Top-up behavior abnormity monitoring system based on big data and artificial intelligence

Abstract

The invention relates to the technical field of recharging abnormity monitoring, in particular to a big data and artificial intelligence-based recharging behavior abnormity monitoring system, which is characterized in that historical recharging behavior data and real-time user behavior data are acquired, a user static portrait and an equipment I P portrait are constructed, deviation measurement is performed on real-time behavior characteristics, and the difference between the real-time behavior characteristics and a historical baseline is quantified, so that the recharging behavior abnormity can be monitored. The method is used for identifying abnormal operation modes. A time sequence neural network model is trained based on a historical operation sequence, typical operation links and behavioral rhythms of a user are automatically learned, and time sequence structure abnormity is accurately identified. And the abnormity monitoring module fuses static offset and behavior offset results, adopts a reinforcement learning model, dynamically adjusts a response strategy according to a risk interception effect, a false alarm condition and user feedback, realizes adaptive optimization of risk control measures, and improves the real-time intelligent risk control capability of the system in a complex recharging scene.

Description

Technical Field

[0001] The present invention relates to the technical field of abnormal recharge monitoring, and in particular to a recharge behavior abnormality monitoring system based on big data and artificial intelligence. Background Art

[0002] Online top-up services have become a crucial component of user activity and revenue for various platforms. However, malicious activities such as abnormal top-ups, group arbitrage, bot-based order manipulation, and account theft frequently occur in virtual top-up scenarios, causing not only economic losses to the platforms but also serious damage to user interests and business reputation.

[0003] Currently, the industry's prevention and control of abnormal recharge behavior primarily relies on rule-based risk control strategies and manual review. For example, simple rules such as thresholds are used to determine recharge frequency, amount, and abnormal device switching, or suspected behavior is manually reviewed on a case-by-case basis. While these methods initially demonstrated some interception capabilities, their effectiveness has gradually declined as fraudulent methods continue to evolve. A single rule is difficult to adapt to the diverse and dynamic recharge behavior patterns of users, and is prone to false positives and false negatives. Furthermore, manual review suffers from low efficiency, poor timeliness, and high costs, making it difficult to meet the actual needs of real-time risk control and large-scale business operations. Summary of the Invention

[0004] To solve the above problems, the present invention provides a recharge behavior abnormality monitoring system based on big data and artificial intelligence.

[0005] To achieve the above object, the technical solution adopted by the present invention is:

[0006] A recharge behavior anomaly monitoring system based on big data and artificial intelligence, including a data acquisition module, a static offset calculation module, a behavior sequence detection module and an anomaly monitoring module;

[0007] The data collection module is used to collect historical recharge behavior data and real-time user behavior data;

[0008] The static offset calculation module is used to construct a user static profile and a device IP static profile based on historical recharge behavior data, calculate the real-time behavior data deviation value based on the user static profile and the device IP static profile, and generate a static detection vector;

[0009] The behavior sequence detection module is used to build a user behavior sequence model based on historical recharge behavior data, and calculate the behavior offset vector through real-time behavior data and the user behavior sequence model;

[0010] The anomaly monitoring module is used to output a real-time response strategy through a reinforcement learning model based on a static detection vector and a behavior deviation vector.

[0011] Furthermore, the historical recharge behavior data includes user recharge time, recharge amount, recharge frequency, payment method, login device identification, login IP address and corresponding geographic location information, and also includes the user's operation behavior log before recharging.

[0012] Furthermore, the construction of a user static profile and a device IP static profile based on historical recharge behavior data includes the following steps:

[0013] Based on the historical recharge behavior data, extract the recharge time, recharge amount, recharge frequency, payment method, login device identifier, login IP address and pre-recharge operation behavior log for each user account to form a user behavior feature data set;

[0014] Performing statistics on the user behavior feature dataset to summarize the time distribution, amount distribution, payment method preference, device change frequency, and IP regional distribution of user recharge behaviors to obtain user static portrait features;

[0015] Based on the number of login accounts, switching frequency, and recharge geographical location of each device identification and IP address in the historical recharge behavior data, the devices and IPs are aggregated and statistically analyzed to obtain the static portrait features of the device IP.

[0016] Furthermore, the calculation of the real-time behavior data deviation value based on the user static profile and the device IP static profile to generate the static detection vector includes the following steps:

[0017] Align the feature dimensions of the real-time behavior data feature vector with the user static profile feature and the device IP static profile feature to generate feature pairs to be compared;

[0018] For each feature pair, the cosine similarity is used to measure the distance between the real-time behavior data and the static portrait features to obtain the deviation score of each feature item;

[0019] The deviation scores of each feature item are normalized to generate a static detection vector.

