Internet risk control optimization method based on multi-dimensional data analysis

Abstract

The invention relates to the technical field of internet risk control management, and discloses an internet risk control optimization method based on multi-dimensional data analysis, which comprises the following steps: acquiring internet user behavior data, transaction data, equipment information and environment data in real time, and carrying out data preprocessing on the data to generate a sample data set; key risk control features are extracted from the sample data set based on a feature importance analysis strategy, and a feature subset is generated; performing parameter optimization on the integrated gradient boosting tree and the deep learning network by using an improved sparrow search algorithm, and obtaining a risk control model after optimization; and inputting the feature subset into a risk control model for analysis, outputting a risk score, and generating a risk control decision in combination with a dynamic threshold adjustment strategy. According to the method, the model iteration period is shortened, the training convergence speed is improved, the overall prediction performance and generalization ability of the risk control model are improved, and more reliable technical guarantee is provided for risk identification.

Description

Technical Field

[0001] The present invention relates to the technical field of Internet risk control management, and in particular to an Internet risk control optimization method based on multidimensional data analysis. Background Art

[0002] With the rapid development of Internet finance and e-commerce, large-scale, multi-source data has shown explosive growth in areas such as online transactions, payment settlements, and user behavior analysis, giving rise to a strong demand for risk identification and control technologies; traditional risk control mainly relies on single or limited dimensional data, such as only focusing on transaction amounts, account history, or simple geographic location information, which makes it difficult to timely and comprehensively characterize users' potential risk behaviors.

[0003] In recent years, the application of new algorithms such as deep learning and reinforcement learning in financial risk control scenarios has continued to increase, but most algorithm strategies are still at the stage of fixed rules or shallow analysis, and lack sufficient ability to capture nonlinear correlations and dynamic changes between complex data; therefore, in the massive, multi-dimensional Internet data environment, how to effectively integrate user behavior, device environment and transaction characteristics, and make full use of advanced algorithms to mine and model high-dimensional features has become an important direction of Internet risk control research.

[0004] Existing Internet risk control models generally have problems such as low training efficiency, incomplete feature extraction and insufficient parameter optimization depth: on the one hand, risk control systems based on single-point rules are difficult to respond quickly to changes in new risk scenarios; on the other hand, although ensemble learning algorithms have improved prediction performance to a certain extent, they may still have limitations in the screening and redundant processing of multi-dimensional features, resulting in difficulty in balancing the complexity and interpretability of the model; at the same time, deep learning models are extremely sensitive to hyperparameters, and it is difficult to obtain optimal performance without an efficient search algorithm; the above-mentioned deficiencies cause the existing risk control solutions to lack sufficient accuracy and flexibility in real-time analysis of multi-source data and dynamic threshold adjustment, resulting in blind spots in effectively identifying and predicting users' potential risk behaviors.

[0005] Based on the limitations of the above-mentioned existing technologies, the common Internet risk control methods in this field have deficiencies in multi-dimensional data integration and model parameter optimization. Our invention is a solution for real-time collection of multi-source data, feature importance analysis and parameter tuning, and then generating more accurate and flexible risk control decisions. It mainly solves the technical difficulties that traditional risk control cannot efficiently extract multi-source key features, is difficult to realize deep model optimal parameter search, and has difficulty in intelligent adjustment of dynamic thresholds. Summary of the invention

[0006] The purpose of this section is to summarize some aspects of the embodiments of the present invention and briefly introduce some preferred embodiments. Some simplifications or omissions may be made in this section and the abstract of the specification and the title of the invention of this application to avoid blurring the purpose of this section, the abstract of the specification and the title of the invention, and such simplifications or omissions cannot be used to limit the scope of the present invention.

[0007] In view of the above existing problems, the present invention is proposed.

[0008] In order to solve the above technical problems, the present invention provides the following technical solutions: real-time collection of Internet user behavior data, transaction data, device information and environmental data, data preprocessing, and generation of sample data sets; Extracting key risk control features from the sample data set based on a feature importance analysis strategy to generate a feature subset; The improved sparrow search algorithm is used to optimize the parameters of the integrated gradient boosting tree and deep learning network, and the risk control model is obtained after optimization; The feature subset is input into the risk control model for analysis, a risk score is output, and a risk control decision is generated in combination with a dynamic threshold adjustment strategy.

