Method and device for preventing behaviors of electronic cattle and medium

Abstract

The invention provides a method and device for preventing behaviors of an electronic cattle and a medium. The method comprises the steps of performing normalization processing on payment data; feature engineering construction is carried out on the payment data after normalization processing; on the basis of feature engineering, carrying out deep mining on the payment data after normalization processing to obtain a payment sequence of a new dimension; performing clustering analysis on the user dimension feature system, the channel dimension feature system and the payment sequence, and training a payment trajectory model according to a clustering analysis result; and using the trained payment trajectory model to predict payment data to be identified. According to the method, the device and the medium, the problems that the real-time performance and the accuracy are difficult to consider in the existing method for preventing the behaviors of the electronic cattle, particularly, the performance bottleneck is easily caused under the high concurrency condition, the risk points are difficult to cover comprehensively, and the user privacy risk is possibly increased and the normal user experience is influenced by implementing strict permission verification can be solved.

Description

Technical Field

[0001] The present invention relates to the field of network technology, and in particular to a method, device and medium for preventing electronic scalping. Background Art

[0002] Electronic scalpers are people who use electronic technology to register for others, grab numbers and then transfer them. With the serious imbalance between supply and demand, especially in the fields of ticketing, medical appointments, and limited-edition product sales, the huge gap between scarce resources and strong demand has provided a breeding ground for electronic scalping activities. In the digital age, this problem has been further magnified, and the convenience and anonymity of Internet technology have provided scalpers with a more covert operating space. Electronic scalpers disrupt the market order in their covert way, using advanced technology and automation tools such as scripts and robots through illegal means to quickly snap up illegally hoarded scarce resources and resell them at a price far higher than the original price, forcing consumers to bear additional financial burdens. This is especially obvious in the fields of ticketing, medical appointments, and e-commerce rush purchases, which seriously infringes on the interests of consumers and makes it difficult for consumers who really need services or products to obtain them.

[0003] The existing medical platforms’ preventive measures against electronic scalpers are mainly through permission verification of access information or real-name system and dynamic verification. The real-name system is strictly enforced in the registration process, requiring the identity of the registrant to be consistent with the patient, and dynamic verification is performed using technologies such as face recognition and ID card online verification. Technical means are used to limit behaviors such as multiple numbers for one person and batch registration. However, these methods have problems such as difficulty in balancing real-time and accuracy, especially in high-concurrency situations, which can easily lead to performance bottlenecks and difficulty in fully covering risk points. In addition, strict permission verification may increase user privacy risks and affect normal user experience. Summary of the invention

[0004] The technical problem to be solved by the present invention is to provide a method, device and medium for preventing electronic scalping behavior in view of the above-mentioned deficiencies in the prior art, so as to solve the problems that the existing methods for preventing electronic scalping behavior have the difficulty in balancing real-time and accuracy, especially in high concurrency situations, which easily lead to performance bottlenecks, and are difficult to fully cover risk points, and the implementation of strict permission verification may increase user privacy risks and affect the normal user experience.

[0005] In a first aspect, the present invention provides a method for preventing electronic scalping behavior, the method comprising:

[0006] Normalize payment data;

[0007] Perform feature engineering on the normalized payment data, establish feature systems from the user and channel aspects, and obtain user dimension feature systems and channel dimension feature systems;

[0008] Based on feature engineering, the normalized payment data is deeply mined to obtain payment sequences of new dimensions;

[0009] Performing cluster analysis on the user dimension feature system, the channel dimension feature system and the payment sequence, and training a payment trajectory model based on the results of the cluster analysis;

[0010] Use the trained payment trajectory model to predict the payment data to be identified and determine whether the corresponding target user is an e-scalper;

[0011] In response to the target user being an e-scalper, corresponding risk control measures are executed according to a preset risk control strategy.

[0012] Further, the payment data includes the user's historical payment data, the payment data being generated by the user, and the payment data that the user plans to generate;

[0013] The payment sequence includes a payment user behavior sequence, a payment time interval sequence, a payment amount change sequence, a payment specific object sequence, a payment channel conversion sequence and a payment channel frequency sequence.

[0014] Further, the method of using the trained payment trajectory model to predict the payment data to be identified and determining whether the corresponding target user is an e-scalper specifically includes:

[0015] Using the trained payment trajectory model to perform a first check on the payment data to be identified, so as to determine whether the payment behavior corresponding to the payment data to be identified exceeds a corresponding threshold;

[0016] In response to the payment behavior corresponding to the payment data to be identified exceeding the corresponding threshold, performing a second check on the payment account corresponding to the payment data to be identified to determine whether the payment account corresponding to the payment data to be identified is within a preset scalper database;

[0017] In response to the payment account being in a preset scalper database, it is determined that the target user is an electronic scalper.

[0018] Furthermore, the first check of the payment data to be identified using the trained payment trajectory model to determine whether the payment behavior corresponding to the payment data to be identified exceeds a corresponding threshold value specifically includes:

[0019] Obtaining a payment user behavior sequence, a payment time interval sequence, a payment amount change sequence, a payment specific object sequence, a payment channel conversion sequence, and a payment channel frequency sequence corresponding to the payment data to be identified;

[0020] Using the trained payment trajectory model, judging whether the corresponding payment behavior exceeds the corresponding transaction threshold according to the payment user behavior sequence, payment time interval sequence, payment amount change sequence, payment specific object sequence, payment channel conversion sequence and payment channel frequency sequence corresponding to the payment data to be identified, wherein each payment sequence corresponds to a transaction threshold;

[0021] If the payment behavior corresponding to any payment sequence exceeds the corresponding transaction threshold, it is determined that the payment behavior corresponding to the payment data to be identified exceeds the corresponding threshold.

[0022] Furthermore, before performing a second check on the payment account corresponding to the payment data to be identified to determine whether the payment account corresponding to the payment data to be identified is within a preset scalper database, the method further includes:

[0023] Collect information about electronic scalpers;

[0024] The scalper database is constructed based on the collected relevant information.

[0025] Furthermore, the second verification of the payment account corresponding to the payment data to be identified to determine whether the payment account corresponding to the payment data to be identified is within a preset scalper database specifically includes:

[0026] Check whether the account ID corresponding to the payment data to be identified is in the scalper database;

[0027] In response to the account ID being in the scalper database, matching the Internet Protocol IP address, and / or device fingerprint, and / or transaction frequency corresponding to the account ID with the IP address, and / or device fingerprint, and / or transaction frequency corresponding to the account ID in the scalper database to obtain a matching result;

[0028] It is comprehensively determined based on the matching result whether the payment account corresponding to the payment data to be identified is within the preset scalper database.

[0029] Furthermore, the risk control measures include at least one of the following: delaying the return time of account operations, placing the account in a manual review list, limiting transaction frequency, and requiring additional verification.

