Detection system and method for preventing woolen pulling in marketing based on micro-batch risk management and control

Abstract

The invention relates to the technical field of risk monitoring, in particular to an anti-marketing wool pulling detection system and method based on micro-batch risk management and control, and the system comprises a wool pulling rule construction module, a grey list management module and an activity assembly. According to the method, the early warning threshold value of the Japanese pulling behavior can be flexibly set, the interception mechanism is automatically triggered when the movable component and the Flink action reach the standard, resource distribution is accurately controlled, and the illegal arbitrage behavior is effectively restrained; a grey list management mechanism is introduced, the identified high-risk clients are transferred to a grey list, and accurate prevention and control and subsequent tracking management are realized; by adding the dynamic adjustment process of the wool pulling rule and the secondary feedback verification of the grey list, whether the user really belongs to the wool pulling user can be returned and compacted, the accuracy of preventing the wool pulling and the grey list is greatly improved, the real wool pulling user can be effectively screened out so as to cope with the change of different market environments and customer behaviors, and the user experience is improved. And misjudgment caused by a fixed threshold value can be reduced.

Description

Technical Field

[0001] The present invention relates to the technical field of risk monitoring, and in particular to a detection system and method for preventing marketing fraud based on micro-batch risk management, which is suitable for monitoring fraud behaviors in marketing activities of the financial banking industry. Background Art

[0002] With the popularity of online marketing activities and the increase in flash sales business scenarios, the behavior of the wool party (a professional group that specializes in collecting and using various preferential information to gain benefits) has become more rampant, causing huge economic losses to companies and platforms. In order to control the risk of marketing flash sales activities, existing technologies usually use wool-pulling behavior monitoring and management systems to conduct marketing risk analysis to ensure the purity and fairness of marketing flash sales activities and effectively eliminate wool-pulling behavior.

[0003] In the existing technical solutions, in order to timely intercept the behavior of grabbing wool at flash sales, the monitoring and management system of grabbing wool behavior needs to have high real-time performance, which requires the system to be able to quickly process a large amount of data and make decisions; however, high real-time performance is often accompanied by a large consumption of computing resources, which may lead to a decrease in system performance. In addition, for the wool-grabbing rules in the system, the thresholds are generally pre-set and usually need to be adjusted manually. It may be reasonable to set them in the current time period, but in special scenarios such as holidays, peak hours after meals, and Double Eleven, there are many abnormal rule detection results; at the same time, the existing monitoring and management system will usually add the user to the gray list after judging that the user is a wool-grabbing user group, which means that the user can basically no longer participate in subsequent marketing activities under normal circumstances, but in some special scenarios, the user is allowed to grab wool, but the user is also added to the gray list, which will lead to the loss of customers and cause losses.

[0004] Therefore, a detection system and method based on micro-batch risk management and control to prevent marketing fraud was proposed. Summary of the invention

[0005] Based on this, it is necessary to provide a detection system and method based on micro-batch risk control to prevent marketing fraud in response to the above-mentioned technical problems.

[0006] According to a first aspect of the present invention, a detection system for preventing marketing fraud based on micro-batch risk management is provided, the system comprising: a fraud rule construction module, used to create and dynamically adjust fraud rules, and store the fraud rules in a cache library; a gray list management module, used to use Flink to obtain the user's event stream information value or activity component participation data, perform Flink action compliance calculation on the user's event stream information value or activity component participation data, and verify and compare the Flink action compliance calculation result with the fraud rules. If the Flink action compliance calculation result exceeds the fraud rules, the corresponding user and event stream information value or activity component participation data are stored in the gray list library, and the user in the gray list library is automatically prevented from participating in marketing activities. If the Flink action compliance calculation result does not exceed the fraud rules, the user is allowed to participate in the marketing activities; and according to the gray list secondary feedback verification mechanism, automatically Execute the operation of removing users and corresponding event flow information values ​​or activity component participation data in the gray list library; activity component, used to construct an activity page for a marketing activity, the activity page is generated based on a combination of multiple types of components, each type of component is provided with an internal verification mechanism and an internal logic execution rule, according to the internal verification mechanism of each type of component, the internal logic execution rule of the corresponding type of component is automatically executed, and after the user participates in the marketing activity of a certain type of component and the internal logic execution rule of the corresponding type of component is executed, the corresponding activity component participation data is recorded, and the activity component participation data is sent to the gray list management module for verification and comparison. If the verification and comparison pass, the user is allowed to participate in the marketing activity of the corresponding type of component and continue to execute the internal logic execution rule of the corresponding type of component. If the verification and comparison fail, the user is not allowed to continue to participate in the marketing activity of the corresponding type of component.

[0007] Optionally, the wool-pulling rule construction module includes: a wool-pulling rule definition submodule, which is used to create wool-pulling rules and store the created wool-pulling rules in a cache library, wherein the wool-pulling rules include activity number information, activity name information, monitoring status information, affiliated organization information, notification person in charge information, rule configuration information and threshold; a dynamic rule adjustment submodule, which is used to pull the user list in the gray list library according to the defined first time interval, calculate the event flow information value or the average value of the activity component participation data that triggers the wool-pulling rules for all users in the gray list library within the current first time interval, and use the calculated average value as the threshold of the wool-pulling rules, dynamically adjust the wool-pulling rules, and store the dynamically adjusted wool-pulling rules in the cache library.

