Method and system for implementing electronic channel risk control based on code insertion technology

Abstract

The present invention provides a method and system for implementing electronic channel risk control based on code insertion technology, which relates to the field of electronic channel risk control technology, including encrypting user information and channel identification information through a double hash algorithm to generate a dynamic session identification code, and using an adaptive segmentation algorithm and a business feature marker to form a target coding sequence. A dynamic risk control rule model is constructed using a graph neural network, and user multi-dimensional features are extracted and weighted fused to generate a user risk score. After comparison with the adaptive risk threshold, abnormal behavior is analyzed based on a probabilistic graph model to generate an intelligent risk warning report. The reinforcement learning risk control strategy engine is called to determine the optimal disposal strategy, and a multi-factor interactive verification instruction is issued. After verification, the blocking mechanism is selectively activated according to the verification result, and the interactive data and results are synchronized to a distributed risk control data center, and the risk control model is continuously optimized based on federated learning.

Description

Technical Field

[0001] The present invention relates to electronic channel risk control technology, and in particular to an electronic channel risk control disposal method and system based on code insertion technology. Background Art

[0002] With the rapid development of electronic channel business, risk prevention and control faces greater challenges. Existing risk control technologies mainly rely on static rules and fixed thresholds for risk judgment, which is difficult to effectively deal with complex and changeable attack methods, and lack the ability to deeply analyze user behavior characteristics and multi-dimensional verification.

[0003] Traditional session identification technology usually uses a simple random number or timestamp generation method, which is easy to be cracked or forged, and cannot effectively associate business scenario characteristics. Existing risk control solutions are often based on a single-dimensional risk assessment result to directly trigger blocking, lacking an intelligent strategy selection mechanism, which can easily lead to misjudgment and loss of user experience.

[0004] The verification data transmission and processing process in the current risk control system has security risks. The risk control data between various channels cannot be safely shared and collaboratively learned, which limits the optimization effect of the risk control model. Therefore, there is an urgent need for an electronic channel risk control disposal method based on coding technology to achieve accurate risk identification, intelligent disposal and continuous optimization. Summary of the invention

[0005] The embodiments of the present invention provide a method and system for implementing electronic channel risk control based on code insertion technology, which can solve the problems in the prior art.

[0006] According to a first aspect of the embodiments of the present invention,

[0007] A method for implementing electronic channel risk control based on code insertion technology is provided, including:

[0008] Receive an electronic channel access request sent by a user terminal, the electronic channel access request including user information and channel identification information, encrypt the user information and channel identification information by a double hash algorithm to obtain an original session identification code, inject a timestamp and an increasing sequence number into the original session identification code by using a distributed time series counter to form a dynamic session identification code, perform duplicate checking and filtering on the dynamic session identification code by using a Bloom filter, and divide the dynamic session identification code into a plurality of variable-length coding segments by using an adaptive segmentation algorithm, and respectively embed service feature markers into the plurality of variable-length coding segments to form a target coding sequence with multi-dimensional features;

[0009] A dynamic risk control rule model is constructed based on a graph neural network. The target coding sequence is parsed through a feature extraction subnetwork to extract the user's biological feature vector, behavior trajectory feature tensor, and device environment feature matrix. The extracted features are subjected to multi-level weighted fusion using an attention mechanism to generate a user risk score. The user risk score is compared with an adaptive risk threshold dynamically calculated based on spatiotemporal distribution. When the user risk score exceeds the adaptive risk threshold, the propagation path of the abnormal behavior is analyzed based on a probabilistic graph model to generate an intelligent risk warning report containing risk tracing information and risk diffusion prediction.

[0010] According to the intelligent risk warning report, the risk control strategy engine based on reinforcement learning is called, and the optimal risk control disposal strategy is determined after the benefits of different disposal plans are evaluated through a multi-round game model. Based on the optimal risk control disposal strategy, a multi-factor interactive verification instruction including a biometric recognition instruction and an environmental factor verification instruction is issued to the user terminal, and a verification data packet returned after the user completes the multi-factor interactive verification instruction is received. The verification data packet is decrypted and verified using homomorphic encryption technology, and the preset blocking mechanism is selectively activated according to the verification result. The interactive data of the verification process and the blocking execution result are synchronized to the distributed risk control data center in real time, and the risk control rule model is continuously optimized based on the federated learning framework.

[0011] In an optional embodiment,

[0012] Encrypting the user information and the channel identification information by a double hash algorithm to obtain an original session identification code, and injecting a timestamp and an increasing sequence number into the original session identification code by using a distributed time series counter to form a dynamic session identification code includes:

[0013] Extracting field identifiers and field values ​​from the user information to construct a field mapping table, sorting the fields in the field mapping table based on a preset field priority, normalizing the sorted field values ​​according to a standard data format to obtain normalized user information, and using a double hash algorithm based on key dispersion to perform block encryption on the normalized user information to obtain a first information summary;

[0014] The first information digest and the channel identification information are concatenated according to a preset separator and encoding rule to obtain combined information, the combined information is digitally signed to obtain signature information, and the combined information and the signature information are subjected to multiple rounds of operations using a key-based hash algorithm to obtain an original session identification code;

[0015] Obtain a count key value of the current time segment from the distributed storage cluster, perform an atomic increment operation on the count key value through a distributed lock mechanism to obtain an incrementing sequence number, combine the incrementing sequence number with the access node identifier and the current timestamp in the channel identifier information through a mask operation to obtain a time series counting code, wherein the time series counting code includes a time base identification bit, a time precision bit segment, a node identification bit segment, and a counting bit segment;

[0016] The binary sequence of the original session identification code and the binary sequence of the timing counting code are combined through bit operation to obtain a dynamic session identification code.

[0017] In an optional embodiment,

[0018] The dynamic session identification code is filtered through a Bloom filter for duplicate checking, and the dynamic session identification code is divided into a plurality of variable-length coding segments by using an adaptive segmentation algorithm, and the plurality of variable-length coding segments are respectively embedded with service feature markers to form a target coding sequence with multi-dimensional features, including:

[0019] Extracting the business scenario identifier, security level information and timestamp information from the dynamic session identification code, determining a feature embedding strategy based on the business scenario identifier, determining a coding segmentation parameter based on the security level information, and calculating the effective duration of the session identification code based on the timestamp information;

[0020] Constructing a multi-stage Bloom filter group, the multi-stage Bloom filter group includes a fast filtering layer and an accurate deduplication layer, wherein the fast filtering layer uses a first hash function family and a first bitmap to perform coarse-grained duplicate checking, and the accurate deduplication layer uses a second hash function family and a second bitmap to perform fine-grained verification, the dynamic session identification code is sequentially passed through the fast filtering layer and the accurate deduplication layer for duplicate checking and filtering, and a duplication probability evaluation value is generated, and when the duplication probability evaluation value exceeds a preset evaluation threshold, a regeneration process of the session identification code is triggered;

[0021] Calculate the local entropy distribution curve of the binary sequence of the dynamic session identification code in multiple sliding windows, use a peak detection algorithm to identify entropy mutation points from the local entropy distribution curve as candidate segmentation positions, build segmentation constraints in combination with the coding segmentation parameters, and divide the dynamic session identification code into multiple variable-length coding segments based on a dynamic programming algorithm, where the information entropy distribution of the multiple variable-length coding segments meets a balance condition and the overlap between the segments is lower than a preset threshold;

[0022] Convert the business scenario identifier into a ternary sequence, wherein the values ​​in the ternary sequence correspond to basic operations, sensitive operations, and privileged operations, respectively; construct a coding template based on the ternary sequence, wherein the coding template includes a front-end bit, a middle-end bit, and a back-end bit; and map the business information according to the coding template to generate an initial feature code;

[0023] The target feature code is obtained by performing a cyclic shift on the initial feature code, the target feature code is embedded in the variable-length coding segment based on the feature embedding strategy, a check bit is added to the head of the variable-length coding segment to generate a coding segment with a feature mark, and the coding segment with the feature mark is reorganized by using an interleaved coding method so that the feature marks of adjacent segments are staggered to generate a target coding sequence with multi-dimensional features.

[0024] In an optional embodiment,

[0025] A dynamic risk control rule model is constructed based on a graph neural network. The target coding sequence is parsed through a feature extraction sub-network to extract the user's biological feature vector, behavior trajectory feature tensor, and device environment feature matrix. The attention mechanism is used to perform multi-level weighted fusion of the extracted features to generate a user risk score, including:

[0026] Performing partition analysis on the feature bits in the target coding sequence, calculating the local entropy value distribution of the feature bits based on a sliding window, determining the feature segmentation position from the local entropy value distribution, dividing the target coding sequence into business feature segments, behavior feature segments and environment feature segments, and performing reverse mapping on each feature segment to obtain original feature data;

[0027] Constructing a feature extraction subnetwork, the feature extraction subnetwork includes a biometric channel, a behavior trajectory channel and a device environment channel, wherein the biometric channel extracts the operation habit feature, the touch screen pressure feature and the operation interval feature in the service feature segment to generate a biometric feature vector, the behavior trajectory channel extracts the operation sequence in the behavior feature segment to generate a behavior trajectory feature tensor, and the device environment channel extracts the device fingerprint feature, the network environment feature and the geographic location feature in the environment feature segment to generate a device environment feature matrix;

[0028] Constructing a heterogeneous graph neural network, mapping the biological feature vector, behavior trajectory feature tensor and device environment feature matrix into different types of graph nodes, calculating the feature correlation between nodes to construct an edge weight matrix, and using a graph attention network to optimize the edge weight matrix to obtain a dynamic connection relationship;

[0029] Design a hierarchical attention mechanism, calculate the importance of different types of nodes and perform feature weighting through the node-level attention layer, selectively aggregate node features based on semantic relevance through the semantic-level attention layer, iteratively update node representations using a graph convolutional network, build a cross-layer feature fusion network, combine features of node representations at different levels, introduce feature gating units to adjust feature transfer strength, retain discriminative features through residual learning, and iteratively optimize to obtain multi-scale fusion features;

[0030] A risk scoring model is constructed based on the multi-scale fusion features to generate risk components including account security risk, transaction behavior risk and environmental abnormality risk, and the risk components are weighted and fused to obtain a user risk score.