[0020] Furthermore, the normalization includes Z-score normalization.

[0021] Furthermore, the user behavior sequence model is constructed by the following steps:

[0022] Based on the historical recharge behavior data and the pre-recharge operation behavior log, each user's behavior events are serialized in chronological order to generate a user historical behavior event sequence;

[0023] Performing data encoding and normalization processing on the user's historical behavior event sequence to generate a behavior feature vector sequence for model training;

[0024] The behavior feature vector sequence is semi-supervisedly trained based on a temporal neural network model to extract the temporal pattern of the user's historical behavior, and a user behavior sequence model for describing the user's normal behavior habits is generated based on the training results.

[0025] Furthermore, the serializing of each user's behavior events in chronological order includes:

[0026] The historical recharge behavior data and pre-recharge operation behavior logs are sorted according to timestamps, and the operation events, page browsing, recharge attempts, payment actions and corresponding occurrence times of the same user in each login cycle are arranged in sequence to construct a behavior event sequence containing operation type, behavior parameters and time information.

[0027] Furthermore, the calculation of the behavior offset vector using the real-time behavior data and the user behavior sequence model includes the following steps:

[0028] Perform feature encoding on real-time behavior data and convert it into a real-time behavior feature vector sequence;

[0029] Based on the user behavior sequence model, similarity calculation is performed on the real-time behavior feature vector sequence to generate the deviation between the current behavior sequence and the historical normal behavior habits;

[0030] Each deviation index is standardized and weighted to generate a behavior deviation vector that characterizes the difference between the user's current behavior sequence and his historical behavior pattern.

[0031] Furthermore, the reinforcement learning model is constructed by the following steps:

[0032] Using the received static detection vector and behavior offset vector as the current environment state input, it defines transaction freezing, secondary verification, account locking, and initiating manual review as a set of optional actions.

[0033] Set a reward function based on the accuracy of historical anomaly detection, interception amount, false interception amount, and number of user complaints;

[0034] Based on the environment state input, optional action set and reward function, iterative training is performed through the deep Q network to output a real-time response strategy.

[0035] Furthermore, the reward function is as follows:

[0036]

[0037] Among them, R is the reward value; a k The number of abnormal recharge behaviors successfully intercepted in the kth round of detection; b k is the number of normal behaviors falsely reported in the kth round of detection; m kis the total amount of abnormal recharges actually intercepted in round k; c k is the number of user complaints caused by risk control measures in the kth round; α, β, γ and λ are preset weight coefficients.

[0038] The beneficial effects of the present invention are as follows: the present invention collects historical recharge behavior data and real-time user behavior data, combines historical data to build user static portraits and device IP static portraits, and dynamically quantifies the degree of deviation of behavior from the historical baseline by comparing real-time behavior data. Based on the historical behavior data, the time series neural network model is trained to automatically learn and characterize the user's behavior habits, and to achieve accurate modeling of operation links and behavior time series changes, which can effectively identify operation sequence anomalies caused by gang arbitrage, script order brushing, etc. Finally, based on the fusion of static detection and behavior offset vectors, the anomaly monitoring module continuously and adaptively optimizes the risk response strategy according to actual detection results and user feedback through the reinforcement learning model, and dynamically outputs the optimal response strategy according to previous risk handling effects, thereby achieving adaptive adjustment of risk control response measures. It meets the real-time intelligent risk control needs of large-scale and complex recharge scenarios in digital business environments. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 This is a structural diagram of a recharge behavior abnormality monitoring system based on big data and artificial intelligence in the present invention.

[0040] Figure 2 It is a flowchart of the steps of the user behavior sequence model in the present invention. DETAILED DESCRIPTION

[0041] See also Figure 1-Figure 2 As shown, the present invention relates to a recharge behavior anomaly monitoring system based on big data and artificial intelligence, including a data acquisition module, a static offset calculation module, a behavior sequence detection module and an anomaly monitoring module;

[0042] The data collection module is used to collect historical recharge behavior data and real-time user behavior data;

[0043] The static offset calculation module is used to construct a user static profile and a device IP static profile based on historical recharge behavior data, calculate the real-time behavior data deviation value based on the user static profile and the device IP static profile, and generate a static detection vector;

[0044] The behavior sequence detection module is used to build a user behavior sequence model based on historical recharge behavior data, and calculate the behavior offset vector through real-time behavior data and the user behavior sequence model;

[0045] The anomaly monitoring module is used to output a real-time response strategy through a reinforcement learning model based on a static detection vector and a behavior deviation vector.

