Abnormal transaction behavior detection method and device and medium

Abstract

The invention discloses an abnormal transaction behavior detection method and device and a medium. The method comprises the following steps: for a target transaction behavior of a target user, obtaining target order data of the target transaction behavior; obtaining a plurality of first historical order data of the target user from a predetermined storage table according to a predetermined detection period; based on the target order data and the first historical order data, performing access behavior detection to obtain a first detection result; transaction address detection is carried out based on the target order data and the first historical order data, and a second detection result is obtained; payment link detection is carried out based on the target order data and the first historical order data, and a third detection result is obtained; and determining a target detection result of the target transaction behavior based on the first detection result, the second detection result and the third detection result. The accuracy of abnormal transaction behavior detection can be improved.

Description

Technical Field

[0001] The present invention relates to the technical field of e-commerce, and particularly to a method, device and medium for detecting abnormal transaction behaviors. Background Art

[0002] With the continuous development of Internet technology, various e-commerce applications have emerged. To ensure the integrity and compliance of platform transaction data, it is crucial to identify and block abnormal order behaviors / abnormal transaction behaviors.

[0003] However, the existing methods for detecting abnormal transaction behaviors have the problems of inaccurate and unreliable detection results. Summary of the Invention

[0004] In view of this, the present invention provides a method, device and medium for detecting abnormal transaction behaviors, mainly aiming to solve the problem that the existing methods for detecting abnormal transaction behaviors have inaccurate and unreliable detection results.

[0005] To solve the above problems, the present application provides a method for detecting abnormal transaction behaviors, including:

[0006] For a target transaction behavior of a target user, obtain target order data of the target transaction behavior;

[0007] Obtain a number of first historical order data of the target user from a predetermined storage table according to a predetermined detection period;

[0008] Based on the target order data and each of the first historical order data, perform access behavior detection to obtain a first detection result;

[0009] Based on the target order data and each of the first historical order data, perform transaction address detection to obtain a second detection result;

[0010] Based on the target order data and each of the first historical order data, perform payment link detection to obtain a third detection result;

[0011] Based on the first detection result, the second detection result and the third detection result, determine a target detection result of the target transaction behavior.

[0012] Optionally, the performing access behavior detection based on the target order data and each of the first historical order data to obtain a first detection result specifically includes:

[0013] Based on the target order data and each of the first historical order data, determine the interface access density of a target transaction interface corresponding to a target transaction object;

[0014] Based on the target order data and each piece of the first historical order data, determine the application access density of the target trading application corresponding to the target trading object;

[0015] Based on the interface access density and the application access density, perform access behavior detection to obtain the first detection result.

[0016] Optionally, the performing transaction address detection based on the target order data and each piece of the first historical order data to obtain a second detection result specifically includes:

[0017] Based on the target order data and each piece of the first historical order data, determine the distribution range of the transaction address;

[0018] Based on the distribution range, perform transaction address detection to obtain the second detection result.

[0019] Optionally, the performing payment link detection based on the target order data and each piece of the first historical order data to obtain a third detection result specifically includes:

[0020] Based on the target order data and each piece of the first historical order data, determine the payment success rate and the coupon usage rate;

[0021] Based on the payment success rate and the coupon usage rate, perform payment link detection to obtain the third detection result.

[0022] Optionally, the determining the target detection result of the target trading behavior based on the first detection result, the second detection result, and the third detection result specifically includes:

[0023] When any one of the first detection result, the second detection result, and the third detection result is an abnormal trading behavior, determine that the target trading behavior is an abnormal trading behavior to obtain the target detection result.

[0024] Optionally, when the target detection result is a non-abnormal trading behavior, the method further includes: verifying the target trading behavior, which specifically includes:

[0025] Based on the interface access density, the application access density, the distribution range of the transaction address, the payment success rate, and the coupon usage rate, use a pre-trained target detection model to verify the target trading behavior to obtain a verification result.