[0009] As a preferred solution of the Internet risk control optimization method based on multidimensional data analysis described in the present invention, the user behavior data includes user login frequency, page dwell time, click behavior sequence and operation trajectory heat map; The transaction data includes transaction amount, payment method, transaction timestamp, associated account information and number of failed transactions; The device information includes device model, operating system version, IP address, GPS location data and device unique identifier; The environmental data includes network type, real-time geographic location risk score, third-party blacklist association data and current network delay status.

[0010] As a preferred solution of the Internet risk control optimization method based on multidimensional data analysis described in the present invention, the data preprocessing includes: The missing data are interpolated using the missing value filling method based on the K nearest neighbor algorithm; Outliers were identified through Z-score standardization combined with the interquartile range method, and abnormal data were eliminated; The Min-Max normalization method is used to unify data of different dimensions into the interval [0,1]; The Word2Vec model is used to vectorize and encode text data to generate semantic vector representations.

[0011] As a preferred solution of the Internet risk control optimization method based on multidimensional data analysis described in the present invention, the feature importance analysis strategy includes: Calculate the Gini impurity reduction value of each feature based on the random forest algorithm and sort them by importance; The correlation between features and risk labels is calculated using the mutual information method, and features with correlations higher than a preset threshold are screened; Combine the Lasso regression model to perform sparse processing on the features and remove redundant features whose weight coefficients are lower than the set value; The above results are combined to generate a feature subset containing the top N key features, where N is determined by cross-validation.

[0012] As a preferred solution of the Internet risk control optimization method based on multidimensional data analysis described in the present invention, the improved sparrow search algorithm includes: The dynamic inertia weight is introduced to adjust the search step length of the individual sparrow according to the number of iterations. The formula is: Where t is the current iteration number, is the preset maximum number of iterations, Indicates the dynamic inertia weight value at the tth iteration, which is used to adjust the search step length of the sparrow individual. Indicates the preset initial maximum value of the inertia weight, which is used to control the global search capability at the initial stage of iteration. Indicates the preset minimum inertia weight, which is used to limit the local fine search range in the later stage of iteration; Add a multi-group collaboration mechanism to divide the sparrow population into exploration subgroups and development subgroups to perform global search and local fine search respectively; An adaptive mutation strategy is adopted to perform Gaussian mutation on individuals that have not been optimized for multiple consecutive generations to avoid falling into local optimality.

[0013] As a preferred solution of the Internet risk control optimization method based on multidimensional data analysis described in the present invention, the improved sparrow search algorithm is used to optimize the parameters of the integrated gradient boosting tree and deep learning network, including: The gradient boosting tree is used to process structured data, the input is a numerical feature in a feature subset, and the output is a preliminary risk probability; The deep learning network adopts a bidirectional LSTM structure, the input is the time series behavior data in the feature subset, and the output is the time series risk probability; The output results of the gradient boosting tree and the deep learning network are integrated through a weighted fusion layer, and the weight is dynamically assigned by the validation set AUC indicator.

[0014] As a preferred solution of the Internet risk control optimization method based on multidimensional data analysis described in the present invention, a weighted sum is performed according to the weight coefficients of each feature in the risk control model, and the output risk score is formulated as follows: in, Indicates the risk score of the user's current behavior or transaction. The initial value is a linear weighted sum. is the weight coefficient of the i-th feature in the risk control model, reflecting the contribution of this feature to risk determination. is the value of the i-th feature after normalization, n is the total number of features contained in the feature subset, and i is the feature index; The summation result is mapped to the interval [0,1] through the Sigmoid function as the final risk score; When the value approaches 0, it means there is no risk; When the value approaches 1, it indicates extremely high risk.

[0015] As a preferred solution of the Internet risk control optimization method based on multidimensional data analysis described in the present invention, the dynamic threshold adjustment strategy includes: The mean and standard deviation of historical risk scores are calculated based on a sliding window, with the window size being the most recent M transaction data. Define adjustment factors based on business risk appetite; Calculate the dynamic threshold based on the distribution of risk scores in the current window; When the real-time risk score exceeds the dynamic threshold, a high-risk decision is triggered; When the real-time risk score is lower than the dynamic threshold, a secondary verification is performed in combination with the user's historical credit rating.

