Malicious buyer identification method and device, equipment and medium

Abstract

The invention relates to a malicious buyer identification method and device, equipment and a medium, and the method comprises the steps: obtaining a to-be-predicted order sample set, the to-be-predicted order sample set comprises order samples of a plurality of payment orders, and the order samples comprise order attribute information; all order samples in the to-be-predicted order sample set are constructed into nodes of a graph structure; according to the order attribute information and a preset association rule, whether the order attribute information of any two nodes in the graph structure meets the association rule is judged, and if yes, edge connection is established between the two nodes; and inputting the graph structure into a pre-trained graph attention neural network model to predict the risk probability that the buyer corresponding to each payment order in the to-be-predicted order sample set is a malicious buyer, and judging whether the corresponding buyer is a malicious buyer or not according to the risk probability. According to the invention, the association information between the orders can be effectively captured, so that the accuracy of identifying whether the buyer corresponding to the order is a malicious buyer or not is improved.

Description

Technical Field

[0001] The present application relates to e-commerce information security technology, and in particular to a method for identifying malicious buyers and its device, equipment, and medium. Background Art

[0002] With the rapid development of e-commerce, online transactions have become an important part of daily consumption. Against this background, the volume of commodity transactions on e-commerce platforms has continued to increase, and the interactions between the two parties have become increasingly frequent. However, the anonymity and convenience of e-commerce platforms have been exploited by some malicious buyers. On e-commerce platforms, malicious buyers place large orders to purchase goods, and then use false complaints, malicious negative reviews, false returns and other means to try to obtain improper benefits. These behaviors have seriously disrupted the normal trading order of e-commerce platforms and damaged the legitimate rights and interests of merchants.

[0003] Existing methods for identifying malicious buyers mainly rely on rule engines and traditional machine learning models. Although these methods can identify some malicious behaviors to a certain extent, they have significant limitations. Rule engines rely on predefined rules and thresholds to identify malicious behaviors, but as malicious behaviors continue to evolve, the cost of updating and maintaining rules is high, and it is difficult to cover more potential malicious behaviors. In addition, traditional machine learning models make predictions based on the characteristics of a single order, but since malicious buyers may implement malicious behaviors through multiple related orders, traditional machine learning models cannot effectively capture the correlation between orders, making it difficult to identify malicious buyer behaviors with clustering characteristics. Summary of the invention

[0004] The primary purpose of the present application is to solve at least one of the above problems and provide a method for identifying malicious buyers and its device, equipment, and medium.

[0005] According to one aspect of the present application, a method for identifying a malicious buyer is provided, comprising the following steps:

[0006] Acquire a sample set of orders to be predicted, wherein the sample set of orders to be predicted includes order samples of multiple payment orders, and the order samples include order unique identifiers, order attribute information, and order feature data;

[0007] Each order sample in the to-be-predicted order sample set is constructed as a node of a graph structure, wherein the order unique identifier in the order sample is used as the unique identifier of the order node, the order feature data is used as the feature vector of the order node, and the order attribute information is used to determine whether there is a relationship between order nodes;

[0008] According to the order attribute information and the preset association rule, it is determined whether the order attribute information of any two nodes in the graph structure satisfies the association rule, and if so, an edge connection is established between the two nodes to form a complete graph structure;

[0009] The graph structure is input into a pre-trained graph attention neural network model to predict the risk probability that the buyer corresponding to each payment order in the sample set of orders to be predicted is a malicious buyer, and whether the corresponding buyer is a malicious buyer is determined based on the risk probability.

[0010] According to another aspect of the present application, a malicious buyer identification device is provided, comprising:

[0011] A sample set acquisition module to be predicted, configured to acquire a sample set of orders to be predicted, wherein the sample set of orders to be predicted includes order samples of multiple payment orders, and the order samples include order unique identifiers, order attribute information, and order feature data;

[0012] A graph structure node construction module, configured to construct each order sample in the to-be-predicted order sample set into a node of a graph structure, wherein the order unique identifier in the order sample is used as the unique identifier of the order node, the order feature data is used as a feature vector of the order node, and the order attribute information is used to determine whether there is a relationship between order nodes;

[0013] A graph structure edge connection module, configured to determine whether the order attribute information of any two nodes in the graph structure satisfies the association rule based on the order attribute information and a preset association rule, and if so, establish an edge connection between the two nodes to form a complete graph structure;

[0014] The risk probability prediction module is configured to input the graph structure into a pre-trained graph attention neural network model to predict the risk probability that the buyer corresponding to each payment order in the sample set of orders to be predicted is a malicious buyer, and determine whether the corresponding buyer is a malicious buyer based on the risk probability.

[0015] According to another aspect of the present application, a malicious buyer identification device is provided, comprising a central processing unit and a memory, wherein the central processing unit is used to call and run a computer program stored in the memory to execute the steps of the malicious buyer identification method described in the present application.

[0016] According to another aspect of the present application, a non-volatile readable storage medium is provided, which stores a computer program implemented according to the malicious buyer identification method in the form of computer-readable instructions, and when the computer program is called and executed by a computer, the steps included in the method are executed.

[0017] The technical solution of this application has many advantages, including but not limited to the following aspects:

[0018] This application captures the correlation between payment orders by constructing a graph structure, which can effectively identify malicious buyer behaviors with clustering characteristics. And by defining association rules, the behavior patterns of malicious buyers can be effectively associated, thereby significantly improving the classification effect of the graph attention neural network model in identifying malicious buyers. The graph attention neural network model takes advantage of the graph neural network to effectively process graph structured data and capture complex relationships and contextual information between nodes. In particular, the graph attention mechanism can dynamically assign differentiated attention weights to the neighboring nodes of each node, so that the graph attention neural network model pays more attention to other nodes that are closely related to the current node when processing. This mechanism significantly enhances the recognition accuracy of the graph attention neural network model for malicious buyer behavior and improves the accuracy of identifying malicious buyers. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 The network architecture corresponding to the exemplary deployment of the malicious buyer risk control system of this application in the e-commerce platform;

[0020] Figure 2 A schematic diagram of a flow chart of an embodiment of a method for identifying malicious buyers of the present application;

[0021] Figure 3 This is a functional block diagram of the malicious buyer identification device of the present application;

[0022] Figure 4 This is a schematic diagram of the structure of a malicious buyer identification device used in this application. DETAILED DESCRIPTION

[0023] See also Figure 1 , the present application proposes an example of a network architecture suitable for an e-commerce platform, including a terminal device 80, a security server 81, and an online transaction server 82. The terminal device 80 can be a smart phone, a personal computer, a laptop, a tablet computer, etc., and a user can trigger a network request through these devices to use various services provided by the online transaction server 82, such as placing an order to purchase a product. When a user executes an order to purchase a product, the terminal device 80 monitors and records the user's order purchase behavior, and encapsulates the data generated by these order purchase behaviors into order samples and sends them to the online transaction server 82 for storage.

[0024] The order sample contains order attribute information related to the event of placing an order to purchase goods, such as order time, buyer unique identifier (such as buyer ID), session unique identifier (such as session ID), buyer's mobile phone number, buyer's email address, order IP, buyer UA, store unique identifier, etc.

[0025] In addition, the order sample also includes order feature data related to the event of placing an order to purchase goods. These order feature data can be divided into dimensions such as order information features, product features of the corresponding goods in the order, order payment behavior features, buyer behavior features, and store behavior features. Among them, order information features include order amount, discount amount, discount rate, order physical cost, logistics cost ratio, order payment method, order transaction currency, and other features, as well as the country of the order IP, the country of the order delivery mobile phone number, and whether the country of the order IP and the country of the order delivery mobile phone number are consistent. The product features of the corresponding goods in the order include the number of goods included in the order, the average price of the order goods, the number of product categories included in the order, and the price of the highest-priced goods in the order. The order payment behavior features mainly process the buried data to obtain the order payment behavior related features, including the total time from order creation to payment completion, the browsing time of the corresponding goods before order creation, the number of browsing times of the corresponding goods in the order, and the total time from the start of order payment to the end of payment. Buyer behavior features mainly refer to the number of orders, number of completed payment orders, number of cancelled payment orders, number of complaint orders, etc. for the same buyer in different time slices. It should be noted that the order purchase behaviors executed by the same buyer ID, the same mobile phone number, the same delivery email address, and the same device fingerprint are all classified as the order purchase behaviors executed by the same buyer. Store behavior features are the features of the store to which the order belongs, such as the store's transaction features, the store's on-shelf and off-shelf features, etc. Store behavior features are mainly used to distinguish whether the order anomaly comes from the merchant (i.e., the seller) or the customer (i.e., the buyer).

[0026] The order sample also includes a unique order identifier, such as an order ID, and malicious buyer tag data corresponding to a malicious buyer. These malicious buyer tag data can be marked through feedback from merchants with excellent performance in the e-commerce platform, or can be obtained through prediction by the graph attention neural network model trained by the present application, and the malicious buyer tag data corresponding to each payment order is encapsulated in the order sample and stored in the database of the online transaction server 82.