[0026] Optionally, before performing access behavior detection, the method further includes: determining the user type of the target user, and when determining that the user type is a non-risk user, perform access behavior detection;

[0027] Determining the user type of the target user specifically includes:

[0028] According to a predetermined screening period, several second historical order data of the target user are screened and obtained from a predetermined storage table;

[0029] Based on the target order data and each second historical order data, determine the first transaction times of the target transaction object corresponding to the target order data;

[0030] Based on the first transaction times and a predetermined first transaction times threshold corresponding to the target transaction object, determine that the user type of the target user is a risk user or a non-risk user;

[0031] Alternatively, based on the target order data and each second historical order data, determine the transaction time span and the second transaction times of each transaction object;

[0032] Based on the transaction time span, the second transaction times, a predetermined time span threshold, and a predetermined second transaction times threshold, determine that the user type of the target user is a risk user or a non-risk user.

[0033] Optionally, after obtaining the target order data of the target transaction behavior, the method further includes:

[0034] Generate a structured order log for the target order data;

[0035] Store the structured order log and the user information in the index table in the storage table in the form of key-value pairs;

[0036] Add a time stamp corresponding to the structured order log to a predetermined time series doubly linked list, and configure a pointer for the time stamp to point to the structured order log to update the time series doubly linked list in the storage table.

[0037] To solve the above problems, the present application provides an abnormal transaction behavior detection device, including:

[0038] A first acquisition module, configured to acquire target order data of a target transaction behavior for a target user;

[0039] A second acquisition module, configured to acquire several first historical order data of the target user from a predetermined storage table according to a predetermined detection period;

[0040] A first detection module, configured to perform access behavior detection based on the target order data and each of the first historical order data to obtain a first detection result;

[0041] A second detection module, configured to perform transaction address detection based on the target order data and each piece of the first historical order data, and obtain a second detection result;

[0042] A third detection module, configured to perform payment link detection based on the target order data and each piece of the first historical order data, and obtain a third detection result;

[0043] A determination module, configured to determine a target detection result of the target transaction behavior based on the first detection result, the second detection result, and the third detection result.

[0044] To solve the above problems, the present application provides a storage medium storing a computer program, and when the computer program is executed by a processor, the steps of the abnormal transaction behavior detection method described in any one of the above are implemented.

[0045] In the abnormal transaction behavior detection method, device, and medium of the present application, for the target order data to be detected, by obtaining a plurality of first historical orders of the same user, and respectively performing access behavior detection, transaction address detection, and payment link detection according to the target order data and each piece of the first historical order data, multi-dimensional detection can be achieved, making the detection result more accurate and reliable.

[0046] The above description is only an overview of the technical solution of the present invention. In order to be able to understand the technical means of the present invention more clearly, it can be implemented according to the content of the specification. And in order to make the above and other objects, features, and advantages of the present invention more obvious and understandable, the following specifically illustrates the specific embodiments of the present invention. Description of the Drawings

[0047] By reading the following detailed description of the preferred embodiments, various other advantages and benefits will become clear to those of ordinary skill in the art. The drawings are only for the purpose of showing the preferred embodiments and are not considered as limiting the present invention. And throughout the drawings, the same reference numerals are used to represent the same components. In the drawings:

[0048] Figure 1 It is a flowchart of an abnormal transaction behavior detection method according to an embodiment of the present application;

[0049] Figure 2 It is a structural block diagram of an abnormal transaction behavior detection device according to another embodiment of the present application;

[0050] Figure 3 It is a structural block diagram of an electronic device according to another embodiment of the present application. Detailed Embodiments

[0051] Reference is made herein to the various aspects and features of the present application with reference to the drawings.

[0052] It should be understood that various modifications may be made to the embodiments of the present application. Therefore, the above description should not be considered as limiting, but merely as an example of an embodiment. Other modifications within the scope and spirit of the present application will occur to those skilled in the art.

[0053] The accompanying drawings, which are incorporated in and constitute a part of the specification, illustrate embodiments of the present application and, together with the general description of the present application given above and the detailed description of the embodiments given below, serve to explain the principles of the present application.

[0054] These and other characteristics of the present application will become apparent from the following description of a preferred form of embodiment given as a non-limiting example with reference to the accompanying drawings.

[0055] It should also be understood that although the present application has been described with reference to certain specific examples, those skilled in the art will readily be able to implement many other equivalent forms of the present application.

