User behavior risk control method and device, equipment and storage medium

Abstract

The invention discloses a risk control method, device and equipment for user behaviors and a storage medium, and the method comprises the steps: continuously obtaining the behaviors of a user when the user enters and accesses a target website through a domain name of the target website, and enabling the behaviors of the user to enter and access the target website when the user operates to place an order; and performing risk analysis and judgment on various behaviors of the user from accessing the target website to operating the order placing to obtain a risk judgment result, if no risk exists, allowing the order placing behavior of the user, if the risk is low, sending human-computer interaction verification to the user, if the risk is medium, performing short message verification code verification on the user, and if the risk is high, refusing the order placing behavior of the user. Therefore, after the user enters the website, each behavior of the user is monitored, so that when the user places an order, whether a series of behavior actions executed in the past have cheating abnormity or not is analyzed, the risk degree is defined, the preferential picking behavior can be identified more accurately and effectively, and corresponding risk control is carried out.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and more specifically, to a method, device, equipment and storage medium for risk control of user behavior. Background Art

[0002] In today's Internet era, many e-commerce websites conduct marketing activities online to increase user activity and develop new users. This marketing method brings convenience and speed, but it also brings some problems.

[0003] Generally, when platforms conduct promotions, they have budgets and KPI indicators, aiming to retain users and achieve long-term profits. However, there is a group of gray-market discount pickers who use marketing activities as an opportunity to use technical means to find bugs caused by platform business loopholes and other reasons, and take away red envelopes and coupons with monetization value in a very short time. Discount pickers often cheat in groups, and a bug information can spread virally in an instant.

[0004] At present, the practice of picking up discounts usually restricts some user information, such as common device number identification, IMEI number identification or IP address, Wifi address, etc. However, more professional discount pickers have iteratively optimized the platform's basic anti-cheating measures. They can disguise a device to present N apps of different models and addresses, directly bypassing the risk control detection of small and medium-sized platforms and even some large platforms.

[0005] In summary, the existing technology only determines whether one is eligible to participate and controls and restricts account information, device information, and IP information, which is unable to effectively deal with the increasingly complex behavior of picking up discounts.

[0006] Based on this, how to accurately and effectively identify the behavior of picking up discounts and conduct corresponding risk control is an issue that needs attention. Summary of the invention

[0007] In view of the above problems, the present application provides a user behavior risk control method, device, equipment and storage medium to accurately and effectively identify preferential picking behavior and perform corresponding risk control.

[0008] In order to achieve the above objectives, the specific plan is proposed as follows:

[0009] A method for risk control of user behavior, comprising:

[0010] When a user accesses the target website through the domain name of the target website, continuously obtaining the user's behavior;

[0011] When the user places an order, a risk analysis is performed on the user's various behaviors from visiting the target website to placing the order, and a risk determination result is obtained;

[0012] If the risk determination result is no risk, the user is allowed to place an order;

[0013] If the risk determination result is low risk, sending a human-computer interaction verification to the user;

[0014] If the risk determination result is medium risk, the user is subject to SMS verification code verification;

[0015] If the risk assessment result is that the risk is high, the user's ordering behavior is rejected.

[0016] Optionally, when the user places an order, a risk analysis is performed on various behaviors of the user from visiting the target website to placing the order, and a risk determination result is obtained, including:

[0017] When the user places an order, various behaviors of the user from visiting the target website to placing the order are retrieved, wherein the various behaviors include one or more of the user's login action, the user's browsing action, the user's page clicking action, the user's page staying action, and the user's ordering action;

[0018] Based on the various behaviors and the time span between the user's behavioral actions, risk analysis and judgment are performed to obtain a risk judgment result.

[0019] Optionally, risk analysis and judgment are performed based on the various behaviors and the time span between the user's behavior actions to obtain a risk judgment result, including:

[0020] If the various behaviors only include multiple order actions of the user on the same page, and the time interval between the order actions of the user is less than the preset time threshold, then the risk determination result is high risk;

[0021] If the user or the IP of the device used by the user places an order more than a first preset number of times on the same page within a first preset time period, the previous risk assessment result is retrieved to obtain a risk assessment result that is not less risky than the previous risk assessment result.

