Cross-platform cross-region association analysis method suitable for network illegal transaction situation awareness

Abstract

A cross-platform and cross-region association analysis method suitable for network illegal transaction situation awareness comprises the following steps: 1) preprocessing a data set, removing redundant attribute fields and performing data repair for missing values; 2) constructing a network illegal transaction knowledge graph, determining core entity nodes, and constructing attribute edges according to the actual relationship between the nodes; 3) based on a random walk sampling strategy, performing Node2vec parameter tuning on the sub-graph, and determining an optimal walk probability parameter combination; 4) using the optimized Node2vec model to generate low-dimensional dense vector representation on the complete knowledge graph; 5) constructing a distributed similarity calculation matrix, and solving a similarity relationship between the region and a platform node vector space; and 6) according to a similarity result, analyzing a cross-platform and cross-region illegal behavior association relationship. Through the multi-dimensional feature fusion and graph embedding technology, the judgment efficiency of illegal behavior space correlation analysis is improved.

Description

Technical Field

[0001] This invention addresses the fact that current online illegal transaction detection technologies are often limited to analyzing features on a single platform or in a local area, lacking the ability to efficiently integrate heterogeneous data from multiple sources. By constructing a dynamic knowledge graph and graph embedding model, this invention addresses the coupling problem between multimodal data representation and mining the topological structure of illegal transaction networks. The invention proposes a cross-platform, cross-region, multi-dimensional correlation analysis method for illegal online transactions. Background Art

[0002] In recent years, with the rapid development of e-commerce and mobile payments, illegal transactions have also become increasingly prevalent. However, due to the anonymity and rapid transaction speed of online illegal transactions, they face challenges such as low inspection efficiency and difficulty detecting trends. Existing technologies typically rely on rule-based methods such as keyword matching and single-dimensional transaction threshold detection to identify suspicious behavior. However, such methods can only capture isolated anomalies and are limited to transactions within a single platform. They are unable to penetrate data barriers across multiple platforms to reveal the relationships among illegal transaction networks across platforms and regions, and it is even more difficult to quantify the strength of connections between illegal entities across regions.

[0003] Currently, knowledge graph-based entity relationship mining technology has been partially applied in risk monitoring scenarios. For example, node attributes are used to construct merchant credit rating graphs within e-commerce platforms. However, existing methods generally suffer from the following problems: First, they often lack a global perspective when dealing with complex network structures, making it difficult to capture complex behavioral patterns across multiple platforms and regions; second, traditional graph algorithms are computationally inefficient when processing massive amounts of multi-source data, making them unable to support real-time analysis needs; and third, cross-platform entity alignment technology relies on manual rule design, resulting in a lack of semantic connections between heterogeneous data. These issues severely restrict the accuracy and response speed of early warning models for online illegal transactions. Summary of the Invention

[0004] In response to the shortcomings of existing technologies, the present invention proposes a cross-platform and cross-regional association analysis method suitable for exploring illegal online transactions. First, a multi-source heterogeneous data processing engine is constructed to achieve standardized reconstruction of cross-platform transaction records through semantic feature analysis and data preprocessing, and a missing value repair algorithm that fills the average value is used to improve data availability. Secondly, a multimodal knowledge graph architecture is designed to map the four types of entities: administrative regions, e-commerce platforms, business entities, and commodities involved in the case, into multidimensional feature nodes. Composite relationship edges are generated by combining behavioral features such as logistics trajectories and sales links to form an extensible spatiotemporal association graph.

[0005] The present invention is achieved through the following technical solution: a cross-platform and cross-regional correlation analysis method suitable for situational awareness of illegal online transactions, the steps of which are as follows:

[0006] Step 1) Preprocess the online illegal transaction dataset, remove redundant attribute fields and invalid records, and perform data repair for missing values.

[0007] 1.1) Eliminate redundant fields: Analyze the fields in the dataset and remove redundant fields that have little correlation with illegal online transactions. Only key fields related to illegal activities are retained in the dataset: transaction time, platform information, merchant information, product information, product type, transaction location, and number of illegal transactions.

[0008] 1.2) Processing Invalid Records: Delete records with negative transaction amounts and empty transaction times, repair records with format errors, and convert the date format of the TransactionDate column in the original dataset from month / day / year hour:minute to the ISO 8601 standard format. This unified date format facilitates subsequent data processing and analysis.

