Abnormal member early warning marketing management system and method based on customer behaviors

Abstract

The invention discloses an abnormal member early warning marketing management system and method based on customer behaviors, and relates to the technical field of customer behavior early warning. The system comprises a behavior acquisition and storage module, an analysis dynamic screening module, an abnormal gang marking module, a notification and white list management module and an abnormal member processing module. The technical key points are as follows: precise monitoring in special scenes such as seckilling activities is realized, and the false alarm rate is further reduced; in combination with a graph attention mechanism, real gang cooperation and accidental behavior overlapping can be distinguished; the attention coefficient between the nodes is calculated, and the nodes with strong relevance are focused on, so that false alarms caused by accidental similarity are reduced; and a multi-stage verification process is adopted, so that only the strictly verified user can be finally marked as the abnormal gang member, and the reliability and the accuracy of the system on abnormality judgment are effectively balanced.

Description

Technical Field

[0001] The present invention relates to the technical field of customer behavior early warning, and in particular to an abnormal member early warning marketing management system and method based on customer behavior. Background Art

[0002] Customer behavior early warning is a mechanism that uses data analysis and artificial intelligence to identify abnormal or potentially risky customer behavior. It models historical customer behavior data and monitors current behavior in real time to detect deviations from normal patterns. These early warnings can address credit risk, fraud, customer churn, and other aspects. Timely early warnings can help companies take appropriate measures, such as strengthening verification procedures, providing personalized offers, or improving customer service. In the daily operations of some shopping malls, there are significant value-added services such as free delivery, membership points, and membership level discounts. These services often give rise to customer behaviors such as scalpers and wool-collecting parties who place fake orders. Currently, screening or early warning can only be carried out through customer lists. However, this type of screening is costly on the one hand and has a high false alarm rate on the other.

[0003] In combination with the above description and the prior art: (1) When conducting early warning marketing management for member customers, the conventional management method is usually to set a threshold for customer consumption. However, the traditional fixed threshold has a high misjudgment rate when dealing with emergencies. Although the threshold can be changed according to historical data and a dynamic threshold model can be set, there will still be problems of response delay and misjudgment. For example, in the event of an emergency (such as fake orders in flash sales), the traditional dynamic threshold model may fail due to the following reasons: Response delay: Dynamic thresholds rely on the statistical characteristics of historical data (such as moving average and standard deviation) and require calculation within a certain time window (such as 5 minutes). They cannot capture instantaneous surges within 1 minute. Risk of misjudgment: Normal flash sales may form legitimate high-density order clusters, which may be misjudged as anomalies by relying solely on dynamic thresholds. (2) Regarding scalpers who are organized into gangs: In the past, rule-based or simple statistical methods could not effectively identify group fraud across multiple dimensions (such as different stores and different time periods); due to the lack of effective differentiation methods, traditional anti-fraud systems often face high false alarm rates (that is, normal users are mistakenly marked as abnormal) and low recall rates (that is, all fraudulent behaviors are not identified), and thus cannot effectively balance the reliability and accuracy of abnormality judgment. Summary of the Invention

[0004] To achieve the above objectives, the present invention is implemented through the following technical solutions: An abnormal member early warning marketing management system based on customer behavior, which includes: Behavior collection and storage module collects and stores customer consumption data; Among them, customer consumption data includes at least order data and status data; Analyze the dynamic screening module and build an initial rule engine. This module analyzes customer consumption data and identifies members who meet abnormal conditions during inactive periods. During active periods, it performs real-time stream processing and cluster analysis, dynamically adjusts the rule engine, and identifies members who meet abnormal conditions. The abnormal group marking module builds a triplet graph structure based on a graph neural network. After graph representation learning and abnormality score calculation, it marks suspected abnormal group members as abnormal members when the trigger conditions are met, and performs label verification and judgment: Through the dynamic adjacency matrix and graph structure evolution, we identify whether abnormal nodes form a high-density subgraph to determine the potential gang. If it is determined to be a potential gang, the first-level verification strategy is triggered; otherwise, the graph attention mechanism is used to identify whether there is a strong correlation path between nodes; if so, it is determined to be a strongly correlated gang and the second-level verification strategy is triggered.

[0005] Furthermore, the order data includes at least: the amount, time, store information, actual payment amount and points earned of each customer's purchase; Status data includes at least: member points log, disabled status, and store membership.

[0006] Furthermore, during the inactive period, the hierarchical filtering process in the initial rule engine is as follows: Single transaction screening: Check whether there is a single transaction ≥ the set amount threshold Q; Any store screening: Count whether there are purchases at the same store within a specified time period that are greater than or equal to the set purchase threshold L; Cumulative screening: calculate whether the total consumption of all stores in the entire mall is greater than the set total threshold H; Trigger log generation: For members who meet any of the filtering conditions, the triggered filtering item ID and the associated order list will be recorded.

[0007] Furthermore, during the event, real-time stream processing is performed: the Apache Flink framework is used to process order streams in real time, aggregating order data from the last minute. The tolerance range ∈ of consumption amount fluctuations and the minimum number of abnormal orders Pts_min are obtained in real time. Cluster analysis is performed to map order data to a consumption amount-time coordinate system to detect high-density abnormal clusters. Trigger conditions are determined when a customer's order falls into a cluster that meets the following conditions: Cluster density > normal cluster density mean / 2 and intra-cluster amount fluctuation >∈; When a high-density abnormal cluster is detected, the risk score S and threshold adjustment coefficient τ0 of the high-density abnormal cluster are introduced to dynamically adjust the dynamic threshold model and obtain a new dynamic threshold; among them, the risk score of the high-density abnormal cluster is based on the number of orders in the cluster and the fluctuation of the amount in the cluster, and is obtained by weighted calculation.