[0008] Optionally, the gray list management module includes: a preliminary verification submodule, which is used to use Flink to obtain the user's event stream information value or activity component participation data, and to perform a preliminary verification of the user's qualifications by pulling the user list in the gray list library. If the user is in the gray list library, the user is automatically prevented from participating in marketing activities. If the user is not in the gray list library, the user is secondary verified by the secondary verification submodule; a secondary verification submodule, which is used to perform a secondary verification on the user who has passed the preliminary verification, and perform Flink action compliance calculation on the user's event stream information value or activity component participation data to obtain a Flink action compliance calculation result, wherein the Flink action compliance calculation result is obtained based on counting the user's event stream information value or activity component participation data, and is called and stored in the cache library The wool-pulling rules in the Flink action standard calculation are verified and compared with the wool-pulling rules. If the Flink action standard calculation result exceeds the wool-pulling rules, the corresponding user is determined to be a user with abnormal acquisition behavior, and the corresponding user and event flow information value or activity component participation data are stored in the gray list library, and the user in the gray list library is automatically prevented from participating in marketing activities. If the Flink action standard calculation result does not exceed the wool-pulling rules, the user is allowed to participate in marketing activities; the gray list regression verification batch running sub-module is used to perform secondary feedback verification on the users in the gray list library according to the gray list secondary feedback verification mechanism, obtain the secondary feedback verification result, and determine whether to automatically execute the operation of removing the users and the corresponding event flow information value or activity component participation data in the gray list library according to the secondary feedback verification result.

[0009] Optionally, the gray list regression verification batch running submodule includes: a regression verification submodule, which is used to pull the user list in the gray list library according to the defined second time interval, and perform regression verification on all users in the gray list library within the current second time interval according to the gray list regression verification batch running rules, wherein the gray list regression verification batch running rules include whether the time when the user is judged to have abnormal acquisition behavior is within a preset time threshold, whether the calculation result of the user's Flink action reaching the standard is verified again to exceed the current dynamically adjusted wool-pulling rule, and whether the number of times the user is stored in the gray list library exceeds the preset number threshold. If the time when the user is judged to have abnormal acquisition behavior is within the preset time threshold or the calculation result of the user's Flink action reaching the standard is verified again not to exceed the current dynamically adjusted wool-pulling rule, and if the number of times the user is stored in the gray list library is verified not to exceed the preset number threshold, then the operation of removing the user and the corresponding event stream information value or activity component participation data in the gray list library is automatically executed; otherwise, the operation of removing the user and the corresponding event stream information value or activity component participation data in the gray list library is not executed.

[0010] Optionally, the activity component includes: an activity page construction submodule, which is used to construct an activity page for a marketing activity, and the activity page is generated based on a combination of multiple types of components; a rule definition submodule, which is used to set an internal verification mechanism and an internal logic execution rule for each type of component, wherein the internal verification mechanism of each type of component is the same and is used to verify the qualifications of users participating in the marketing activity; an activity component internal verification submodule, which is used to verify the qualifications of users participating in the marketing activity according to the internal verification mechanism of each type of component, obtain the qualification verification result, and determine whether to automatically execute the internal logic execution rule of the corresponding type of component according to the qualification verification result; an activity component participation data verification submodule, which is used to record the corresponding activity component participation data after the user participates in the marketing activity of a certain type of component and the internal logic execution rule of the corresponding type of component is executed, and send the activity component participation data to the gray list management module for verification and comparison. If the verification and comparison pass, the user is allowed to participate in the marketing activity of the corresponding type of component and continue to execute the internal logic execution rule of the corresponding type of component. If the verification and comparison fail, the user is not allowed to continue to participate in the marketing activity of the corresponding type of component.

[0011] Optionally, the internal verification submodule of the activity component includes: an internal verification submodule, which is used to verify the qualifications of the current user who has entered the gray list library, by pulling the user list in the gray list library, if the current user is still in the gray list library, the current user is automatically prevented from continuing to participate in the marketing activity, and a prompt message is returned that the current user is a user with abnormal acquisition behavior; if the current user is not in the gray list library, the internal logic execution rules of the corresponding type of component are automatically executed.

[0012] Optionally, the system further includes: a cache library for storing wool-pulling rules; a gray list library for storing users who are determined to have abnormal acquisition behavior and corresponding event flow information values ​​or activity component participation data.

[0013] According to a second aspect of the present invention, a detection method for preventing marketing fraud based on micro-batch risk management is provided, comprising: creating and dynamically adjusting fraud rules through a fraud rule construction module, and storing the fraud rules in a cache library; using Flink to obtain a user's event stream information value or activity component participation data through a gray list management module, performing Flink action compliance calculation on the user's event stream information value or activity component participation data, verifying and comparing the Flink action compliance calculation result with the fraud rules, if the Flink action compliance calculation result exceeds the fraud rules, then storing the corresponding user and event stream information value or activity component participation data in the gray list library, automatically preventing the user in the gray list library from participating in marketing activities, and allowing the user to participate in marketing activities if the Flink action compliance calculation result does not exceed the fraud rules; and automatically executing according to the gray list secondary feedback verification mechanism. Operations of removing users and corresponding event flow information values ​​or activity component participation data in the grey list library; constructing an activity page for a marketing activity through activity components, wherein the activity page is generated based on a combination of multiple types of components, and each type of component is provided with an internal verification mechanism and an internal logic execution rule. According to the internal verification mechanism of each type of component, the internal logic execution rule of the corresponding type of component is automatically executed, and after the user participates in a marketing activity of a certain type of component and the internal logic execution rule of the corresponding type of component is executed, the corresponding activity component participation data is recorded, and the activity component participation data is sent to the grey list management module for verification and comparison. If the verification and comparison pass, the user is allowed to participate in the marketing activity of the corresponding type of component and continue to execute the internal logic execution rule of the corresponding type of component. If the verification and comparison fail, the user is not allowed to continue to participate in the marketing activity of the corresponding type of component.