[0009] 1.3) Repair missing values: For missing values in existing attribute columns, use the mean filling method to repair them. Assume that all data sets in the attribute column are (x1, x2, ..., x n ), the missing data values are filled by taking the mean value. The specific formula is as follows:

[0010]

[0011] Missing attribute column information in the source dataset is processed using a random distribution algorithm.

[0012] Step 2) Build a multi-dimensional knowledge graph of illegal online transactions, taking administrative regions, e-commerce platforms, business entities, and commodities involved as core entity nodes, constructing composite relationship edges based on the actual business relationships between nodes, and integrating attribute features for storage.

[0013] 2.1) Node Creation: The four entities of administrative regions, e-commerce platforms, business entities, and involved goods are used as core nodes in the knowledge graph. Each node contains corresponding attribute information. The nodes of administrative regions, e-commerce platforms, and business entities only contain the corresponding name identifiers, while the nodes of involved goods contain the dual attributes of merchant ID and product type.

[0014] 2.2) Relationship Edge Creation: Attribute edges are constructed based on the actual business relationship between a merchant selling goods on a certain platform, goods being sold on a certain platform, and goods circulating in a certain province. The transaction time, number of violations, provinces involved in the transaction, and product transaction attributes are stored on the merchant-platform edge. The relationship is as follows:

[0015] Merchant-platform relationship: SELLS_ON(M,P), including attributes: illegal-count, product, province-code, timestamp, transaction-id;

[0016] Product-Platform Relationship: AVAILABLE_ON(PD,P)

[0017] Merchant-province relationship: LOCATED_IN(M,PR)

[0018] Merchant-product relationship: SELLS(M,PD)

[0019] Where P represents the e-commerce platform, PD represents the goods involved in the case, M represents the business entity, and PR represents the administrative region. To distinguish between directly related edges and potentially related edges, low weights are assigned to potentially related edges, and the weights of other directly related edges are defaulted to 1.

[0020] Define a function f(p,pr) to represent the number of transactions on platform p in province pr. If f(p,pr) is zero, a potential relationship is created. The weight calculation formula is as follows:

[0021]

[0022] r.transaction_weight=f(p,pr)-r.risk_weight=f(p,pr)*0.0001;

[0023] 2.3) Graph Database Storage: Use the graph database Neo4j to store the constructed online illegal transaction knowledge graph, use the graph database's Cypher query language to query and analyze complex relationships, manage the graph database on the web page, and implement the creation, update, deletion, and retrieval of entities and their relationships.

[0024] Step 3) Based on the random walk sampling strategy, the Node2vec model optimization parameters are tuned on the subgraph dataset to determine the optimal walk probability parameter combination.

[0025] 3.1) Extracting Subgraph Datasets: Due to the large size of the initial dataset, we first extract the dataset and use the extracted lightweight dataset to construct a subgraph of illegal online transactions. Let D be the entire dataset, where |D| represents the number of samples in dataset D, and α is the split ratio. The split index i is calculated as follows:

[0026]

[0027] D small =D[i:|D|]

[0028] Where D[i:|D|] represents the subset of the dataset D from index i to |D|-1. When the data sample is large, the sample size of the light dataset is adjusted to reach the set state by adjusting α. The smaller α is, the larger the sample size of the light dataset is. When α=1, it means that the light dataset is an empty set with no data.

[0029] 3.2) Perform random walks: Random walks are a process of randomly moving on a graph. Starting from a node, the next adjacent node is randomly selected according to a certain probability, and this process is repeated until a specified number of steps are reached. Node2vec controls the behavior of random walks by introducing return parameters p and input and output parameters q. Let the current node be v, the previous node be t, and the next candidate node be x. Then the transition probability π vx The definition is as follows:

[0030]

[0031] The return parameter p controls the probability of the walk returning to the previous node; the larger the p value, the more likely the walk is to return to the previous node; the entry and exit parameter q controls the probability of the walk exploring new nodes; the larger the q value, the more likely the walk is to explore areas far away from the current node;

[0032] 3.3) Node2vec model parameter tuning, the main parameters include:

[0033] dimensions: the dimensions of the embedding vector;

[0034] walk leng : The number of steps in each random walk;

[0035] num walk : The number of random walks starting from each node;