[0008] Further, model design in graph neural network: Constructing customer-store-order triple graph structure: Nodes: customers, stores, and orders; Edge: The consumption relationship between customers and orders, and the ownership relationship between orders and stores; Graph representation learning: Use GNN to embed nodes into a low-dimensional space to capture the correlation characteristics of customers, stores, and orders; Abnormal score calculation: Based on the number of consumption orders of customer u, the clustering coefficient of the order-associated store, and the Euclidean distance between the customer embedding vector and the group mean, the abnormal score Sr of the customer node u is calculated in the following way: u : Sr u =α×Degree(u)+β×Clustering_Coefficient(u)+γ×Embedding_Outlier(u); In the formula, α, β and γ are weight coefficients; Trigger condition: When Sr u When GNN_Threshold>GNN_Threshold, it is marked as a suspected abnormal gang member; where GNN_Threshold represents the preset threshold of the model, and GNN_Threshold>0.

[0009] Furthermore, dynamic adjacency matrix update: regularly recalculate the cosine similarity of node embedding vectors to generate the adjacency matrix A: Where, sim(u,o): cosine similarity between node u and node o; Graph structure evolution: Using the DBSCAN algorithm, high-density subgraphs are detected based on the adjacency matrix A; Judgment condition: If the abnormal nodes {u1, u2, ..., un} form a subgraph and the edge density within the subgraph exceeds 0.8, it is judged as a potential gang; otherwise, it is judged as a non-potential gang.

[0010] Furthermore, the operation steps of the graph attention mechanism are as follows: Attention weight calculation: Use the GAT model to calculate the attention coefficient Q between nodes u，o; Strong correlation path extraction: When the attention weight Q of node u and node o u，o ≥0.8, a strong association is identified.

[0011] Furthermore, the content of the first-level verification strategy is as follows: Embedding vector clustering: Embedding vectors of abnormal nodes Clustering is performed and intra-cluster similarity is calculated. Behavior pattern comparison: Check whether the consistency of consumption behavior characteristics of abnormal nodes exceeds 80%. Consumption behavior characteristics include consumption amount, time interval, and store preference. Verification criteria: If either the intra-cluster average similarity ≥ 0.8 or the consistency of consumption behavior characteristics exceeds 80%, the verification is passed. In the secondary verification strategy, the steps of embedding vector clustering and behavioral pattern comparison are the same; the judgment condition becomes: if the average similarity within the cluster is ≥ 0.8 and the consistency of consumption behavior characteristics exceeds 80%, it means that the verification is passed.

[0012] Furthermore, the system also includes: a notification and whitelist management module, which issues early warning notifications based on the mark verification judgment results and provides a whitelist mechanism to eliminate misjudgments; an abnormal member handling module, which performs restriction handling operations on members who meet the abnormal conditions; performs disabling processing operations on suspected gang abnormal members; and performs cancellation + points clearing operations on abnormal gang members.

[0013] The abnormal member early warning marketing management method based on customer behavior includes the following steps: S101. Collect and store customer consumption data; Among them, customer consumption data includes at least order data and status data; The method is characterized by further comprising: S102, building an initial rule engine, analyzing customer consumption data, and identifying members meeting abnormal conditions during non-activity periods; during activity periods, performing real-time stream processing and cluster analysis, and dynamically adjusting the rule engine to identify members meeting abnormal conditions; S103: Build a triplet graph structure based on a graph neural network. After graph representation learning and anomaly score calculation, if the trigger condition is met, mark it as a suspected abnormal gang member and perform label verification and judgment: Through the dynamic adjacency matrix and graph structure evolution, we identify whether abnormal nodes form a high-density subgraph to determine whether they are potential gangs. If they are judged as potential gangs, the first-level verification strategy is triggered. Otherwise, the graph attention mechanism is used to identify whether there are strong correlation paths between nodes. If so, it is determined to be a strongly correlated gang and the second-level verification strategy is triggered. S104: Issue an early warning notification based on the tag verification judgment result, and provide a whitelist mechanism to eliminate misjudgment; S105. Execute restriction processing operations on members who meet the abnormal conditions; execute ban processing operations on members who meet the abnormal conditions suspected of being members of a gang; execute cancellation + clearing points operations on members who meet the abnormal conditions of a gang.