[0056] The above and other aspects, features and advantages of the present application will become more apparent from the following detailed description when taken in conjunction with the accompanying drawings.

[0057] Specific embodiments of the present application will be described hereinafter with reference to the accompanying drawings; however, it should be understood that the embodiments described are merely examples of the present application and may be implemented in a variety of ways. Familiar and / or repetitive functions and structures are not described in detail to avoid obscuring the present application with unnecessary or redundant details. Therefore, the specific structural and functional details described herein are not intended to be limiting, but rather serve merely as a basis and representative basis for the claims to teach those skilled in the art to variously utilize the present application with substantially any suitable detailed structure.

[0058] This specification may use the phrases "in one embodiment," "in another embodiment," "in yet another embodiment," or "in other embodiments," which may all refer to one or more of the same or different embodiments according to the present application.

[0059] The present invention provides a method for detecting abnormal transaction behavior, which can be applied to electronic devices such as terminals and servers. Figure 1 As shown, the method in this embodiment includes the following steps:

[0060] Step S101, acquiring target order data of a target transaction behavior of a target user;

[0061] In this step, when the user submits an order, the transaction behavior event can be captured in real time, thereby obtaining the target order data of the target transaction behavior.

[0062] Step S102, obtain a number of first historical order data of the target user from a predetermined storage table according to a predetermined detection period;

[0063] In this step, the storage table includes an index table and a time series doubly linked list. The index table stores the correspondence between each user identifier / user ID and each order data. The time series doubly linked list stores the timestamps of each order data, and each timestamp is respectively configured with a pointer for pointing to the corresponding order data.

[0064] That is, the index table (hash table) specifically stores order data in the form of key-value pairs. Key design: The key can be specifically stored in a composite key manner, specifically including the user ID, behavior type (payment behavior, order placement behavior), and time slice (such as user789:order:20231215_14), supporting data isolation by hour-level slices to avoid hash collisions. Value storage: The order unit data (product ID, amount, coupon information) can be stored in the data structure serialization Protobuf compression format, which can reduce memory occupancy, and the memory occupancy is reduced by 40%.

[0065] In the specific implementation process of this embodiment, the hash interval can also be divided into 256 slices by using a segmented lock method, and each slice is independently locked to improve the write throughput.

[0066] In this embodiment, a time series doubly linked list can be created in advance for the index table to store the timestamps of each order data. That is, each node includes a timestamp, a pointer to the index table, and references to the predecessor and successor nodes, supporting O(1) time complexity for head insertion.

[0067] Furthermore, in this embodiment, a corresponding skip list index can also be constructed for the time series doubly linked list. The skip list index stores some timestamps in the time doubly linked list at a predetermined time interval, and pointers for pointing to the corresponding order data in the index table are configured for each timestamp in the skip list index, facilitating subsequent rapid finding of the corresponding order data from the index table based on the skip list index. In this embodiment, the time complexity of positioning the time starting point can be reduced from O(N) to O(log N), facilitating subsequent rapid skipping of expired nodes when counting "data in the past 1 hour".

[0068] In the specific implementation process of this embodiment, after obtaining the target order data, the target order data can also be converted into a structured order log, and then the structured order log and user information are stored in a predetermined index table in the form of key-value pairs. In this embodiment, before storing the structured order log and user information in the predetermined index table, sensitive information in the structured order log can also be desensitized; and a number is configured for the structured order log.

[0069] Step S103: Based on the target order data and each of the first historical order data, perform access behavior detection to obtain a first detection result;

[0070] In this step, specifically, the home page access ratio or the order placement interface access ratio can be determined according to the target order data and each of the first historical order data, and then whether it is an abnormal access behavior, and thus whether it is an abnormal transaction behavior can be determined according to the home page access ratio and / or the order placement interface access ratio, so as to obtain a first detection result.

[0071] Step S104: Based on the target order data and each of the first historical order data, perform transaction address detection to obtain a second detection result;

[0072] In this step, specifically, the distribution range of the order placement address can be determined according to the target order data and each of the first historical order data, and then whether it is an abnormal transaction behavior can be determined according to the address distribution range, so as to obtain a second detection result.