[0016] As a preferred solution of the Internet risk control optimization method based on multidimensional data analysis described in the present invention, the risk control decision includes high-risk decision, medium-risk decision and low-risk decision, wherein: The high-risk decision includes intercepting the current transaction, sending SMS verification and freezing the account operation authority; The medium-risk decision includes limiting the transaction amount and requiring additional identity verification information; The low-risk decision includes allowing the transaction to go through, recording a log, and updating the user's credit score.

[0017] Beneficial effects of the present invention: 1. Real-time data collection enables the system to capture the latest risk dynamics in a timely manner, thereby responding quickly to new risk events. The preprocessing step can compress data dimensions, reduce redundancy, and extract core information, thereby improving the overall data quality and laying a solid foundation for subsequent feature extraction and model training; 2. It reduces information noise caused by feature redundancy, improves model training efficiency, strengthens the focus on core features, and significantly improves the prediction stability and accuracy of the model in complex data scenarios; 3. The improved sparrow search algorithm is used to optimize the parameters of the integrated gradient boosting tree and deep learning network, which can find the approximately optimal hyperparameter combination in a broader and more global search space. The improved algorithm simulates group intelligence and individual random search behavior to ensure that the search depth and breadth are taken into account in the multi-dimensional search space, and effectively avoid falling into the local optimum, thereby achieving the effect of overall optimization. It not only reduces the repeated experiments and subjective experience deviations required for a large number of manual parameter adjustments, but also shortens the model iteration cycle and improves the training convergence speed, thereby improving the overall prediction performance and generalization ability of the risk control model. In the face of the ever-changing Internet risk control scenarios, the model can perform adaptive parameter updates more timely, providing more reliable technical guarantees for risk identification; 4. By setting dynamic thresholds, the system can adaptively adjust the judgment threshold according to the real-time risk environment or business needs, avoiding high false positives or missed positives under fixed thresholds, thereby achieving a better balance between robustness and sensitivity. It can not only maintain relatively consistent risk identification accuracy in fluctuating business scenarios, but also improve the practicality and security prevention capabilities of the system in a complex Internet ecosystem. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative labor. Among them: Figure 1 Schematic diagram of the process of the Internet risk control optimization method based on multidimensional data analysis shown in the present invention. DETAILED DESCRIPTION

[0019] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings. It is obvious that the described embodiments are only part of the embodiments of the present invention, but not all of the embodiments.

[0020] Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without making any creative work should fall within the scope of protection of the present invention.

[0021] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0022] According to an embodiment of the present invention, Figure 1 The flowchart shown is an Internet risk control optimization method based on multi-dimensional data analysis, which specifically includes the following steps: S1. Collect Internet user behavior data, transaction data, device information and environment data in real time, perform data preprocessing on them, and generate a sample data set. It should be noted that this step collects multi-source data from the Internet environment in real time, including: User behavior data: user login frequency, page dwell time, click behavior sequence, operation trajectory heat map; Transaction data: transaction amount, payment method, transaction timestamp, associated account information, number of failed transactions; Device information: device model, operating system version, IP address, GPS location data, device unique identifier; Environmental data: network type, real-time geographic location risk score, third-party blacklist association data, current network latency status; The above-mentioned raw data are marked according to time sequence and data source to form the original data set, in which each record contains at least a unique index value and a corresponding timestamp to ensure accurate positioning and association during subsequent processing and feature alignment.

[0023] Furthermore, the missing or incomplete data in the original data set are interpolated using a filling method based on the K-nearest neighbor algorithm. For each record with missing values, the distance between the known feature vector contained in the record and other complete records is first calculated, and the corresponding feature means of the top k most similar records are selected for interpolation.

[0024] In an optional embodiment, Z-score standardization combined with interquartile range (IQR) method is used to identify and remove outliers in the data, including: Calculate the Z-score value for each record ,like If the preset threshold is exceeded, it can be initially regarded as an extreme abnormality; The remaining records were further tested using the interquartile range (IQR) method: in, and The 25th and 75th percentiles respectively. If a feature value of a record exceeds range, it is marked as an exception; in, It is an adjustable parameter that is set according to business risk preference or model robustness requirements; Records marked as abnormal can be directly eliminated or eliminated after manual review, thereby ensuring that the retained data is within a reasonable fluctuation range.