[0036] p: Return parameter, controlling the probability of random walk returning to the previous node;

[0037] q: input and output parameter, controlling the probability of random walk to explore outward;

[0038] The node2vec model parameters p and q are continuously optimized, and a search is performed within the range of p∈[0.5,2] and q∈[0.5,2] to determine the optimal combination of p and q parameters so that the generated node sequence can retain the structural information of the graph to the greatest extent. After multiple experiments and calculations, it is determined that when p=1.2 and q=0.8, the Node2vec model can better learn the structural features of the knowledge graph. In the implementation process, the output dimension of the Node2vec model is set to 128 dimensions, walk_length=50, num_walks=300, so that the generated low-dimensional node vectors can effectively represent the node features.

[0039] Step 4) Use the optimized Node2vec model to perform multi-order neighborhood walks on the complete knowledge graph to generate a low-dimensional dense vector representation with spatial structure preservation characteristics.

[0040] 4.1) Multi-order Neighborhood Walks: We use the optimized Node2vec model to perform random walks on the knowledge graph constructed from the complete dataset. This is a biased random walk process. Based on the trained parameters p and q, we derive the order of the walks, generating a walk sequence.

[0041] 4.2) Distributed Vector Space Mapping: The sequence is input into the Skip-gram model, and the embedding vector is learned through the co-occurrence relationship in the context window W, and finally a 128-dimensional dense vector is generated. The node vector representation vi = Node2vec(G, p, q) can capture the structural information of the node in the multi-order neighborhood, representing the position and structure of the node in the graph. It realizes the mapping from the graph structure to the sequence space through the parameterized walk strategy. For the walk sequence S = (s1,…,s L ), maximize the context co-occurrence probability, the formula is as follows:

[0042]

[0043] Among them, w represents the context window size, φ(s i ) represents node s i 128-dimensional embedding vector; σ represents the sigmoid function, which maps the dot product to the probability value; φ o represents the embedding of the actual context node, φ i represents the embedding of the central node; K represents the number of negative samples, P n represents the negative sample distribution.

[0044] Step 5) Construct a distributed similarity calculation matrix and use the cosine similarity measurement algorithm to solve the bidirectional similarity relationship between the regional node vector space and the platform node vector space;

[0045] 5.1) Use the cosine similarity metric to calculate the similarity between similar nodes; suppose there is a node A=(a1,a2,…,a n ) and node B=(b1,b2,…,b n ), then the process of using the cosine similarity calculation formula to calculate the similarity between the two is as follows:

[0046]

[0047] 5.2) Construct a distributed similarity calculation matrix: Use two nested for loops to traverse all node pairs. For each pair of nodes, use the above cosine similarity formula to calculate, and finally store the calculation results in the form of a two-dimensional array.

[0048] Step 6) Based on the similarity results, analyze the cross-platform and cross-regional illegal behavior correlations and identify potential illegal behavior networks.

[0049] 6.1) Cluster analysis: The goal of K-means clustering is to cluster n samples x1, x2, ..., x n Divide into k clusters C1, C2, ..., C k , so that the sum of the squares of the distances from each sample to its cluster center is minimized, and the cluster center μ j is cluster C j The mean of all samples in , solve μ j The formula for minimizing the objective function is as follows:

[0050]

[0051] 6.2) Elbow Rule: This is used to determine the optimal number of clusters k and calculate the distortion under different k values. The distortion is defined as follows:

[0052]

[0053] 6.3) Association analysis: In the association analysis, the number of intersections between two clusters is used as the association indicator:

[0054] A ij =|C 1i ∩C 2j |

[0055] Among them A ij represents the correlation between the i-th cluster in the first cluster set and the j-th cluster in the second cluster set, C 1i and C 2j Represent the clusters in the two cluster sets respectively; through the clustering results, the potential illegal behavior network is identified.