[0014] According to a third aspect of the present invention, an electronic device is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the method when executing the computer program.

[0015] According to a fourth aspect of the present invention, there is provided a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and the computer program implements the steps of the method when executed by a processor.

[0016] The advantages and beneficial effects of the present invention are as follows: the present invention provides a detection system and method for preventing marketing fraud based on micro-batch risk control, the system can flexibly set the warning threshold of fraud behavior, and the active components and Flink actions that meet the standards will automatically trigger the interception mechanism, so as to achieve accurate control of resource distribution and effectively curb illegal arbitrage behavior; at the same time, a gray list management mechanism is introduced to transfer the identified high-risk customers to the gray list, so as to achieve accurate prevention and control and subsequent tracking management, ensure the purity and fairness of the flash sale activities and prevent fraud; and, a dynamic adjustment process of the fraud rules and a secondary feedback verification of the gray list are added, which can not only realize the regression to confirm whether the user is really a fraud user, but also block the user from participating in marketing activities if it is true, and remove the user from the gray list library if it is not true, which greatly improves the accuracy of the anti-fraud and gray list, so that the gray list can more accurately reflect the customer groups with real problems. In addition, by The threshold of the rule is adjusted dynamically. When the number of wool-pulling behaviors increases, the threshold of the wool-pulling rule will be increased accordingly, so as to more effectively screen out the real wool-pulling people, so as to cope with the changes in different market environments and customer behaviors, and thus reduce the misjudgment caused by fixed thresholds; in addition, the system adopts Flink, cache library and database real-time synchronization technology, which can instantly capture and process event stream information values ​​or activity component participation data from various channels, and use Flink to independently execute complex compliance rule calculation logic, which greatly shortens the processing time and ensures that the system can respond in real time and generate accurate data results. It can not only detect and warn potential wool-pulling behaviors in a timely manner, but also dynamically adjust the wool-pulling rules according to real-time data, so as to more effectively curb the occurrence of malicious behaviors. At the same time, due to the low latency and high throughput characteristics of Flink, the system can maintain stable performance and response speed even in the face of large-scale data and high concurrent requests. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 It is a system principle block diagram of the present invention.

[0018] Figure 2 This is a system principle block diagram of the wool-picking rule construction module of the present invention.

[0019] Figure 3 This is a system principle block diagram of the grey list management module of the present invention.

[0020] Figure 4 It is a system principle block diagram of the active components of the present invention.

[0021] Figure 5 It is the overall flow chart of the present invention.

[0022] Figure 6 Schematic diagram of an electronic device of the present invention. DETAILED DESCRIPTION

[0023] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below through specific implementation methods in conjunction with the accompanying drawings. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0024] Embodiment 1

[0025] Reference Figure 1-4 A detection system 100 for preventing marketing scams based on micro-batch risk management is disclosed. The system includes a scam rule construction module 110, a gray list management module 120, and an activity component 130.

[0026] In some embodiments, refer to the attached Figure 2 The wool-pulling rule construction module 110 is used to create and dynamically adjust the wool-pulling rules and store the wool-pulling rules in a cache library.

[0027] Furthermore, the wool-pulling rule construction module 110 includes a wool-pulling rule definition submodule 1110, which is used to create wool-pulling rules and store the created wool-pulling rules in the cache library, wherein the wool-pulling rules include activity number information, activity name information, monitoring status information, affiliated organization information, notification person in charge information, rule configuration information and threshold; a dynamic rule adjustment submodule 1120, which is used to pull the user list in the gray list library according to the defined first time interval, calculate the event flow information value or the average value of the activity component participation data that triggers the wool-pulling rules for all users in the gray list library within the current first time interval, and use the calculated average value as the threshold of the wool-pulling rules, dynamically adjust the wool-pulling rules, and store the dynamically adjusted wool-pulling rules in the cache library.

[0028] Furthermore, the wool-picking rules involved in this application include but are not limited to activity number information, activity name information, monitoring status information, affiliated organization information, notification person in charge information, rule configuration information and thresholds, etc. This information constitutes the basic framework for activity dimension monitoring, so as to provide data support for the subsequent triggering and verification of corresponding early warning rules.

[0029] Furthermore, by setting the wool-picking rule definition submodule 1110, the configuration of the wool-picking rules can be realized. For example, the monitoring status information is set to transaction frequency monitoring, the rule configuration information is the statistical time of 12 seconds, and the corresponding threshold is the number limit of 2 times. It should be noted that the number of rule configuration information and thresholds can be flexibly adjusted according to actual conditions and are no longer limited here. For example, for transaction frequency monitoring, two rule configuration information are configured, such as the first rule configuration information is the statistical time of 12 seconds, and the corresponding threshold is the number limit of 2 times, and the second rule configuration information is the statistical time of 23 seconds, and the corresponding threshold is the number limit of 5 times.

[0030] Furthermore, by setting a dynamic rule adjustment submodule 1120 and adopting a dynamic rule batch running mechanism, the user list in the gray list library is pulled once according to the defined first time interval (such as every 30 minutes), and the event flow information value or the average value of the activity component participation data of these users triggering the wool-pulling rule is calculated. For example, within the first time interval, user A consumed 30 times, user B consumed 40 times, and user C consumed 35 times, then the average value is 35, and the threshold of the current wool-pulling rule is updated and adjusted to 35. In the subsequent wool-pulling rule verification, the threshold of the wool-pulling rule is not fixed, but changes with time and changes in gray list information, which can effectively prevent the gray list from misjudging.

