User operation behavior risk control method and device, equipment and medium

Abstract

The invention relates to a user operation behavior risk control method and device, equipment and medium in the technical field of e-commerce, and the method comprises the steps: enabling a risk control measure for a user when a violation accumulated confidence value corresponding to a historical operation behavior implemented by the user exceeds a first preset threshold value, otherwise, the behavior prediction model is adopted to determine a future operation behavior sequence and a prediction confidence value of the future operation behavior sequence according to the current operation behavior sequence of the user; a risk assessment model is adopted to determine a future violation confidence value according to a future operation behavior sequence, sequence time information corresponding to a current operation behavior sequence and behavior detail information, and a violation update increment is determined according to a predicted confidence value and the future violation confidence value. And judging whether the violation accumulated confidence value exceeds a first preset threshold value after being updated by the violation updating increment, and if so, correspondingly updating the violation accumulated confidence value, and starting risk control measures for the user. According to the invention, the risk user behavior can be estimated in advance for restriction.

Description

Technical Field

[0001] The present application relates to the field of e-commerce technology, and in particular to a user operation behavior risk control method and its corresponding device, computer equipment, and computer-readable storage medium. Background Art

[0002] With the booming development of the e-commerce industry, independent stores have attracted more and more users, resulting in a sharp increase in the number of user operations. In traditional technologies, facing such a huge amount of user behavior data, they usually rely on static rules and manual review. These methods are not only inefficient, but also prone to miss risks, resulting in inaccurate and in-time risk control. The most important thing is that the risk can only be reviewed after it actually occurs, which is often too late because the risk has already caused losses. Such belated risk control measures cannot effectively prevent losses and are often accompanied by high post-event remediation costs.

[0003] In view of the shortcomings of traditional practices, the applicant has been engaged in research in related fields for a long time and has taken a different approach to solve industry problems in the field of e-commerce technology. Summary of the invention

[0004] The primary purpose of the present application is to solve at least one of the above problems and provide a user operation behavior risk control method and its corresponding device, computer equipment, and computer program product.

[0005] In order to meet the various objectives of this application, this application adopts the following technical solutions:

[0006] A user operation behavior risk control method provided to meet one of the purposes of this application includes the following steps:

[0007] Obtaining the user's current operation behavior sequence and its corresponding sequence time information, the behavior details information corresponding to each operation behavior, and the violation cumulative confidence value corresponding to the user's historical operation behavior;

[0008] When the cumulative violation confidence value exceeds a first preset threshold, risk control measures are initiated for the user to restrict the user's future operation behavior; otherwise, a preset behavior prediction model is used to determine a future operation behavior sequence and its prediction confidence value based on the current operation behavior sequence;

[0009] When the prediction confidence value exceeds a second preset threshold, a preset risk assessment model is used to determine a future violation confidence value according to the future operation behavior sequence, sequence time information, and behavior detail information;

[0010] A violation update increment is determined based on the predicted confidence value and the future violation value. When the sum of the violation cumulative confidence value and the violation update increment exceeds a first preset threshold, the violation cumulative confidence value is reassigned to the sum, and the risk measure is enabled for the user.

[0011] On the other hand, a user operation behavior risk control device provided to meet one of the purposes of the present application includes a data acquisition module, a behavior prediction module, a violation assessment module and a behavior risk control module, wherein the data acquisition module is used to obtain the user's current operation behavior sequence and its corresponding sequence time information, the behavior detail information corresponding to each operation behavior, and the cumulative violation confidence value corresponding to the user's historical operation behavior; the behavior prediction module is used to enable risk control measures for the user to restrict the user's future operation behavior when the cumulative violation confidence value exceeds a first preset threshold, otherwise, a preset behavior prediction model is used to determine the future operation behavior sequence and its predicted confidence value based on the current operation behavior sequence; the violation assessment module is used to determine the future violation confidence value based on the future operation behavior sequence, sequence time information, and behavior detail information using a preset risk assessment model when the predicted confidence value exceeds a second preset threshold; the behavior risk control module is used to determine the violation update increment based on the predicted confidence value and the future violation value, and when the sum of the cumulative violation confidence value and the violation update increment exceeds the first preset threshold, the cumulative violation confidence value is reassigned to the sum value, and the risk measures are enabled for the user.

[0012] On the other hand, a computer device provided to meet one of the purposes of the present application includes a central processing unit and a memory, and the central processing unit is used to call and run a computer program stored in the memory to execute the steps of the user operation behavior risk control method described in the present application.

[0013] On the other hand, a computer program product provided to meet another purpose of the present application includes a computer program / instruction, which, when executed by a processor, implements the steps of the method described in any embodiment of the present application.

[0014] The technical solution of this application has many advantages, including but not limited to the following aspects:

[0015] The present application enables risk control measures for users when the cumulative confidence value of violations corresponding to the user's historical operation behavior exceeds the first preset threshold value, and immediately restricts the user's future operations in view of the confirmation that the user's operation behavior is in violation, so as to stop losses in time; otherwise, the current user's operation behavior is not reliable enough to be judged as risky, and then a behavior prediction model is used to determine the future operation behavior sequence and its predicted confidence value based on the user's current operation behavior sequence; when the predicted confidence value exceeds the second preset threshold value, it means that the predicted confidence value is high enough at this time, so that the future operation behavior sequence is reliable enough, and the accuracy of the future operation behavior in the sequence is assured. Based on this, further, a risk assessment model is used to determine the future violation confidence value according to the accurate and reliable future operation behavior sequence, the sequence time information corresponding to the current operation behavior sequence, and the behavior details information, so as to ensure the credibility and accuracy of the future violation confidence value; after determining the violation update increment according to the reliable and accurate prediction confidence value and the future violation confidence value, it is first necessary to determine whether the violation cumulative confidence value exceeds the first preset threshold after being updated with the violation update increment. If it exceeds, the violation cumulative confidence value is updated accordingly, and risk control measures are enabled for the user. It can be seen that reliable risk estimation of future operation behaviors can be achieved, and restrictions on users' future operations can be imposed when risks are predicted in advance, so as to achieve the effect of prior prevention and reduce unnecessary losses. In this process, the cumulative confidence value of violations on which the user's violation penalties are based needs to continuously accumulate reliable and accurate violation update increments until the threshold is exceeded, triggering the activation of risk control measures. This can take into account a certain degree of tolerance for users' suspected risky operation behaviors and reduce the possibility of misjudgment of violations. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The above and / or additional aspects and advantages of the present application will become apparent and easily understood from the following description of the embodiments in conjunction with the accompanying drawings, in which:

[0017] Figure 1 A schematic diagram of a typical network deployment architecture related to implementing the technical solution of this application;

[0018] Figure 2 This is a flowchart of a typical embodiment of the user operation behavior risk control method of the present application;

[0019] Figure 3 This is a functional block diagram of the user operation behavior risk control device of this application;

[0020] Figure 4 A schematic diagram of the structure of a computer device used in this application. DETAILED DESCRIPTION

[0021] The embodiments of the present application are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present application, and cannot be interpreted as limiting the present application.

[0022] It will be understood by those skilled in the art that, unless expressly stated, the singular forms "one", "said", and "the" used herein may also include plural forms. It should be further understood that the term "comprising" used in the specification of the present application refers to the presence of the features, integers, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or groups thereof. It should be understood that when we refer to an element as being "connected" or "coupled" to another element, it may be directly connected or coupled to the other element, or there may be an intermediate element. In addition, the "connection" or "coupling" used herein may include wireless connection or wireless coupling. The term "and / or" used herein includes all or any unit and all combinations of one or more associated listed items.

[0023] It will be understood by those skilled in the art that, unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as those generally understood by those skilled in the art to which this application belongs. It should also be understood that terms such as those defined in general dictionaries should be understood to have meanings consistent with those in the context of the prior art, and will not be interpreted with idealized or overly formal meanings unless specifically defined as here.

[0024] like Figure 1 In the network architecture shown, the e-commerce platform 82 is deployed on the Internet to provide corresponding services to its users. Similarly, the devices 80 of the merchant users of the e-commerce platform 82 and the devices 81 of the consumer users are also connected to the Internet to use the services provided by the e-commerce platform.