[0022] Optionally, risk analysis and judgment are performed based on the various behaviors and the time span between the user's behavior actions to obtain a risk judgment result, including:

[0023] When the IP addresses of other users or other devices all have the same target action sequence within a second preset period, and the time span between the actions in the target action sequence is the same, and a total of more than a second preset number of order actions occur on the target page, the most recent risk determination result of the other users who have most recently performed the order action determined by the risk analysis is obtained;

[0024] If the user places an order on the target page more than a third preset number of times in the target behavior sequence within the second preset time period, the risk assessment result is no less than the risk level of the most recent risk assessment result.

[0025] Optionally, risk analysis and judgment are performed based on the various behaviors and the time span between the user's behavior actions to obtain a risk judgment result, including:

[0026] Among the various behaviors, determine each key action of the user before executing the order placement action;

[0027] For each key action, determine the risk score of the key action according to the time span between the key action and the next action;

[0028] Add up the risk scores of each key action to get the basic risk score;

[0029] Determine a risk assessment coefficient based on the historical risk determination results of the user, the device information used by the user, the IP information of the device used by the user, and the current popularity of the page where the user performs an order placement action;

[0030] The basic risk score is multiplied by the risk assessment coefficient to obtain a final risk score, so as to evaluate the risk determination result through the final risk score.

[0031] A user behavior risk control device, comprising:

[0032] A user behavior sending unit, used to continuously obtain the user's behavior when the user accesses the target website through the domain name of the target website;

[0033] A risk level determination unit is used to perform risk analysis and determination on various behaviors of the user from visiting the target website to placing the order when the user places the order, and obtain a risk determination result;

[0034] A risk-free processing unit, configured to allow the user to place an order if the risk determination result is risk-free;

[0035] A low risk processing unit, configured to send a human-computer interaction check to the user if the risk determination result is low risk;

[0036] A medium risk processing unit, configured to perform SMS verification code verification on the user if the risk determination result is medium risk;

[0037] The high-risk processing unit is used to reject the user's order behavior if the risk determination result is high risk.

[0038] Optionally, the risk level determination unit includes:

[0039] A user behavior retrieving unit, used to retrieve various behaviors of the user from visiting the target website to operating the order when the user operates the order, wherein the various behaviors include one or more of the user's login action, the user's browsing action, the user's page clicking action, the user's page staying action and the user's ordering action;

[0040] The risk analysis unit is used to perform risk analysis and judgment based on the various behaviors and the time span between the user's behavior actions to obtain a risk judgment result.

[0041] Optionally, the risk analysis unit includes:

[0042] A high risk analysis unit, configured to determine that the risk is high if the various behaviors only include multiple order actions of the user on the same page, and the time interval between the order actions of the user is less than a preset time threshold;

[0043] The first incremental risk analysis unit is used to retrieve the previous risk determination result if the user or the IP of the device used by the user places an order more than a first preset number of times on the same page within a first preset time period, and to obtain a risk determination result that is not less than the risk level of the previous risk determination result.

[0044] Optionally, the risk analysis unit includes:

[0045] A recent risk determination result acquisition unit is used to acquire the recent risk determination result of other users who have recently performed an order action, determined by risk analysis, when the IP addresses of other users or other devices all have the same target action sequence within a second preset time period, and the time span between the action actions in the target action sequence is the same, and a total of more than a second preset number of order actions have occurred on the target page;

[0046] The second incremental risk analysis unit is used to obtain a risk assessment result that is not less than the risk level of the most recent risk assessment result if the user places an order on the target page more than a third preset number of times in the target behavior action sequence within the second preset time period.

[0047] Optionally, the risk analysis unit includes:

[0048] A key action determination unit, used to determine, among the various behaviors, each key action of the user before performing an order placement action;

[0049] A risk score determination unit, configured to determine, for each key action, a risk score of the key action according to a time span from the key action to the next action;

[0050] A basic risk score calculation unit is used to accumulate the risk scores of each key action to obtain a basic risk score;

[0051] A risk assessment coefficient determination unit, configured to determine a risk assessment coefficient according to the historical risk determination result of the user, the device information used by the user, the IP information of the device used by the user, and the current popularity of the page on which the user performs an order placement action;

[0052] The risk determination result determining unit is used to multiply the basic risk score by the risk assessment coefficient to obtain a final risk score, so as to evaluate the risk determination result through the final risk score.

[0053] A user behavior risk control device, comprising a memory and a processor;

[0054] The memory is used to store programs;

[0055] The processor is used to execute the program to implement the various steps of the user behavior risk control method as described above.

