Order processing method and device

Abstract

The invention discloses an order processing method and device, and relates to the technical field of computers. A specific embodiment of the method comprises the steps of capturing order information in real time, obtaining user related data of the order information, and obtaining feedback stream data; wherein the feedback stream data is used for optimizing processing logic of abnormal order detection; constructing first order rich data according to the order information, the feedback stream data and the user related data; determining topological information associated with the first order rich data by using a preset graph structure strategy; and determining abnormal order rich data in the first order rich data based on the topological information and the first order rich data, and intercepting the order information corresponding to the abnormal order rich data. According to the embodiment, the accuracy and response speed of abnormal order detection are improved, and the occurrence of fraudulent behaviors is effectively reduced.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to an order processing method and device. Background Art

[0002] With the increase in the scale of business and the development of global business, online order data has increased dramatically, and the identification of abnormal orders has become an important challenge. Although there are many methods for identifying abnormal orders, these methods still have problems such as low efficiency in practical applications. In order to ensure the normal operation of the platform and user experience, enterprises need to continuously optimize their technical architecture and identification mechanism for identifying abnormal orders. Summary of the invention

[0003] In view of this, an embodiment of the present invention provides an order processing method and device, which can at least solve the problem of low efficiency in identifying abnormal orders in the prior art.

[0004] To achieve the above-mentioned purpose, according to one aspect of an embodiment of the present invention, an order processing method is provided, including: capturing order information in real time, obtaining user-related data of the order information, and obtaining feedback stream data; wherein the feedback stream data is used to optimize the processing logic of abnormal order detection; constructing first order rich data according to the order information, the feedback stream data and the user-related data; using a preset graph structure strategy, determining topology information associated with the first order rich data; based on the topology information and the first order rich data, determining abnormal order rich data in the first order rich data, and intercepting the order information corresponding to the abnormal order rich data.

[0005] Optionally, user-related data is determined by user information, and user information is determined by a user identifier in order information. The method also includes: determining a system that generates an order based on the order information; sending the user information or the system that generates the order to an authentication center module for security authentication; in response to an authentication result indicating an abnormality, intercepting the order information and triggering an alarm.

[0006] Optionally, the user-related data includes one or more of user behavior data, user groups and historical static data; the obtaining of feedback stream data includes: obtaining feedback stream data corresponding to the user group; the constructing of the first order rich data based on the order information, the feedback stream data and the user-related data includes: constructing an initial order real-time stream based on the order information, user behavior data and feedback stream data; when the initial order real-time stream passes the security protocol detection, analyzing the initial order real-time stream to obtain the user behavior pattern; when the user behavior pattern is a normal behavior pattern, fusing the initial order real-time stream and the historical static data to construct the first order rich data.

[0007] Optionally, the constructing of the initial order real-time stream based on the order information, user behavior data and feedback stream data includes: constructing an initial captured order data stream based on the order information, user behavior data and feedback stream data; extracting key data elements from the initial captured order data stream, and converting the key data elements into a preset format; preprocessing the key data elements converted into the preset format to obtain preprocessed key data elements, obtaining metadata of the preprocessed key data elements to label the metadata tags and obtain the initial order real-time stream.

[0008] Optionally, the analysis of the real-time stream of initial orders to obtain the user behavior pattern includes: obtaining the historical purchase data and historical behavior data of all users in the user group to construct a user group portrait; judging whether the real-time stream of initial orders meets the characteristics of the user group portrait, and determining whether the user behavior pattern is an abnormal behavior pattern or a normal behavior pattern based on the judgment result; and intercepting the order information when the user behavior pattern is an abnormal behavior pattern.

[0009] Optionally, the method further includes: determining the size of the order information or the order information and user-related data to determine resource configuration parameters required to process data of said size, and then performing resource configuration according to the resource configuration parameters.

[0010] Optionally, the use of a preset graph structure strategy to determine the topological information associated with the first order rich data includes: constructing a first graph structure based on the first order rich data; obtaining a second graph structure locally, integrating the first graph structure and the second graph structure to obtain a third graph structure; using the third graph structure to process the first order rich data to obtain topological information to add to the first order rich data.

[0011] Optionally, the method of obtaining the second graph structure locally and integrating the first graph structure and the second graph structure to obtain the third graph structure includes: obtaining the second order rich data and the second graph structure of all other users locally; integrating the first graph structure and the second graph structure according to the first order rich data and the second order rich data to obtain the third graph structure; and replacing the local second graph structure with the third graph structure, and adding the first order rich data locally.

[0012] Optionally, the method also includes: determining a risk score of the first order rich data, and marking the first order rich data with a corresponding risk label according to the size relationship between the risk score and a preset threshold; splitting the first order rich data marked with the risk label according to preset multiple dimensions, dividing the split data into groups corresponding to the corresponding dimensions, and updating the data model of the group corresponding to the dimension; performing multi-dimensional funnel analysis on the data models of all dimensions to obtain order dimension characteristics and information about risk trends, adding the information about risk trends to the order dimension characteristics, and then sorting the order dimension characteristics according to the timestamp in the order information to generate a multi-dimensional order data stream; based on user information in the multi-dimensional order data stream, obtaining relevant data from multiple data sources, integrating the multi-dimensional order data stream and the relevant data to obtain a target multi-dimensional order data stream; determining a target multi-dimensional order data stream including the same object, analyzing the target multi-dimensional order data stream, obtaining feature information about the object, and adding the feature information to the target multi-dimensional order data stream; using the first graph structure, the target multi-dimensional order data stream, the information in the early warning center module, and the performance indicators of obtaining the order dimension characteristics as feedback flow data; wherein triggering an alarm is executed by the early warning center module.

[0013] Optionally, the multi-dimensional funnel analysis is performed on the data models of all dimensions, including: for the abnormal first order rich data marked with a high-risk label, obtaining processing information, and re-evaluating the risk score based on the processing information and the abnormal first order rich data marked with a high-risk label; for each order information, re-evaluating the risk score based on the data models of all dimensions and the first order rich data of each order information; and performing a multi-dimensional funnel analysis on the data models of all dimensions after the risk scores are re-evaluated.

[0014] Optionally, the order dimension features are sorted according to the timestamp in the order information to generate a multidimensional order data stream, including: fault-tolerant filtering of the order dimension features to obtain multidimensional fault-tolerant data; and sorting the multidimensional fault-tolerant data according to the timestamp in the order information to generate a multidimensional fault-tolerant order data stream.

[0015] Optionally, the determining of the target multidimensional order data stream including the same object, analyzing the target multidimensional order data stream, and obtaining characteristic information of the relevant object includes one or more of the following: determining the target multidimensional order data stream including the same item, performing time and order processing on the determined target multidimensional order data stream, and obtaining time series data of item data changing over time; determining the target multidimensional order data stream including the same user information, and integrating and analyzing the user behavior data in the determined target multidimensional order data stream to identify user behavior patterns.

[0016] To achieve the above-mentioned purpose, according to another aspect of an embodiment of the present invention, an order processing device is provided, including a data acquisition layer, a data integration layer, a graph data processing layer and a monitoring and alarm layer: the data acquisition layer is used to capture order information in real time, obtain user-related data of the order information, and obtain feedback stream data; wherein the feedback stream data is used to optimize the processing logic of abnormal order detection; the data integration layer is used to construct first order rich data according to the order information, the feedback stream data and the user-related data; the graph data processing layer is used to determine the topology information associated with the first order rich data using a preset graph structure strategy; the monitoring and alarm layer is used to determine abnormal order rich data in the first order rich data based on the topology information and the first order rich data, and intercept the order information corresponding to the abnormal order rich data.

[0017] Optionally, user-related data is determined by user information, and user information is determined by a user identifier in order information. The device also includes an authentication center module, which is used to: determine the system that generates the order based on the order information; send the user information or the system that generates the order to the authentication center module for security authentication; in response to an authentication result indicating an abnormality, intercept the order information and trigger an alarm.

[0018] Optionally, the user-related data includes one or more of user behavior data, user groups and historical static data; the data ingestion layer is used to: obtain feedback stream data corresponding to the user group; construct an initial order real-time stream according to order information, user behavior data and feedback stream data; when the initial order real-time stream passes the security protocol detection, analyze the initial order real-time stream to obtain the user behavior pattern; when the user behavior pattern is a normal behavior pattern, fuse the initial order real-time stream and the historical static data to construct the first order rich data.

[0019] Optionally, the data ingestion layer is used to: construct an initial captured order data stream based on order information, user behavior data and feedback stream data; extract key data elements from the initial captured order data stream, and convert the key data elements into a preset format; preprocess the key data elements converted into the preset format to obtain preprocessed key data elements, obtain metadata of the preprocessed key data elements to mark the metadata tags, and obtain the initial order real-time stream.

[0020] Optionally, the data integration layer is used to: obtain historical purchase data and historical behavior data of all users in the user group to construct a user group portrait; determine whether the real-time stream of initial orders meets the characteristics of the user group portrait, and determine whether the user behavior pattern is an abnormal behavior pattern or a normal behavior pattern based on the judgment result; and in the case that the user behavior pattern is an abnormal behavior pattern, intercept the order information.

[0021] Optionally, the device further comprises: determining the size of the order information or the order information and user-related data to determine resource configuration parameters required to process data of said size, and then performing resource configuration according to the resource configuration parameters.

[0022] Optionally, the graph data processing layer is used to: construct a first graph structure based on the first order rich data; obtain a second graph structure locally, integrate the first graph structure and the second graph structure to obtain a third graph structure; use the third graph structure to process the first order rich data to obtain topology information to add to the first order rich data.