[0056] The beneficial effects of this invention are as follows: To address the issues of multi-source data fragmentation and insufficient cross-domain correlation mining in online illegal transaction monitoring, this invention proposes a cross-platform and cross-regional illegal activity analysis method based on knowledge graphs and graph embedding technology. This method constructs a multi-dimensional knowledge graph that integrates spatiotemporal attribute features, combines the Node2vec parameter space optimization strategy to generate a low-dimensional vector representation, and uses a distributed similarity matrix to quantify the coupling strength between regions and platforms. Through the above technical solution, the present invention has realized for the first time the dynamic modeling and cross-domain correlation penetration analysis of the black market network driven by multimodal data. Specifically, it realizes the efficient fusion of multi-source heterogeneous data, unifies the scattered cross-platform transaction records into a standardized data model through semantic parsing and missing value repair algorithms, and solves the problem of feature extraction bias caused by data silos; improves the interpretability of the illegal transaction network, constructs a spatiotemporal knowledge graph using composite relationship edges, and combines multi-order neighborhood walk strategies to reveal the cross-regional collaboration model and hidden transaction links of criminal gangs; optimizes the efficiency of illegal behavior discovery, and enhances the Node2vec model's ability to characterize illegal transaction features through a parameter adaptive tuning mechanism; strengthens the cross-platform collaborative crackdown capability, identifies cross-domain abnormal transaction communities based on the cosine similarity matrix and spectral clustering algorithm, and helps regulatory authorities accurately locate core illegal nodes. The promotion and application of the present invention will effectively predict and stop the cross-platform spread trend of network black industries, and provide intelligent analysis tools for maintaining the ecological security of the digital economy. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] Figure 1 Flow chart of the method of the present invention. DETAILED DESCRIPTION

[0058] A cross-platform and cross-region correlation analysis method suitable for situation awareness of illegal online transactions, comprising the following steps:

[0059] Step 1) Preprocess the online illegal transaction dataset, remove redundant attribute fields and invalid records, and perform data repair for missing values.

[0060] 1.1) Eliminate redundant fields: Analyze the fields in the dataset and remove redundant fields that have little correlation with illegal online transactions. Only key fields related to illegal activities are retained in the dataset: transaction time, platform information, merchant information, product information, product type, transaction location, and number of illegal transactions.

[0061] 1.2) Processing Invalid Records: Delete records with negative transaction amounts and empty transaction times, repair records with format errors, and convert the date format of the TransactionDate column in the original dataset from month / day / year hour:minute to the ISO 8601 standard format. This unified date format facilitates subsequent data processing and analysis.

[0062] 1.3) Repair missing values: For missing values in existing attribute columns, use the mean filling method to repair them. Assume that all data sets in the attribute column are (x1, x2, ..., x n ), the missing data values are filled by taking the mean value. The specific formula is as follows:

[0063]

[0064] Missing attribute column information in the source dataset is processed using a random distribution algorithm.

[0065] Step 2) Build a multi-dimensional knowledge graph of illegal online transactions, taking administrative regions, e-commerce platforms, business entities, and commodities involved as core entity nodes, constructing composite relationship edges based on the actual business relationships between nodes, and integrating attribute features for storage.

[0066] 2.1) Node Creation: The four entities of administrative regions, e-commerce platforms, business entities, and involved goods are used as core nodes in the knowledge graph. Each node contains corresponding attribute information. The nodes of administrative regions, e-commerce platforms, and business entities only contain the corresponding name identifiers, while the nodes of involved goods contain the dual attributes of merchant ID and product type.

[0067] 2.2) Relationship Edge Creation: Attribute edges are constructed based on the actual business relationship between a merchant selling goods on a certain platform, goods being sold on a certain platform, and goods circulating in a certain province. The transaction time, number of violations, provinces involved in the transaction, and product transaction attributes are stored on the merchant-platform edge. The relationship is as follows:

[0068] Merchant-platform relationship: SELLS_ON(M,P), including attributes: illegal-count, product, province-code, timestamp, transaction-id;

[0069] Product-Platform Relationship: AVAILABLE_ON(PD,P)

[0070] Merchant-province relationship: LOCATED_IN(M,PR)

[0071] Merchant-product relationship: SELLS(M,PD)

[0072] Where P represents the e-commerce platform, PD represents the goods involved in the case, M represents the business entity, and PR represents the administrative region. To distinguish between directly related edges and potentially related edges, low weights are assigned to potentially related edges, and the weights of other directly related edges are defaulted to 1.

[0073] Define a function f(p,pr) to represent the number of transactions on platform p in province pr. If f(p,pr) is zero, a potential relationship is created. The weight calculation formula is as follows:

[0074]

[0075] r.transaction_weight=f(p,pr)-r.risk_weight=f(p,pr)*0.0001;

[0076] 2.3) Graph Database Storage: Use the graph database Neo4j to store the constructed online illegal transaction knowledge graph, use the graph database's Cypher query language to query and analyze complex relationships, manage the graph database on the web page, and implement the creation, update, deletion, and retrieval of entities and their relationships.