[0056] A storage medium stores a computer program, which, when executed by a processor, implements the various steps of the user behavior risk control method as described above.

[0057] By means of the above technical scheme, the present application continuously obtains the user's behavior when the user accesses the target website through the domain name of the target website. When the user places an order, the application conducts risk analysis and judgment on the various behaviors of the user from visiting the target website to placing an order, and obtains a risk judgment result. If the risk judgment result is no risk, the user's order behavior is allowed. If the risk judgment result is low risk, a human-computer interaction verification is sent to the user. If the risk judgment result is medium risk, the user is verified by SMS verification code. If the risk judgment result is high risk, the user's order behavior is rejected. It can be seen that after the user enters the website, each behavior of the user is monitored, so that when the user places an order, the series of behavior actions performed in the past by the user are analyzed to determine whether there are cheating anomalies, thereby defining the risk level, and being able to more accurately and effectively identify the behavior of picking up discounts, and perform corresponding risk control. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present application. Also, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0059] Figure 1 A schematic diagram of a process for implementing risk control of user behavior provided in an embodiment of the present application;

[0060] Figure 2 A schematic diagram of a device structure for implementing risk control of user behavior provided in an embodiment of the present application;

[0061] Figure 3 A schematic diagram of the structure of a device for implementing risk control of user behavior provided in an embodiment of the present application. DETAILED DESCRIPTION

[0062] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0063] The present application solution can be implemented based on a terminal with data processing capabilities, which can be a user behavior analysis center. The terminal can communicate with multiple user terminals, and specifically establish a connection with the user terminal after the user enters the target website, so as to monitor the actions of all users on the target website and make risk management.

[0064] Next, combine Figure 1 The user behavior risk control method of the present application may include the following steps:

[0065] Step S110: When a user accesses the target website through the domain name of the target website, the user's behavior is continuously obtained.

[0066] Specifically, when the target website recognizes that a user has entered to visit, the user behavior analysis center can begin to capture the user's actions.

[0067] In addition, the target website can also implement the behavior collection function code and generate a user ID, and upload the user's access behavior and user ID to the user behavior analysis center.

[0068] Step S120: When the user places an order, risk analysis and judgment are performed on various behaviors of the user from visiting the target website to placing the order to obtain a risk judgment result.

[0069] It is understandable that the user's actions have been collected before placing an order. When the user places an order, it is necessary to identify whether the user's ordering behavior is an act of picking up discounts. Therefore, a risk analysis and judgment can be performed on the user's various behaviors from visiting the target website to placing an order, and whether there are any cheating anomalies in the series of actions performed in the past, thereby defining the degree of risk.

[0070] Step S130: If the risk determination result is no risk, the user is allowed to place an order.

[0071] Specifically, risk-free may mean that the user's actions from visiting the target website to placing an order are not behaviors of picking up discounts, but normal ordering operations, so the user's ordering behavior may be allowed.

[0072] Step S140: If the risk determination result is low risk, a human-computer interaction verification is sent to the user.

[0073] Specifically, low risk means that the user's actions from visiting the target website to placing an order have a low probability of being discount-picking behaviors. At this time, the user can be subjected to a primary verification, such as sending a human-computer interaction verification.

[0074] Furthermore, after the user completes the human-computer interaction verification, the risk level can be further reduced.

[0075] Step S150: If the risk determination result is medium risk, the user is subjected to SMS verification code verification.

[0076] Specifically, low risk means that there is a medium probability that the user's actions from visiting the target website to placing an order are to pick up discounts. At this time, the user can be subject to intermediate verification, such as sending a text message verification code to the user's mobile device for verification.

[0077] Furthermore, after the user completes the SMS verification code verification, the risk level can be further reduced.

[0078] Step S160: If the risk determination result is that the risk is high, rejecting the user's ordering behavior.

[0079] It is understandable that high risk means that the user's actions from visiting the target website to placing an order are identified as picking up discounts, and the user's order behavior is directly rejected. At the same time, the user's device information and IP information can also be listed as high-risk factors until they are lifted after 7 days.

[0080] Among them, the degree of classification of risk judgment results such as no risk, low risk, medium risk and high risk can be based on the risk scoring of users' actions from visiting the target website to placing an order, and is defined according to the high and low scores.