[0023] Optionally, the graph data processing layer is used to: obtain the second order rich data and the second graph structure of all other users locally; integrate the first graph structure and the second graph structure according to the first order rich data and the second order rich data to obtain a third graph structure; and replace the local second graph structure with the third graph structure, and add the first order rich data locally.

[0024] Optionally, the device also includes a data buffer layer and a data enhancement feedback layer: a monitoring alarm layer, used to determine the risk score of the first order rich data, and mark the first order rich data with a corresponding risk label according to the size relationship between the risk score and a preset threshold; a data buffer layer, used to split the first order rich data marked with the risk label according to preset multiple dimensions, divide the split data into groups corresponding to corresponding dimensions, and update the data model of the group corresponding to the dimension; perform multi-dimensional funnel analysis on the data models of all dimensions to obtain order dimension characteristics and information about risk trends, add the information about risk trends to the order dimension characteristics, and then The order dimension features are sorted according to the timestamp to generate a multidimensional order data stream; a data enhancement feedback layer is used to obtain relevant data from multiple data sources based on user information in the multidimensional order data stream, integrate the multidimensional order data stream and the relevant data, and obtain a target multidimensional order data stream; determine a target multidimensional order data stream including the same object, analyze the target multidimensional order data stream, obtain feature information about the object, and add the feature information to the target multidimensional order data stream; use the first graph structure, the target multidimensional order data stream, the information in the early warning center module, and the performance indicators of the order dimension features as feedback stream data; wherein, triggering an alarm is executed by the early warning center module.

[0025] Optionally, the data buffer layer is used to: obtain processing information for the abnormal first order rich data marked with a high-risk label, and re-evaluate the risk score based on the processing information and the abnormal first order rich data marked with a high-risk label; for each order information, re-evaluate the risk score based on the data model of all dimensions and the first order rich data of each order information; and perform multi-dimensional funnel analysis on the data model of all dimensions after the re-evaluation of the risk score.

[0026] Optionally, the data acceleration layer is used to: perform fault-tolerant filtering on order dimensional features to obtain multi-dimensional fault-tolerant data; and sort the multi-dimensional fault-tolerant data according to timestamps in the order information to generate a multi-dimensional fault-tolerant order data stream.

[0027] Optionally, the data enhancement feedback layer includes one or more of the following: determining a target multidimensional order data stream including the same item, performing time-based and order-ordering processing on the determined target multidimensional order data stream to obtain time series data of item data changing over time; determining a target multidimensional order data stream including the same user information, and integrating and analyzing user behavior data in the determined target multidimensional order data stream to identify user behavior patterns.

[0028] To achieve the above objective, according to another aspect of an embodiment of the present invention, an order processing electronic device is provided.

[0029] The electronic device of an embodiment of the present invention includes: one or more processors; a storage device for storing one or more programs, when the one or more programs are executed by the one or more processors, the one or more processors implement any of the order processing methods described above.

[0030] To achieve the above objective, according to another aspect of an embodiment of the present invention, a computer-readable medium is provided, on which a computer program is stored, and when the program is executed by a processor, any of the above order processing methods is implemented.

[0031] To achieve the above objective, according to another aspect of an embodiment of the present invention, a computer program product is provided. A computer program product according to an embodiment of the present invention includes a computer program, and when the program is executed by a processor, the order processing method provided by the embodiment of the present invention is implemented.

[0032] According to the solution provided by the present invention, one embodiment of the above invention has the following advantages or beneficial effects: by capturing and processing order information in real time, combining user-related data, and constructing multi-dimensional order rich data, a full-scale analysis of orders and real-time dynamic decision-making are achieved. This method not only improves the accuracy and response speed of abnormal order detection, but also enhances the system's adaptability and foresight by continuously optimizing the processing logic, effectively reducing the occurrence of fraud, while ensuring the stability and security of the system, and solving the problem of low efficiency in existing abnormal order identification.

[0033] The further effects of the above-mentioned non-conventional optional manner will be described below in conjunction with specific implementation examples. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] The accompanying drawings are used to better understand the present invention and do not constitute an improper limitation of the present invention.

[0035] Figure 1 is a schematic diagram of an order processing architecture according to an embodiment of the present invention;

[0036] Figure 2 This is a schematic diagram of the main flow of an order processing method according to an embodiment of the present invention;

[0037] Figure 3 is a flowchart of a specific order processing method according to an embodiment of the present invention;

[0038] Figure 4 is a schematic diagram of main modules of an order processing device according to an embodiment of the present invention;

[0039] Figure 5 is an exemplary system architecture diagram to which embodiments of the present invention may be applied;

[0040] Figure 6 It is a schematic diagram of the structure of a computer system of a mobile device or a server suitable for implementing an embodiment of the present invention. DETAILED DESCRIPTION

[0041] The following is a description of exemplary embodiments of the present invention in conjunction with the accompanying drawings, including various details of the embodiments of the present invention to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those of ordinary skill in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope and spirit of the present invention. Similarly, for clarity and conciseness, the description of well-known functions and structures is omitted in the following description.

[0042] It should be noted that the collection, collection, updating, analysis, processing, use, transmission, storage and other aspects of user personal information involved in the technical solution of this disclosure are in compliance with the provisions of relevant laws and regulations, are used for legitimate purposes, and do not violate public order and good morals. Necessary measures are taken for user personal information to prevent illegal access to user personal information data and maintain the security of user personal information, network security and national security.

[0043] With the continuous increase in the business scale of enterprises (such as e-commerce platforms) and the continuous development of services and global business, the amount of online order data has shown explosive growth. For the processing of user order data, the processing of large-scale orders, especially the identification of abnormal orders, needs to be solved efficiently. In the business scenarios of enterprises, abnormal orders usually refer to those orders that intend to obtain improper benefits through false transactions, brushing orders, cashing out, etc., which will not only cause economic losses to the platform, but also damage the shopping experience of normal users.

[0044] In order to ensure the normal operation of the platform and maintain a fair competition environment, the company will take a series of measures to identify and intercept such abnormal orders, and is also constantly exploring and optimizing its technical architecture to improve the efficiency of intercepting abnormal orders. Although the company has made significant progress in identifying abnormal orders, there are still some technical challenges and shortcomings: such as data imbalance, model update frequency, false positive rate and recall rate, user experience, internal fraud, and dynamic adjustment issues.

[0045] See also Figure 1 , which shows a schematic diagram of an order processing architecture provided by an embodiment of the present invention. This solution aims to solve the interception of abnormal orders in shopping scenarios, and comprehensively designs the functions and collaborative working methods of each layer, including data acquisition layer, data integration layer, graph data processing layer, monitoring alarm layer, data buffer layer, data acceleration layer, and data enhancement feedback layer. Each layer is an upstream and downstream relationship from left to right.

[0046] 1. The data ingestion layer includes data capture module, data conversion module, data preprocessing module and data annotation module. The data ingestion layer outputs the initial order real-time stream to the data integration layer. There are limited flow module, load balancing module, permission control module and security monitoring module between the data ingestion layer and the data integration layer.

[0047] 2. The data integration layer includes pattern matching module, data fusion module and graph construction module. The data integration layer provides structured and formatted order rich data for the downstream graph data processing layer.

[0048] 3. The graph data processing layer includes a data flow engine module, a data flow graph calculation module, and a data flow graph storage module. The graph data processing layer provides real-time and dynamic decision-making data for the downstream monitoring and alarm layer.

[0049] 4. The monitoring and alarm layer includes a real-time monitoring decision module, an order interception module, and an integrated service module. The monitoring and alarm layer provides real-time dynamic labeling order rich data for the downstream data buffer layer.

[0050] 5. The data buffer layer includes a cache module, a real-time data warehouse module, and a data analysis module. The data buffer layer provides real-time dynamic multi-dimensional analysis data for the downstream data acceleration layer.

[0051] 6. The data acceleration layer implements fault-tolerant filtering and provides real-time dynamic multi-dimensional fault-tolerant data for the downstream data enhancement layer.

[0052] 7. The data enhancement feedback layer includes a distributed service module, a multi-party data fusion module, a time series module, and a behavior feedback module, which outputs a feedback stream for the data ingestion layer.

[0053] Based on the above, a closed loop of data processing is formed. This solution also includes auxiliary modules, including authentication center module, architecture service module, behavior log collection module and early warning center module.

[0054] 1. The data ingestion layer includes data capture module, data conversion module, data preprocessing module and data annotation module. The data ingestion layer outputs the initial order real-time stream to the data integration layer.

[0055] 1. Data capture module: This module is the starting point of the data ingestion process. Its main responsibility is to capture data in real time from various data sources (such as application programming interfaces, databases, log files, websites, mobile applications, etc.). The data capture module can process data in different formats and protocols and ensure the integrity and consistency of the data. It needs to interact with the API interface (Application Programming Interface) of the external system, the message queue or directly with the database to capture the changing data in real time. The continuously changing data can form a data stream to provide the original input for the subsequent processing process.