[0073] Step S105: Based on the target order data and each of the first historical order data, perform payment link detection to obtain a third detection result;

[0074] In this step, specifically, the payment success rate and the coupon usage rate can be determined according to the target order data and each of the first historical order data, and then whether it is an abnormal transaction behavior can be determined according to the payment success rate and / or the coupon usage rate, so as to obtain a third detection result.

[0075] Step S106: Based on the first detection result, the second detection result, and the third detection result, determine the target detection result of the target transaction behavior.

[0076] In this step, when any one of the three detection results is an abnormal transaction behavior, it can be determined that the target transaction behavior is an abnormal transaction behavior, so as to obtain the target detection result; on the contrary, if all three detection results are non-abnormal transaction behaviors, it can be determined that the target transaction behavior is a non-abnormal transaction behavior, so as to obtain the target detection result.

[0077] The abnormal transaction behavior detection method in this application, for the target order data to be detected, by obtaining several first historical orders of the same user, and respectively performing access behavior detection, transaction address detection, and payment link detection according to the target order data and each first historical order data, can achieve multi-dimensional detection, making the detection results more accurate and reliable.

[0078] Another embodiment of this application provides an abnormal transaction behavior detection method, which specifically includes the following steps:

[0079] Step S201, for the target transaction behavior of the target user, obtain the target order data of the target transaction behavior;

[0080] In this step, when the user submits an order, the behavior event can be captured in real time, so as to obtain the target order data of the target transaction behavior.

[0081] In this step, after obtaining the target order data, a structured order log can be generated, and the fields in the structured order log include any one or several of the following: user ID, commodity ID, timestamp, IP address, device fingerprint, payment channel.

[0082] In this step, after generating the structured order log, it can be preprocessed / desensitized. That is, desensitize the sensitive fields (such as the IP address), and append a globally unique serial number (TraceID) for subsequent link tracking.

[0083] After obtaining the desensitized structured order log, the structured order log and user information can be stored in a predetermined index table in the form of key-value pairs, which is convenient for subsequent detection of abnormal behaviors of other order data.

[0084] Step S202, determine the user type of the target user;

[0085] In the specific implementation process of this step, the user type includes risk users and non-risk users. Specifically, the user type of the target user can be determined as a risk user or a non-risk user by checking the blacklist / whitelist, or the following method can be used to determine the user type of the target user.

[0086] Method 1:

[0087] Step 1, according to a predetermined screening period, screen and obtain several second historical order data of the target user from a predetermined storage table;

[0088] Step 2, based on the target order data and each second historical order data, determine the first transaction times of the target transaction object corresponding to the target order data;

[0089] Step 3: Based on the first transaction count and the predetermined first transaction count threshold corresponding to the target trading object, determine whether the user type of the target user is a risky user or a non-risky user.

[0090] In this method, since the trading objects corresponding to each second historical order are different, the target trading object can be determined based on the target order data. Taking the target trading object as product A as an example, after determining product A, the second historical order data whose trading object is product A can be further determined by combining the second historical order data, so as to statistically obtain the first transaction count for product A. Furthermore, the first transaction count can be compared with the first transaction count threshold. When it is determined that the first transaction count is greater than the predetermined first transaction count threshold, the user type of the target user is determined to be a risky user; on the contrary, when the first transaction count is less than or equal to the predetermined first transaction count threshold, the user type of the target user is determined to be a non-risky user.

[0091] Method 2:

[0092] Step 1: Based on the target order data and the second historical order data, determine the trading time span and the second transaction count for each trading object;

[0093] Step 2: Based on the trading time span, the second transaction count, the predetermined time span threshold, and the predetermined second transaction count threshold, determine whether the user type of the target user is a risky user or a non-risky user.

[0094] In this method, since the trading objects corresponding to each second historical order are different, the trading time span can be determined according to the trading time corresponding to each second historical order data and the trading time corresponding to the target order data. At the same time, the second transaction count can be determined according to the second historical order data. Then, the trading time span is compared with the predetermined time span threshold, and at the same time, the second transaction count is compared with the second transaction count threshold; when it is determined that the trading time span is greater than or equal to the predetermined time span threshold and the second transaction count is less than or equal to the second transaction count threshold, the user type of the target user is determined to be a non-risky user; when it is determined that the trading time span is less than the predetermined time span threshold and / or the second transaction count is greater than the second transaction count threshold, the user type of the target user is determined to be a risky user.

