Order management system based on online payment and payment security management and control method

Abstract

The invention relates to the technical field of order management, in particular to an order management system based on online payment and a payment safety management and control method, and the system comprises a behavior sequence recognition module, a sequence offset comparison module, a state chain construction module, a jump imbalance detection module and a risk level linkage module. According to the invention, through comparison of behavior data of multiple successful transactions, a standardized payment process can be established, abnormal behavior deviation can be effectively identified, the execution sequence of the payment process can be accurately evaluated through time difference analysis, potential risks can be discovered, the traceability of the payment process can be enhanced, and the payment efficiency can be improved. The construction of the state chain and the sorting check ensure that the state circulation accords with logic, reverse, repeated or abnormal jump can be identified in time, the abnormal frequency of behavior offset and state jump is combined, a multi-dimensional risk assessment standard is adopted, a risk order is identified and frozen in real time, the abnormity in the payment process is accurately identified, and the payment security and stability are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of order management, and in particular to an order management system based on online payment and a payment security control method. Background Art

[0002] The field of order management technology encompasses the research and application of technologies for order generation, processing, tracking, and management within the commodity transaction process. Core areas include the collection of order information, updating order status, controlling the order process, and storing and querying order data. With the rapid development of e-commerce and online transactions, order management technology is evolving towards automation, digitization, and networking. It encompasses every process node from front-end order placement to back-end processing, including user order submission, system inventory verification, shipment scheduling, payment confirmation, and subsequent return and exchange management. It designs and optimizes key business logic within the order lifecycle to ensure the orderly execution of transactions and the efficient flow of information.

[0003] Among them, the online payment-based order management system refers to a full-process management system for orders that complete payment through the Internet in e-commerce transactions. It covers the establishment of a link between order and payment information, real-time monitoring of online payment status, automatic order confirmation processing after successful payment, order freezing mechanisms in the event of payment anomalies, and technical content for categorizing and managing orders based on payment channels. Generally, it is achieved by building a unified order payment processing logic, binding user-submitted order requests with payment channels, and completing dynamic order management by setting order processing processes corresponding to different payment statuses. In addition, by setting payment time node monitoring rules and automated processing rules, it ensures that the order process can be automatically processed after payment is completed.

[0004] The existing payment order management process usually relies on static rules or time-based sequential updates to control the order process. However, in the face of the variability and complexity of user behavior, it cannot provide sufficient flexibility and accuracy. For example, the existing technology is relatively simple in behavior recognition during the payment process, and fails to deeply explore the behavioral differences between different users in different transaction scenarios, resulting in the inability to capture potential risky behaviors in a timely manner. The tracking of order status changes mostly relies on timestamps and static field records, lacking dynamic analysis based on complete behavioral paths, which affects the real-time monitoring ability of abnormal jumps. In addition, risk assessment is often based on a single payment status and fixed process, ignoring the subtle differences between different payment paths and user operation patterns, which can easily lead to delayed risk identification. Especially when users frequently switch payment methods or abnormal order status occurs, the system is prone to ignore related risks, resulting in high missed detection and false positive rates. Summary of the Invention

[0005] The purpose of the present invention is to solve the shortcomings of the prior art and to propose an order management system based on online payment and a payment security control method.

[0006] In order to achieve the above-mentioned purpose, the present invention adopts the following technical solution: an order management system based on online payment includes:

[0007] The behavior sequence recognition module obtains successful transaction records under the user account during the online payment process, collects the complete behavior process of each order from user login to payment confirmation, selects behavior nodes, cross-references the time and location of the occurrence of behavior nodes of the same type, and generates a standard account behavior process set;

[0008] The sequence offset comparison module obtains the real-time behavior process of the current payment order based on the account standard behavior process set, arranges the behavior nodes in chronological order, calculates the time interval difference between the same behavior nodes in the two processes, and sums them to obtain the total amount of payment operation process offset;

[0009] The state chain construction module obtains all status change records of the current payment order, collects the trigger times of the status events such as pending payment, payment processing, payment confirmation, payment failure, and refund, connects the states in chronological order according to the change path, and constructs the order status change path set;

[0010] The jump imbalance detection module combines all state nodes in the order state change path set, selects the order relationship between adjacent states, compares the state logic process, counts the number of state jumps with sequence abnormalities in the process, and generates a state jump abnormality frequency.

[0011] As a further solution of the present invention, the account standard behavior process set includes behavior node time distribution characteristics, node appearance sequence characteristics, and standard behavior path patterns; the total payment operation process offset includes the cumulative value of behavior node time differences, behavior path similarity offset value, and process timing consistency offset value; the order status change path set includes the state evolution path structure, state node time chain, and state evolution logic hierarchy; the state jump abnormality frequency includes the number of state jump sequence abnormalities, the number of state jump backtracking repetitions, and the state jump logic deviation index.

[0012] As a further solution of the present invention, the behavior sequence recognition module includes:

[0013] The behavior process collection submodule obtains three consecutive successful transaction records under the user account, collects the complete behavior process of each order from user login to payment confirmation, extracts the data of each behavior node of each order, including user login, browsing products, adding to shopping cart, selecting payment method, entering verification code, and confirming payment, records the original position and timestamp of the node in the behavior sequence, and generates behavior node timing information;

[0014] The node time positioning submodule marks the time positions of the same type of behavior nodes in the three orders based on the behavior node timing information, calculates the standard deviation and average offset value of the node time distribution in each order, determines the time consistency level of each behavior node in different orders, and obtains the node position consistency index;

[0015] The standard process generation submodule sorts all behavior nodes from low to high according to the time consistency index based on the node position consistency index, selects the behavior nodes with the smallest offset difference among all orders, constructs a time position alignment sequence, extracts node names and positions, reconstructs the standardized behavior path order, and generates an account standard behavior process set.