[0014] The present invention provides an abnormal member early warning marketing management system and method based on customer behavior, which has the following beneficial effects: (1) By combining the dynamic threshold model with real-time stream computing and cluster analysis, the following effects are achieved: Minute-level response: In the event of an emergency, threshold adjustment delay is shortened, improving interception efficiency; Accurate identification capability: The false positive rate is significantly reduced compared to traditional methods, with zero false positives for legitimate flash sales. Adaptive evolution: No need for frequent manual rule adjustments; the model can automatically adapt to new order-brushing patterns, reducing operation and maintenance costs. Driven by the dual engines of "statistical dynamic thresholds + real-time behavior clustering," this solution addresses the response lag of traditional methods in emergency scenarios, providing a more robust solution for anti-fraud systems. It also enables precise monitoring in special scenarios such as flash sales, further reducing false alarm rates. (2) By running the abnormal group marking module, the following effects were achieved: Accurate group identification: Graph Neural Networks (GNNs) are used to embed customer-store-order information into a low-dimensional space (for example, each customer originally corresponds to a five-dimensional vector, but with GNNs, each customer corresponds to a three-dimensional vector). This captures the complex correlation characteristics between customers, improving identification accuracy and revealing hidden group relationships. Dynamic Adjustment and Enhanced Adaptability: By regularly updating the cosine similarity of node embedding vectors and dynamically adjusting the adjacency matrix, the system ensures that the graph structure is updated in real time as it changes over time, enabling the system to quickly respond to new fraud patterns or changes in strategies. Reducing false positives and multi-level verification: Incorporating a graph attention mechanism, it can distinguish between true group collaboration and accidental behavioral overlap. By calculating the attention coefficient between nodes, it focuses on nodes with strong correlations, reducing false positives caused by accidental similarities. A multi-stage verification process ensures that only users who have undergone rigorous verification are ultimately marked as abnormal group members, effectively balancing the reliability and accuracy of the system's anomaly judgment. (3) By taking tiered measures to deal with abnormal members in different situations, risks can be effectively managed and the interests of the platform and other users can be protected. This refined management not only helps to combat fraud, but also maintains a good user experience and promotes the healthy development of the platform. Each measure should follow the principles of fairness and transparency and provide users with a reasonable complaint mechanism to ensure the fairness and accuracy of decision-making. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 This is a modular schematic diagram of the abnormal member early warning marketing management system based on customer behavior in the present invention; Figure 2 The figure is a schematic diagram of the overall process of the abnormal member early warning marketing management method based on customer behavior in the present invention. DETAILED DESCRIPTION

[0016] The following will provide a clear and complete description of the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0017] Example 1: See also Figure 1 This embodiment provides an abnormal member warning marketing management system based on customer behavior. The system is mainly designed for some scalpers and wool parties who make fake orders. The overall system includes multiple functional modules that run in sequence. The following is a description of each functional module: 1. Behavior collection and storage module: Collect customer consumption data in real time, provide a basic data source for anomaly detection, and store it; Among them, customer consumption data (i.e. corresponding to customer behavior) includes at least order data and status data; Order data: the amount, time, store information, actual payment amount, and points earned for each customer purchase; Specifically, order data is obtained from the sales order system, namely the amount, time, store information, actual payment amount and points earned (including the number of transactions) of each customer's consumption.

[0018] Status data: member points log, disabled status, and store membership; Specifically, it is necessary to synchronize member points logs, disabled status, store membership status and other information to the system database; Storage, i.e. historical data archiving: retaining customer consumption data within 90 days to support historical behavior analysis; For example: The system records three transactions made by a member (MCU123) yesterday (20XX-0X-0X): Spend 3,000 yuan at store A, 2,000 yuan at store B, and 500 yuan at store C, totaling 5,500 yuan, and earn 550 points.

[0019] Analyze the dynamic screening module: Build an initial rules engine, perform multi-dimensional data analysis based on customer consumption data, and identify members who meet abnormal conditions when it is determined to be a non-active period. When it is determined to be an active period, perform real-time stream processing and cluster analysis, dynamically adjust the rules engine, and use the new rules engine to identify members who meet abnormal conditions. Among them, the initial rule engine (sets three filtering dimensions): Hierarchical screening process: Single transaction screening: Check whether there is a single transaction ≥ the set amount threshold Q; Any store filter: Count whether the number of purchases at the same store within a specified period is greater than or equal to the set transaction threshold L (currently only a single filter item is available. Based on the actual needs of the solution, a maximum of five filter items can be added to a filter dimension). Cumulative screening: calculate whether the total consumption of all stores in the entire mall is greater than the set total threshold H; The set amount threshold Q, the set number threshold L, and the set total amount threshold H all belong to the dynamic threshold Dynamic_Threshold; and Q, L, and H are all greater than 0. For example: the set amount threshold Q = 5,000 yuan; the number of transactions at the same store in the past 7 days ≥ the set number threshold L = 15 times; the total amount of transactions at all stores in the entire mall ≥ the set total threshold H = 50,000 yuan; As for the initial threshold value L of the number of transactions, its specific value can be set independently according to the actual situation; Introducing a dynamic threshold model to dynamically adjust the set amount threshold Q and the set total amount threshold H; The model formula is as follows: Where, u: the average consumption value in the past T days (e.g., 7 days); σ: standard deviation of consumption over the past T days; k: hyperparameter (e.g., 2.5), controls threshold sensitivity, k>0; t: the interval between the current time and the most recent dynamic threshold update time (hours); τ: time decay coefficient (e.g., 24 hours), indicating the rate at which the dynamic threshold decays over time; Logic description: Dynamic: The exponential decay term exp(-t / τ) is used to make recent data have a greater impact on the dynamic threshold, adapting to consumption peaks or holiday fluctuations. Robust: The mean and standard deviation are combined to avoid interference from extreme values. For example, a sudden increase in single consumption will not excessively trigger warnings. The reference examples are as follows: Table 1: Abnormal member warning rules (i.e., the solutions included in the rule engine): Table 2: Abnormal member log