[0046] In some embodiments, the data collection module connects to the platform's user behavior database and real-time log system to continuously extract information such as top-up time, top-up amount, payment method, login device ID, login IP address, IP location, and page access path before top-up. It also simultaneously collects real-time behavior streams to ensure the integrity and continuity of feature data. For example, the system can capture the operation trajectory of a user who changes from a Southeast Asian IP address to a domestic IP address within a short period of time, and whose device fingerprint changes, but who continues to make frequent small top-ups. This provides data support for subsequent multimodal deviation modeling. The static offset calculation module uses statistical modeling of historical top-up behavior to automatically construct static profiles of users and devices based on dimensions such as top-up frequency, amount distribution, active time periods, and commonly used devices / addresses. This profile is updateable and individual, reflecting the stable characteristics of users' long-term top-up behavior. Upon receiving a new top-up request, the system immediately calculates the deviation of that behavior from the static profile within the multidimensional feature space. For example, if user A typically tops up 50 yuan with a bank card during the lunch hour on weekdays, and suddenly tops up 500 yuan in a row using an unfamiliar device in the early morning, the static offset calculation module will output significant deviations in the time, amount, device, and payment method dimensions, forming a unified static detection vector, improving sensitivity to sudden changes in individual behavior. The behavior sequence detection module utilizes a long short-term memory (LSTM) network to construct a user behavior sequence model. This model features the sequence of user actions, including login, browsing, click to top up, and payment confirmation. This model is encoded and modeled using a time window, automatically learning the characteristics of the user's operational chain during the top-up process. In actual detection, if a user's usual behavior sequence is "login - browse - click to top up - pay - log out," but their current behavior is "login - click to top up - pay," indicating a shortened operation path, skipping normal interactions, the system will output a behavior offset vector, indicating a broken operation chain and an abnormal timing structure. Compared to traditional static methods based solely on behavior frequency, this module can jointly analyze the integrity of the operation path and the rhythm of the behavior, significantly improving the ability to identify scripted operations and abnormal batch behavior. The anomaly monitoring module integrates static detection vectors and behavioral deviation vectors, using these as state inputs to construct a reinforcement learning model based on a deep Q-network (DQN). The system records the results after each detection decision, including metrics such as whether an abnormal top-up was successfully intercepted, whether a misjudgment occurred, and whether a user complained, and updates the reward function parameters accordingly. In actual operation, if the system performs secondary verification on newly added accounts for a batch of devices and successfully intercepts a large number of abnormal top-ups, it will tend to reuse the same response action when encountering similar deviation characteristics in the future, thereby achieving self-learning and dynamic adjustment of the strategy.Different from the existing technology, this solution supports collaborative deviation analysis of multi-subject features by integrating user portrait and device / IP portrait modeling, which is different from the limitation of existing technology that uses users as the only detection unit; it introduces a behavior sequence modeling mechanism to achieve dynamic detection of operation logic and behavior process through temporal structure learning, thereby enhancing the ability to identify hidden abnormal operations; thirdly, the reinforcement learning model forms a closed-loop feedback optimization in the response strategy, which can continuously update the risk control strategy threshold and action selection logic according to the system operation effect, avoiding the problem of static rule system requiring frequent manual maintenance.

[0047] Furthermore, the historical recharge behavior data includes user recharge time, recharge amount, recharge frequency, payment method, login device identification, login IP address and corresponding geographic location information, and also includes the user's operation behavior log before recharging.

[0048] It's important to note that historical top-up behavior data covers not only the core transaction parameters of the user's top-up operation itself, but also encompasses upstream and downstream behaviors and environmental characteristics related to the top-up. For example, on a certain trading platform, user A's top-up behavior over the past 90 days is continuously collected and organized into a multi-dimensional feature set. This includes key metrics such as the timestamp corresponding to each top-up operation (e.g., daily top-ups are concentrated between 6:00 PM and 9:00 PM), the amount of each top-up transaction (typically between 20 and 100 RMB), the frequency of top-ups within a week (approximately 2 to 3 times per week), and the payment method (primarily using linked bank cards). User action logs immediately preceding each top-up are also recorded. For example, within the 15 minutes prior to a top-up, the user's page paths (e.g., browsing a product page, opening the account center), the sequence of action events (e.g., clicking on top-up, selecting a payment method), and the associated login device identifier, IP address, and geographic location (e.g., a typical login device is an Android phone, with a common IP location in a certain city in Guangdong Province) are all included as supplementary features in the historical behavior profile. The log data is sorted by event timestamps to form an operation chain, which can be used for subsequent time series model training, and then used in the detection stage to identify typical high-risk patterns such as "rapid recharge in a short period of time", "sudden change in geographic location", and "device switching".