[0025] In an optional implementation, a Min-Max normalization method is used to map data of different dimensions to the interval [0,1] to ensure that the values ​​of each feature dimension are comparable in the subsequent model training process; It should be noted that if the user behavior log or environmental data contains text descriptions, notes, or tag fields, the Word2Vec model is used for semantic vectorization encoding; Assume that the text field contains a set of words , then after the Word2Vec model training is completed, each word can be represented as a d-dimensional vector , where d is the word vector dimension; For each text record, all its word vectors can be weighted or averaged on the same dimension to obtain the vector representation of the entire text: After concatenating the vector representation to the numerical feature vector, it serves as a unified input format for subsequent model training and analysis.

[0026] After missing value filling, outlier removal, dimension unification, and text vectorization encoding, all feature dimension information is finally integrated to form the following unified structure for each record: in, is a unique identifier, t is a timestamp, is the normalized numerical feature vector, is the text class feature vector, Risk markers; It should be noted that the sample data set obtained through the above preprocessing operations can be expressed as a multidimensional feature matrix or saved in the database in the form of a structured table, and when necessary, combined with distributed storage and indexing mechanisms (such as HBase, ElasticSearch) for efficient retrieval and real-time analysis for use in subsequent analysis steps.

[0027] S2. Extract key risk control features from the sample data set based on the feature importance analysis strategy to generate a feature subset. In this step, it should be noted that: The sample data set generated in step S1 is used as the feature set ; Among them, M represents the total number of features contained in the sample data set; Determine the risk label or target variable, denoted as Y, where Y represents the risk level label of the user's current behavior or transaction, and the binary classification label of whether a risk event has occurred, which is used to evaluate the impact and contribution of each feature to the label in the subsequent process; Furthermore, a random forest model is constructed, including: Let the sample data set be ,in, represents the feature vector of the sample, is the risk label or category corresponding to the sample; It should be noted that the random forest model consists of several decision trees, and each decision tree randomly samples features and samples during training to reduce overfitting and improve generalization ability; Furthermore, the Gini impurity reduction value of each feature is calculated: When splitting a decision tree node, for each feature Calculate the change in Gini impurity before and after the feature split; The decrease in Gini impurity when splitting nodes in all decision trees in the random forest is accumulated or averaged to obtain the feature Importance metrics in a random forest ensemble : Where T is the total number of decision trees in the random forest, Representation characteristics Gini value drop contribution in the t-th tree; in accordance with Sort all features in descending order to get a list of feature importance: in, The feature with the highest Gini importance is represented by The features that represent the lowest Gini importance; For example, let a feature be , the risk label is Y, and its mutual information can be expressed as: in, and Represents characteristics and the value space of label Y, represents the corresponding probability distribution, Represents the mutual information value and measures the characteristics The correlation between the risk indicator Y and is the jth feature; like It is a continuous feature, and its probability distribution is approximated by binning or kernel density estimation. If it is a discrete feature or a text-derived feature, the joint probability is calculated directly based on the frequency of occurrence; Calculate the relationship between all features and risk labels , and obtain a set of mutual information values .

[0028] As an example, define a mutual information threshold , all features with mutual information values ​​greater than or equal to The features of are judged to be significantly related to the risk label, and the feature set that meets the conditions is recorded as: Under the premise of satisfying the optimal loss function conditions, some feature regression coefficients will be compressed to zero; make Represents the regression coefficient of the jth feature after the training is completed. If Below the set value (If it is very close to 0), it is considered that the feature has a very low contribution to the model output and can be eliminated; Get Satisfied The feature set of: The final feature priority list is obtained by comprehensively considering the random forest Gini importance ranking, mutual information screening results, and Lasso sparsification set; For any feature , if it ranks high in the Gini importance ranking and satisfies the mutual information method , and Lasso regression obtains No less than , it can be selected as an important feature first.