[0095] Step S203: When the user type of the target user is a non-risky user, obtain a number of first historical order data of the target user from a predetermined storage table according to a predetermined detection period;

[0096] In this step, when the user type of the target user is a risky user, the target transaction behavior can be directly intercepted and corresponding prompts can be given. When the user type of the target user is a non-risky user, several first historical order data can be obtained to further detect the target transaction behavior of the target user.

[0097] Step S204: Based on the target order data and each of the first historical order data, determine the interface access density of the target transaction interface corresponding to the target transaction object; based on the target order data and each of the first historical order data, determine the application access density of the target transaction application corresponding to the target transaction object; based on the interface access density and the application access density, conduct access behavior detection to obtain the first detection result.

[0098] In this step, the application access density refers to the number of times a user logs in to a certain trading application / trading platform within a unit time period. Since the trading application contains trading links of several trading objects, after the target user logs in to the trading application, they may purchase different goods / trading objects. Therefore, by counting the number of times the user logs in to the trading application and then according to the time span of the login, the login density can be determined, that is, the application access density can be obtained.

[0099] Similarly, the interface access density refers to the number of times the trading interface corresponding to the same trading object is accessed within a unit time. By counting the number of times the user logs in to the trading interface and then according to the time span of the login, the interface access density can be determined. The higher the interface access density, the higher the risk of abnormal transactions, and there may be a behavior of brushing orders.

[0100] For example, when the application access density / home page access ratio is less than the application access density threshold of 10% and the order placement interface ratio is greater than the interface access density threshold of 60%, it can be determined that the first detection result is an abnormal transaction behavior.

[0101] Step S205: Based on the target order data and each of the first historical order data, determine the distribution range of the trading address; based on the distribution range, conduct trading address detection to obtain the second detection result.

[0102] In this step, when the distribution range of the trading address is greater than the predetermined range threshold, it can be determined that the second detection result is an abnormal transaction behavior.

[0103] Step S206: Based on the target order data and each of the first historical order data, determine the payment success rate and the coupon usage rate; based on the payment success rate and the coupon usage rate, conduct payment link detection to obtain the third detection result.

[0104] In this step, when the payment success rate is less than the predetermined success rate threshold and / or the coupon usage rate is greater than the predetermined usage rate threshold, it can be determined that the third detection result is an abnormal transaction behavior.

[0105] Step S207, when any one of the first detection result, the second detection result, and the third detection result is an abnormal transaction behavior, determine that the target transaction behavior is an abnormal transaction behavior to obtain the target detection result.

[0106] In this step, when any one of the first detection result, the second detection result, and the third detection result is an abnormal transaction behavior, it can be determined that the target transaction behavior of the target user is abnormal, that is, the target detection result is an abnormal transaction behavior; conversely, if the first detection result, the second detection result, and the third detection result are all non-abnormal transaction behaviors, it can be determined that the target detection result is a non-abnormal transaction behavior, and step S208 can be executed to verify the target transaction result.

[0107] Step S208, when the target detection result is a non-abnormal transaction behavior, based on the interface access density, application access density, distribution range of the transaction address, payment success rate, and coupon usage rate, use the pre-trained target detection model to verify the target transaction behavior to obtain the verification result.

[0108] In this step, the interface access density, application access density, distribution range of the transaction address, payment success rate, and coupon usage rate can be used as feature data, and they are standardized to obtain the standardized feature vector (such as interface distribution entropy value, IP clustering dispersion, payment amount variance). Then, the standardized feature vector is used as the model input, and the pre-trained target detection model (hybrid large model) is used to dynamically weight the importance of different features (example weights: access behavior features 40%, geographical features 30%, payment link features 30%) to further determine whether the target transaction behavior is abnormal, so as to obtain the verification result. In this embodiment, by further verifying using the target detection model, the final detection result can be made more accurate and reliable, improving the accuracy of abnormal behavior detection.