[0049] Furthermore, the construction of a user static profile and a device IP static profile based on historical recharge behavior data includes the following steps:

[0050] Based on the historical recharge behavior data, extract the recharge time, recharge amount, recharge frequency, payment method, login device identifier, login IP address and pre-recharge operation behavior log for each user account to form a user behavior feature data set;

[0051] Performing statistics on the user behavior feature dataset to summarize the time distribution, amount distribution, payment method preference, device change frequency, and IP regional distribution of user recharge behaviors to obtain user static portrait features;

[0052] Based on the number of login accounts, switching frequency, and recharge geographical location of each device identification and IP address in the historical recharge behavior data, the devices and IPs are aggregated and statistically analyzed to obtain the static portrait features of the device IP.

[0053] In some embodiments, the historical recharge behavior data is first structured and parsed, and a user behavior feature data set is constructed for subsequent portrait modeling. The system extracts features from the historical behavior logs of each user account, specifically including recharge timestamp sequence, recharge amount sequence, recharge interval period, recharge channel (such as bank card, third-party payment), login device identification sequence, login IP address sequence and pre-recharge operation event sequence. In order to ensure the availability of the data algorithm, all raw data are discretized, normalized and encoded before processing. For example, the recharge time is projected into a two-dimensional periodic space of seven days a week and 24 hours a day to construct the user's behavior heat distribution in the time dimension. In the process of user static portrait modeling, the system performs statistical analysis and distribution modeling on multi-dimensional features such as time, amount, frequency, device, and IP. Specifically, for top-up time, kernel density estimation (KDE) is used to model its distribution trend within daily and weekly cycles, outputting a probability density function of user time behavior. For top-up amount, quantile distribution modeling is used to extract medians, extreme values, and deviation indicators to avoid outlier interference. For top-up frequency, a sliding time window is used to calculate the number of top-ups per unit time and the periodicity feature vector. Payment method preference is constructed by normalizing the number of times different payment methods are used to construct a weighted preference distribution vector. Device change frequency is based on the number of device ID switches per unit time, combined with the timestamp sequence of the switch times to further extract a stability coefficient. IP regional distribution is based on reverse parsing results of IP location, statistically analyzing the frequency distribution of each province and city, and outputting a regional concentration index. The statistical results of all these dimensions are unified into a user static profile feature vector, reflecting the user's stable behavior patterns in long-term top-up behavior. Device and IP profiles focus on extracting aggregated features from the many-to-many relationships between "account-device" and "account-IP." The system uses device identification and IP address as nodes, counts historical login accounts associated with them, and calculates the number of login accounts, login frequency change rate, and account replacement frequency for each device or IP in unit time. In order to explore potential device reuse or IP drift behavior, the system also introduces a device-account clustering similarity index to perform similarity analysis on devices or IPs with similar recharge behavior characteristics but bound to different accounts. The recharge geographic location aggregates the recharge activities of multiple accounts under the same IP address through IP geographic reverse lookup and location clustering, and extracts the spatial distribution range, the number of hot cities, and the frequency of cross-regional activities to form the final device IP portrait feature.

[0054] Furthermore, the calculation of the real-time behavior data deviation value based on the user static profile and the device IP static profile to generate the static detection vector includes the following steps:

[0055] Align the feature dimensions of the real-time behavior data feature vector with the user static profile feature and the device IP static profile feature to generate feature pairs to be compared;

[0056] For each feature pair, the cosine similarity is used to measure the distance between the real-time behavior data and the static portrait features to obtain the deviation score of each feature item;

[0057] The deviation scores of each feature item are normalized to generate a static detection vector.