[0081] The risk control method of user behavior provided in this embodiment continuously obtains the user behavior sent by the user's terminal when the user accesses the target website through the domain name of the target website. When the user places an order, the risk analysis and judgment of the various behaviors of the user from visiting the target website to placing an order are performed to obtain the risk judgment result. If the risk judgment result is no risk, the user's order behavior is allowed. If the risk judgment result is low risk, a human-computer interaction verification is sent to the user. If the risk judgment result is medium risk, the user is verified by SMS verification code. If the risk judgment result is high risk, the user's order behavior is rejected. It can be seen that after the user enters the website, each behavior of the user is monitored, so that when the user places an order, the series of behavior actions performed by the user in the past are analyzed to determine whether there are cheating anomalies, thereby defining the risk level, and being able to more accurately and effectively identify the behavior of picking up discounts and perform corresponding risk control.

[0082] In some embodiments of the present application, the process of performing risk analysis and judgment on various behaviors of the user from visiting the target website to placing an order in the above step S120 to obtain a risk judgment result is introduced, and the process may include:

[0083] S1. When the user places an order, various behaviors of the user from visiting the target website to placing an order are retrieved.

[0084] The various behaviors may include one or more of the user's login action, the user's browsing action, the user's page click action, the user's page stay action, and the user's order placement action.

[0085] It is understandable that since the risk analysis is triggered only when the user places an order, various behaviors at least include the user's ordering action, and other actions can be zero or more.

[0086] Specifically, after the user performs the login action, the user ID will be bound, and the subsequent uploaded behavior data will carry the user ID as the user identifier to identify the user. At the same time, a login behavior log will be recorded, including the login time, user ID and other information.

[0087] The user's browsing action can represent each page switching behavior that occurs when the user enters each page. When a page switching behavior occurs, a browsing behavior log will be recorded, recording the behavior time, user ID, browsing address, forward address and other information.

[0088] The user's page click action can represent any click behavior of the user on the page. Every time the user clicks on the page, a click behavior log will be recorded, recording the behavior time, user ID, clicked page address, button element location, button element name and other information.

[0089] The user's page dwell action can refer to the behavior of the user staying on the page after browsing the page. After the user stays on the page, a dwell behavior log will be recorded, recording the behavior time, user ID, page address, dwell time and other information.

[0090] S2. Perform risk analysis and judgment based on the various behaviors and the time span between the user's behavior actions to obtain a risk judgment result.

[0091] Specifically, by collecting information on various behaviors, we can completely restore the user's operation path and the time span between behavioral actions, so as to conduct risk analysis and judgment and obtain risk assessment results.

[0092] The risk control of user behavior provided in this embodiment can restore the user's operation path by analyzing the user's login actions, browsing actions, page click actions and page dwell actions, and more effectively and accurately identify whether the user has the intention to pick up discounts when placing an order.

[0093] In some embodiments of the present application, the process of performing risk analysis and judgment according to the various behaviors and the time span between the user's behavior actions mentioned in the above embodiments to obtain the risk judgment result is introduced, and the process may include the following situations:

[0094] First, if the various behaviors only include multiple ordering actions of the user on the same page, and the time interval between the ordering actions of the user is less than a preset time threshold, the risk determination result is high risk.

[0095] It is understandable that when users who pick up discounts place orders directly through the interface, the user behavior analysis center cannot monitor the user's behavior logs, but directly place batch orders through the interface. For this behavior, the risk assessment result can be directly concluded as high risk.

[0096] The second type is that if the user or the IP of the device used by the user places an order more than a first preset number of times on the same page within a first preset time period, the previous risk assessment result is retrieved and the risk assessment result is obtained to be no less risky than the previous risk assessment result.

[0097] It is understandable that a single user may take advantage of a certain activity product loophole and use the same account or multiple accounts with the same IP address to make a large number of transactions in a short period of time. This behavior of a single user continuously placing orders may lead to picking up discounts. Therefore, with the increase of orders, the risk assessment result is that the degree will also increase.

[0098] The third type is that when the IP addresses of other users or other devices all use the same target behavior action sequence within the second preset time period, and the time span between the behavior actions in the target behavior action sequence is the same, and a total of more than a second preset number of order actions occur on the target page, the most recent risk assessment result of other users who have recently performed an order action and have been judged by risk analysis is obtained.

[0099] Furthermore, if the user places an order on the target page more than a third preset number of times in the target behavior action sequence within the second preset time period, the risk assessment result is a risk level not lower than the most recent risk assessment result.