[0029] Through K-fold cross-validation, the model performance indicators under different feature number N values ​​are evaluated; Select the number of features N that makes the average performance of the validation set optimal, and construct the final key feature subset, which is recorded as: in, The subscript brackets represent the priority after the above multiple evaluation methods; The final selected N key features are stored in the form of ordered sets or vectors to form: Among them, each Corresponding to a preprocessed and filtered feature component; As an example, the key features included in the feature subset include at least page dwell time, click sequence statistics, transaction amount, number of transaction failures, timestamp features, GPS location offset, IP address location features, and highly correlated dimensional features of text semantic vectors.

[0030] S3. Use the improved sparrow search algorithm to optimize the parameters of the integrated gradient boosting tree and deep learning network, and obtain the risk control model after optimization. Among them, the following points need to be explained in this step: The feature subsets selected in step S2 are input into the gradient boosting tree (GBDT) and the bidirectional LSTM network respectively; make represents the hyperparameters to be optimized for GBDT, Represents the hyperparameters to be optimized for the bidirectional LSTM network; Create a unified parameter vector , as the position representation of each individual sparrow in the search space, to be globally optimized in the multi-dimensional space through the improved sparrow search algorithm; Subset features to numerical features (Structured data such as transaction amount, number of failures, geographic location score, etc.) is input into the GBDT model, and the output of the initial risk probability is recorded as ; The time series behavior data in the feature subset (such as time-series user click logs, login intervals, device status changes, etc.) are input into the bidirectional LSTM network, and the output time series risk probability is recorded as ; The above probability results will be integrated through the subsequent weighted fusion layer, and the goal of parameter optimization is set to maximize the prediction performance index of the validation set; Furthermore, the maximum number of iterations is set to , the current number of iterations is recorded as t, and the preset initial maximum value of the inertia weight is recorded as , the preset minimum inertia weight is recorded as ; Dynamic Inertia Weight It is used to control a larger global search at the beginning of the iteration and gradually converge to a local fine search at the end of the iteration. The example is as follows: in, , It gradually decreases as t increases. When t approaches T, Approach , which is conducive to strengthening the local optimization in the later stage; Specifically, the population is divided into two parts: exploration subgroup and development subgroup, and global search and local search are performed respectively, where: Explore subgroups, using a larger search step size to search for potential optimal solutions in a wide space in each iteration; Develop subgroups to reduce the search range based on dynamic inertia weights and conduct more detailed neighborhood searches on discovered high fitness areas; Through regular information exchange, the exploration subgroup can provide a global perspective, and the development subgroup can quickly improve the accuracy of the solution in the local area, thus effectively avoiding falling into the local optimum; For individuals whose fitness (such as AUC index) has not been significantly improved within several rounds of iterations, Gaussian mutation is triggered; Define the position of the individual in the parameter vector space as , its adaptive variation can be expressed as: in, To follow the normal distribution The random increment of It is associated with the number of iterations or the magnitude of improvement from the last round of evolution; The above operations break the local convergence state and ensure that the algorithm continues to explore globally in a more complex hyperparameter space; Generate a number of initial individuals in a set search range by random or stratified sampling , where S is the population size; Each Both include the main hyperparameters of GBDT and the main hyperparameters of bidirectional LSTM networks; For any individual , first apply the corresponding parameter configuration to the GBDT model and the bidirectional LSTM model; Use the training set to train GBDT and bidirectional LSTM separately to get the output probability and ; Combine the two outputs through a weighted fusion layer: in, is the risk probability or estimated score output by the gradient boosting tree, is the time series risk probability or prediction score output by the bidirectional LSTM network, is the weighting coefficient, Represents the weighted fusion result of the two model outputs, which is used to calculate the fitness or final risk score; Based on dynamic inertia weight, multi-group collaboration and adaptive mutation strategy, all individuals are updated in parameter space; After each iteration, the fitness of the individual is recalculated and the current optimal individual is selected. ; When the number of iterations reaches Or when the convergence condition is met (such as the fitness has not been significantly improved for multiple consecutive rounds), the search process is terminated; The best individual As the final hyperparameter selection for GBDT and bidirectional LSTM; Let the trained GBDT and bidirectional LSTM integration model be recorded as , that is, the optimized risk control model.