[0077] Step 3) Based on the random walk sampling strategy, the Node2vec model optimization parameters are tuned on the subgraph dataset to determine the optimal walk probability parameter combination.

[0078] 3.1) Extracting Subgraph Datasets: Due to the large size of the initial dataset, we first extract the dataset and use the extracted lightweight dataset to construct a subgraph of illegal online transactions. Let D be the entire dataset, where |D| represents the number of samples in dataset D, and α is the split ratio. The split index i is calculated as follows:

[0079]

[0080] D small =D[i:|D|]

[0081] Where D[i:|D|] represents the subset of the dataset D from index i to |D|-1. When the data sample is large, the sample size of the light dataset is adjusted to reach the set state by adjusting α. The smaller α is, the larger the sample size of the light dataset is. When α=1, it means that the light dataset is an empty set with no data.

[0082] 3.2) Perform random walks: Random walks are a process of randomly moving on a graph. Starting from a node, the next adjacent node is randomly selected according to a certain probability, and this process is repeated until a specified number of steps are reached. Node2vec controls the behavior of random walks by introducing return parameters p and input and output parameters q. Let the current node be v, the previous node be t, and the next candidate node be x. Then the transition probability π vx The definition is as follows:

[0083]

[0084] The return parameter p controls the probability of the walk returning to the previous node; the larger the p value, the more likely the walk is to return to the previous node; the entry and exit parameter q controls the probability of the walk exploring new nodes; the larger the q value, the more likely the walk is to explore areas far away from the current node;

[0085] 3.3) Node2vec model parameter tuning, the main parameters include:

[0086] dimensions: the dimensions of the embedding vector;

[0087] walk lengt : The number of steps in each random walk;

[0088] num wal : The number of random walks starting from each node;

[0089] p: Return parameter, controlling the probability of random walk returning to the previous node;

[0090] q: input and output parameter, controlling the probability of random walk to explore outward;

[0091] The node2vec model parameters p and q are continuously optimized, and a search is performed within the range of p∈[0.5,2] and q∈[0.5,2] to determine the optimal combination of p and q parameters so that the generated node sequence can retain the structural information of the graph to the greatest extent. After multiple experiments and calculations, it is determined that when p=1.2 and q=0.8, the Node2vec model can better learn the structural features of the knowledge graph. In the implementation process, the output dimension of the Node2vec model is set to 128 dimensions, walk_length=50, num_walks=300, so that the generated low-dimensional node vectors can effectively represent the node features.

[0092] Step 4) Use the optimized Node2vec model to perform multi-order neighborhood walks on the complete knowledge graph to generate a low-dimensional dense vector representation with spatial structure preservation characteristics.

[0093] 4.1) Multi-order Neighborhood Walks: We use the optimized Node2vec model to perform random walks on the knowledge graph constructed from the complete dataset. This is a biased random walk process. Based on the trained parameters p and q, we derive the order of the walks, generating a walk sequence.

[0094] 4.2) Distributed Vector Space Mapping: The sequence is input into the Skip-gram model, and the embedding vector is learned through the co-occurrence relationship in the context window W, and finally a 128-dimensional dense vector is generated. The node vector representation vi = Node2vec(G, p, q) can capture the structural information of the node in the multi-order neighborhood, representing the position and structure of the node in the graph. It realizes the mapping from the graph structure to the sequence space through the parameterized walk strategy. For the walk sequence S = (s1,…,s L ), maximize the context co-occurrence probability, the formula is as follows:

[0095]

[0096] Among them, w represents the context window size, φ(s i ) represents node s i 128-dimensional embedding vector; σ represents the sigmoid function, which maps the dot product to the probability value; φ o represents the embedding of the actual context node, φ i represents the embedding of the central node; K represents the number of negative samples, P n represents the negative sample distribution.