[0031] In some embodiments, refer to the attached Figure 3 The gray list management module 120 is used to use Flink to obtain the user's event stream information value or activity component participation data, perform Flink action compliance calculation on the user's event stream information value or activity component participation data, and verify and compare the Flink action compliance calculation result with the wool-pulling rule. If the Flink action compliance calculation result exceeds the wool-pulling rule, the corresponding user and event stream information value or activity component participation data are stored in the gray list library, and the user in the gray list library is automatically prevented from participating in the marketing activity. If the Flink action compliance calculation result does not exceed the wool-pulling rule, the user is allowed to participate in the marketing activity; and according to the gray list secondary feedback verification mechanism, the operation of automatically removing the user and the corresponding event stream information value or activity component participation data in the gray list library is automatically executed.

[0032] Furthermore, the gray list management module 120 includes: a preliminary verification submodule 1210, which is used to use Flink to obtain the user's event stream information value or activity component participation data, and to perform a preliminary verification of the user's qualifications by pulling the user list in the gray list library. If the user is in the gray list library, the user is automatically prevented from participating in the marketing activity. If the user is not in the gray list library, the user is secondary verified by the secondary verification submodule; a secondary verification submodule 1220, which is used to perform a secondary verification on the user who has passed the preliminary verification, and perform Flink action compliance calculation on the user's event stream information value or activity component participation data to obtain a Flink action compliance calculation result, wherein the Flink action compliance calculation result is obtained based on counting the user's event stream information value or activity component participation data, and calling the stored The wool-pulling rules in the cache library verify and compare the Flink action compliance calculation results with the wool-pulling rules. If the Flink action compliance calculation results exceed the wool-pulling rules, the corresponding user will be judged as a user with abnormal acquisition behavior, and the corresponding user and event flow information value or activity component participation data will be stored in the gray list library, and the user in the gray list library will be automatically prevented from participating in marketing activities. If the Flink action compliance calculation results do not exceed the wool-pulling rules, the user is allowed to participate in marketing activities; the gray list regression verification batch running sub-module 1230 is used to perform secondary feedback verification on the users in the gray list library according to the gray list secondary feedback verification mechanism, obtain the secondary feedback verification results, and determine whether to automatically execute the operation of removing the users and corresponding event flow information values ​​or activity component participation data in the gray list library according to the secondary feedback verification results.

[0033] Furthermore, by setting up a gray list management module 120, which is mainly responsible for executing the verification logic of the wool-pulling rule and the Flink action compliance calculation, once it is detected that a user has triggered the wool-pulling rule, the user and his event stream information value or activity component participation data will be automatically added to the gray list library; users pulled into the gray list library are deemed to have abnormal acquisition behavior, and the system will automatically block their further participation in marketing activities.

[0034] Furthermore, the Flink involved in this application is mainly capable of processing event stream information values ​​and activity component participation data from multiple channels (such as mobile banking, bank big data platforms and data warehouses, etc.) in real time, wherein the event stream includes events such as user behavior, transaction records, and participation in promotional activities, and the event stream information value refers to the event data generated by these events, including but not limited to user behavior data, transaction record data, and promotional activity participation data. For example, "{"time":"2024-11-20 10:00:05","custNo":"Zhang San","spendMoney":100.00", this event stream includes information such as time, user number, and amount of consumption. After receiving the event stream information value or activity component participation data, Flink will extract the specific values ​​of these data for subsequent judgment of whether the threshold of the wool-pulling rule is met.

[0035] Furthermore, after obtaining the event stream information value and activity component participation data, Flink first pulls the user list in the gray list library to perform a preliminary verification of the qualifications of users participating in the marketing activities. If the user is in the gray list library, the user is automatically blocked from participating in the marketing activities. If the user is not in the gray list library, the user is verified again, and the wool-pulling rules are quickly obtained through the cache library to quickly support the subsequent wool-pulling rule verification process. The Flink action compliance calculation is performed on the user's event stream information value or activity component participation data to obtain the Flink action compliance calculation result, and the Flink action compliance calculation result is compared with the wool-pulling rules. If the Flink action compliance calculation result exceeds the wool-pulling rules, the user and its event stream information value and activity component participation data are added to the gray list library to prevent further improper behavior; if the Flink action compliance calculation result does not exceed the wool-pulling rules, the user is allowed to participate in the marketing activities.

[0036] Furthermore, the Flink action compliance calculation result is obtained by counting the user's event stream information value or activity component participation data. For example, the number of activity component participation data within a preset period of time is counted, such as counting the number of lottery participation data within one minute, and obtaining the number of lottery participation data within one minute (that is, the Flink action compliance calculation result, such as 5 times). Subsequently, the Flink action compliance calculation result is verified and compared with the lottery rules (such as the number threshold of lottery participation data within one minute is 6). The Flink action compliance calculation result does not exceed the lottery rules, allowing the user to participate in the lottery marketing activity; if the number of lottery participation data within one minute is counted as 7 times, that is, the Flink action compliance calculation result is 7 times, then the Flink action compliance calculation result exceeds the lottery rules, the user is added to the gray list library, and the user in the gray list library is automatically prevented from participating in the lottery marketing activity.

[0037] In some embodiments, the gray list regression verification batch submodule 1230 includes: a regression verification submodule, which is used to pull the user list in the gray list library according to the defined second time interval, and perform regression verification on all users in the gray list library within the current second time interval according to the gray list regression verification batch rule, wherein the gray list regression verification batch rule includes whether the time when the user is judged to have abnormal acquisition behavior is within the preset time threshold, whether the calculation result of the user's Flink action reaching the standard is verified again to exceed the current dynamically adjusted wool-pulling rule, and whether the number of times the user is stored in the gray list library exceeds the preset number threshold. If the time when the user is judged to have abnormal acquisition behavior is within the preset time threshold or the calculation result of the user's Flink action reaching the standard is verified again not to exceed the current dynamically adjusted wool-pulling rule, and if the number of times the user is stored in the gray list library is verified not to exceed the preset number threshold, then the operation of removing the user and the corresponding event stream information value or activity component participation data in the gray list library is automatically executed; otherwise, the operation of removing the user and the corresponding event stream information value or activity component participation data in the gray list library is not executed.