[0100] It is understandable that after discovering the loophole, users who pick up discounts in the gray market will call on other users to place large numbers of orders for arbitrage. At this time, the user behavior analysis center will show a large number of users with the same sequence of behavioral actions, and the same time span (or similar time interval) between behavioral actions. The ultimate goal of these users is also to place orders for the same products. In response to this situation, when users place multiple orders for the same product on the page during the period when the page product is being ordered, the risk level can be enhanced. Similarly, as the number of times users place orders for the product increases, the risk level will also increase.

[0101] In some embodiments of the present application, the process of performing risk analysis and judgment according to the various behaviors and the time span between the user's behavior actions mentioned in the above embodiments to obtain the risk judgment result is introduced from the risk value scoring method. The process may include:

[0102] S1. Among the various behaviors, determine each key action of the user before placing an order.

[0103] Specifically, the key action may represent a behavioral action that must be performed before placing an order.

[0104] It is understandable that in order to more accurately identify discount-picking behavior and reduce the interference of unnecessary behaviors, necessary behaviors can be selected for analysis.

[0105] S2. For each key action, determine the risk score of the key action according to the time span from the key action to its next action.

[0106] It is understandable that when users who pick up discounts learn that they can make arbitrage by brushing orders, they will become more skilled in operating the website and the time span between actions will be shorter. Therefore, the shorter the time span between the key action and the next action, the more obvious / stronger the intention to pick up discounts, and the higher the risk score of the key action.

[0107] S3. Add up the risk scores of each key action to obtain the basic risk score.

[0108] Specifically, the basic risk score can indicate the strength of the user's intention to pick up discounts as revealed by the user's action path before placing an order.

[0109] S4. Determine a risk assessment coefficient based on the historical risk determination results of the user, the device information used by the user, the IP information of the device used by the user, and the current popularity of the page where the user performs an order placement action.

[0110] Specifically, the user's historical risk assessment results, the device information used by the user, and the IP information of the device used by the user can indicate whether the user has taken actions to pick up discounts and whether the user has met the conditions for picking up discounts. The current popularity of the page where the user places an order can reflect whether the product on the page is eligible for the discount.

[0111] S5. Multiply the basic risk score by the risk assessment coefficient to obtain a final risk score, so as to evaluate the risk determination result through the final risk score.

[0112] The following is a description of an apparatus for implementing risk control of user behavior provided in an embodiment of the present application. The apparatus for implementing risk control of user behavior described below and the method for implementing risk control of user behavior described above can be referenced to each other.

[0113] See also Figure 2 , Figure 2 A schematic diagram of the structure of a device for implementing risk control of user behavior disclosed in an embodiment of the present application.

[0114] like Figure 2 As shown, the device may include:

[0115] A user behavior sending unit 11 is used to continuously obtain the user's behavior when the user accesses the target website through the domain name of the target website;

[0116] The risk level determination unit 12 is used to perform risk analysis and determination on various behaviors of the user from visiting the target website to placing the order when the user places the order, and obtain a risk determination result;

[0117] A risk-free processing unit 13, configured to allow the user to place an order if the risk determination result is risk-free;

[0118] A low risk processing unit 14, configured to send a human-computer interaction check to the user if the risk determination result is low risk;

[0119] The medium risk processing unit 15 is used to perform SMS verification code verification on the user if the risk determination result is medium risk;

[0120] The high-risk processing unit 16 is used to reject the user's ordering behavior if the risk determination result is high risk.

[0121] Optionally, the risk level determination unit includes:

[0122] A user behavior retrieving unit, used to retrieve various behaviors of the user from visiting the target website to operating the order when the user operates the order, wherein the various behaviors include one or more of the user's login action, the user's browsing action, the user's page clicking action, the user's page staying action and the user's ordering action;

[0123] The risk analysis unit is used to perform risk analysis and judgment based on the various behaviors and the time span between the user's behavior actions to obtain a risk judgment result.

[0124] Optionally, the risk analysis unit includes:

[0125] A high risk analysis unit, configured to determine that the risk is high if the various behaviors only include multiple order actions of the user on the same page, and the time interval between the order actions of the user is less than a preset time threshold;

[0126] The first incremental risk analysis unit is used to retrieve the previous risk determination result if the user or the IP of the device used by the user places an order more than a first preset number of times on the same page within a first preset time period, and to obtain a risk determination result that is not less than the risk level of the previous risk determination result.