[0097] Step 5) Construct a distributed similarity calculation matrix and use the cosine similarity measurement algorithm to solve the bidirectional similarity relationship between the regional node vector space and the platform node vector space;

[0098] 5.1) Use the cosine similarity metric to calculate the similarity between similar nodes; suppose there is a node A=(a1,a2,…,a n ) and node B=(b1,b2,…,b n ), then the process of using the cosine similarity calculation formula to calculate the similarity between the two is as follows:

[0099]

[0100] 5.2) Construct a distributed similarity calculation matrix: Use two nested for loops to traverse all node pairs. For each pair of nodes, use the above cosine similarity formula to calculate, and finally store the calculation results in the form of a two-dimensional array.

[0101] Step 6) Based on the similarity results, analyze the cross-platform and cross-regional illegal behavior correlations and identify potential illegal behavior networks.

[0102] 6.1) Cluster analysis: The goal of K-means clustering is to cluster n samples x1, x2, ..., x n Divide into k clusters C1, C2, ..., C k, so that the sum of the squares of the distances from each sample to its cluster center is minimized, and the cluster center μ i is cluster C j The mean of all samples in , solve μ j The formula for minimizing the objective function is as follows:

[0103]

[0104]

[0105] 6.2) Elbow Rule: This is used to determine the optimal number of clusters k and calculate the distortion under different k values. The distortion is defined as follows:

[0106]

[0107] 6.3) Association analysis: In the association analysis, the number of intersections between two clusters is used as the association indicator:

[0108] A ij =|C 1i ∩C 2j |

[0109] Among them A ij represents the correlation between the i-th cluster in the first cluster set and the j-th cluster in the second cluster set, C 1i and C 2j Represent the clusters in the two cluster sets respectively; through the clustering results, the potential illegal behavior network is identified.

[0110] Example 1:

[0111] Assume that there are three administrative regions, A, B, and C, in a certain area, involving two e-commerce platforms, X and Y. The illegal transaction data set is as follows, and five data are displayed. The verification steps are as follows:

[0112] Transaction ID Trading Hours Transaction quantity platform area commodity Seller ID 001 2023-10-01 3 X First Illegal health products A 002 2023-10-02 2 Y Second counterfeit cosmetics B 003 2023-10-03 5 X First Illegal health products - 004 2023-10-01 5 X C counterfeit cosmetics A 005 2023-10-02 3 Y Second Illegal health products B

[0113] First, we eliminated redundant fields: Delete "Transaction ID." The missing seller ID for transaction 003 was replaced with A (a high-frequency seller on the same platform, X). Since there were no invalid records, we retained all five entries.

[0114] Next, we construct a transaction graph based on the four major components: administrative regions (A, B, C), platforms (X, Y), commodities, and business entities. The transaction edges are defined as "Platform X - Sales - Illegal Health Products", "Seller A - Located in Region A", "Seller A - Sales - Counterfeit Cosmetics", and "Seller A - Has a Store - Platform X".

[0115] Because the data volume is too small, no subdivision is required. Based on the actual situation, the parameters are optimized on the graph (optimal p = 0.8, q = 1.2) to generate a 32-dimensional vector of the nodes in the entire graph. Finally, the platform nodes and region nodes are stored in vectors separately (for example: the platform X vector is V_x, and the region A vector is V_A). Finally, the association matrix is solved using cosine similarity:

[0116] Table 1 Similarity matrix between platforms

[0117] Platform X Platform Y Platform X 1.00 0.83 Platform Y 0.83 1.00

[0118] Table 2 Inter-region similarity matrix

[0119] First Second C First 1.00 0.91 0.62 Second 0.91 1.00 0.78 C 0.62 0.78 1.00

[0120] Results analysis: The similarity between platforms X and Y reached 0.83, indicating that there is overlap in products or sellers between the two. The similarity between A and B is 0.91 (very high), and the similarity between B and C is 0.78 (moderate), suggesting that B is a transit hub for cross-regional transactions.

Claims

1. A cross-platform and cross-regional correlation analysis method suitable for situation awareness of illegal online transactions, characterized by: The steps are: Step 1) Preprocess the online illegal transaction dataset, remove redundant attribute fields and invalid records, and perform data repair for missing values; Step 2) Build a multi-dimensional knowledge graph of illegal online transactions, taking administrative regions, e-commerce platforms, business entities, and commodities involved as core entity nodes, constructing composite relationship edges based on the actual business relationships between nodes, and integrating attribute features for storage; Step 3) Based on the random walk sampling strategy, the Node2vec model optimization parameters are tuned on the subgraph dataset to determine the optimal walk probability parameter combination; Step 4) Use the optimized Node2vec model to perform multi-order neighborhood walks on the complete knowledge graph to generate a low-dimensional dense vector representation with spatial structure preservation characteristics; Step 5) Construct a distributed similarity calculation matrix and use the cosine similarity measurement algorithm to solve the bidirectional similarity relationship between the regional node vector space and the platform node vector space; Step 6) Based on the similarity results, analyze the cross-platform and cross-regional illegal behavior correlations and identify potential illegal behavior networks.