[0031] In an optional embodiment,

[0032] The user risk score is compared with an adaptive risk threshold dynamically calculated based on spatiotemporal distribution. When the user risk score exceeds the adaptive risk threshold, the propagation path of the abnormal behavior is analyzed based on a probabilistic graph model to generate an intelligent risk warning report containing risk tracing information and risk diffusion prediction, including:

[0033] Collect user risk scores and geographic location data within the historical time window, calculate the risk distribution density function through kernel density estimation, extract time series features in combination with exponentially weighted moving average, construct a spatial correlation matrix based on geographic grid division to extract spatial correlation features, and input the time series features and the spatial correlation features into a deep neural network to generate spatiotemporal fusion features;

[0034] Constructing a combined risk function based on the spatiotemporal fusion features, inputting the combined risk function into a Bayesian optimizer, iteratively updating the weight coefficient of the combined risk function with the goal of minimizing the weighted sum of the risk detection rate and the false alarm rate, and outputting an adaptive risk threshold;

[0035] A probabilistic graphical model is constructed based on user interaction data, wherein the probabilistic graphical model includes an observation layer, a latent variable layer, and a conditional probability layer, user nodes are mapped to the observation layer, risk factors are mapped to the latent variable layer, and parameter distribution of the conditional probability layer is learned based on a variational inference method;

[0036] Performing a belief propagation operation on the probabilistic graph model, calculating the risk propagation probability between nodes based on the parameter distribution, inputting the risk propagation probability into a graph attention network to extract node risk features, and performing a graph convolution operation on the node risk features to obtain edge propagation features;

[0037] The joint distribution of the node risk characteristics and the edge propagation characteristics is modeled using Markov random fields, potential function parameters are optimized by maximum likelihood estimation, a risk propagation path graph is constructed based on the potential function parameters, and topological features of the risk propagation path graph are extracted;

[0038] When it is detected that the user risk score exceeds the adaptive risk threshold, the topological features are input into the recurrent neural network, the risk tracing path is located through depth-first search, and the risk diffusion range is predicted through breadth-first search. A risk propagation situation map is generated based on the temporal pattern of the risk tracing path and the spatial distribution of the risk diffusion range. Dynamic clustering analysis is performed on the risk propagation situation map to identify high-risk propagation areas and extract key propagation nodes. An intelligent risk warning report containing risk tracing information and risk diffusion prediction is generated by combining the spatiotemporal distribution characteristics of the high-risk propagation areas and the behavioral characteristics of the key propagation nodes.

[0039] In an optional embodiment,

[0040] According to the intelligent risk warning report, a risk control strategy engine based on reinforcement learning is called, and the optimal risk control strategy is determined after the benefits of different disposal plans are evaluated through a multi-round game model. Based on the optimal risk control strategy, a multi-factor interactive verification instruction including a biometric identification instruction and an environmental factor verification instruction is issued to the user terminal, including:

[0041] Extract user risk scores, abnormal behavior characteristics and environmental abnormal factors from the intelligent risk warning report to construct a state space, construct biometric verification instructions, environmental factor verification instructions and behavioral feature comparison instructions into an action space, and combine the risk treatment effect value, user experience impact coefficient and operating cost parameters in the state space to construct an instant reward function;

[0042] Input the feature vectors of each dimension in the state space and the verification instruction sequence in the action space into the multi-round game model, build a game confrontation relationship based on the defense strategy matrix and the opponent strategy matrix, combine the instant reward function and the historical verification pass rate to build a strategy utility function, and solve the optimal countermeasure by iteratively calculating the maximum and minimum values ​​to obtain the mixed strategy distribution;

[0043] Input the mixed strategy distribution into a dual value function network, construct state-action pairs based on the state space and the action space, store the state-action pairs and corresponding reward data into a replay cache to form a training sample set, obtain training data by batch sampling from the training sample set, and input the training data into the dual value function network to alternately update network parameters;

[0044] Input the current state vector into the updated dual-value function network, calculate the defense strategy value of each action based on the updated network parameters, stratify the defense strategy value according to the score range, perform strategy sampling in each stratum to generate a candidate strategy set, perform weighted combination of the candidate strategy set and the user's historical verification pass rate, and output the optimal risk control disposal strategy by comparing the weighted scores;

[0045] Based on the optimal risk control disposal strategy, the biometric verification factors and environmental feature verification factors to be verified are extracted, the verification factors are prioritized according to the user's historical verification pass rate to obtain a verification order, and the verification instructions of the biometric verification factor and the environmental feature verification factor are packaged according to the verification order to generate a multi-factor interactive verification instruction.

[0046] In an optional embodiment,

[0047] Receive the verification data packet returned by the user after completing the multi-factor interactive verification instruction, use homomorphic encryption technology to decrypt and verify the verification data packet, selectively activate the preset blocking mechanism according to the verification result, synchronize the interactive data of the verification process and the blocking execution result to the distributed risk control data center in real time, and continuously optimize the risk control rule model based on the federated learning framework, including:

[0048] Decrypt the verification data packet using a segmented decryption strategy to obtain decrypted verification data, perform multi-dimensional feature matching on the decrypted verification data and the user's historical feature template, and calculate the matching score of each dimensional feature;

[0049] Input the matching scores of the features of each dimension into a pre-built risk control rule model, the risk control rule model includes a feature evaluation neural network and a rule generation decision tree, generate a verification result based on the output score of the feature evaluation neural network, use a hierarchical clustering algorithm to divide the verification result into multiple abnormal levels, use the rule generation decision tree to map the abnormal level of the verification result to a risk control rule, select a blocking mechanism of a corresponding level from a preset multi-level blocking strategy library according to the risk control rule and execute it, and record the execution effect of the blocking mechanism;

[0050] Combine the matching scores of each dimension feature, the abnormal level of the verification result, the triggering record of the risk control rule and the execution effect of the blocking mechanism to generate time series feature data, synchronize the time series feature data to each node of the risk control data center, and train the local risk control rule sub-model after desensitizing the time series feature data at each node;

[0051] A federated learning framework is used to securely aggregate the model parameters of each node to obtain the global model parameters. The network weights of the neural network are evaluated based on the update characteristics of the global model parameters. The rule generation decision tree is optimized based on the execution effect of the blocking mechanism. The priority of the risk control rules and the triggering conditions of the blocking mechanisms at each level in the multi-level blocking strategy library are dynamically adjusted to achieve optimization and update of the risk control rule model.

[0052] A second aspect of an embodiment of the present invention provides an electronic channel risk control system based on a code insertion technology, comprising:

[0053] The first unit is used to receive an electronic channel access request sent by a user terminal, wherein the electronic channel access request includes user information and channel identification information, encrypt the user information and the channel identification information by a double hash algorithm to obtain an original session identification code, inject a timestamp and an increasing sequence number into the original session identification code by using a distributed time series counter to form a dynamic session identification code, perform duplicate checking and filtering on the dynamic session identification code by using a Bloom filter, and use an adaptive segmentation algorithm to divide the dynamic session identification code into multiple variable-length coding segments, and respectively embed service feature markers into the multiple variable-length coding segments to form a target coding sequence with multi-dimensional features;

[0054] The second unit is used to build a dynamic risk control rule model based on a graph neural network, parse the target coding sequence through a feature extraction sub-network, extract the user's biological feature vector, behavior trajectory feature tensor and device environment feature matrix, use the attention mechanism to perform multi-level weighted fusion on the extracted features to generate a user risk score, compare the user risk score with an adaptive risk threshold dynamically calculated based on spatiotemporal distribution, and when the user risk score exceeds the adaptive risk threshold, analyze the propagation path of the abnormal behavior based on a probabilistic graph model to generate an intelligent risk warning report containing risk tracing information and risk diffusion prediction;

[0055] The third unit is used to call the risk control strategy engine based on reinforcement learning according to the intelligent risk warning report, determine the optimal risk control disposal strategy after evaluating the benefits of different disposal plans through a multi-round game model, and issue a multi-factor interactive verification instruction including a biometric identification instruction and an environmental factor verification instruction to the user terminal based on the optimal risk control disposal strategy, receive a verification data packet returned after the user completes the multi-factor interactive verification instruction, decrypt and verify the verification data packet using homomorphic encryption technology, selectively activate a preset blocking mechanism according to the verification result, synchronize the interaction data of the verification process and the blocking execution result to the distributed risk control data center in real time, and continuously optimize the risk control rule model based on the federated learning framework.

[0056] A third aspect of the embodiments of the present invention

[0057] An electronic device is provided, comprising:

[0058] processor;

[0059] a memory for storing processor-executable instructions;

[0060] The processor is configured to call the instructions stored in the memory to execute the aforementioned method.

[0061] A fourth aspect of the embodiments of the present invention is:

[0062] A computer-readable storage medium is provided, on which computer program instructions are stored. When the computer program instructions are executed by a processor, the aforementioned method is implemented.

