be selected, and the behavior relationship topology of each labeled transaction behavior data set in the A labeled transaction behavior data sets;

[0180] Operation S5112112: determining a topological representation vector of the yth transaction behavior data set to be selected according to the behavior relationship topology of the yth transaction behavior data set to be selected;

[0181] Operation S5112113: for each labeled transaction behavior data set in the A labeled transaction behavior data sets, determine a topological representation vector of the labeled transaction behavior data set according to the behavior relationship topology of the labeled transaction behavior data set.

[0182] In operation S511211, the core task of the computer system is to construct the behavior relationship topology for the yth selected transaction behavior data set and the A labeled transaction behavior data sets, and generate corresponding topology representation vectors based on these topologies. These topology representation vectors are an important basis for the subsequent calculation of matching coefficients and risk assessment.

[0183] The purpose of operation S5112111 is to construct a behavioral relationship topology of a transaction behavior data set, and to represent the intrinsic connection and dynamic changes between transaction behaviors in the form of a graph structure. This can be achieved by the following possible processes: First, the computer system needs to preprocess the yth selected transaction behavior data set and the A labeled transaction behavior data sets, including steps such as data cleaning, deduplication, and format unification. These steps are intended to improve data quality and lay the foundation for the subsequent construction of behavioral relationship topology. Next, the computer system segments the transaction records in each data set in chronological order according to the chronological order of the transaction behaviors. Each segment represents an independent transaction behavior event, including all transaction records and related attributes (such as transaction amount, transaction type, transaction time, etc.) in the event. After the segmentation is completed, the computer system needs to define the relationship between transaction behaviors. These relationships may be based on time sequence (such as buying first and selling later), transaction objects (such as transactions with the same account), transaction types (such as frequent large transfers), etc. These relationships will be used to construct edges in the behavioral relationship topology. Based on the above segmentation and relationship definitions, the computer system constructs a behavioral relationship topology graph for each data set. In this graph, the topological unit represents the transaction behavior segment, and the edge represents the relationship between the segments. Each topological unit may also contain a series of attributes, such as transaction amount, transaction time, transaction object, etc. These attributes will play a role in the subsequent generation of topological representation vectors.

[0184] For example, suppose that the yth transaction behavior dataset contains all transaction records of user Zhang San within a week, including various types of transaction behaviors such as shopping, transfer, and withdrawal. The computer system first preprocesses these records to remove duplicate and invalid data. Then, these records are segmented in chronological order according to the transaction time sequence, and each segment represents an independent transaction behavior event. Next, the system defines the relationship between transaction behaviors, such as connecting adjacent segments in time with edges to indicate that these transaction behaviors occur in chronological order. Finally, the system constructs a behavior relationship topology graph based on these segments and relationship definitions, where each topological unit represents a segment and the edge represents the relationship between segments.

[0185] For A labeled transaction behavior data sets, the computer system performs the same operation to build a corresponding behavior relationship topology for each labeled data set. These labeled data sets may cover different types of risky transaction behaviors, such as fraud, money laundering, etc., and have been labeled and verified by experts.

[0186] The purpose of operation S5112112 is to convert the behavior relationship topology of the yth candidate transaction behavior data set into a low-dimensional numerical vector form for subsequent calculation and analysis. The following possible process can be used to achieve this: select a suitable graph embedding technology to generate a topological representation vector. Graph embedding technology can convert graph structure data into a low-dimensional numerical vector while retaining important structural and attribute information in the graph. Common graph embedding technologies include DeepWalk, Node2vec, LINE, GraphSAGE, GCN, etc. After selecting the graph embedding technology, the computer system needs to use the technology to train a model to generate a topological representation vector. This model usually needs to be trained on a large amount of graph structure data to learn the structural features of the graph and the relationship between topological units. However, in this scenario, since there is already a specific behavior relationship topology graph (i.e., the behavior relationship topology of the yth candidate transaction behavior data set), the graph embedding model can be directly applied to the graph to generate a topological representation vector without the need for an additional training process (unless unsupervised learning or self-supervised learning methods are used). Applying the trained graph embedding model (or directly applying the graph embedding algorithm on a specific graph), the computer system generates a low-dimensional numerical vector for each topological unit in the behavior relationship topological graph of the yth candidate transaction behavior data set. These vectors will serve as the embedding representation of the topological unit and can be used for subsequent calculations and analysis. In order to obtain the topological representation vector of the entire data set, the system can use pooling operations (such as sum pooling, average pooling, maximum pooling, etc.) to aggregate the embedding vectors of all topological units.

[0187] For example, suppose that the computer system selects GraphSAGE as the graph embedding technology to generate the topological representation vector of the yth candidate transaction behavior data set. GraphSAGE is a graph embedding method based on the aggregation of neighbor topological unit information, which can capture local and global features in the graph structure. The computer system first applies the GraphSAGE model to the behavioral relationship topological graph of the yth candidate transaction behavior data set. For each topological unit in the graph (i.e., each transaction behavior segment), the GraphSAGE model updates the embedding representation of the topological unit by aggregating the information of its neighbor topological units. After multiple iterations, each topological unit will obtain an embedding vector containing its local and global structural information. Finally, the system uses the average pooling method to aggregate the embedding vectors of all topological units to obtain a topological representation vector representing the entire data set.

[0188] The purpose of operation S5112113 is to generate a topological characterization vector for each of the A labeled transaction behavior data sets so as to compare and analyze it with the topological characterization vector of the candidate data set. The following possible process can be used for implementation: For each of the A labeled transaction behavior data sets, the computer system performs the same steps as operation S5112112 to generate its topological characterization vector. Apply the same graph embedding technology: In order to ensure consistency and comparability, the computer system needs to apply the same graph embedding technology as the candidate data set to all labeled data sets. This means that when generating the topological characterization vector of the labeled data set, the same graph embedding model (such as GraphSAGE) should be selected as when generating the topological characterization vector of the candidate data set. Independently process each labeled data set: For each of the A labeled data sets, the computer system needs to independently construct its behavioral relationship topological graph and apply the graph embedding model to generate its topological characterization vector. This process is exactly the same as generating the topological characterization vector of the candidate data set, except that the processed data sets are different. Result storage and indexing: After generating the topological characterization vector of each labeled data set, the computer system needs to store these vectors in an appropriate data structure and index them for subsequent retrieval and comparison. These topological representation vectors will be used as part of the risk behavior control library for comparison and analysis with the topological representation vectors of the candidate data set.