[0020] Table 3: Filter item trigger log

[0021] The event period shall at least include: product promotion activities, flash sales activities and other types of promotional activities; Real-time stream processing: Use the Apache Flink framework to process order streams in real time, aggregating order data from the last minute. Obtain the consumption amount fluctuation tolerance range∈ (e.g., ±5%) and the minimum number of abnormal orders Pts_min (e.g., 3) in real time. Cluster analysis: Map order data to the consumption amount-time coordinate system to detect high-density abnormal clusters; Trigger condition: If a customer's order falls into a cluster that meets the following conditions: Cluster density > normal cluster density mean / 2 and intra-cluster amount fluctuation >∈; When a high-density abnormal cluster is detected, the dynamic threshold model is dynamically adjusted in the following ways: Where Dynamic_Threshold x : New dynamic threshold; S: risk score of high-density abnormal clusters; Calculated based on the number of orders and amount fluctuations within the cluster (e.g., S = weight 1 × number of orders + weight 2 × amount fluctuation); where weight 1 + weight 2 = 1; the weight coefficient is determined using the coefficient of variation method, which assigns weights to each indicator based on the degree of variation between the current value and the target value of each evaluation indicator; if the numerical difference of an indicator is large, it can clearly distinguish the evaluated objects, indicating that the indicator has rich discriminative information, and thus should be given a larger weight; conversely, if the numerical difference of each evaluated object on a certain indicator is small, then the ability of this indicator to distinguish the evaluated objects is weak, and thus should be given a smaller weight; this method directly uses the information contained in each indicator to calculate the indicator weight, and therefore is objective; τ0: threshold adjustment coefficient (e.g. 0.2), which controls the threshold tightening > amplitude, and 1 > τ0 > 0; Logic description: Dynamically tighten thresholds: When an abnormal cluster is detected, the dynamic threshold is immediately lowered, for example, by reducing the set amount threshold Q from 5,000 yuan to 4,500 yuan, accelerating anomaly identification. Localized adjustments: The threshold is adjusted only for the customer or store that triggered the abnormal cluster to avoid global misjudgments. The above technical solution was used to perform collaborative optimization of dynamic thresholds and real-time stream + clustering analysis, achieving the following technical results: Effect 1: Improved minute-level response capabilities. Example: During a flash sale, a fraudulent order scammers placed 100 orders within one minute, each worth 4,900 yuan (slightly lower than the original threshold of 5,000 yuan). Traditional dynamic threshold: It takes 5 minutes to calculate the moving average before triggering the warning, at which time the order has been completed; Collaborative solutions: A surge in order density was detected in real time, and cluster analysis (DBSCAN) identified high-density abnormal clusters; the dynamic threshold was adjusted to 4,950 yuan, and subsequent orders were immediately marked as abnormal; the system intercepted subsequent order-padding behavior within 1 minute.

[0022] Effect 2: Reduced misjudgment rate Case: A normal flash sale activity forms a legitimate high-density order cluster (small amount fluctuation and concentrated time); Traditional dynamic thresholds: Due to a surge in order volume, they may be misjudged as abnormal. Collaborative solutions: Cluster analysis (DBSCAN) detected that the amount fluctuation within the cluster was small (consistent with normal flash sales characteristics) and the risk score was low; the dynamic threshold was not adjusted, and the system ignored the cluster to avoid misjudgment.

[0023] Effect 3: Enhanced adaptability Case: New order-brushing model (such as small-amount, high-frequency orders); Traditional dynamic thresholds: rely on historical data and cannot identify new patterns; Collaborative solutions: Real-time streaming detects abnormal order density (e.g., a customer places five small orders within one minute); After cluster analysis (DBSCAN) marks an abnormal cluster, the small order threshold is dynamically adjusted (for example, the daily cumulative limit is reduced from 1,000 yuan to 800 yuan); the system quickly adapts to the new abnormal pattern without manual intervention.

[0024] Key points of technical implementation: Closed loop of real-time streaming and dynamic thresholds: Clustering results are called back to the dynamic threshold model via API, triggering threshold adjustments. In-memory databases such as Redis can be used to cache real-time calculation results to ensure low latency. Dynamic weighting of risk scores: The weight parameter S is adjusted based on the business scenario (e.g., "amount fluctuation" is given a higher weight for fraudulent order-scaling gangs). A smoothing mechanism for threshold adjustments can also be added: an upper limit for threshold adjustments can be set (e.g., a single adjustment range ≤ 15%) to avoid overreaction. In summary, by combining the dynamic threshold model with real-time stream computing and cluster analysis, the following breakthrough results were achieved: Minute-level response: In the event of anomalies, threshold adjustment delays are reduced from 5 minutes to within 1 minute, improving interception efficiency by 80%. Accurate identification: The false positive rate is reduced to less than 2% (compared to 15% with traditional methods), ensuring zero false positives for legitimate flash sales. Adaptive evolution: The model automatically adapts to new order-boosting patterns without frequent manual rule adjustments, reducing operation and maintenance costs. Driven by the dual engines of "statistical dynamic thresholds + real-time behavior clustering," this solution solves the response lag problem of traditional methods in emergency scenarios, providing a more robust solution for anti-fraud systems; it achieves precise monitoring in special scenarios such as flash sales, further reducing the false alarm rate.

[0025] Trigger log generation: For members who meet any of the filtering conditions, record the triggered filtering item ID (any one or more of single filtering, any store filtering, and cumulative filtering) and the associated order list.