[0030] In a second aspect, the present invention provides a device for preventing electronic scalping behavior, the device comprising:

[0031] A normalization processing module, used for normalizing payment data;

[0032] A feature engineering module, connected to the normalization processing module, is used to perform feature engineering on the payment data after normalization processing, establish feature systems from two aspects, namely, user and channel, to obtain a user dimension feature system and a channel dimension feature system;

[0033] A payment sequence mining module, connected to the feature engineering module, is used to perform in-depth mining on the normalized payment data based on feature engineering to obtain a payment sequence of a new dimension;

[0034] A model training module, connected to the payment sequence mining module, is used to perform cluster analysis on the user dimension feature system, the channel dimension feature system and the payment sequence, and train a payment trajectory model based on the results of the cluster analysis;

[0035] A payment data prediction module, connected to the model training module, is used to use the trained payment trajectory model to predict the payment data to be identified and determine whether the corresponding target user is an e-scalper;

[0036] The risk control measure execution module is connected to the payment data prediction module and is used to execute corresponding risk control measures according to a preset risk control strategy in response to the target user being an e-scalper.

[0037] In a third aspect, the present invention provides an apparatus for preventing electronic scalping, comprising a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to implement the method for preventing electronic scalping described in the first aspect.

[0038] In a fourth aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the method for preventing electronic scalping behavior described in the first aspect above is implemented.

[0039] The present invention provides a method, device and medium for preventing electronic scalping behavior. First, the payment data is normalized; and feature engineering is performed on the normalized payment data, and feature systems are established from the two aspects of users and channels, respectively, to obtain a user dimension feature system and a channel dimension feature system; then, based on feature engineering, the normalized payment data is deeply mined to obtain a payment sequence of a new dimension; and cluster analysis is performed on the user dimension feature system, the channel dimension feature system and the payment sequence, and a payment trajectory model is trained according to the results of the cluster analysis; the trained payment trajectory model is then used to predict the payment data to be identified, and it is determined whether the corresponding target user is an electronic scalper; finally, in response to the target user being an electronic scalper, corresponding risk control measures are executed according to a preset risk control strategy. The present invention performs in-depth mining of payment behavior and payment trajectory based on payment data, and fully extracts and analyzes the multi-dimensional characteristics of users and channels through normalization and feature engineering, significantly enhancing the model's real-time processing capability and accuracy of payment data. On this basis, by deeply mining payment data, the potential laws and patterns behind payment behaviors are revealed, further enriching the model's predictive ability. The application of cluster analysis enables the model to classify users according to the similarity of payment trajectories, thereby more accurately identifying electronic scalpers, and there is no need to implement overly strict permission checks throughout the process, thereby effectively combating electronic scalping while reducing user privacy risks and ensuring a good experience for normal users. The existing methods for preventing electronic scalping behaviors have been solved, which are difficult to balance between real-time and accuracy, especially in high-concurrency situations, which can easily lead to performance bottlenecks and difficulty in fully covering risk points, and the implementation of strict permission checks may increase user privacy risks and affect normal user experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 This is a flow chart of a method for preventing electronic scalping behavior according to Embodiment 1 of the present invention;

[0041] Figure 2 A flowchart of another method for preventing electronic scalping behavior according to an embodiment of the present invention;

[0042] Figure 3 A flowchart of another method for preventing electronic scalping behavior according to an embodiment of the present invention;

[0043] Figure 4 A schematic diagram of a process of double checking electronic scalpers using cluster analysis according to an embodiment of the present invention;

[0044] Figure 5 This is a schematic diagram of the structure of a device for preventing electronic scalping behavior according to Embodiment 2 of the present invention;

[0045] Figure 6 This is a schematic diagram of the structure of a device for preventing electronic scalping behavior according to Example 3 of the present invention. DETAILED DESCRIPTION

[0046] In order to enable those skilled in the art to better understand the technical solution of the present invention, the embodiments of the present invention will be further described in detail below with reference to the accompanying drawings.

[0047] It should be understood that the specific embodiments and drawings described herein are only used to explain the present invention rather than to limit the present invention.

[0048] It can be understood that, in the absence of conflict, the various embodiments of the present invention and the various features in the embodiments can be combined with each other.

[0049] It can be understood that, for the convenience of description, the drawings of the present invention only show the parts related to the present invention, while the parts irrelevant to the present invention are not shown in the drawings.

[0050] It can be understood that each unit and module involved in the embodiments of the present invention may correspond to only one physical structure, or may be composed of multiple physical structures, or multiple units and modules may be integrated into one physical structure.

[0051] It can be understood that the terms "first", "second", etc. in the embodiments of the present invention are used to distinguish different objects, or to distinguish different processing of the same object, rather than to describe a specific order of objects.

[0052] It can be understood that, without conflict, the functions and steps marked in the flowcharts and block diagrams of the present invention may occur in an order different from that marked in the drawings.

[0053] It is understood that the flowcharts and block diagrams of the present invention illustrate the possible architectures, functions, and operations of the systems, devices, equipment, and methods according to the various embodiments of the present invention. Each box in the flowchart or block diagram may represent a unit, module, program segment, or code, which contains executable instructions for implementing the specified functions. Moreover, each box or combination of boxes in the block diagram and flowchart may be implemented by a hardware-based system that implements the specified functions, or may be implemented by a combination of hardware and computer instructions.

[0054] It can be understood that the units and modules involved in the embodiments of the present invention can be implemented by software or hardware. For example, the units and modules can be located in a processor.

[0055] Application Overview

[0056] Existing methods for preventing electronic scalping have the following disadvantages:

[0057] 1) Real-time and accuracy challenges: Permission verification needs to be performed in a real-time environment at the millisecond level. Especially during peak registration periods, the platform needs to withstand huge concurrent traffic, which is prone to performance bottlenecks. In addition, it is necessary to ensure high throughput while ensuring accurate verification.

[0058] 2) It is difficult to fully cover risk points: E-scalpers may use various methods to bypass permission verification, such as registering fake accounts in batches, borrowing or stealing other people's identity information, and exploiting system loopholes. Permission verification cannot eliminate all potential risks at once.

[0059] 3) User experience and privacy issues: In order to implement strict permission verification, the platform may need to collect more user information, which may increase the risk of user privacy exposure and may also affect the user experience of normal users due to the cumbersome identity authentication process.

[0060] In response to the above technical problems, the concept of this application is to provide a method, device and medium for preventing electronic scalping behavior, deeply mine the payment behavior and payment trajectory based on payment data, and fully extract and analyze the multi-dimensional characteristics of users and channels through normalization processing and feature engineering construction, which significantly enhances the model's real-time processing ability and accuracy of payment data. On this basis, through deep mining of payment data, the potential laws and patterns behind payment behavior are revealed, further enriching the model's predictive ability. The application of cluster analysis enables the model to classify users according to the similarity of payment trajectories, thereby more accurately identifying electronic scalpers, and there is no need to implement overly strict permission checks throughout the process, thereby effectively combating electronic scalping behavior while reducing user privacy risks and ensuring a good experience for normal users.

[0061] After introducing the basic principles of the present application, various non-limiting embodiments of the present application will be described in detail with reference to the accompanying drawings.

[0062] Embodiment 1:

[0063] This embodiment provides a method for preventing electronic scalping behavior, such as Figure 1 As shown, the method includes:

[0064] Step S101: normalize the payment data.