[0189] For example, suppose A=5, that is, there are 5 annotated transaction behavior data sets. For each of these 5 data sets, the computer system performs the same operation as the yth candidate transaction behavior data set to generate its topological representation vector. This means that for each annotated data set, the system needs to construct its behavioral relationship topological graph, select GraphSAGE as the graph embedding technology, apply the GraphSAGE model to generate the embedding representation of the topological unit, and use the average pooling method to aggregate the embedding vectors of all topological units into the topological representation vector of the entire data set. In the end, the system will obtain the topological representation vectors of the 5 annotated data sets and store them in the risk behavior control library for subsequent use.

[0190] Through the implementation of the above three sub-operations, the computer system successfully generates topological representation vectors for the yth candidate transaction behavior data set and the A labeled transaction behavior data sets. These vectors will serve as important basic data for subsequent calculation of matching coefficients and risk assessment. In practical applications, these vectors can be used in a variety of machine learning or data mining tasks, such as classification, clustering, anomaly detection, etc., to help computer systems better understand and respond to information security risks in online transactions.

[0191] In one implementation, in the above operation S512, determining the risk assessment value of each of the G first risk transaction behavior data sets may be implemented by using the following sub-operations:

[0192] Operation S5121: when the first risky transaction behavior dataset is the yth transaction behavior dataset to be selected, based on the matching coefficient between the yth transaction behavior dataset to be selected and each of the A labeled transaction behavior datasets, z labeled transaction behavior datasets whose matching coefficient with the yth transaction behavior dataset to be selected is greater than or equal to a third critical matching coefficient are screened out from the A labeled transaction behavior datasets;

[0193] Operation S5122: Determine the risk assessment value of the yth transaction behavior data set to be selected according to the risk assessment values ​​of the z labeled transaction behavior data sets.

[0194] In operation S512, the core task of the computer system is to determine an accurate risk assessment value for each first risky transaction behavior data set (which may refer to a data set that is screened out from the candidate data sets and is considered to be potentially high-risk, i.e., the yth candidate transaction behavior data set is confirmed as the first risky transaction behavior data set after a series of screening and evaluation). This assessment value will directly reflect the risk level of the transaction behavior pattern represented by the data set, and provide support for subsequent risk management and decision-making.

[0195] The purpose of operation S5121 is to screen out the most similar labeled data set to the selected data set by comparing the similarity (i.e., matching coefficient) between the yth selected transaction behavior data set and the labeled transaction behavior data set, so as to subsequently determine the risk assessment value of the selected data set based on the risk assessment values ​​of these similar data sets. The following possible process can be used to achieve this: Prior to this, the computer system has calculated the matching coefficients of the yth selected transaction behavior data set and the A labeled transaction behavior data sets through operation S51121. These matching coefficients quantify the similarity between the selected data set and each labeled data set.

[0196] The computer system needs to set a third critical matching coefficient (denoted as threshold_match_3) to screen the annotated data sets that are similar enough to the candidate data sets. The selection of this critical value depends on the specific application scenario, data characteristics and business requirements. It should be able to balance the similarity and the diversity of the data sets to ensure that the screened annotated data sets are both similar to the candidate data sets and representative. The computer system traverses A annotated transaction behavior data sets and compares their matching coefficients with the yth candidate transaction behavior data set. For annotated data sets whose matching coefficients are greater than or equal to the third critical matching coefficient, the system regards them as similar data sets and retains them. Ultimately, the system will screen out z such similar annotated data sets (the specific value of z depends on the distribution of the annotated data sets and the setting of the critical matching coefficient).

[0197] For example, suppose A=10 (i.e., there are 10 labeled transaction behavior data sets), and the third critical matching coefficient is set to 0.7. For the yth selected transaction behavior data set, the computer system has calculated its matching coefficient with each labeled data set, such as [0.65, 0.72, 0.58, 0.83, 0.69, 0.45, 0.78, 0.32, 0.62, 0.80]. By comparing these matching coefficients with the critical value of 0.7, the system selects the labeled data sets with matching coefficients greater than or equal to 0.7, namely, the 2nd, 4th, 6th, and 8th labeled data sets (Note: the matching coefficient of the 6th labeled data set here is actually less than 0.7, but it is included here for the completeness of the example and should be excluded in actual situations). However, since it is expected to screen out z similar datasets, and in practical applications z is usually less than A, it is assumed here that only the first z labeled datasets that meet the conditions are taken (in this hypothetical scenario, z is at most 4, because only 4 labeled datasets have matching coefficients greater than or equal to 0.7). Therefore, the similar labeled datasets finally screened out are the 2nd, 4th, 7th, and 8th (Note: the 7th here is an error in the example, and it should actually be the 10th, because only the 10th in the original example has a matching coefficient of 0.80 greater than or equal to 0.7).

[0198] The purpose of operation S5122 is to determine the risk assessment value of the yth transaction behavior data set to be selected based on the risk assessment value of the screened similar annotated data set by a certain aggregation or weighted average method. The following possible process can be used for implementation: For the z screened similar annotated data sets, the computer system knows their respective risk assessment values. These assessment values ​​can be discrete levels (such as high, medium, and low) or continuous scores (such as a value between 0 and 100). In order to obtain the risk assessment value of the data set to be selected, the system needs to aggregate these known risk assessment values. A common method is to use weighted average to calculate the risk assessment value of the data set to be selected. In this method, the risk assessment value of each similar annotated data set is weighted according to its similarity with the data set to be selected (i.e., the matching coefficient). The annotated data set with a higher matching coefficient contributes more to the weighted average. In addition to weighted average, other aggregation methods can also be used to determine the risk assessment value of the data set to be selected, such as taking the maximum value, minimum value, median, or mode. Which method is selected depends on business needs and data characteristics.

[0199] In one implementation, the above operation S52, i.e., determining the matching coefficient between the user transaction behavior monitoring dataset and each of the G first risk transaction behavior datasets according to the behavior relationship topology of the user transaction behavior monitoring dataset and the topological representation vector or behavior relationship topology of each first risk transaction behavior dataset, can be implemented by the following sub-operations:

[0200] Operation S521: when the risk behavior comparison library includes the behavior relationship topologies of G first risk transaction behavior data sets, determining a matching coefficient between the user transaction behavior monitoring data set and each of the G first risk transaction behavior data sets according to the behavior relationship topology of the user transaction behavior monitoring data set and the behavior relationship topologies of the G first risk transaction behavior data sets;

[0201] Operation S522: When the risk behavior comparison library includes topological characterization vectors of G first risk transaction behavior data sets, determine the matching coefficient between the user transaction behavior monitoring data set and each first risk transaction behavior data set in the G first risk transaction behavior data sets based on the topological characterization vector of the user transaction behavior monitoring data set and the topological characterization vectors of the G first risk transaction behavior data sets.