[0063] In this embodiment, through dynamic session identification code, Bloom filter duplication check, adaptive segmentation algorithm and multi-dimensional feature tagging and other technical means, abnormal access requests can be more accurately identified and filtered, the false positive rate and missed positive rate can be reduced, and the processing efficiency of the risk control system can be improved. The dynamic risk control rule model based on graph neural network combines multi-dimensional information such as user biometrics, behavior trajectory and device environment, and uses attention mechanism for weighted fusion, which can more comprehensively evaluate user risks and achieve more refined risk identification and early warning. Based on the probabilistic graph model to analyze the propagation path of abnormal behavior, risk tracing and diffusion prediction can be achieved, so as to warn potential risks in advance and enhance the initiative of the risk control system. The reinforcement learning risk control strategy engine can intelligently select the optimal risk control strategy through a multi-round game model to evaluate the benefits of different disposal schemes, and improve the decision-making efficiency and accuracy of the risk control system. The homomorphic encryption technology is used to decrypt and verify the verification data packet, which can complete identity authentication under the premise of protecting user data privacy and avoid sensitive information leakage. Continuously optimizing the risk control rule model based on the federated learning framework can achieve multi-party collaborative training without sharing the original data, further improving the generalization ability and robustness of the model while ensuring data security. BRIEF DESCRIPTION OF THE DRAWINGS

[0064] Figure 1 It is a flow chart of a method for implementing risk control of electronic channels based on the code insertion technology according to an embodiment of the present invention;

[0065] Figure 2 The present invention is a schematic diagram of the structure of an electronic channel risk control system based on the coding technology according to an embodiment of the present invention. DETAILED DESCRIPTION

[0066] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0067] The technical solution of the present invention is described in detail with specific embodiments below. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described in detail in some embodiments.

[0068] Figure 1FIG. 1 is a flow chart of a method for implementing electronic channel risk control based on the coding technology according to an embodiment of the present invention. Figure 1 As shown, the method includes:

[0069] S101. Receive an electronic channel access request sent by a user terminal, wherein the electronic channel access request includes user information and channel identification information, encrypt the user information and channel identification information by a double hash algorithm to obtain an original session identification code, inject a timestamp and an increasing sequence number into the original session identification code by using a distributed time series counter to form a dynamic session identification code, perform duplicate checking and filtering on the dynamic session identification code by using a Bloom filter, and use an adaptive segmentation algorithm to divide the dynamic session identification code into multiple variable-length coding segments, and respectively embed service feature markers into the multiple variable-length coding segments to form a target coding sequence with multi-dimensional features;

[0070] S102. Construct a dynamic risk control rule model based on a graph neural network, parse the target coding sequence through a feature extraction subnetwork, extract the user's biological feature vector, behavior trajectory feature tensor and device environment feature matrix, use an attention mechanism to perform multi-level weighted fusion on the extracted features to generate a user risk score, compare the user risk score with an adaptive risk threshold dynamically calculated based on spatiotemporal distribution, and when the user risk score exceeds the adaptive risk threshold, analyze the propagation path of the abnormal behavior based on a probabilistic graph model, and generate an intelligent risk warning report containing risk tracing information and risk diffusion prediction;

[0071] S103. According to the intelligent risk warning report, the risk control strategy engine based on reinforcement learning is called, and the optimal risk control disposal strategy is determined after the benefits of different disposal plans are evaluated through a multi-round game model. Based on the optimal risk control disposal strategy, a multi-factor interactive verification instruction including a biometric recognition instruction and an environmental factor verification instruction is issued to the user terminal, and a verification data packet returned after the user completes the multi-factor interactive verification instruction is received. The verification data packet is decrypted and verified using homomorphic encryption technology, and a preset blocking mechanism is selectively activated according to the verification result. The interactive data of the verification process and the blocking execution result are synchronized to the distributed risk control data center in real time, and the risk control rule model is continuously optimized based on the federated learning framework.

[0072] The user information obtained in this application has been obtained with the user's consent and complies with relevant laws and policies.

[0073] Among them, the electronic channel access request contains user information and channel identification information. User information includes but is not limited to the user's personal identity information (such as mobile phone number, account name, IP address, etc.) and device information (such as device model, operating system version, etc.). Channel identification information indicates the specific channel from which the request comes, such as APP, Web and other platforms.

[0074] Then, the system injects a timestamp and an increasing sequence number into the session identification code through a distributed time series counter. The timestamp ensures the timeliness of the session, while the increasing sequence number ensures the uniqueness of the identification code and prevents conflicts during concurrent access. The dynamic session identification code is generated by combining the timestamp and the increasing sequence number to ensure that each session has a unique and timely identification.

[0075] After generating the dynamic session identification code, the system begins to assess the user's risk. A dynamic risk control rule model is constructed using graph neural network (GNN), combining multiple user characteristics for risk analysis.

[0076] Among them, the dynamic session identification code is divided into multiple variable-length coding segments through an adaptive segmentation algorithm, and a service feature marker (such as access time, device information, etc.) is embedded in each segment to form a target coding sequence with multi-dimensional characteristics.

[0077] Among them, biometric features include fingerprints, facial recognition, etc., behavioral tracks involve the user's login location, operation frequency, etc., and the device environment includes hardware and software configuration.

[0078] After the risk control assessment, the system executes the risk control strategy to deal with potential risks. The risk control strategy engine based on reinforcement learning evaluates different disposal plans through multiple rounds of games and selects the optimal risk control strategy.

[0079] The system uses a multi-round game model of reinforcement learning to evaluate the effectiveness of different risk control solutions. These solutions may include requiring users to undergo secondary identity verification, restricting operations, or freezing accounts. The game model can automatically select the most appropriate solution strategy.

[0080] In an optional implementation, encrypting the user information and the channel identification information by a double hash algorithm to obtain an original session identification code, and injecting a timestamp and an increasing sequence number into the original session identification code by using a distributed time series counter to form a dynamic session identification code includes:

[0081] Extracting field identifiers and field values ​​from the user information to construct a field mapping table, sorting the fields in the field mapping table based on a preset field priority, normalizing the sorted field values ​​according to a standard data format to obtain normalized user information, and using a double hash algorithm based on key dispersion to perform block encryption on the normalized user information to obtain a first information summary;

[0082] The first information digest and the channel identification information are concatenated according to a preset separator and encoding rule to obtain combined information, the combined information is digitally signed to obtain signature information, and the combined information and the signature information are subjected to multiple rounds of operations using a key-based hash algorithm to obtain an original session identification code;

[0083] Obtain a count key value of the current time segment from the distributed storage cluster, perform an atomic increment operation on the count key value through a distributed lock mechanism to obtain an incrementing sequence number, combine the incrementing sequence number with the access node identifier and the current timestamp in the channel identifier information through a mask operation to obtain a time series counting code, wherein the time series counting code includes a time base identification bit, a time precision bit segment, a node identification bit segment, and a counting bit segment;

[0084] The binary sequence of the original session identification code and the binary sequence of the timing counting code are combined through bit operation to obtain a dynamic session identification code.

[0085] Exemplarily, first, extract the key fields and their corresponding values ​​in the user information, such as the user ID is "12345", the user name is "TestUser", and the login IP is "192.168.1.1". This information is constructed into a field mapping table. According to the predefined field priority, such as the user ID has the highest priority, followed by the user name, and finally the login IP, the fields in the field mapping table are sorted. The sorted result is the user ID, the user name, and the login IP. Next, the sorted field values ​​are normalized to conform to the standard data format. For example, the IP address is converted to a long integer, and the user name is converted to UTF-8 encoding. Assume that the normalized user information is "12345TestUser192.168.1.1". Use a double hash algorithm based on key dispersion, such as the HMAC-SHA256 algorithm, to perform block encryption operations on the normalized user information. First, divide the user information into several blocks, then use different keys to perform hash operations on each block, and finally splice the hash values ​​of all blocks to obtain the first information summary. Assume that the first information digest is "abcdef123456".

[0086] Then, the first information summary and the channel identification information (for example, the channel ID is "channel123") are concatenated according to the preset separator (for example, "-") and encoding rules (for example, UTF-8 encoding) to obtain the combined information. The concatenated combined information is "abcdef123456-channel123". The combined information is digitally signed, for example, using the RSA algorithm to obtain the signature information "signature_info". Using a key-based hash algorithm, such as the SHA256 algorithm, multiple rounds of operations are performed on the combined information and the signature information to obtain the original session identification code. For example, the combined information and the signature information are concatenated and then subjected to the first round of hash operations, and then the hash result of the first round is concatenated with the key again to perform the second round of hash operations, and so on. After multiple rounds of operations, the final original session identification code is obtained, which is assumed to be "original_session_id".

[0087] Next, obtain the count key value of the current time segment (e.g., the current minute) from the distributed storage cluster (e.g., Redis cluster). Assume that the count key value of the current minute is 100. Perform an atomic increment operation on the count key value through a distributed lock mechanism (e.g., Redis's SETNX command) to obtain an incrementing sequence number. The incremented count key value is 101, and the incrementing sequence number is 101. The incrementing sequence number 101 is combined with the access node identifier (e.g., the node ID is "node01") in the channel identifier information and the current timestamp (e.g., 20240726100000) through a mask operation to obtain a time series counting code. The time series counting code includes a time base identification bit, a time precision bit segment, a node identification bit segment, and a counting bit segment. For example, convert the timestamp into binary, convert the node identifier into binary, convert the incrementing sequence number into binary, and then combine these binary sequences according to a predetermined format and mask to obtain the final time series counting code, which is assumed to be "timestamp_code".

[0088] Finally, the binary sequence of the original session identification code "original_session_id" and the binary sequence of the time count code "timestamp_code" are combined through a bit operation (such as an exclusive OR operation) to obtain the final dynamic session identification code "dynamic_session_id".

[0089] In this embodiment, the double hash algorithm and digital signature technology are used to effectively ensure the security of user information and session identification, and prevent forgery and tampering. Combined with the distributed time series counter, the global uniqueness of each dynamic session identification code is guaranteed, and conflicts and duplications are avoided. The distributed storage cluster and distributed lock mechanism are used to achieve high concurrency and high performance session identification code generation, meeting the needs of large-scale applications.