[0056] The data capture module first captures the order information, then obtains the user information according to the user ID in the order information, and then obtains the user behavior data of the user information from the user behavior log, such as shopping cart data, browsing data, order data, etc. At this time, the data capture module also works with the authentication center module in the auxiliary module. If the user information or the system that generates the order exists in the blacklist or has no authority, the order will be terminated, and the order behavior log will be recorded in the behavior log collection module of the auxiliary module, and the order abnormality information will be reported to the early warning center module, and the order will be intercepted and terminated; otherwise, the next step will be processed. The aforementioned user behavior log can be obtained from the behavior log collection module. After the abnormal order is intercepted, the system will continue to monitor its performance and stability. The overall architecture service module will analyze the system performance after the event, and the behavior log collection module will record the detailed log of the entire event. In addition, the authentication center module will also update the blacklist to prevent future fraud.

[0057] The data capture module first determines the size of the order information or the order information and user behavior data, and sends the size to the data enhancement feedback layer through the data integration layer, so that the data enhancement feedback layer determines the resource configuration parameters through the distributed service module. Specifically, the distributed service module determines the resource configuration parameters required by the data ingestion layer, data integration layer, graph data layer and monitoring alarm layer to process data of this size respectively through load balancing, automatic expansion and fault tolerance mechanisms, and sends the resource configuration parameters to the data ingestion layer, data integration layer, graph data layer and monitoring alarm layer respectively. At the same time, according to the actual needs of other layers and the current system status, adjust its own resource configuration parameters, such as CPU, memory, network bandwidth and other resources.

[0058] At the same time, the data capture module is also required to receive the feedback stream data of the data enhancement feedback layer. For the explanation of the feedback stream data, please refer to the data enhancement feedback layer. The order information is combined with the feedback stream data and the user behavior data to form an initial captured order data stream. It should be noted that the feedback stream data here may be targeted at all user groups. In order to achieve targeted processing, it is also necessary to determine the user group to which the user information belongs. The determination method here can adopt the existing method. Assume that the determination result is user group A, and then obtain the feedback stream data of user group A from the feedback stream data. It should be noted that the feedback stream data and the order information data structure are basically the same. Both are user order information, but there are some other features than the order information, such as the user's purchase history and behavior data.

[0059] 2. Data conversion module: The data conversion module is responsible for cleaning the initial captured order data stream and converting it into a unified format that is more suitable for processing and analysis so that subsequent modules can process it efficiently. During the conversion process, the module ensures that the data quality is not damaged, while removing useless information and extracting key data elements. This module is a key link in data standardization and is essential for integrating data from different sources.

[0060] 3. Data preprocessing module: This module is responsible for cleaning and normalizing key data elements converted into a preset format to improve data quality, such as removing duplicate records, filling missing values, correcting errors (such as correcting timestamps and formatting address information) and outlier processing. Preprocessing is an important step to ensure data availability and reliability.

[0061] 4. Data labeling module: This module performs preliminary classification and labeling of key data elements after preprocessing. The goal is to add metadata tags. Metadata is about the source of data, timestamp, data type, or any other information that is helpful for subsequent processing. It is to lay the foundation for subsequent pattern matching and analysis. In the scenario of abnormal order detection, labeling may also include customer behavior classification, order status marking, etc.

[0062] It should be noted that the behavior log collection module records the processing of the entire life cycle of the order, such as browsing, ordering, delivery, logistics, after-sales service, complaints, processing, etc. The above-noted results will also be recorded by the behavior log collection module to ensure the transparency and traceability of the system. At this stage, the order flow is converted into the initial order real-time flow. In addition, all user behavior logs and system operation logs (such as the above resource configuration parameters) are recorded to provide data support for user analysis and system auditing and monitoring.

[0063] 2. Modules between the data ingestion layer and the data integration layer: limited flow module, load balancing module, permission control module, and security monitoring module.

[0064] 1. Current limiting module: used to control the rate of data inflow to prevent overload. In high-traffic events (such as large-scale promotions) or DDoS attacks (full name Distributed Denial of Service), protect the system from being overwhelmed and ensure service availability. You can use Kafka's quota management (Quotas) to limit the read and write rates, or implement a custom current limiting strategy in the Flink application. Current limiting can be achieved through current limiting algorithms (such as token bucket or leaky bucket algorithms) to ensure that the system does not crash in the face of sudden traffic while maintaining normal service levels.

[0065] 2. Load balancing module: responsible for distributing the workload among multiple processing nodes in the data integration layer, so as to ensure that each node can process data evenly, avoid overloading a node and affecting the performance of the entire system, realize horizontal expansion of processing capabilities, and improve the throughput and response speed of the system; among them, the processing node is used to process real-time order flow according to the data inflow rate.

[0066] 3. Permission control module: Since the aforementioned login authentication is not 100% reliable, further verification is required to ensure security. The permission control module is responsible for data access permission verification and authorization. It ensures that only authorized users and systems can access and operate data. This helps prevent unauthorized access and data leakage, and is also an important means of resisting malicious logins and internal threats. The permission control module is integrated with the user authentication system to manage user permissions and roles.

[0067] Malicious logins: By analyzing the user's current order records and historical order records, potential malicious login behaviors can be identified. For example, a user's account suddenly has a large number of abnormal orders in a short period of time, and the delivery addresses, payment methods, or types of purchased goods of these orders are obviously different from the historical records. In addition, if the same IP address attempts to log in to multiple different accounts in a short period of time, it may also be a sign of malicious login.

[0068] DDOS attack: usually manifests as a large number of requests flooding into the system in a short period of time, causing the server to be overloaded. DDOS attacks can be identified by monitoring the order frequency and request frequency of each user. For example, a certain IP address or user initiates a large number of order requests in a short period of time, far exceeding the order frequency of normal users. In addition, if multiple different IP addresses initiate a large number of similar requests in the same time period, it may also be part of a DDOS attack.

[0069] Internal employee internal threat: Internal employees may use their permissions to access user information and place a large number of orders. This type of internal threat can be identified by analyzing the login records and operation logs of internal employees. For example, an internal employee frequently logs into the system during non-working hours and places a large number of orders in a short period of time. The delivery addresses or payment methods of these orders do not match the employee's historical records. In addition, if the operation logs of internal employees show that they frequently access sensitive data or perform abnormal operations, you should also be vigilant.

[0070] 4. Security Monitoring Module: monitors the security events and abnormal behaviors of the system. The security monitoring module works closely with the authority control module and is responsible for monitoring the security status of the system. It can detect and record abnormal behaviors, such as unusual access patterns or potential security attacks, and trigger alarms. In the case that the authority control module detects abnormal orders, it intercepts the abnormal orders and triggers alarms. The security monitoring module is also responsible for audit log management, providing an additional layer of protection for the security of the system.

[0071] Under this architecture, when the initial order real-time flow flows from the ingestion flow layer to the integration flow layer, it will go through a series of security protocol detection and efficiency control measures. Order information that does not comply with the security protocol will be intercepted, and otherwise it will be processed by the next link, the data integration layer. This not only ensures the continuity and stability of data processing, but also ensures the security of the entire system. Through this layered approach, the initial order real-time flow can be flexibly controlled and managed, and it is also easy to monitor and maintain.

[0072] 3. The data integration layer includes the pattern matching module, data fusion module, and graph construction module. The data integration layer provides structured and formatted rich data for the downstream graph data processing layer. The ingested data is cleaned, transformed, and fused for graph processing.

[0073] 1. Pattern matching module: It can be regarded as a trained pattern matching model. This module receives the real-time stream of initial orders detected by security protocols and focuses on identifying and correlating behavioral patterns and features in the data in order to understand and predict user behavior. In the context of order information, this module will associate the purchase history and behavioral data of all users in the user group to build a user group portrait, which may include users' online and offline activity patterns, shopping preferences, consumption frequency, etc. It uses algorithms to match user behavior with known fraud or normal behavior patterns to quickly identify abnormal or expected behavior patterns in real-time data streams. Using this information, the system can more accurately mark and process potential abnormal orders and accurately label orders.

[0074] When the real-time stream of initial orders detected by the security protocol arrives, relevant information about the order is extracted, such as the type, quantity, price, purchase time, payment method, user behavior, etc. of the purchased goods. Then, this information is compared with the profile of user group A to determine whether it meets the characteristics in the profile. Based on the judgment results, the user behavior is matched with known fraudulent behavior patterns and normal behavior patterns, and finally the result is obtained that the user behavior pattern is a fraudulent behavior pattern or a normal pattern.

[0075] 2. Data fusion module: When the user behavior pattern belongs to the normal behavior pattern, the data fusion module is responsible for integrating the initial order real-time stream with the historical data set or other static data sources for comprehensive analysis. For example, user account information, etc. By integrating historical static data from different time points and sources, the data fusion module can provide an order rich data (i.e. the first order rich data, generally a row of data, but including multiple dimensions), thereby supporting more complex analysis and decision-making processes. Among them, rich data refers to a data set containing a large amount of relevant information and multiple dimensions. For example, order rich data contains user portrait information, product portrait information, logistics timeliness information, etc.

[0076] 3. Graph construction module: Its main responsibility is to convert order rich data into a format suitable for graph database processing. In this process, entities in order rich data will be converted into nodes in the graph (such as users, products, orders, etc.), and entity relationships will be converted into edges in the graph (representing the relationship between nodes, such as purchase behavior, product recommendation relationship, etc.). Building a graph structure can reveal complex relationship networks and patterns, such as influence propagation in social networks, product associations in recommendation systems, and abnormal behavior chains in fraud detection. This makes analysis more intuitive and efficient, especially when dealing with complex relationships and network analysis, where graph structures provide obvious advantages. The graph construction module also builds a graph structure based on the relationships between order data, which can reveal complex connections between orders, such as multiple orders for the same user or related transactions between multiple users. At this stage, the initial order real-time stream forms structured and formatted rich data.