[0065] In this embodiment, in order to ensure that data of different magnitudes can be compared and analyzed on the same scale, the payment data is first normalized. The normalization process includes standardized time format, standardized payment amount format, data discretization, integration and conversion, etc. Before the normalization process, the payment data can be cleaned, including removing invalid or erroneous records, missing values ​​and outliers, and duplicate data processing.

[0066] In this embodiment, the payment data includes the user's historical payment data, the payment data being generated by the user, and the payment data that the user plans to generate; among them, the user's historical payment data refers to the data record of all successful payments of the user in the past period of time; the payment data being generated by the user refers to the data generated during the user's current transaction process; the payment data that the user plans to generate refers to the data of payment behaviors that the user may perform in the future. This type of data is often based on the user's intentions and plans and has a certain predictive nature.

[0067] Step S102: Perform feature engineering on the normalized payment data, establish feature systems from two aspects, namely, user and channel, to obtain a user dimension feature system and a channel dimension feature system.

[0068] In this embodiment, the user dimension feature system captures similar feature groups through basic information features and user activity features; and captures abnormal time and amount data through payment behavior features and risk credit features. The channel dimension feature system captures feature objects through channel basic payment information; captures the conversion characteristics of payment data through channel preference habits; and captures the frequency characteristics of payment data through payment success rate and speed.

[0069] Among them, the characteristics of the user dimension feature system include: basic information (age, gender, geographic location, etc.), transaction behavior (transaction frequency, average transaction amount, transaction time distribution, transaction type preference), payment method preference (commonly used payment tools, payment terminals), credit status (credit score, past default records), social network information (social media activity, followed brands or merchants), risk factors (abnormal transaction patterns, signs of suspected fraudulent behavior), etc.

[0070] Among them, the characteristics of the channel dimension feature system include: channel attributes (channel type (online / offline, mobile application / website)), channel name (WeChat Pay, Alipay, bank online banking, etc.)), usage (transaction volume of each channel, peak hours of channel use, conversion rate between different channels), security and stability (transaction success rate, fault frequency and recovery time), cost-effectiveness (operating costs of each channel, benefits brought by the channel), etc. The channel feature system uses the unique identifier of each channel as the primary key, and payment methods such as WeChat and Alipay have universal unique identifiers.

[0071] Step S103: Based on feature engineering, the normalized payment data is deeply mined to obtain a payment sequence of a new dimension.

[0072] In this embodiment, the payment sequence includes a payment user behavior sequence, a payment time interval sequence, a payment amount change sequence, a payment specific object sequence, a payment channel conversion sequence, and a payment channel frequency sequence. In the mining process, the payment user behavior sequence can be discovered by the GSP (Generalized Sequential Pattern Mining) algorithm; the payment time interval sequence and the payment amount change sequence can be discovered by ARIMA (Autoregressive Integrated Moving Average Model); the payment specific object sequence can be discovered by hierarchical clustering and K-means (k-means clustering algorithm); the payment channel conversion sequence and the payment channel frequency sequence can be discovered by the state space model and HMM (Hidden Markov Model).

[0073] Among them, the payment user behavior sequence: includes a series of users' payment operation records; the payment time interval sequence: records the time difference between two adjacent payments; the payment amount change sequence: records the amount of each payment and forms a sequence that changes over time; the payment specific object sequence: records which specific objects or merchants the user pays to; the payment channel conversion sequence: describes the user's switching between different payment channels; the payment channel frequency sequence: counts the frequency of each payment channel being used.

[0074] Step S104: performing cluster analysis on the user dimension feature system, the channel dimension feature system and the payment sequence, and training a payment trajectory model based on the results of the cluster analysis.

[0075] In this embodiment, the clustering algorithm used in cluster analysis is preferably DBscan (Density-Based Spatial Clustering of Applications with Noise), which can cluster data sets of any shape. Through cluster analysis, users or transaction records with similar payment behavior patterns are divided into the same cluster. According to the results of cluster analysis, the payment trajectory model is trained, and the model can identify abnormal transaction clusters, that is, payment record trajectories that deviate from normal behavior patterns.

[0076] Step S105: Use the trained payment trajectory model to predict the payment data to be identified and determine whether the corresponding target user is an e-scalper.

[0077] In this embodiment, the payment data to be identified is newly generated payment data. By using the trained payment trajectory model to predict the payment data to be identified, it can be determined whether the corresponding target user is an electronic scalper (hereinafter referred to as scalper).

[0078] Optionally, using the trained payment trajectory model to predict the payment data to be identified to determine whether the corresponding target user is an e-scalper specifically includes:

[0079] Using the trained payment trajectory model to perform a first check on the payment data to be identified, so as to determine whether the payment behavior corresponding to the payment data to be identified exceeds a corresponding threshold;

[0080] In response to the payment behavior corresponding to the payment data to be identified exceeding the corresponding threshold, performing a second check on the payment account corresponding to the payment data to be identified to determine whether the payment account corresponding to the payment data to be identified is within a preset scalper database;

[0081] In response to the payment account being in a preset scalper database, it is determined that the target user is an electronic scalper.

[0082] In this embodiment, in order to improve the efficiency and accuracy of preventing scalpers, the trained payment trajectory model adopts a double verification method to predict the user's payment behavior.

[0083] Optionally, the first check of the payment data to be identified using the trained payment trajectory model to determine whether the payment behavior corresponding to the payment data to be identified exceeds a corresponding threshold value specifically includes:

[0084] Obtaining a payment user behavior sequence, a payment time interval sequence, a payment amount change sequence, a payment specific object sequence, a payment channel conversion sequence, and a payment channel frequency sequence corresponding to the payment data to be identified;

[0085] Using the trained payment trajectory model, judging whether the corresponding payment behavior exceeds the corresponding transaction threshold according to the payment user behavior sequence, payment time interval sequence, payment amount change sequence, payment specific object sequence, payment channel conversion sequence and payment channel frequency sequence corresponding to the payment data to be identified, wherein each payment sequence corresponds to a transaction threshold;

[0086] If the payment behavior corresponding to any payment sequence exceeds the corresponding transaction threshold, it is determined that the payment behavior corresponding to the payment data to be identified exceeds the corresponding threshold.

[0087] In this embodiment, each payment sequence corresponds to a transaction threshold, and a reasonable transaction threshold can be set for each payment sequence according to business needs and risk control strategies. For example, a user is allowed to make a maximum of N transactions within a certain time range (such as one day, one week, or one month); whether the IP (Internet Protocol) address of the user's payment behavior is different within a set time; the same user frequently changes channels for multiple transactions, etc.

[0088] In this embodiment, each payment sequence corresponds to a corresponding payment behavior, for example, the payment user behavior sequence corresponds to the number of user payment behavior transactions, the payment time interval sequence corresponds to the user payment time interval, etc. The verification of the payment trajectory model based on the transaction threshold includes but is not limited to: verifying the number of user payment behavior transactions, verifying the IP address of the user payment behavior, verifying the user payment time interval, verifying the change of the user payment amount, verifying the user payment channel conversion, verifying the user payment channel frequency, etc. If the payment behavior corresponding to any payment sequence exceeds the corresponding transaction threshold, it is judged that the payment behavior corresponding to the payment data to be identified exceeds the corresponding threshold.