[0090] In an optional implementation, the dynamic session identification code is filtered through a Bloom filter for duplicate checking, and an adaptive segmentation algorithm is used to divide the dynamic session identification code into multiple variable-length coding segments, and the multiple variable-length coding segments are respectively embedded with service feature markers to form a target coding sequence with multi-dimensional features, including:

[0091] Extracting the business scenario identifier, security level information and timestamp information from the dynamic session identification code, determining a feature embedding strategy based on the business scenario identifier, determining a coding segmentation parameter based on the security level information, and calculating the effective duration of the session identification code based on the timestamp information;

[0092] Constructing a multi-stage Bloom filter group, the multi-stage Bloom filter group includes a fast filtering layer and an accurate deduplication layer, wherein the fast filtering layer uses a first hash function family and a first bitmap to perform coarse-grained duplicate checking, and the accurate deduplication layer uses a second hash function family and a second bitmap to perform fine-grained verification, the dynamic session identification code is sequentially passed through the fast filtering layer and the accurate deduplication layer for duplicate checking and filtering, and a duplication probability evaluation value is generated, and when the duplication probability evaluation value exceeds a preset evaluation threshold, a regeneration process of the session identification code is triggered;

[0093] Calculate the local entropy distribution curve of the binary sequence of the dynamic session identification code in multiple sliding windows, use a peak detection algorithm to identify entropy mutation points from the local entropy distribution curve as candidate segmentation positions, build segmentation constraints in combination with the coding segmentation parameters, and divide the dynamic session identification code into multiple variable-length coding segments based on a dynamic programming algorithm, where the information entropy distribution of the multiple variable-length coding segments meets a balance condition and the overlap between the segments is lower than a preset threshold;

[0094] Convert the business scenario identifier into a ternary sequence, wherein the values ​​in the ternary sequence correspond to basic operations, sensitive operations, and privileged operations, respectively; construct a coding template based on the ternary sequence, wherein the coding template includes a front-end bit, a middle-end bit, and a back-end bit; and map the business information according to the coding template to generate an initial feature code;

[0095] The target feature code is obtained by performing a cyclic shift on the initial feature code, the target feature code is embedded in the variable-length coding segment based on the feature embedding strategy, a check bit is added to the head of the variable-length coding segment to generate a coding segment with a feature mark, and the coding segment with the feature mark is reorganized by using an interleaved coding method so that the feature marks of adjacent segments are staggered to generate a target coding sequence with multi-dimensional features.

[0096] Exemplarily, first, extract key information of the dynamic session identification code. Extract business scenario identification, security level information and timestamp information from the dynamic session identification code. For example, a session identification code is "ABC1234567890-20231027100000", where "ABC" represents the business scenario identification, "123" represents the security level, and "20231027100000" represents the timestamp.

[0097] Determine the processing strategy based on the extracted information. Determine the feature embedding strategy based on the business scenario identifier "ABC". For example, if "ABC" represents an online payment scenario, a high-intensity feature embedding strategy is adopted. Determine the encoding segmentation parameters based on the security level information "123". For example, if "123" represents a high level of security, the encoding segment length is set to a shorter value. Calculate the validity period of the session identification code based on the timestamp information "20231027100000". For example, the validity period is 24 hours.

[0098] Perform duplicate checking and filtering, and build a multi-level Bloom filter group, which includes a fast filtering layer and an accurate deduplication layer. The fast filtering layer uses a set of hash functions and a bitmap for coarse-grained duplicate checking. For example, three hash functions are used to map the session identification code to three positions of the bitmap. If the values ​​of these three positions are all 1, it is preliminarily determined that the session identification code already exists. The accurate deduplication layer uses another set of hash functions and another bitmap for fine-grained verification. For example, five hash functions are used for verification. If the values ​​of the five positions are all 1, it is finally determined that the session identification code already exists. Assuming that the currently processed session identification code is "DEF4567890123-20231027110000", if no duplication is detected in the fast filtering layer and the accurate deduplication layer, continue with subsequent processing. If the duplication probability evaluation value exceeds the preset threshold, such as 80%, the regeneration process of the session identification code is triggered.

[0099] Adaptively segment the dynamic session identification code. Calculate the local entropy distribution curve of the binary sequence of the dynamic session identification code in multiple sliding windows. For example, use a sliding window of length 16 to calculate the entropy of the binary sequence in each window. Use a peak detection algorithm to identify entropy mutation points from the local entropy distribution curve as candidate segmentation positions. For example, three entropy mutation points are identified. Construct segmentation constraints in combination with coding segmentation parameters. For example, the segment length is not less than 8 and not more than 32. Divide the dynamic session identification code into multiple variable-length coding segments based on a dynamic programming algorithm, for example, divide the identification code into four segments with lengths of 15, 20, 12 and 18 respectively. Ensure that the information entropy distribution of multiple variable-length coding segments meets the equilibrium condition and the overlap between segments is lower than a preset threshold, such as 10%.

[0100] Embed the service feature into the coding segment. Convert the service scenario identifier "ABC" into a ternary sequence, for example, "A" is converted to 0, "B" is converted to 1, and "C" is converted to 2, to obtain the ternary sequence "012". Construct a coding template based on the ternary sequence, for example, the template is "front segment-middle segment-back segment". Generate an initial feature code by mapping the service information according to the coding template, for example, map "012" to "100-010-001". Perform a cyclic shift on the initial feature code to obtain the target feature code, for example, cyclically shift "100-010-001" left by one position to obtain "001-100-010". Embed the target feature code into the variable-length coding segment based on the feature embedding strategy. For example, embed "001-100-010" into the head of the first segment "110010101110011" to obtain "001100010110010101110011". Add a check bit to the head of the variable-length code segment, for example, add two check bits "10" to generate a code segment with a characteristic mark "1000110001011001010101110011". Use interleaving coding to reorganize the code segments with characteristic marks, so that the characteristic marks of adjacent segments are staggered, and generate a target code sequence with multi-dimensional features.

[0101] In this embodiment, the risk of session identification codes being predicted and forged is effectively reduced through multi-level Bloom filter duplicate checking and adaptive segmentation algorithm, thereby improving the security of the system. The Bloom filter duplicate checking mechanism can effectively identify duplicate session identification codes, ensure the uniqueness of each session identification code, and avoid potential conflicts and errors. By embedding the service feature marker bit, the generated coding sequence carries rich service information, which can better support the processing and analysis of service logic.

[0102] In an optional implementation, a dynamic risk control rule model is constructed based on a graph neural network, the target coding sequence is parsed through a feature extraction sub-network, the user biometric feature vector, the behavior trajectory feature tensor and the device environment feature matrix are extracted, and the extracted features are subjected to multi-level weighted fusion using an attention mechanism to generate a user risk score, including:

[0103] Performing partition analysis on the feature bits in the target coding sequence, calculating the local entropy value distribution of the feature bits based on a sliding window, determining the feature segmentation position from the local entropy value distribution, dividing the target coding sequence into business feature segments, behavior feature segments and environment feature segments, and performing reverse mapping on each feature segment to obtain original feature data;

[0104] Constructing a feature extraction subnetwork, the feature extraction subnetwork includes a biometric channel, a behavior trajectory channel and a device environment channel, wherein the biometric channel extracts the operation habit feature, the touch screen pressure feature and the operation interval feature in the service feature segment to generate a biometric feature vector, the behavior trajectory channel extracts the operation sequence in the behavior feature segment to generate a behavior trajectory feature tensor, and the device environment channel extracts the device fingerprint feature, the network environment feature and the geographic location feature in the environment feature segment to generate a device environment feature matrix;

[0105] Constructing a heterogeneous graph neural network, mapping the biological feature vector, behavior trajectory feature tensor and device environment feature matrix into different types of graph nodes, calculating the feature correlation between nodes to construct an edge weight matrix, and using a graph attention network to optimize the edge weight matrix to obtain a dynamic connection relationship;

[0106] Design a hierarchical attention mechanism, calculate the importance of different types of nodes and perform feature weighting through the node-level attention layer, selectively aggregate node features based on semantic relevance through the semantic-level attention layer, iteratively update node representations using a graph convolutional network, build a cross-layer feature fusion network, combine features of node representations at different levels, introduce feature gating units to adjust feature transfer strength, retain discriminative features through residual learning, and iteratively optimize to obtain multi-scale fusion features;

[0107] A risk scoring model is constructed based on the multi-scale fusion features to generate risk components including account security risk, transaction behavior risk and environmental abnormality risk, and the risk components are weighted and fused to obtain a user risk score.

[0108] Exemplarily, first, the user's target coding sequence is parsed. The sequence contains the user's behavior information in a specific time period, such as login time, transaction amount, device information, etc., which are stored in a specific coding format. The coding sequence is partitioned and parsed, the feature bits are divided into multiple local areas, and the entropy distribution of each area is calculated using a sliding window mechanism. The entropy value reflects the uncertainty of the information in the area. The higher the entropy value, the greater the uncertainty. According to the change of the local entropy value distribution, the feature segmentation position is determined, and the target coding sequence is divided into business feature segments, behavior feature segments, and environment feature segments. Then, each feature segment is reverse mapped and converted into original feature data, such as user login time, transaction amount, device type, etc.

[0109] Assume that the target coding sequence is "1001011100110100", and set the sliding window size to 4. Calculate the entropy value of the first window "1001", and then calculate the subsequent windows "0010", "0101", etc. in turn to obtain the local entropy value distribution sequence. If the entropy value changes significantly at a certain position, the position is determined as the segmentation point. Assuming that the entropy value changes greatly between "10010111" and "00110100", the sequence is divided into two segments: "10010111" and "00110100". After reverse mapping, the first segment may correspond to business features such as user login time and transaction amount, and the second segment may correspond to environmental features such as user device information.