[0038] Furthermore, the gray list secondary feedback verification mechanism involved in the present application is triggered at a fixed time. For the gray list secondary feedback verification process, an intelligent customized triggered gray list secondary feedback verification mechanism is adopted. This mechanism accurately pulls the users and their event flow information values ​​and activity component participation data in the current gray list library, and on this basis, verifies whether the time when the user is judged to have abnormal acquisition behavior is within the preset time threshold (such as whether the last time the user was judged to have abnormal acquisition behavior was within 48 hours), and re-verifies whether the user's Flink action compliance calculation result exceeds the current dynamically adjusted wool-pulling rules (such as re-verifying whether the user's Flink action compliance calculation result exceeds the threshold of the current dynamically adjusted wool-pulling rules), and at the same time verifies whether the number of times the user is stored in the gray list library exceeds the preset number threshold (such as checking whether the number of times the user enters the gray list library exceeds three times). If If the time when the user is judged to have abnormal acquisition behavior is within the preset time threshold or the calculation result of the user's Flink action reaching the standard is verified again and does not exceed the current dynamically adjusted wool-pulling rule, and at the same time, it is verified that the number of times the user is stored in the gray list library does not exceed the preset number threshold, that is, if the time when the user is judged to have abnormal acquisition behavior is within the preset time threshold and at the same time, it is verified that the number of times the user is stored in the gray list library does not exceed the preset number threshold, or the calculation result of the user's Flink action reaching the standard is verified again and does not exceed the current dynamically adjusted wool-pulling rule, and at the same time, it is verified that the number of times the user is stored in the gray list library does not exceed the preset number threshold, then the operation of removing the user and the corresponding event stream information value or activity component participation data in the gray list library is automatically executed. In addition, the operation of removing the user and the corresponding event stream information value or activity component participation data in the gray list library is not executed, so as to ensure the accuracy and flexibility of user management.

[0039] Furthermore, by setting up a secondary feedback verification mechanism for the gray list, when a user is preliminarily judged to have abnormal acquisition behavior and is added to the gray list library, the system will perform the first step of verification to determine whether the user actually engages in wool-pulling behavior. If it is found through verification that the user is not actually a wool-pulling user, the user needs to be removed from the gray list library. The secondary feedback verification mechanism for the gray list can ensure that only users who actually engage in wool-pulling behavior will be added to the gray list library to avoid user dissatisfaction and loss caused by misjudgment. At the same time, it also improves the accuracy of the system's judgment on wool-pulling behavior, thereby enhancing the credibility of the system, and users' trust in the system is improved, which helps to maintain good customer relationships. In addition, by removing misjudged users, the management mechanism of the gray list can be optimized, effectively reducing resource consumption and labor costs, and this also enables the gray list to more accurately reflect the user groups that actually have problems.

[0040] In some embodiments, refer to the attached Figure 4, activity component 130, is used to construct an activity page for a marketing activity, and the activity page is generated based on a combination of multiple types of components. Each type of component is provided with an internal verification mechanism and an internal logic execution rule. According to the internal verification mechanism of each type of component, the internal logic execution rule of the corresponding type of component is automatically executed, and after the user participates in the marketing activity of a certain type of component and the internal logic execution rule of the corresponding type of component is executed, the corresponding activity component participation data is recorded, and the activity component participation data is sent to the gray list management module 120 for verification and comparison. If the verification and comparison pass, the user is allowed to participate in the marketing activity of the corresponding type of component and continue to execute the internal logic execution rule of the corresponding type of component. If the verification and comparison fail, the user is not allowed to continue to participate in the marketing activity of the corresponding type of component.

[0041] Furthermore, the activity component 130 includes: an activity page construction submodule 1310, which is used to construct an activity page for a marketing activity, and the activity page is generated based on a combination of multiple types of components; a rule definition submodule 1320, which is used to set an internal verification mechanism and an internal logic execution rule for each type of component, wherein the internal verification mechanism of each type of component is the same and is used to perform qualification verification on users participating in the marketing activity; an activity component internal verification submodule 1330, which is used to perform qualification verification on users participating in the marketing activity according to the internal verification mechanism of each type of component, obtain a qualification verification result, and determine whether to automatically execute the internal logic execution rule of the corresponding type of component according to the qualification verification result; an activity component participation data verification submodule 1340, which is used to record the corresponding activity component participation data after the user participates in the marketing activity of a certain type of component and the internal logic execution rule of the corresponding type of component is executed, and send the activity component participation data to the gray list management module 120 for verification and comparison. If the verification and comparison pass, the user is allowed to participate in the marketing activity of the corresponding type of component and continue to execute the internal logic execution rule of the corresponding type of component. If the verification and comparison fail, the user is not allowed to continue to participate in the marketing activity of the corresponding type of component.

[0042] Furthermore, the components involved in this application serve as the basic building blocks of the activity page, and various activity pages are constructed by combining different types of components (such as lottery, turntable, flip card, and registration, etc.). In addition, each component has independent internal logic execution rules and can independently process its internal logic. For example, the lottery component implements lottery to obtain rights, and the top 5 flip card rankings obtain rights after the event ends. The registration component allows operation and maintenance personnel to obtain the registration list for the next business operation.