[0016] As a further embodiment of the present invention, the sequence offset comparison module includes:

[0017] The real-time process collection submodule obtains the entire behavior process of the current payment order from user login to payment trigger, collects the occurrence time of all behavior nodes and records the node sequence, arranges the node events in ascending order of timestamps, and generates real-time behavior sequence data;

[0018] The node interval calculation submodule combines the real-time behavior sequence data with the account standard behavior process set, matches the same behavior nodes in the two sequences, compares the timestamps of each group of identical behavior nodes, calculates the time interval difference between the corresponding nodes in the two processes, records all interval differences in the order of behavior nodes, and generates a node interval difference sequence;

[0019] The offset total generation submodule calculates the sum of the time interval difference values of all behavior nodes according to the node interval difference sequence, using the formula:

[0020]

[0021] Calculate the total amount of payment operation process offset M, where A i Indicates the timestamp of the i-th node in the account standard process, B i Represents the timestamp of the i-th node in the real-time process, represents the average time of all nodes in the standard process, Δ i It represents the index position difference of the i-th node in the two processes, and n represents the total number of nodes.

[0022] As a further solution of the present invention, the state chain building module includes:

[0023] The status change collection submodule obtains all status change records of the current payment order from the pending payment state to the current processing node, collects various status events and their triggering time, including pending payment, payment processing, payment confirmation, payment failure, and refund, and generates status change time records;

[0024] The state path connection submodule sorts different state events in chronological order based on the state change time record, connects the state change events according to the change path, and forms a state change path sequence;

[0025] The change path set generation submodule sorts all potential state change paths according to the state change path sequence, removes duplicate paths, and generates an order state change path set.

[0026] As a further solution of the present invention, the jump imbalance detection module includes:

[0027] The state sequence verification submodule selects the order relationship between adjacent states based on all state nodes in the order state change path set, verifies the state logic flow that pending payment takes precedence over payment in progress, and payment in progress takes precedence over payment confirmation, identifies all illogical state relationships, and generates a state sequence verification result;

[0028] The abnormal jump identification submodule identifies any state relationship with reversed order or repeated return according to the state sequence verification result, filters all state pairs with abnormal jumps, marks specific nodes with abnormal jumps, and generates an abnormal jump node set;

[0029] The jump abnormality frequency statistics submodule counts the number of state jumps with sequence abnormalities in the process according to the abnormal jump node set, using the formula:

[0030]

[0031] Calculate the abnormal frequency value F of each state jump and generate the state jump abnormal frequency, where X i represents the time interval of the i-th jump, Y i represents the standard time interval of the i-th jump, μ X represents the mean of all jump intervals, Z i represents the state offset of the i-th jump, and m represents the total number of jumps.

[0032] As a further solution of the present invention, the system further includes a risk level linkage module;

[0033] The risk level linkage module performs an independent judgment operation based on the total amount of operation process deviation and the abnormal frequency of state jump, combined with the preset behavior process deviation judgment threshold and state jump abnormality judgment threshold. If any one item exceeds the corresponding judgment threshold, it is marked as a medium-risk order. If both items exceed the judgment threshold, it is marked as a high-risk order. The current order risk status is determined, and the online payment risk order process freezing operation is executed simultaneously to obtain the risk order security management record.

[0034] The risk order security management and control records include risk level marking information, freezing process execution records, and risk control response execution status.

[0035] As a further solution of the present invention, the risk level linkage module includes:

[0036] The behavior deviation judgment submodule performs an independent judgment operation based on the total amount of operation process deviation and a preset behavior process deviation judgment threshold. If the total amount of operation process deviation exceeds the threshold, it is marked as a medium-risk order and a behavior deviation risk level is generated;

[0037] The state jump abnormality judgment submodule performs an independent judgment operation based on the state jump abnormality frequency and the preset state jump abnormality judgment threshold. If the state jump abnormality frequency exceeds the threshold, it is marked as a medium risk order and the state jump abnormality risk level is generated;

[0038] The risk status marking submodule determines whether the behavior deviation risk level and the state jump abnormal risk level both exceed the corresponding judgment thresholds at the same time based on the behavior deviation risk level and the state jump abnormal risk level. If both exceed the threshold, it is marked as a high-risk order; otherwise, it is marked as a medium-risk order, and the online payment risk order process freezing operation is executed simultaneously to generate a risk order security management record.

[0039] A method for managing payment security based on online payment, comprising the following steps:

[0040] S1: Obtain the time from the user's login to payment confirmation node for successful transactions, filter and align the trigger time nodes, and generate a set of standard account behavior processes;

[0041] S2: Based on the account behavior node time set, collect the trigger time of the operation behavior nodes in the current payment order, calculate the sum of the difference between each node and the standard time, and obtain the total amount of payment operation process offset;

[0042] S3: Obtain the time nodes of order status changes, connect the time of each status from pending payment to confirmed payment, identify whether the states meet the logical sequence, and generate a set of order status change paths;

[0043] S4: Based on the set of order status change paths, count the number of order reversals and repeated returns in the order status paths to obtain the abnormal frequency of status jumps;

[0044] S5: Based on the total amount of the payment operation process deviation and the abnormal state jump frequency, the behavior deviation is compared with the jump abnormality threshold, the risk order freezing action is executed, and the risk order security management record is generated.

[0045] Compared with the prior art, the advantages and positive effects of the present invention are:

[0046] In the present invention, by collecting and comparing the behavioral processes of multiple successful transactions under user accounts, a standardized process for user payment behavior can be established, thereby identifying deviations in abnormal behavior, and quantitatively analyzing the time difference of behavioral nodes. It can accurately evaluate the execution order and rhythm of the payment process, discover potential risk operations, and enhance the traceability and security of the payment process. By constructing a state chain for the entire life cycle and performing strict sorting checks on it, it is ensured that the state flow complies with the established logical rules, and can effectively identify any reverse, repeated or unreasonable state jumps, discover abnormal risks in advance, combine the offset of the behavioral path with the abnormal frequency of state jumps, and formulate multi-dimensional risk assessment standards. By triggering the threshold judgment mechanism, the order risk can be frozen and processed in time when it is confirmed, thereby providing real-time security management and control, and improving the order's responsiveness and risk prevention and control effects. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 is a system flow chart of the present invention;

[0048] Figure 2 This is a flow chart of the behavior sequence recognition module of the present invention;

[0049] Figure 3 This is a flow chart of the sequence offset alignment module of the present invention;

[0050] Figure 4 A flow chart of the state chain building module of the present invention;

[0051] Figure 5 This is a flow chart of the jump imbalance detection module of the present invention;

[0052] Figure 6 This is a flow chart of the risk level linkage module of the present invention. DETAILED DESCRIPTION

[0053] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0054] In the description of the present invention, it should be understood that the terms "length," "width," "up," "down," "front," "back," "left," "right," "vertical," "horizontal," "top," "bottom," "inside," "outside," and the like, indicating positions or relationships, are based on the positions or relationships shown in the accompanying drawings and are intended only to facilitate the description of the present invention and simplify the description. They do not indicate or imply that the devices or elements referred to must have a specific orientation, be constructed, or operate in a specific orientation. Therefore, they should not be construed as limiting the present invention. Furthermore, in the description of the present invention, "plurality" means two or more, unless otherwise expressly and specifically defined.