[0110] Next, construct a feature extraction subnetwork. This subnetwork contains a biometric channel, a behavior trajectory channel, and a device environment channel. The biometric channel extracts features such as user operation habits, touch screen pressure, and operation interval in the business feature segment to generate a biometric vector. For example, the average login time of the user, the fluctuation range of the transaction amount, the strength and frequency of clicking the screen, etc. The behavior trajectory channel extracts the user operation sequence in the behavior feature segment to generate a behavior trajectory feature tensor. For example, the user's login, browsing, transaction, and other operation sequences within a period of time. The device environment channel extracts features such as device fingerprints, network environment, and geographic location in the environment feature segment to generate a device environment feature matrix. For example, the user's device model, operating system version, IP address, geographic location coordinates, etc.

[0111] Taking the user operation sequence "login - browse product A - add to shopping cart - browse product B - place order - pay" as an example, the behavior trajectory channel can convert it into a tensor, in which each dimension represents a different operation type.

[0112] Then, a heterogeneous graph neural network is constructed. The extracted biometric feature vectors, behavioral trajectory feature tensors, and device environment feature matrices are mapped to different types of graph nodes. The feature correlation between nodes is calculated, such as cosine similarity or Pearson correlation coefficient, and an edge weight matrix is ​​constructed. The edge weight matrix is ​​optimized using a graph attention network to obtain a dynamic connection relationship that represents the degree of association between different features.

[0113] For example, there may be a strong correlation between a user's biometric vector and the behavioral trajectory feature tensor, reflecting the connection between the user's operating habits and his or her behavioral trajectory.

[0114] After that, a hierarchical attention mechanism is designed. The importance of different types of nodes is calculated through the node-level attention layer and feature weighting is performed, for example, weighting is performed according to the degree or centrality of the node. Through the semantic-level attention layer, node features are selectively aggregated based on semantic relevance, for example, semantically similar features are merged. A graph convolutional network is used to iteratively update the node representation, fusing the node's own features and the features of its neighboring nodes. A cross-layer feature fusion network is constructed to combine features of node representations at different levels, for example, splicing node-level features and semantic-level features. A feature gating unit is introduced to adjust the feature transfer strength and control the contribution of different features. Residual learning is used to retain discriminative features to avoid information loss. Iterative optimization is performed to obtain multi-scale fusion features.

[0115] Finally, a risk scoring model is constructed based on multi-scale fusion features. Risk components including account security risk, transaction behavior risk, and environmental abnormality risk are generated. For example, if the user's login time is abnormal, the transaction amount is too large, or the device environment changes, the corresponding risk component will be higher. The risk components are weighted and fused to obtain the final user risk score.

[0116] In this embodiment, through multi-level feature extraction and fusion, user risk information can be captured more comprehensively, thereby improving the accuracy of risk identification. The structure of the graph neural network can clearly show the correlation between different features, enhance the interpretability of the model, and facilitate the analysis of the causes of risks. The dynamic graph structure and attention mechanism can adjust the risk assessment strategy in real time according to changes in user behavior, improving the real-time and adaptability of the model.

[0117] In an optional implementation, the user risk score is compared with an adaptive risk threshold dynamically calculated based on spatiotemporal distribution. When the user risk score exceeds the adaptive risk threshold, the propagation path of the abnormal behavior is analyzed based on a probabilistic graph model, and an intelligent risk early warning report containing risk tracing information and risk diffusion prediction is generated, including:

[0118] Collect user risk scores and geographic location data within the historical time window, calculate the risk distribution density function through kernel density estimation, extract time series features in combination with exponentially weighted moving average, construct a spatial correlation matrix based on geographic grid division to extract spatial correlation features, and input the time series features and the spatial correlation features into a deep neural network to generate spatiotemporal fusion features;

[0119] Constructing a combined risk function based on the spatiotemporal fusion features, inputting the combined risk function into a Bayesian optimizer, iteratively updating the weight coefficient of the combined risk function with the goal of minimizing the weighted sum of the risk detection rate and the false alarm rate, and outputting an adaptive risk threshold;

[0120] A probabilistic graphical model is constructed based on user interaction data, wherein the probabilistic graphical model includes an observation layer, a latent variable layer, and a conditional probability layer, user nodes are mapped to the observation layer, risk factors are mapped to the latent variable layer, and parameter distribution of the conditional probability layer is learned based on a variational inference method;

[0121] Performing a belief propagation operation on the probabilistic graph model, calculating the risk propagation probability between nodes based on the parameter distribution, inputting the risk propagation probability into a graph attention network to extract node risk features, and performing a graph convolution operation on the node risk features to obtain edge propagation features;

[0122] The joint distribution of the node risk characteristics and the edge propagation characteristics is modeled using Markov random fields, potential function parameters are optimized by maximum likelihood estimation, a risk propagation path graph is constructed based on the potential function parameters, and topological features of the risk propagation path graph are extracted;

[0123] When it is detected that the user risk score exceeds the adaptive risk threshold, the topological features are input into the recurrent neural network, the risk tracing path is located through depth-first search, and the risk diffusion range is predicted through breadth-first search. A risk propagation situation map is generated based on the temporal pattern of the risk tracing path and the spatial distribution of the risk diffusion range. Dynamic clustering analysis is performed on the risk propagation situation map to identify high-risk propagation areas and extract key propagation nodes. An intelligent risk warning report containing risk tracing information and risk diffusion prediction is generated by combining the spatiotemporal distribution characteristics of the high-risk propagation areas and the behavioral characteristics of the key propagation nodes.

[0124] For example, first, the risk score and geographic location data of the user within a period of time are obtained. For example, we can collect the risk score of the user in the past month, and the geographic location information (latitude and longitude) of the user when performing the scoring operation.

[0125] Next, the kernel density estimation method is used to calculate the density function of the risk distribution, which describes the density of different geographical locations and risk scores. At the same time, the exponentially weighted moving average method is used to extract time series features, such as the short-term and long-term trends of risk scores. Then, the geographical area is divided into several grids, and the spatial correlation matrix is ​​calculated based on the risk scores of users in different grids to extract spatial correlation features. A city can be divided into 100x100 grids, the average risk score of users in each grid is calculated, and the correlation of average risk scores between adjacent grids is calculated.

[0126] The extracted time series features and spatial correlation features are input into a deep neural network to generate spatiotemporal fusion features. A multi-layer perceptron network can be used to take the time series features and spatial correlation features as input, and after multiple layers of nonlinear transformation, a feature vector that integrates spatiotemporal information is output.

[0127] The combined risk function is constructed using the spatiotemporal fusion features. This function maps the spatiotemporal fusion features to a risk value. For example, a linear function can be used to multiply each dimension of the spatiotemporal fusion features by different weight coefficients, and then sum them up to obtain the risk value.

[0128] The combined risk function is input into the Bayesian optimizer, with the goal of minimizing the weighted sum of the risk detection rate and the false alarm rate, and the weight coefficient of the combined risk function is iteratively updated to finally output the adaptive risk threshold. The weight of the risk detection rate can be set to 0.8, and the weight of the false alarm rate can be set to 0.2. Through the Bayesian optimization algorithm, a set of weight coefficients is found to minimize 0.8×risk detection rate+0.2×false alarm rate.

[0129] A probabilistic graph model is constructed based on user interaction data. The model consists of an observation layer, a latent variable layer, and a conditional probability layer. User nodes are mapped to the observation layer, risk factors are mapped to the latent variable layer, and the parameter distribution of the conditional probability layer is learned using a variational inference method. Transaction records between users can be used as user interaction data, and credit rating, activity, etc. can be used as risk factors. Assuming that there is a transaction record between user A and user B, there is an edge connection between user A and user B in the probabilistic graph model.

[0130] The belief propagation operation is performed on the probabilistic graph model to calculate the risk propagation probability between nodes based on the parameter distribution. The risk propagation probability is input into the graph attention network to extract the node risk features, and then the graph convolution operation is performed on the node risk features to obtain the edge propagation features. For example, if there is a high risk propagation probability between user A and user B, then the feature value of the edge connecting user A and user B will be high.

[0131] The joint distribution of node risk characteristics and edge propagation characteristics is modeled using Markov random fields, and the potential function parameters are optimized through maximum likelihood estimation. A risk propagation path graph is constructed based on the potential function parameters, and the topological features of the graph are extracted. For example, we can calculate topological features such as the average path length of the risk propagation path graph and the degree distribution of nodes.

[0132] When it is detected that the user risk score exceeds the adaptive risk threshold, the topological features are input into the recurrent neural network, the risk tracing path is located through depth-first search, and the risk diffusion range is predicted through breadth-first search. A risk propagation situation map is generated based on the temporal pattern of the risk tracing path and the spatial distribution of the risk diffusion range. Dynamic clustering analysis is performed on the risk propagation situation map to identify high-risk propagation areas and extract key propagation nodes. An intelligent risk warning report containing risk tracing information and risk diffusion prediction is generated by combining the spatiotemporal distribution characteristics of high-risk propagation areas and the behavioral characteristics of key propagation nodes.

[0133] In this embodiment, by combining spatiotemporal information and probabilistic graph models, high-risk users can be identified more accurately and risk propagation paths can be predicted, reducing false positives and false negatives. Adaptive risk thresholds and dynamic clustering analysis can adjust early warning strategies based on real-time data changes, and timely discover and respond to potential risks. Intelligent risk early warning reports provide rich risk tracing information and risk diffusion predictions, helping risk managers quickly locate the source of risks, take effective prevention and control measures, and reduce risk losses.