[0077] The graph structure here is different from the existing graph structure. Taking user X buying a smartphone as an example, the existing graph structure may only include user X and the smartphone. The graph structure of this solution can analyze the relationship between users, such as husband-wife relationship, friend relationship, etc., and then study the influence propagation path. For example, after user X buys a certain product, will user Z, who is in a husband-wife relationship with user X, also be recommended to buy the same product? Through the relationship between user purchase behavior and products, a product recommendation relationship can be constructed. For example, if user X buys a smartphone, the system can recommend related accessories or services based on his purchase behavior, or recommend it to user Z. By analyzing the relationship between users and their purchase behavior, abnormal order patterns can be identified. For example, if user X and user Z frequently purchase the same product in a short period of time, and their purchase behavior is significantly different from other users, it may indicate fraud. Therefore, by constructing a graph structure topology of order-rich data, complex relationship networks and patterns can be analyzed more intuitively and efficiently.

[0078] 4. The graph data processing layer includes the data flow engine module, the data flow graph calculation module, and the data flow graph storage module. These three modules form a loop. The graph data processing layer provides real-time dynamic decision-making data for the downstream monitoring and alarm layer.

[0079] 1. Data flow engine module: This module is the core of the graph data processing layer and is responsible for managing the entire life cycle of data flow computing, including data input, processing, and output. The data flow engine is responsible for distributing the structured and formatted order-rich data provided by the data integration layer to the correct computing nodes of the data flow graph computing module, and ensuring that the data flows correctly between different computing stages. It is also responsible for obtaining the second order-rich data and second graph structure of all other users (usually hundreds of millions) from the data flow graph storage module for subsequent data flow graph computing module processing. Through efficient state management and event time processing, the data flow engine supports complex event-driven logic to ensure the real-time and accuracy of graph computing.

[0080] 2. Data flow graph calculation module: This module is the algorithm executor of the graph data processing layer, and is specifically responsible for applying graph calculation methods to analyze and extract order features. It receives real-time graph data provided by the data flow engine, and uses graph theory algorithms (such as community discovery, shortest path, node influence analysis, etc.) to reveal hidden relationships between orders and user behavior patterns. This module can quickly identify abnormal patterns, such as abnormal order chains, fraud clusters, etc., providing a scientific basis for risk assessment. It can also dynamically adjust the structure and weight of the graph according to real-time changes in user behavior to improve the prediction accuracy and response speed of the algorithm.

[0081] Specifically, the current user's order rich data and the first graph structure, the most recently generated historical graph structure, and the multi-dimensional rich data of other users are integrated to obtain the current largest topological structure; using the current largest graph structure, the graph algorithm model is used to process the current user's order rich data to generate topological information, such as user X belongs to community 1, the centrality is 0.85, and the key relationships are husband and wife (user Z) and friend (user Q). The topological information is added to the current user's order rich data to form a more comprehensive user portrait.

[0082] In addition, the data flow graph computing module can also use complex graph algorithm models to process the fraud cases reported by users, customer service records, and false positive and false positive cases intercepted by the system provided by the order rich data and early warning center module to identify abnormal patterns, such as possible fraud gangs or unusual transaction networks. When the system detects new fraudulent behaviors or abnormal patterns, the graph algorithm model of the graph data processing layer will be updated and adjusted according to this new information. In this process, the system will use historical data in the behavior log collection module for learning and pattern recognition to improve the accuracy of the detection algorithm. The analyzed data is then stored for subsequent queries and further analysis. These data include structural information of the transaction graph, as well as possible risk scores.

[0083] 3. Data flow storage module: This module is the data persistence guarantee of the graph data processing layer. It supports efficient data writing and fast data recovery. This module stores the results processed by the data flow engine and analyzed by the data flow graph, such as the largest graph structure, including the structure of the graph, node attributes, edge relationships and other information. It can also add rich order data of the current user. It is preferred to use a distributed storage system to support the storage needs of large-scale graph data.

[0084] 5. The monitoring and alarm layer includes real-time monitoring decision module, order interception module, and integrated service module. The monitoring and alarm layer provides real-time dynamic labeling data for the downstream data buffer layer. It processes the decision-making data output by the graph data processing layer, identifies abnormal orders in real time, and triggers warnings.

[0085] 1. Real-time monitoring decision module: The decision algorithm is used to evaluate the first order rich data provided by the graph data processing layer in real time to quickly identify abnormal behaviors and potential abnormal orders. It can update the risk score in real time and label each order with a risk tag, such as suspicious level or fraud probability. Each order will be labeled with a risk tag, but there are high and low risk tags. For example, if the risk score is higher than the threshold, it is abnormal. These real-time generated annotation information is the key to identifying and processing abnormal orders. They will be sent to downstream modules for further operations. In addition, the real-time monitoring decision module can also adjust the monitoring strategy according to the latest risk assessment to ensure the flexibility and adaptability of monitoring activities.

[0086] 2. Order interception module: This module follows the real-time monitoring decision module. It combines the order annotation information provided by the real-time monitoring decision module and the warning signal of the early warning center module to perform rapid response operations. When an order is marked as high-risk or malicious, the order interception module will immediately trigger the interception mechanism to prevent further processing of the order or completion of the transaction. This module can not only prevent losses caused by fraudulent behavior in a timely manner, but also reduce the impact of erroneous interception on normal user experience. It seamlessly connects with various payment gateways and transaction systems to ensure the timeliness and accuracy of interception operations.

[0087] 3. Integration service module: This module is a bridge for the monitoring alarm layer to interact with the external system. Once the order interception module confirms the abnormal order, the integration service module will synchronously take a series of response measures. It is responsible for issuing real-time warning information to the early warning center module and activating the security response process. At the same time, it will send security reminders to affected users through communication channels such as email, SMS or application push to enhance users' security awareness and preventive measures. In addition, the integration service module will also issue warnings to the internal security center so that the security team can quickly take further investigation and response measures. It is also responsible for feeding back the processing results to the downstream data buffer layer to support subsequent data analysis and feedback processes. The integration service module ensures the timeliness and accuracy of the information flow, making the response mechanism of the entire system more efficient and coordinated.

[0088] 6. The data buffer layer includes a cache module, a real-time data warehouse module, and a data analysis module (or a data analysis model). The data buffer layer provides real-time dynamic multi-dimensional analysis data, namely, order dimension features, for the downstream data acceleration layer. In order to handle peak traffic, a data buffer mechanism is provided.

[0089] 1. Cache module: This module is the infrastructure of the data buffer layer, which is responsible for efficiently storing and accessing real-time processed data. This module uses memory or distributed cache technology (such as Redis) to ensure low latency and high throughput data access. It mainly stores the marked order rich data transmitted by the real-time monitoring decision module. The cache module provides a temporary data storage area for the upstream monitoring alarm layer to quickly respond to possible query requests, and also provides real-time data for the downstream real-time data warehouse and data analysis modules to support subsequent data processing and analysis tasks.

[0090] 2. Real-time data warehouse module: This module is the component in the data buffer layer responsible for long-term storage and management of data. It establishes a data model for the order theme. This model is built around order-rich data, including order attributes, user information, transaction history, risk labeling and other dimensions. The order-rich data is split according to these dimensions, and the split information is divided into groups corresponding to the dimensions to update the data model under the dimensions, thereby forming a multi-dimensional data set. The real-time data warehouse supports the storage and real-time query of big data. It provides a structured and historical data source for the data analysis module, enabling the data analysis module to conduct in-depth analysis of real-time data against the background of rich historical data and explore the potential value and trends of the data.

[0091] 3. Data analysis module: This module is the intelligent processing center of the data buffer layer, responsible for in-depth analysis and mining of order-rich data. This module uses data mining and machine learning technology to perform funnel analysis on data models of all dimensions in the real-time data warehouse, including user behavior analysis, order attribute analysis, time series analysis, etc., so as to extract dimensional characteristics of orders, such as conversion rate, churn rate and other key indicators. In addition, the module will also evaluate and optimize the labeled data provided by the monitoring and alarm layer to improve the accuracy of future monitoring and early warning. The output of the data analysis module not only has an important impact on business decisions, but also provides data support for the continuous optimization of the system.

[0092] Here, the risk score can also be re-evaluated. Assuming that the first order rich data of user X is labeled as high-risk, obtain its processing information (such as abnormal login times, abnormal purchase frequency, user complaint information, customer service processing information, etc.). Re-evaluate the risk score based on the processing information and high-risk labels. For example, user X has 10 abnormal login times and abnormal purchase frequency, but the user complaint should be a normal order, and the customer service processing result is also a normal order. After re-evaluation, the risk score is 50 points (less than or equal to the threshold). For each order information, re-evaluate the risk score based on the data model of all dimensions (such as user dimension, product dimension, time dimension) and the first order rich data of each order information. For example, user X of order 1 purchased a laptop worth 1,000 yuan at 2 a.m., and the risk score after re-evaluation is 80 points. Perform multi-dimensional funnel analysis on the data model of all dimensions after the re-evaluation of the risk score to obtain information about the risk trend dimension (such as the time period of high-risk users and the category of high-risk goods) and order dimension characteristics (such as purchase time, purchase amount, and purchase frequency). Through these analyses, high-risk behaviors can be identified and managed more accurately.