[0026] 3. Abnormal group marking module: A triplet graph structure is constructed based on a graph neural network. After graph representation learning and anomaly score calculation, the member is marked as a suspected abnormal gang member when the trigger condition is met. Then mark and verify the suspected abnormal members of the gang: Through the dynamic adjacency matrix and graph structure evolution, we identify whether abnormal nodes form a high-density subgraph to determine whether they are potential gangs. If they are determined to be potential gangs, the first-level verification strategy is triggered. After passing the verification, the mark will be changed to abnormal gang member; Otherwise, the mark of suspected abnormal gang members will be cancelled; When it is determined to be a non-potential gang, the graph attention mechanism is used to identify whether there is a strong correlation path between the nodes; if so, it is determined to be a strongly correlated gang and the secondary verification strategy is triggered; After passing the verification, the mark will be changed to abnormal gang member; Otherwise, the mark of suspected abnormal gang members will be maintained and a recheck confirmation signal will be issued; It should be noted that the model design in the graph neural network (GNN): Construct the customer-store-order triple graph structure: Nodes: Customer (MCU), Store (Store), Order (SO); Edge: The consumption relationship between customers and orders, and the ownership relationship between orders and stores; Graph representation learning: Use GNN (such as GraphSAGE) to embed nodes into a low-dimensional space to capture the associated features of customers, stores, and orders; Anomaly score calculation: The abnormality score Sr of customer node u u Use the following formula: Sr u =α×Degree(u)+β×Clustering_Coefficient(u)+γ×Embedding_Outlier(u); Where, Degree(u): the number of consumption orders of customer u (degree centrality); Clustering_Coefficient(u): clustering coefficient of the stores associated with customer u’s orders (measure of group aggregation); For customer u, the clustering coefficient of the stores associated with his orders can be regarded as the clustering coefficient of a subgraph formed by all stores related to his orders. Specifically, if a customer's orders are concentrated in a few stores and the connections between these stores are close, then the clustering coefficient of this customer is high. The algorithm steps are as follows: For customer u, collect the store sets involved in all its related orders: Su={s1,s2,...,sn}; Construct an undirected graph G = (V, E), where V = Su, and edge E indicates whether there are common customers between the two stores (that is, at least one other customer has shopped at both stores at the same time); For each node vi (representing a store), calculate its degree di and the actual number of edges bi between its neighboring nodes; The clustering coefficient Clustering_Coefficient(u) of customer u can be calculated by the formula: Among them, the summation is performed on all nodes belonging to Su; Embedding_Outlier(u): Euclidean distance between the customer embedding vector and the group mean (to detect behavioral outliers); Among them, the embedding vector outlier is used to measure the degree of difference between the behavior pattern of customer u and the behavior pattern of the entire customer group; the algorithm process is as follows: Use a GNN model (such as GraphSAGE) to generate embedding vectors for all customers in the entire network; Calculate the average of all customer embedding vectors For customer u, its embedding vector is Then its outlier score is obtained by calculating the Euclidean distance from the group mean: α, β, γ: weight coefficients (such as 0.4, 0.3, 0.3), and α, β, γ are all greater than 0; Trigger conditions: When Sr u When the value is greater than GNN_Threshold (e.g. 0.8), the member is marked as a suspected abnormal gang member; Among them, GNN_Threshold represents the model preset threshold, and GNN_Threshold>0; Determination method: Using historical data sets, we first identify known good and fraudulent users; Calculate the abnormality score Sr for these two groups of users respectively u ; Draw the abnormal score distribution graph of normal users and fraudulent users, and find a suitable dividing point as GNN_Threshold, so as to maximize the detection of fraudulent users and minimize the false alarm rate; In practical applications, this threshold may need to be continuously adjusted and optimized according to the actual situation. In this solution, a simple method is adopted, that is, the area under the ROC curve (AUC) is used to evaluate the performance of different thresholds and the optimal threshold is selected as GNN_Threshold. Dynamic adjacency matrix update: Periodically (for example, every 15 minutes) recalculate the cosine similarity of the node embedding vectors to generate the adjacency matrix A; The calculation formula of cosine similarity is as follows: Where, The characteristic vector of node o. In this solution, node u can represent a normal customer, and node o can represent a known scalper. The formula logic is as follows: Cosine similarity calculation: The formula calculates the cosine similarity between two vectors, and the value range is [-1, 1]. The larger the value, the more similar the behavior of the two nodes. Similarity judgment: If the consumption behavior characteristics of two customers (such as high-frequency consumption, preference for the same store, and similar amount distribution) are highly similar, the similarity is close to 1. Dynamic adjacency matrix update: Dynamically adjust the adjacency matrix A of the graph according to the similarity, and set the connection weights between nodes with high similarity to high values ​​(1), otherwise set them to low values ​​(0). The significance of dynamic graph structure: Real-time: Recalculate cosine similarity every 15 minutes to ensure that the graph structure is updated as customer behavior changes; Targeted: For example, when new customers share similar behavioral characteristics with known scalpers, the two can be dynamically linked to facilitate subsequent group detection. Generate the adjacency matrix A: Graph structure evolution (subgraph clustering): Use DBSCAN or Louvain algorithm to detect high-density subgraphs based on the adjacency matrix A; Judgment conditions: If the abnormal nodes (such as u1, u2, ..., un) form a subgraph, and the edge density within the subgraph exceeds 0.8, it is judged as a potential gang; otherwise, it is judged as a non-potential gang; Among them, the first-level verification strategy: Embedding vector clustering: Embedding vectors of abnormal nodes Perform clustering (e.g., K-means) and calculate intra-cluster similarity. Compare behavior patterns: Check whether the consistency of consumption behavior characteristics of abnormal nodes exceeds 80%. Consumption behavior characteristics include consumption amount, time interval, and store preference. Judgment conditions: If either the average similarity within the cluster is ≥ 0.8 or the consistency of consumer behavior characteristics exceeds 80%, the verification is passed; Graph Attention Mechanism: Strong Correlation Path Analysis Objective: Identify whether there are strong correlation paths between nodes (such as collaboration between scalpers) through attention weights; The graph attention mechanism operates as follows: ① Attention weight calculation: Use the GAT model to calculate the attention coefficient Q between nodes u，o , the formula is as follows: Q u，o : The attention weight from node u to node o, which indicates the degree of attention u pays to o when aggregating neighbor information; Learnable weight matrix to optimize attention allocation through training; Concatenate the embedding vectors of nodes u and o into a new vector; Softmax: Normalization operation to ensure that the sum of attention weights is 1; Formula logic description: The role of the attention mechanism: dynamic weight allocation: through the weight matrix The model learns how to allocate attention based on node characteristics (such as consumption amount and time concentration); key feature capture: For example, if the consumption amount of node o is abnormally high and time-concentrated, the model will give it a higher attention weight and prioritize its influence on node u; Extension of the GAT model: The formula achieves differentiated attention to neighboring nodes by splicing node features and weighting them; For example, if the consumption behaviors of node u (new customer) and node o (scalper) are highly similar (e.g., high-frequency small orders), the model will assign a high attention weight to strengthen the correlation between the two. ② Strong correlation path extraction: If the attention weight Q of nodes u and o u，o ≥0.8, a strong association was identified; Example path: If a strong association chain is formed, it will be determined to be a strongly associated gang; Secondary verification strategy: Embedding vector clustering: Embedding vectors of abnormal nodes Perform clustering (e.g., K-means) and calculate intra-cluster similarity. Compare behavior patterns: Check whether the consistency of consumption behavior characteristics of abnormal nodes exceeds 80%. Consumption behavior characteristics include consumption amount, time interval, and store preference. Judgment conditions: If the average similarity within the cluster is ≥ 0.8 and the consistency of consumption behavior characteristics exceeds 80%, it means that the verification is passed; Send a review confirmation signal and introduce manual review; for example, manually review the order details (such as delivery address, payment method) to confirm, thereby reducing the risk of misjudgment.