[0089] Optionally, before performing a second check on the payment account corresponding to the payment data to be identified to determine whether the payment account corresponding to the payment data to be identified is within a preset scalper database, the method further includes:

[0090] Collect information about electronic scalpers;

[0091] The scalper database is constructed based on the collected relevant information.

[0092] In this embodiment, suspected or confirmed scalper accounts are identified based on historical data analysis, reporting information, and technical means, and listed in the scalper database. The scalper database may contain key data such as user account IDs, registration information, and transaction records.

[0093] Optionally, the performing a second check on the payment account corresponding to the payment data to be identified to determine whether the payment account corresponding to the payment data to be identified is within a preset scalper database specifically includes:

[0094] Check whether the account ID corresponding to the payment data to be identified is in the scalper database;

[0095] In response to the account ID being in the scalper database, matching the Internet Protocol IP address, and / or device fingerprint, and / or transaction frequency corresponding to the account ID with the IP address, and / or device fingerprint, and / or transaction frequency corresponding to the account ID in the scalper database to obtain a matching result;

[0096] It is comprehensively determined based on the matching result whether the payment account corresponding to the payment data to be identified is within the preset scalper database.

[0097] In this embodiment, the scalper database contains not only the account ID, but also other information related to the account ID, such as IP address, device fingerprint, transaction frequency, etc. In order to more comprehensively analyze and identify electronic scalper behavior, and to improve the accuracy of judgment, when the user makes a payment, the system automatically performs a background comparison of the user's account ID to quickly identify whether the account ID exists in the scalper database. If the account ID matches, the system considers it necessary to further analyze (such as the possibility of misjudgment of the account ID or the need for more sophisticated verification), and will further consider other factors such as IP address, device fingerprint, transaction frequency, etc. By comprehensively considering multiple factors (including but not limited to account ID, IP address, device fingerprint, transaction frequency, etc.), when multiple factors point to the same conclusion, the system will consider that the payment account is in the scalper database. The specific matching algorithm can adopt the following algorithm:

[0098] 1) String matching algorithm: Use Bloom filter and KMP algorithm (Knuth-Morris-Pratt). Bloom filter can quickly determine whether an element is in a set; KMP algorithm and BM algorithm can be used to quickly find whether a string contains a specified string in the scalper database.

[0099] 2) Pattern recognition algorithm: Use regular expression matching and sequence labeling models in deep learning. The pattern recognition algorithm determines whether the user information contains specific patterns or complex sequence features, such as specific numbers, user names, email addresses, etc. that scalpers often use, to determine whether it is similar to the information in the scalper database.

[0100] 3) Feature extraction and similarity comparison: Use feature vectorization and multimodal matching. By converting user information into feature vectors, such as mobile phone numbers, IP addresses, etc., and then using cosine similarity and edit distance measurement methods, it is compared with the records in the scalper database. Combined with multi-dimensional features such as user behavior patterns, transaction history, and geographic location, a comprehensive judgment is made through a multimodal fusion matching algorithm.

[0101] Step S106: In response to the target user being an e-scalper, corresponding risk control measures are executed according to a preset risk control strategy.

[0102] Specifically, the risk control measures include at least one of the following: delaying the return time of account operations, adding the account to the manual review list, limiting the transaction frequency, and requiring additional verification.

[0103] In this embodiment, delaying the return time of account operations means temporarily extending the payment transaction function of suspected scalper accounts (i.e., electronic scalper accounts) and deciding whether to restore their payment functions after further verification; including accounts in the manual review list means including suspected scalper accounts in the manual review list, and a dedicated customer service team or risk control team will conduct a detailed review of their past transaction records to confirm whether there are any violations; limiting transaction frequency means setting a daily or periodic transaction limit for suspected scalper accounts, and providing user feedback through friendly prompts to indicate abnormal transaction behavior, to prevent a large number of medical resources from being seized in a short period of time. Requiring additional verification means requiring users to provide additional identity authentication information or perform additional verification steps when suspected scalper accounts conduct payment transactions, in order to further confirm their identities and the legitimacy of transactions, thereby reducing risks and preventing potential violations.

[0104] It should be noted that the method for preventing electronic scalping provided by the present invention is a new method for preventing electronic scalping at the payment stage based on big data analysis and machine learning. The method conducts in-depth mining of payment behaviors and payment trajectories based on payment data, establishes feature engineering and payment behavior sequences, and aims to identify abnormal payment patterns and abnormal payment links, and adopts double verification to improve the efficiency and accuracy of preventing electronic scalping.

[0105] In a specific embodiment, payment behavior and payment track are deeply mined based on payment data to identify abnormal payment patterns and abnormal payment links, such as Figure 2 As shown, the method for preventing electronic scalping behavior may include the following steps:

[0106] 1. Normalize the payment data, which includes the user's historical payment data, the payment data that the user is currently generating, and the payment data that the user plans to generate.

[0107] Among them, payment data may include business response, business response information, payment method, payment method name, request source, payment channel, payment type, payment amount, payment time, business party order number, user ID, payment expiration time, client IP address, payment success time, payment status, extended information and other fields.

[0108] Among them, taking the scenario of medical prevention electronic scalpers as an example, the user's historical payment data refers to the data records of all successful payments made by the user in the past period of time (such as the past year, the past six months, etc.). The payment data being generated by the user refers to the data generated during the user's current transaction process, such as the information entered by the user on the payment page of the registration completion page, the selected payment method, the actual payment behavior, etc. This type of data is usually real-time and reflects the user's immediate payment activities. The payment data that the user plans to generate refers to the data of the user's payment behavior that may be performed in the future. This includes users who have completed registration but have not paid immediately, users who select alternate when registering, payments after successful alternate, stored payment information, favorite popular or frequently used departments, etc. This type of data is often based on the user's intentions and plans and has a certain predictive nature.

[0109] 2. Carry out feature engineering on normalized payment data and establish feature systems from two aspects: users and channels.

[0110] Among them, channels refer to the different entrances that users can choose when making payments, including but not limited to WeChat Pay, Alipay, UnionPay card payment and various e-wallets.

[0111] 3. Based on feature engineering, conduct in-depth data mining to obtain payment sequences of new dimensions.

[0112] 4. Combine the above steps 2 and 3 to perform cluster analysis on the feature system and payment sequence using the payment behavior feature system sequence algorithm.

[0113] Specifically:

[0114] a) Conduct group feature engineering for relevant persons involved in user payment behavior to confirm that no relevant persons frequently engage in transactions under the same user system;

[0115] It should be noted that in the analysis of user payment behavior, group feature engineering is mainly carried out to identify and understand the behavior patterns, preferences and potential risks of different user groups.

[0116] Related people: This includes family members, friends, or business partners. These relationships can be indirectly identified through shared addresses, phone numbers, bank account information, etc.

[0117] Group feature engineering: A user system can refer to all activities under a single account, or it can be extended to interactions between a group of related accounts. For example, if two or more accounts often log in together using the same device or the same account, they may be considered to belong to the same user system.