[0027] The security server 81, as the main executor of the malicious buyer risk control system of the present application, adopts the graph attention neural network model algorithm, and effectively identifies malicious buyer behaviors with aggregation characteristics by learning the association relationship information between payment orders. In this typical embodiment, the security server 81 obtains the sample set of orders to be predicted by accessing the database in the online transaction server 82, and constructs the order samples in the sample set to be predicted as nodes of the graph structure. Then, according to the order attribute information and the preset association rules, it is judged whether the order attribute information of any two nodes in the graph structure meets the association rules. If so, an edge connection is established between the two nodes to form a complete graph structure. Then, the constructed graph structure is input into the pre-trained graph attention neural network model to predict the risk probability that the buyer corresponding to each payment order in the sample set of orders to be predicted is a malicious buyer, and whether the corresponding buyer is a malicious buyer is judged according to the risk probability.

[0028] In one embodiment, if the buyer is determined to be a malicious buyer, the security server 81 will obtain the buyer's corresponding complaint information to be predicted and input it into a pre-trained neural network model to determine whether the buyer's complaint behavior is a malicious complaint. If it is determined to be a malicious complaint, the buyer will be determined as a high-risk malicious buyer.

[0029] In another embodiment, the security server 81 also periodically obtains the evaluation order sample set and inputs it into the graph attention neural network model to verify whether the prediction accuracy of the graph attention neural network model is within a preset threshold range. If not, that is, the prediction effect of the graph attention neural network model decreases, the evaluation order sample set and the training order sample set are merged, and a new graph attention neural network model is retrained to improve the accuracy and reliability of the prediction.

[0030] In another embodiment, when the buyer is confirmed to be a high-risk malicious buyer, the security server 81 will call the large language model to generate a malicious behavior report corresponding to the payment order based on the order attribute information and order feature data of the buyer's corresponding payment order. Then iterate the above malicious behavior report generation event until the number of malicious behavior reports generated exceeds the preset report number threshold, wherein the report number threshold is preset by a technician in this field as needed. Then call the large language model to generate corresponding malicious behavior regulations based on the generated malicious behavior report, wherein the malicious behavior regulations include multiple malicious behavior details. When the malicious behavior details exceed the preset detail number threshold, the large language model can be used to predict the sample set of orders to be predicted, and it can be determined whether the buyers corresponding to each payment order in the sample set of orders to be predicted are malicious buyers.

[0031] The malicious buyer identification method of the present application can be implemented as a computer program product through programming and implanted into the malicious buyer risk control system. When the malicious buyer risk control system predicts that the buyer corresponding to the payment order is a malicious buyer, risk control and authority restriction processing can be implemented on it. Of course, it can also be handed over to a manual management user for further manual review and confirmation before risk control and authority restriction processing is implemented.

[0032] See also Figure 2 According to a malicious buyer identification method provided by the present application, in one embodiment, the method comprises the following steps:

[0033] Step S5100: obtaining a sample set of orders to be predicted, wherein the sample set of orders to be predicted includes order samples of multiple payment orders, and the order samples include order unique identifiers, order attribute information, and order feature data;

[0034] In the daily operation of e-commerce platforms, a large number of transactions occur every day, and a large number of new orders are constantly generated. Buyers access the online transaction server through terminal devices and place orders to purchase goods on the online transaction server. At this time, the online transaction server triggers a payment order generation event, and uses the order unique identifier, order attribute information, and order feature data of the corresponding payment order generated by the order purchase behavior as the order sample of the payment order, and sends each order sample to the online transaction server for storage. In order to effectively identify potential malicious buyers, the malicious buyer risk control system will respond to the malicious buyer identification event and initiate a request to the online transaction server to obtain a sample set of orders to be predicted. The request can set a specific time period or sample quantity to obtain a sample set of orders to be predicted within a specific time period or a specific sample quantity. Among them, the specific time period and sample quantity are set by technicians in this field based on business experience or data exploration.

[0035] The sample set of orders to be predicted obtained by the malicious buyer risk control system includes order samples of multiple payment orders, wherein the order sample includes an order unique identifier, which is used to distinguish and track each independent payment order. In addition, the order sample also includes order attribute information, which is used to determine whether there is a correlation between payment order nodes. In previous malicious buyer identification events, the payment orders generated by malicious buyers' order purchase behavior are usually not isolated, but the same buyer places multiple orders in the same store on the same e-commerce platform, and then initiates a large number of malicious negative reviews, malicious complaints, malicious returns, etc. at one time. It should be noted that the order purchase behavior executed by the same buyer ID, the same mobile phone number, the same delivery email address, and the same device fingerprint are all classified as the order purchase behavior executed by the same buyer. That is, the payment orders generated by the same buyer when executing the order purchase behavior are often related. These correlations can be identified by the buyer's unique identifier, contact information (such as mobile phone number and email address), device fingerprint, order IP address, and order time in the order attribute information. Specifically, if the buyer's unique identifier of multiple payment orders is the same, or the contact information, device fingerprint, ordering IP address are the same, and the order time interval is short, then these payment orders are judged to be initiated by the same buyer, and thus have a high correlation. This correlation can help identify malicious buyer behaviors with clustering characteristics, because malicious buyers usually place multiple orders in a short period of time, and then initiate malicious negative reviews, malicious complaints, or malicious returns to the same store to achieve their purpose of performing malicious behaviors. By analyzing the correlation between these payment orders, it is possible to more effectively identify and prevent the behavior of malicious buyers and protect the interests of merchants and e-commerce platforms. Using this feature, in-depth analysis of order attribute information is performed to identify potential association patterns, providing rich contextual information for subsequent graph attention neural network models to train more accurate graph attention neural network models, thereby effectively predicting and combating the behavior of malicious buyers.

[0036] The order sample also includes order feature data, where the order feature data includes order information features, including order amount, discount amount, discount rate, order logistics cost, logistics cost ratio, order payment method, order transaction currency and other features, as well as the country of the order placing IP, the country of the order receiving mobile phone number, whether the country of the order placing IP and the country of the order receiving mobile phone number are consistent, etc. The correlation between payment orders is analyzed based on the order information features. For example, if the logistics cost ratios of multiple payment orders are similar, especially if they are initiated by the same buyer in a short period of time, that is, malicious buyers will use the same logistics strategy to place multiple orders in a short period of time, and then engage in improper behaviors such as malicious bad reviews on these payment orders. The order feature data also includes the product features of the products corresponding to the order. The product features of the products corresponding to the order include the number of products included in the order, the average price of the products in the order, the number of product categories included in the order, the price of the product with the highest price in the order, etc. The correlation between payment orders is analyzed based on the product features of the products corresponding to the order. For example, if multiple orders contain a similar number of product categories, especially if they are initiated by the same buyer within a short period of time, that is, malicious buyers will concentrate on purchasing the same or similar products within a short period of time, and then initiate malicious bad reviews, malicious complaints or malicious returns, etc., in order to achieve the purpose of performing malicious acts.

[0037] The order sample also includes order feature data, wherein the order feature data also includes order payment behavior features, which include the total time from order creation to payment completion, the browsing time of the corresponding product before order creation, the number of browsing times of the corresponding product of the order, and the total time from the start of order payment to the end of payment. The correlation between payment orders is analyzed based on the order payment behavior features. For example, if the browsing time of the corresponding product before order creation and the number of browsing times of the corresponding product of the order are similar for multiple orders, especially if they are initiated by the same buyer in a short period of time, there is a correlation between these payment orders. Malicious buyers will browse the same or similar products in a short period of time and then quickly place orders to achieve the purpose of performing malicious behaviors. The order feature data also includes buyer behavior features, which include mainly the number of orders for the same buyer in different time slices, the number of order payments completed, the number of cancelled payment orders, and the number of complaint orders. The correlation between payment orders is analyzed based on the buyer behavior features. For example, if the same buyer frequently complains in a short period of time, especially if he complains about the same or similar products multiple times in a short period of time, it is determined that there is a correlation between these payment orders. Malicious buyers make multiple complaints in a short period of time to achieve the purpose of performing malicious behaviors. The order feature data also includes store behavior features, which include store transaction features, store listing and delisting features, etc. The store behavior features are mainly used to distinguish whether the payment order anomaly comes from the merchant (i.e., seller) or the customer (i.e., buyer). By analyzing order samples, malicious buyer behaviors with clustering characteristics can be identified, so as to more effectively identify and prevent malicious buyer behaviors, protect the interests of merchants and e-commerce platforms, and provide rich contextual information for subsequent graph attention neural network models to train more accurate graph attention neural network models.

[0038] Step S5200: construct each order sample in the to-be-predicted order sample set into a node of a graph structure, wherein the order unique identifier in the order sample is used as the unique identifier of the order node, the order feature data is used as a feature vector of the order node, and the order attribute information is used to determine whether there is a correlation between order nodes;

[0039] The graph structure can effectively capture the correlation between each payment order in the sample set of orders to be predicted, such as the same buyer placing multiple orders in a short period of time, using the same contact information and device fingerprints to place orders, etc. These correlations are difficult to represent and process in traditional linear data structures, but can be represented and analyzed in the graph structure. In addition, the order attribute information and order feature data are imported into the graph structure, which provides rich contextual information for the subsequent graph attention neural network model, and helps the graph attention neural network model to more accurately predict malicious buyers. By constructing a graph structure, the order attribute information and order feature data in the order sample can be integrated, thereby improving the efficiency of data analysis.