[0093] 7. The data acceleration layer implements fault-tolerant filtering. The data acceleration layer provides real-time dynamic multi-dimensional fault-tolerant data for the downstream data enhancement layer. The multi-dimensional analysis data enters the data acceleration layer. In the data acceleration layer, the fault-tolerant filtering module processes the multi-dimensional analysis data from the upstream to ensure the accuracy and consistency of the data, reduce the impact of erroneous data on system decisions, and ensure the quality and speed of data in the flow process. At this stage, the multi-dimensional analysis data is converted into real-time dynamic multi-dimensional fault-tolerant data, and then the order dimension features are sorted according to the timestamp in the order information (such as the order time) to generate a multi-dimensional order data stream.

[0094] The fault-tolerant filtering module implements fault-tolerant filtering of data through existing data processing technology, which means that it can identify and correct or isolate incomplete, erroneous or abnormal data records. This process involves complex data verification rules and anomaly detection algorithms to ensure that the multi-dimensional analysis data provided by the upstream meets the quality requirements of downstream applications. This module is responsible for the rapid transformation of data streams and can aggregate, sort, process and convert data in real time. For example, it can summarize the data generated by real-time analysis into a more streamlined and optimized format so that it can be quickly supplied to downstream processing systems, thereby achieving rapid response to risk changes and user needs.

[0095] 8. Data enhancement feedback layer. The data enhancement feedback layer includes a distributed service module, a multi-party data fusion module, a time series module, and a behavior feedback module. It outputs feedback streams for the data ingestion layer and determines resource configuration parameters for the data ingestion layer, data integration layer, graph data layer, and monitoring alarm layer.

[0096] Regarding the generation of feedback stream information: The feedback stream of the data enhancement feedback layer is a multidimensional data set that integrates graph computing results and data analysis results. Its purpose is to continuously optimize and adjust the processing logic and parameter settings of the data ingestion layer to improve the efficiency of the early data processing of abnormal order detection. Specifically, the data in the feedback stream includes the following aspects:

[0097] 1) Graph computing results: The graph computing processing layer generates insights about the relationships between orders, between users, and between users and orders. These results include abnormal pattern recognition, social network analysis, abnormal clustering of transaction networks, etc. These results can indicate that certain specific graph structures or patterns are highly correlated with fraudulent behavior.

[0098] 2) Data analysis results, i.e., multi-dimensional features of orders, including the following:

[0099] The data analysis module of the data enhancement feedback layer conducts multi-dimensional analysis, including user behavior analysis, order attribute analysis, time series analysis, etc. These analysis results help reveal new trends, cyclical patterns or abnormal fluctuations in fraudulent behavior.

[0100] Comparison of historical data and real-time data: By comparing the differences between historical data analysis results and real-time data streams, new or changing fraud patterns can be identified, such as analyzing historical order records and current order records to identify abnormal login behavior or abnormal order frequency. This comparison helps adjust the data preprocessing and transformation rules of the data ingestion layer.

[0101] Outputs of anomaly detection and prediction models: Anomaly detection models and prediction models based on time series may discover potential fraudulent behavior or risk trends, such as the information about the risk trend dimension mentioned above. The outputs of these models are an important part of the feedback flow and can be used to adjust anti-fraud strategies in advance.

[0102] 3) User and warning center module system feedback, that is, the information in the warning center module in the auxiliary module: fraud cases reported by users, customer service records, and false positive and false positive cases intercepted by the system are all feedback information. This information can be used to adjust the sensitivity of the detection algorithm, update the feature library of fraudulent behavior, and optimize the user experience.

[0103] 4) Performance indicators of the data analysis module: Evaluation indicators such as accuracy, recall, F1 score (an indicator used to evaluate the performance of classification models), etc. can directly reflect the performance of the current detection model. Changes in these indicators can be used as feedback to guide the adjustment and optimization of the model.

[0104] The feedback stream from the data enhancement feedback layer is a mechanism for the data ingestion layer to calibrate and refine the data ingestion strategy in real time. This feedback can be parameter adjustments (such as changing the threshold for data cleaning), policy updates (such as introducing new data sources or discarding no longer relevant features), or model fine-tuning (such as updating the weights of the pattern matching fraud detection model). In this way, the system can continuously learn and adapt to more accurately identify and defend against abnormal orders.

[0105] The real-time dynamic multi-dimensional fault-tolerant order data stream enters the data enhancement feedback layer. Here, the distributed service module ensures that the multi-dimensional fault-tolerant data can run on different devices and locations, while maintaining the consistency and real-time nature of the data, and quickly expanding and optimizing the system. The multi-party data fusion module integrates the multi-dimensional fault-tolerant data with data from different sources to provide a more complete data view. The time series module tracks the changes in multi-dimensional fault-tolerant data over time and provides trend and pattern analysis. Finally, the behavioral feedback module learns and adjusts based on user and system feedback, and uses the multi-dimensional fault-tolerant data as the data ingestion layer feedback stream data to form a closed loop.

[0106] 1. Distributed service module: This module is the basis of the data enhancement layer and is responsible for processing and responding to large-scale data requests. Through load balancing, automatic expansion and fault tolerance mechanisms, this module ensures that the data ingestion layer, data integration layer, graph data layer and monitoring alarm layer determine resource configuration parameters to ensure high availability and stability of the system. In the data enhancement feedback layer, this module also provides the necessary computing resources and data foundation for other modules, ensuring that when enhancing the received multi-dimensional fault-tolerant data, the system can respond quickly and ensure the continuity and consistency of data processing.

[0107] 2. Multi-party data fusion module: The function of this module is to enhance the information content and accuracy of internal data. It enriches the dimension and depth of internal data analysis by integrating external data sources. This module uses data fusion technology to ensure that data from different sources can be effectively combined and maintain the consistency and quality of the data. This fusion strategy not only enhances the value of data, but also provides a more comprehensive perspective for subsequent data analysis and decision-making.

[0108] 3. Time series module: This module focuses on time-based and ordered processing of target multi-dimensional order data streams. It uses time series databases and analysis tools to store and manage order flow data that changes over time. This module can capture and analyze the changing trends of data over time, such as cyclical fluctuations in order volume, seasonal changes, etc. Through in-depth analysis of time series data, it helps the business team make more accurate decisions. The role of the time series module is to combine the user's multi-dimensional order data (that is, data including graph structure) to make real-time predictions on user behavior changes.

[0109] 4. Behavior feedback module: The main task of this module is to provide feedback information for the original order data processed by the downstream data ingestion layer, and use this information to optimize the user authentication and security authentication mechanism. Based on the fused multi-party data and time series data, this module integrates and analyzes the user's behavior data to identify user behavior patterns. It can adjust the data processing flow based on multi-party data combined with the fault-tolerant data of the data acceleration layer to improve data accuracy and system responsiveness.

[0110] Based on the above, a closed loop of data processing is formed. This solution includes auxiliary modules, which participate in data processing between various layers. The auxiliary modules include authentication center module, architecture service module, behavior log collection module and early warning center module.

[0111] 1. The authentication center module interacts with the data ingestion layer, behavior log collection module, and early warning center module to achieve a closed loop of multi-factor security authentication, blacklist mechanism, behavior collection, and early warning mechanism. This module provides users with single sign-on (SSO) and secure access control by integrating authentication protocols and technologies. At the same time, it also manages a dynamically updated blacklist that includes known malicious users and systems to ensure that these users or systems cannot access or affect the data processing process. The authentication center interacts closely with the data ingestion layer to verify the authenticity and security of the data source and ensure the accuracy of the data and the integrity of the system.

[0112] 2. Overall architecture service module: This module is the monitoring center for system health and performance. It collects various system performance indicators in real time, including CPU usage, memory usage, disk IO, network traffic, service response time, etc., by integrating monitoring tools and platforms. The monitoring module not only tracks the system operation status, but also detects and warns of potential problems, such as service anomalies and resource bottlenecks. It supports custom alarm rules and can promptly notify system administrators when system indicators exceed the normal range. This module ensures that the entire streaming architecture can run stably and respond to performance degradation and service failures in a timely manner. Service monitoring is the monitoring center for the entire method service and equipment operation status, ensuring that the entire streaming architecture can be stable, respond to performance degradation and service failures in a timely manner, and interact with the entire system to form a monitoring closed loop.

[0113] 3. Behavior log collection module: This module is a key part of data auditing and user behavior analysis. This module captures and stores user behavior logs and system behavior logs through log agents and collection systems. The behavior log collection module not only provides the ability to track and restore user operations for system security, but also supports subsequent data analysis, such as mining user behavior patterns or identifying system anomalies through log data. In addition, this module also interacts closely with the data ingestion layer, authentication center, and graph data processing layer to ensure the integrity and timeliness of log data, forming a closed loop for user behavior log and system log collection.

[0114] 4. Early warning center module: This module is the key channel for system early warning and response. When the monitoring alarm layer detects potential abnormal orders or system abnormalities, this module is responsible for notifying relevant personnel or systems in a timely manner. The alarm release module supports the customization of alarm levels and alarm processes to ensure that alarms of different levels can be notified to the correct response personnel or systems according to the predetermined process. Working in conjunction with the authentication center module, the alarm release module can also trigger automatic security response mechanisms when abnormal behavior is detected, such as temporary locking of user accounts, to further ensure the security of the system. In addition, the module also receives user-reported fraud cases, customer service records, and false positives and false positives intercepted by the system. The alarm release module is the key to system early warning and response, interacting with the authentication center module and the monitoring alarm layer to form an early warning alarm closed loop.