[0025] The exemplary e-commerce platform 82 provides supply and demand matching of products and / or services to the general public with the help of Internet infrastructure. In the e-commerce platform 82, products and / or services are provided as commodity information. To simplify the description, the concepts of commodity, product, etc. are used in this application to refer to the products and / or services in the e-commerce platform 82, which may specifically be physical products, digital products, tickets, service subscriptions, other offline services, etc.

[0026] In reality, all entities can access the e-commerce platform 82 as users, use various online services provided by the e-commerce platform 82, and achieve the purpose of participating in the business activities achieved by the e-commerce platform 82. These entities can be natural persons, legal persons or social organizations, etc. Corresponding to the two types of entities, merchants and consumers in business activities, the e-commerce platform 82 has two types of users, merchant users and consumer users. All entities in the product distribution chain in business activities, including manufacturers, sellers, retailers, logistics providers, etc., can use online services in the e-commerce platform 82 as merchant users, while consumers in business activities, including real or potential consumers, can use online services in the e-commerce platform 82 as their corresponding consumer users. In actual business activities, the same entity can act as both a merchant user and a consumer user, and this should be understood flexibly.

[0027] The infrastructure used to deploy the e-commerce platform 82 mainly includes the backend architecture and frontend equipment. The backend architecture runs various online services through the service cluster, including middleware or frontend services for the platform, services for consumers, services for merchants, etc., to enrich and improve its service functions; the frontend equipment mainly covers the terminal devices used by users to access the e-commerce platform 82 as clients, including but not limited to various mobile terminals, personal computers, point-of-sale devices, etc. For example, merchant users can enter product information for their online stores through their terminal devices 80, or generate their product information using the interfaces opened by the e-commerce platform; consumer users can access the webpage of the online store implemented by the e-commerce platform 82 through their terminal devices 81, trigger the shopping process through the shopping buttons provided on the webpage, and call various online services provided by the e-commerce platform 82 during the shopping process, so as to achieve the purpose of shopping orders.

[0028] In some embodiments, the e-commerce platform 82 may be implemented by a processing facility including a processor and a memory, the processing facility storing a set of instructions that, when executed, cause the e-commerce platform 82 to perform the e-commerce and support functions involved in the present application. The processing facility may be part of a server, client, network infrastructure, mobile computing platform, cloud computing platform, fixed computing platform, or other computing platform, and provides electronic components, merchant equipment, payment gateways, application developers, marketing channels, transportation providers, customer equipment, point-of-sale equipment, etc. of the e-commerce platform 82.

[0029] The e-commerce platform 82 can be implemented as an online service such as cloud computing service, software as a service (SaaS), infrastructure as a service (IaaS), platform as a service (PaaS), desktop as a service (DaaS), hosted software as a service, mobile backend as a service (MBaaS), information technology management as a service (ITMaaS), etc. In some embodiments, the various functional components of the e-commerce platform 82 can be implemented to be suitable for operation on various platforms and operating systems. For example, for an online store, its administrator users enjoy the same or similar functions regardless of various embodiments such as iOS, Android, HomonyOS, or web pages.

[0030] The e-commerce platform 82 can realize the corresponding independent station for each merchant to run its corresponding online store, and provide the merchant with the corresponding business management engine instance for the merchant to establish, maintain and run one or more online stores in one or more independent stations. The business management engine instance can be used for content management, task automation and data management of one or more online stores, and various specific business processes of the online store can be configured through interfaces or built-in components to support the implementation of business activities. The independent station is the infrastructure of the e-commerce platform 82 with cross-border service functions. Merchants can maintain their online stores more centrally and autonomously based on the independent station. The independent station usually has a domain name and storage space dedicated to the merchant, and different independent stations are relatively independent. The e-commerce platform 82 can provide standardized or personalized technical support for a large number of independent stations, so that merchant users can customize their own business management engine instance and use this business management engine instance to maintain one or more online stores they own.

[0031] The online store can implement backend configuration and maintenance by having the merchant user log in to its business management engine instance as an administrator. With the support of various online services provided by the infrastructure of the e-commerce platform 82, the merchant user can configure various functions in its online store as an administrator, view various data, etc. For example, the merchant user can manage various aspects of its online store, such as viewing the online store's recent activities, updating the online store's product catalog, managing orders, recent visit activities, total order activities, etc.; the merchant user can also view more detailed information about the business and visitors to the merchant's online store by obtaining reports or metrics, such as showing a sales summary of the merchant's overall business, specific sales and participation data of active sales marketing channels, etc.

[0032] The e-commerce platform 82 may provide communication facilities and associated merchant interfaces for providing electronic communications and marketing, such as utilizing electronic message aggregation facilities to collect and analyze communication interactions between merchants, consumers, merchant devices, customer devices, point-of-sale devices, etc., aggregating and analyzing communications, such as for increasing the potential for providing product sales, etc. For example, a consumer may have a question related to a product, which may generate a dialogue between the consumer and the merchant (or an automated processor-based agent on behalf of the merchant), where the communication facility is responsible for interacting and providing the merchant with analysis on how to increase the probability of a sale.

[0033] In some embodiments, an application suitable for installation in a terminal device can be provided to serve the access needs of different users, so that various users can access the e-commerce platform 82 by running the application in the terminal device, such as the merchant backend module of the online store in the e-commerce platform 82, etc. In the process of implementing business activities through these functions, the e-commerce platform 82 can implement various functions related to supporting the implementation of business activities as middleware or online services and open corresponding interfaces, and then implant the toolkit corresponding to the interface access function into the application to implement function expansion and task implementation. The business management engine can include a series of basic functions, and expose these functions to online services and / or application calls through APIs. Online services and applications use corresponding functions by remotely calling corresponding APIs.

[0034] With the support of various components of the business management engine instance, the e-commerce platform 82 can provide online shopping functions, enabling merchants to establish connections with customers in a flexible and transparent manner. Consumer users can select items online, create product orders, provide the delivery address of the goods in the product order, and complete the payment confirmation of the product order. Then, the merchant can review and complete or cancel the order. The review component carried by the business management engine instance can realize the compliance use of business processes to ensure that the order is suitable for fulfillment before actual fulfillment. Orders may sometimes be fraudulent and need to be verified (such as ID card checks). There is a payment method that requires merchants to wait to ensure that funds are received, which can play a role in preventing such risks, etc. Order risks may be generated by fraud detection tools submitted by third parties through order risk APIs, etc. Before fulfillment, merchants may need to obtain payment information or wait to receive payment information in order to mark the order as paid, so that the merchant can prepare to deliver the product. Such situations can be reviewed accordingly. The review process can be implemented by the fulfillment component. Merchants can use the fulfillment component to review, adjust work, and trigger related fulfillment services, such as: manual fulfillment services, which are used when merchants pick and pack products in boxes, purchase shipping labels and enter their tracking numbers, or simply mark items as fulfilled; custom fulfillment services, which can define email notifications; API fulfillment services, which can trigger third-party applications to create fulfillment records in third parties; legacy fulfillment services, which can trigger custom API calls from the business management engine to third parties; gift card fulfillment services. You can provide the generation of numbers and activate gift cards. Merchants can use the order printer application to print shipping orders. The fulfillment process can be executed when the items are packed in boxes and ready for shipping, tracking, delivery, consumer receipt verification, etc.