[0040] In the process of building the graph structure, each order sample in the set of order samples to be predicted is first regarded as a node in the graph structure. The order unique identifier of each order sample is used as the unique identifier of the node to ensure that each node is unique in the graph structure. At the same time, the order feature data in the order sample is converted into the feature vector of the node. These feature vectors include feature data of dimensions such as order information features, product features of the corresponding products of the order, order payment behavior features, buyer behavior features, and store behavior features. These feature vectors provide rich contextual information for the subsequent graph attention neural network model.

[0041] When constructing the graph structure, the order attribute information in the order sample is used to determine whether there is a correlation between the payment order nodes. For example, by analyzing the buyer's unique identifier, contact information (such as mobile phone number and email address), device fingerprint, order IP address, and order time, the associated order nodes can be identified. Specifically, if the buyer's unique identifier of multiple payment orders is the same, or the contact information, device fingerprint, order IP address are the same, and the order time interval is short, then these payment orders are determined to be initiated by the same buyer, and thus have a high correlation. By constructing a graph structure, the order attribute information in the order sample can be used to determine whether there is a correlation between the order nodes. This correlation can help identify malicious buyer behaviors with clustering characteristics, because malicious buyers usually place multiple orders in a short period of time, and then initiate malicious behaviors such as malicious bad reviews, malicious complaints, or malicious returns.

[0042] Step S5300: According to the order attribute information and the preset association rule, determine whether the order attribute information of any two nodes in the graph structure satisfies the association rule; if so, establish an edge connection between the two nodes to form a complete graph structure.

[0043] In the process of constructing the graph structure, it is first necessary to determine whether the order attribute information of any two nodes in the graph structure meets the association rule based on the order attribute information and the preset association rules. Specifically, by analyzing the attribute information such as the buyer's unique identifier, contact information (such as mobile phone number and email address), device fingerprint, order IP address, and order time, the order nodes with association can be identified. For example, if the buyer's unique identifier of multiple payment orders is the same, or the session unique identifier, contact information, device fingerprint, order IP address are the same, and the order time interval is short, then these payment orders will be judged to be initiated by the same buyer, and thus have a high association. In this case, if the order attribute information between these payment order nodes meets the preset association rules, edge connections are established between these nodes to form a complete graph structure. Among them, the association rules are preset based on the analysis of historical malicious buyer identification events and business experience summary. In this way, the correlation between payment orders can be effectively captured, providing strong support for subsequent malicious buyer identification.

[0044] First, the malicious buyer risk control system will compare the order attribute information of any two nodes in the graph structure one by one to determine whether the preset association rules are met. In one embodiment, the association rules may include one or more of the following: the malicious buyer risk control system will check whether the buyer's unique identifier, session unique identifier or contact information (such as mobile phone number and email address) of the two nodes are the same. If they are the same, it means that the two payment orders are initiated by the same buyer, and thus have a high correlation; the malicious buyer risk control system calculates whether the similarity between the email information between any two nodes exceeds the preset similarity threshold. If it exceeds and the payment time interval between the payment orders of the two nodes does not exceed the preset time threshold, an edge connection can be established between the two nodes, wherein the similarity calculation can adopt a variety of methods, such as string similarity calculation, cosine similarity calculation, etc.; the malicious buyer risk control system detects whether the order IP addresses between any two nodes are the same and the payment time interval between the payment orders of the two nodes does not exceed the preset time threshold, and establishes an edge connection between the two nodes; the malicious buyer risk control system detects whether the buyer UA between any two nodes is the same and the payment time interval between the payment orders of the two nodes does not exceed the preset time threshold, and establishes an edge connection between the two nodes, indicating that there is a strong correlation between the two nodes;

[0045] Association rules determine the topology of the graph structure, that is, the connection between nodes. A good topology can better reflect the true association between order samples, thereby improving the training effect of the graph attention neural network model. Through association rules, a graph structure with local clustering can be constructed, so that the graph attention neural network model can better capture this clustering.

[0046] In this way, the malicious buyer risk control system can determine whether the order attribute information of any two nodes in the graph structure meets the association rules based on the order attribute information and the preset association rules, and establish edge connections between the nodes that meet the association rules, thereby constructing a complete graph structure. This graph structure not only contains the order sample information of the payment order, but also reveals the potential correlation between the payment orders, providing rich contextual information for the subsequent graph attention neural network model to train a more accurate graph attention neural network model, thereby effectively predicting and combating the behavior of malicious buyers.

[0047] Step S5400: input the graph structure into a pre-trained graph attention neural network model to predict the risk probability that the buyer corresponding to each payment order in the sample set of orders to be predicted is a malicious buyer, and determine whether the corresponding buyer is a malicious buyer based on the risk probability.

[0048] After the graph structure is constructed, the graph structure is input into the pre-trained graph attention neural network model to predict the risk probability that the buyer of each payment order in the predicted order sample set is a malicious buyer. The graph attention neural network model is a deep learning model based on graph neural network, which is suitable for processing graph structure data and can effectively capture the complex relationships and contextual information between nodes.

[0049] First, the constructed graph structure is input into the pre-trained graph attention neural network model. The graph attention neural network model has been trained with a large amount of historical order sample data, and can learn the patterns and characteristics of malicious buyer behavior. For the specific training steps, please refer to the subsequent specific implementation method, which will not be repeated here. When inputting the graph structure, the graph attention neural network model will first extract features for each node in the graph (i.e., order sample), and use the node's own feature vector and the feature vector of its neighboring nodes to calculate the node's representation. In this process, the graph attention mechanism can dynamically assign different attention weights to each node's neighboring nodes, thereby better capturing the correlation and importance between nodes.

[0050] After feature extraction is completed, the graph attention neural network model will further aggregate and update the node representation through a multi-layer attention mechanism, and gradually extract higher-level feature representations. These feature representations not only contain the order unique identifier, order attribute information, and order feature data, but also contain the correlation and context information between payment orders, so as to more accurately reflect the characteristics of malicious buyer behavior. Then the graph attention neural network model will input the final node representation into the classifier to predict the risk probability that the buyer corresponding to each payment order is a malicious buyer. The classifier uses a softmax function or other probability output function to map the node representation to a probability value, indicating the possibility that the buyer corresponding to the payment order is a malicious buyer. The obtained risk probability value can intuitively reflect the potential risk level of each payment order.

[0051] Finally, based on the predicted risk probability, the buyer corresponding to each payment order in the predicted order sample set can be judged. In one embodiment, a risk threshold is set. When the risk probability of a payment order exceeds the threshold, the buyer corresponding to the payment order is judged to be a malicious buyer. This judgment result can be used for subsequent risk control and prevention measures, such as manual review of predicted malicious buyers, restricting the purchase behavior of malicious buyers, etc., so as to effectively protect the interests of merchants and e-commerce platforms. Through this step, the graph attention neural network model can make full use of the rich information in the graph structure, accurately predict the risk probability of malicious buyers, and provide e-commerce platforms with powerful risk identification and prevention measures.

[0052] It can be known from the typical embodiments of the present application that the technical solution of the present application has many advantages, including but not limited to the following aspects:

[0053] This application captures the correlation between payment orders by constructing a graph structure, effectively identifying malicious buyer behaviors with clustering characteristics. In the dynamic transaction environment of e-commerce platforms, malicious buyers often use multiple related payment orders to perform malicious behaviors in a short period of time. By constructing a graph structure, this application not only reveals the potential connections between payment orders, but also defines association rules based on multiple order attribute information, which can effectively associate the behavior patterns of most malicious buyers, thereby significantly improving the classification effect of the graph attention neural network model in identifying malicious buyers.

[0054] In addition, the present application uses in-depth order feature data to characterize the feature portrait of payment orders from multiple dimensions. This multi-angle feature extraction provides rich contextual information for the graph attention neural network model, enabling the model to capture the behavioral characteristics of malicious buyers from different aspects, further improving the recognition ability and classification accuracy of the graph attention neural network model. Furthermore, the graph attention neural network model takes advantage of the graph neural network to effectively process graph structure data and capture complex relationships and contextual information between nodes. In particular, the graph attention mechanism can dynamically assign differentiated attention weights to the neighboring nodes of each node, so that the graph attention neural network model pays more attention to other nodes that are closely related to the current node when processing. This mechanism significantly enhances the recognition accuracy of the graph attention neural network model for malicious buyer behavior, especially when faced with malicious buyers who perform complex operations through multiple payment orders, and can accurately identify their behavior patterns.

[0055] In general, this application not only improves the accuracy and efficiency of identifying malicious buyers, but also can adapt to changes in malicious behavior patterns, providing strong technical support for risk management and decision-making of e-commerce platforms, effectively safeguarding the interests of merchants and e-commerce platforms, and ensuring a healthy trading environment for e-commerce platforms.