[0055] See also Figure 1 , an order management system based on online payment includes:

[0056] The behavior sequence recognition module obtains three consecutive successful transaction records from a user's account during the online payment process. It collects the complete behavior flow of each order from user login to payment confirmation. It selects user login, product browsing, adding to shopping cart, payment method selection, verification code input, and payment confirmation as behavior nodes. It cross-references the time and location of the occurrence of the same type of behavior nodes to generate a standard account behavior flow set.

[0057] The sequence offset comparison module obtains the real-time behavior flow of the current payment order from user login to payment trigger based on the account standard behavior flow set. It collects the occurrence time of all behavior nodes and arranges them in chronological order. It calculates the time difference between the same behavior nodes in two flows and sums them to obtain the total payment operation flow offset.

[0058] The state chain construction module obtains all state change records of the current payment order from the pending payment state to the current processing node, collects the trigger times of the state events such as pending payment, payment processing, payment confirmation, payment failure, and refund, connects the states in chronological order according to the change path, and constructs the order state change path set;

[0059] The jump imbalance detection module combines all state nodes in the order status change path set, selects the order relationship between adjacent states, and compares the state logic flow where pending payment takes precedence over payment processing, and payment processing takes precedence over payment confirmation. It identifies any state relationships with reversed order or repeated returns, and counts the number of state jumps with abnormal order in the process to generate the state jump abnormality frequency.

[0060] The risk level linkage module performs independent judgment operations based on the total amount of operation process deviations and the frequency of abnormal state jumps, combined with the preset behavior process deviation judgment threshold and state jump abnormality judgment threshold. If any one item exceeds the corresponding judgment threshold, it is marked as a medium-risk order. If both items exceed the judgment threshold, it is marked as a high-risk order. The current order risk status is determined, and the online payment risk order process freezing operation is executed simultaneously to obtain the risk order security management record.

[0061] The standard account behavior process set includes the time distribution characteristics of behavior nodes, the node appearance sequence characteristics, and the standard behavior path pattern. The total amount of payment operation process offset includes the cumulative value of behavior node time difference, the behavior path similarity offset value, and the process timing consistency offset value. The order status change path set includes the state evolution path structure, the state node time chain, and the state evolution logical hierarchy. The state jump abnormality frequency includes the number of state jump sequence abnormalities, the number of state jump backtracking repetitions, and the state jump logic deviation index. The risk order security management and control records include risk level labeling information, freezing process execution records, and risk control response execution status.

[0062] See also Figure 2 , the behavior sequence recognition module includes:

[0063] The behavior process collection submodule obtains three consecutive successful transaction records under the user account, collects the complete behavior process of each order from user login to payment confirmation, extracts the data of each behavior node of each order, including user login, browsing products, adding to shopping cart, selecting payment method, entering verification code, and confirming payment, records the original position and timestamp of the node in the behavior sequence, and generates behavior node timing information;

[0064] When obtaining three consecutive successful transaction records under a user account, it is necessary to select transaction flows with a status code of "paid" and a payment time within 7 days before the current system time from the database, limit them to the same account name and sort them in order of transaction time, and filter out three consecutive successful records to prevent non-continuous transactions from disrupting the behavior pattern judgment. For example, if the account "U123" has successfully paid three orders in the past 7 days, namely T1, T2, and T3, they are used as samples of this behavior sequence. During the behavior sequence of each order from user login to payment confirmation, the behavior event records of each order are first parsed according to the server log, and specific behavior records such as user login time, page browsing path, product click, shopping cart addition, payment method selection, verification code input, and payment confirmation click are extracted.

[0065] For example, the behavior path in T1 is Login→View→Cart→PaySel→Verify→Confirm. Each behavior node in this path has timestamp information, such as the login time is 2025-03-2010:23:11, the browsing time of the product page is 12 seconds, the delay of adding to the shopping cart operation is 5 seconds, etc. Next, each node behavior needs to be refined. In the parsed log, the keyword extraction method is used to determine the behavior category for each type of behavior event. The behavior is classified and archived based on the behavior keywords (such as "login", "addToCart", "submitOrder", etc.), and the corresponding timestamps are extracted and recorded in the two-dimensional behavior sequence matrix. In the matrix, rows represent different orders and columns represent the same node type. On this basis, the six behavior nodes of each order are recorded separately to obtain a combined data array of behavior time and node type, and then the original behavior time series table is constructed. For behavior nodes such as login, browsing, and payment, it is necessary to check again whether they appear in all three orders. If a node is missing, the validity of the node in subsequent processing is eliminated to prevent the behavior trajectory deviation caused by incomplete nodes. At the same time, for behavior nodes such as "browsing products", if there are multiple repeated records, the time of the first occurrence is uniformly extracted as the behavior positioning point of the node. Through the above processing, a behavior structure matrix containing the timestamps and sequential positions of each key behavior node in each order is finally generated.