[0109] In the specific implementation process of this embodiment, the index table and the time series doubly linked list can also be cleaned of data according to a predetermined time period. For example, data cleaning is performed according to the timeliness priority mode; that is, each time data is accessed, the corresponding node is moved to the head of the linked list; the asynchronous cleaning thread regularly scans the tail of the linked list and removes stale data that exceeds 24 hours. Or, data cleaning is performed according to the frequency priority mode; that is, an access counter is maintained for each data node, and when the memory usage rate > 80%, low-frequency node elimination (the lowest 10% of the data with the counter value) is started.

[0110] In the specific implementation process of this embodiment, when it is determined that the target transaction behavior is an abnormal transaction behavior, the risk level of the target user can be further determined. For example, a risk score is given to the target user. For high-risk users (score ≥ 90): immediately intercept the order, asynchronously notify manual review, and freeze the account for 24 hours. For medium-risk users (70 ≤ score < 90): restrict some functions (such as disabling coupons), and asynchronously notify manual review. For low-risk users (score < 70): release the order, but mark it as an object under observation, and subsequent behaviors are included in the long-term credit rating.

[0111] In the abnormal transaction behavior detection method of this embodiment, for the target order data to be detected, by obtaining a number of first historical orders of the same user, and respectively performing access behavior detection, transaction address detection, and payment link detection according to the target order data and each first historical order data, multi-dimensional detection can be achieved, making the detection results more accurate and reliable.

[0112] Another embodiment of this application provides an abnormal transaction behavior detection device, as Figure 2 shown, including:

[0113] The first acquisition module 11 is used to acquire the target order data of the target transaction behavior for the target user;

[0114] The second acquisition module 12 is used to acquire a number of first historical order data of the target user from a predetermined storage table according to a predetermined detection period;

[0115] The first detection module 13 is used to perform access behavior detection based on the target order data and each of the first historical order data to obtain a first detection result;

[0116] The second detection module 14 is used to perform transaction address detection based on the target order data and each of the first historical order data to obtain a second detection result;

[0117] The third detection module 15 is used to perform payment link detection based on the target order data and each of the first historical order data to obtain a third detection result;

[0118] The determination module 16 is used to determine the target detection result of the target transaction behavior based on the first detection result, the second detection result, and the third detection result.

[0119] In the specific implementation process of this embodiment, the first detection module is specifically configured to: determine the interface access density of the target transaction interface corresponding to the target transaction object based on the target order data and each piece of the first historical order data; determine the application access density of the target transaction application corresponding to the target transaction object based on the target order data and each piece of the first historical order data; and perform access behavior detection based on the interface access density and the application access density to obtain the first detection result.

[0120] In the specific implementation process of this embodiment, the second detection module is specifically configured to: determine the distribution range of the transaction address based on the target order data and each piece of the first historical order data; and perform transaction address detection based on the distribution range to obtain the second detection result.

[0121] In the specific implementation process of this embodiment, the third detection module is specifically configured to: determine the payment success rate and the coupon usage rate based on the target order data and each piece of the first historical order data; and perform payment link detection based on the payment success rate and the coupon usage rate to obtain the third detection result.

[0122] In the specific implementation process of this embodiment, the determination module is specifically configured to: when any one of the first detection result, the second detection result, and the third detection result is an abnormal transaction behavior, determine that the target transaction behavior is an abnormal transaction behavior to obtain the target detection result.

[0123] In the specific implementation process of this embodiment, the abnormal transaction behavior detection device further includes: a verification module for verifying the target transaction behavior, and the verification module is specifically configured to: verify the target transaction behavior by using a pre-trained target detection model based on the interface access density, the application access density, the distribution range of the transaction address, the payment success rate, and the coupon usage rate to obtain a verification result.

[0124] In the specific implementation process of this embodiment, the abnormal transaction behavior detection device further includes: a type determination module, and the type determination module is specifically configured to: screen and obtain a number of second historical order data of a target user from a predetermined storage table according to a predetermined screening period; determine the first transaction times of the target transaction object corresponding to the target order data based on the target order data and each second historical order data; determine whether the user type of the target user is a risk user or a non-risk user based on the first transaction times and a predetermined first transaction times threshold corresponding to the target transaction object; or determine the transaction time span and the second transaction times of each transaction object based on the target order data and each second historical order data; determine whether the user type of the target user is a risk user or a non-risk user based on the transaction time span, the second transaction times, a predetermined time span threshold, and a predetermined second transaction times threshold.