[0035] The e-commerce platform 82 can provide plug-in services to all independent station stores therein. The plug-in service is a service provided by the e-commerce platform 82 to the merchants of the independent station stores through the plug-in system developed and maintained by the e-commerce platform 82. The plug-in system provides multiple plug-ins with different functions, such as but not limited to, intelligent customer service plug-in: it can be used to act as the customer service role of the independent station store, and automatically reply to some preset consulting questions and / or scripts based on the preset question and answer data of the independent station store; product image design plug-in: it can be used to use the layer template data or default layer template data set by the merchants of the independent station store to further design the product header image, product detail image and other product images to enhance the marketing effect of the product image; logistics transfer order search plug-in: it can be used to use the product title data of the independent station store to retrieve the corresponding logistics transfer order; data analysis plug-in: it can be used to help the independent station store collect, analyze and display the operation data of the store. Data, including traffic sources, customer behavior, sales trends, etc., so that merchants can make more informed business decisions; Inventory management plug-in: can be used to monitor and manage the inventory data of independent station stores in real time, and issue alarms when inventory is insufficient to avoid overselling and out-of-stock situations; Marketing campaign management plug-in: can be used to create and track various promotional activities, such as coupons, limited-time discounts, member points, etc., to attract consumers and increase sales; Marketing promotion plug-in: can be used to use artificial intelligence technology to construct marketing promotion tweets based on the product data and / or marketing campaign data of the independent station store, and send them to social media, search engines, product audiences and other promotion channels associated with the independent station store; Store decoration plug-in: can be used to match the corresponding front-end decoration interface template based on the product data and / or marketing campaign data of the independent station store, so as to optimize the visual effect of the store decoration and improve the efficiency of the store decoration.

[0036] A user operation behavior risk control method of the present application can be programmed as a computer program product and deployed in a client or server for execution. For example, in the exemplary application scenario of the present application, it can be deployed and implemented in the server of an independent website store, thereby accessing the interface opened after the computer program product is running and performing human-computer interaction with the process of the computer program product through a graphical user interface to execute the method.

[0037] See also Figure 2 A user operation behavior risk control method of the present application, in its typical embodiment, includes the following steps:

[0038] Step S1100: obtaining the user's current operation behavior sequence and its corresponding sequence time information, behavior detail information corresponding to each operation behavior, and the violation cumulative confidence value corresponding to the user's historical operation behaviors;

[0039] The server generates logs corresponding to the operation behaviors of all users in the independent station store. For each user, the server collects the operation behaviors implemented by the user at all times, and sorts these operation behaviors in chronological order according to the timestamps associated with each operation behavior. Then, for each two adjacent operation behaviors, the server calculates the timestamp of the operation behavior in the later order minus the timestamp of the operation behavior in the earlier order, and obtains the time interval between the two adjacent operation behaviors, and then determines whether each time interval exceeds the preset time length. When the preset time length is exceeded, the two adjacent operation behaviors in the corresponding order are regarded as not belonging to the same sequence, otherwise, the two adjacent operation behaviors in the corresponding order are regarded as belonging to the same sequence. A person skilled in the art can set the preset time length as needed according to the disclosure herein, for example, 30 minutes.

[0040] For the user, the current timestamp minus the timestamp of the last operation behavior in each sequence can be calculated based on each sequence corresponding to the user to obtain the corresponding time interval, and the sequence corresponding to the preset time length whose time interval does not exceed the preset time length is determined as the current operation behavior sequence. It is not difficult to understand that the operation behaviors in each sequence corresponding to the time interval exceeding the preset time length are relative historical operation behaviors.

[0041] The sequence time information includes the operation duration corresponding to the current operation behavior sequence and the time interval between every two adjacent operation behaviors in the current operation behavior sequence. The operation duration can be obtained by calculating the timestamp of the last operation behavior in the current operation behavior sequence minus the timestamp of the first operation behavior. The time interval between every two adjacent operation behaviors can be obtained by subtracting the timestamp of the previous operation behavior from the timestamp of the latter operation behavior in the two adjacent operation behaviors.

[0042] The behavior detail information corresponding to each operation behavior in the current operation behavior sequence is presented as behavior-related statistical data. Specifically, if the current operation behavior sequence includes an operation behavior of the operation type of return, the total number of returns of the user in the independent station store is obtained, otherwise the total number of returns is not obtained; if the actual operation behavior sequence includes an operation behavior of the operation type of purchase, the total number of purchases and the total number of purchased goods of the user in the independent station store are obtained, otherwise the total number of purchases and the total number of purchased goods are not obtained; if the current operation behavior sequence includes an operation behavior of the operation type of click, the total number of clicks of the user in the independent station store is obtained, otherwise the total number of clicks is not obtained. number; if the current operation behavior sequence includes an operation behavior of comment type, the total number of words in the user's comment and the total number of comments by the user in the independent station store are obtained, otherwise the total number of words in the comment and the total number of comments are not obtained; if the current operation behavior sequence includes an operation behavior of search type, the total number of searches by the user in the independent station store are obtained, otherwise the total number of searches is not obtained; if the current operation behavior sequence includes an operation behavior of like, follow, and share type, the total number of likes, follows, and shares of the user in the independent station store are obtained accordingly, otherwise the total number of likes, follows, and shares are not obtained.

[0043] The violation cumulative confidence value is initially set to zero, and is updated whenever a violation update increment corresponding to the user's historical operation behavior is confirmed, so that the violation cumulative confidence value is accumulated by each corresponding violation update increment.

[0044] Step S1200: When the cumulative violation confidence value exceeds a first preset threshold, risk control measures are enabled for the user to restrict the user's future operation behavior; otherwise, a preset behavior prediction model is used to determine a future operation behavior sequence and its prediction confidence value based on the current operation behavior sequence;

[0045] The behavior prediction model includes a text vector representation layer, a multi-layer decoder layer and a subsequent prediction layer. Each decoder layer is obtained by making changes based on the same transformer block. The changes include replacing the layer normalization (LayerNorm) with root mean square normalization (RMSNorm), replacing the multi-head attention (Multi-Head Attention) with group query attention (Group Query Attention), replacing the positional encoding (PositionalEncoding) with rotational position encoding (Rotary Position Embedding, RoPE), and replacing the linear rectified function (Rectified Linear Unit) with a gated linear function (Switched Gated Linear Unit); the prediction layer is a multi-classification fully connected layer. The number of layers of the decoder layer can be set as needed by a technician in this field, for example, 32 layers. The behavior prediction model is pre-trained to a convergence state and learns the ability to predict future operation behaviors in the sequence based on the input operation behavior sequence.

[0046] The first preset threshold is a pre-set value used to determine whether the cumulative confidence value of violations is high enough to confirm whether the conditions for enabling risk control measures for the corresponding user are met. Accordingly, when the cumulative confidence value of violations exceeds the first preset threshold, it is confirmed that the conditions for enabling risk control measures for the user are met, and the risk control measures are enabled for the user, so that the user is subject to corresponding restrictions and cannot perform future operation behaviors; when the cumulative confidence value of violations is lower than or equal to the first preset threshold, it is confirmed that the conditions for enabling risk control measures for the user are not met, and the current operation behavior sequence is input into the behavior prediction model, and the behavior prediction model performs autoregressive prediction on the current operation behavior sequence to predict the future operation behavior sequence and its predicted confidence value. The autoregressive prediction means that in each time step, the behavior prediction model predicts a new sequence based on the sequence input at the time step, and the new sequence is a single future operation behavior inferred at the end of the input sequence, and the new sequence is used as the input of the next time step. The prediction confidence value refers to the confidence or reliability of the behavior prediction model for the accuracy of its predicted future operation behavior sequence.

[0047] Those skilled in the art can set the first preset threshold as needed based on the above disclosure. The risk control measures can be to prohibit users from performing predetermined operations through operation restrictions, and the predetermined operations can be set by those skilled in the art as needed; or they can be to restrict user login / account ban, prohibiting users from successfully logging in so that users cannot perform all operations after logging in.

[0048] Step S1300: when the prediction confidence value exceeds a second preset threshold, a preset risk assessment model is used to determine a future violation confidence value according to the future operation behavior sequence, sequence time information, and behavior detail information;

[0049] The risk assessment model is pre-trained to a convergence state and acquires the ability to determine the probability of a category belonging to a violation based on an operation behavior sequence, sequence time information, and behavior detail information.

[0050] The second preset threshold is a pre-set value used to determine whether the prediction confidence value is high enough so that the confidence level or reliability level of the future operation behavior sequence is accurate. Accordingly, when the prediction confidence value exceeds the second preset threshold, it indicates that the future operation behavior sequence is sufficiently reliable and trustworthy, and then the feature representation module in the risk assessment model extracts the deep semantic information corresponding to the future operation behavior sequence, sequence time information, and behavior detail information, and derives the corresponding risk assessment features that quantify the deep semantic information. The classification module in the risk assessment model classifies and maps the risk assessment features to binary categories, and determines the probability of the first category in the binary category that represents violations, that is, the category probability of violations. The binary category includes a first category that represents violations, and a second category that represents violations.