[0134] In an optional implementation, according to the intelligent risk warning report, a risk control strategy engine based on reinforcement learning is called, and the optimal risk control strategy is determined after the benefits of different disposal schemes are evaluated through a multi-round game model. Based on the optimal risk control strategy, a multi-factor interactive verification instruction including a biometric identification instruction and an environmental factor verification instruction is issued to the user terminal, including:

[0135] Extract user risk scores, abnormal behavior characteristics and environmental abnormal factors from the intelligent risk warning report to construct a state space, construct biometric verification instructions, environmental factor verification instructions and behavioral feature comparison instructions into an action space, and combine the risk treatment effect value, user experience impact coefficient and operating cost parameters in the state space to construct an instant reward function;

[0136] Input the feature vectors of each dimension in the state space and the verification instruction sequence in the action space into the multi-round game model, build a game confrontation relationship based on the defense strategy matrix and the opponent strategy matrix, combine the instant reward function and the historical verification pass rate to build a strategy utility function, and solve the optimal countermeasure by iteratively calculating the maximum and minimum values ​​to obtain the mixed strategy distribution;

[0137] Input the mixed strategy distribution into a dual value function network, construct state-action pairs based on the state space and the action space, store the state-action pairs and corresponding reward data into a replay cache to form a training sample set, obtain training data by batch sampling from the training sample set, and input the training data into the dual value function network to alternately update network parameters;

[0138] Input the current state vector into the updated dual-value function network, calculate the defense strategy value of each action based on the updated network parameters, stratify the defense strategy value according to the score range, perform strategy sampling in each stratum to generate a candidate strategy set, perform weighted combination of the candidate strategy set and the user's historical verification pass rate, and output the optimal risk control disposal strategy by comparing the weighted scores;

[0139] Based on the optimal risk control disposal strategy, the biometric verification factors and environmental feature verification factors to be verified are extracted, the verification factors are prioritized according to the user's historical verification pass rate to obtain a verification order, and the verification instructions of the biometric verification factor and the environmental feature verification factor are packaged according to the verification order to generate a multi-factor interactive verification instruction.

[0140] For example, first, key information is extracted from the intelligent risk warning report. This includes the user's risk score, such as a score calculated based on historical behavior and credit records; abnormal behavior characteristics, such as multiple login attempts or large transfers in a short period of time; and environmental abnormal factors, such as frequent changes in login IP addresses or device abnormalities. This information constitutes a state space that describes the current risk status.

[0141] Next, define the actions that can be taken, i.e. the action space. This includes biometric verification instructions, such as fingerprint verification or face recognition; environmental factor verification instructions, such as device fingerprint verification or IP address verification; and behavioral feature comparison instructions, such as comparison with the user's historical behavior pattern.

[0142] In order to evaluate the effects of different actions, an immediate reward function is constructed. This function comprehensively considers the risk management effect value, such as the number of successful interception of risky operations; the user experience impact coefficient, such as the cumbersomeness of the verification steps; and the operating cost parameters, such as the computing resources and time required for verification. For example, successfully intercepting high-risk operations will receive a high reward, while frequent verification operations will reduce the reward.

[0143] Subsequently, a multi-round game model is used for strategy optimization. The feature vectors of the state space and the verification instruction sequence of the action space are input into the model to simulate the game process between the attacker and the defender. The defender's strategy matrix represents the different verification strategies adopted by the system, and the adversary's strategy matrix represents the behavior pattern of potential attackers. The strategy utility function combines the immediate reward function and the historical verification pass rate to evaluate the long-term effectiveness of different strategies. Through iterative calculation, the mixed strategy distribution that maximizes the defender's benefits is found, such as choosing different verification methods with different probabilities in different situations.

[0144] In order to further improve the adaptability of the strategy, a dual value function network is used for training. The state space, action space, and corresponding reward data are constructed into a training sample set and input into the dual value function network for training. The network continuously learns and optimizes strategy selection to maximize long-term benefits. For example, if a certain verification method does not work well in a specific situation, the network will adjust its selection probability.

[0145] In actual applications, the current state vector is input into the trained dual-value function network to calculate the defense strategy value of each action. The strategies are layered according to their value, and strategies are sampled within each layer to generate a set of candidate strategies. For example, the 20% strategies with the highest value are placed in the first layer, the next 30% are placed in the second layer, and so on. Finally, the candidate strategy set is weighted and combined with the user's historical verification pass rate. For example, if the user has often passed fingerprint verification in the past, the weight of fingerprint verification is increased, and the optimal risk control disposal strategy is finally output.

[0146] Based on the optimal risk control strategy, extract the biometric and environmental features that need to be verified, and prioritize them according to the user's historical verification pass rate. For example, if the user has a high fingerprint verification pass rate in the past, fingerprint verification will be prioritized. Finally, these verification instructions are packaged to generate multi-factor interactive verification instructions and sent to the user terminal.

[0147] In this embodiment, through the multi-round game model and reinforcement learning algorithm, the engine can more accurately identify risks and adopt more effective disposal strategies to reduce the probability of risk events. By combining user historical behavior and real-time risk assessment, the engine can dynamically adjust the verification strength to avoid excessive verification and improve user experience. By optimizing the verification strategy, reducing unnecessary verification operations, and reducing the computing resources and time required for verification, operating costs can be reduced.

[0148] In an optional implementation, a verification data packet returned by a user after completing a multi-factor interactive verification instruction is received, the verification data packet is decrypted and verified using homomorphic encryption technology, a preset blocking mechanism is selectively activated according to the verification result, and the interactive data of the verification process and the blocking execution result are synchronized in real time to a distributed risk control data center. The risk control rule model is continuously optimized based on a federated learning framework, including:

[0149] Decrypt the verification data packet using a segmented decryption strategy to obtain decrypted verification data, perform multi-dimensional feature matching on the decrypted verification data and the user's historical feature template, and calculate the matching score of each dimensional feature;

[0150] Input the matching scores of the features of each dimension into a pre-built risk control rule model, the risk control rule model includes a feature evaluation neural network and a rule generation decision tree, generate a verification result based on the output score of the feature evaluation neural network, use a hierarchical clustering algorithm to divide the verification result into multiple abnormal levels, use the rule generation decision tree to map the abnormal level of the verification result to a risk control rule, select a blocking mechanism of a corresponding level from a preset multi-level blocking strategy library according to the risk control rule and execute it, and record the execution effect of the blocking mechanism;

[0151] Combine the matching scores of each dimension feature, the abnormal level of the verification result, the triggering record of the risk control rule and the execution effect of the blocking mechanism to generate time series feature data, synchronize the time series feature data to each node of the risk control data center, and train the local risk control rule sub-model after desensitizing the time series feature data at each node;

[0152] A federated learning framework is used to securely aggregate the model parameters of each node to obtain the global model parameters. The network weights of the neural network are evaluated based on the update characteristics of the global model parameters. The rule generation decision tree is optimized based on the execution effect of the blocking mechanism. The priority of the risk control rules and the triggering conditions of the blocking mechanisms at each level in the multi-level blocking strategy library are dynamically adjusted to achieve optimization and update of the risk control rule model.

[0153] For example, first, the client requests the server to authenticate the identity. The server generates a challenge containing multiple authentication factors, such as a graphic verification code, a text message verification code, biometric identification, etc., and sends the challenge to the client.

[0154] After the client receives the challenge, the user completes all challenges in sequence. The client combines the response data of each challenge completed by the user and encrypts the combined data packet using homomorphic encryption technology to generate a verification data packet. The client then sends the encrypted verification data packet back to the server.

[0155] After receiving the encrypted verification data packet, the server uses a segmented decryption strategy to decrypt the data packet. For example, the response data of the graphic verification code can be decrypted first, and then the response data of the SMS verification code can be decrypted after the verification is passed, and so on. The decrypted data includes the user's response to each challenge, such as the recognition result of the graphic verification code, the number of the SMS verification code, the feature vector of biometric recognition, etc.

[0156] The server performs multi-dimensional feature matching on the decrypted verification data with the historical feature templates pre-stored by the user. For example, the accuracy and time consumption of the current graphic verification code recognition result are compared with the user's historical recognition result, the SMS verification code input time is compared with the user's historical input time, and the biometric features are compared with the user's historical biometric features. The matching of each dimensional feature will generate a matching score, such as similarity or difference.

[0157] These matching scores are input into the risk control rule model. The model consists of two parts: a feature evaluation neural network and a rule generation decision tree. The feature evaluation neural network calculates a score based on the input matching scores to assess the risk level of this verification.

[0158] According to the output score of the neural network, the system uses a hierarchical clustering algorithm to divide the verification results into multiple abnormal levels. For example, the scores are divided into different levels such as low risk, medium risk, and high risk. The rule generation decision tree maps the abnormal level of the verification result to the corresponding risk control rule. For example, the low risk level corresponds to the release rule, the medium risk level corresponds to the secondary verification rule, and the high risk level corresponds to the access denial rule.

[0159] According to the risk control rules, the system selects and executes the corresponding level of blocking mechanism from the preset multi-level blocking strategy library. For example, low-risk level does not perform any blocking, medium-risk level requires users to authenticate again, and high-risk level directly denies user access. The system records the execution effect of the blocking mechanism, such as whether malicious access is successfully blocked.

[0160] For example, user A performs login verification, and the server sends a graphic verification code and a text message verification code. After user A completes the challenge, the client encrypts the response data and sends it to the server. After the server decrypts, it compares the graphic verification code recognition result with the historical recognition record of user A, and finds that the recognition time is significantly shortened and the matching score is low; the text message verification code input time is compared with the historical record, and it is found that the input time is also within the normal range, and the matching score is high. These two scores are input into the risk control rule model. The neural network calculates the score as medium risk, corresponding to the secondary verification rule. The system requires user A to perform fingerprint verification again. After user A completes the fingerprint verification, the system allows him to log in.

[0161] The system combines the matching scores of each dimension feature, the abnormal level of the verification result, the triggering record of the risk control rule and the execution effect of the blocking mechanism to generate time series feature data. These data are synchronized to each node of the distributed risk control data center.

[0162] At each node, the system desensitizes the received time series feature data, such as removing user identity information, and then uses this data to train the local risk control rule sub-model.