[0056] On the basis of any embodiment of the method of the present application, after determining whether the corresponding buyer is a malicious buyer according to the risk probability, the method includes:

[0057] Step S6100: if the buyer is determined to be a malicious buyer, obtain the corresponding complaint information to be predicted of the buyer;

[0058] After completing the judgment on whether a buyer is a malicious buyer, if a buyer is determined to be a malicious buyer, the malicious buyer risk control system obtains the buyer's corresponding complaint information as the complaint information to be predicted. The purpose of this step is to deeply analyze the buyer's complaint behavior to determine whether the complaint is a malicious complaint, so as to further identify whether the buyer is a malicious buyer and improve the accuracy and reliability of malicious buyer identification.

[0059] In one embodiment, the malicious buyer risk control system will extract all complaint information related to the buyer from the database of the online transaction server based on the unique order identifier of the malicious buyer. Such complaint information includes but is not limited to the time of the complaint, the content of the complaint, the object of the complaint (such as the merchant, the product, etc.), the processing status of the complaint, etc. By obtaining such detailed complaint information, sufficient data support can be provided for the subsequent malicious complaint judgment.

[0060] In another embodiment, in the process of obtaining complaint information, the malicious buyer risk control system will preliminarily screen and organize the complaint information according to preset rules and algorithms. For example, the malicious buyer risk control system will filter out some invalid or repeated complaint information to ensure the accuracy and efficiency of the analysis. At the same time, the malicious buyer risk control system will also classify and label the complaint information so that the subsequent neural network model can better understand and process this data. In addition, the malicious buyer risk control system combines the buyer's historical behavior data, such as historical complaint records, historical purchase records, historical evaluation records, etc., to further enrich the dimensions of the complaint information to be predicted. These historical behavior data can help the model understand the buyer's behavior patterns and potential risks more comprehensively, thereby improving the accuracy of malicious complaint judgments.

[0061] Step S6200: input the complaint information to be predicted into a pre-trained neural network model to determine whether the buyer's complaint behavior is a malicious complaint. If it is determined to be a malicious complaint, the buyer is determined to be a high-risk malicious buyer;

[0062] After obtaining the corresponding complaint information to be predicted of the malicious buyer, the complaint information to be predicted is input into the pre-trained neural network model to determine whether the buyer's complaint behavior is a malicious complaint. For the training of the neural network model, please refer to the subsequent specific implementation method, which will not be repeated here. This step further screens and confirms the malicious buyers determined in step S5400 to improve the accuracy and reliability of malicious buyer identification, so as to take corresponding risk control measures.

[0063] The complaint information to be predicted is input into the pre-trained neural network model. The neural network model will first extract features from the complaint information and use various features in the complaint information, such as the time of the complaint, the content of the complaint, the object of the complaint, the processing status of the complaint, etc., to calculate the representation of the complaint behavior. After the feature extraction is completed, the neural network model will further aggregate and update the representation of the complaint behavior through a multi-layer neural network, and gradually extract higher-level feature representations. Then the neural network model will input the final complaint behavior representation into the classifier to predict whether the buyer's complaint behavior is a malicious complaint. The classifier maps the complaint behavior representation to a probability value, indicating the possibility that the complaint behavior is a malicious complaint. These probability values ​​can intuitively reflect the potential risk level of each complaint behavior. Finally, the complaint behavior can be judged based on the predicted probability value. Set a risk threshold. When the probability value of a complaint behavior exceeds the threshold, the complaint behavior is judged to be a malicious complaint. If a buyer's complaint behavior is judged to be a malicious complaint, the buyer is judged to be a high-risk malicious buyer. Through this step, the neural network model can make full use of complaint information, accurately predict malicious complaint behavior, and further confirm whether the buyers among the initially identified malicious buyers are high-risk malicious buyers, providing e-commerce platforms with powerful risk identification and prevention measures.

[0064] In one embodiment, if a buyer is determined to be a malicious buyer, the malicious behavior of the buyer is further confirmed by obtaining the buyer's evaluation information of the goods purchased. Specifically, after completing the preliminary judgment on whether the buyer is a malicious buyer, if a buyer is determined to be a malicious buyer, the malicious buyer risk control system will further obtain the buyer's evaluation information of the goods purchased by the buyer to deeply analyze the buyer's evaluation behavior and determine whether the evaluation is a malicious evaluation. The purpose of this step is to further screen and confirm the list of malicious buyers initially determined, so as to improve the accuracy and reliability of malicious buyer identification.

[0065] In another embodiment, after completing the preliminary judgment on whether a buyer is a malicious buyer, if a buyer is determined to be a malicious buyer, the malicious buyer risk control system will further obtain the malicious return information of the buyer to deeply analyze the buyer's return behavior and determine whether the return is a malicious return.

[0066] In one exemplary example of this embodiment, the malicious buyer risk control system will extract all return information related to the buyer from the database of the online transaction server based on the unique order identifier of the malicious buyer. This return information includes but is not limited to the time of return, reason for return, returned goods, return processing status, etc. Then the malicious buyer risk control system will analyze the return information according to the preset malicious return judgment rules. These rules may include but are not limited to the following:

[0067] If a buyer frequently returns goods in a short period of time, especially if he returns the same or similar goods multiple times in a short period of time, it is determined that there is a correlation between these return behaviors. Malicious buyers usually make multiple returns in a short period of time to achieve their malicious behavior.

[0068] If a buyer's return reasons are mostly "product quality issues" or "product does not match description", but the product provided by the merchant is of good quality and the description is accurate, then these returns are determined to be malicious returns. Malicious buyers usually make up false return reasons to achieve their malicious return purposes.

[0069] If a buyer returns mostly high-value or popular items, and the return time is short compared to the purchase time, it is determined that these returns may be malicious returns. Malicious buyers usually choose high-value or popular items for malicious returns to maximize the benefits of their malicious behavior.

[0070] If the return status of a buyer is mostly "refunded" or "returned", but the merchant has not received the returned goods or the returned goods are obviously damaged, these returns are determined to be malicious returns. Malicious buyers usually deliberately damage the goods or do not send them back during the return process in order to achieve their malicious return purposes.

[0071] Through these rules, the malicious buyer risk control system can conduct a detailed analysis of the return information to determine whether it is a malicious return. If a buyer's return behavior is determined to be a malicious return, the buyer is further confirmed to be a high-risk malicious buyer. This judgment result can be used for subsequent risk control and prevention measures, such as stricter monitoring of high-risk malicious buyers, restricting their purchase behavior, and even banning their accounts, thereby effectively protecting the interests of merchants and e-commerce platforms.

[0072] In this embodiment, by obtaining the complaint information to be predicted of malicious buyers and inputting it into the pre-trained neural network model, it is determined whether their complaint behavior is a malicious complaint, thereby further refining the list of malicious buyers initially determined to be high-risk malicious buyers. This multi-level and multi-dimensional analysis method improves the accuracy and reliability of malicious buyer identification and provides e-commerce platforms with more powerful risk identification and prevention methods.

[0073] Based on any embodiment of the method of the present application, if the buyer is determined to be a malicious buyer, before obtaining the corresponding complaint information to be predicted of the buyer, the following steps are included:

[0074] Step S6010: Obtain a complaint information sample set, where the complaint information sample set includes a plurality of complaint information and corresponding malicious complaint label data indicating whether the complaint is a malicious complaint;

[0075] After purchasing goods on an e-commerce platform, if the buyer is not satisfied with the goods or services, he can submit a complaint message through the complaint channel provided by the e-commerce platform, and the submitted complaint message will be stored in the database of the e-commerce platform. In this step, the malicious buyer risk control system will extract a sample set of complaint information consisting of complaint information within a specific time period or a specific number of complaint information and its corresponding malicious complaint label data that characterizes whether it is a malicious complaint from the database of the e-commerce platform. Among them, the malicious complaint label data is used to characterize whether the complaint information is a malicious complaint. Specifically, if a complaint information is determined to be a malicious complaint, it is marked as "malicious complaint"; otherwise, it is marked as "non-malicious complaint". These malicious complaint label data will be used as supervisory signals for subsequent training of the neural network model, so that the neural network model can learn the patterns and characteristics of malicious complaint behavior.

[0076] Step S6011: input the complaint information sample set into a pre-trained neural network model, and use the malicious complaint label data of the multiple complaint information to perform supervised training, so as to train the neural network model to a convergence state.

[0077] In this step, the malicious buyer risk control system will perform data preprocessing on the complaint information sample set. This step includes feature extraction and feature encoding. Feature extraction involves extracting key features from each complaint information, such as the time of the complaint, the content of the complaint (such as text content, keywords, etc.), the object of the complaint (such as merchants, products, etc.), the processing status of the complaint (such as processed, unprocessed, etc.), etc. Feature encoding converts these extracted features into numerical form so that the neural network model can process them. For example, text content can be converted into vector representation through word embedding technology, and time information can be converted into numerical representation through timestamp.