[0043] Furthermore, each time a user participates in a marketing activity (such as a lottery, a registration, etc.), the corresponding activity component participation data is recorded by the activity component participation data verification submodule, and the activity component participation data is sent to the gray list management module 120. After obtaining the activity component participation data, the gray list management module 120 will first perform gray list verification to determine whether the user is in the gray list library. If not, the activity component participation data is subjected to Flink action compliance calculation to obtain the Flink action compliance calculation result, which is then verified and compared with the wool-pulling rules. If the verification and comparison pass, the user is allowed to participate in the marketing activities of the corresponding type of component and continue to execute the internal logic execution rules of the corresponding type of component. If the verification and comparison fail, the user is not allowed to continue to participate in the marketing activities of the corresponding type of component.

[0044] Furthermore, activity component participation data includes, but is not limited to, parameter data for participating in a lottery, parameter data for obtaining registrations, parameter data for participating in games, and parameter data for participating in quizzes, and can be flexibly set according to actual marketing activities and will not be limited here.

[0045] Furthermore, each component involved in the present application also has an independent internal verification mechanism, and the internal verification mechanisms of each component are the same, which are all for verifying the qualifications of users participating in marketing activities. It is used when a user who has been pulled into the gray list library tries to participate in a marketing activity again. For example, a user who has been pulled into the gray list library tries to participate in a lottery again. At this time, the lottery component first triggers the gray list verification process to verify the qualifications of the user.

[0046] In some embodiments, the activity component internal verification submodule 1330 includes: an internal verification submodule, which is used to verify the qualifications of the current user who has entered the gray list library, by pulling the user list in the gray list library. If the current user is still in the gray list library, the current user is automatically prevented from continuing to participate in the marketing activity, and a prompt message is returned that the current user is a user with abnormal acquisition behavior; if the current user is not in the gray list library, the internal logic execution rules of the corresponding type of component are automatically executed.

[0047] Furthermore, by setting up an internal verification sub-module, when a user who has been added to the gray list library tries to participate in a marketing activity again, the system first triggers the gray list verification process to verify the user's qualifications. If the user is still in the gray list library, the verification fails, and the current user is automatically prevented from continuing to participate in the marketing activity, and a prompt message is displayed indicating that the current user is a user with abnormal acquisition behavior. If the user is not in the gray list library, the verification passes, and according to the type of marketing activity in which the user participates, such as a lottery, the internal logic execution rules of the lottery type component are automatically executed, allowing the user to participate in the lottery normally.

[0048] In some embodiments, refer to the attached Figure 1 The system also includes a cache library 140 and a gray list library 150, wherein the cache library 140, such as Redis, is used to store wool-pulling rules; the gray list library 150 is used to store users who are judged to have abnormal acquisition behavior and the corresponding event flow information values ​​or activity component participation data.

[0049] Embodiment 2

[0050] This embodiment provides a detection method for preventing marketing fraud based on micro-batch risk management and control on the basis of the above embodiment 1. Figure 5 , a detection system based on micro-batch risk management and control to prevent marketing fraud applied to Example 1, the method includes the following steps.

[0051] S1. Create and dynamically adjust the wool-pulling rules through the wool-pulling rule construction module, and store the wool-pulling rules in the cache library.

[0052] S2. Use Flink to obtain the user's event stream information value or activity component participation data through the gray list management module, perform Flink action compliance calculation on the user's event stream information value or activity component participation data, and verify and compare the Flink action compliance calculation result with the wool-pulling rules. If the Flink action compliance calculation result exceeds the wool-pulling rules, the corresponding user and event stream information value or activity component participation data are stored in the gray list library, and the user in the gray list library is automatically prevented from participating in the marketing activity. If the Flink action compliance calculation result does not exceed the wool-pulling rules, the user is allowed to participate in the marketing activity; and according to the gray list secondary feedback verification mechanism, automatically execute the operation of removing the user and the corresponding event stream information value or activity component participation data in the gray list library.

[0053] S3. Construct an activity page for a marketing activity through activity components. The activity page is generated by combining multiple types of components. Each type of component is provided with an internal verification mechanism and internal logic execution rules. According to the internal verification mechanism of each type of component, the internal logic execution rules of the corresponding type of component are automatically executed. When a user participates in a marketing activity of a certain type of component and the internal logic execution rules of the corresponding type of component are executed, the corresponding activity component participation data is recorded and sent to the gray list management module for verification and comparison. If the verification and comparison pass, the user is allowed to participate in the marketing activity of the corresponding type of component and continue to execute the internal logic execution rules of the corresponding type of component. If the verification and comparison fail, the user is not allowed to continue to participate in the marketing activity of the corresponding type of component.

[0054] Embodiment 3

[0055] This embodiment further provides an electronic device based on the above embodiment 1. Figure 6 , Figure 6 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0056] like Figure 6 As shown, the electronic device may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 301, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 302 or a program loaded from a storage device 308 to a random access memory (RAM) 303. Various programs and data required for the operation of the electronic device are also stored in the RAM 303. The processing device 301, the ROM 302, and the RAM 303 are connected to each other via a bus 304. An input / output (I / O) interface 305 is also connected to the bus 304.

[0057] Typically, the following devices may be connected to the I / O interface 305: an input device 306 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, etc., an output device 307 including, for example, a liquid crystal display (LCD), a speaker, etc., a storage device 308 including, for example, a magnetic tape, a hard disk, etc., and a communication device 309. The communication device 309 may allow the electronic device to communicate with other devices wirelessly or by wire to exchange data. Figure 6 An electronic device having various devices is shown, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead. Figure 6 Each block shown in the figure may represent one device, or may represent multiple devices as required.