2. The cross-platform and cross-regional correlation analysis method for network illegal transaction situation awareness according to claim 1 is characterized in that: In the step 1), the specific method is: 1.1) Eliminate redundant fields: Analyze the fields in the dataset and remove redundant fields that have little correlation with illegal online transactions. Only key fields related to illegal activities are retained in the dataset: transaction time, platform information, merchant information, product information, product type, transaction location, and number of illegal transactions. 1.2) Processing Invalid Records: Delete records with negative transaction amounts and empty transaction times, repair records with format errors, and convert the date format of the TransactionDate column in the original dataset from month / day / year hour:minute to the ISO 8601 standard format. This unified date format facilitates subsequent data processing and analysis. 1.3) Repair missing values: For missing values in existing attribute columns, use the mean filling method to repair them. Assume that all data sets in the attribute column are (x1, x2, ..., x n ), the missing data values are filled by taking the mean value. The specific formula is as follows: The missing attribute column information in the source data set is processed using a random distribution algorithm.

3. The cross-platform and cross-regional correlation analysis method for network illegal transaction situation awareness according to claim 1 is characterized in that: In the step 2), the specific method is: 2.1) Node Creation: The four entities of administrative regions, e-commerce platforms, business entities, and involved goods are used as core nodes in the knowledge graph. Each node contains corresponding attribute information. The nodes of administrative regions, e-commerce platforms, and business entities only contain the corresponding name identifiers, while the nodes of involved goods contain the dual attributes of merchant ID and product type. 2.2) Relationship Edge Creation: Attribute edges are constructed based on the actual business relationship between a merchant selling goods on a certain platform, goods being sold on a certain platform, and goods circulating in a certain province. The transaction time, number of violations, provinces involved in the transaction, and product transaction attributes are stored on the merchant-platform edge. The relationship is as follows: Merchant-platform relationship: SELLS_ON(M,P), including attributes: illegal-count, product, province-code, timestamp, transaction-id; Product-Platform Relationship: AVAILABLE_ON(PD,P) Merchant-province relationship: LOCATED_IN(M,PR) Merchant-product relationship: SELLS(M,PD) Where P represents the e-commerce platform, PD represents the goods involved in the case, M represents the business entity, and PR represents the administrative region. To distinguish between directly related edges and potentially related edges, low weights are assigned to potentially related edges, and the weights of other directly related edges are defaulted to 1. Define a function f(p,pr) to represent the number of transactions on platform p in province pr. If f(p,pr) is zero, a potential relationship is created. The weight calculation formula is as follows: r.transaction_weight=f(p,pr)-r.risk_weight=f(p,pr)*0.0001; 2.3) Graph Database Storage: Use the graph database Neo4j to store the constructed online illegal transaction knowledge graph, use the graph database's Cypher query language to query and analyze complex relationships, manage the graph database on the web page, and implement the creation, update, deletion, and retrieval of entities and their relationships.