[0051] When the probability of the category belonging to the violation exceeds the third preset threshold, it is used as the future violation confidence value assessed based on the future operation behavior sequence, sequence time information, and behavior detail information; when the probability of the category belonging to the violation is lower than or equal to the third preset threshold, it means that the probability of the category belonging to the violation is not credible enough and cannot be used as a quantitative value for violation penalty. Therefore, the future violation confidence value assessed based on the future operation behavior sequence, sequence time information, and behavior detail information is directly set to zero.

[0052] Those skilled in the art may set the second and third preset thresholds as needed based on the above disclosure.

[0053] Step S1400: determine a violation update increment based on the predicted confidence value and the future violation value; when the sum of the violation cumulative confidence value and the violation update increment exceeds a first preset threshold, reassign the violation cumulative confidence value to the sum, and enable the risk measure for the user.

[0054] The product of the predicted confidence value and the future violation confidence value is calculated as the violation update increment. Afterwards, it is determined whether the sum of the violation update increment and the cumulative violation confidence value exceeds the first preset threshold. When it exceeds, the cumulative violation confidence value is reassigned to the sum to complete the update of the cumulative violation confidence value. At this time, because the condition for enabling the risk control measure for the user is met, the risk control measure is enabled for the user.

[0055] It can be known from the typical embodiments of the present application that the technical solution of the present application has many advantages, including but not limited to the following aspects:

[0056] The present application enables risk control measures for users when the cumulative confidence value of violations corresponding to the user's historical operation behavior exceeds the first preset threshold value, and immediately restricts the user's future operations in view of the confirmation that the user's operation behavior is in violation, so as to stop losses in time; otherwise, the current user's operation behavior is not reliable enough to be judged as risky, and then a behavior prediction model is used to determine the future operation behavior sequence and its predicted confidence value based on the user's current operation behavior sequence; when the predicted confidence value exceeds the second preset threshold value, it means that the predicted confidence value is high enough at this time, so that the future operation behavior sequence is reliable enough, and the accuracy of the future operation behavior in the sequence is assured. Based on this, further, a risk assessment model is used to determine the future violation confidence value according to the accurate and reliable future operation behavior sequence, the sequence time information corresponding to the current operation behavior sequence, and the behavior details information, so as to ensure the credibility and accuracy of the future violation confidence value; after determining the violation update increment according to the reliable and accurate prediction confidence value and the future violation confidence value, it is first necessary to determine whether the violation cumulative confidence value exceeds the first preset threshold after being updated with the violation update increment. If it exceeds, the violation cumulative confidence value is updated accordingly, and risk control measures are enabled for the user. It can be seen that it is possible to achieve reliable risk prediction of future operational behaviors, and when risks are predicted in advance, restrict users' future operations, so as to achieve the effect of prior prevention and reduce unnecessary losses. In this process, the cumulative confidence value of violations on which the user's violation penalties are based needs to continuously accumulate reliable and accurate violation update increments until the threshold is exceeded, triggering the penalty of enabling risk control measures. This can take into account a certain degree of tolerance for users' suspected risky operational behaviors and reduce the possibility of misjudgment of violations.

[0057] In a further embodiment, before step S1100, obtaining the user's current operation behavior sequence and its corresponding sequence time information, the behavior detail information corresponding to each operation behavior, and the violation cumulative confidence value corresponding to the user's historical operation behavior, the following steps are included:

[0058] Step S1000: Obtain a user operation behavior log set to determine a historical operation behavior set for each user;

[0059] It can be understood that the server can form a corresponding log by real-time monitoring and recording each operation behavior of the user, and then store the log for future use. The operation behavior is composed of a page, a page module, a page component, and an operation type, indicating that the corresponding user performs the operation of the operation type on the page component under the page module in the page of the independent station store. The page module includes areas divided for different business objectives in each page, such as a product recommendation module, a product evaluation module, a product details module, a product group order module, a product order module, a product shopping cart module, etc.; the page component includes all controls that can be triggered by users in any page of the independent station store. Human-computer interaction, such as a product search box, a product search button, a product thumbnail display window, a like product button, a favorite product button, a comment input box, a comment submission button, an add to cart button, a purchase or order button, a payment button, etc.; the operation type includes the type of operation corresponding to all human-computer interactions that can be performed by users and any page of the independent station store, such as search, click, purchase, return, add to cart, comment, share, like, forward, etc. For easier understanding, the following examples are used: home page, product recommendation module, a product thumbnail display window component, and click.

[0060] Obtain the logs corresponding to the operation behaviors of all users in the independent station store, and collect these logs to form the user operation behavior log set. The log includes the unique identifier of the corresponding user and its operation behavior, as well as the timestamp corresponding to the user's implementation of the operation behavior. The unique identifier of the user is used to uniquely refer to the user to distinguish other users, and can be flexibly set by technical personnel in this field, such as the user ID. For each user, all operation behaviors and their timestamps associated with the same unique identifier of the user are collected from the user operation behavior log set. However, these operation behaviors have already occurred, so these individual operation behaviors are respectively taken as historical operation behaviors, and these historical operation behaviors are collected and associated with their timestamps to form the user's historical operation behavior set.

[0061] Step S1010: for each user, determining at least one historical operation behavior sequence from the historical operation behavior set of the user, wherein the time interval between each historical operation behavior in the historical operation behavior sequence meets a preset condition;

[0062] Taking a single user as an example, from the historical operation behavior set of the user, all historical operation behaviors are sorted in chronological order according to the timestamp associated with each historical operation behavior, and then according to the timestamps associated with each two adjacent historical operation behaviors, for each two adjacent historical operation behaviors, the timestamp of the historical operation behavior sorted later is subtracted from the timestamp of the historical operation behavior sorted earlier to obtain the time interval between the two adjacent historical operation behaviors, and then it is determined whether each time interval exceeds the preset time length. When it exceeds the preset time length, the two corresponding adjacent historical operation behaviors are deemed to not belong to the same sequence. Otherwise, the two corresponding adjacent historical operation behaviors are deemed to belong to the same sequence. Therefore, for each sequence, all historical operation behaviors belonging to the sequence form a single historical operation behavior sequence. It is not difficult to understand that the historical operation behaviors in the historical operation behavior sequence are arranged in chronological order, and the time interval between each historical operation behavior does not exceed the preset time length. In addition, the sequence to which the historical operation behaviors belong is divided accordingly based on whether it exceeds the preset time length, thereby constructing a corresponding historical operation behavior sequence, in which each historical operation behavior is regarded as being continuously performed by the corresponding user. Technical personnel in this field can set the preset time length as needed according to the disclosure herein, for example 30 minutes.

[0063] Step S1020: construct a training set based on all historical operation behavior sequences corresponding to each user, and call the training set to train the behavior prediction model until it converges.

[0064] The behavior prediction model includes a text vector representation layer, a multi-layer decoder layer and a subsequent prediction layer. Each decoder layer is obtained by changing the same transformer block. The changes include replacing the layer normalization (LayerNorm) with the root mean square normalization (RMSNorm), the multi-head attention (Multi-Head Attention) with the group query attention (Group Query Attention), the positional encoding (PositionalEncoding) with the rotational position encoding (Rotary Position Embedding, RoPE), and the linear rectified function (Rectified Linear Unit) with the gated linear function (Switched Gated Linear Unit); the prediction layer is a multi-classification fully connected layer. The number of layers of the decoder layer can be set by technicians in this field as needed, for example, 32 layers.