[0027] The effects achieved by the above scheme are described as follows: Accurate group identification: Graph Neural Networks (GNNs) are used to embed customer-store-order information into a low-dimensional space, capturing the complex associations between customers. This not only improves identification accuracy but also enables the discovery of hidden group relationships. Example: In an e-commerce platform case, the system successfully identified a group of seemingly independent but actually closely connected users who were involved in a large-scale fake order operation. By analyzing their consumption patterns and transaction paths, the system was able to accurately classify them as a gang. Dynamic Adjustment and Enhanced Adaptability: By regularly updating the cosine similarity of node embedding vectors and dynamically adjusting the adjacency matrix, the system ensures that the graph structure is updated in real time as it changes over time, enabling the system to quickly respond to new fraud patterns or changes in strategies. Example: When a new pattern of small, high-frequency orders emerges, the system can automatically adjust its thresholds and weight distribution to quickly adapt to this new type of fraudulent behavior without manual intervention; Reducing false positives and multi-level verification: Incorporating a graph attention mechanism, it can distinguish between true group collaboration and accidental behavioral overlap. By calculating the attention coefficient between nodes, it focuses on nodes with strong correlations, reducing false positives caused by accidental similarities. A multi-stage verification process (including targeted primary and secondary verification strategies) ensures that only users who have undergone rigorous verification are ultimately marked as abnormal group members, effectively balancing the reliability and accuracy of the system's anomaly judgment. For example: During a promotion, although many users exhibited similar purchasing behaviors, the system only marked those users who were indeed closely related as suspected abnormal gang members, avoiding the misjudgment of a large number of normal users. For those marked as suspected abnormal gang members, the system first conducted a preliminary behavioral pattern comparison. If the conditions were met, it would enter a more in-depth inspection; otherwise, the mark would be cancelled. This process significantly reduced the risk of incorrect labeling and ensured the reliability and effectiveness of the labeling results.

[0028] 4. Notification and whitelist management module: Issue early warning notifications based on tag verification and judgment results, and provide a whitelist mechanism to eliminate false positives; You can choose to send a warning notification at a scheduled time: For example, at 10:00 every day, a message is sent to authorized members who follow the service account, including abnormal members of the gang, members who meet abnormal conditions, and suspected abnormal members of the gang; Whitelist mechanism, whitelist operation: Add to whitelist: Administrators can manually add misjudged members to the whitelist, and the system will filter them for subsequent detection; Remove from the whitelist: record the reason and time of the operation and restore the abnormal detection of the member (i.e., analyze the normal operation of the dynamic screening module and the abnormal group marking module); For example: the system detects MCU123 as an abnormal member, but after verification, it is confirmed that he is a VIP customer with normal consumption. The administrator adds him to the whitelist and notes "normal large consumption"; The reference examples are as follows: Table 4: Whitelist

[0029] Table 5: Whitelist operation log:

[0030] 5. Abnormal member handling module: Implement restrictive measures on members who meet abnormal conditions; Among them, for those members who have shown abnormal behavior but have not yet been determined to be fraudulent; restrictive disposal operations are intended to reduce potential risks while giving members the opportunity to prove their legitimacy or correct their wrong behavior; Measures to restrict disposal operations include: Limit purchase frequency or amount: such as single purchase limits, daily / weekly spending caps; increase verification steps: for example, requiring additional identity verification (such as SMS verification codes) for high-value transactions; restrict account functions: temporarily prohibiting the use of certain functions, such as refund applications and participation in promotions; Ban members suspected of being members of a gang who are abnormal; This policy primarily targets members who are initially identified as potentially involved in group fraud, but for whom the evidence is insufficient. Banning is a harsh but reversible measure designed to prevent further risks while allowing for subsequent review. Measures to disable processing operations include: Temporary account suspension: Suspends all activities on a member's account, including logging in, browsing products, and placing orders. Notification and appeal process: Sends a notification to the member informing them of the reason for the account suspension and providing a clear appeal path for them to explain the situation or submit evidence. For example, member A's account was temporarily suspended and they received an email with instructions on how to appeal to restore their account. For abnormal members of the group who meet the requirements, cancel the membership and clear their points; Among them, for users who have been clearly identified as members of a fraud gang; canceling their accounts and clearing all points is a final measure aimed at completely eliminating the threat posed by the user to the platform and serving as a warning to other users; The measures for cancellation + points clearing include: Permanently delete the account: remove all the member's information on the platform, making it impossible for them to access or use the service; points will be reset to zero: Revoke any reward points or coupons held by the member to ensure they cannot profit from them; To sum up, by taking tiered measures to deal with abnormal members in different situations, we can effectively manage risks and protect the interests of the platform and other users; this refined management not only helps to combat fraud, but also maintains a good user experience and promotes the healthy development of the platform; each measure should follow the principles of fairness and transparency, and provide users with a reasonable complaint mechanism to ensure the fairness and accuracy of decision-making.

[0031] Example 2: See also Figure 2 Based on Example 1, this embodiment further provides an abnormal member warning marketing management method based on customer behavior, including the following steps: S101. Collect and store customer consumption data; Among them, customer consumption data includes at least order data and status data; The method is characterized by further comprising: S102, building an initial rule engine, analyzing customer consumption data, and identifying members meeting abnormal conditions during non-activity periods; during activity periods, performing real-time stream processing and cluster analysis, and dynamically adjusting the rule engine to identify members meeting abnormal conditions; S103: Build a triplet graph structure based on a graph neural network. After graph representation learning and anomaly score calculation, if the trigger condition is met, mark it as a suspected abnormal gang member and perform label verification and judgment: Through the dynamic adjacency matrix and graph structure evolution, we identify whether abnormal nodes form a high-density subgraph to determine whether they are potential gangs. If they are judged as potential gangs, the first-level verification strategy is triggered. Otherwise, the graph attention mechanism is used to identify whether there are strong correlation paths between nodes. If so, it is determined to be a strongly correlated gang and the second-level verification strategy is triggered. S104: Issue an early warning notification based on the tag verification judgment result, and provide a whitelist mechanism to eliminate misjudgment; S105. Execute restriction processing operations on members who meet the abnormal conditions; execute ban processing operations on members who meet the abnormal conditions suspected of being members of a gang; execute cancellation + clearing points operations on members who meet the abnormal conditions of a gang.

[0032] The above embodiments can be implemented in whole or in part by software, hardware, firmware, or any other combination thereof. When implemented using software, the above embodiments can be implemented in whole or in part in the form of a computer program product. Those skilled in the art will appreciate that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution.

[0033] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, and may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment as needed.

[0034] The above is only a specific implementation method of the present application, but the scope of protection of the present application is not limited thereto. Any technician familiar with this technical field can easily think of changes or replacements within the technical scope disclosed in this application, which should be covered by the scope of protection of the present application.

Claims

1. An abnormal member early warning marketing management system based on customer behavior, which includes: Behavior collection and storage module collects and stores customer consumption data; Among them, customer consumption data includes at least order data and status data; The system also includes: an analysis and dynamic screening module, which builds an initial rule engine and analyzes customer consumption data to identify members who meet abnormal conditions during inactive periods; during active periods, it performs real-time stream processing and cluster analysis, dynamically adjusts the rule engine, and identifies members who meet abnormal conditions; The abnormal group marking module builds a triplet graph structure based on a graph neural network. After graph representation learning and abnormality score calculation, it marks suspected abnormal group members as abnormal members when the trigger conditions are met, and performs label verification and judgment: Through the dynamic adjacency matrix and graph structure evolution, we identify whether abnormal nodes form a high-density subgraph to determine the potential gang. If it is determined to be a potential gang, the first-level verification strategy is triggered; otherwise, the graph attention mechanism is used to identify whether there is a strong correlation path between nodes; if so, it is determined to be a strongly correlated gang and the second-level verification strategy is triggered.

2. The abnormal member early warning marketing management system based on customer behavior according to claim 1 is characterized by: Order data shall at least include: the amount, time, store information, actual payment amount and points earned of each customer's purchase; Status data includes at least: member points log, disabled status, and store membership.

3. The abnormal member early warning marketing management system based on customer behavior according to claim 1 is characterized by: During the inactive period, the initial hierarchical filtering process in the rule engine is as follows: Single transaction screening: Check whether there is a single transaction ≥ the set amount threshold Q; Any store screening: Count whether there are purchases at the same store within a specified time period that are greater than or equal to the set purchase threshold L; Cumulative screening: calculate whether the total consumption of all stores in the entire mall is greater than the set total threshold H; Trigger log generation: For members who meet any of the filtering conditions, the triggered filtering item ID and the associated order list will be recorded.