[0202] In operation S52, the core task of the computer system is to calculate the matching coefficient between the user transaction behavior monitoring data set and the first risk transaction behavior data set in the risk behavior comparison library according to the similarity between them. The purpose of operation S521 is to calculate the matching coefficient between the user transaction behavior monitoring data set and the first risk transaction behavior data set by comparing the similarity between the user transaction behavior monitoring data set and these behavior relationship topologies when the behavior relationship topology of the first risk transaction behavior data set is included in the risk behavior comparison library. The following possible process can be used to implement it: First, the computer system constructs its behavior relationship topology based on the user transaction behavior monitoring data set. This process usually involves steps such as data preprocessing, time series data segmentation, characterization information extraction, and construction of a behavior relationship topology map. The constructed behavior relationship topology map will serve as the basis for subsequent matching coefficient calculation. In the risk behavior comparison library, the behavior relationship topology of G first risk transaction behavior data sets has been included. These topology maps represent known risk transaction behavior patterns and are important references for subsequent matching coefficient calculations. In order to calculate the matching coefficient between the user transaction behavior monitoring data set and the first risk transaction behavior data set, the computer system needs to select a suitable graph similarity measurement method. The selection of the graph similarity measurement method depends on the specific application scenario and data characteristics. Common graph similarity measurement methods include graph edit distance, maximum common subgraph, graph kernel function, etc. However, since these methods may have high computational complexity, practical applications may need to consider the balance between computational efficiency and effect.

[0203] A more efficient method is to use similarity calculation based on graph embedding. Through graph embedding technology (such as GraphSAGE, GCN, etc.), the computer system can convert the behavior relationship topology graph into a low-dimensional numerical vector (i.e., topological representation vector), and then use the similarity between these vectors (such as cosine similarity, Euclidean distance, etc.) to approximate the similarity between the original graphs. This method greatly improves the computational efficiency. After selecting a suitable graph similarity measurement method, the computer system begins to calculate the matching coefficient between the user transaction behavior monitoring data set and each first risk transaction behavior data set. If a graph embedding-based method is used, it is first necessary to perform graph embedding processing on the user transaction behavior monitoring data set and each first risk transaction behavior data set to obtain their topological representation vectors. Then, the similarity between these vectors is calculated using the selected similarity measurement method, which is the matching coefficient between the user transaction behavior monitoring data set and the first risk transaction behavior data set.

[0204] For example, assume that the risk behavior control library contains three first risk transaction behavior data sets (G=3), and the behavior relationship topology of these data sets has been constructed. At the same time, the user transaction behavior monitoring data set has also constructed its behavior relationship topology. The computer system decides to use a similarity calculation method based on graph embedding.

[0205] First, the computer system uses the GraphSAGE model to perform graph embedding processing on the user transaction behavior monitoring dataset and the three first risk transaction behavior datasets to obtain their topological representation vectors. Assume that the topological representation vector of the user transaction behavior monitoring dataset is v_monitor, and the topological representation vectors of the three first risk transaction behavior datasets are v_risk1, v_risk2, and v_risk3.

[0206] Then, the computer system selects cosine similarity as a similarity measurement method and calculates a matching coefficient between the user transaction behavior monitoring data set and each first risk transaction behavior data set.

[0207] The purpose of operation S522 is to calculate the matching coefficient between the topological characterization vectors of the user transaction behavior monitoring data set and these vectors by comparing the similarity between them when the topological characterization vectors of the first risky transaction behavior data set are directly included in the risk behavior comparison library. The following possible process can be used to implement it: Since the topological characterization vectors of the first risky transaction behavior data set have been directly provided in the risk behavior comparison library, the computer system does not need to construct their behavioral relationship topological graph or perform graph embedding processing. On the contrary, the computer system can directly use these topological characterization vectors to calculate the matching coefficient. Then the topological characterization vector of the user transaction behavior monitoring data set is generated. The computer system uses the same method as the construction of the topological characterization vector of the first risky transaction behavior data set (such as the same graph embedding model) to perform graph embedding processing on the user transaction behavior monitoring data set to generate its topological characterization vector v_monitor. With the topological characterization vector of the user transaction behavior monitoring data set and the topological characterization vector of the first risky transaction behavior data set, the computer system can directly use the selected similarity measurement method (such as cosine similarity, Euclidean distance, etc.) to calculate the matching coefficient between them. By calculating the matching coefficient, the computer system can evaluate the similarity between the user transaction behavior monitoring data set and each first risk transaction behavior data set, thereby providing an important basis for subsequent risk assessment.

[0208] Operation S52 calculates the matching coefficient between the user transaction behavior monitoring data set and the first risk transaction behavior data set in the risk behavior comparison library by comparing the behavior relationship topology or topological representation vector between them. These matching coefficients not only reflect the similarity between the user transaction behavior and the known risk pattern, but also provide key data support for subsequent risk assessment decisions. In practical applications, the computer system can select appropriate graph similarity measurement methods and graph embedding models according to specific data characteristics and business requirements to implement this process.

[0209] In one implementation, the above operation S521, i.e., determining the matching coefficient between the user transaction behavior monitoring dataset and each of the G first risk transaction behavior datasets according to the behavior relationship topology of the user transaction behavior monitoring dataset and the behavior relationship topology of the G first risk transaction behavior datasets, can be implemented by the following sub-operations:

[0210] Operation S5211: determining a topological representation vector of the user transaction behavior monitoring data set according to the behavior relationship topology of the user transaction behavior monitoring data set;

[0211] Operation S5212: determining topological representation vectors of the G first risky transaction behavior data sets according to the behavior relationship topology of the G first risky transaction behavior data sets;

[0212] Operation S5213: determining a matching coefficient between the user transaction behavior monitoring dataset and each of the G first risky transaction behavior datasets according to the topological characterization vector of the user transaction behavior monitoring dataset and the topological characterization vectors of the G first risky transaction behavior datasets.