[0066] The node time positioning submodule marks the time positions of the same type of behavior nodes in three orders based on the behavior node timing information, calculates the standard deviation and average offset value of the node time distribution in each order, determines the time consistency level of each behavior node in different orders, and obtains the node position consistency index;

[0067] Based on the timing information of the behavior nodes, we first locate the timestamp sequence of each type of behavior node in the three orders. For example, for the "enter verification code" behavior node, if the timestamps in T1, T2, and T3 are 10:23:41, 11:45:12, and 09:30:55, respectively, then the behavior node time array {37421, 42312, 34255} is formed. The array is converted into relative time from the start of login, and then the average offset value and standard deviation value of the node are calculated as the time consistency quantitative standard. Here, the behavior node sequence can be translated to a unified starting point and aligned, and then the standard deviation is calculated. If the standard deviation exceeds the set threshold, for example, the behavior node time consistency standard deviation threshold is set to 60 seconds, then the node behavior distribution is judged to be unstable. In addition, for the behavior When comparing node positions, it is necessary to extract their index positions in the behavior path. For example, if the "Confirm Payment" node is at the 6th, 6th, and 5th positions in the three orders, respectively, then the position array is {6, 6, 5}. Based on this array, its average offset value is calculated to be 5.67. At the same time, normalized according to the total number of order nodes, the node position offset rate is 5.67 / 6 = 0.945, which is above the standard offset rate threshold of 0.8. Therefore, its node position consistency is judged to be high. For the same node in the behavior path, if the time offset is less than 20 seconds and the position offset rate is greater than 0.9, it is classified as highly consistent. Otherwise, it is marked as an offset node. The above operations are performed for each type of node separately. Finally, the consistency evaluation results of each type of node between orders are obtained, and a node consistency score array is formed.

[0068] The standard process generation submodule sorts all action nodes from low to high according to the time consistency index based on the node position consistency index, selects the action node with the smallest offset difference among all orders, constructs a time position alignment sequence, extracts node names and positions, reconstructs the standardized action path sequence, and generates a set of standard account action processes.

[0069] According to the node position consistency index, in the sorting operation, priority is determined according to the comprehensive score of the time offset value and position offset rate of each type of behavior node. First, the node consistency score is normalized, and the time consistency score is mapped to a score between 0 and 1 according to the offset seconds, and the position consistency is mapped to a consistency score according to the offset rate. Then, the two are weighted to calculate the comprehensive score according to the weight setting ratio of 1:2. For example, the time offset score of the verification code input node is 0.92, and the position score is 0.95. The weighted comprehensive score is 0.92×0.33+0.95×0.67≈0.94. The nodes are arranged in descending order according to the comprehensive score, and the top three nodes with the highest scores are selected as the core nodes of the standard path. The remaining nodes are spliced together in the order of behavior occurrence to form a complete standard behavior path sequence, and repeated behavior nodes are deduplicated. For example, if the "browse products" behavior appears more than three times in two orders, only the first browsing record is retained to enter the standard path. In addition, when standardizing the order of nodes, if the node order is reversed in different orders but all meet the high consistency conditions, the sequence pattern with the highest frequency of occurrence is selected as the path template. For example, in T1, T2, and T3, "add to shopping cart" and "select payment method" are in the same order in T1 and T2, but reversed in T3, then the order of T1 and T2 is selected to form the standard path node sequence, and finally the standard behavior path process is constructed to form the account standard behavior process set.

[0070] See also Figure 3 , the sequence offset alignment module includes:

[0071] The real-time process collection submodule obtains the entire behavior process of the current payment order from user login to payment trigger, collects the occurrence time of all behavior nodes and records the node sequence, arranges the node events in ascending order of timestamps, and generates real-time behavior sequence data;

[0072] First, all behavior nodes for the current payment order, from user login to payment triggering, are collected. To ensure data integrity and accuracy, the timestamps of these behavior nodes must be accurately recorded and sorted in ascending order. For example, when a user logs in, this node is recorded as a behavior node with the timestamp "2025-03-26 10:05:15." Subsequently, user actions such as browsing products and adding products to the shopping cart are collected in chronological order, and the timestamp of each node is recorded one by one. If a user browses a product at "2025-03-26 10:10:00" and adds it to the shopping cart at "2025-03-26 10:15:30," the timestamp of the "add to cart" node is "2025-03-26 10:15:30." After collecting and sorting all these behavior nodes, real-time behavior sequence data is generated, which contains each behavior node and its corresponding timestamp for subsequent comparison and analysis. In actual applications, the collected behavioral data can be completed through system logs or user behavior tracking tools to ensure comprehensive coverage of each user's operations.

[0073] The node interval calculation submodule combines real-time behavior sequence data with the account standard behavior process set, matches the same behavior nodes in the two sequences, compares the timestamps of each group of identical behavior nodes, calculates the time interval difference between the corresponding nodes in the two processes, records all interval differences in the order of behavior nodes, and generates a node interval difference sequence;

[0074] Compare real-time behavior sequence data with the account's standard behavior flow set. Assume the first behavior node in the standard behavior flow set is "User Login" with a timestamp of "2025-03-26 10:05:00." Compare the timestamps of the same behavior node in the current payment order, for example, "2025-03-26 10:05:15" as the timestamp of "User Login" in the current payment order. The time difference is calculated: "2025-03-26 10:05:15 minus "2025-03-26 10:05:00," resulting in a time difference of 15 seconds for this node. Continue calculating timestamp differences for other identical behavior nodes (such as browsing products, adding to cart, and selecting a payment method), obtaining the time difference value for each node one by one. This allows for precise comparison of the differences between the two behavior flows and ensures accuracy and consistency during process execution. By calculating the time difference values for all behavior nodes, a node time difference sequence is ultimately formed, preparing for the next step of calculating the total offset. For example, if the standard timestamp of the browsed product node is "2025-03-26 10:10:00", and the timestamp of the corresponding node in the current payment order is "2025-03-26 10:10:30", the time interval difference value of the node is 30 seconds.

[0075] The offset total generation submodule calculates the sum of the time interval difference values of all behavior nodes based on the node interval difference sequence, using the formula:

[0076]

[0077] Calculate the total amount of payment operation process offset M, where A i Indicates the timestamp of the i-th node in the account standard process, B i Represents the timestamp of the i-th node in the real-time process, represents the average time of all nodes in the standard process, Δ i represents the index position difference of the i-th node in the two processes, and n represents the total number of nodes;

[0078] Calculations are performed based on the node interval difference sequence to ultimately generate the total amount of payment process deviation. For example, in the node interval difference sequence, assume the time interval difference values for the first few nodes are: 15 seconds, 30 seconds, and 20 seconds, respectively. First, these difference values are summed to obtain 15 seconds + 30 seconds + 20 seconds = 65 seconds. Then, the overall deviation trend is calculated using the average and standard deviation of these time difference values. For example, if the standard deviation is 5 seconds, the total deviation is the sum of the time differences combined with the standard deviation. The final result shows that the total deviation of the payment process is 65 seconds. In this way, an accurate deviation value can be obtained, reflecting the degree of deviation between the current payment process and the standard process, helping to optimize the user payment experience and reduce process deviation.