[0058] In particular, according to some embodiments of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, some embodiments of the present disclosure include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In some such embodiments, the computer program can be downloaded and installed from the network through the communication device 309, or installed from the storage device 308, or installed from the ROM 302. When the computer program is executed by the processing device 301, the above-mentioned functions defined in the method of some embodiments of the present disclosure are executed.

[0059] Embodiment 4

[0060] Based on the above-mentioned embodiment 1, this embodiment further provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the steps of the above-mentioned method are implemented.

[0061] It should be noted that the computer-readable medium mentioned above in some embodiments of the present disclosure may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In some embodiments of the present disclosure, the computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, device or device. In some embodiments of the present disclosure, the computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer readable signal media may also be any computer readable medium other than computer readable storage media, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0062] In this embodiment, the client and the server may communicate using any currently known or future developed network protocol such as HTTP (HyperTextTransferProtocol), and may be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an adhoc peer-to-peer network), as well as any currently known or future developed network.

[0063] The computer-readable medium may be included in the device, or may exist independently without being installed in the electronic device. The computer-readable medium carries one or more programs. When the one or more programs are executed by the electronic device, the electronic device: obtains training data, converts the training data into initial data; determines an initial rule base based on the initial data, and optimizes the parameters of the initial rule base to obtain a target rule base; calculates the rules in the target rule base according to a preset activation weight calculation formula to obtain activation weights; determines abnormal information according to the test data and the activation weights.

[0064] Computer program code for performing the operations of some embodiments of the present disclosure may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0065] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0066] The units described in some embodiments of the present disclosure may be implemented by software or hardware. The units described may also be provided in a processor, for example, may be described as: a processor including a data acquisition unit, a rule determination unit, a weight calculation unit, and an anomaly determination unit. The names of these units do not, in some cases, constitute limitations on the units themselves, for example, the data acquisition unit may also be described as a "unit for acquiring training data".

[0067] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, exemplary types of hardware logic components that may be used include, without limitation, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), etc.

[0068] Obviously, it should be understood by those skilled in the art that the above-mentioned various steps of the present invention can be performed in a manner different from the present invention, and the simulation method and experimental equipment include but are not limited to the above description. The above-mentioned various steps of the present invention can be performed in an order different from that here in some cases, and the steps shown or described above can be performed separately. Therefore, the present invention is not limited to any specific combination of hardware and software.

[0069] The above contents are further detailed descriptions of the present invention in combination with specific implementation methods, and it cannot be determined that the specific implementation of the present invention is limited to these descriptions. For ordinary technicians in the technical field to which the present invention belongs, several simple deductions or substitutions can be made without departing from the concept of the present invention, which should be regarded as falling within the scope of protection of the present invention.

Claims

1. A detection system based on micro-batch risk management and control to prevent marketing fraud, characterized in that: The system includes: The wool-pulling rule construction module is used to create and dynamically adjust the wool-pulling rules and store the wool-pulling rules in the cache library; The graylist management module is used to use Flink to obtain the user's event stream information value or activity component participation data, perform Flink action compliance calculation on the user's event stream information value or activity component participation data, and verify and compare the Flink action compliance calculation result with the wool-pulling rule. If the Flink action compliance calculation result exceeds the wool-pulling rule, the corresponding user and event stream information value or activity component participation data are stored in the graylist library, and the user in the graylist library is automatically prevented from participating in the marketing activity. If the Flink action compliance calculation result does not exceed the wool-pulling rule, the user is allowed to participate in the marketing activity; and according to the graylist secondary feedback verification mechanism, automatically execute the operation of removing the user and the corresponding event stream information value or activity component participation data in the graylist library; An activity component is used to construct an activity page for a marketing activity. The activity page is generated based on a combination of multiple types of components. Each type of component is provided with an internal verification mechanism and internal logic execution rules. According to the internal verification mechanism of each type of component, the internal logic execution rules of the corresponding type of component are automatically executed. When a user participates in a marketing activity of a certain type of component and the internal logic execution rules of the corresponding type of component are executed, the corresponding activity component participation data is recorded and sent to the gray list management module for verification and comparison. If the verification and comparison pass, the user is allowed to participate in the marketing activity of the corresponding type of component and continue to execute the internal logic execution rules of the corresponding type of component. If the verification and comparison fail, the user is not allowed to continue to participate in the marketing activity of the corresponding type of component.

2. According to claim 1, a detection system based on micro-batch risk management and control to prevent marketing fraud is characterized in that: The wool-pulling rule construction module includes: A submodule for defining rules for collecting benefits, which is used to create benefits rules and store the created benefits rules in a cache library, wherein the benefits rules include activity number information, activity name information, monitoring status information, affiliated organization information, notification person in charge information, rule configuration information and threshold value; The dynamic rule adjustment submodule is used to pull the user list in the gray list library according to the defined first time interval, calculate the event flow information value or the average value of the activity component participation data of all users in the gray list library that trigger the wool-pulling rule within the current first time interval, and use the calculated average value as the threshold of the wool-pulling rule, dynamically adjust the wool-pulling rule, and store the dynamically adjusted wool-pulling rule in the cache library.