[0213] In operation S521, the core task of the computer system is to calculate the matching coefficient between the user transaction behavior monitoring data set and the G first risk transaction behavior data sets based on the behavior relationship topology. This process involves converting the complex behavior relationship topology into topological representation vectors that are easy to compare and calculate, and calculating the matching coefficient based on these vectors.

[0214] The purpose of operation S5211 is to convert the behavior relationship topology of the user transaction behavior monitoring data set into a low-dimensional numerical vector form (i.e., a topological representation vector) for subsequent calculation and analysis. The following possible processes can be used for implementation: First, the computer system needs to select a suitable graph embedding model to convert the behavior relationship topology into a topological representation vector. The graph embedding model can learn the features of the topological units and edges in the graph structure and embed them into a low-dimensional space while retaining important structural and attribute information in the graph. Common graph embedding models include DeepWalk, Node2vec, LINE, GraphSAGE, GCN, etc.

[0215] When selecting a graph embedding model, the computer system needs to consider factors such as model complexity, computational efficiency, quality and stability of the embedding vector, etc. For online transaction information security risk assessment management scenarios, the model needs to be able to quickly process large-scale graph data and accurately capture the complex relationships between transaction behaviors.

[0216] If the selected graph embedding model needs to be pre-trained, the computer system needs to train the model on a large amount of graph structured data. However, in many cases, pre-trained models or implementations in open source libraries can be used directly to avoid the complexity and computational cost of training models from scratch.

[0217] Input the behavioral relationship topology of the user transaction behavior monitoring dataset into the selected graph embedding model. This usually involves converting the graph structure data (including topological units, edges, and attribute information) into a format that the model can process (such as adjacency matrix, edge list, etc.).

[0218] Through the calculation of the graph embedding model, the topological representation vector of the user transaction behavior monitoring data set is obtained. This vector is a low-dimensional numerical vector that contains key information and structural features in the behavior relationship topology.

[0219] For example, suppose that the computer system selects the GraphSAGE model to generate a topological representation vector. GraphSAGE is a graph embedding method based on the aggregation of neighbor topological unit information, which can capture local and global features in the graph structure.

[0220] First, the computer system inputs the behavioral relationship topology of the user transaction behavior monitoring data set into the GraphSAGE model. This topological graph contains multiple topological units (representing transaction behavior segments) and edges (representing the relationship between segments). Each topological unit may also contain a series of attribute information, such as transaction amount, transaction type, transaction time, etc.

[0221] Then, the GraphSAGE model updates the embedding representation of each topological unit by iteratively aggregating the information of neighboring topological units. In each iteration, the model calculates a new embedding vector based on the information of neighboring topological units of the current topological unit and uses it as the input of the next iteration. After multiple iterations, each topological unit will get an embedding vector containing its local and global structural information.

[0222] Finally, the computer system uses the average pooling method to aggregate the embedding vectors of all topological units to obtain a topological representation vector v_monitor representing the entire user transaction behavior monitoring data set. This vector will serve as the basis for subsequent calculation of the matching coefficient.

[0223] The purpose of operation S5212 is similar to that of operation S5211, but this operation is performed on G first risk transaction behavior data sets, and the purpose is to convert their respective behavior relationship topologies into topology representation vectors.

[0224] The purpose of operation S5213 is to calculate the matching coefficient between the topological characterization vector of the user transaction behavior monitoring data set and the topological characterization vector of each first risk transaction behavior data set by comparing the similarity between them. These matching coefficients will be used in subsequent risk assessment decisions. The following possible processes can be used to implement it: First, the computer system selects a suitable similarity measurement method to calculate the similarity between topological characterization vectors. Common similarity measurement methods include cosine similarity, Euclidean distance, Manhattan distance, etc. In practical applications, cosine similarity is more commonly used because it can handle similarity in the direction of vectors.

[0225] Using the selected similarity measurement method, the computer system calculates the similarity between the topological characterization vector (v_monitor) of the user transaction behavior monitoring data set and the topological characterization vector (such as v_riskA, v_riskB, v_riskC) of each first risk transaction behavior data set. This similarity value is the matching coefficient between them. These matching coefficients reflect the similarity between the user transaction behavior monitoring data set and each first risk transaction behavior data set. In subsequent risk assessment decisions, the computer system can identify possible risk patterns in user transaction behaviors based on these matching coefficients and take corresponding risk management measures.

[0226] Operation S521 converts the behavioral relationship topology between the user transaction behavior monitoring data set and the first risk transaction behavior data set into a topological representation vector that is easy to compare and calculate through graph embedding technology and similarity measurement method, and calculates the matching coefficient between them based on these vectors. These matching coefficients not only provide important data support for risk assessment, but also provide a strong basis for subsequent risk management and decision making. In practical applications, the computer system can select appropriate graph embedding models and similarity measurement methods to implement this process according to specific data characteristics and business requirements.

[0227] In one implementation scheme, the above operation S53, that is, selecting E first risk transaction behavior data sets from G first risk transaction behavior data sets based on the matching coefficient, can be implemented by the following operation: screening out E first risk transaction behavior data sets whose matching coefficients with the user transaction behavior monitoring data set are greater than or equal to the first critical matching coefficient from the G first risk transaction behavior data sets.

[0228] In operation S53, the core task of the computer system is to select E data sets with the highest matching degree with the user transaction behavior monitoring data set from the G first risk transaction behavior data sets. This screening process is based on the matching coefficient calculated previously, and a first critical matching coefficient is set to ensure that the selected data set has a high similarity with the user's transaction behavior, so that it is more likely to contain risk characteristics related to the user's current transaction behavior. The computer system first sets a first critical matching coefficient (denoted as threshold_match_1). This critical value is used to determine which first risk transaction behavior data sets have a high enough matching degree with the user transaction behavior monitoring data set, so as to be eligible to be selected as the basis for subsequent risk assessment. The setting of the critical value depends on the specific application scenario, data characteristics and business needs. Usually, this value is determined based on the performance of historical data, expert opinions or business rules.

[0229] After obtaining the matching coefficients of all G first risk transaction behavior data sets and user transaction behavior monitoring data sets, the computer system sorts these matching coefficients in descending order. The purpose of sorting is to quickly identify the data set with the highest matching degree.