[0125] In the specific implementation process of this embodiment, the abnormal transaction behavior detection device further includes: a storage module and an update module; the storage module is configured to: generate a structured order log for the target order data; store the structured order log and user information in an index table in the storage table in a key-value pair storage manner;

[0126] The update module is configured to: add a time stamp corresponding to the structured order log to a predetermined time series doubly linked list, and configure a pointer for the time stamp to point to the structured order log, so as to update the time series doubly linked list in the storage table.

[0127] For the target order data to be detected, the device in this embodiment can perform multi-dimensional detection by obtaining a number of first historical orders of the same user, and performing access behavior detection, transaction address detection, and payment link detection according to the target order data and each first historical order data, making the detection result more accurate and reliable.

[0128] Another embodiment of this application provides a storage medium, which stores a computer program, and when the computer program is executed by a processor, the following method steps are implemented:

[0129] Step 1: For the target transaction behavior of a target user, obtain the target order data of the target transaction behavior;

[0130] Step 2: Obtain a number of first historical order data of the target user from a predetermined storage table according to a predetermined detection period;

[0131] Step 3: Based on the target order data and each of the first historical order data, perform access behavior detection to obtain a first detection result;

[0132] Step 4: Based on the target order data and each piece of the first historical order data, perform a transaction address detection to obtain a second detection result;

[0133] Step 5: Based on the target order data and each piece of the first historical order data, perform a payment link detection to obtain a third detection result;

[0134] Step 6: Based on the first detection result, the second detection result, and the third detection result, determine the target detection result of the target transaction behavior.

[0135] For the specific implementation process of the above method steps, reference can be made to the embodiments of any of the above abnormal transaction behavior detection methods, and this embodiment will not be repeated here.

[0136] In the storage medium of this application, for the target order data to be detected, by obtaining a number of first historical orders of the same user, and respectively performing access behavior detection, transaction address detection, and payment link detection according to the target order data and each piece of the first historical order data, multi-dimensional detection can be achieved, making the detection result more accurate and reliable.

[0137] Another embodiment of this application provides an electronic device, as Figure 3 shown, at least including a memory 1 and a processor 2. A computer program is stored on the memory 1, and when the processor 2 executes the computer program on the memory 1, the following method steps are implemented:

[0138] Step 1: For the target transaction behavior of a target user, obtain the target order data of the target transaction behavior;

[0139] Step 2: Obtain a number of first historical order data of the target user from a predetermined storage table according to a predetermined detection period;

[0140] Step 3: Based on the target order data and each piece of the first historical order data, perform an access behavior detection to obtain a first detection result;

[0141] Step 4: Based on the target order data and each piece of the first historical order data, perform a transaction address detection to obtain a second detection result;

[0142] Step 5: Based on the target order data and each piece of the first historical order data, perform a payment link detection to obtain a third detection result;

[0143] Step 6: Based on the first detection result, the second detection result, and the third detection result, determine the target detection result of the target transaction behavior.

[0144] For the specific implementation process of the above method steps, reference can be made to the embodiments of any of the above abnormal transaction behavior detection methods, and details will not be repeated herein.

[0145] For the electronic device in this application, for the target order data to be detected, by obtaining a number of first historical orders of the same user, and respectively performing access behavior detection, transaction address detection, and payment link detection according to the target order data and each first historical order data, multi-dimensional detection can be achieved, making the detection results more accurate and reliable.

[0146] The above embodiments are only exemplary embodiments of this application and are not used to limit this application. The protection scope of this application is defined by the claims. Those skilled in the art can make various modifications or equivalent replacements to this application within the essence and protection scope of this application, and such modifications or equivalent replacements should also be regarded as falling within the protection scope of this application.