[0078] The malicious buyer risk control system will divide the complaint information sample set into training set, validation set and test set. The training set is used to train the model, the validation set is used to adjust the model hyperparameters, and the test set is used to finally evaluate the model performance. After the data preprocessing is completed, the malicious buyer risk control system will select a suitable neural network model architecture, such as a multi-layer perceptron (MLP), convolutional neural network (CNN) or recurrent neural network (RNN). Select a suitable model based on the characteristics of the complaint information. Then, randomly initialize the weight parameters of the neural network model. Normal distribution or uniform distribution is usually used for initialization.

[0079] At the beginning of the training process, the malicious buyer risk control system will input each complaint information feature vector in the training set into the neural network model and calculate the prediction result of each complaint information through forward propagation. The prediction result can be a probability value, indicating the possibility that the complaint information is a malicious complaint. Next, the loss between the prediction result and the true label is calculated. Commonly used loss functions include cross-entropy loss, which is suitable for classification problems. Through the back-propagation algorithm, the malicious buyer risk control system will calculate the gradient of the loss function for each weight parameter and adjust the weight parameters in the neural network model according to the gradient to minimize the prediction error. This process will be repeated until the prediction error of the neural network model reaches a preset threshold or the number of training times reaches a preset upper limit. At this point, the neural network model is considered to have converged and can accurately predict whether the complaint information is a malicious complaint. During the training process, the malicious buyer risk control system will use the validation set to monitor the performance of the model and adjust the model's hyperparameters, such as learning rate, batch size, etc., based on the performance of the validation set. Finally, the trained model is evaluated using the test set to ensure that the model performs well on unseen data.

[0080] In this embodiment, by obtaining a sample set of complaint information and using its malicious complaint label data for supervised training, the neural network model is trained to a convergence state, thereby achieving accurate identification of malicious complaint behavior. In this way, the neural network model can learn the patterns and characteristics of malicious complaint behavior, providing strong support for subsequent malicious complaint judgments.

[0081] Based on any embodiment of the method of the present application, before obtaining the sample set of orders to be predicted, the method includes:

[0082] Step S5001, obtaining a training order sample set, wherein the training order sample set includes a plurality of order samples, and the order samples include an order unique identifier, order attribute information, order feature data, and malicious buyer label data corresponding to whether the order is a malicious buyer;

[0083] The malicious buyer risk control system extracts historical payment order samples within a specific time period or a specific number from the database of the e-commerce platform as a training order sample set. The training order sample set includes multiple order samples, and the order samples include an order unique identifier, order attribute information, and malicious buyer label data corresponding to whether it is a malicious buyer. These malicious buyer label data are used to characterize whether the buyer corresponding to the order sample is a malicious buyer. Specifically, if an order sample is determined to be a malicious buyer, it is marked as a "malicious buyer"; otherwise, it is marked as a "non-malicious buyer." These malicious buyer label data will be used as supervisory signals for subsequent training of the graph attention neural network model, so that the model can learn the patterns and characteristics of malicious buyer behavior.

[0084] By obtaining training order sample sets, the malicious buyer risk control system can provide sufficient data support for the graph attention neural network model, ensuring that the model can accurately identify malicious buyers during the training process, thereby improving the security and user experience of the e-commerce platform.

[0085] Step S5010: construct the training order sample set into a graph structure for training a graph attention neural network model, wherein order samples in the training order sample set are constructed as nodes of the graph structure;

[0086] After obtaining the training order sample set, the malicious buyer risk control system will construct the training order sample set into a graph structure for training the graph attention neural network model. The construction of the graph structure can more effectively capture the correlation and contextual information between order samples, thereby improving the training effect and prediction accuracy of the graph attention neural network model. In the e-commerce platform, the ordering behavior of malicious buyers is often not isolated, and there is a strong correlation between the generated payment orders. By constructing a graph structure, the order attribute information in the order sample can be used to determine whether there is a correlation between the payment order nodes, so as to more effectively identify and prevent the behavior of malicious buyers. The order feature data in the order sample provides rich contextual information for the graph attention neural network model. By constructing a graph structure, these feature data can be integrated into the nodes, so that the model can better understand and process these data.

[0087] Step S5011: input the graph structure into the graph attention neural network model, use the malicious buyer label data as the supervision label, and train the graph attention neural network model to a convergence state.

[0088] The graph structure is input into the graph attention neural network model for training. During the training process, the graph attention neural network model gradually adjusts its internal parameters according to the input graph structure to optimize the performance of the model. Specifically, the graph attention neural network model calculates the correlation between each order node and assigns attention weights based on these correlations to better capture the complex relationship between order samples. The attention mechanism allows the graph attention neural network model to dynamically pay attention to other nodes with high correlation when processing each node, thereby improving the expressiveness of the model.

[0089] The graph attention neural network model will also use the order feature data in the order samples to further enrich the representation of the nodes, so that the model can understand and process these data more comprehensively. These order feature data will be integrated into the nodes and processed by the graph attention neural network model. In order to ensure the effectiveness of the training process, the malicious buyer risk control system will use the malicious buyer label data as a supervisory label to guide the training of the model. In each iteration, the graph attention neural network model will calculate the error (loss) between the predicted result and the actual label based on these malicious buyer label data. Commonly used loss functions include the cross entropy loss function, which can effectively measure the difference between the model prediction result and the actual label. Through the back propagation algorithm, the gradient of the loss function to the network parameters is calculated, and the network parameters are adjusted according to the gradient to minimize the loss. The back propagation algorithm is an efficient parameter update method that calculates the contribution of each parameter to the final loss through the chain rule and adjusts the parameters according to these contributions. This process will be repeated until the performance of the model reaches the preset convergence standard, that is, the performance of the model on the training data tends to be stable and the error is within an acceptable range.

[0090] Use optimization algorithms (such as Adam, SGD, etc.) to update network parameters so that the graph attention neural network model is gradually optimized in each iteration. The choice of optimization algorithm has an important impact on the efficiency of the training process and the performance of the final model. The Adam algorithm combines the ideas of momentum method and adaptive learning rate, and can dynamically adjust the learning rate during training, thereby accelerating convergence and improving the stability of the model.

[0091] After each iteration, check whether the performance of the graph attention neural network model reaches the preset convergence standard. If the loss of the graph attention neural network model no longer decreases significantly, or reaches the preset number of iterations, the graph attention neural network model is considered to have converged. The convergence state can be judged based on the performance on the validation set, which is a part of the data separated from the training data and used to evaluate the generalization ability of the model on unseen data. Once the graph attention neural network model reaches the convergence state, it is saved for use in practical applications. The saved graph attention neural network model will be deployed to the malicious buyer risk control system of the e-commerce platform for real-time detection and prevention of malicious buyer behavior. In this way, the graph attention neural network model can gradually learn the patterns and characteristics of malicious buyer behavior, so as to more accurately identify and prevent malicious buyer behavior in practical applications, and improve the security and user experience of the e-commerce platform.

[0092] In this embodiment, by obtaining a training order sample set and constructing a graph structure of a graph attention neural network model, and then using malicious buyer label data for supervised training, the model can gradually learn the patterns and characteristics of malicious buyer behavior, thereby more accurately identifying and preventing malicious buyer behavior in practical applications. This embodiment captures the correlation and contextual information between order samples by constructing a graph structure, and combines the efficient feature extraction and attention mechanism of the graph attention neural network model to achieve more accurate and comprehensive identification of malicious buyer behavior.

[0093] On the basis of any embodiment of the method of the present application, according to the order attribute information and the preset edge association rule, it is determined whether the order attribute information of any two nodes in the graph structure satisfies the edge association rule, and if so, an edge connection is established between the two nodes to form a complete graph structure, including any one or more of the following steps:

[0094] Step S5310: using the buyer's unique identifier corresponding to the payment order as the order attribute information in the corresponding order sample, detecting whether the buyer's unique identifiers corresponding to any two nodes in the graph structure are the same; if they are the same, establishing an edge connection between the two nodes;

[0095] First, the buyer's unique identifier of each payment order is extracted from the sample set of orders to be predicted. The buyer's unique identifier is a unique identifier used to distinguish and track each independent buyer. The buyer's unique identifier of each payment order is imported into the graph structure as part of the order attribute information. Each node represents a payment order, and the node stores the order unique identifier, order attribute information, order feature data, etc. of the payment order. The buyer's unique identifier is associated with the node as part of the order attribute information.

[0096] Compare any two nodes in the graph structure to detect whether the buyer's unique identifiers of the two nodes are the same. Specifically, by comparing the buyer's unique identifiers of the two nodes, determine whether they are completely consistent. If the buyer's unique identifiers of the two nodes are the same, it is considered that there is some kind of association between the two nodes, that is, they may be initiated by the same buyer. In this case, an edge is established between the two nodes, indicating that there is some kind of association between the two nodes.

[0097] In this way, it is ensured that the edge connection relationship of the graph structure can accurately capture the association pattern between payment orders, providing a solid foundation for the subsequent identification of malicious buyers. The sameness of the buyer's unique identifier reflects the characteristics of malicious buyer behavior, because malicious buyers often use the same buyer's unique identifier to place batch orders and initiate malicious negative reviews, malicious complaints, or malicious returns in a short period of time. By capturing this association pattern, the graph structure can better reflect the complex relationship between payment orders and provide more accurate and comprehensive data support for the training of the graph attention neural network model.