[0230] According to the sorted matching coefficient list, the computer system checks the matching coefficient of each first risk transaction behavior data set from high to low. When a data set with a matching coefficient greater than or equal to the first critical matching coefficient is encountered, the data set is selected. This process continues until E data sets that meet the conditions are selected (if G is less than E, all data sets that meet the conditions are selected). If the number of data sets remaining in the matching coefficient list is less than E, or the matching coefficient of no data set reaches the critical value, it is decided whether to continue searching, reduce the critical value, or take other measures according to actual needs.

[0231] For example, suppose G=10 (i.e., there are 10 first risk transaction behavior data sets), E=3 (i.e., 3 data sets with the highest matching degree need to be selected), and the first critical matching coefficient is set to 0.7. After the previous calculation steps, the computer system has obtained a list of matching coefficients between these 10 data sets and the user transaction behavior monitoring data set, such as [0.85, 0.62, 0.90, 0.55, 0.78, 0.30, 0.82, 0.45, 0.75, 0.28].

[0232] Next, the computer system sorts these data sets in order of matching coefficient from large to small, and obtains a new list: [0.90, 0.85, 0.82, 0.78, 0.75, 0.62, 0.55, 0.45, 0.30, 0.28].

[0233] Then, the system starts to filter the datasets with a matching coefficient greater than or equal to 0.7 from the sorted list. First, the system selects the dataset with a matching coefficient of 0.90 (assuming it is dataset A) because it has the highest matching degree in the list. Then, the system continues to check the next dataset and finds that the dataset with a matching coefficient of 0.85 (assuming it is dataset B) also meets the conditions, so it is also selected. Finally, the system selects the dataset with a matching coefficient of 0.82 (assuming it is dataset C). At this time, 3 datasets that meet the conditions have been selected, reaching the value of E.

[0234] If the matching coefficients of the remaining datasets in the list are all less than 0.7, the screening process ends. Finally, the computer system selects the three first risk transaction behavior datasets (A, B, and C) with the highest matching degree, which will be used in subsequent risk assessment decisions.

[0235] Through the above implementation scheme, the computer system can effectively screen out the data set that is most similar to the user's current transaction behavior from a large number of first risk transaction behavior data sets, providing more accurate and targeted data support for risk assessment.

[0236] In one implementation scheme, the above operation S54, i.e., determining the risk assessment value of the user transaction behavior monitoring dataset based on the risk assessment values ​​of E first risk transaction behavior datasets, can be implemented by the following operation: when the number of first risk transaction behavior datasets is multiple, the risk assessment values ​​of the E first risk transaction behavior datasets are averaged, and the result is used as the risk assessment value of the user transaction behavior monitoring dataset.

[0237] In operation S54, the core task of the computer system is to comprehensively determine the risk assessment value of the user transaction behavior monitoring data set based on the risk assessment values ​​of the E first risk transaction behavior data sets that have been screened. This step is the last link in the risk assessment process, and its result will directly reflect the risk level of the user's current transaction behavior. First, the computer system obtains the risk assessment values ​​of each of the E first risk transaction behavior data sets that have been screened. These assessment values ​​may be discrete levels (such as high, medium, and low) or continuous scores (such as a value between 0 and 100), depending on the definition and calculation method of the risk assessment system. If the assessment values ​​are discrete, the computer system may need to convert them into comparable continuous values ​​(such as by assignment or mapping). After obtaining the risk assessment values ​​of the E first risk transaction behavior data sets, the computer system calculates the average of these assessment values. This step is the key to determining the risk assessment value of the user transaction behavior monitoring data set. By averaging, the system can comprehensively consider the performance of multiple similar risk data sets and obtain a more stable and reliable assessment result.

[0238] Finally, the computer system will calculate the average risk assessment value as the risk assessment value of the user transaction behavior monitoring data set. This result will be used in subsequent risk management decisions to guide enterprises or individuals to take corresponding risk prevention and control measures.

[0239] Since the risk assessment value is usually an integer or a value with a certain number of decimal places, in practical applications, the computer system can round the calculation result or retain it to a certain number of decimal places. In this example, the average risk assessment value can be approximated to 82 (retained to an integer).

[0240] Finally, the computer system outputs 82 as the risk assessment value of the user's trading behavior monitoring data set. This result indicates that the user's current trading behavior has a high risk level and needs to be paid attention to and take corresponding risk management measures. Through the above implementation scheme, the computer system can effectively integrate the information of multiple similar risk data sets and obtain a comprehensive risk assessment value by averaging. This assessment value not only reflects the risk level of the user's trading behavior, but also provides an important reference for subsequent risk management decisions.

[0241] In one implementation scheme, the above-mentioned user transaction behavior monitoring data set, the yth selected transaction behavior data set or the labeled transaction behavior data set are all regarded as the second risk transaction behavior data set here. Then, in the above implementation scheme, based on the behavior relationship topology of the second risk transaction behavior data set, the process of determining the topological representation vector of the second risk transaction behavior data set may include: using a machine learning algorithm to extract representation information of the topological unit information of each topological unit in the behavior relationship topology of the second risk transaction behavior data set to obtain the topological representation vector of the second risk transaction behavior data set.

[0242] In the information security risk assessment management of online transactions, when the user transaction behavior monitoring dataset, the yth candidate transaction behavior dataset or the annotated transaction behavior dataset are uniformly regarded as the second risk transaction behavior dataset, determining the topological representation vectors of these datasets is the key link in assessing their risk characteristics. This process involves the abstraction and representation of complex structures and information in the behavior relationship topology, and machine learning algorithms, especially graph neural networks (GNNs), provide powerful tools for this purpose.

[0243] The computer system first constructs the behavioral relationship topology of the second risk transaction behavior data set. The topological graph consists of multiple topological units (i.e., topological units in the graph). Each topological unit represents a transaction behavior event or segment. Topological units are connected by edges, indicating the time sequence, causal relationship, or other associations between events. The behavioral relationship topology not only contains the basic attributes of transaction behavior (such as transaction amount, transaction type, etc.), but also implies the complex relationships between events, which are crucial for risk assessment.

[0244] In order to convert the information in the behavioral relationship topology into a numerical form that can be used for subsequent calculations and analysis, the computer system uses graph neural networks as the core algorithm. Graph neural networks are particularly suitable for processing graph structured data, and can learn the feature representation of topological units and edges, and capture the global and local structural information of the graph.