[0058] In some embodiments, all key features of the behavior are first structured and encoded to generate a real-time feature vector for the current behavior. This feature vector includes fields such as the time of the top-up, the amount, the payment method used, the unique identifier of the currently logged-in device, the region corresponding to the IP address, and a summary of the user's previous actions prior to the top-up. To achieve high consistency with the user's static profile and the device's IP static profile, the system performs dimension alignment on the real-time feature vector to ensure that its field order, encoding method, and numerical range are strictly consistent with the modeled profile features. The aligned feature pairs are then fed into the similarity calculation module one by one. For each feature, the system calculates the similarity between the current real-time value and the corresponding profile value. In the algorithm implementation, a vectorized distance metric, such as cosine similarity, is used to map the two feature representations into a unified high-dimensional space for angular determination. In layman's terms, if a feature of the current behavior (e.g., the top-up time) significantly deviates from the user's historical high-frequency top-up time period, that dimension will exhibit a significant directional shift, resulting in a large distance value. All these distance values ​​are uniformly interpreted as "deviation scores," representing the degree to which the behavior deviates from the user or device profile in that feature dimension. To improve the comparability and numerical stability of these deviation scores, the system then normalizes the deviation results across all feature dimensions. Specifically, the system initially models the mean and variance of historical deviation data for each feature dimension. During detection, the system uses the Z-score normalization method to convert the current raw deviation value into a standardized score, representing the degree of anomaly in that dimension relative to the overall historical distribution. After this processing, the standardized deviation scores across all feature dimensions are combined into a unified static detection vector. This vector not only captures the long-term behavioral characteristics of the user and device profile models, but also expresses the degree of deviation of the current behavior across multiple dimensions on a unified scale. This static detection vector serves as a key input for subsequent risk assessment and decision-making. Together with the behavioral deviation vector output by the behavior sequence detection module, it drives the anomaly monitoring model to make accurate and responsive risk control decisions.

[0059] Furthermore, the normalization includes Z-score normalization.

[0060] It should be noted that by introducing historical statistical distribution, the original deviation values ​​are mapped to a unified standard distribution interval, making the numerical scale of each feature dimension consistent, thereby avoiding model bias caused by differences in feature dimensions. In actual operation, the system will pre-calculate the mean and standard deviation of the deviation value of each feature dimension based on historical data. For example, in the dimension of recharge amount, the system counts the historical deviation behavior of a large number of users and establishes the center value and dispersion of their deviation distribution. When detecting in real time, the system compares the deviation score of the current recharge behavior in this dimension with its historical mean and divides it by the standard deviation to obtain a standardized result. After this processing, regardless of the numerical value of the original deviation value of a certain feature itself, it falls into the same evaluation system after standardization.

[0061] Furthermore, the user behavior sequence model is constructed by the following steps:

[0062] Based on the historical recharge behavior data and the pre-recharge operation behavior log, each user's behavior events are serialized in chronological order to generate a user historical behavior event sequence;

[0063] Performing data encoding and normalization processing on the user's historical behavior event sequence to generate a behavior feature vector sequence for model training;

[0064] The behavior feature vector sequence is semi-supervisedly trained based on a temporal neural network model to extract the temporal pattern of the user's historical behavior, and a user behavior sequence model for describing the user's normal behavior habits is generated based on the training results.

[0065] It should be noted that a user behavior sequence model is constructed based on historical top-up behavior data and pre-top-up operation logs to identify timing deviation anomalies in the operation chain. First, the system performs time serialization on each user's behavior events. This process uses timestamps as the primary index and arranges all key user actions before each top-up in the order of occurrence. For example, these include behavior events such as "logging in to your account," "browsing the page," "clicking the top-up portal," "selecting a payment method," and "submitting an order." Each behavior event also contains additional attribute information such as operation duration, page dwell time, and event trigger location. After serialization, the system vectorizes each behavior event. This process utilizes a multi-type feature joint embedding strategy. Discrete fields such as operation type, page ID, and payment channel are represented using one-hot encoding or embedding vectors. Continuous variables such as dwell time and operation interval are normalized and mapped to a unified numerical space, ultimately forming a multi-dimensional behavior feature vector sequence. The system constructs training samples using a fixed window approach, with the sequence within each window representing a complete top-up behavior chain.

[0066] Next, the system uses a temporal neural network model to train the constructed feature vector sequence. In this embodiment, a bidirectional long short-term memory network (Bi-LSTM) is preferably used to simultaneously model the forward and backward dependencies of user behavior, thereby capturing the contextual logic between behavioral events in the sequence. The training process is carried out in a semi-supervised manner, that is, samples marked as normal behavior are used as the main training set, and a reconstruction loss function is introduced through an autoencoder structure to enhance the model's learning ability for sequence integrity and temporal rationality. During the learning process, the model gradually forms an abstraction of the behavioral pattern of the user's typical recharge operation process, including operation sequence, timing rhythm, page jump path, etc. After training is completed, the system solidifies the model parameters as a reference benchmark for behavioral deviations in subsequent real-time detection. In actual detection, the system can input the user's current behavior sequence into the model to determine its degree of consistency with the historical behavior pattern, thereby quantifying the abnormal deviation of the behavior chain in structure, sequence or rhythm. Compared with traditional event counting or static rule-based methods, this embodiment has obvious advantages in modeling depth and structural expression, and can highly sensitively identify timing anomalies in complex behavior chains, especially in dealing with highly disguised attack behaviors such as scripted and automated batch operations.