[0163] The system uses a federated learning framework to securely aggregate the model parameters of each node to obtain global model parameters. These global parameters are used to update the characteristics to evaluate the network weights of the neural network, and the decision tree is generated based on the optimization rules of the execution effect of the blocking mechanism. The priority of the risk control rules and the triggering conditions of each level of the blocking mechanism in the multi-level blocking strategy library are dynamically adjusted to achieve continuous optimization and update of the risk control rule model.

[0164] In this embodiment, homomorphic encryption technology is used to protect user verification data, prevent data leakage, and improve the security of identity authentication. Multi-dimensional feature matching and continuous optimization of risk control rule models based on federated learning can more accurately identify malicious access and reduce the misjudgment rate. The system can dynamically adjust the risk control strategy according to actual conditions, adapt to changing attack methods, and improve the effectiveness of the risk control system.

[0165] Figure 2 FIG. 1 is a schematic diagram of a structure of an electronic channel risk control system based on a coding technology according to an embodiment of the present invention. Figure 2 As shown, the system comprises:

[0166] The first unit is used to receive an electronic channel access request sent by a user terminal, wherein the electronic channel access request includes user information and channel identification information, encrypt the user information and the channel identification information by a double hash algorithm to obtain an original session identification code, inject a timestamp and an increasing sequence number into the original session identification code by using a distributed time series counter to form a dynamic session identification code, perform duplicate checking and filtering on the dynamic session identification code by using a Bloom filter, and use an adaptive segmentation algorithm to divide the dynamic session identification code into multiple variable-length coding segments, and respectively embed service feature markers into the multiple variable-length coding segments to form a target coding sequence with multi-dimensional features;

[0167] The second unit is used to build a dynamic risk control rule model based on a graph neural network, parse the target coding sequence through a feature extraction sub-network, extract the user's biological feature vector, behavior trajectory feature tensor and device environment feature matrix, use the attention mechanism to perform multi-level weighted fusion on the extracted features to generate a user risk score, compare the user risk score with an adaptive risk threshold dynamically calculated based on spatiotemporal distribution, and when the user risk score exceeds the adaptive risk threshold, analyze the propagation path of the abnormal behavior based on a probabilistic graph model to generate an intelligent risk warning report containing risk tracing information and risk diffusion prediction;

[0168] The third unit is used to call the risk control strategy engine based on reinforcement learning according to the intelligent risk warning report, determine the optimal risk control disposal strategy after evaluating the benefits of different disposal plans through a multi-round game model, and issue a multi-factor interactive verification instruction including a biometric identification instruction and an environmental factor verification instruction to the user terminal based on the optimal risk control disposal strategy, receive a verification data packet returned after the user completes the multi-factor interactive verification instruction, decrypt and verify the verification data packet using homomorphic encryption technology, selectively activate a preset blocking mechanism according to the verification result, synchronize the interaction data of the verification process and the blocking execution result to the distributed risk control data center in real time, and continuously optimize the risk control rule model based on the federated learning framework.

[0169] According to a third aspect of the embodiments of the present invention,

[0170] An electronic device is provided, comprising:

[0171] processor;

[0172] a memory for storing processor-executable instructions;

[0173] The processor is configured to call the instructions stored in the memory to execute the aforementioned method.

[0174] A fourth aspect of the embodiments of the present invention is:

[0175] A computer-readable storage medium is provided, on which computer program instructions are stored. When the computer program instructions are executed by a processor, the aforementioned method is implemented.

[0176] The present invention may be a method, an apparatus, a system and / or a computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for executing various aspects of the present invention.

[0177] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for implementing electronic channel risk control based on code insertion technology, characterized in that: include: Receive an electronic channel access request sent by a user terminal, the electronic channel access request including user information and channel identification information, encrypt the user information and channel identification information by a double hash algorithm to obtain an original session identification code, inject a timestamp and an increasing sequence number into the original session identification code by using a distributed time series counter to form a dynamic session identification code, perform duplicate checking and filtering on the dynamic session identification code by using a Bloom filter, and divide the dynamic session identification code into a plurality of variable-length coding segments by using an adaptive segmentation algorithm, and respectively embed service feature markers into the plurality of variable-length coding segments to form a target coding sequence with multi-dimensional features; A dynamic risk control rule model is constructed based on a graph neural network. The target coding sequence is parsed through a feature extraction subnetwork to extract the user's biological feature vector, behavior trajectory feature tensor, and device environment feature matrix. The extracted features are subjected to multi-level weighted fusion using an attention mechanism to generate a user risk score. The user risk score is compared with an adaptive risk threshold dynamically calculated based on spatiotemporal distribution. When the user risk score exceeds the adaptive risk threshold, the propagation path of the abnormal behavior is analyzed based on a probabilistic graph model to generate an intelligent risk warning report containing risk tracing information and risk diffusion prediction. According to the intelligent risk warning report, the risk control strategy engine based on reinforcement learning is called, and the optimal risk control strategy is determined after the benefits of different disposal plans are evaluated through a multi-round game model. Based on the optimal risk control strategy, a multi-factor interactive verification instruction containing a biometric identification instruction and an environmental factor verification instruction is issued to the user terminal, and a verification data packet returned after the user completes the multi-factor interactive verification instruction is received. The verification data packet is decrypted and verified using homomorphic encryption technology, and a preset blocking mechanism is selectively activated according to the verification result. The interactive data of the verification process and the blocking execution result are synchronized in real time to the distributed risk control data center, and the risk control rule model is continuously optimized based on the federated learning framework; A dynamic risk control rule model is constructed based on a graph neural network. The target coding sequence is parsed through a feature extraction sub-network to extract the user's biological feature vector, behavior trajectory feature tensor, and device environment feature matrix. The attention mechanism is used to perform multi-level weighted fusion of the extracted features to generate a user risk score, including: Performing partition analysis on the feature bits in the target coding sequence, calculating the local entropy value distribution of the feature bits based on a sliding window, determining the feature segmentation position from the local entropy value distribution, dividing the target coding sequence into business feature segments, behavior feature segments and environment feature segments, and performing reverse mapping on each feature segment to obtain original feature data; Constructing a feature extraction subnetwork, the feature extraction subnetwork includes a biometric channel, a behavior trajectory channel and a device environment channel, wherein the biometric channel extracts the operation habit feature, the touch screen pressure feature and the operation interval feature in the service feature segment to generate a biometric feature vector, the behavior trajectory channel extracts the operation sequence in the behavior feature segment to generate a behavior trajectory feature tensor, and the device environment channel extracts the device fingerprint feature, the network environment feature and the geographic location feature in the environment feature segment to generate a device environment feature matrix; Constructing a heterogeneous graph neural network, mapping the biological feature vector, behavior trajectory feature tensor and device environment feature matrix into different types of graph nodes, calculating the feature correlation between nodes to construct an edge weight matrix, and using a graph attention network to optimize the edge weight matrix to obtain a dynamic connection relationship; Design a hierarchical attention mechanism, calculate the importance of different types of nodes and perform feature weighting through the node-level attention layer, selectively aggregate node features based on semantic relevance through the semantic-level attention layer, iteratively update node representations using a graph convolutional network, build a cross-layer feature fusion network, combine features of node representations at different levels, introduce feature gating units to adjust feature transfer strength, retain discriminative features through residual learning, and iteratively optimize to obtain multi-scale fusion features; A risk scoring model is constructed based on the multi-scale fusion features to generate risk components including account security risk, transaction behavior risk and environmental abnormality risk, and the risk components are weighted and fused to obtain a user risk score.

2. The method according to claim 1, characterized in that Encrypting the user information and the channel identification information by a double hash algorithm to obtain an original session identification code, and injecting a timestamp and an increasing sequence number into the original session identification code by using a distributed time series counter to form a dynamic session identification code includes: Extracting field identifiers and field values ​​from the user information to construct a field mapping table, sorting the fields in the field mapping table based on a preset field priority, normalizing the sorted field values ​​according to a standard data format to obtain normalized user information, and using a double hash algorithm based on key dispersion to perform block encryption on the normalized user information to obtain a first information summary; The first information digest and the channel identification information are concatenated according to a preset separator and encoding rule to obtain combined information, the combined information is digitally signed to obtain signature information, and the combined information and the signature information are subjected to multiple rounds of operations using a key-based hash algorithm to obtain an original session identification code; Obtain a count key value of the current time segment from the distributed storage cluster, perform an atomic increment operation on the count key value through a distributed lock mechanism to obtain an incrementing sequence number, combine the incrementing sequence number with the access node identifier and the current timestamp in the channel identifier information through a mask operation to obtain a time series counting code, wherein the time series counting code includes a time base identification bit, a time precision bit segment, a node identification bit segment, and a counting bit segment; The binary sequence of the original session identification code and the binary sequence of the timing counting code are combined through bit operation to obtain a dynamic session identification code.