[0031] Exemplarily, the risk control model structure includes: GBDT sub-model: receives numerical features in the feature subset and contains several CART weak learners; Bidirectional LSTM sub-model: receives time series data suitable for sequence processing in the feature subset, contains forward and backward LSTM layers, and can model complex sequence dynamics through hidden layers or attention mechanisms; Weighted fusion layer: GBDT output probability Output probability with bidirectional LSTM According to the optimal fusion weight Perform weighted or other forms of combination to output the final risk probability ; As an example, the risk control model is , represents the risk identification model composed of GBDT and bidirectional LSTM under optimal parameters; Feed a subset of input features into the model , a risk probability value is obtained, and then in step S4, the final risk control decision is output in combination with the dynamic threshold strategy.

[0032] S4: Input the feature subset into the risk control model for analysis, output the risk score, and generate a risk control decision in combination with the dynamic threshold adjustment strategy. Obtain the risk control model optimized in step S3, where each key feature corresponds to a weight coefficient; make Represents the weight coefficient of the i-th feature in the risk control model, is the feature vector contained in the feature subset obtained after preprocessing and feature screening, with a total of n features; The initial weighted sum of risk scores is defined as: in, Indicates the risk score of the user's current behavior or transaction. The initial value is a linear weighted sum. is the weight coefficient of the i-th feature in the risk control model, reflecting the contribution of this feature to risk determination. is the value of the i-th feature after standardized processing; The weighted summation result is mapped to the [0,1] interval through the Sigmoid function to obtain the final risk score : Among them, when When the value of is close to 0, it means no risk or low risk; When the value of approaches 1, it indicates extremely high risk.

[0033] Furthermore, the window size is set to M, which means that statistics are collected on the most recent M transactions (or user behaviors); For the risk score value within the window , calculate its mean With standard deviation , where t is the current time or the current window index; Define adjustment factors , set according to business risk preferences; At the current time t, the dynamic threshold The expression is as follows: When the overall risk environment is safe, and Smaller, will decrease accordingly; when the recent risk score fluctuates greatly, Increased Increased to more sensitively intercept potential risks.

[0034] Exemplarily, the risk score calculated for the current transaction or user behavior is compared with the dynamic threshold: like , indicating high risk, immediately triggering high-risk decisions, including intercepting current transactions, sending SMS verification to users, freezing account operation permissions, etc., to minimize possible fraud or losses, and recording the event in the high-risk log for subsequent analysis and tracking; like , it is temporarily regarded as medium-low risk and needs to be further determined in combination with the grading strategy; among which: when However, if the risk score is still higher than a certain secondary threshold (which can be set by the operation strategy), a medium-risk decision will be triggered, including limiting the transaction amount or number of transactions and requiring the user to undergo additional authentication (ID card information, face recognition, etc.). If the risk score is still high after re-verification, it can be converted to a high-risk decision; if the risk is reduced, it can be converted to a low-risk decision. when If there are no other warning factors, a low-risk decision will be triggered, including allowing the transaction to go through normally, and the system will only make routine log records. At the same time, the user's credit score or trust level will be updated based on the user's current and historical performance.

[0035] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. An Internet risk control optimization method based on multidimensional data analysis, characterized in that: include: Collect Internet user behavior data, transaction data, device information and environmental data in real time, perform data preprocessing on them, and generate sample data sets; Extracting key risk control features from the sample data set based on a feature importance analysis strategy to generate a feature subset; The improved sparrow search algorithm is used to optimize the parameters of the integrated gradient boosting tree and deep learning network, and the risk control model is obtained after optimization; The feature subset is input into the risk control model for analysis, a risk score is output, and a risk control decision is generated in combination with a dynamic threshold adjustment strategy.

2. The Internet risk control optimization method based on multidimensional data analysis according to claim 1 is characterized in that: The user behavior data includes user login frequency, page dwell time, click behavior sequence and operation trajectory heat map; The transaction data includes transaction amount, payment method, transaction timestamp, associated account information and number of failed transactions; The device information includes device model, operating system version, IP address, GPS location data and device unique identifier; The environmental data includes network type, real-time geographic location risk score, third-party blacklist association data and current network delay status.