[0067] Furthermore, the serializing of each user's behavior events in chronological order includes:

[0068] The historical recharge behavior data and pre-recharge operation behavior logs are sorted according to timestamps, and the operation events, page browsing, recharge attempts, payment actions and corresponding occurrence times of the same user in each login cycle are arranged in sequence to construct a behavior event sequence containing operation type, behavior parameters and time information.

[0069] Specifically, all user operation data is strictly time-sorted based on the timestamp field in each log record. During this sorting process, the user account ID is used as the primary key to extract the complete user interaction process within each login cycle. Login cycles are typically marked by the "login" and "logout" or "session timeout" events as their start and end points. During a login cycle, users may perform a series of actions, including browsing pages, clicking on functions, initiating top-ups, selecting payment methods, submitting orders, and completing payments. The system chronologically arranges these actions to generate structured sequences of behavioral events. Each behavioral event is represented as a triple, consisting of the action type (e.g., "clicking the top-up entry," "selecting a bank card payment"), key parameters (e.g., payment channel ID, top-up amount, selected product type), and corresponding temporal information (e.g., time of event occurrence, time interval between previous actions, etc.). These sequences preserve not only the operational content of user actions but also the temporal structure between them, enabling the model to learn the rhythmic characteristics and behavioral dependencies within typical user action flows. For example, in real-world logs, a typical user top-up behavior might be: "Login (0 seconds) - Browse the activity page (+15 seconds) - Click the top-up button (+20 seconds) - Select a payment method (+5 seconds) - Confirm payment (+3 seconds) - Complete redirect (+2 seconds)." This behavior chain is serialized into a sequence of operations with time intervals, providing high-fidelity input for subsequent vector encoding and model training.

[0070] Furthermore, the calculation of the behavior offset vector using the real-time behavior data and the user behavior sequence model includes the following steps:

[0071] Perform feature encoding on real-time behavior data and convert it into a real-time behavior feature vector sequence;

[0072] Based on the user behavior sequence model, similarity calculation is performed on the real-time behavior feature vector sequence to generate the deviation between the current behavior sequence and the historical normal behavior habits;

[0073] Each deviation index is standardized and weighted to generate a behavior deviation vector that characterizes the difference between the user's current behavior sequence and his historical behavior pattern.

[0074] In some embodiments, the detection phase first receives behavioral data from the real-time log stream and collects and preprocesses all operational events of the current user within a login cycle. Consistent with the model training phase, the system organizes various behavioral events within the login cycle (such as page clicks, function jumps, top-up initiations, payment submissions, etc.) into chronological operation sequences and converts each event into a unified feature vector representation. Feature encoding includes categorical embedding of operation types, numerical normalization of operation parameters, and interval encoding of temporal features, ultimately generating a fixed-structure real-time behavioral feature vector sequence as model input. The system then inputs this sequence into the corresponding user's behavioral sequence model. This model is a time-series neural network trained on historical data that can represent the user's typical top-up behavior chain. During the inference process, the model performs a structural comparison of the current input sequence and extracts information about the differences between it and historical patterns. In this embodiment, similarity calculation is implemented using a reconstruction error-based approach. Specifically, the model attempts to map the input behavior sequence to its reconstructed form in the historical behavior space and calculates sequence deviation by comparing metrics such as mean square error, time step difference, or attention mismatch between the original input and the reconstructed output. This process can accurately capture non-obvious anomalies in the behavioral process, such as local jumps, missing steps, and sudden changes in rhythm. To further improve comparability across users or behavioral scenarios, the system normalizes each deviation indicator using the Z-score to eliminate differences in numerical scales. Subsequently, based on the importance distribution of feature dimensions, a weighted summation strategy is applied to integrate multiple deviation indicators into a unified behavioral deviation vector. Each dimension in this vector corresponds to the degree of abnormality of a sequence behavior feature, and its overall structure can be used as a quantitative expression of the risk of the behavioral sequence in the sense of time series modeling.