[0118] When the transaction behavior of the same user includes information such as the amount, frequency, time point, and transaction method, if it is found that several accounts that seem unrelated but actually have some connection (such as a shared IP address) frequently have the same type of transactions or other suspicious operations, data analysis can be used to detect whether there are any abnormalities.

[0119] b) Conduct feature engineering for transaction time in user payment behavior, such as payment time interval (the time difference between two consecutive payments), payment behavior clustering time period, etc.

[0120] e) Conduct feature engineering on transaction amounts in user payment behaviors, such as amount distribution (single payment amount, total payment amount, average payment amount, etc.);

[0121] c) Conduct feature engineering for transaction objects in channel payment behaviors and identify common areas for transaction objects, such as medical appointment registration, concert tickets, etc.;

[0122] e) Conduct feature engineering for transaction conversion in channel payment behavior to confirm whether multiple transaction conversions are performed to evade system security protection and other methods to prevent scalpers;

[0123] f) Conduct feature engineering for transaction frequency in channel payment behavior to confirm the transaction frequency of the same user in a short period of time and the frequency of payment or refund generated by the same user;

[0124] 5. Train the payment trajectory model based on the cluster analysis algorithm to identify abnormal transaction clusters and payment record trajectories that deviate from normal behavior patterns.

[0125] 6. The payment trajectory model is used to predict the user's payment behavior, and double verification is used to improve the efficiency and accuracy of preventing scalpers.

[0126] In another specific embodiment, Figure 3 As shown, the method for preventing electronic scalping behavior may include the following steps:

[0127] S1. Normalize the payment data, which includes the user's historical payment data, the payment data being generated by the user, and the payment data that the user plans to generate. The normalization content includes removing invalid or erroneous records, standardizing the time format, standardizing the payment amount format, handling missing values ​​and outliers, handling duplicate data, and discretizing, integrating, and converting data.

[0128] S2. Perform feature engineering on normalized payment data and establish feature systems from two aspects: users and channels. The user dimension feature system captures similar feature groups through basic information features and user activity features; and captures abnormal time and amount data through payment behavior features and risk credit features. The channel dimension feature system captures feature objects through channel basic payment information; captures the conversion characteristics of payment data through channel preference habits; and captures the frequency characteristics of payment data through payment success rate and speed.

[0129] It should be noted that the characteristics of the user dimension feature system include: basic information (age, gender, geographic location, etc.), transaction behavior (transaction frequency, average transaction amount, transaction time distribution, transaction type preference), payment method preference (commonly used payment tools, payment terminals), credit status (credit score, past default record), social network information (social media activity, followed brands or merchants), risk factors (abnormal transaction patterns, signs of suspected fraudulent behavior), etc.

[0130] It should be noted that the characteristics of the channel dimension feature system include: channel attributes (channel type (online / offline, mobile application / website)), channel name (WeChat Pay, Alipay, bank online banking, etc.), usage (transaction volume of each channel, peak hours of channel use, conversion rate between different channels), security and stability (transaction success rate, failure frequency and recovery time), cost-effectiveness (operating costs of each channel, revenue brought by the channel), etc. The channel feature system uses the unique identifier of each channel as the primary key, and payment methods such as WeChat and Alipay have universal unique identifiers.

[0131] Among them, the Z-score normalization algorithm is used for the first identification and processing of outliers, and a modification, deletion or replacement strategy is adopted to retain a new data domain (that is, the historical payment data, the payment data being generated by the user and the payment data planned to be generated by the user are normalized and the data are converted into a standard normal distribution). Then, the DBscan algorithm is used to detect the object p that has not been checked in the database. If p has not been processed (not classified into a cluster or marked as noise), its neighborhood is checked. If the number of objects contained is not less than minPts, a new cluster C is established, and all points in it are added to the candidate set N; for all objects q in the candidate set N that have not been processed, their neighborhood is checked. If it contains at least minPts objects, these objects are added to N; if q is not classified into any cluster, q is added to C; the unprocessed objects in N are continued to be checked, and the current candidate set N is empty; until all objects are classified into a cluster or marked as noise.

[0132] It should be noted that the DBscan algorithm is a density-based spatial clustering algorithm, which is mainly used to cluster data sets with arbitrary shapes. In the present invention, standardized (i.e., normalized) data are clustered. The object refers to the standardized data, and the cluster refers to the high-density area of ​​the standardized data. The points in these areas are regarded as the same cluster.

[0133] S3. Based on feature engineering, the data is deeply mined to obtain payment sequences of new dimensions. Among them, the GSP algorithm is used to discover frequent patterns in sequence data, which is suitable for discovering fixed order patterns in user payment behavior and discovering payment user behavior sequences. ARIMA (autoregressive integrated moving average model) is a statistical model used to predict and understand time series data. It is suitable for analyzing the changing trend of payment amount or frequency over time, and discovering payment time interval sequences and payment amount change sequences. State space model and HMM (hidden Markov model): suitable for analyzing hidden state changes in payment behavior, such as the changing pattern of user payment habits over time, discovering payment channel conversion sequences and payment channel frequency sequences. Hierarchical clustering, K-means clustering: Grouping users based on the similarity of payment behavior may reveal different payment patterns or user groups and discover payment specific object sequences.

[0134] Specifically, each payment sequence includes the timestamp of each payment, payment ID or transaction number, user ID, payment amount, payment channel, payment type, payee information, notes, etc.

[0135] Payment user behavior sequence: includes a series of user payment operation records, such as the timestamp of each payment, payment amount, payment tool used (WeChat, Alipay, etc.), and payment purpose (shopping, transfer, payment, etc.).

[0136] Payment time interval sequence: records the time difference between two consecutive payments. For example, if the user made the first payment at 2023-01-01 10:00 and the second payment at 2023-01-01 12:30, the time interval is 2 hours and 30 minutes.

[0137] Payment amount change sequence: records the amount of each payment and forms a sequence that changes over time. For example, the user's payment amounts are 50 yuan, 120 yuan, 80 yuan, 200 yuan, etc.

[0138] Payment sequence for specific objects: records the specific objects or merchants to which users make payments. For example, users often pay a supermarket, a friend, or an online service provider.

[0139] Payment channel conversion sequence: describes the user's switching between different payment channels. For example, the user first uses WeChat Pay, then switches to Alipay, and then returns to WeChat Pay.

[0140] Payment channel frequency series: This counts the frequency of use of each payment channel. For example, a user uses WeChat Pay 20 times and Alipay 10 times in a month.

[0141] S4, combining the above S2 and S3 to perform cluster analysis on the characteristic system and payment sequence using the payment behavior characteristic system sequence algorithm. The specific analysis method is as follows: Figure 4 As shown, the following steps are included (i.e., the payment trajectory model prediction steps):

[0142] 1. Perform the first level of verification on the order payment user and channel;

[0143] 1) Setting thresholds: According to business needs and risk control strategies, a reasonable transaction threshold is set. For example, users are allowed to conduct a maximum of N transactions within a certain time frame (such as one day, one week, or one month); whether the IP address of the user's payment behavior is different within the set time; the same user frequently changes channels for multiple transactions, etc.