3. A detection system based on micro-batch risk management and control to prevent marketing fraud according to claim 2, characterized in that: The grey list management module comprises: The preliminary verification submodule is used to obtain the user's event stream information value or activity component participation data using Flink, and to perform preliminary verification of the user's qualifications by pulling the user list in the gray list library. If the user is in the gray list library, the user is automatically prevented from participating in the marketing activity. If the user is not in the gray list library, the user is secondary verified by the secondary verification submodule; The secondary verification submodule is used to perform secondary verification on users who have passed the preliminary verification, perform Flink action compliance calculation on the user's event stream information value or activity component participation data, and obtain the Flink action compliance calculation result. The Flink action compliance calculation result is obtained after counting the user's event stream information value or activity component participation data, and the wool-pulling rules stored in the cache library are called to verify and compare the Flink action compliance calculation result with the wool-pulling rules. If the Flink action compliance calculation result exceeds the wool-pulling rules, the corresponding user is determined to be a user with abnormal acquisition behavior, and the corresponding user and event stream information value or activity component participation data are stored in the gray list library, and the user in the gray list library is automatically prevented from participating in marketing activities. If the Flink action compliance calculation result does not exceed the wool-pulling rules, the user is allowed to participate in the marketing activities; The grey list regression verification batch sub-module is used to perform secondary feedback verification on the users in the grey list library according to the grey list secondary feedback verification mechanism, obtain the secondary feedback verification result, and determine whether to automatically remove the users and corresponding event flow information values ​​or activity component participation data in the grey list library based on the secondary feedback verification result.

4. A detection system based on micro-batch risk management and control to prevent marketing fraud according to claim 3, characterized in that: The grey list regression verification batch running submodule includes: The regression verification submodule is used to pull the user list in the gray list library according to the defined second time interval, and perform regression verification on all users in the gray list library within the current second time interval according to the gray list regression verification batch rule, wherein the gray list regression verification batch rule includes whether the time when the user is judged to have abnormal acquisition behavior is within the preset time threshold, whether the calculation result of the Flink action of the user reaches the standard after verification again exceeds the current dynamically adjusted wool-pulling rule, and whether the number of times the user is stored in the gray list library exceeds the preset number threshold. If the time when the user is judged to have abnormal acquisition behavior is within the preset time threshold or the calculation result of the Flink action of the user reaches the standard after verification again does not exceed the current dynamically adjusted wool-pulling rule, and the number of times the user is stored in the gray list library does not exceed the preset number threshold, then the operation of removing the user and the corresponding event stream information value or activity component participation data in the gray list library is automatically executed; otherwise, the operation of removing the user and the corresponding event stream information value or activity component participation data in the gray list library is not executed.

5. According to claim 1, a detection system based on micro-batch risk management and control to prevent marketing fraud is characterized in that: The activity components include: An activity page construction submodule is used to construct an activity page for a marketing activity, wherein the activity page is generated based on a combination of multiple types of components; The rule definition submodule is used to set the internal verification mechanism and internal logic execution rules for each type of component, wherein the internal verification mechanism of each type of component is the same and is used to verify the qualifications of users participating in marketing activities; The activity component internal verification submodule is used to verify the qualifications of users participating in the marketing activities according to the internal verification mechanism of each type of component, obtain the qualification verification results, and determine whether to automatically execute the internal logic execution rules of the corresponding type of component according to the qualification verification results; The activity component participation data verification sub-module is used to record the corresponding activity component participation data after the user participates in the marketing activities of a certain type of component and the internal logic execution rules of the corresponding type of component are executed, and send the activity component participation data to the gray list management module for verification and comparison. If the verification and comparison pass, the user is allowed to participate in the marketing activities of the corresponding type of component and continue to execute the internal logic execution rules of the corresponding type of component. If the verification and comparison fails, the user is not allowed to continue to participate in the marketing activities of the corresponding type of component.

6. A detection system based on micro-batch risk management and control to prevent marketing fraud according to claim 5, characterized in that: The activity component internal check submodule includes: The internal verification submodule is used to verify the qualifications of the current user who has entered the gray list library. By pulling the user list in the gray list library, if the current user is still in the gray list library, the current user is automatically prevented from continuing to participate in marketing activities, and a prompt message is returned that the current user is a user with abnormal acquisition behavior. If the current user is not in the gray list library, the internal logic execution rules of the corresponding type of component are automatically executed.

7. A detection system based on micro-batch risk management and control to prevent marketing fraud according to claim 1, characterized in that: The system further comprises: Cache library, used to store wool-pulling rules; The greylist library is used to store users who are judged to have abnormal acquisition behavior and the corresponding event flow information values ​​or activity component participation data.

8. A detection method for preventing marketing fraud based on micro-batch risk management, characterized in that: include: Create and dynamically adjust the wool-pulling rules through the wool-pulling rule construction module, and store the wool-pulling rules in the cache library; The greylist management module uses Flink to obtain the user's event stream information value or activity component participation data, performs Flink action compliance calculation on the user's event stream information value or activity component participation data, and verifies and compares the Flink action compliance calculation result with the wool-pulling rules. If the Flink action compliance calculation result exceeds the wool-pulling rules, the corresponding user and event stream information value or activity component participation data are stored in the greylist library, and the user in the greylist library is automatically prevented from participating in the marketing activity. If the Flink action compliance calculation result does not exceed the wool-pulling rules, the user is allowed to participate in the marketing activity; And according to the grey list secondary feedback verification mechanism, automatically perform the operation of removing the user and corresponding event flow information value or activity component participation data in the grey list library; An activity page for a marketing activity is constructed through activity components. The activity page is generated by combining multiple types of components. Each type of component is provided with an internal verification mechanism and internal logic execution rules. The internal logic execution rules of the corresponding type of component are automatically executed according to the internal verification mechanism of each type of component. When a user participates in a marketing activity of a certain type of component and the internal logic execution rules of the corresponding type of component are executed, the corresponding activity component participation data is recorded and sent to the gray list management module for verification and comparison. If the verification and comparison pass, the user is allowed to participate in the marketing activity of the corresponding type of component and continue to execute the internal logic execution rules of the corresponding type of component. If the verification and comparison fail, the user is not allowed to continue to participate in the marketing activity of the corresponding type of component.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the method according to claim 8 are implemented.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of the method according to claim 8 are implemented.

Images