[0075] Furthermore, the reinforcement learning model is constructed by the following steps:

[0076] Using the received static detection vector and behavior offset vector as the current environment state input, it defines transaction freezing, secondary verification, account locking, and initiating manual review as a set of optional actions.

[0077] Set a reward function based on the accuracy of historical anomaly detection, interception amount, false interception amount, and number of user complaints;

[0078] Based on the environment state input, optional action set and reward function, iterative training is performed through the deep Q network to output a real-time response strategy.

[0079] Specifically, after each top-up behavior monitoring, the system concatenates the static detection vector and the behavior offset vector, respectively output by the static offset calculation module and the behavior sequence detection module, to form a state input. This state vector comprehensively reflects the combined degree of abnormality of the current behavior in terms of both user characteristics and temporal behavior. Based on this, the system defines a variety of optional risk response actions as a set of actions in the reinforcement learning process, including freezing the current transaction, initiating a secondary verification process for the user, temporarily locking the user account, and triggering a manual review mechanism. Each action has a different level of intervention and business impact, and in practice, it is necessary to dynamically balance its risk control effectiveness with the user experience cost. To quantify the effectiveness of risk management and guide policy learning, the system constructs a reward function consisting of multiple metrics. This function assigns a value based on the actual performance of each response action in the historical handling record, including the number of abnormal behaviors accurately identified (i.e., detection accuracy), the amount of abnormal top-ups successfully intercepted, the amount of normal users intercepted due to handling errors (i.e., false interception rate), and the number of user complaints generated after risk control intervention. Among them, accurate interception will bring positive rewards, while false interception and complaints will lead to negative penalties. Based on this, the system constructs a unified feedback signal as the training basis for the reinforcement learning model. During the training process, the system uses the deep Q network (DQN) as the policy learning architecture. In the specific implementation, the Q network takes the current state vector as input and outputs the expected reward value (Q value) corresponding to each optional action. The system selects the current optimal response action based on the Q value. During the training phase, the system uses historical records to construct a state-action-reward triple, updates the network parameters by minimizing the temporal difference error, and continuously approaches the optimal policy function. In the training iteration, the system introduces the experience replay mechanism and greedy policy control to improve training stability and policy diversity, and prevent local optimal convergence.

[0080] Furthermore, the reward function is as follows:

[0081]

[0082] Among them, R is the reward value; a k The number of abnormal recharge behaviors successfully intercepted in the kth round of detection; b k is the number of normal behaviors falsely reported in the kth round of detection; m k is the total amount of abnormal recharges actually intercepted in round k; c k is the number of user complaints caused by risk control measures in the kth round; α, β, γ and λ are preset weight coefficients.

[0083] Specifically, after each round of risk response, the system records the following key metrics: the number of successfully intercepted abnormal deposits, the number of falsely reported normal user behaviors, the total value of successfully intercepted abnormal deposits, and the number of user complaints resulting from risk control measures. These metrics collectively reflect the actual performance of the current risk control strategy across three dimensions: accuracy, economic value, and user impact. To transform these metrics into usable feedback signals for reinforcement learning, the system assigns corresponding weights to each metric and constructs a weighted sum reward function. Successfully intercepted abnormal behaviors and intercepted amounts provide positive incentives for the model, guiding the strategy to select more defensive responses. The number of false positives and user complaints, on the other hand, serves as negative penalties, discouraging over-intervention and improving user experience. By adjusting the weight parameters for different business scenarios, the reinforcement learning model can flexibly control its balance between interception rate and fault tolerance.

[0084] The above embodiments are merely descriptions of preferred embodiments of the present invention and are not intended to limit the scope of the present invention. Without departing from the design spirit of the present invention, various modifications and improvements made to the technical solutions of the present invention by ordinary engineering technicians in this field should fall within the scope of protection determined by the claims of the present invention.

Claims

1. A recharge behavior abnormality monitoring system based on big data and artificial intelligence, characterized by: It includes data acquisition module, static offset calculation module, behavior sequence detection module and anomaly monitoring module; The data collection module is used to collect historical recharge behavior data and real-time user behavior data; The static offset calculation module is used to construct a user static profile and a device IP static profile based on historical recharge behavior data, calculate the real-time behavior data deviation value based on the user static profile and the device IP static profile, and generate a static detection vector; The behavior sequence detection module is used to build a user behavior sequence model based on historical recharge behavior data, and calculate the behavior offset vector through real-time behavior data and the user behavior sequence model; The anomaly monitoring module is used to output a real-time response strategy through a reinforcement learning model based on a static detection vector and a behavior deviation vector.