3. The method according to claim 1, characterized in that The dynamic session identification code is filtered through a Bloom filter for duplicate checking, and the dynamic session identification code is divided into a plurality of variable-length coding segments by using an adaptive segmentation algorithm, and the plurality of variable-length coding segments are respectively embedded with service feature markers to form a target coding sequence with multi-dimensional features, including: Extracting the business scenario identifier, security level information and timestamp information from the dynamic session identification code, determining a feature embedding strategy based on the business scenario identifier, determining a coding segmentation parameter based on the security level information, and calculating the effective duration of the session identification code based on the timestamp information; Constructing a multi-stage Bloom filter group, the multi-stage Bloom filter group includes a fast filtering layer and an accurate deduplication layer, wherein the fast filtering layer uses a first hash function family and a first bitmap to perform coarse-grained duplicate checking, and the accurate deduplication layer uses a second hash function family and a second bitmap to perform fine-grained verification, the dynamic session identification code is sequentially passed through the fast filtering layer and the accurate deduplication layer for duplicate checking and filtering, and a duplication probability evaluation value is generated, and when the duplication probability evaluation value exceeds a preset evaluation threshold, a regeneration process of the session identification code is triggered; Calculate the local entropy distribution curve of the binary sequence of the dynamic session identification code in multiple sliding windows, use a peak detection algorithm to identify entropy mutation points from the local entropy distribution curve as candidate segmentation positions, build segmentation constraints in combination with the coding segmentation parameters, and divide the dynamic session identification code into multiple variable-length coding segments based on a dynamic programming algorithm, where the information entropy distribution of the multiple variable-length coding segments meets a balance condition and the overlap between the segments is lower than a preset threshold; Convert the business scenario identifier into a ternary sequence, wherein the values ​​in the ternary sequence correspond to basic operations, sensitive operations, and privileged operations, respectively; construct a coding template based on the ternary sequence, wherein the coding template includes a front-end bit, a middle-end bit, and a back-end bit; and map the business information according to the coding template to generate an initial feature code; The target feature code is obtained by performing a cyclic shift on the initial feature code, the target feature code is embedded in the variable-length coding segment based on the feature embedding strategy, a check bit is added to the head of the variable-length coding segment to generate a coding segment with a feature mark, and the coding segment with the feature mark is reorganized by using an interleaved coding method so that the feature marks of adjacent segments are staggered to generate a target coding sequence with multi-dimensional features.

4. The method according to claim 1, characterized in that: The user risk score is compared with an adaptive risk threshold dynamically calculated based on spatiotemporal distribution. When the user risk score exceeds the adaptive risk threshold, the propagation path of the abnormal behavior is analyzed based on a probabilistic graph model to generate an intelligent risk warning report containing risk tracing information and risk diffusion prediction, including: Collect user risk scores and geographic location data within the historical time window, calculate the risk distribution density function through kernel density estimation, extract time series features in combination with exponentially weighted moving average, construct a spatial correlation matrix based on geographic grid division to extract spatial correlation features, and input the time series features and the spatial correlation features into a deep neural network to generate spatiotemporal fusion features; Constructing a combined risk function based on the spatiotemporal fusion features, inputting the combined risk function into a Bayesian optimizer, iteratively updating the weight coefficient of the combined risk function with the goal of minimizing the weighted sum of the risk detection rate and the false alarm rate, and outputting an adaptive risk threshold; A probabilistic graphical model is constructed based on user interaction data, wherein the probabilistic graphical model includes an observation layer, a latent variable layer, and a conditional probability layer, user nodes are mapped to the observation layer, risk factors are mapped to the latent variable layer, and parameter distribution of the conditional probability layer is learned based on a variational inference method; Performing a belief propagation operation on the probabilistic graph model, calculating the risk propagation probability between nodes based on the parameter distribution, inputting the risk propagation probability into a graph attention network to extract node risk features, and performing a graph convolution operation on the node risk features to obtain edge propagation features; The joint distribution of the node risk characteristics and the edge propagation characteristics is modeled using Markov random fields, potential function parameters are optimized by maximum likelihood estimation, a risk propagation path graph is constructed based on the potential function parameters, and topological features of the risk propagation path graph are extracted; When it is detected that the user risk score exceeds the adaptive risk threshold, the topological features are input into the recurrent neural network, the risk tracing path is located through depth-first search, and the risk diffusion range is predicted through breadth-first search. A risk propagation situation map is generated based on the temporal pattern of the risk tracing path and the spatial distribution of the risk diffusion range. Dynamic clustering analysis is performed on the risk propagation situation map to identify high-risk propagation areas and extract key propagation nodes. An intelligent risk warning report containing risk tracing information and risk diffusion prediction is generated by combining the spatiotemporal distribution characteristics of the high-risk propagation areas and the behavioral characteristics of the key propagation nodes.

5. The method according to claim 1, characterized in that According to the intelligent risk warning report, a risk control strategy engine based on reinforcement learning is called, and the optimal risk control strategy is determined after the benefits of different disposal plans are evaluated through a multi-round game model. Based on the optimal risk control strategy, a multi-factor interactive verification instruction including a biometric identification instruction and an environmental factor verification instruction is issued to the user terminal, including: Extract user risk scores, abnormal behavior characteristics and environmental abnormal factors from the intelligent risk warning report to construct a state space, construct biometric verification instructions, environmental factor verification instructions and behavioral feature comparison instructions into an action space, and combine the risk treatment effect value, user experience impact coefficient and operating cost parameters in the state space to construct an instant reward function; Input the feature vectors of each dimension in the state space and the verification instruction sequence in the action space into the multi-round game model, build a game confrontation relationship based on the defense strategy matrix and the opponent strategy matrix, combine the instant reward function and the historical verification pass rate to build a strategy utility function, and solve the optimal countermeasure by iteratively calculating the maximum and minimum values ​​to obtain the mixed strategy distribution; Input the mixed strategy distribution into a dual value function network, construct state-action pairs based on the state space and the action space, store the state-action pairs and corresponding reward data into a replay cache to form a training sample set, obtain training data by batch sampling from the training sample set, and input the training data into the dual value function network to alternately update network parameters; Input the current state vector into the updated dual-value function network, calculate the defense strategy value of each action based on the updated network parameters, stratify the defense strategy value according to the score range, perform strategy sampling in each stratum to generate a candidate strategy set, perform weighted combination of the candidate strategy set and the user's historical verification pass rate, and output the optimal risk control disposal strategy by comparing the weighted scores; Based on the optimal risk control disposal strategy, the biometric verification factors and environmental feature verification factors to be verified are extracted, the verification factors are prioritized according to the user's historical verification pass rate to obtain a verification order, and the verification instructions of the biometric verification factor and the environmental feature verification factor are packaged according to the verification order to generate a multi-factor interactive verification instruction.

6. The method according to claim 1, characterized in that Receive the verification data packet returned by the user after completing the multi-factor interactive verification instruction, use homomorphic encryption technology to decrypt and verify the verification data packet, selectively activate the preset blocking mechanism according to the verification result, synchronize the interactive data of the verification process and the blocking execution result to the distributed risk control data center in real time, and continuously optimize the risk control rule model based on the federated learning framework, including: Decrypt the verification data packet using a segmented decryption strategy to obtain decrypted verification data, perform multi-dimensional feature matching on the decrypted verification data and the user's historical feature template, and calculate the matching score of each dimensional feature; Input the matching scores of the features of each dimension into a pre-built risk control rule model, the risk control rule model includes a feature evaluation neural network and a rule generation decision tree, generate a verification result based on the output score of the feature evaluation neural network, use a hierarchical clustering algorithm to divide the verification result into multiple abnormal levels, use the rule generation decision tree to map the abnormal level of the verification result to a risk control rule, select a blocking mechanism of a corresponding level from a preset multi-level blocking strategy library according to the risk control rule and execute it, and record the execution effect of the blocking mechanism; Combine the matching scores of each dimension feature, the abnormal level of the verification result, the triggering record of the risk control rule and the execution effect of the blocking mechanism to generate time series feature data, synchronize the time series feature data to each node of the risk control data center, and train the local risk control rule sub-model after desensitizing the time series feature data at each node; A federated learning framework is used to securely aggregate the model parameters of each node to obtain the global model parameters. The network weights of the neural network are evaluated based on the update characteristics of the global model parameters. The rule generation decision tree is optimized based on the execution effect of the blocking mechanism. The priority of the risk control rules and the triggering conditions of the blocking mechanisms at each level in the multi-level blocking strategy library are dynamically adjusted to achieve optimization and update of the risk control rule model.

7. An electronic channel risk control system based on code insertion technology, used to implement the method described in any one of claims 1 to 6, characterized in that: include: The first unit is used to receive an electronic channel access request sent by a user terminal, wherein the electronic channel access request includes user information and channel identification information, encrypt the user information and the channel identification information by a double hash algorithm to obtain an original session identification code, inject a timestamp and an increasing sequence number into the original session identification code by using a distributed time series counter to form a dynamic session identification code, perform duplicate checking and filtering on the dynamic session identification code by using a Bloom filter, and use an adaptive segmentation algorithm to divide the dynamic session identification code into multiple variable-length coding segments, and respectively embed service feature markers into the multiple variable-length coding segments to form a target coding sequence with multi-dimensional features; The second unit is used to build a dynamic risk control rule model based on a graph neural network, parse the target coding sequence through a feature extraction sub-network, extract the user's biological feature vector, behavior trajectory feature tensor and device environment feature matrix, use the attention mechanism to perform multi-level weighted fusion on the extracted features to generate a user risk score, compare the user risk score with an adaptive risk threshold dynamically calculated based on spatiotemporal distribution, and when the user risk score exceeds the adaptive risk threshold, analyze the propagation path of the abnormal behavior based on a probabilistic graph model to generate an intelligent risk warning report containing risk tracing information and risk diffusion prediction; The third unit is used to call the risk control strategy engine based on reinforcement learning according to the intelligent risk warning report, determine the optimal risk control disposal strategy after evaluating the benefits of different disposal plans through a multi-round game model, and issue a multi-factor interactive verification instruction including a biometric identification instruction and an environmental factor verification instruction to the user terminal based on the optimal risk control disposal strategy, receive a verification data packet returned after the user completes the multi-factor interactive verification instruction, decrypt and verify the verification data packet using homomorphic encryption technology, selectively activate a preset blocking mechanism according to the verification result, synchronize the interaction data of the verification process and the blocking execution result to the distributed risk control data center in real time, and continuously optimize the risk control rule model based on the federated learning framework.

8. An electronic device, characterized in that: include: processor; a memory for storing processor-executable instructions; The processor is configured to call the instructions stored in the memory to execute the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having computer program instructions stored thereon, characterized in that: When the computer program instructions are executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images