[0245] The specific implementation process may include: the computer system selects a suitable graph neural network model, such as GraphConvolutional Network (GCN), GraphSAGE, Graph Attention Network (GAT), etc. These models have their own characteristics. For example, GCN aggregates the information of neighbor topological units through convolution operations, GraphSAGE generates topological unit embedding by sampling and aggregating neighbor topological unit information, and GAT introduces an attention mechanism to distinguish the importance of different neighbor topological units. The behavioral relationship topology of the second risk transaction behavior data set is used as the input of the graph neural network. This includes the feature vectors of all topological units in the topology (such as the numerical representation of attributes such as transaction amount and transaction type) and the connection relationship between topological units (i.e., the adjacency matrix or edge list of the graph).

[0246] If you use a pre-trained model or an implementation in an open source library, you may not need to train the model from scratch. However, for optimization of specific application scenarios, the computer system may need to use an annotated dataset (such as a transaction behavior dataset with a known risk level) to fine-tune the model parameters to improve the performance of the model on specific tasks.

[0247] Through the iterative calculation process of the graph neural network, the system extracts representation information for each topological unit (topological unit) in the behavioral relationship topology. In each iteration, the model updates the embedding representation of the topological unit based on the feature vector of the current topological unit and the information of the neighboring topological units. After multiple iterations, each topological unit will obtain a low-dimensional numerical vector containing its local and global structural information, namely the topological representation vector.

[0248] In order to obtain the topological representation vector of the entire second risky transaction behavior data set, the computer system can use a pooling operation (such as sum pooling, average pooling, etc.) to aggregate the embedding vectors of all topological units. The global topological representation vector obtained in this way can represent the risk characteristics of the entire data set.

[0249] For example, suppose that the computer system selects the GraphSAGE model to process a behavior relationship topology containing multiple fraudulent transaction behavior topological units. In the training phase, the system uses the labeled fraudulent transaction behavior dataset to fine-tune the GraphSAGE model so that it can better capture the characteristics of fraudulent behavior. In the inference phase, for a new second-risk transaction behavior dataset (such as a user transaction behavior monitoring dataset to be evaluated), the system constructs its behavior relationship topology and inputs it into the trained GraphSAGE model. Through the iterative calculation of GraphSAGE, each transaction behavior event topological unit obtains an embedding vector containing its fraud risk information. Finally, the system aggregates these embedding vectors into a global topological representation vector through an average pooling operation, which can be used in subsequent risk assessment decisions.

[0250] In one implementation, the yth transaction behavior dataset to be selected, the labeled transaction behavior dataset, or the first risky transaction behavior dataset mentioned above is regarded as the third risky transaction behavior dataset. In the above embodiment, the process of determining the behavior relationship topology of the third risky transaction behavior dataset may include:

[0251] Operation S100: performing time series data segmentation on the third risky transaction behavior data set according to the behavior events included in the third risky transaction behavior data set to obtain M behavior data segments of the third risky transaction behavior data set, where M is a natural number greater than 0;

[0252] Operation S200: acquiring time series information of each behavior data segment in the third risk transaction behavior data set, and extracting representation information of the M behavior data segments to obtain a behavior representation vector of each behavior data segment in the M behavior data segments;

[0253] Operation S300: For each of the M behavior data segments, use the behavior data segment as a topological unit of the behavior relationship topology, and determine the topological unit information of the topological unit based on the behavior characterization vector and timing information of the behavior data segment to obtain the behavior relationship topology of the third risk transaction behavior data set.

[0254] When determining the behavioral relationship topology of the third risky transaction behavior dataset (whether it is the yth candidate transaction behavior dataset, the labeled transaction behavior dataset, or the first risky transaction behavior dataset), the computer system needs to perform a series of sophisticated operations to construct this key data structure. The behavioral relationship topology not only reveals the intrinsic connection between transaction behaviors, but also provides a solid foundation for subsequent risk assessment.

[0255] The purpose of operation S100 is to segment the third risk transaction behavior data set according to the time sequence of the occurrence of the behavior events, so as to analyze each independent behavior event in more detail. The following possible processes can be used for implementation: Data preprocessing: First, the computer system preprocesses the third risk transaction behavior data set, including data cleaning, deduplication, format unification and other steps to ensure the data quality of subsequent analysis. The system traverses each transaction record in the data set and extracts the timestamp information of each record. These timestamps record the specific time point when the transaction behavior occurs, which is the basis for time series data segmentation. According to business requirements and data characteristics, the system defines segmentation logic. This may be based on multiple factors such as the time interval, transaction type, and transaction amount of the transaction behavior. For example, adjacent and same type of transaction behaviors can be regarded as a segment, or segmented according to a preset time window (such as every hour, every day). According to the defined segmentation logic, the system segments the third risk transaction behavior data set for time series data. In this process, the system identifies each independent behavior event and extracts it as a behavior data segment. Each segment contains all transaction records and related attributes in the behavior event.

[0256] For example, suppose that the third risk transaction behavior dataset contains all transaction records of user Zhang San within a week, including shopping, transfer, withdrawal and other types. The system first extracts the timestamp of each transaction record, and then segments it according to the transaction type and time interval. For example, Zhang San made three shopping transactions between 9:00 and 10:00 am on Monday, and these three transactions are regarded as one behavior data segment (segment 1). Then, Zhang San made a large transfer transaction at 3:00 pm on Tuesday, which constitutes a behavior data segment (segment 2) alone. And so on, the system eventually divides the transaction records of this week into multiple behavior data segments.

[0257] The purpose of operation S200 is to extract key feature information from each behavior data segment and convert it into a low-dimensional numerical vector form (i.e., a behavior representation vector) for subsequent calculation and analysis. The following possible process can be used for implementation: the system selects a suitable feature set based on business requirements and data characteristics. These features may include transaction amount, transaction type, transaction time, transaction object type, etc. For each feature, the system needs to define its data type and value range, and perform necessary preprocessing (such as normalization, encoding conversion, etc.). For each behavior data segment, the system extracts representation information based on its internal transaction records. This usually involves statistical aggregation, calculation of indicators such as average, median, mode, or the use of machine learning algorithms (such as embedding algorithms) to convert classification features into numerical vectors. Based on the extracted representation information, the system generates a behavior representation vector for each behavior data segment. This vector contains the key feature information of the transaction behavior in the segment and is expressed in numerical form.