[0115] This solution combines the streaming computing framework with the above layers to build an efficient, dynamic and adaptive abnormal order interception system. The specific innovations and advantages are as follows:

[0116] 1. Multi-level streaming architecture: Traditional abnormal order detection systems usually use batch processing mode, which requires collecting complete data before processing, resulting in delays. This solution uses a streaming computing framework to achieve real-time data ingestion and processing, enabling the system to respond to new orders in near real time, quickly identify and intercept abnormal behaviors, and significantly improve response speed and efficiency.

[0117] 2. Graph data processing: At the data integration layer, the system integrates data from different sources and builds a graph structure. The application of graph data processing can reveal complex relationships and patterns between data, such as the association between users and the similarity of orders. Compared with traditional table data processing, this method can analyze and understand data more deeply, thereby improving the accuracy of intercepting abnormal orders.

[0118] 3. Real-time dynamic decision-making: By applying data flow engines and graph computing in the graph data processing layer, the system achieves real-time dynamic decision-making capabilities. It can process static data and dynamically changing data streams, and update decision models in real time to adapt to new fraud behavior patterns. This real-time feature enables the system to quickly adapt to new malicious behaviors and remain forward-looking and flexible.

[0119] 4. Data-enhanced feedback mechanism: enables the system to learn from operations and continuously adjust the detection algorithm. By collecting user and system feedback, the system can self-optimize and improve the efficiency and effectiveness of intercepting abnormal orders in the future. This adaptability is lacking in traditional systems, allowing the system to become smarter and more accurate over time.

[0120] 5. Auxiliary module integration: The design of auxiliary modules provides security, data integrity and system stability. For example, the authentication center module ensures the security and legitimacy of the data source; the behavior log collection module provides support for system auditing and user behavior analysis; and the alarm release module ensures that the system can respond to potential threats in a timely manner. The integration of these modules not only improves the effectiveness of intercepting abnormal orders, but also maintains the internal and external security of the system.

[0121] In summary, this solution provides an innovative solution for real-time and accurate detection and interception of abnormal orders through the combination of streaming computing framework and graph data processing. Its implementation significantly improves the response speed, accuracy, dynamic adaptability and stability of the abnormal order interception system, bringing a technological breakthrough in the field of abnormal order interception.

[0122] See also Figure 2 , which shows a main flow chart of an order processing method provided by an embodiment of the present invention, comprising the following steps:

[0123] S101: Capture order information in real time, obtain user-related data of the order information, and obtain feedback stream data; wherein the feedback stream data is used to optimize the processing logic of abnormal order detection;

[0124] S102: Constructing first order rich data according to the order information, the feedback stream data and the user-related data;

[0125] S103: using a preset graph structure strategy to determine topology information associated with the first order rich data;

[0126] S104: Based on the topology information and the first order rich data, determine abnormal order rich data in the first order rich data, and intercept order information corresponding to the abnormal order rich data.

[0127] In the above implementation, for step S101, real-time order information is captured from multiple data sources through the data ingestion layer, a user identifier is obtained from the order information, and user information is obtained based on the user identifier. Then, based on the user information, user behavior data is obtained from the user behavior log of the behavior log collection module. Feedback stream data fed back by the data enhancement feedback layer is obtained, a user group is determined based on the user information, and then feedback stream data of the user group is determined, and an initial order real-time stream is constructed based on the order information, user behavior data, and feedback stream data.

[0128] For step S102, the data integration layer receives the initial order real-time stream, obtains the user's historical static data from multiple data sources based on the user information in the initial order real-time stream, and then constructs the first order rich data based on the initial order real-time stream and the historical static data. Rich data refers to data containing relatively rich data information, such as order rich data containing user portrait information, product portrait information, logistics time information, etc.

[0129] For step S103, the relationship between entities is determined based on the first order rich data, and then a first graph structure is constructed, such as a user relationship graph structure, an order relationship graph structure, etc. The graph data processing layer receives the first order rich data and the first graph structure transmitted by the data integration layer, obtains the second graph structure and the order rich data of all users from the data flow graph storage module, integrates the first graph structure and the second graph structure to obtain a third graph structure, uses the third graph structure to process the first order rich data, obtains topology information and adds it to the first order rich data.

[0130] For step S104, the monitoring alarm layer calculates the risk score based on the first order rich data after adding the topology information. If the risk score is greater than the threshold, it is determined that there is an abnormality and the abnormal order is intercepted. However, if there is no abnormality, the normal order is sent to the downstream service of the order for order scheduling.

[0131] The method provided in the above embodiment realizes all-round analysis and real-time dynamic decision-making of orders by capturing and processing order information in real time, combining user-related data, and constructing multi-dimensional order-rich data and graph structures. This method not only improves the accuracy and response speed of abnormal order detection, but also enhances the system's adaptability and foresight by continuously optimizing the processing logic, effectively reducing the occurrence of fraud, and ensuring the stability and security of the system.

[0132] See also Figure 3 , shows a schematic flow chart of a specific order processing method according to an embodiment of the present invention, comprising the following steps:

[0133] 1. Data Ingestion Layer

[0134] 1) The order flow first passes through the data capture module of the data ingestion layer, which collects order information from various data sources. At this stage, the module must capture data efficiently and accurately to ensure that all relevant information is recorded, including the timestamp, amount, user information, product information, etc. of the order. The order information is combined with the graph calculation and data analysis results of the feedback stream data of the data enhancement feedback layer to form the initial captured order data flow.

[0135] The data capture module also works with the authentication center module at this time. If the user or the system that generates the order is on the blacklist or has no authority, the order will be terminated, and the order behavior log will be recorded in the behavior log module. The abnormal order information will be reported to the early warning center module, the order will be intercepted, and the order will be ended; otherwise, the next step will be continued.

[0136] After the abnormal order is blocked, the system will continue to monitor its performance and stability. The overall architecture service module will analyze the system performance after the event, while the behavior log collection module will record the detailed log of the entire event. In addition, the authentication center module can update the blacklist to prevent future fraud.

[0137] 2) The data conversion module of the data ingestion layer takes over the initial captured order data stream, extracts key data elements from it, and converts it into a unified format that is more suitable for processing and analysis.

[0138] 3) The data preprocessing module cleans and normalizes the key data elements after the conversion format. At this stage, the behavior log collection module begins to record all preprocessing activities, including user behavior logs and system operation logs, to provide data support for user analysis and system auditing and monitoring.

[0139] 4) The data annotation module performs preliminary classification and annotation of the key data elements after preprocessing. Specifically, it obtains metadata and tags them, which lays the foundation for subsequent pattern matching and analysis. At this time, the annotation results will also be recorded by the behavior log collection module to ensure the transparency and traceability of the system. At this stage, the order flow is converted into the initial order real-time flow.

[0140] 2. Between the data ingestion layer and the data integration layer

[0141] Before the initial order real-time flow enters the data integration layer, a security protocol check will be performed. If the order information does not comply with the security protocol, the order interception operation of step 1) will be executed. Otherwise, the next stage of data processing will be carried out.

[0142] 3. Data Integration Layer

[0143] 1) The initial order real-time stream detected by the security protocol enters the data integration layer pattern matching module, where the historical purchase data and historical behavior data of all users in the user group are obtained to build a user group portrait; it is judged whether the initial order real-time stream meets the characteristics of the user group portrait, and the user behavior pattern is determined to be an abnormal behavior pattern or a normal behavior pattern based on the judgment result; and in the case that the user behavior pattern is an abnormal behavior pattern, the order information is intercepted and an alarm is triggered.

[0144] 2) For the initial order real-time stream of normal behavior patterns, the data fusion module obtains historical static data corresponding to user information from different data sources, and fuses the initial order real-time stream and historical static data to build a more comprehensive first order rich data. For example, the user's historical purchase data is merged with the current order data to better understand the user behavior.

[0145] 3) The graph construction module constructs a first graph structure based on the relationship between the order data and the first order rich data. This can reveal the complex connections between orders and users, such as multiple orders of the same user or related transactions between multiple users. At this stage, the initial order real-time stream forms structured and formatted order rich data.

[0146] 4. Graph Data Processing Layer

[0147] 1) Structured and formatted order rich data enters the graph data processing layer. The data flow engine pushes the information required by the data flow graph calculation module in real time. Specifically, it also includes obtaining the second graph structure and order rich data of all other users from the data flow graph storage module.

[0148] 2) The data flow graph calculation module uses complex graph algorithms to process the order rich data and user-reported fraud cases, customer service records, and system-intercepted false positive and false positive cases provided by the early warning center module, and identify abnormal patterns. When the system detects new fraudulent behavior or abnormal patterns, the model of the graph data processing layer will be updated and adjusted according to this new information. In this process, the system will use the historical data in the behavior log collection module for learning and pattern recognition to improve the accuracy of the detection algorithm. After that, the analyzed graph structure and order rich data are stored for subsequent query and further analysis. These data include the structural information of the transaction graph and possible risk scores. At this stage, the order rich data forms real-time dynamic decision-making data.

[0149] 5. Monitoring and alarm layer: real-time and dynamic decision-making data enters the monitoring and alarm layer.

[0150] 1) The real-time monitoring decision module evaluates the received data in real time and makes quick decisions if potential fraud or other risks are detected. After confirming the risk, the order blocking module is responsible for preventing the transaction from proceeding and passing the relevant information to the integrated service module.