[0127] Optionally, the risk analysis unit includes:

[0128] A recent risk determination result acquisition unit is used to acquire the recent risk determination result of other users who have recently performed an order action, determined by risk analysis, when the IP addresses of other users or other devices all have the same target action sequence within a second preset time period, and the time span between the action actions in the target action sequence is the same, and a total of more than a second preset number of order actions have occurred on the target page;

[0129] The second incremental risk analysis unit is used to obtain a risk assessment result that is not less than the risk level of the most recent risk assessment result if the user places an order on the target page more than a third preset number of times in the target behavior action sequence within the second preset time period.

[0130] Optionally, the risk analysis unit includes:

[0131] A key action determination unit, used to determine, among the various behaviors, each key action of the user before performing an order placement action;

[0132] A risk score determination unit, configured to determine, for each key action, a risk score of the key action according to a time span from the key action to the next action;

[0133] A basic risk score calculation unit is used to accumulate the risk scores of each key action to obtain a basic risk score;

[0134] A risk assessment coefficient determination unit, configured to determine a risk assessment coefficient according to the historical risk determination result of the user, the device information used by the user, the IP information of the device used by the user, and the current popularity of the page on which the user performs an order placement action;

[0135] The risk determination result determining unit is used to multiply the basic risk score by the risk assessment coefficient to obtain a final risk score, so as to evaluate the risk determination result through the final risk score.

[0136] The apparatus for risk control of user behavior provided in the embodiment of the present application can be applied to equipment for risk control of user behavior, such as a user behavior analysis center. Figure 3 The hardware structure diagram of the device for user behavior risk control is shown in FIG. Figure 3 , the hardware structure of the device for risk control of user behavior may include: at least one processor 1, at least one communication interface 2, at least one memory 3 and at least one communication bus 4;

[0137] In the embodiment of the present application, the number of the processor 1, the communication interface 2, the memory 3, and the communication bus 4 is at least one, and the processor 1, the communication interface 2, and the memory 3 communicate with each other through the communication bus 4;

[0138] The processor 1 may be a central processing unit CPU, or an application-specific integrated circuit ASIC (Application Specific Integrated Circuit), or one or more integrated circuits configured to implement the embodiments of the present invention, etc.;

[0139] The memory 3 may include a high-speed RAM memory, and may also include a non-volatile memory (non-volatile memory), etc., such as at least one disk memory;

[0140] The memory stores a program, and the processor can call the program stored in the memory, wherein the program is used to:

[0141] When a user accesses the target website through the domain name of the target website, continuously obtaining the user's behavior;

[0142] When the user places an order, a risk analysis is performed on the user's various behaviors from visiting the target website to placing the order, and a risk determination result is obtained;

[0143] If the risk determination result is no risk, the user is allowed to place an order;

[0144] If the risk determination result is low risk, sending a human-computer interaction verification to the user;

[0145] If the risk determination result is medium risk, the user is subject to SMS verification code verification;

[0146] If the risk assessment result is that the risk is high, the user's ordering behavior is rejected.

[0147] Optionally, the detailed functions and extended functions of the program may refer to the above description.

[0148] The embodiment of the present application further provides a storage medium, which may store a program suitable for execution by a processor, wherein the program is used to:

[0149] When a user accesses the target website through the domain name of the target website, continuously obtaining the user's behavior;

[0150] When the user places an order, a risk analysis is performed on the user's various behaviors from visiting the target website to placing the order, and a risk determination result is obtained;

[0151] If the risk determination result is no risk, the user is allowed to place an order;

[0152] If the risk determination result is low risk, sending a human-computer interaction verification to the user;

[0153] If the risk determination result is medium risk, the user is subject to SMS verification code verification;

[0154] If the risk assessment result is that the risk is high, the user's ordering behavior is rejected.

[0155] Optionally, the detailed functions and extended functions of the program may refer to the above description.

[0156] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0157] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The various embodiments can be combined as needed, and the same or similar parts can refer to each other.

[0158] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for risk control of user behavior, characterized in that: include: When a user accesses the target website through the domain name of the target website, continuously obtaining the user's behavior; When the user places an order, a risk analysis is performed on the user's various behaviors from visiting the target website to placing the order, and a risk determination result is obtained; If the risk determination result is no risk, the user is allowed to place an order; If the risk determination result is low risk, sending a human-computer interaction verification to the user; If the risk determination result is medium risk, the user is subject to SMS verification code verification; If the risk assessment result is that the risk is high, the user's ordering behavior is rejected.