[0258] For example, continuing the above example, for segment 1 (Zhang San's shopping transactions on Monday morning), the system may extract the following representation information: average transaction amount (such as 300 yuan), transaction type (all shopping), transaction time range (9:00-10:00). Then, the system converts this information into a numerical vector form, such as [300, 1, 0, 0, ...] (assuming that one-hot encoding is used to represent the transaction type, where 1 represents shopping and 0 represents other types). For segment 2 (Zhang San's transfer transactions on Tuesday afternoon), the system also extracts representation information and generates a behavior representation vector.

[0259] The purpose of operation S300 is to construct a behavioral relationship topological graph of the third risky transaction behavior data set based on the behavior characterization vectors and timing information of the behavior data segments. It can be implemented by the following possible processes: In the behavior relationship topological graph, each behavior data segment is regarded as a topological unit (i.e., a topological unit in the graph). These topological units are connected by edges, representing the time sequence, causal relationship, or other associations between behavioral events. For each topological unit (behavior data segment), the system determines its topological unit information based on its behavior characterization vector and timing information. This includes the location, weight, label and other attributes of the topological unit, as well as the connection relationship between the topological units. Based on the information of all topological units, the system constructs a behavioral relationship topological graph of the third risky transaction behavior data set. This graph intuitively shows the intrinsic connection and dynamic changes between transaction behaviors.

[0260] In order to ensure the accuracy and effectiveness of the topology map, the system may need to perform optimization and verification operations. For example, the performance of the topology map on the risk assessment task can be evaluated through a cross-validation method; or the topology map can be manually reviewed and adjusted using domain knowledge. For example, in the above example, the system has generated behavioral representation vectors for all behavioral data segments such as segment 1 and segment 2. Next, the system uses these segments as topological units to construct a behavioral relationship topology map. In the figure, each segment is represented as a topological unit and connected by edges to represent the time order between them (such as segment 1 occurs before segment 2). The weight of the topological unit can be determined based on factors such as transaction amount and transaction frequency; the label of the topological unit can be set based on transaction type or other business rules. The behavioral relationship topology map finally constructed intuitively shows the time order and type distribution of Zhang San's transaction behavior within a week, providing strong support for subsequent risk assessment.

[0261] By implementing operations S100, S200, and S300, the computer system can accurately determine the behavioral relationship topology of the third risk transaction behavior data set. This process not only improves the precision and accuracy of data analysis, but also provides important data support and decision-making basis for subsequent risk assessment and management. In practical applications, these operations can be flexibly adjusted and optimized according to specific business needs and data characteristics.

[0262] An embodiment of the present application provides an information security risk assessment management device, including a memory and a processor, wherein the memory stores a computer program that can be executed on the processor, and when the processor executes the program, some or all of the steps (i.e., each operation) in the above method are implemented. Figure 2 A hardware entity diagram of an information security risk assessment management device provided in an embodiment of the present application, such as Figure 2 As shown, the hardware entity of the information security risk assessment management device 1000 includes: a processor 1001 and a memory 1002, wherein the memory 1002 stores a computer program that can be run on the processor 1001, and the processor 1001 implements the steps in the method of any of the above embodiments when executing the program.

[0263] The above are only implementation methods of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application.

Claims

1. A method for information security risk assessment and management of online transactions. It is characterized in that include: Acquire a user transaction behavior monitoring data set to be evaluated, wherein the user transaction behavior monitoring data set includes a plurality of user transaction behavior data collected from transaction behaviors performed by a target user in a target period; According to the behavior events included in the user transaction behavior monitoring data set, the user transaction behavior monitoring data set is segmented into time series data to obtain U behavior data segments of the user transaction behavior monitoring data set, where U is a natural number greater than 0; Acquire the time series information of each behavior data segment in the user transaction behavior monitoring data set, and extract the representation information of the U behavior data segments to obtain the behavior representation vector of each behavior data segment in the U behavior data segments; For each of the U behavior data segments, the behavior data segment is used as a topological unit of the behavior relationship topology, and the topological unit information of the topological unit is determined according to the behavior representation vector and timing information of the behavior data segment, so as to obtain the behavior relationship topology of the user transaction behavior monitoring data set; performing risk assessment on the user transaction behavior monitoring data set according to the behavior relationship topology of the user transaction behavior monitoring data set; Wherein, performing risk assessment on the user transaction behavior monitoring data set according to the behavior relationship topology of the user transaction behavior monitoring data set includes: Determine a risk behavior control library, wherein the risk behavior control library includes a risk assessment value of each first risk transaction behavior data set in G first risk transaction behavior data sets, and a topological characterization vector or a behavior relationship topology of each first risk transaction behavior data set, wherein the topological characterization vector of the first risk transaction behavior data set is determined according to the behavior relationship topology of the first risk transaction behavior data set, and G is a natural number greater than 0; Determine a matching coefficient between the user transaction behavior monitoring dataset and each of the G first risky transaction behavior datasets according to the behavior relationship topology of the user transaction behavior monitoring dataset and the topological representation vector or behavior relationship topology of each first risky transaction behavior dataset; According to the matching coefficient, selecting E first risky transaction behavior data sets from the G first risky transaction behavior data sets, where E is a non-zero natural number not greater than G; Determining a risk assessment value of the user transaction behavior monitoring dataset according to the risk assessment values ​​of the E first risk transaction behavior datasets; Wherein, determining the matching coefficient between the user transaction behavior monitoring dataset and each of the G first risk transaction behavior datasets according to the behavior relationship topology of the user transaction behavior monitoring dataset and the topological representation vector or behavior relationship topology of each first risk transaction behavior dataset comprises: When the risk behavior comparison library includes the behavior relationship topology of the G first risk transaction behavior data sets, determining the matching coefficient between the user transaction behavior monitoring data set and each first risk transaction behavior data set in the G first risk transaction behavior data sets according to the behavior relationship topology of the user transaction behavior monitoring data set and the behavior relationship topology of the G first risk transaction behavior data sets; When the risk behavior comparison library includes the topological characterization vectors of the G first risk transaction behavior data sets, determining the matching coefficient between the user transaction behavior monitoring data set and each of the G first risk transaction behavior data sets according to the topological characterization vector of the user transaction behavior monitoring data set and the topological characterization vectors of the G first risk transaction behavior data sets; Wherein, determining the matching coefficient between the user transaction behavior monitoring dataset and each of the G first risky transaction behavior datasets according to the behavior relationship topology of the user transaction behavior monitoring dataset and the behavior relationship topology of the G first risky transaction behavior datasets includes: Determining a topological representation vector of the user transaction behavior monitoring data set according to the behavior relationship topology of the user transaction behavior monitoring data set; Determining a topological representation vector of the G first risky transaction behavior data sets according to the behavior relationship topology of the G first risky transaction behavior data sets; Determining a matching coefficient between the user transaction behavior monitoring dataset and each of the G first risky transaction behavior datasets according to the topological characterization vector of the user transaction behavior monitoring dataset and the topological characterization vectors of the G first risky transaction behavior datasets; The selecting E first risky transaction behavior data sets from the G first risky transaction behavior data sets according to the matching coefficients includes: Selecting E first risky transaction behavior data sets whose matching coefficient with the user transaction behavior monitoring data set is greater than or equal to a first critical matching coefficient from the G first risky transaction behavior data sets; Determining the risk assessment value of the user transaction behavior monitoring data set according to the risk assessment values ​​of the E first risky transaction behavior data sets includes: When there are multiple first risky transaction behavior data sets, averaging the risk assessment values ​​of the E first risky transaction behavior data sets, and using the result as the risk assessment value of the user transaction behavior monitoring data set; The risk behavior control library comprises: Obtaining the G first risky transaction behavior data sets; Determine a behavior relationship topology and a risk assessment value of each first risk transaction behavior data set in the G first risk transaction behavior data sets; The risk behavior control library is determined according to the behavior relationship topology and the risk assessment value of the G first risk transaction behavior data sets.