[0098] Step S5320: using the contact information when the payment order is generated as the order attribute information in the corresponding order sample, detecting whether the contact information corresponding to any two nodes in the graph structure is the same; if they are the same, establishing an edge connection between the two nodes;

[0099] In the process of building the graph structure, contact information is also an important attribute for identifying the association between payment orders. Contact information includes but is not limited to mobile phone numbers, email addresses, etc., which can be provided by buyers when placing an order and remain consistent across multiple payment orders from the same buyer. Therefore, by analyzing contact information, we can further identify payment order nodes with associations.

[0100] In this step, the contact information when the payment order is generated is used as the order attribute information in the corresponding order sample to detect whether the contact information corresponding to any two nodes in the graph structure is the same. Specifically, the system will compare the contact information of any two nodes in the graph structure one by one. If it is found that the contact information of the two nodes is the same, it means that the two payment orders may be initiated by the same buyer, and thus have a high correlation. In this case, if the contact information between these payment order nodes is the same, edge connections are established between these nodes to form a complete graph structure. In this way, the correlation between payment orders can be effectively captured, especially when the buyer's unique identifier is missing or unclear, the contact information can be used as a supplementary means to help identify related payment order nodes.

[0101] Step S5330: Using the IP address when the payment order is generated and the order generation time as the order attribute information in the corresponding order sample, compare whether the corresponding IP addresses between any two nodes in the graph structure are the same; if they are the same and the corresponding order generation time interval between the two nodes does not exceed a preset time threshold, establish an edge connection between the two nodes.

[0102] The IP address and order generation time when each payment order is generated are extracted from the sample set of orders to be predicted. The IP address is the network address used by the buyer when the order is generated, and the order generation time is the specific timestamp when the order is generated. The IP address and order generation time when each payment order is generated are imported into the graph structure as part of the order attribute information. Any two nodes in the graph structure are compared to detect whether the IP addresses of the two nodes are the same. Specifically, by comparing the IP addresses of the two nodes, it is determined whether they are completely consistent. If the IP addresses of the two nodes are the same, it is considered that there is a certain association between the two nodes, that is, they are both initiated by the same network environment or device. The order generation time intervals of the two nodes are further compared. Specifically, the difference between the order generation times of the two nodes is calculated to determine whether it is within the preset time threshold. The time threshold is set by a technician in this field as needed. If the order generation time interval of the two nodes does not exceed the preset time threshold, it is considered that there is a strong association between the two nodes, that is, the payment orders of the two nodes are initiated by the same buyer or device in a short period of time.

[0103] When the above two conditions are met, that is, when the IP addresses are the same and the order generation time interval does not exceed the preset time threshold, an edge is established between the two nodes, indicating that there is a certain association between the two nodes. In this way, it is ensured that the edge connection relationship of the graph structure can accurately capture the association pattern between payment orders, providing a solid foundation for the subsequent identification of malicious buyers. The sameness and time interval of IP addresses and order generation time reflect the characteristics of malicious buyers' behavior, because malicious buyers often use the same IP address to place batch orders and initiate malicious negative reviews, malicious complaints or malicious returns in a short period of time.

[0104] In this embodiment, by comprehensively utilizing multi-dimensional order attribute information such as buyer's unique identification, contact information, IP address, and order generation time, a more comprehensive and accurate graph structure is constructed, which significantly improves the accuracy and reliability of malicious buyer identification. Through multi-level attribute information comparison and association rule application, it can not only capture the association pattern under a single attribute, but also identify the complex association relationship under the joint action of multiple attributes, thereby more effectively revealing the behavioral characteristics of malicious buyers, providing richer and more accurate training data for the graph attention neural network model, and further enhancing the graph attention neural network model's prediction ability and ability to deal with complex malicious behaviors.

[0105] Based on any embodiment of the method of the present application, it includes:

[0106] Step S7100: regularly obtain an evaluation order sample set and input it into the graph attention neural network model to count the number of buyers corresponding to payment orders in the evaluation order sample set who are malicious buyers;

[0107] In order to ensure the prediction accuracy and stability of the graph attention neural network model, the model needs to be evaluated and updated regularly. Specifically, the malicious buyer risk control system will set a regular time interval (such as weekly, monthly or quarterly) to obtain the evaluation order sample set from the e-commerce platform's database. The evaluation order sample set includes multiple order samples, each of which contains an order unique identifier, order attribute information, order feature data, and malicious buyer label data corresponding to whether it is a malicious buyer, which is used to evaluate the prediction accuracy of the graph attention neural network model.

[0108] After obtaining the evaluation order sample set, the evaluation order sample set is input into the pre-trained graph attention neural network model. The graph attention neural network model determines whether the buyer corresponding to each order sample in the evaluation order sample set is a malicious buyer. The number of buyers corresponding to the payment orders in the evaluation order sample set that are malicious buyers is counted to evaluate the prediction accuracy of the subsequent graph attention neural network model.

[0109] Step S7200: dividing the number obtained by statistics by the number of malicious buyers represented by the malicious buyer label data in the evaluation order sample set as the prediction accuracy of the graph attention neural network model;

[0110] Compare the number of malicious buyers obtained in the previous step with the number of malicious buyers represented by the malicious buyer label data in the evaluation order sample set. The comparison value obtained is used as the prediction accuracy of the graph attention neural network model on the evaluation order sample set. The higher the prediction accuracy, the closer the model's prediction results are to the actual label data, and the better the performance of the graph attention neural network model. Conversely, the lower the prediction accuracy, the greater the deviation between the prediction results of the graph attention neural network model and the actual label data, and the performance of the model needs to be further optimized.

[0111] Step S7300: If the prediction accuracy is less than a preset accuracy threshold, merge the evaluation order sample set and the training order sample set to retrain and obtain a new graph attention neural network model.

[0112] Compare the calculated prediction accuracy with the preset accuracy threshold. The preset accuracy threshold is set according to business needs and model performance requirements to determine whether the model's prediction results meet the expected level. If the prediction accuracy is less than the preset accuracy threshold, it means that there is a large deviation between the model's prediction results and the actual label data, and the performance of the graph attention neural network model needs to be further optimized.

[0113] In this case, the malicious buyer risk control system merges the evaluation order sample set with the training order sample set to form a new training sample data set. The merged training sample data set contains more order samples and malicious buyer label data, which can provide the model with richer training information, thereby improving the prediction accuracy of the model. The merged training data set is then input into the graph attention neural network model for retraining. During the retraining process, the model will perform feature extraction, representation update, and classification prediction based on the new training data set, and gradually learn more accurate malicious buyer behavior patterns and features. Through multiple iterative training, the graph attention neural network model can gradually optimize its prediction performance and improve the accuracy of malicious buyer identification. The training process will continue until the loss value of the model reaches a lower level, or the performance of the graph attention neural network model is no longer significantly improved, that is, the graph attention neural network model reaches a convergence state. At this point, the model has a good ability to identify malicious buyers and can be used for subsequent malicious buyer identification tasks.

[0114] In this embodiment, the accuracy and stability of malicious buyer identification are significantly improved by regularly evaluating and dynamically updating the graph attention neural network model. By regularly obtaining evaluation order sample sets and calculating the prediction accuracy, the degradation of model performance is discovered in a timely manner, and the merged new training data set is used for retraining to ensure that the model always maintains a high level of recognition ability, thereby effectively responding to the dynamic changes in malicious buyer behavior and enhancing the security and user experience of the e-commerce platform.

[0115] Based on any embodiment of the method of the present application, after the buyer is determined to be a high-risk malicious buyer, the following steps are included:

[0116] Step S8100: When the buyer is confirmed to be a high-risk malicious buyer, the large language model is called to generate a malicious behavior report corresponding to the payment order according to the order attribute information and order feature data of the buyer's corresponding payment order;

[0117] In one embodiment, the malicious buyer risk control system will call a large language model (such as GPT-4, etc.) to generate a malicious behavior report. The large language model is a natural language processing model based on deep learning, which can understand and generate natural language text and has strong text generation and understanding capabilities. When generating a malicious behavior report, the large language model will automatically generate a detailed malicious behavior report based on the order attribute information and order feature data of the buyer's corresponding payment order. The large language model will analyze the malicious behavior patterns and characteristics of the buyer based on these order attribute information and order feature data, and generate a detailed malicious behavior report. The malicious behavior report includes order attribute information, order feature data, malicious behavior analysis (including detailed descriptions and analysis of malicious negative reviews, malicious complaints, malicious returns, etc.), correlation analysis (including correlation analysis such as the same buyer placing multiple orders in a short period of time, placing orders using the same contact information and device fingerprints, etc.), and risk assessment (including risk level assessment and risk control recommendations for the buyer). Through this step, the malicious buyer risk control system can call the large language model to generate a malicious behavior report corresponding to the payment order based on the order attribute information and order feature data of the buyer's corresponding payment order, thereby recording and analyzing the buyer's malicious behavior in detail and providing a basis for subsequent risk control and prevention measures.