2. The method according to claim 1, characterized in that When the user places an order, a risk analysis is performed on the user's various behaviors from visiting the target website to placing the order, and a risk determination result is obtained, including: When the user places an order, various behaviors of the user from visiting the target website to placing the order are retrieved, wherein the various behaviors include one or more of the user's login action, the user's browsing action, the user's page clicking action, the user's page staying action, and the user's ordering action; Based on the various behaviors and the time span between the user's behavioral actions, risk analysis and judgment are performed to obtain a risk judgment result.

3. The method according to claim 2, characterized in that Based on the various behaviors and the time span between the user's behaviors, risk analysis and judgment are performed to obtain risk judgment results, including: If the various behaviors only include multiple order actions of the user on the same page, and the time interval between the order actions of the user is less than the preset time threshold, then the risk determination result is high risk; If the user or the IP of the device used by the user places an order more than a first preset number of times on the same page within a first preset time period, the previous risk assessment result is retrieved to obtain a risk assessment result that is not less risky than the previous risk assessment result.

4. The method according to claim 2, characterized in that: Based on the various behaviors and the time span between the user's behaviors, risk analysis and judgment are performed to obtain risk judgment results, including: When the IP addresses of other users or other devices all have the same target action sequence within a second preset period, and the time span between the actions in the target action sequence is the same, and a total of more than a second preset number of order actions occur on the target page, the most recent risk determination result of the other users who have most recently performed the order action determined by the risk analysis is obtained; If the user places an order on the target page more than a third preset number of times in the target behavior sequence within the second preset time period, the risk assessment result is no less than the risk level of the most recent risk assessment result.

5. The method according to any one of claims 2 to 4, characterized in that: Based on the various behaviors and the time span between the user's behaviors, risk analysis and judgment are performed to obtain risk judgment results, including: Among the various behaviors, determine each key action of the user before executing the order placement action; For each key action, determine the risk score of the key action according to the time span between the key action and the next action; Add up the risk scores of each key action to get the basic risk score; Determine a risk assessment coefficient based on the historical risk determination results of the user, the device information used by the user, the IP information of the device used by the user, and the current popularity of the page where the user performs an order placement action; The basic risk score is multiplied by the risk assessment coefficient to obtain a final risk score, so as to evaluate the risk determination result through the final risk score.

6. A user behavior risk control device, characterized in that: include: A user behavior sending unit, used to continuously obtain the user's behavior when the user accesses the target website through the domain name of the target website; A risk level determination unit is used to perform risk analysis and determination on various behaviors of the user from visiting the target website to placing the order when the user places the order, and obtain a risk determination result; A risk-free processing unit, configured to allow the user to place an order if the risk determination result is risk-free; A low risk processing unit, configured to send a human-computer interaction check to the user if the risk determination result is low risk; A medium risk processing unit, configured to perform SMS verification code verification on the user if the risk determination result is medium risk; The high-risk processing unit is used to reject the user's order behavior if the risk determination result is high risk.

7. The device according to claim 6, characterized in that The risk level determination unit includes: A user behavior retrieving unit, used to retrieve various behaviors of the user from visiting the target website to operating the order when the user operates the order, wherein the various behaviors include one or more of the user's login action, the user's browsing action, the user's page clicking action, the user's page staying action and the user's ordering action; The risk analysis unit is used to perform risk analysis and judgment based on the various behaviors and the time span between the user's behavior actions to obtain a risk judgment result.

8. The device according to claim 7, characterized in that The risk analysis unit comprises: A high risk analysis unit, configured to determine that the risk is high if the various behaviors only include multiple order actions of the user on the same page, and the time interval between the order actions of the user is less than a preset time threshold; The first incremental risk analysis unit is used to retrieve the previous risk determination result if the user or the IP of the device used by the user places an order more than a first preset number of times on the same page within a first preset time period, and to obtain a risk determination result that is not less than the risk level of the previous risk determination result.

9. A user behavior risk control device, characterized in that: including memory and processor; The memory is used to store programs; The processor is used to execute the program to implement each step of the user behavior risk control method as described in any one of claims 1 to 5.

10. A storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, each step of the user behavior risk control method as described in any one of claims 1 to 5 is implemented.

Images