[0065] Each historical operation behavior is taken as a single training sample, and all training samples are collected to form a training set. A single training sample in the training set is called, and the behavior prediction model performs Teacher Forcing prediction based on the training sample, that is, the real target sequence, that is, the training sample, is used as the input of the behavior prediction model, rather than the sequence predicted by the behavior prediction model itself as the input of the next time step. Specifically, for each time step, the next operation behavior of the single operation behavior selected in the previous time step is sequentially selected from the training sample, and it and all previous operation behaviors constitute the input sequence corresponding to the time step; the input sequence corresponding to the first time step includes the first operation behavior in the training sample, and the input sequence corresponding to the last time step includes all operation behaviors in the training sample except the last operation behavior; it is not difficult to understand that the total number of time steps is the total number of operation behaviors in the training sample minus one. Further, for each time step, the behavior prediction model predicts the predicted operation behavior corresponding to the time step according to the input sequence corresponding to the time step, thereby forming a predicted operation behavior sequence with the first predicted operation behavior in the training sample and the predicted operation behavior corresponding to each time step, and using the maximum likelihood estimation function as the loss function, the loss value corresponding to the predicted operation behavior sequence is determined according to the training sample, and when the loss value is less than or equal to the preset threshold, it indicates that the behavior prediction model has been trained to a convergence state, so that the training of the behavior prediction model can be terminated; when the loss value exceeds the preset threshold, it indicates that the behavior prediction model has not converged, and then the behavior prediction model is gradient updated according to the loss value, usually by back propagation to correct the weight parameters of each link of the behavior prediction model so that the behavior prediction model is further close to convergence, and then, other training samples in the training set are continuously called to iteratively train the behavior prediction model until the behavior prediction model is trained to a convergence state. The preset threshold can be flexibly set by those skilled in the art.

[0066] It can be understood that the vocabulary of the behavior prediction model includes all different operational behaviors that can occur in an independent station store, and each operational behavior is regarded as a word element in the vocabulary. Those skilled in the art can flexibly implement the vocabulary.

[0067] In this embodiment, the process of training the behavior prediction model to a convergence state is revealed to ensure the accuracy and reliability of the reasoning results of the behavior prediction model, so that the subsequent use of the behavior prediction model can efficiently and accurately infer the corresponding future operation behavior sequence based on the user's current operation behavior sequence.

[0068] In a further embodiment, step S1300, using a preset risk assessment model to determine a future violation confidence value according to the future operation behavior sequence, sequence time information, and behavior detail information, includes the following steps:

[0069] Step S1310: using a feature representation module in a preset risk assessment model to extract risk assessment features according to the future operation behavior sequence, sequence time information, and behavior detail information;

[0070] Based on the disclosure of the reasoning process of the risk assessment model in this embodiment, those skilled in the art can flexibly and adaptably implement the training of the risk assessment model to a convergence state, so that it can learn the ability to determine the probability of a category belonging to a violation based on the operation behavior sequence, sequence time information, and behavior detail information.

[0071] The risk assessment model includes a feature representation layer and a classification module. The feature representation layer can be a model suitable for text feature representation in the NLP field, for example, it can be any one or any combination of MLP, RNN, Transformer encoder, BERT, etc., which can be set as needed by technicians in the field. The classification module can be a binary fully connected layer or MLP, which can be set as needed by technicians in the field.

[0072] The feature representation module in the risk assessment model extracts the deep semantic information corresponding to the future operation behavior sequence, sequence time information, and behavior detail information, and derives corresponding risk assessment features that vectorize the deep semantic information.

[0073] Step S1320: The classification module in the risk assessment model classifies the probability of a violation according to the risk assessment feature;

[0074] The classification module in the risk assessment model classifies and maps the risk assessment features to binary categories, and determines the probability of the first category in the binary category representing the violation, that is, the category probability of the violation. The binary category includes the first category representing the violation and the second category representing the non-violation.

[0075] Step S1330: When the probability of the category belonging to the violation exceeds a third preset threshold, confirm the category probability as a future violation confidence value.

[0076] The third preset threshold is a pre-set value used to determine whether the probability of the category belonging to the violation input by the classification module is high enough to be considered sufficiently credible, so that it can be used as a quantitative value for violation penalty. Those skilled in the art can set the third preset threshold as needed based on the disclosure herein. Thus, the probability of the category belonging to the violation that exceeds the third preset threshold is confirmed as the future violation confidence value evaluated according to the future operation behavior sequence, sequence time information, and behavior detail information; when the probability of the category belonging to the violation is lower than or equal to the third preset threshold, it means that the probability of the category belonging to the violation is not credible enough, so it cannot be used as a quantitative value for violation penalty. Therefore, the future violation confidence value evaluated according to the future operation behavior sequence, sequence time information, and behavior detail information is directly set to zero.

[0077] In this embodiment, through the feature representation module and classification module of the risk assessment model, relevant features for risk assessment are extracted from the future operation behavior sequence, sequence time information, and behavior detail information, and then the probability of belonging to the category of violation is classified according to it. It can be seen that the features used for risk assessment can be accurately extracted, and then the probabilistic prediction of the violation behavior can be made. Furthermore, by setting the third preset threshold, it is ensured that only when the probability of belonging to the category of violation reaches a certain height, it will be regarded as a credible violation confidence value, thereby ensuring the accuracy and reliability of risk control decisions.

[0078] In a further embodiment, step S1400, when exceeded, correspondingly updating the violation cumulative confidence value and enabling the risk control measures for the user, comprises the following steps:

[0079] Step S1510: iteratively performing a first time decay operation on the violation cumulative confidence value according to a preset first exponential decay coefficient, so that the violation cumulative confidence value gradually decreases as time increases;

[0080] For iteratively performing the first time decay operation on the violation cumulative confidence value, an exemplary formula is as follows:

[0081]

[0082] Where: N(t) is the value of the cumulative confidence value of violations at time t, N(0)=N0 is the initial value of the cumulative confidence value of violations before attenuation, and is also the maximum value when t≥0, and α1 is the first exponential attenuation coefficient.

[0083] The larger the first exponential decay coefficient is, the smaller the violation cumulative confidence value becomes as time goes by, and the shorter the time required for decaying to approach 0. The first exponential decay coefficient can be set as needed by those skilled in the art according to the above formula and the disclosure herein.

[0084] Step S1520: When the cumulative confidence value of violations after the first time decay operation is lower than the first preset threshold, the first time decay operation is terminated, and risk control measures for the user are stopped.

[0085] When the cumulative confidence value of violations gradually decays to below the first preset threshold as time increases, the cumulative confidence value of violations at this time does not meet the conditions for enabling risk control measures for the user. Therefore, the risk control measures for the user are stopped. At the same time, the first time decay operation is terminated to alert the user, so that the cumulative confidence value of violations no longer decays and approaches the first preset threshold.

[0086] In this embodiment, the first exponential decay coefficient is introduced to iteratively decay the cumulative confidence value of violations until the value drops below the preset first threshold, thereby automatically terminating the risk control measures. This mechanism can not only prevent excessive punishment of users, but also effectively safeguard the legitimate rights and interests of users. At the same time, by keeping the cumulative confidence value of violations close to the first threshold, user behavior can be continuously monitored and warned to ensure that users remain alert for a certain period of time to avoid violations again. This dynamic adjustment strategy not only reflects the flexibility and humanity of risk control of user operation behavior, but also improves users' acceptance and cooperation with risk control measures, which helps to build a more harmonious and effective risk management environment.