[0144] Among them, each payment sequence corresponds to a transaction threshold. Figure 4 Verifying the number of user payment transactions, verifying the IP address of user payment behavior, verifying the user payment time interval, verifying the change in user payment amount, verifying the user payment channel conversion, and verifying the user payment channel frequency are partial verifications performed by the payment trajectory model based on the transaction threshold.

[0145] 2) Real-time monitoring and statistics: Real-time monitoring of user transaction data. Every time a user completes a transaction, the system automatically updates the user's transaction statistics.

[0146] 3) Count transactions: For each user, add up all successfully completed transactions within a specified time window (e.g., the past hour).

[0147] 4) Comparison threshold: Compare the actual transactions counted with the preset threshold. If the transaction exceeds the threshold, the early warning mechanism is triggered.

[0148] 5) Take measures: If the transaction exceeds the threshold, take corresponding actions according to the risk control strategy, such as suspending subsequent transactions, requiring users to provide additional identity verification information, etc. The specific measures are as follows:

[0149] ① Delaying the return time of account operations: temporarily extending the return notification of the payment transaction function of suspected scalper accounts, and deciding whether to restore their payment function after further verification of the situation.

[0150] ② Manual review: Suspected scalper accounts will be included in the manual review list, and a dedicated customer service team or risk control team will conduct a detailed review of their past transaction records to confirm whether there are any violations.

[0151] ③ Limit transaction frequency: Set a daily or periodic transaction limit for the account, and provide friendly prompts to users to alert them of abnormal transaction behavior, to prevent a large amount of medical resources from being seized in a short period of time.

[0152] ④ Optimize risk control strategies: Based on the findings this time, we will continue to improve and optimize risk control strategies, adjust threshold settings, and improve the accuracy of identifying scalper behaviors and the efficiency of intercepting them.

[0153] 6) Continuous optimization: Based on actual operating conditions and risk control effects, continuously adjust and improve threshold settings to achieve the optimal level of risk prevention and control.

[0154] 7) Storing audit records: All transaction records and events exceeding the threshold should be securely stored and regularly reviewed and analyzed. Through the audit analysis of scalper payment data, we can gain a deeper understanding of how scalpers exploit system vulnerabilities, thereby improving platform services, optimizing resource allocation, and protecting the rights and interests of normal users.

[0155] To sum up, check whether the user's payment transaction behavior is within the threshold. If the payment behavior exceeds the threshold, it means that the user account is an abnormal account and is suspected of being a major scalper.

[0156] According to the conclusion of 1 above, the second level of verification of the order payment account is carried out, including:

[0157] 2. Verify whether the user's payment account is in the scalper database. The specific execution steps are designed and implemented as follows:

[0158] 1) Establish a scalper database: Identify suspected or confirmed scalper accounts based on historical data analysis, reporting information, and technical means, and list them in the scalper database. The scalper database should contain key data such as user account ID, registration information, and transaction records. The specific establishment method is as follows:

[0159] ① Information collection and integration: Integrate multi-channel information: collect information from major hospital registration systems, records of relevant agencies, patient complaints and reports, etc., including but not limited to personal identity information, mobile phone numbers, online accounts, historical violation records, etc. of electronic scalpers. Data standardization processing: The collected information is unified into a standard format to facilitate database management and cross-institutional sharing.

[0160] ②Build a database system: Design a special database structure, including modules for storing basic information of electronic scalpers, details of illegal activities, and evidence chains, to ensure that the information is accurate and easy to query. Introduce information security and privacy protection mechanisms to ensure the legal and compliant use of scalper information and prevent data leakage.

[0161] ③Technical connection and sharing mechanism: Establish data interfaces with major hospital registration platforms, local health commissions and other related units to achieve real-time update and sharing of scalper information. Implement special monitoring of key hospitals, key departments, popular expert appointment sources, etc. to capture abnormal registration behaviors in a timely manner.

[0162] ④ Intelligent identification and tracking: Apply big data analysis technology and artificial intelligence algorithms to identify abnormal registration patterns and behavioral characteristics of electronic scalpers, such as snapping up a large number of specific numbers in a short period of time, frequently changing the information of the registrant, etc. Through machine learning, we continuously optimize the recognition model and improve our ability to respond to new scalper tactics.

[0163] 2) Real-time update and maintenance: The scalper database needs to be updated regularly, including adding new electronic scalper accounts, removing misjudged accounts, updating electronic scalper behavior characteristics, etc., to ensure the accuracy and timeliness of the database content.

[0164] 3) Verification before payment: When a user makes a payment, the system automatically performs a background comparison of the user's account ID to check whether the account exists in the scalper database.

[0165] 4) Matching algorithm: judged through more complex and sophisticated matching algorithms, such as comprehensive analysis based on multiple factors such as IP address, device fingerprint, transaction frequency, etc., to improve the accuracy of judgment (that is, to verify whether all abnormal account IDs are in the scalper database, including the user's IP address, device fingerprint, transaction frequency, and the scalper database at least includes account ID, IP address, device fingerprint, and transaction frequency). The specific algorithm is as follows:

[0166] ① String matching algorithm: Use Bloom filter and KMP algorithm (Knuth-Morris-Pratt). Bloom filter can quickly determine whether an element is in a set; KMP algorithm and BM algorithm can be used to quickly find whether a string contains a specified string in the scalper database. Although the above algorithms have a false positive rate, they are very practical in the initial screening stage. When the first level of verification is completed and the user is judged to be a suspected scalper, the algorithm can be used to quickly further confirm the scalper's identity.

[0167] ② Pattern recognition algorithm: Use regular expression matching and sequence labeling models in deep learning. The pattern recognition algorithm determines whether the user information contains specific patterns or complex sequence features, such as specific numbers, user names, email addresses, etc. that scalpers often use, to determine whether it is similar to the information in the scalper database.

[0168] ③ Feature extraction and similarity comparison: Use feature vectorization and multimodal matching. By converting user information into feature vectors, such as mobile phone numbers, IP addresses, etc., and then using cosine similarity and edit distance measurement methods to compare with the records in the scalper database. Combined with multi-dimensional features such as user behavior patterns, transaction history, and geographic location, a comprehensive judgment is made through a multimodal fusion matching algorithm.

[0169] ④ Machine learning and deep learning algorithms: Use machine learning classification algorithms (such as logistic regression, support vector machine, random forest, etc.) or deep learning models (such as convolutional neural network, recurrent neural network, etc.) to train scalper identification models, classify user behaviors, and determine whether they belong to scalpers.

[0170] 5) Risk assessment and processing: When a user account exists in the scalper database, risk control strategies are immediately triggered, such as increasing the response time of the user's operating system, requiring additional verification, manual review intervention, and other measures to prevent scalpers from grabbing resources.

[0171] 6) Dynamic monitoring and feedback: Implement a dynamic monitoring mechanism. When new scalper behavior characteristics emerge, timely adjust and improve the scalper database, and add new scalper accounts to the database to form a closed-loop management.