[0118] Step S8200, iterating the malicious behavior report generation event until the number of malicious behavior reports generated exceeds a preset report number threshold, calling the large language model to generate corresponding malicious behavior regulations according to the generated malicious behavior reports, the malicious behavior regulations including multiple malicious behavior details;

[0119] The malicious buyer risk control system continues to identify and determine high-risk malicious buyers, and generates corresponding malicious behavior reports. After each malicious behavior report is generated, check whether the number of malicious behavior reports currently generated reaches the preset report number threshold. The report number threshold is set by a technician in this field as needed. If the preset report number threshold is not reached, continue to iterate the above malicious behavior report generation event until the number of malicious behavior reports generated reaches the preset report number threshold. When the number of malicious behavior reports generated exceeds the preset report number threshold, the malicious buyer risk control system calls the large language model to generate corresponding malicious behavior regulations based on these malicious behavior reports. The large language model analyzes and summarizes the commonalities and rules in these malicious behavior reports, extracts multiple malicious behavior details, and forms malicious behavior regulations. Malicious behavior regulations are a summary and induction of malicious behavior. Malicious behavior regulations include multiple malicious behavior details, each of which describes a specific malicious behavior pattern or feature. For example, if multiple malicious behavior reports mention that a buyer places multiple orders in a short period of time, and the types and amounts of goods placed in each order are similar, the large language model will extract this behavior pattern as a malicious behavior detail. In this way, malicious behaviors can be systematically summarized and classified, providing more comprehensive and accurate guidance for subsequent malicious behavior identification.

[0120] The generated malicious behavior regulations will be stored in the e-commerce platform's database for subsequent malicious behavior identification and disposal. The malicious behavior regulations can also be used to generate the platform's malicious behavior prevention guide to help merchants understand and respond to malicious behavior, thereby improving the platform's security and user experience.

[0121] Step S8300: After determining that the malicious behavior details exceed the preset detail number threshold, after obtaining the sample set of orders to be predicted, call the large language model to determine whether the buyers corresponding to each payment order in the sample set of orders to be predicted are malicious buyers based on the malicious behavior details and the sample set of orders to be predicted.

[0122] The malicious buyer risk control system checks whether the number of malicious behavior details in the generated malicious behavior regulations exceeds the preset threshold of the number of details, which is set by the technicians in this field as needed. If the number of malicious behavior details does not reach the preset threshold of the number of details, the malicious behavior report and malicious behavior regulations are iteratively generated until the number of malicious behavior details meets the requirement. When the number of malicious behavior details exceeds the preset threshold of the number of details, the malicious buyer risk control system will call the large language model after obtaining the sample set of orders to be predicted, based on the generated malicious behavior details and the sample set of orders to be predicted, to determine whether the buyers corresponding to each payment order in the sample set of orders to be predicted are malicious buyers. The large language model will analyze and compare each payment order in the sample set of orders to be predicted based on the behavior patterns and features in the malicious behavior details. Specifically, the large language model will extract the order attribute information and order feature data in the sample set of orders to be predicted, and match them with the behavior patterns in the malicious behavior details. If the attribute information and feature data of an order are highly similar to the behavior patterns in the malicious behavior details, the large language model will determine that the buyer corresponding to the payment order is a malicious buyer. In this way, the large language model can use the behavior patterns summarized in the malicious behavior details to quickly and accurately determine whether the buyers corresponding to each payment order in the order sample set to be predicted are malicious buyers, thereby improving the efficiency and accuracy of malicious behavior identification.

[0123] In this embodiment, the large language model is called to generate malicious behavior reports, summarize malicious behavior rules and apply them to real-time payment order prediction, which significantly improves the automation and accuracy of malicious buyer identification. The large language model automatically generates detailed reports and summarizes behavior rules, which can not only quickly identify and record malicious behavior, but also dynamically update identification rules to ensure that the model always adapts to the latest malicious behavior patterns, thereby effectively improving the security and user experience of the e-commerce platform.

[0124] See also Figure 3According to one aspect of the present application, a malicious buyer identification device is provided, including a sample set acquisition module 5100 to be predicted, a graph structure node construction module 5200, a graph structure edge connection module 5300, and a risk probability prediction module 5400, wherein the sample set acquisition module 5100 to be predicted is configured to obtain an order sample set to be predicted, the order sample set to be predicted includes order samples of multiple payment orders, the order samples include an order unique identifier, order attribute information, and order feature data; the graph structure node construction module 5200 is configured to construct each order sample in the order sample set to be predicted into a node of a graph structure, wherein the order unique identifier in the order sample is used as the unique identifier of the order node. , the order feature data is used as the feature vector of the order node, and the order attribute information is used to determine whether there is an association between the order nodes; the graph structure edge connection module 5300 is configured to determine whether the order attribute information of any two nodes in the graph structure satisfies the association rule based on the order attribute information and the preset association rule. If so, an edge connection is established between the two nodes to form a complete graph structure; the risk probability prediction model 5400 is configured to input the graph structure into a pre-trained graph attention neural network model to predict the risk probability that the buyer corresponding to each payment order in the sample set of the order to be predicted is a malicious buyer, and determine whether the corresponding buyer is a malicious buyer based on the risk probability.

[0125] On the basis of any embodiment of the device of the present application, the risk probability prediction model 5400 includes: a complaint information acquisition submodule to be predicted, which is configured to obtain the corresponding complaint information to be predicted of the buyer if the buyer is judged to be a malicious buyer; a high-risk malicious buyer determination submodule, which is configured to input the complaint information to be predicted into a pre-trained neural network model to determine whether the complaint behavior of the buyer is a malicious complaint. If it is determined to be a malicious complaint, the buyer is determined to be a high-risk malicious buyer.

[0126] On the basis of any embodiment of the device of the present application, the complaint information to be predicted acquisition submodule includes: a complaint information sample set acquisition submodule, which is configured to acquire a complaint information sample set, wherein the complaint information sample set includes multiple complaint information and corresponding malicious complaint label data representing whether the complaint is a malicious complaint; a neural network model training submodule, which is configured to input the complaint information sample set into a pre-trained neural network model, and use the malicious complaint label data of the multiple complaint information for supervised training to train the neural network model to a convergence state.

[0127] On the basis of any embodiment of the device of the present application, the sample set to be predicted acquisition module 5100 includes: a training order sample set acquisition submodule, which is configured to acquire a training order sample set, wherein the training order sample set includes multiple order samples, and the order samples include an order unique identifier, order attribute information, order feature data, and malicious buyer label data corresponding to whether the buyer is a malicious buyer; a graph structure construction submodule, which is configured to construct the training order sample set into a graph structure for training a graph attention neural network model, wherein the order samples in the training order sample set are constructed as nodes of the graph structure; a graph attention neural network model training submodule, which is configured to input the graph structure into a graph attention neural network model, and use the malicious buyer label data as a supervision label to train the graph attention neural network model to a convergence state.

[0128] Based on any embodiment of the device of the present application, the graph structure edge connection module 5300 includes any one or more of the following modules: a buyer unique identifier judgment submodule, configured to use the buyer unique identifier corresponding to the payment order as the order attribute information in the corresponding order sample, and detect whether the buyer unique identifiers corresponding to any two nodes in the graph structure are the same. If they are the same, an edge connection is established between the two nodes; a contact information judgment submodule, configured to use the contact information when the payment order is generated as the order attribute information in the corresponding order sample, and detect whether the contact information corresponding to any two nodes in the graph structure is the same. If they are the same, an edge connection is established between the two nodes; an IP address judgment submodule, configured to use the IP address and order generation time when the payment order is generated as the order attribute information in the corresponding order sample, and compare whether the corresponding IP addresses between any two nodes in the graph structure are the same. If they are the same and the corresponding order generation time interval between the two nodes does not exceed a preset time threshold, an edge connection is established between the two nodes.

[0129] On the basis of any embodiment of the device of the present application, it includes: a periodic evaluation submodule, which is configured to periodically obtain an evaluation order sample set and input it into the graph attention neural network model to count the number of buyers corresponding to the payment orders in the evaluation order sample set that are malicious buyers; a prediction accuracy calculation submodule, which is configured to divide the statistically obtained number by the number of malicious buyers represented by the malicious buyer label data in the evaluation order sample set as the prediction accuracy of the graph attention neural network model; and a model retraining submodule, which is configured to merge the evaluation order sample set and the training order sample set if the prediction accuracy is less than a preset accuracy threshold, so as to retrain a new graph attention neural network model.