[0087] In a further embodiment, when the prediction confidence value does not exceed the second preset threshold, or when the sum of the violation cumulative confidence value and the violation update increment does not exceed the first preset threshold, the following steps are included:

[0088] Step S2110: Acquire each operation behavior performed by the user after the current operation behavior sequence and belonging to the same operation behavior sequence as the current operation behavior sequence, construct the operation behavior sequence as an actual operation behavior sequence, and the implementation time interval between each operation behavior in the actual operation behavior sequence meets a preset condition;

[0089] From the logs corresponding to the operation behaviors of all users in the independent station store, collect the operation behaviors performed by the user after the current operation behavior sequence, and sort these operation behaviors in chronological order according to the timestamps associated with each operation behavior. Then, for every two adjacent operation behaviors, calculate the timestamp of the later operation behavior minus the timestamp of the earlier operation behavior to obtain the time interval between the two adjacent operation behaviors, and then determine whether each time interval exceeds a preset time length. When it exceeds the preset time length, the two corresponding adjacent operation behaviors are regarded as not belonging to the same sequence; otherwise, the two corresponding adjacent operation behaviors are regarded as belonging to the same sequence. Further, determine the time interval between the timestamp of the first operation behavior in the sequence that is the first in time and the timestamp of the last operation behavior in the current operation behavior sequence. When the time interval is less than or equal to the preset duration, it means that all the operation behaviors in the sequence that is the first in time and all the operation behaviors in the current operation behavior sequence belong to the same sequence. Thus, all the operation behaviors in the sequence that is the first in time are placed after the last operation behavior in the current operation behavior sequence to form the actual operation behavior sequence; when the time interval exceeds the preset duration, it means that all the operation behaviors in the sequence that is the first in time and all the operation behaviors in the current operation behavior sequence do not belong to the same sequence, and the current operation behavior sequence is directly used as the actual operation behavior sequence. Those skilled in the art can set the preset duration as needed according to the disclosure herein, for example, 30 minutes.

[0090] Step S2120: acquiring sequence time information corresponding to the actual operation behavior sequence and behavior detail information corresponding to each operation behavior, and using the risk assessment model to determine an actual violation confidence value according to the actual operation behavior sequence, sequence time information, and behavior detail information;

[0091] Based on the disclosure of the reasoning process of the risk assessment model in this embodiment, those skilled in the art can flexibly and adaptably implement the training of the risk assessment model to a convergence state, so that it can learn the ability to determine the probability of a category belonging to a violation based on the operation behavior sequence, sequence time information, and behavior detail information.

[0092] The risk assessment model includes a feature representation layer and a classification module. The feature representation layer can be a model suitable for text feature representation in the NLP field, for example, it can be any one or any combination of MLP, RNN, Transformer encoder, BERT, etc., which can be set as needed by technicians in the field. The classification module can be a binary fully connected layer or MLP, which can be set as needed by technicians in the field.

[0093] The sequence time information includes the operation duration corresponding to the actual operation behavior sequence and the time interval between each two adjacent operation behaviors in the actual operation behavior sequence. The operation duration can be obtained by calculating the timestamp of the last operation behavior in the actual operation behavior sequence minus the timestamp of the first operation behavior. The time interval between each two adjacent operation behaviors can be obtained by subtracting the timestamp of the previous operation behavior from the timestamp of the later operation behavior of the two adjacent operation behaviors.

[0094] The behavior detail information corresponding to each operation behavior in the actual operation behavior sequence is presented as behavior-related statistical data. Specifically, if the actual operation behavior sequence includes an operation behavior of the operation type of return, the total number of returns of the user in the independent station store is obtained, otherwise the total number of returns is not obtained; if the actual operation behavior sequence includes an operation behavior of the operation type of purchase, the total number of purchases and the total number of purchased goods of the user in the independent station store are obtained, otherwise the total number of purchases and the total number of purchased goods are not obtained; if the actual operation behavior sequence includes an operation behavior of the operation type of click, the total number of clicks of the user in the independent station store is obtained, otherwise the total number of clicks is not obtained. number; if the actual operation behavior sequence includes an operation behavior of comment type, the total number of words in the user's comment and the total number of comments by the user in the independent station store are obtained, otherwise the total number of words in the comment and the total number of comments are not obtained; if the actual operation behavior sequence includes an operation behavior of search type, the total number of searches by the user in the independent station store are obtained, otherwise the total number of searches is not obtained; if the actual operation behavior sequence includes an operation behavior of like, follow, and share type, the total number of likes, follows, and shares of the user in the independent station store are obtained accordingly, otherwise the total number of likes, follows, and shares are not obtained.

[0095] The feature representation module in the risk assessment model extracts the deep semantic information corresponding to the historical operation behavior sequence, sequence time information, and behavior detail information, and obtains the corresponding risk assessment features that quantify the deep semantic information. The classification module in the risk assessment model classifies and maps the risk assessment features to binary categories, and determines the probability of the first category in the binary category representing violations, that is, the category probability of violations. The binary category includes the first category representing violations and the second category representing non-violations.

[0096] When the probability of the category belonging to the violation exceeds the third preset threshold, it is used as the actual violation confidence value assessed based on the actual operation behavior sequence, sequence time information, and behavior detail information; when the probability of the category belonging to the violation is lower than or equal to the third preset threshold, it means that the probability of the category belonging to the violation is not credible enough and cannot be used as a quantitative value for violation penalty. Therefore, the actual violation confidence value assessed based on the actual operation behavior sequence, sequence time information, and behavior detail information is directly set to zero.

[0097] Step S2130: Update the violation cumulative confidence value using the actual violation confidence value as the violation update increment to obtain the latest violation cumulative confidence value.

[0098] The actual violation confidence value is used as the violation update increment, and the sum of the violation update increment and the violation cumulative confidence value is calculated to obtain the latest violation cumulative confidence value, so as to complete the update of the violation cumulative confidence value.

[0099] In this embodiment, when the preset confidence value does not meet the conditions for predictive confidence, or the cumulative violation confidence value does not meet the conditions for enabling risk control measures for the user, the operation behaviors that follow the current operation behavior sequence and belong to the same sequence are determined, an actual operation behavior sequence is constructed, and the sequence time information corresponding to the actual operation behavior sequence and the behavior detail information corresponding to each operation behavior are obtained. The risk assessment model determines the actual violation confidence value based on the actual operation behavior sequence, the sequence time information, and the behavior detail information, and updates the cumulative violation confidence value with the actual violation confidence value, thereby ensuring real-time monitoring of the user's operation behavior and performing risk assessment.

[0100] In a further embodiment, after step S2130, updating the violation cumulative confidence value with the actual violation confidence value as the violation update increment, the following steps are included:

[0101] Step S2140: after each update of the cumulative violation confidence value, a preset violation description model is used to generate a corresponding violation description text according to the operation behavior sequence and its corresponding behavior detail information on which the update depends, the behavior detail information corresponding to each operation behavior, and the corresponding cumulative violation confidence values ​​before and after the update, the violation update increment and its construction description text;

[0102] It can be understood that, after each update of the cumulative confidence value of violations in history, the operation behavior sequence and its corresponding behavior details information, the behavior details information corresponding to each operation behavior, and the corresponding cumulative confidence values ​​of violations before and after the update, the violation update increments and their construction description texts can be collected in advance as a single training sample, thereby obtaining multiple training samples, and then manually annotating the supervision label of each training sample as the violation description text corresponding to the training sample. A collection of all training samples and their supervision labels constitutes a training set. The violation description text explains why the corresponding user's operation behavior violates the rules based on the content contained in the training sample, and how the corresponding cumulative confidence value of violations is updated. Those skilled in the art can flexibly implement it. The construction description text corresponding to the violation update increment is used to explain how the violation update increment is constructed. Those skilled in the art can set the construction description text according to the disclosure of the relevant embodiments of the present application, and this step will not be repeated.

[0103] A single training sample in the training set and its supervision label are called, and the training sample is input into the large language model. The encoding end in the large language model extracts the deep semantic information of the training sample, and obtains the corresponding text feature vector encoded by the last hidden layer vectorization in the encoding end. The decoding end in the large language model decodes the text feature vector to decode the predicted violation description text. Calling a preset cross entropy loss function, calculating the cross entropy loss value corresponding to the predicted violation description text based on the supervisory label of the training sample, when the cross entropy loss value is less than or equal to a preset threshold, it indicates that the large language model has been trained to a convergence state, so that the training of the large language model can be terminated; when the cross entropy loss value exceeds the preset threshold, the large language model is fine-tuned by LoRA (Low-Rank Adaptation of Large Language Models), thereby implicitly low-rank conversion of the weight matrix, fixing the original parameters of the weight matrix of the model, determining the weight change parameters of the weight matrix of the model according to the cross loss value, adjusting the weight matrix accordingly according to the weight change parameters, and then continuing to call other training samples in the training set and their supervisory labels to iteratively train the large language model until the model is trained to a convergence state, and then using the large language model trained to a convergence state as a violation description model. The preset threshold can be flexibly set by those skilled in the art.