[0151] 2) The integrated service module ensures that the decision-making of the monitoring alarm layer can work in coordination with other systems (such as payment gateways, customer service, email and SMS systems, case collection, etc.) to achieve coordination of the entire order processing process. If the order has been marked as a risk or abnormal order, the alarm module will play a role at this stage. Once an abnormality is detected, the early warning mechanism will be triggered immediately. If the order is normal, the order will enter normal downstream services, such as settlement, delivery, etc. At this stage, the decision-making data is converted into real-time dynamic marking data.

[0152] 6. Data buffer layer

[0153] Real-time dynamic tagged data enters the data buffer layer. The cache module quickly accesses frequently accessed order data, which can speed up data processing and reduce the pressure on backend storage. The real-time data warehouse module then stores the tagged data, establishes order subject data, and splits the first order rich data according to multiple dimensions. It supports high-speed query of historical data and real-time data, and provides support for the data analysis module. The data analysis module performs multi-dimensional funnel analysis on the data models of all dimensions stored in the real-time data warehouse module to provide deeper insights.

[0154] 7. Data Acceleration Layer

[0155] The multi-dimensional analysis data enters the data acceleration layer. In the data acceleration layer, the fault-tolerant filtering module processes the multi-dimensional analysis data from the upstream to ensure the accuracy and consistency of the data and reduce the impact of erroneous data on system decisions. In this stage, the multi-dimensional analysis data is converted into real-time dynamic multi-dimensional fault-tolerant data. The multi-dimensional fault-tolerant data is sorted according to the order timestamp to obtain a multi-dimensional fault-tolerant order data stream.

[0156] 8. Data Enhancement Feedback Layer

[0157] Real-time dynamic multi-dimensional fault-tolerant data enters the data enhancement feedback layer. Here, the distributed service module ensures that the multi-dimensional fault-tolerant data can run on different devices and locations, while maintaining data consistency and real-time, and quickly expanding and optimizing the system. The multi-party data fusion module integrates multi-dimensional fault-tolerant data with data from different sources to provide a more complete data view. The time series module tracks the changes in multi-dimensional fault-tolerant data over time and provides trend and pattern analysis. Finally, the behavior feedback module learns and adjusts based on user and system feedback, and uses the multi-dimensional fault-tolerant order data stream as the data ingestion layer feedback stream data to form a closed loop.

[0158] This solution combines the multi-level streaming architecture with the above layers and has the following significant advantages over the traditional abnormal order interception solution:

[0159] 1. Real-time and dynamic adaptability: Through streaming processing, the system can analyze and respond to order data in real time, quickly identify and intercept abnormal orders. At the same time, the system has the ability to dynamically adapt to new fraud patterns, and can continuously learn from the behavior feedback module and update the detection algorithm.

[0160] 2. Data fusion and enhancement: The system integrates multiple data sources and can use a wider range of information when analyzing orders, which significantly improves the accuracy of identifying abnormal orders. Time series analysis further enhances the ability to identify abnormal patterns, especially when dealing with complex attacks.

[0161] 3. Enhanced security measures: The authentication center module provides a more powerful user authentication mechanism, including multi-factor authentication and blacklist management, effectively reducing unauthorized access and fraud.

[0162] 4. Comprehensive monitoring and early warning system: The system's overall architecture service module and alarm module ensure comprehensive monitoring of the system's health status and rapid response when anomalies are detected, thereby reducing potential risks and losses.

[0163] 5. High scalability and fault tolerance: The distributed service module enables the system to efficiently process large-scale data while maintaining performance and stability. This design allows the system to be easily expanded to cope with the growth of data volume and more complex data processing needs.

[0164] 6. Balance between user experience and system security: Through refined behavioral analysis and models, the system can intercept abnormal orders without interfering with normal user transactions, thus achieving a good balance between user experience and system security.

[0165] In summary, through real-time data processing, advanced analytical technology and enhanced security measures, this solution can prevent and reduce the occurrence of fraud more effectively than traditional solutions.

[0166] See also Figure 4 , showing a schematic diagram of the main modules of an order processing device 400 provided in an embodiment of the present invention, including: a data acquisition layer 401, used for capturing order information in real time, obtaining user-related data of the order information, and obtaining feedback stream data; wherein the feedback stream data is used to optimize the processing logic of abnormal order detection; a data integration layer 402, used for constructing first order rich data according to the order information, the feedback stream data and the user-related data; a graph data processing layer 403, used for determining topology information associated with the first order rich data using a preset graph structure strategy; a monitoring alarm layer 404, used for determining abnormal order rich data in the first order rich data based on the topology information and the first order rich data, and intercepting the order information corresponding to the abnormal order rich data.

[0167] In the implementation device of the present invention, user-related data is determined by user information, and user information is determined by a user identifier in order information. The device also includes an authentication center module, which is used to: determine the system that generates the order based on the order information; send the user information or the system that generates the order to the authentication center module for security authentication; in response to an authentication result that is an abnormality, intercept the order information and trigger an alarm.

[0168] In the implementation device of the present invention, the user-related data includes one or more of user behavior data, user groups and historical static data; the data acquisition layer 401 is used to: obtain feedback stream data corresponding to the user group; construct an initial order real-time stream according to order information, user behavior data and feedback stream data; when the initial order real-time stream passes the security protocol detection, analyze the initial order real-time stream to obtain the user behavior pattern; when the user behavior pattern is a normal behavior pattern, fuse the initial order real-time stream and the historical static data to construct the first order rich data.

[0169] In the implementation device of the present invention, the data ingestion layer 401 is used to: construct an initial captured order data stream based on order information, user behavior data and feedback stream data; extract key data elements from the initial captured order data stream, and convert the key data elements into a preset format; preprocess the key data elements converted into the preset format to obtain preprocessed key data elements, obtain metadata of the preprocessed key data elements, and mark the metadata tags to obtain the initial order real-time stream.

[0170] In the implementation device of the present invention, the data integration layer 402 is used to: obtain the historical purchase data and historical behavior data of all users in the user group to construct a user group portrait; determine whether the real-time stream of initial orders meets the characteristics of the user group portrait, and determine whether the user behavior pattern is an abnormal behavior pattern or a normal behavior pattern based on the judgment result; and intercept the order information when the user behavior pattern is an abnormal behavior pattern.

[0171] The implementation device of the present invention also includes: determining the size of the order information or the order information and user-related data to determine the resource configuration parameters required to process the data of the size, and then performing resource configuration according to the resource configuration parameters.

[0172] In the implementation device of the present invention, the graph data processing layer 403 is used to: construct a first graph structure based on the first order rich data; obtain the second graph structure locally, integrate the first graph structure and the second graph structure to obtain a third graph structure; use the third graph structure to process the first order rich data to obtain topology information to add to the first order rich data.

[0173] In the implementation device of the present invention, the graph data processing layer 403 is used to: obtain the second order rich data and the second graph structure of all other users locally; integrate the first graph structure and the second graph structure according to the first order rich data and the second order rich data to obtain a third graph structure; and replace the local second graph structure with the third graph structure, and add the first order rich data locally.

[0174] In the implementation device of the present invention, the device also includes a data buffer layer and a data enhancement feedback layer:

[0175] The monitoring alarm layer 404 is used to determine the risk score of the first order rich data, and to label the first order rich data with a corresponding risk label according to the relationship between the risk score and a preset threshold;

[0176] The data buffer layer is used to split the first order rich data marked with risk labels according to preset multiple dimensions, divide the split data into groups corresponding to corresponding dimensions, and update the data model of the group corresponding to the dimension;

[0177] Perform multi-dimensional funnel analysis on the data models of all dimensions to obtain order dimension features and information about risk trends, add the information about risk trends to the order dimension features, and then sort the order dimension features according to the timestamps in the order information to generate a multi-dimensional order data stream;

[0178] The data enhancement feedback layer is used to obtain relevant data from multiple data sources based on user information in the multidimensional order data stream, integrate the multidimensional order data stream and the relevant data, and obtain the target multidimensional order data stream;

[0179] Determine a target multidimensional order data flow including the same object, analyze the target multidimensional order data flow, obtain feature information about the object, and add the feature information to the target multidimensional order data flow;

[0180] The first graph structure, the target multi-dimensional order data flow, the information in the early warning center module, and the performance indicators of the order dimension characteristics are obtained as feedback flow data; wherein, triggering the alarm is executed through the early warning center module.

[0181] In the implementation device of the present invention, the data buffer layer is used to: obtain processing information for the abnormal first order rich data marked with a high-risk label, and re-evaluate the risk score based on the processing information and the abnormal first order rich data marked with a high-risk label; for each order information, re-evaluate the risk score based on the data model of all dimensions and the first order rich data of each order information; and perform multi-dimensional funnel analysis on the data model of all dimensions after the re-evaluation of the risk score.

[0182] In the implementation device of the present invention, the data acceleration layer is used to: perform fault-tolerant filtering on order dimensional features to obtain multi-dimensional fault-tolerant data; sort the multi-dimensional fault-tolerant data according to the timestamp in the order information to generate a multi-dimensional fault-tolerant order data stream.

[0183] In the implementation device of the present invention, the data enhancement feedback layer includes one or more of the following: determining a target multidimensional order data stream including the same item, performing time and order processing on the determined target multidimensional order data stream to obtain time series data of item data changing over time; determining a target multidimensional order data stream including the same user information, and integrating and analyzing the user behavior data in the determined target multidimensional order data stream to identify user behavior patterns.

[0184] In addition, the specific implementation content of the device described in the embodiment of the present invention has been described in detail in the method described above, so the repeated content will not be described again here.

[0185] Figure 5An exemplary system architecture 500 to which embodiments of the present invention may be applied is shown, including terminal devices 501 , 502 , 503 , a network 504 and a server 505 (only an example).