[0079] Table 1: Behavior node time difference table

[0080] Node Type Standard timestamp Current timestamp Time difference (seconds) User login 2025-03-2610:05:00 2025-03-2610:05:15 15 Browse products 2025-03-2610:10:00 2025-03-2610:10:30 30 add to the cart 2025-03-2610:12:00 2025-03-2610:12:20 20

[0081] As shown in Table 1, by calculating the time difference value of each node, the time offset of each behavior node can be obtained.

[0082] Assuming the average timestamp of the standard process is "2025-03-26 10:05:00", the time interval in the calculation formula is:

[0083]

[0084] Calculate the absolute value of the difference:

[0085] The time difference between user login nodes is 15 seconds;

[0086] The time difference between browsing product nodes is 30 seconds;

[0087] The time difference of adding to shopping cart node is 20 seconds;

[0088] The sum of the absolute differences is 15+30+20=65 seconds.

[0089] Calculate the standard deviation part:

[0090] Assuming the standard deviation of node timestamps is 5 seconds, calculate the difference between each node timestamp and the standard process timestamp and use it to calculate the standard deviation.

[0091]

[0092] Reflects the volatility of node timestamp distribution.

[0093] Calculate the weighted value part:

[0094] Calculate the weighted value of each node, assuming that the deviation of each node is Δ i They are 1, 2, and 1 (representing the relative offset position of the nodes in the process), and the timestamp difference of each node is 15 seconds, 30 seconds, and 20 seconds respectively:

[0095]

[0096] Calculation yields:

[0097] |0.48|+|1.94|+|0.95|=0.48+1.94+0.95=3.37;

[0098] Finally calculate the total offset:

[0099] Combining the total time difference and the weighted value of the standard deviation, we can get the final total payment process deviation:

[0100]

[0101] The calculated result of 28.76 seconds represents the total deviation of the current payment process from the standard process. This deviation reflects the difference between the time at each user's payment node and the time at each node in the standard process. A higher deviation indicates a significant time difference between the current user's payment behavior and the standard behavior, indicating a certain behavioral deviation in the user's payment process.

[0102] See also Figure 4 , the state chain building blocks include:

[0103] The status change collection submodule obtains all status change records of the current payment order from the pending payment state to the current processing node, collects various status events and their triggering time, including pending payment, payment processing, payment confirmation, payment failure, and refund, and generates status change time records;

[0104] Obtain a record of all state changes for the current payment order from the pending payment state to the current processing node. Collect each state event and its triggering time, including pending payment, payment processing, payment confirmation, payment failure, and refunding, to generate a state change time record. Specifically, the order's state change history is first retrieved from the order database, recording the triggering time of each state change. For example, the time when the order triggers the "pending payment" state is "2025-03-26 10:05:00," and the state is now "pending payment." Next, query the database for the next state change. Assuming the order changes from "pending payment" to "payment processing," record the triggering time of this event, for example, "2025-03-26 10:10:00." This process continues by recording each state update until the order enters the "refunding" state, forming a complete time series covering all state change nodes. To ensure the completeness and accuracy of status change records, we verify the time of each event and ensure that all timestamps are arranged in true chronological order. For example, the time interval between an order changing from "pending payment" to "payment processing" should be 5 minutes. This is then sorted to form an ordered time record of status changes. These time records provide basic data support for subsequent status path analysis and comparison.

[0105] The state path connection submodule sorts different state events in chronological order based on the state change time record, connects the state change events according to the change path, and forms a state change path sequence;

[0106] Based on the state change time records, different state events are sorted in chronological order, and the state change events are connected according to the change path to form a preliminary state change path sequence. In this process, the state change time records are first processed and sorted by timestamp from small to large to ensure that the time sequence of each state change is not disordered. Suppose the state change record of an order is as follows:

[0107] Table 2 Order status change data

[0108] state Timestamp Pending payment 2025-03-2610:05:00 Payment processing 2025-03-2610:10:00 Confirm payment 2025-03-2610:20:00 Payment failed 2025-03-2610:30:00 Refund in progress 2025-03-2610:35:00

[0109] After sorting, we obtain the correct time sequence, as shown in the table above. These state change events are then connected according to their occurrence time to form a path. In this example, the path is "Pending Payment -> Payment Processing -> Payment Confirmed -> Payment Failed -> Refunding Pending," indicating that the order transitioned from "Pending Payment" to "Refunding Pending." The transition time between each state node can also be recorded as part of the state change path, providing a reference for subsequent analysis of time differences between state changes. The resulting state change path sequence provides a basis for subsequent path comparison and process optimization.

[0110] The change path set generation submodule sorts all potential status change paths according to the status change path sequence, removes duplicate paths, and generates an order status change path set;

[0111] Based on the state change path sequence, all possible state change paths are sorted, duplicate paths are removed, and a unique set of order state change paths is generated. The goal of this process is to extract all possible state change paths for an order and remove duplicate paths, thereby obtaining a unique set of state change paths. During implementation, the state change paths of all orders are first analyzed, and the state change sequence of each order is recorded. For example, suppose the state change paths of two orders are as follows:

[0112] Order 1: Pending payment -> Payment processing -> Payment confirmed -> Payment failed;

[0113] Order 2: Pending payment -> Payment processing -> Payment confirmed -> Payment failed;

[0114] Order 3: Pending payment -> Payment processing -> Refund in progress;

[0115] Since the status paths of Order 1 and Order 2 are exactly the same, we can remove the duplicate paths and only keep the two paths: "Waiting for Payment -> Payment Processing -> Confirmed Payment -> Payment Failed" and "Waiting for Payment -> Payment Processing -> Refunding". The resulting set of order status change paths is:

[0116] Payment pending -> Payment processing -> Payment confirmed -> Payment failed;

[0117] Payment pending -> Payment processing -> Refund in progress;

[0118] The unique path can provide an effective reference for subsequent process optimization or error prediction, help analyze the commonalities and differences in the order status change process, and provide support for predicting the future status of the order.