4. The cross-platform and cross-regional correlation analysis method for network illegal transaction situation awareness according to claim 1 is characterized in that: In the step 3), the specific method is: 3.1) Extracting Subgraph Datasets: Due to the large size of the initial dataset, we first extract the dataset and use the extracted lightweight dataset to construct a subgraph of illegal online transactions. Let D be the entire dataset, where |D| represents the number of samples in dataset D, and α is the split ratio. The split index i is calculated as follows: D small =D[i:|D|] Among them, D[i:|D|] represents the subset of the dataset D from index i to |D|-1. When the data sample is large, the sample size of the lightweight dataset is adjusted to reach the set state by adjusting α. The smaller α is, the larger the sample size of the lightweight dataset is. When α=1, Indicates that the light dataset is an empty set and has no data; 3.2) Perform random walks: Random walks are a process of randomly moving on a graph. Starting from a node, the next adjacent node is randomly selected according to a certain probability, and this process is repeated until a specified number of steps are reached. Node2vec controls the behavior of random walks by introducing return parameters p and input and output parameters q. Let the current node be v, the previous node be t, and the next candidate node be x. Then the transition probability π vx The definition is as follows: The return parameter p controls the probability of the walk returning to the previous node; the larger the p value, the more likely the walk is to return to the previous node; the entry and exit parameter q controls the probability of the walk exploring new nodes; the larger the q value, the more likely the walk is to explore areas far away from the current node; 3.3) Node2vec model parameter tuning, the main parameters include: dimensions: the dimensions of the embedding vector; walk len : The number of steps in each random walk; num walks : The number of random walks starting from each node; p: Return parameter, controlling the probability of the random walk returning to the previous node; q: input and output parameter, controlling the probability of random walk to explore outward; The node2vec model parameters p and q are continuously optimized, and a search is performed within the range of p∈[0.5,2] and q∈[0.5,2] to determine the optimal combination of p and q parameters so that the generated node sequence can retain the structural information of the graph to the greatest extent. After multiple experiments and calculations, it is determined that when p=1.2 and q=0.8, the Node2vec model can better learn the structural features of the knowledge graph. In the implementation process, the output dimension of the Node2vec model is set to 128 dimensions, walk_length=50, num_walks=300, so that the generated low-dimensional node vectors can effectively represent the node features.

5. The cross-platform and cross-regional correlation analysis method for network illegal transaction situation awareness according to claim 1 is characterized in that: In the step 4), the specific method is: 4.1) Multi-order Neighborhood Walks: We use the optimized Node2vec model to perform random walks on the knowledge graph constructed from the complete dataset. This is a biased random walk process. Based on the trained parameters p and q, we derive the order of the walks, generating a walk sequence. 4.2) Distributed Vector Space Mapping: The sequence is input into the Skip-gram model, and the embedding vector is learned through the co-occurrence relationship in the context window W, and finally a 128-dimensional dense vector is generated. The node vector representation vi = Node2vec(G, p, q) can capture the structural information of the node in the multi-order neighborhood, representing the position and structure of the node in the graph. It realizes the mapping from the graph structure to the sequence space through the parameterized walk strategy. For the walk sequence S = (s1,…,s L ), maximize the context co-occurrence probability, the formula is as follows: Among them, w represents the context window size, φ(s i ) represents node s i 128-dimensional embedding vector; σ represents the sigmoid function, which maps the dot product to the probability value; φ o represents the embedding of the actual context node, φ i represents the embedding of the central node; K represents the number of negative samples, P n represents the negative sample distribution.

6. The cross-platform and cross-regional correlation analysis method for network illegal transaction situation awareness according to claim 1 is characterized in that: In the step 5), the specific method is: 5.1) Use the cosine similarity metric to calculate the similarity between similar nodes; suppose there is a node A=(a1,a2,…,a n ) and node B=(b1,b2,…,b n ), then the process of using the cosine similarity calculation formula to calculate the similarity between the two is as follows: 5.2) Construct a distributed similarity calculation matrix: Use two nested for loops to traverse all node pairs. For each pair of nodes, use the above cosine similarity formula to calculate, and finally store the calculation results in the form of a two-dimensional array.

7. The cross-platform and cross-regional correlation analysis method for network illegal transaction situation awareness according to claim 1 is characterized in that: In the step 6), the specific method is: 6.1) Cluster analysis: The goal of K-means clustering is to cluster n samples x1, x2, ..., x n Divide into k clusters C1, C2, ..., C k , so that the sum of the squares of the distances from each sample to its cluster center is minimized, and the cluster center μ j is cluster C j The mean of all samples in , solve μ j The formula for minimizing the objective function is as follows: 6.2) Elbow Rule: This is used to determine the optimal number of clusters k and calculate the distortion under different k values. The distortion is defined as follows: 6.3) Association analysis: In the association analysis, the number of intersections between two clusters is used as the association indicator: A ij =|C 1i ∩C 2j | Among them A ij represents the correlation between the i-th cluster in the first cluster set and the j-th cluster in the second cluster set, C 1i and C 2j Represent the clusters in the two cluster sets respectively; through the clustering results, the potential illegal behavior network is identified.

Images