[0172] 7) Linkage mechanism: Share information with other platforms or relevant institutions to achieve coordinated prevention and control of scalper accounts and jointly build a barrier to prevent scalpers.

[0173] To sum up, check whether the user's payment account is in the scalper database. If the user's payment account is in the scalper database, it means that the user account is an abnormal account and the user is confirmed to be a scalper.

[0174] Verify whether the user's payment account is in the scalper database. If the return message shows that the user's payment account is not in the scalper database, it means that the user account is a normal account.

[0175] When the preset payment data satisfies the non-scalper user, the payment operation of the client is controlled according to the result.

[0176] The method for preventing electronic scalping provided by the embodiment of the present invention first normalizes the payment data; and performs feature engineering on the normalized payment data, establishes feature systems from the two aspects of users and channels, and obtains user dimension feature systems and channel dimension feature systems; then, based on feature engineering, the normalized payment data is deeply mined to obtain a payment sequence of a new dimension; and cluster analysis is performed on the user dimension feature system, the channel dimension feature system, and the payment sequence, and a payment trajectory model is trained according to the results of the cluster analysis; the trained payment trajectory model is then used to predict the payment data to be identified, and it is determined whether the corresponding target user is an electronic scalper; finally, in response to the target user being an electronic scalper, corresponding risk control measures are executed according to a preset risk control strategy. The present invention performs in-depth mining of payment behavior and payment trajectory based on payment data, and fully extracts and analyzes the multi-dimensional features of users and channels through normalization and feature engineering, significantly enhancing the real-time processing capability and accuracy of the model for payment data. On this basis, by deeply mining payment data, the potential laws and patterns behind payment behaviors are revealed, further enriching the model's predictive ability. The application of cluster analysis enables the model to classify users according to the similarity of payment trajectories, thereby more accurately identifying electronic scalpers, and there is no need to implement overly strict permission checks throughout the process, thereby effectively combating electronic scalping while reducing user privacy risks and ensuring a good experience for normal users. The existing methods for preventing electronic scalping behaviors have been solved, which are difficult to balance between real-time and accuracy, especially in high-concurrency situations, which can easily lead to performance bottlenecks and difficulty in fully covering risk points, and the implementation of strict permission checks may increase user privacy risks and affect normal user experience.

[0177] Embodiment 2:

[0178] like Figure 5 As shown, this embodiment provides a device for preventing electronic scalping behavior, which is used to execute the above-mentioned method for preventing electronic scalping behavior, including:

[0179] A normalization processing module 11, used for normalizing the payment data;

[0180] The feature engineering module 12 is connected to the normalization processing module 11 and is used to perform feature engineering on the payment data after normalization, establish feature systems from two aspects, namely, user and channel, to obtain a user dimension feature system and a channel dimension feature system;

[0181] The payment sequence mining module 13 is connected to the feature engineering module 12 and is used to perform in-depth mining on the normalized payment data based on feature engineering to obtain a payment sequence of a new dimension;

[0182] A model training module 14, connected to the payment sequence mining module 13, is used to perform cluster analysis on the user dimension feature system, the channel dimension feature system and the payment sequence, and train a payment trajectory model according to the result of the cluster analysis;

[0183] The payment data prediction module 15 is connected to the model training module 14 and is used to use the trained payment trajectory model to predict the payment data to be identified and determine whether the corresponding target user is an e-scalper;

[0184] The risk control measure execution module 16 is connected to the payment data prediction module 15 and is used to execute corresponding risk control measures according to a preset risk control strategy in response to the target user being an e-scalper.

[0185] Optionally, the payment data includes the user's historical payment data, the payment data being generated by the user, and the payment data that the user plans to generate;

[0186] The payment sequence includes a payment user behavior sequence, a payment time interval sequence, a payment amount change sequence, a payment specific object sequence, a payment channel conversion sequence and a payment channel frequency sequence.

[0187] Optionally, the payment data prediction module 15 specifically includes:

[0188] A first verification unit, used to perform a first verification on the payment data to be identified using a trained payment trajectory model, so as to determine whether the payment behavior corresponding to the payment data to be identified exceeds a corresponding threshold;

[0189] a second verification unit, configured to, in response to the payment behavior corresponding to the payment data to be identified exceeding a corresponding threshold, perform a second verification on the payment account corresponding to the payment data to be identified, so as to determine whether the payment account corresponding to the payment data to be identified is within a preset scalper database;

[0190] The electronic scalper confirmation unit is used to determine that the target user is an electronic scalper in response to the payment account being within a preset scalper database.

[0191] Optionally, the first verification unit specifically includes:

[0192] A first acquisition unit is used to acquire a payment user behavior sequence, a payment time interval sequence, a payment amount change sequence, a payment specific object sequence, a payment channel conversion sequence, and a payment channel frequency sequence corresponding to the payment data to be identified;

[0193] A threshold judgment unit, used to use the trained payment trajectory model to judge whether the corresponding payment behavior exceeds the corresponding transaction threshold according to the payment user behavior sequence, payment time interval sequence, payment amount change sequence, payment specific object sequence, payment channel conversion sequence and payment channel frequency sequence corresponding to the payment data to be identified, wherein each payment sequence corresponds to a transaction threshold;

[0194] The first judgment unit is used to judge that the payment behavior corresponding to the payment data to be identified exceeds the corresponding threshold if the payment behavior corresponding to any payment sequence exceeds the corresponding transaction threshold.

[0195] Optionally, the payment data prediction module 15 further includes:

[0196] An information collection unit, used to collect relevant information about electronic scalpers;

[0197] The cattle database construction unit is used to construct the cattle database according to the collected relevant information.

[0198] Optionally, the second verification unit specifically includes:

[0199] An ID query unit, used to query whether the account ID corresponding to the payment data to be identified is in the scalper database;

[0200] an information matching unit, configured to match the Internet Protocol IP address, and / or device fingerprint, and / or transaction frequency corresponding to the account ID with the IP address, and / or device fingerprint, and / or transaction frequency corresponding to the account ID in the scalper database in response to the account ID being in the scalper database, to obtain a matching result;

[0201] The comprehensive judgment unit is used to comprehensively judge whether the payment account corresponding to the payment data to be identified is within the preset scalper database based on the matching result.

[0202] Optionally, the risk control measures include at least one of the following: delaying the return time of account operations, adding the account to the manual review list, limiting the transaction frequency, and requiring additional verification.

[0203] Embodiment 3:

[0204] refer to Figure 6 This embodiment provides a device for preventing electronic scalping behavior, including a memory 21 and a processor 22. The memory 21 stores a computer program, and the processor 22 is configured to run the computer program to execute the method for preventing electronic scalping behavior in Example 1.

[0205] The memory 21 is connected to the processor 22. The memory 21 may be a flash memory, a read-only memory or other memory. The processor 22 may be a central processing unit or a single-chip microcomputer.

[0206] Embodiment 4:

[0207] This embodiment provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the method for preventing electronic scalping behavior in the above-mentioned embodiment 1 is implemented.