[0119] See also Figure 5 , the jump imbalance detection module includes:

[0120] The state sequence verification submodule selects the order relationship between adjacent states based on all state nodes in the order state change path set, verifies the state logic flow that pending payment takes precedence over payment in progress, and payment in progress takes precedence over payment confirmation, identifies all illogical state relationships, and generates state sequence verification results;

[0121] First, the relationship between each pair of adjacent states is extracted from all state nodes in the order state change path. For example, during the state change process of an order, the "Pending Payment" state may occur first, followed by the "Payment Processing" state, and then the "Confirmed Payment" state. These states must ensure that they conform to the predefined order logic, namely, "Pending Payment" takes precedence over "Payment Processing," which in turn takes precedence over "Confirmed Payment." Next, a comparison is performed to determine whether each pair of adjacent states meets the order requirements. If the order between a pair of states is found to be inconsistent with the expected order, such as "Payment Processing" taking precedence over "Pending Payment," the state is marked as an anomaly. This comparison can detect any ordering issues and further analyze whether these ordering errors are caused by improper operation, system errors, or data anomalies. During this process, if the order of state nodes for an order does not conform to the expected order, the abnormal state relationship is identified and recorded. For example, if the state change of order ID 123 shows the incorrect order of "Payment Processing" before "Pending Payment," this is marked as an anomaly, generating a state order verification result indicating that the order has a sequence error.

[0122] The abnormal jump identification submodule identifies any state relationship with reversed order or repeated return based on the state sequence verification results, filters all state pairs with abnormal jumps, marks the specific nodes with abnormal jumps, and generates an abnormal jump node set;

[0123] First, based on the state sequence verification results, the system further analyzes detected abnormal transitions. It examines all state pairs marked as abnormal to determine whether they exhibit sequence reversals or duplicate returns. A sequence reversal means that the states occur in an unexpected order, such as returning from "Payment Processing" to "Awaiting Payment," which violates the normal state flow. Duplicate returns mean that a state does not follow the normal flow but instead repeatedly returns to a previous state, such as returning to "Payment Processing" after "Confirming Payment." These transition types are identified and the associated abnormal transition nodes are recorded. For example, if an abnormal transition from "Payment Processing" to "Awaiting Payment" occurs in the state flow for order ID 124, the system will detect this transition and mark it as abnormal. Finally, based on the identification of these abnormal transitions, a set of abnormal transition nodes is generated for further analysis and as a basis for subsequent abnormality frequency statistics.

[0124] The jump exception frequency statistics submodule counts the number of state jumps with sequence exceptions in the process based on the set of abnormal jump nodes, using the formula:

[0125]

[0126] Calculate the abnormal frequency value F of each state jump and generate the state jump abnormal frequency, where X i represents the time interval of the i-th jump, Y i represents the standard time interval of the i-th jump, μ X represents the mean of all jump intervals, Z i represents the state offset of the i-th jump, and m represents the total number of jumps;

[0127] The abnormal transition node collection is used to count the frequency of each abnormal transition. For each transition type (such as order reversal and repeated returns), the system counts its occurrence across all orders. Specifically, if the status of a particular order ID experiences a reversed order or repeated returns, the system records this abnormal transition as one. All abnormal transitions are accumulated to produce the abnormal state transition frequency, which is the frequency of each abnormal transition within a certain timeframe. For example, if a specific state transition (such as "Payment Processing" to "Awaiting Payment") occurs five times in a set of orders, the abnormal frequency of that transition is five. This frequency is then calculated to see if it exceeds a preset baseline. For example, if a state transition occurs more than three times within a month, it is considered frequent and a major issue, requiring further optimization or remediation. This method generates a statistical report on abnormal state transition frequency, helping developers and operations personnel identify potential issues in the system.

[0128] Use the formula to calculate the abnormal frequency value of each state jump. Assume that there are abnormal jump frequency records in Table 3 below in a set of order data:

[0129] Table 3 Abnormal jump frequency record

[0130]

[0131]

[0132] Calculate according to Table 3.

[0133] For the jump from "Payment Processing -> Pending Payment", it occurs in orders 123 and 125. The actual frequency of each occurrence is 1 and the standard frequency is 0. Substitute these values into the X i and Y i .

[0134]

[0135] First calculate the absolute difference:

[0136]

[0137] Then calculate the difference between the standard time interval and the actual time:

[0138]

[0139] Finally, calculate the product term:

[0140]

[0141] So the frequency of "payment processing -> pending payment" is:

[0142] 1+2.83+5=8.83;

[0143] The jump to "Confirm Payment->Payment Processing" occurs in orders 124 and 126, with an actual frequency of 2 and 1 respectively, and a standard frequency of 1. Substitute these values into the X i and Y i .

[0144]

[0145] First calculate the absolute difference:

[0146]

[0147] Then calculate the difference between the standard time interval and the actual time:

[0148]

[0149] Finally, calculate the product term:

[0150]

[0151] So the frequency of "Confirmed Payment -> Payment Processing" is:

[0152] F = 0.5 + 1.12 + 6 = 7.62;

[0153] Finally, the frequency results of all abnormal jumps can be integrated to generate the jump abnormality frequency as part of the analysis report. The data shows that some jumps have frequent abnormal behaviors, which deserve further investigation and optimization.

[0154] Table 4: Abnormal jump frequency calculation results

[0155] Exception jump type Abnormal jump frequency Payment processing->Awaiting payment 8.83 Confirm payment->Payment processing 7.62

[0156] As shown in Table 4, the calculated jump frequency reflects the abnormal frequency of jumps in different states, which helps system developers identify the key areas of abnormal jumps and facilitates optimization.

[0157] See also Figure 6, the risk level linkage module includes:

[0158] The behavior deviation judgment submodule performs independent judgment based on the total amount of operation process deviation and the preset behavior process deviation judgment threshold. If the total amount of operation process deviation exceeds the threshold, it is marked as a medium-risk order and the behavior deviation risk level is generated.