[0104] The large language model is suitable for text processing in the field of NLP. It is pre-trained with an extremely large corpus until convergence, acquires the ability to generate human language, and has a certain degree of accurate text semantic understanding and logical reasoning ability. The selection of the large language model includes OPT, Chinchilla, PaLM, LLaMA, Alpaca, Vicuna, GPT3, GPT3.5, GPT4, etc.

[0105] Step S2150: Send the violation description text to the user.

[0106] After each update of the violation cumulative confidence value, the user can refer to the corresponding violation description text to clarify the reason for the update of the violation cumulative confidence value.

[0107] In this embodiment, after each update of the cumulative confidence value of the violation, a violation description model is used to generate a corresponding violation description text based on the relevant information on which the update depends and sent to the user, thereby improving the user's understanding and acceptance of risk control decisions and enhancing the transparency of risk control results.

[0108] The user operation behavior risk control method of any embodiment of the present application further includes the following steps:

[0109] Step S3110: After the violation cumulative confidence value is updated each time, the continuous time of stopping updating is reset and accumulated;

[0110] The duration of stopping updating is realized by a timer. Whenever the cumulative confidence value of violation is updated, the timer is reset and starts to accumulate the duration. The duration of stopping updating can be obtained by reading the duration counted by the timer.

[0111] Step S3120: when the duration of the stop updating exceeds a fourth preset threshold, iteratively performing a second time decay operation on the violation cumulative confidence value according to a preset second exponential decay coefficient, so that the violation cumulative confidence value gradually decreases as time increases;

[0112] The fourth preset threshold is a preset value used to determine whether the duration of the stop updating is high enough to be considered to enhance the trust in the user, and thus can be used as a value used to measure whether to trigger the reduction of the user's cumulative confidence value of violation. Those skilled in the art can set the fourth preset threshold as needed based on the disclosure herein. The second exponential decay coefficient is determined based on the cumulative confidence value of violation as the initial value, and the initial value gradually decays until the corresponding final target value, and the time required to decay from the initial value to the final target value. The exemplary formula is as follows:

[0113]

[0114] Where: α2 is the second attenuation coefficient, N init The initial value, N finish is the final target value, and m is the time required for the initial value to decay to the final target value.

[0115] For iteratively performing the second time decay operation on the violation cumulative confidence value, an exemplary formula is as follows:

[0116]

[0117] Wherein: N(t) is the value of the violation cumulative confidence value at time t, N(0)=N0 is the initial value, and is also the maximum value when t≥0.

[0118] Step S3130: When the violation cumulative confidence value is updated again, or the violation cumulative confidence value after the second time decay operation meets a preset condition, terminate the second time decay operation.

[0119] When the cumulative confidence value of violations is updated again, it means that the cumulative confidence value of violations is increased at this time, and the corresponding increased trust in the user needs to be stopped and re-established, or when the cumulative confidence value of violations after the second time decay operation decays to the final target value, the cumulative confidence value of violations at this time is regarded as meeting the preset conditions. In this regard, the second time decay operation needs to be terminated, and the cumulative confidence value of violations will no longer be reduced with the increase of time.

[0120] In this embodiment, the impact of the user's violation record is gradually reduced without increasing the user's cumulative violation confidence value for a long time. This not only encourages users to implement compliant operating behaviors, but also reflects positive incentives for improving users' operating behaviors, while maintaining the flexibility and adaptability of risk control measures.

[0121] See also Figure 3, a user operation behavior risk control device provided to meet one of the purposes of the present application is a functional embodiment of the user operation behavior risk control method of the present application. On the other hand, the device is a user operation behavior risk control device provided to meet one of the purposes of the present application, including a data acquisition module, a behavior prediction module, a violation assessment module and a behavior risk control module, wherein the data acquisition module is used to obtain the user's current operation behavior sequence and its corresponding sequence time information, the behavior detail information corresponding to each operation behavior, and the violation cumulative confidence value corresponding to the user's historical operation behavior; the behavior prediction module is used to enable risk control for the user when the violation cumulative confidence value exceeds a first preset threshold. control measures to limit the future operation behavior of the user, otherwise, a preset behavior prediction model is used to determine the future operation behavior sequence and its predicted confidence value according to the current operation behavior sequence; a violation assessment module is used to determine the future violation confidence value according to the future operation behavior sequence, sequence time information, and behavior detail information using a preset risk assessment model when the predicted confidence value exceeds a second preset threshold; a behavior risk control module is used to determine the violation update increment according to the predicted confidence value and the future violation value, and when the sum of the violation cumulative confidence value and the violation update increment exceeds the first preset threshold, the violation cumulative confidence value is reassigned to the sum value, and the risk measures are enabled for the user.

[0122] In a further embodiment, the data acquisition module includes: a set acquisition submodule, which is used to acquire a user operation behavior log set and determine a historical operation behavior set for each user; a sequence determination submodule, which is used to determine at least one historical operation behavior sequence from the historical operation behavior set of each user, and the time interval between each historical operation behavior in the historical operation behavior sequence meets a preset condition; and a model training submodule, which is used to construct a training set based on all historical operation behavior sequences corresponding to each user, and call the training set to train the behavior prediction model to a convergence state.

[0123] In a further embodiment, the violation assessment module includes: a feature extraction submodule, which is used to use the feature representation module in the preset risk assessment model to extract risk assessment features according to the future operation behavior sequence, sequence time information, and behavior detail information; a model classification submodule, which is used to classify the category probability of the violation according to the risk assessment features by the classification module in the risk assessment model; and a probability confirmation submodule, which is used to confirm that the category probability is a future violation confidence value when the category probability of the violation exceeds a third preset threshold.

[0124] In a further embodiment, the behavioral risk control module includes: a first time decay sub-module, which is used to iteratively perform a first time decay operation on the cumulative confidence value of the violation according to a preset first exponential decay coefficient, so that the cumulative confidence value of the violation gradually decreases with time; a measure stopping sub-module, which is used to terminate the first time decay operation and stop enabling risk control measures for the user when the cumulative confidence value of the violation after the first time decay operation is lower than the first preset threshold.

[0125] In a further embodiment, when the predicted confidence value does not exceed the second preset threshold, or when the sum of the cumulative violation confidence value and the violation update increment does not exceed the first preset threshold, it includes: a sequence construction submodule, used to obtain each operation behavior implemented by the user after the current operation behavior sequence and belonging to the same operation behavior sequence as the current operation behavior sequence, and construct the operation behavior sequence as an actual operation behavior sequence, and the implementation time interval between each operation behavior in the actual operation behavior sequence meets the preset conditions; an actual violation submodule, used to obtain the sequence time information corresponding to the actual operation behavior sequence and the behavior detail information corresponding to each operation behavior, and use the risk assessment model to determine the actual violation confidence value according to the actual operation behavior sequence, the sequence time information, and the behavior detail information; a violation update submodule, used to update the cumulative violation confidence value with the actual violation confidence value as the violation update increment to obtain the latest cumulative violation confidence value.

[0126] In a further embodiment, after the violation update submodule, it includes: a text generation submodule, which is used to use a preset violation description model to generate a corresponding violation description text according to the operation behavior sequence and its corresponding behavior detail information on which the update depends, the behavior detail information corresponding to each operation behavior, and the corresponding violation cumulative confidence values ​​before and after the update, the violation update increment and its constructed description text after each update of the violation cumulative confidence value; and a text sending submodule, which is used to send the violation description text to the user.

[0127] The user operation behavior risk control method of any embodiment of the present application also includes: a duration setting submodule, which is used to start resetting and accumulating the duration of stopping updates each time the cumulative confidence value of violations is updated; a second time decay submodule, which is used to iteratively perform a second time decay operation on the cumulative confidence value of violations according to a preset second exponential decay coefficient when the duration of stopping updates exceeds a fourth preset threshold, so that the cumulative confidence value of violations gradually decreases accordingly with the increase of time; an operation stop submodule, which is used to terminate the second time decay operation when the cumulative confidence value of violations is updated again, or when the cumulative confidence value of violations after the second time decay operation meets the preset conditions.