Claims

1. A method for detecting abnormal trading behaviors, characterized in that, Including: For the target transaction behavior of the target user, obtain the target order data of the target transaction behavior; Obtain a number of first historical order data of the target user from a predetermined storage table according to a predetermined detection period; Based on the target order data and each of the first historical order data, perform access behavior detection to obtain a first detection result; Based on the target order data and each of the first historical order data, perform transaction address detection to obtain a second detection result; Based on the target order data and each of the first historical order data, perform payment link detection to obtain a third detection result; Based on the first detection result, the second detection result, and the third detection result, determine the target detection result of the target transaction behavior.

2. The method according to claim 1, wherein The performing access behavior detection based on the target order data and each of the first historical order data to obtain a first detection result specifically includes: Based on the target order data and each of the first historical order data, determine the interface access density of the target transaction interface corresponding to the target transaction object; Based on the target order data and each of the first historical order data, determine the application access density of the target transaction application corresponding to the target transaction object; Based on the interface access density and the application access density, perform access behavior detection to obtain the first detection result.

3. The method according to claim 1, characterized in that The performing transaction address detection based on the target order data and each of the first historical order data to obtain a second detection result specifically includes: Based on the target order data and each of the first historical order data, determine the distribution range of the transaction address; Based on the distribution range, perform transaction address detection to obtain the second detection result.

4. The method according to claim 1, characterized in that, The performing payment link detection based on the target order data and each of the first historical order data to obtain a third detection result specifically includes: Based on the target order data and each of the first historical order data, determine the payment success rate and the coupon usage rate; Based on the payment success rate and the coupon usage rate, perform payment link detection to obtain the third detection result.

5. The method according to claim 1, characterized in that, The determining the target detection result of the target transaction behavior based on the first detection result, the second detection result, and the third detection result specifically includes: When any one of the first detection result, the second detection result, and the third detection result is an abnormal transaction behavior, determine that the target transaction behavior is an abnormal transaction behavior to obtain the target detection result.

6. The method according to any one of claims 1-5, characterized in that, When the target detection result is a non-abnormal transaction behavior, the method further includes: verifying the target transaction behavior, specifically including: Based on the interface access density, the application access density, the distribution range of the transaction address, the payment success rate, and the coupon usage rate, use a pre-trained target detection model to verify the target transaction behavior to obtain a verification result.

7. The method according to claim 1, wherein Before performing access behavior detection, the method further includes: determining the user type of the target user, and when determining that the user type is a non-risk user, perform access behavior detection; The determination of the user type of the target user specifically includes: Filtering a number of second historical order data of the target user from a predetermined storage table according to a predetermined screening period; Based on the target order data and each second historical order data, determining the first transaction count of the target trading object corresponding to the target order data; Based on the first transaction count and a predetermined first transaction count threshold corresponding to the target trading object, determining that the user type of the target user is a risky user or a non-risky user; Alternatively, based on the target order data and each second historical order data, determining the transaction time span and the second transaction count of each trading object; Based on the transaction time span, the second transaction count, a predetermined time span threshold, and a predetermined second transaction count threshold, determining that the user type of the target user is a risky user or a non-risky user.

8. The method according to claim 1, wherein After obtaining the target order data of the target transaction behavior, the method further includes: Generating a structured order log for the target order data; Storing the structured order log and user information in an index table in the storage table in a key-value pair storage manner; Adding a time stamp corresponding to the structured order log to a predetermined time series doubly linked list, and configuring a pointer for the time stamp to point to the structured order log to update the time series doubly linked list in the storage table.

9. An abnormal transaction behavior detection device, characterized in that, Including: A first acquisition module for acquiring target order data of a target transaction behavior for a target user; A second acquisition module for acquiring a number of first historical order data of the target user from a predetermined storage table according to a predetermined detection period; A first detection module for performing access behavior detection based on the target order data and each of the first historical order data to obtain a first detection result; A second detection module for performing transaction address detection based on the target order data and each of the first historical order data to obtain a second detection result; A third detection module for performing payment link detection based on the target order data and each of the first historical order data to obtain a third detection result; A determination module for determining a target detection result of the target transaction behavior based on the first detection result, the second detection result, and the third detection result.

10. A storage medium, characterized in that, The storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the abnormal transaction behavior detection method according to any one of claims 1-8 above are implemented.

Images