2. The system for monitoring abnormal recharge behavior based on big data and artificial intelligence according to claim 1 is characterized in that: The historical recharge behavior data includes the user's recharge time, recharge amount, recharge frequency, payment method, login device identification, login IP address and corresponding geographical location information, and also includes the user's operation behavior log before recharging.

3. The system for monitoring abnormal recharge behavior based on big data and artificial intelligence according to claim 2 is characterized in that: The construction of user static profile and device IP static profile based on historical recharge behavior data includes the following steps: Based on the historical recharge behavior data, extract the recharge time, recharge amount, recharge frequency, payment method, login device identifier, login IP address and pre-recharge operation behavior log for each user account to form a user behavior feature data set; Performing statistics on the user behavior feature dataset to summarize the time distribution, amount distribution, payment method preference, device change frequency, and IP regional distribution of user recharge behaviors to obtain user static portrait features; Based on the number of login accounts, switching frequency, and recharge geographical location of each device identification and IP address in the historical recharge behavior data, the devices and IPs are aggregated and statistically analyzed to obtain the static portrait features of the device IP.

4. The system for monitoring abnormal recharge behavior based on big data and artificial intelligence according to claim 3 is characterized in that: Calculating the real-time behavior data deviation value based on the user static profile and the device IP static profile to generate a static detection vector includes the following steps: Align the feature dimensions of the real-time behavior data feature vector with the user static profile feature and the device IP static profile feature to generate feature pairs to be compared; For each feature pair, the cosine similarity is used to measure the distance between the real-time behavior data and the static portrait features to obtain the deviation score of each feature item; The deviation scores of each feature item are normalized to generate a static detection vector.

5. The system for monitoring abnormal recharge behavior based on big data and artificial intelligence according to claim 4 is characterized in that: The normalization includes Z-score normalization.

6. The system for monitoring abnormal recharge behavior based on big data and artificial intelligence according to claim 4 is characterized in that: The user behavior sequence model is constructed by the following steps: Based on the historical recharge behavior data and the pre-recharge operation behavior log, each user's behavior events are serialized in chronological order to generate a user historical behavior event sequence; Performing data encoding and normalization processing on the user's historical behavior event sequence to generate a behavior feature vector sequence for model training; The behavior feature vector sequence is semi-supervisedly trained based on a temporal neural network model to extract the temporal pattern of the user's historical behavior, and a user behavior sequence model for describing the user's normal behavior habits is generated based on the training results.

7. The system for monitoring abnormal recharge behavior based on big data and artificial intelligence according to claim 6 is characterized in that: The serializing of each user's behavior events in chronological order includes: The historical recharge behavior data and pre-recharge operation behavior logs are sorted according to timestamps, and the operation events, page browsing, recharge attempts, payment actions and corresponding occurrence times of the same user in each login cycle are arranged in sequence to construct a behavior event sequence containing operation type, behavior parameters and time information.

8. The system for monitoring abnormal recharge behavior based on big data and artificial intelligence according to claim 6 is characterized in that: Calculating the behavior offset vector using real-time behavior data and a user behavior sequence model includes the following steps: Perform feature encoding on real-time behavior data and convert it into a real-time behavior feature vector sequence; Based on the user behavior sequence model, similarity calculation is performed on the real-time behavior feature vector sequence to generate the deviation between the current behavior sequence and the historical normal behavior habits; Each deviation index is standardized and weighted to generate a behavior deviation vector that characterizes the difference between the user's current behavior sequence and his historical behavior pattern.

9. The system for monitoring abnormal recharge behavior based on big data and artificial intelligence according to claim 1 is characterized in that: The reinforcement learning model is constructed by the following steps: Using the received static detection vector and behavior offset vector as the current environment state input, it defines transaction freezing, secondary verification, account locking, and initiating manual review as a set of optional actions. Set a reward function based on the accuracy of historical anomaly detection, interception amount, false interception amount, and number of user complaints; Based on the environment state input, optional action set and reward function, iterative training is performed through the deep Q network to output a real-time response strategy.

10. The system for monitoring abnormal recharge behavior based on big data and artificial intelligence according to claim 9 is characterized in that: The reward function is as follows: Among them, R is the reward value; a k The number of abnormal recharge behaviors successfully intercepted in the kth round of detection; b k is the number of normal behaviors falsely reported in the kth round of detection; m k is the total amount of abnormal recharges actually intercepted in round k; c k is the number of user complaints caused by risk control measures in the kth round; α, β, γ and λ are preset weight coefficients.

Images