[0128] In order to solve the above technical problems, the present application also provides a computer device. Figure 4 As shown, a schematic diagram of the internal structure of a computer device. The computer device includes a processor, a computer-readable storage medium, a memory, and a network interface connected via a system bus. Among them, the computer-readable storage medium of the computer device stores an operating system, a database, and computer-readable instructions. The database may store a control information sequence. When the computer-readable instructions are executed by the processor, the processor can implement a user operation behavior risk control method. The processor of the computer device is used to provide computing and control capabilities to support the operation of the entire computer device. The memory of the computer device may store computer-readable instructions. When the computer-readable instructions are executed by the processor, the processor can execute the user operation behavior risk control method of the present application. The network interface of the computer device is used to connect and communicate with a terminal. Those skilled in the art can understand that Figure 4 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0129] In this embodiment, the processor is used to execute Figure 3 The memory stores the program code and various data required to execute the above modules or submodules. The network interface is used to transmit data between user terminals or servers. The memory in this embodiment stores the program code and data required to execute all modules / submodules in the user operation behavior risk control device of this application, and the server can call the program code and data of the server to execute the functions of all submodules.

[0130] The present application also provides a storage medium storing computer-readable instructions. When the computer-readable instructions are executed by one or more processors, the one or more processors execute the steps of the user operation behavior risk control method of any embodiment of the present application.

[0131] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments of the present application can be implemented by instructing the relevant hardware through a computer program, and the computer program can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, the aforementioned storage medium can be a computer-readable storage medium such as a disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

[0132] In summary, this application can predict risky user behaviors in advance and restrict them.

[0133] It will be understood by those skilled in the art that the various operations, methods, steps, measures, and schemes in the processes discussed in this application may be alternated, changed, combined, or deleted. Furthermore, other steps, measures, and schemes in the various operations, methods, and processes discussed in this application may also be alternated, changed, rearranged, decomposed, combined, or deleted. Furthermore, the steps, measures, and schemes in the various operations, methods, and processes in the prior art that are open source and in this application may also be alternated, changed, rearranged, decomposed, combined, or deleted.

[0134] The above description is only a partial implementation method of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A user operation behavior risk control method, characterized in that: The steps include: Obtaining the user's current operation behavior sequence and its corresponding sequence time information, the behavior details information corresponding to each operation behavior, and the violation cumulative confidence value corresponding to the user's historical operation behavior; When the cumulative violation confidence value exceeds a first preset threshold, risk control measures are initiated for the user to restrict the user's future operation behavior; otherwise, a preset behavior prediction model is used to determine a future operation behavior sequence and its prediction confidence value based on the current operation behavior sequence; When the prediction confidence value exceeds a second preset threshold, a preset risk assessment model is used to determine a future violation confidence value according to the future operation behavior sequence, sequence time information, and behavior detail information; A violation update increment is determined based on the predicted confidence value and the future violation value. When the sum of the violation cumulative confidence value and the violation update increment exceeds a first preset threshold, the violation cumulative confidence value is reassigned to the sum, and the risk measure is enabled for the user.

2. The user operation behavior risk control method according to claim 1, characterized in that: Before obtaining the user's current operation behavior sequence and its corresponding sequence time information, the behavior detail information corresponding to each operation behavior, and the violation cumulative confidence value corresponding to the user's historical operation behavior, the following steps are included: Obtain the user operation behavior log set and determine the historical operation behavior set of each user; For each user, determining at least one historical operation behavior sequence from the historical operation behavior set of the user, wherein the time interval between each historical operation behavior in the historical operation behavior sequence meets a preset condition; A training set is constructed based on all historical operation behavior sequences corresponding to each user, and the training set is used to train the behavior prediction model until it converges.

3. The user operation behavior risk control method according to claim 1, characterized in that: The preset risk assessment model is used to determine the future violation confidence value according to the future operation behavior sequence, sequence time information, and behavior detail information, including the following steps: Using a feature representation module in a preset risk assessment model to extract risk assessment features according to the future operation behavior sequence, sequence time information, and behavior detail information; The classification module in the risk assessment model classifies the probability of a violation according to the risk assessment feature; When the category probability of the violation exceeds a third preset threshold, the category probability is confirmed as a future violation confidence value.

4. The user operation behavior risk control method according to claim 1, characterized in that: When it exceeds, the cumulative violation confidence value is updated accordingly, and the risk control measures are enabled for the user, and the following steps are included: Iteratively performing a first time decay operation on the violation cumulative confidence value according to a preset first exponential decay coefficient, so that the violation cumulative confidence value gradually decreases accordingly as time increases; When the cumulative confidence value of violations after the first time decay operation is lower than the first preset threshold, the first time decay operation is terminated, and risk control measures for the user are no longer enabled.

5. The user operation behavior risk control method according to claim 1, characterized in that: When the prediction confidence value does not exceed the second preset threshold, or when the sum of the violation cumulative confidence value and the violation update increment does not exceed the first preset threshold, the following steps are included: Acquire each operation behavior performed by the user after the current operation behavior sequence and belonging to the same operation behavior sequence as the current operation behavior sequence, construct the operation behavior sequence as an actual operation behavior sequence, and the implementation time interval between each operation behavior in the actual operation behavior sequence meets a preset condition; Obtaining sequence time information corresponding to the actual operation behavior sequence and behavior detail information corresponding to each operation behavior, and using the risk assessment model to determine an actual violation confidence value according to the actual operation behavior sequence, sequence time information, and behavior detail information; The violation cumulative confidence value is updated using the actual violation confidence value as a violation update increment to obtain a latest violation cumulative confidence value.

6. The user operation behavior risk control method according to claim 5, characterized in that: After the violation cumulative confidence value is updated using the actual violation confidence value as the violation update increment, the following steps are included: After each update of the cumulative confidence value of the violation, a preset violation description model is used to generate a corresponding violation description text according to the operation behavior sequence and its corresponding behavior detail information on which the update depends, the behavior detail information corresponding to each operation behavior, and the corresponding cumulative confidence value of the violation before and after the update, the violation update increment and its construction description text; The violation description text is sent to the user.

7. The user operation behavior risk control method according to any one of claims 1 to 6, characterized in that: The following steps are also included: Each time the violation cumulative confidence value is updated, the duration of stopping updating is reset and accumulated; When the duration of the stop updating exceeds a fourth preset threshold, iteratively performing a second time decay operation on the violation cumulative confidence value according to a preset second exponential decay coefficient, so that the violation cumulative confidence value gradually decreases accordingly as time increases; When the violation cumulative confidence value is updated again, or the violation cumulative confidence value after the second time decay operation meets a preset condition, the second time decay operation is terminated.

8. A user operation behavior risk control device, characterized in that: include: A data acquisition module is used to acquire the user's current operation behavior sequence and its corresponding sequence time information, the behavior details information corresponding to each operation behavior, and the violation cumulative confidence value corresponding to the user's historical operation behavior; A behavior prediction module, configured to enable risk control measures for the user to restrict the user's future operation behavior when the cumulative violation confidence value exceeds a first preset threshold value; otherwise, use a preset behavior prediction model to determine a future operation behavior sequence and its predicted confidence value based on the current operation behavior sequence; A violation assessment module, configured to determine a future violation confidence value based on the future operation behavior sequence, sequence time information, and behavior detail information using a preset risk assessment model when the prediction confidence value exceeds a second preset threshold; The behavioral risk control module is used to determine the violation update increment based on the predicted confidence value and the future violation value. When the sum of the cumulative violation confidence value and the violation update increment exceeds a first preset threshold, the cumulative violation confidence value is reassigned to the sum value, and the risk measure is enabled for the user.

9. A computer device comprising a central processing unit and a memory, characterized in that: The central processing unit is used to call and run the computer program stored in the memory to execute the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: It stores a computer program implemented according to the method described in any one of claims 1 to 7 in the form of computer-readable instructions, and when the computer program is called and executed by a computer, the steps included in the corresponding method are executed.

Images