3. The Internet risk control optimization method based on multidimensional data analysis according to claim 1 is characterized in that: The data preprocessing comprises: The missing data are interpolated using the missing value filling method based on the K nearest neighbor algorithm; Outliers were identified through Z-score standardization combined with the interquartile range method, and abnormal data were eliminated; The Min-Max normalization method is used to unify data of different dimensions into the interval [0,1]; The Word2Vec model is used to vectorize and encode text data to generate semantic vector representations.

4. The Internet risk control optimization method based on multidimensional data analysis according to claim 1 is characterized in that: The feature importance analysis strategy includes: Calculate the Gini impurity reduction value of each feature based on the random forest algorithm and sort them by importance; The correlation between features and risk labels is calculated using the mutual information method, and features with correlations higher than a preset threshold are screened; Combine the Lasso regression model to perform sparse processing on the features and remove redundant features whose weight coefficients are lower than the set value; The above results are combined to generate a feature subset containing the top N key features, where N is determined by cross-validation.

5. The Internet risk control optimization method based on multidimensional data analysis according to claim 1 is characterized in that: The improved sparrow search algorithm comprises: The dynamic inertia weight is introduced to adjust the search step length of the individual sparrow according to the number of iterations. The formula is: ； Where t is the current iteration number, is the preset maximum number of iterations, Indicates the dynamic inertia weight value at the tth iteration, which is used to adjust the search step length of the sparrow individual. Indicates the preset initial maximum value of the inertia weight, which is used to control the global search capability at the initial stage of iteration. Indicates the preset minimum inertia weight, which is used to limit the local fine search range in the later stage of iteration; Add a multi-group collaboration mechanism to divide the sparrow population into exploration subgroups and development subgroups to perform global search and local fine search respectively; An adaptive mutation strategy is adopted to perform Gaussian mutation on individuals that have not been optimized for multiple consecutive generations to avoid falling into local optimality.

6. The Internet risk control optimization method based on multidimensional data analysis according to claim 1 or 5, characterized in that: The improved sparrow search algorithm is used to optimize the parameters of the integrated gradient boosting tree and the deep learning network, including: The gradient boosting tree is used to process structured data, the input is a numerical feature in a feature subset, and the output is a preliminary risk probability; The deep learning network adopts a bidirectional LSTM structure, the input is the time series behavior data in the feature subset, and the output is the time series risk probability; The output results of the gradient boosting tree and the deep learning network are integrated through a weighted fusion layer, and the weight is dynamically assigned by the validation set AUC indicator.

7. The Internet risk control optimization method based on multidimensional data analysis according to claim 1 is characterized in that: The risk score is output by performing a weighted summation based on the weight coefficients of each feature in the risk control model. The formula is: ； in, Indicates the risk score of the user's current behavior or transaction. The initial value is a linear weighted sum. is the weight coefficient of the i-th feature in the risk control model, reflecting the contribution of this feature to risk determination. is the value of the i-th feature after normalization, n is the total number of features contained in the feature subset, and i is the feature index; The summation result is mapped to the interval [0,1] through the Sigmoid function as the final risk score; When the value approaches 0, it means there is no risk; When the value approaches 1, it indicates extremely high risk.

8. The Internet risk control optimization method based on multidimensional data analysis according to claim 1 is characterized in that: The dynamic threshold adjustment strategy includes: The mean and standard deviation of historical risk scores are calculated based on a sliding window, with the window size being the most recent M transaction data. Define adjustment factors based on business risk appetite; Calculate the dynamic threshold based on the distribution of risk scores in the current window; When the real-time risk score exceeds the dynamic threshold, a high-risk decision is triggered; When the real-time risk score is lower than the dynamic threshold, a secondary verification is performed in combination with the user's historical credit rating.

9. The Internet risk control optimization method based on multidimensional data analysis according to claim 8 is characterized in that: The risk control decisions include high-risk decisions, medium-risk decisions and low-risk decisions, among which: The high-risk decision includes intercepting the current transaction, sending SMS verification and freezing the account operation authority; The medium-risk decision includes limiting the transaction amount and requiring additional identity verification information; The low-risk decision includes allowing the transaction to go through, recording a log, and updating the user's credit score.

Images