[0208] The computer-readable storage medium includes volatile or non-volatile, removable or non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, computer program modules or other data). Computer-readable storage media include, but are not limited to, RAM (Random Access Memory), ROM (Read-Only Memory), EEPROM (Electrically Erasable Programmable read only memory), flash memory or other memory technology, CD-ROM (Compact Disc Read-Only Memory), digital versatile disk (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information and can be accessed by a computer.

[0209] In summary, the method, device and medium for preventing electronic scalping provided by the embodiment of the present invention first normalize the payment data; and perform feature engineering on the normalized payment data, respectively establish feature systems from the two aspects of users and channels, and obtain user dimension feature systems and channel dimension feature systems; then, on the basis of feature engineering, the normalized payment data is deeply mined to obtain a payment sequence of a new dimension; and cluster analysis is performed on the user dimension feature system, the channel dimension feature system and the payment sequence, and the payment trajectory model is trained according to the results of the cluster analysis; the trained payment trajectory model is then used to predict the payment data to be identified, and determine whether the corresponding target user is an electronic scalper; finally, in response to the target user being an electronic scalper, corresponding risk control measures are executed according to the preset risk control strategy. The present invention performs deep mining of payment behavior and payment trajectory based on payment data, and fully extracts and analyzes the multi-dimensional characteristics of users and channels through normalization and feature engineering, significantly enhancing the real-time processing capability and accuracy of the model for payment data. On this basis, by deeply mining payment data, the potential laws and patterns behind payment behaviors are revealed, further enriching the model's predictive ability. The application of cluster analysis enables the model to classify users according to the similarity of payment trajectories, thereby more accurately identifying electronic scalpers, and there is no need to implement overly strict permission checks throughout the process, thereby effectively combating electronic scalping while reducing user privacy risks and ensuring a good experience for normal users. The existing methods for preventing electronic scalping behaviors have been solved, which are difficult to balance between real-time and accuracy, especially in high-concurrency situations, which can easily lead to performance bottlenecks and difficulty in fully covering risk points, and the implementation of strict permission checks may increase user privacy risks and affect normal user experience.

[0210] It is to be understood that the above embodiments are merely exemplary embodiments used to illustrate the principles of the present invention, but the present invention is not limited thereto. For those skilled in the art, various modifications and improvements can be made without departing from the spirit and essence of the present invention, and these modifications and improvements are also considered to be within the scope of protection of the present invention.

Claims

1. A method for preventing electronic scalping behavior, characterized in that: The method comprises: Normalize payment data; Perform feature engineering on the normalized payment data, establish feature systems from the user and channel aspects, and obtain user dimension feature systems and channel dimension feature systems; Based on feature engineering, the normalized payment data is deeply mined to obtain payment sequences of new dimensions; Performing cluster analysis on the user dimension feature system, the channel dimension feature system and the payment sequence, and training a payment trajectory model based on the results of the cluster analysis; Use the trained payment trajectory model to predict the payment data to be identified and determine whether the corresponding target user is an e-scalper; In response to the target user being an e-scalper, corresponding risk control measures are executed according to a preset risk control strategy.

2. The method according to claim 1, characterized in that: The payment data includes the user's historical payment data, the payment data being generated by the user, and the payment data that the user plans to generate; The payment sequence includes a payment user behavior sequence, a payment time interval sequence, a payment amount change sequence, a payment specific object sequence, a payment channel conversion sequence and a payment channel frequency sequence.

3. The method according to claim 2, characterized in that The method uses the trained payment trajectory model to predict the payment data to be identified and determines whether the corresponding target user is an e-scalper, specifically including: Using the trained payment trajectory model to perform a first check on the payment data to be identified, so as to determine whether the payment behavior corresponding to the payment data to be identified exceeds a corresponding threshold; In response to the payment behavior corresponding to the payment data to be identified exceeding the corresponding threshold, performing a second check on the payment account corresponding to the payment data to be identified to determine whether the payment account corresponding to the payment data to be identified is within a preset scalper database; In response to the payment account being in a preset scalper database, it is determined that the target user is an electronic scalper.

4. The method according to claim 3, characterized in that The first check of the payment data to be identified using the trained payment trajectory model to determine whether the payment behavior corresponding to the payment data to be identified exceeds a corresponding threshold specifically includes: Obtaining a payment user behavior sequence, a payment time interval sequence, a payment amount change sequence, a payment specific object sequence, a payment channel conversion sequence, and a payment channel frequency sequence corresponding to the payment data to be identified; Using the trained payment trajectory model, judging whether the corresponding payment behavior exceeds the corresponding transaction threshold according to the payment user behavior sequence, payment time interval sequence, payment amount change sequence, payment specific object sequence, payment channel conversion sequence and payment channel frequency sequence corresponding to the payment data to be identified, wherein each payment sequence corresponds to a transaction threshold; If the payment behavior corresponding to any payment sequence exceeds the corresponding transaction threshold, it is determined that the payment behavior corresponding to the payment data to be identified exceeds the corresponding threshold.

5. The method according to claim 3, characterized in that: Before performing a second check on the payment account corresponding to the payment data to be identified to determine whether the payment account corresponding to the payment data to be identified is within a preset scalper database, the method further includes: Collect information about electronic scalpers; The scalper database is constructed based on the collected relevant information.

6. The method according to claim 3, characterized in that The second verification of the payment account corresponding to the payment data to be identified to determine whether the payment account corresponding to the payment data to be identified is within a preset scalper database specifically includes: Check whether the account ID corresponding to the payment data to be identified is in the scalper database; In response to the account ID being in the scalper database, matching the Internet Protocol IP address, and / or device fingerprint, and / or transaction frequency corresponding to the account ID with the IP address, and / or device fingerprint, and / or transaction frequency corresponding to the account ID in the scalper database to obtain a matching result; It is comprehensively determined based on the matching result whether the payment account corresponding to the payment data to be identified is within the preset scalper database.

7. The method according to claim 1, characterized in that The risk control measures include at least one of the following: delaying the return time of account operations, adding the account to the manual review list, limiting the transaction frequency, and requiring additional verification.

8. A device for preventing electronic scalping, characterized in that: The device comprises: A normalization processing module, used for normalizing payment data; A feature engineering module, connected to the normalization processing module, is used to perform feature engineering on the payment data after normalization processing, establish feature systems from two aspects, namely, user and channel, to obtain a user dimension feature system and a channel dimension feature system; A payment sequence mining module, connected to the feature engineering module, is used to perform in-depth mining on the normalized payment data based on feature engineering to obtain a payment sequence of a new dimension; A model training module, connected to the payment sequence mining module, is used to perform cluster analysis on the user dimension feature system, the channel dimension feature system and the payment sequence, and train a payment trajectory model based on the results of the cluster analysis; A payment data prediction module, connected to the model training module, is used to use the trained payment trajectory model to predict the payment data to be identified and determine whether the corresponding target user is an e-scalper; The risk control measure execution module is connected to the payment data prediction module and is used to execute corresponding risk control measures according to a preset risk control strategy in response to the target user being an e-scalper.

9. A device for preventing electronic scalping, characterized in that: The method comprises a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to implement the method for preventing electronic scalping behavior as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method for preventing electronic scalping behavior according to any one of claims 1 to 7 is implemented.

Images