[0186] Terminal devices 501, 502, 503 can be various electronic devices with display screens and supporting web browsing, and various communication client applications are installed. Users can use terminal devices 501, 502, 503 to interact with server 505 through network 504 to receive or send messages, etc.

[0187] The network 504 is used to provide a medium for communication links between the terminal devices 501, 502, 503 and the server 505. The network 504 may include various connection types, such as wired, wireless communication links or optical fiber cables.

[0188] The server 505 may be a server that provides various services, such as a backend management server that provides support for shopping websites browsed by users using terminal devices 501, 502, and 503 (for example only). The backend management server may analyze and process the received data such as product information query requests, and feed back the processing results (such as target push information, product information - for example only) to the terminal device. It should be noted that the method provided in the embodiment of the present invention is generally executed by the server 505, and accordingly, the device is generally set in the server 505.

[0189] It should be understood that Figure 5 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0190] Reference below Figure 6 , which shows a schematic diagram of the structure of a computer system 600 of a terminal device suitable for implementing an embodiment of the present invention. Figure 6 The terminal device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0191] like Figure 6 As shown, the computer system 600 includes a central processing unit (CPU) 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage part 608 into a random access memory (RAM) 603. In the RAM 603, various programs and data required for the operation of the system 600 are also stored. The CPU 601, the ROM 602, and the RAM 603 are connected to each other via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0192] The following components are connected to the I / O interface 605: an input section 606 including a keyboard, a mouse, etc.; an output section 607 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 608 including a hard disk, etc.; and a communication section 609 including a network interface card such as a LAN card, a modem, etc. The communication section 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to the I / O interface 605 as needed. A removable medium 611, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 610 as needed, so that a computer program read therefrom is installed into the storage section 608 as needed.

[0193] In particular, according to the embodiments disclosed in the present invention, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present invention include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 609, and / or installed from the removable medium 611. When the computer program is executed by the central processing unit (CPU) 601, the above-mentioned functions defined in the system of the present invention are executed.

[0194] It should be noted that the computer-readable medium shown in the present invention may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present invention, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present invention, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

[0195] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present invention. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0196] The modules involved in the embodiments of the present invention may be implemented by software or hardware. The modules described may also be set in a processor. For example, they may be described as: a processor includes a data acquisition layer, a data integration layer, a graph data processing layer, and a monitoring alarm layer. The names of these modules do not, in some cases, constitute limitations on the modules themselves. For example, the data acquisition layer may also be described as a "data capture processing layer."

[0197] As another aspect, the present invention further provides a computer-readable medium, which may be included in the device described in the above embodiment; or may exist independently without being assembled into the device. The above computer-readable medium carries one or more programs, and when the above one or more programs are executed by a device, the device executes any of the above order processing methods.

[0198] The computer program product of the present invention comprises a computer program, and when the computer program is executed by a processor, the order processing method in the embodiment of the present invention is implemented.

[0199] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions may occur depending on design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. An order processing method, characterized in that: include: Capture order information in real time, obtain user-related data of order information, and obtain feedback stream data; among which, feedback stream data is used to optimize the processing logic of abnormal order detection; Constructing first order rich data according to the order information, the feedback stream data and the user-related data; Using a preset graph structure strategy, determine topology information associated with the first order rich data; Based on the topology information and the first order rich data, abnormal order rich data in the first order rich data is determined, and order information corresponding to the abnormal order rich data is intercepted.

2. The method according to claim 1, characterized in that The user-related data is determined by the user information, and the user information is determined by the user identifier in the order information. The method further includes: Determine the system that generates the order based on the order information; Send user information or the system that generates the order to the authentication center module for security authentication; In response to the authentication result being abnormal, the order information is intercepted and an alarm is triggered.

3. The method according to claim 1 or 2, characterized in that: The user-related data includes one or more of user behavior data, user groups and historical static data; The obtaining of feedback stream data includes: obtaining feedback stream data corresponding to the user group; The constructing first order rich data according to the order information, the feedback stream data and the user-related data includes: Build the initial order real-time stream based on order information, user behavior data, and feedback stream data; When the initial order real-time stream passes the security protocol detection, the initial order real-time stream is analyzed to obtain the user behavior pattern; When the user behavior pattern is a normal behavior pattern, the initial order real-time stream and historical static data are integrated to construct the first order rich data.

4. The method according to claim 3, characterized in that The initial order real-time stream is constructed based on the order information, user behavior data and feedback stream data, including: Construct the initial captured order data stream based on order information, user behavior data and feedback stream data; Extract key data elements from the initial captured order data stream and convert the key data elements into a preset format; Preprocess the key data elements converted into a preset format to obtain the preprocessed key data elements, obtain metadata of the preprocessed key data elements, tag the metadata tags, and obtain the initial order real-time stream.

5. The method according to claim 3, characterized in that: The analysis of the initial order real-time stream to obtain the user behavior pattern includes: Obtain the historical purchase data and historical behavior data of all users in the user group to build a user group portrait; Determine whether the initial order real-time stream meets the characteristics of the user group profile, and determine whether the user behavior pattern is an abnormal behavior pattern or a normal behavior pattern based on the determination result; and When the user behavior pattern is abnormal, the order information is intercepted.

6. The method according to claim 1, characterized in that The method further comprises: The size of the order information or the order information and user-related data is determined to determine the resource configuration parameters required to process the data of the size, and then the resources are configured according to the resource configuration parameters.

7. The method according to claim 1, characterized in that The using a preset graph structure strategy to determine the topology information associated with the first order rich data includes: Constructing a first graph structure according to the first order rich data; Acquire the second graph structure from the local computer, integrate the first graph structure and the second graph structure, and obtain the third graph structure; The first order rich data is processed using the third graph structure to obtain topology information to be added to the first order rich data.

8. The method according to claim 7, characterized in that The method of obtaining the second graph structure from the local computer and integrating the first graph structure and the second graph structure to obtain the third graph structure includes: Obtain the second order rich data and second graph structure of all other users locally; Integrating the first graph structure and the second graph structure according to the first order rich data and the second order rich data to obtain a third graph structure; and The local second graph structure is replaced with the third graph structure, and the first order rich data is added locally.

9. The method according to claim 1, characterized in that: The method further comprises: Determine the risk score of the first order rich data, and label the first order rich data with a corresponding risk label according to the relationship between the risk score and a preset threshold; According to the preset multiple dimensions, the rich data of the first order marked with risk labels is split, the split data is divided into groups corresponding to the corresponding dimensions, and the data model of the group corresponding to the dimension is updated; Perform multi-dimensional funnel analysis on the data models of all dimensions to obtain order dimension features and information about risk trends, add the information about risk trends to the order dimension features, and then sort the order dimension features according to the timestamps in the order information to generate a multi-dimensional order data stream; Based on the user information in the multidimensional order data stream, relevant data is obtained from multiple data sources, and the multidimensional order data stream and the relevant data are integrated to obtain the target multidimensional order data stream; Determine a target multidimensional order data flow including the same object, analyze the target multidimensional order data flow, obtain feature information about the object, and add the feature information to the target multidimensional order data flow; The first graph structure, the target multi-dimensional order data flow, the information in the early warning center module, and the performance indicators of the order dimension characteristics are obtained as feedback flow data; wherein, triggering the alarm is executed through the early warning center module.

10. The method according to claim 9, characterized in that The multi-dimensional funnel analysis of the data models of all dimensions includes: For the abnormal first order rich data marked with a high-risk label, obtain processing information, and re-evaluate the risk score based on the processing information and the abnormal first order rich data marked with a high-risk label; For each order information, re-evaluate the risk score based on the data model of all dimensions and the first order rich data of each order information; Perform multi-dimensional funnel analysis on the data model of all dimensions after re-evaluating the risk score.

11. The method according to claim 9, characterized in that The order dimension features are sorted according to the timestamps in the order information to generate a multi-dimensional order data stream, including: Perform fault-tolerant filtering on order dimension features to obtain multi-dimensional fault-tolerant data; The multidimensional fault-tolerant data is sorted according to the timestamps in the order information to generate a multidimensional fault-tolerant order data stream.

12. The method according to claim 9, characterized in that The determining of the target multi-dimensional order data stream including the same object, analyzing the target multi-dimensional order data stream, and obtaining feature information of the related object may include one or more of the following: Determine a target multidimensional order data stream including the same item, perform time-based and order-ordering processing on the determined target multidimensional order data stream, and obtain time series data of item data changing over time; A target multi-dimensional order data stream including the same user information is determined, and user behavior data in the determined target multi-dimensional order data stream is integrated and analyzed to identify user behavior patterns.

13. An order processing device, characterized in that: Including data ingestion layer, data integration layer, graph data processing layer and monitoring alarm layer: The data ingestion layer is used to capture order information in real time, obtain user-related data of order information, and obtain feedback stream data; among which, the feedback stream data is used to optimize the processing logic of abnormal order detection; A data integration layer, used for constructing first order rich data according to the order information, the feedback stream data and the user-related data; A graph data processing layer, configured to determine topology information associated with the first order rich data using a preset graph structure strategy; The monitoring alarm layer is used to determine abnormal order rich data in the first order rich data based on the topology information and the first order rich data, and intercept the order information corresponding to the abnormal order rich data.

14. An electronic device, characterized in that: include: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 12.

15. A computer readable medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 12 is implemented.

16. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the method according to any one of claims 1 to 12 is implemented.

Images