2. The method according to claim 1, It is characterized in that The determining the topological unit information of the topological unit according to the behavior characterization vector and the timing information of the segmented behavior data includes: Obtaining behavior intensity information of the behavior data segment; The topological unit information of the topological unit is determined according to the behavior characterization vector, the timing information and the behavior intensity information of the behavior data segment.

3. The method according to claim 2, It is characterized in that The obtaining of the G first risky transaction behavior data sets includes: Obtain A labeled transaction behavior data sets and B candidate transaction behavior data sets, where A and B are both natural numbers greater than 0; According to the A labeled transaction behavior data sets, several transaction behavior data sets to be selected are determined from the B transaction behavior data sets to be selected as the first risk transaction behavior data set.

4. The method according to claim 3, It is characterized in that The step of determining, based on the A labeled transaction behavior data sets, a plurality of transaction behavior data sets to be selected from the B transaction behavior data sets to be selected as the first risk transaction behavior data set includes: For the yth transaction behavior data set to be selected among the B transaction behavior data sets to be selected, determining a matching coefficient between the yth transaction behavior data set to be selected and each labeled transaction behavior data set among the A labeled transaction behavior data sets, where y is a non-zero natural number not greater than B; When a matching coefficient between the yth transaction behavior data set to be selected and some of the A labeled transaction behavior data sets is greater than a second critical matching coefficient, the yth transaction behavior data set to be selected is determined as the first risky transaction behavior data set.

5. The method according to claim 4, It is characterized in that The determining of the matching coefficient between the yth transaction behavior data set to be selected and each labeled transaction behavior data set in the A labeled transaction behavior data sets includes: Determine a topological characterization vector of the yth transaction behavior data set to be selected and a topological characterization vector of each labeled transaction behavior data set in the A labeled transaction behavior data sets; Determining a matching coefficient between the yth transaction behavior dataset to be selected and each labeled transaction behavior dataset in the A labeled transaction behavior datasets according to the topological characterization vector of the yth transaction behavior dataset to be selected and the topological characterization vector of each labeled transaction behavior dataset in the A labeled transaction behavior datasets; The step of determining the topological characterization vector of the yth transaction behavior data set to be selected and the topological characterization vector of each labeled transaction behavior data set in the A labeled transaction behavior data sets includes: Determine the behavior relationship topology of the yth transaction behavior data set to be selected, and the behavior relationship topology of each labeled transaction behavior data set in the A labeled transaction behavior data sets; Determining a topological representation vector of the yth transaction behavior data set to be selected according to the behavior relationship topology of the yth transaction behavior data set to be selected; For each labeled transaction behavior data set in the A labeled transaction behavior data sets, determining a topological representation vector of the labeled transaction behavior data set according to a behavior relationship topology of the labeled transaction behavior data set; The determining the risk assessment value of each of the G first risky transaction behavior data sets includes: When the first risky transaction behavior dataset is the yth transaction behavior dataset to be selected, according to the matching coefficient between the yth transaction behavior dataset to be selected and each of the A labeled transaction behavior datasets, z labeled transaction behavior datasets whose matching coefficient with the yth transaction behavior dataset to be selected is greater than or equal to a third critical matching coefficient are screened out from the A labeled transaction behavior datasets; The risk assessment value of the yth transaction behavior data set to be selected is determined according to the risk assessment values ​​of the z labeled transaction behavior data sets.

6. The method according to claim 1 or 5, It is characterized in that Determining a topological representation vector of the second risky transaction behavior data set according to the behavior relationship topology of the second risky transaction behavior data set includes: A machine learning algorithm is used to extract representation information of the topological unit information of each topological unit in the behavior relationship topology of the second risk transaction behavior data set to obtain a topological representation vector of the second risk transaction behavior data set. The second risk transaction behavior data set is the user transaction behavior monitoring data set, the yth selected transaction behavior data set, or the labeled transaction behavior data set.

7. The method according to claim 1 or 5, It is characterized in that Determine the behavior relationship topology of the third risk transaction behavior data set, including: According to the behavior events included in the third risky transaction behavior data set, the third risky transaction behavior data set is segmented into time series data to obtain M behavior data segments of the third risky transaction behavior data set, the third risky transaction behavior data set is the yth selected transaction behavior data set or the marked transaction behavior data set or the first risky transaction behavior data set, and M is a natural number greater than 0; Acquire the time series information of each behavior data segment in the third risk transaction behavior data set, and extract the representation information of the M behavior data segments to obtain the behavior representation vector of each behavior data segment in the M behavior data segments; For each of the M behavior data segments, the behavior data segment is used as a topological unit of the behavior relationship topology, and the topological unit information of the topological unit is determined based on the behavior characterization vector and timing information of the behavior data segment to obtain the behavior relationship topology of the third risk transaction behavior data set.

8. An information security risk assessment management device, comprising a memory and a processor, wherein the memory stores a computer program that can be run on the processor, It is characterized in that When the processor executes the program, the steps in the method according to any one of claims 1 to 7 are implemented.

Images