[0159] First, the total process deviation is obtained. This value represents the degree of behavioral deviation during the order's payment process. Specifically, it is calculated by accumulating the time differences between each order's behavioral nodes at different time points. Assume that an order's behavioral nodes include: user login, product browsing, adding to cart, selecting a payment method, entering a verification code, and confirming payment. The time difference between each node is the deviation value. For example, if the time difference between the "browse products" node and the "add to cart" node is 3 minutes, and the time difference between the latter and the "select payment method" node is 2 minutes, then the total process deviation is 3 + 2 = 5 minutes. When this total deviation exceeds a preset threshold (e.g., 5 minutes), the system determines that the order has significant behavioral deviation and is classified as a medium-risk order. Assuming the preset behavioral process deviation threshold is 5 minutes, if the total process deviation for an order is 7 minutes, the order is marked as medium-risk and a behavioral deviation risk level is generated. For example, if the total deviation for an order is 6 minutes, its behavioral deviation risk level is medium-risk. The system uses this value to label the order as medium-risk, ultimately providing a basis for risk assessment.

[0160] The state jump abnormality judgment submodule performs independent judgment based on the state jump abnormality frequency and the preset state jump abnormality judgment threshold. If the state jump abnormality frequency exceeds the threshold, it is marked as a medium-risk order and the state jump abnormality risk level is generated;

[0161] First, the frequency of abnormal status transitions is collected. This task involves checking whether order statuses change in the normal order. Each order's status typically changes in the following order: Pending Payment → Payment Processing → Payment Confirmed. If the frequency of status transitions for an order exceeds a preset threshold, it is considered an abnormal transition. For example, an order's status should transition from Pending Payment to Payment Processing, then to Payment Confirmed. If an order's status transitions from Pending Payment to Payment Failed, and then back to Payment Processing, this abnormal transition is recorded as an abnormal status frequency. Assuming the preset threshold for abnormal status transitions is 5, if the frequency of abnormal status transitions reaches 6, the order is determined to have abnormal transitions and is marked as a medium-risk order. A status transition abnormality risk level is also generated. This criterion effectively detects anomalies in the payment process. If the frequency of status transitions is 4, which is below the threshold of 5, the order is not marked as risky and remains in a normal state.

[0162] The risk status labeling submodule determines whether both the behavior deviation risk level and the abnormal state jump risk level exceed the corresponding judgment threshold. If both exceed the threshold, the order is marked as high-risk; otherwise, it is marked as medium-risk. The online payment risk order process is frozen and a risk order security management record is generated.

[0163] Combining the aforementioned behavior deviation risk level and status jump abnormality risk level, the system makes a comprehensive judgment on the order risk status. First, if the behavior deviation risk level is medium risk and the status jump abnormality risk level is also medium risk, the order is judged as a medium risk order. If both risk levels exceed the preset thresholds (for example, when the total deviation amount and the status jump abnormality frequency exceed 5 and 5 times respectively), the order is marked as a high-risk order, and the system will simultaneously execute the online payment risk order process freezing operation to ensure the security of the order payment process. For example, if the total behavior deviation of an order is 8 minutes and the status jump abnormality frequency is 7 times, exceeding the thresholds of 5 minutes and 5 times, the order will be marked as a high-risk order, the system will freeze the payment process, and generate a risk order security management record. Assuming that the total behavior deviation of an order is 6 minutes and the status jump abnormality frequency is 4 times, both indicators do not exceed the threshold of 5, the order will be marked as a medium-risk order and the payment process will continue.

[0164] A method for managing payment security based on online payment, comprising the following steps:

[0165] S1: Obtain the time from the user's login to payment confirmation node for successful transactions, filter and align the trigger time nodes, and generate a set of standard account behavior processes;

[0166] S2: Based on the account behavior node time set, collect the trigger time of the operation behavior nodes in the current payment order, calculate the sum of the difference between each node and the standard time, and obtain the total amount of payment operation process deviation;

[0167] S3: Obtain the time nodes of order status changes, connect the time of each status from pending payment to confirmed payment, identify whether the states meet the logical sequence, and generate a set of order status change paths;

[0168] S4: Based on the set of order status change paths, count the number of order reversals and repeated returns in the order status path to obtain the abnormal frequency of status jumps;

[0169] S5: Based on the total amount of payment operation process deviation and the abnormal state jump frequency, the behavior deviation is compared with the jump abnormality threshold, the risk order freezing action is executed, and the risk order security management record is generated.

[0170] The above are merely preferred embodiments of the present invention and do not limit the present invention in any other form. Any technician familiar with the profession may use the technical content disclosed above to change or modify it into an equivalent embodiment with equivalent changes and apply it to other fields. However, any simple modification, equivalent change and modification made to the above embodiment based on the technical essence of the present invention without departing from the content of the technical solution of the present invention shall still fall within the scope of protection of the technical solution of the present invention.

Claims

1. An order management system based on online payment, characterized by: The system comprises: The behavior sequence recognition module obtains successful transaction records under the user account during the online payment process, collects the complete behavior process of each order from user login to payment confirmation, selects behavior nodes, cross-references the time and location of the occurrence of behavior nodes of the same type, and generates a standard account behavior process set; The sequence offset comparison module obtains the real-time behavior process of the current payment order based on the account standard behavior process set, arranges the behavior nodes in chronological order, calculates the time interval difference between the same behavior nodes in the two processes, and sums them to obtain the total amount of payment operation process offset; The state chain construction module obtains all status change records of the current payment order, collects the trigger times of the status events such as pending payment, payment processing, payment confirmation, payment failure, and refund, connects the states in chronological order according to the change path, and constructs the order status change path set; The jump imbalance detection module combines all state nodes in the order state change path set, selects the order relationship between adjacent states, compares the state logic process, counts the number of state jumps with sequence abnormalities in the process, and generates a state jump abnormality frequency.

2. The online payment-based order management system according to claim 1, characterized in that: The account standard behavior process set includes the behavior node time distribution characteristics, node appearance sequence characteristics, and standard behavior path patterns. The total payment operation process offset includes the behavior node time difference cumulative value, behavior path similarity offset value, and process timing consistency offset value. The order status change path set includes the state evolution path structure, state node time chain, and state evolution logic hierarchy. The state jump abnormality frequency includes the number of state jump sequence abnormalities, the number of state jump backtracking repetitions, and the state jump logic deviation index.