4. The abnormal member early warning marketing management system based on customer behavior according to claim 1 is characterized by: During the event, real-time stream processing was performed: the Apache Flink framework was used to process order streams in real time, aggregating order data from the last minute. The tolerance range for consumption fluctuations and the minimum number of abnormal orders (Pts_min) were obtained in real time. Cluster analysis: Map order data to a consumption amount-time coordinate system to detect high-density abnormal clusters. Trigger condition: A customer's order falls into a cluster that meets the following conditions: Cluster density > normal cluster density mean / 2 and intra-cluster amount fluctuation >∈; When a high-density abnormal cluster is detected, the risk score S and threshold adjustment coefficient τ0 of the high-density abnormal cluster are introduced to dynamically adjust the dynamic threshold model and obtain a new dynamic threshold; among them, the risk score of the high-density abnormal cluster is based on the number of orders in the cluster and the fluctuation of the amount in the cluster, and is obtained by weighted calculation.

5. The abnormal member early warning marketing management system based on customer behavior according to claim 1 is characterized by: Model design in graph neural networks: Constructing a customer-store-order triple graph structure: Nodes: customers, stores, and orders; Edge: The consumption relationship between customers and orders, and the ownership relationship between orders and stores; Graph representation learning: Use GNN to embed nodes into a low-dimensional space to capture the correlation characteristics of customers, stores, and orders; Abnormal score calculation: Based on the number of consumption orders of customer u, the clustering coefficient of the order-associated store, and the Euclidean distance between the customer embedding vector and the group mean, the abnormal score Sr of the customer node u is calculated in the following way: u : Sr u =α×Degree(u)+β×Clustering_Coefficient(u)+γ×Embedding_Outlier(u); In the formula, α, β and γ are weight coefficients; Trigger condition: When Sr u When GNN_Threshold>GNN_Threshold, it is marked as a suspected abnormal gang member; where GNN_Threshold represents the preset threshold of the model, and GNN_Threshold>0.

6. The abnormal member early warning marketing management system based on customer behavior according to claim 1 is characterized by: Dynamic adjacency matrix update: Periodically recalculate the cosine similarity of node embedding vectors to generate the adjacency matrix A: Where, sim(u,o): cosine similarity between node u and node o; Graph structure evolution: Using the DBSCAN algorithm, high-density subgraphs are detected based on the adjacency matrix A; Judgment condition: If the abnormal nodes {u1, u2, ..., un} form a subgraph and the edge density within the subgraph exceeds 0.8, it is judged as a potential gang; otherwise, it is judged as a non-potential gang.

7. The abnormal member early warning marketing management system based on customer behavior according to claim 1 is characterized by: The graph attention mechanism operates as follows: Attention weight calculation: Use the GAT model to calculate the attention coefficient Q between nodes u，o ; Strong correlation path extraction: When the attention weight Q of node u and node o u，o ≥0.8, a strong association is identified.

8. The abnormal member early warning marketing management system based on customer behavior according to claim 1 is characterized by: The contents of the first-level verification strategy are as follows: Embedding vector clustering: Embedding vectors of abnormal nodes Clustering is performed and intra-cluster similarity is calculated. Behavior pattern comparison: Check whether the consistency of consumption behavior characteristics of abnormal nodes exceeds 80%. Consumption behavior characteristics include consumption amount, time interval, and store preference. Verification criteria: If either the intra-cluster average similarity ≥ 0.8 or the consistency of consumption behavior characteristics exceeds 80%, the verification is passed. In the secondary verification strategy, the steps of embedding vector clustering and behavioral pattern comparison are the same; the judgment condition becomes: if the average similarity within the cluster is ≥ 0.8 and the consistency of consumption behavior characteristics exceeds 80%, it means that the verification is passed.

9. The abnormal member early warning marketing management system based on customer behavior according to claim 1 is characterized by: The system also includes: a notification and whitelist management module, which issues early warning notifications based on the tag verification judgment results and provides a whitelist mechanism to eliminate misjudgments; an abnormal member handling module, which performs restriction handling operations on members who meet the abnormal conditions; performs disabling processing operations on suspected gang abnormal members; and performs cancellation + points clearing operations on abnormal gang members.

10. A method for abnormal member early warning marketing management based on customer behavior, using the system of any one of claims 1 to 9, comprising the following steps: S101. Collect and store customer consumption data; in, Customer consumption data includes at least order data and status data; The method is characterized by further comprising: S102, building an initial rule engine, analyzing customer consumption data, and identifying members meeting abnormal conditions during non-activity periods; during activity periods, performing real-time stream processing and cluster analysis, and dynamically adjusting the rule engine to identify members meeting abnormal conditions; S103: Build a triplet graph structure based on a graph neural network. After graph representation learning and anomaly score calculation, if the trigger condition is met, mark it as a suspected abnormal gang member and perform label verification and judgment: Through the dynamic adjacency matrix and graph structure evolution, we identify whether abnormal nodes form a high-density subgraph to determine whether they are potential gangs. If they are judged as potential gangs, the first-level verification strategy is triggered. Otherwise, the graph attention mechanism is used to identify whether there are strong correlation paths between nodes. If so, it is determined to be a strongly correlated gang and the second-level verification strategy is triggered. S104: Issue an early warning notification based on the tag verification judgment result, and provide a whitelist mechanism to eliminate misjudgment; S105. Execute restriction processing operations on members who meet the abnormal conditions; execute ban processing operations on members who meet the abnormal conditions suspected of being members of a gang; execute cancellation + clearing points operations on members who meet the abnormal conditions of a gang.

Images