[0130] On the basis of any embodiment of the device of the present application, after the high-risk malicious buyer determination submodule, it includes: a malicious behavior report generation submodule, which is configured to call the large language model to generate a malicious behavior report corresponding to the payment order according to the order attribute information and order feature data of the buyer's corresponding payment order when the buyer is confirmed to be a high-risk malicious buyer; a malicious behavior regulation generation submodule, which is configured to iterate the above-mentioned malicious behavior report generation event until the number of malicious behavior reports generated exceeds a preset report number threshold, and then call the large language model to generate corresponding malicious behavior regulations according to the generated malicious behavior reports, and the malicious behavior regulations include multiple malicious behavior details; a malicious buyer judgment submodule, which is configured to call the large language model to determine whether the buyers corresponding to each payment order in the sample set of orders to be predicted are malicious buyers according to the malicious behavior details and the sample set of orders to be predicted after determining that the malicious behavior details exceed the preset detail number threshold, after obtaining the sample set of orders to be predicted.

[0131] In order to solve the above technical problems, the present application also provides a computer device. Figure 4 As shown, a schematic diagram of the internal structure of a computer device. The computer device includes a processor, a computer-readable storage medium, a memory, and a network interface connected via a system bus. Among them, the computer-readable storage medium of the computer device stores an operating system, a database, and computer-readable instructions. The database may store a control information sequence. When the computer-readable instructions are executed by the processor, the processor may implement a malicious buyer identification method. The processor of the computer device is used to provide computing and control capabilities to support the operation of the entire computer device. The memory of the computer device may store computer-readable instructions. When the computer-readable instructions are executed by the processor, the processor may execute the malicious buyer identification method of the present application. The network interface of the computer device is used to connect and communicate with a terminal. Those skilled in the art will understand that Figure 4 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0132] In this embodiment, the processor is used to execute Figure 3 The memory stores the program code and various data required to execute the above modules or submodules. The network interface is used to transmit data between user terminals or servers. The memory in this embodiment stores the program code and data required to execute all modules / submodules in the malicious buyer identification device of this application, and the server can call the program code and data of the server to execute the functions of all submodules.

[0133] The present application also provides a storage medium storing computer-readable instructions. When the computer-readable instructions are executed by one or more processors, the one or more processors execute the steps of the malicious buyer identification method of any embodiment of the present application.

[0134] A person skilled in the art can understand that all or part of the processes in the above-mentioned embodiments of the present application can be implemented by instructing the relevant hardware through a computer program, and the computer program can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, the aforementioned storage medium can be a computer-readable storage medium such as a disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

[0135] It will be understood by those skilled in the art that the various operations, methods, steps, measures, and schemes in the processes discussed in this application may be alternated, changed, combined, or deleted. Furthermore, other steps, measures, and schemes in the various operations, methods, and processes discussed in this application may also be alternated, changed, rearranged, decomposed, combined, or deleted. Furthermore, the steps, measures, and schemes in the various operations, methods, and processes in the prior art that are open source and in this application may also be alternated, changed, rearranged, decomposed, combined, or deleted.

[0136] The above description is only a partial implementation method of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A method for identifying malicious buyers, characterized in that: include: Acquire a sample set of orders to be predicted, wherein the sample set of orders to be predicted includes order samples of multiple payment orders, and the order samples include order unique identifiers, order attribute information, and order feature data; Each order sample in the to-be-predicted order sample set is constructed as a node of a graph structure, wherein the order unique identifier in the order sample is used as the unique identifier of the order node, the order feature data is used as the feature vector of the order node, and the order attribute information is used to determine whether there is a relationship between order nodes; According to the order attribute information and the preset association rule, it is determined whether the order attribute information of any two nodes in the graph structure satisfies the association rule, and if so, an edge connection is established between the two nodes to form a complete graph structure; The graph structure is input into a pre-trained graph attention neural network model to predict the risk probability that the buyer corresponding to each payment order in the sample set of orders to be predicted is a malicious buyer, and whether the corresponding buyer is a malicious buyer is determined based on the risk probability.

2. The method for identifying malicious buyers according to claim 1, characterized in that: After determining whether the corresponding buyer is a malicious buyer according to the risk probability, it includes: If the buyer is judged to be a malicious buyer, obtain the corresponding complaint information to be predicted of the buyer; The complaint information to be predicted is input into a pre-trained neural network model to determine whether the buyer's complaint behavior is a malicious complaint. If it is determined to be a malicious complaint, the buyer is determined to be a high-risk malicious buyer.

3. The method for identifying malicious buyers according to claim 2, characterized in that: If the buyer is determined to be a malicious buyer, before obtaining the corresponding complaint information to be predicted of the buyer, the following steps are performed: Obtaining a complaint information sample set, wherein the complaint information sample set includes a plurality of complaint information and corresponding malicious complaint label data indicating whether the complaint is a malicious complaint; The complaint information sample set is input into a pre-trained neural network model, and the malicious complaint label data of the multiple complaint information is used for supervised training to train the neural network model to a convergence state.

4. The method for identifying malicious buyers according to claim 1, characterized in that: Before obtaining the sample set of orders to be predicted, include: Obtaining a training order sample set, wherein the training order sample set includes a plurality of order samples, wherein the order samples include an order unique identifier, order attribute information, order feature data, and malicious buyer label data corresponding to whether the order is a malicious buyer; The training order sample set is constructed as a graph structure of a training graph attention neural network model, wherein order samples in the training order sample set are constructed as nodes of the graph structure; The graph structure is input into a graph attention neural network model, and the malicious buyer label data is used as a supervision label to train the graph attention neural network model to a convergence state.

5. The method for identifying malicious buyers according to claim 1, characterized in that: According to the order attribute information and the preset edge association rule, it is determined whether the order attribute information of any two nodes in the graph structure satisfies the edge association rule, and if so, an edge connection is established between the two nodes to form a complete graph structure, including any one or more of the following steps: Using the buyer's unique identifier corresponding to the payment order as the order attribute information in the corresponding order sample, detecting whether the buyer's unique identifiers corresponding to any two nodes in the graph structure are the same, and if they are the same, establishing an edge connection between the two nodes; Using the contact information when the payment order is generated as the order attribute information in the corresponding order sample, detecting whether the contact information corresponding to any two nodes in the graph structure is the same, and if they are the same, establishing an edge connection between the two nodes; The IP address when the payment order is generated and the order generation time are used as the order attribute information in the corresponding order sample, and the corresponding IP addresses between any two nodes in the graph structure are compared to see whether they are the same. If they are the same and the corresponding order generation time interval between the two nodes does not exceed the preset time threshold, an edge connection is established between the two nodes.

6. The method for identifying malicious buyers according to any one of claims 1 to 5, characterized in that: include: Regularly obtain an evaluation order sample set and input it into the graph attention neural network model to count the number of buyers corresponding to payment orders in the evaluation order sample set who are malicious buyers; Divide the statistically obtained number by the number of malicious buyers represented by the malicious buyer label data in the evaluation order sample set as the prediction accuracy of the graph attention neural network model; If the prediction accuracy is less than a preset accuracy threshold, the evaluation order sample set and the training order sample set are merged to retrain a new graph attention neural network model.

7. The method for identifying malicious buyers according to any one of claims 1 to 5, characterized in that: After the buyer is identified as a high-risk malicious buyer, the following are included: When the buyer is confirmed to be a high-risk malicious buyer, the large language model is called to generate a malicious behavior report corresponding to the payment order based on the order attribute information and order feature data of the buyer's corresponding payment order; Iterate the malicious behavior report generation event until the number of malicious behavior reports generated exceeds a preset report number threshold, and call the large language model to generate corresponding malicious behavior regulations according to the generated malicious behavior reports, wherein the malicious behavior regulations include multiple malicious behavior details; After determining that the malicious behavior details exceed a preset detail number threshold, after obtaining the sample set of orders to be predicted, calling a large language model to determine whether the buyers corresponding to each payment order in the sample set of orders to be predicted are malicious buyers based on the malicious behavior details and the sample set of orders to be predicted.

8. A malicious buyer identification device, characterized in that: include: A sample set acquisition module to be predicted is configured to acquire a sample set of orders to be predicted, wherein the sample set of orders to be predicted includes order samples of multiple payment orders, and the order samples include order unique identifiers, order attribute information, and order feature data; A graph structure node construction module, configured to construct each order sample in the to-be-predicted order sample set into a node of a graph structure, wherein the order unique identifier in the order sample is used as the unique identifier of the order node, the order feature data is used as a feature vector of the order node, and the order attribute information is used to determine whether there is a relationship between order nodes; A graph structure edge connection module, configured to determine whether the order attribute information of any two nodes in the graph structure satisfies the association rule based on the order attribute information and a preset association rule, and if so, establish an edge connection between the two nodes to form a complete graph structure; The risk probability prediction module is configured to input the graph structure into a pre-trained graph attention neural network model to predict the risk probability that the buyer corresponding to each payment order in the sample set of orders to be predicted is a malicious buyer, and determine whether the corresponding buyer is a malicious buyer based on the risk probability.

9. A malicious buyer identification device, comprising a central processing unit and a memory, characterized in that: The central processing unit is used to call and run the computer program stored in the memory to execute the steps of the method according to any one of claims 1 to 7.

10. A non-volatile readable storage medium, characterized in that: It stores a computer program implemented according to the method described in any one of claims 1 to 7 in the form of computer-readable instructions, and when the computer program is called and executed by a computer, the steps included in the corresponding method are executed.

Images