3. The online payment-based order management system according to claim 1, characterized in that: The behavior sequence recognition module includes: The behavior process collection submodule obtains three consecutive successful transaction records under the user account, collects the complete behavior process of each order from user login to payment confirmation, extracts the data of each behavior node of each order, including user login, browsing products, adding to shopping cart, selecting payment method, entering verification code, and confirming payment, records the original position and timestamp of the node in the behavior sequence, and generates behavior node timing information; The node time positioning submodule marks the time positions of the same type of behavior nodes in the three orders based on the behavior node timing information, calculates the standard deviation and average offset value of the node time distribution in each order, determines the time consistency level of each behavior node in different orders, and obtains the node position consistency index; The standard process generation submodule sorts all behavior nodes from low to high according to the time consistency index based on the node position consistency index, selects the behavior nodes with the smallest offset difference among all orders, constructs a time position alignment sequence, extracts node names and positions, reconstructs the standardized behavior path order, and generates an account standard behavior process set.

4. The online payment-based order management system according to claim 1, characterized in that: The sequence offset comparison module includes: The real-time process collection submodule obtains the entire behavior process of the current payment order from user login to payment trigger, collects the occurrence time of all behavior nodes and records the node sequence, arranges the node events in ascending order of timestamps, and generates real-time behavior sequence data; The node interval calculation submodule combines the real-time behavior sequence data with the account standard behavior process set, matches the same behavior nodes in the two sequences, compares the timestamps of each group of identical behavior nodes, calculates the time interval difference between the corresponding nodes in the two processes, records all interval differences in the order of behavior nodes, and generates a node interval difference sequence; The offset total generation submodule calculates the sum of the time interval difference values of all behavior nodes according to the node interval difference sequence, using the formula: Calculate the total amount of payment operation process offset M, where A i Indicates the timestamp of the i-th node in the account standard process, B i Represents the timestamp of the i-th node in the real-time process, represents the average time of all nodes in the standard process, Δ i It represents the index position difference of the i-th node in the two processes, and n represents the total number of nodes.

5. The online payment-based order management system according to claim 1, characterized in that: The state chain building module includes: The status change collection submodule obtains all status change records of the current payment order from the pending payment state to the current processing node, collects various status events and their triggering time, including pending payment, payment processing, payment confirmation, payment failure, and refund, and generates status change time records; The state path connection submodule sorts different state events in chronological order based on the state change time record, connects the state change events according to the change path, and forms a state change path sequence; The change path set generation submodule sorts all potential state change paths according to the state change path sequence, removes duplicate paths, and generates an order state change path set.

6. The online payment-based order management system according to claim 1, characterized in that: The jump imbalance detection module includes: The state sequence verification submodule selects the order relationship between adjacent states based on all state nodes in the order state change path set, verifies the state logic flow that pending payment takes precedence over payment in progress, and payment in progress takes precedence over payment confirmation, identifies all illogical state relationships, and generates a state sequence verification result; The abnormal jump identification submodule identifies any state relationship with reversed order or repeated return according to the state sequence verification result, filters all state pairs with abnormal jumps, marks specific nodes with abnormal jumps, and generates an abnormal jump node set; The jump abnormality frequency statistics submodule counts the number of state jumps with sequence abnormalities in the process according to the abnormal jump node set, using the formula: Calculate the abnormal frequency value F of each state jump and generate the state jump abnormal frequency, where X i represents the time interval of the i-th jump, Y i represents the standard time interval of the i-th jump, μ X represents the mean of all jump intervals, Z i represents the state offset of the i-th jump, and m represents the total number of jumps.

7. The online payment-based order management system according to claim 1, characterized in that: The system also includes a risk level linkage module; The risk level linkage module performs an independent judgment operation based on the total amount of operation process deviation and the abnormal frequency of state jump, combined with the preset behavior process deviation judgment threshold and state jump abnormality judgment threshold. If any one item exceeds the corresponding judgment threshold, it is marked as a medium-risk order. If both items exceed the judgment threshold, it is marked as a high-risk order. The current order risk status is determined, and the online payment risk order process freezing operation is executed simultaneously to obtain the risk order security management record. The risk order security management and control records include risk level marking information, freezing process execution records, and risk control response execution status.

8. The online payment-based order management system according to claim 7, characterized in that: The risk level linkage module includes: The behavior deviation judgment submodule performs an independent judgment operation based on the total amount of operation process deviation and a preset behavior process deviation judgment threshold. If the total amount of operation process deviation exceeds the threshold, it is marked as a medium-risk order and a behavior deviation risk level is generated; The state jump abnormality judgment submodule performs an independent judgment operation based on the state jump abnormality frequency and the preset state jump abnormality judgment threshold. If the state jump abnormality frequency exceeds the threshold, it is marked as a medium risk order and the state jump abnormality risk level is generated; The risk status marking submodule determines whether the behavior deviation risk level and the state jump abnormal risk level both exceed the corresponding judgment thresholds at the same time based on the behavior deviation risk level and the state jump abnormal risk level. If both exceed the threshold, it is marked as a high-risk order; otherwise, it is marked as a medium-risk order, and the online payment risk order process freezing operation is executed simultaneously to generate a risk order security management record.

9. A method for order management and payment security control based on online payment, characterized in that: The system according to any one of claims 1 to 8 is implemented, comprising the following steps: S1: Obtain the time from the user's login to payment confirmation node for successful transactions, filter and align the trigger time nodes, and generate a set of standard account behavior processes; S2: Based on the account behavior node time set, collect the trigger time of the operation behavior nodes in the current payment order, calculate the sum of the difference between each node and the standard time, and obtain the total amount of payment operation process offset; S3: Obtain the time nodes of order status changes, connect the time of each status from pending payment to confirmed payment, identify whether the states meet the logical sequence, and generate a set of order status change paths; S4: Based on the set of order status change paths, count the number of order reversals and repeated returns in the order status paths to obtain the abnormal frequency of status jumps; S5: Based on the total amount of the payment operation process deviation and the abnormal state jump frequency, the behavior deviation is compared with the jump abnormality threshold, the risk order freezing action is executed, and the risk order security management record is generated.

Images