Abnormal order recognition method and device, equipment, medium and product

Abstract

The invention provides an abnormal order recognition method and device, equipment, a medium and a product, and the method comprises the steps: obtaining user related data of a dimension corresponding to a to-be-recognized order in response to the received to-be-recognized order, the user related data comprises at least two of user behavior features, user portrait features and user group features; forming a graph corresponding to the user group characteristics by adopting a preset composite edge relation algorithm; inputting the graph, the user behavior features and the user portrait features into a graph model adapted to the graph for multi-feature fusion; inputting the user behavior features, the user portrait features and a multi-feature fusion result into a neural network model for identification; and determining an abnormal order in the to-be-identified orders according to an identification result of the neural network model. According to the embodiment of the invention, the reliability and accuracy of abnormal order identification are improved.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of data 11, in particular to an abnormal order identification method, device, equipment, medium and product. BACKGROUND

[0002] At present, with the development of electronic commerce and science and technology, more and more people rely on e-commerce platforms to shop.

[0004] However, the abnormal order behavior mode mainly based on brushing orders is complex and changes rapidly, which leads to poor reliability and low accuracy of brushing order identification.

[0005] It should be noted that the information disclosed in the above background section is only used to strengthen the understanding of the background of the present disclosure, and therefore can include information that does not constitute prior art known to those of ordinary skill in the art. SUMMARY

[0006] The purpose of the present disclosure is to provide an abnormal order identification method, device, equipment, medium and product, which at least partially overcomes the problem of poor accuracy of abnormal order identification due to the limitations and defects of related technologies.

[0007] According to a first aspect of an embodiment of the present disclosure, an abnormal order identification method is provided, comprising: in response to a received to-be-identified order, obtaining user behavior features, user portrait features and user group features corresponding to the to-be-identified order; using a preset composite edge relationship algorithm to form a graph corresponding to the user group features; inputting the graph, the user behavior features and the user portrait features into a graph model adapted to the graph for multi-feature fusion; inputting the user behavior features, the user portrait features and the multi-feature fusion result into a neural network model for identification; and determining abnormal orders in the to-be-identified order according to the identification result of the neural network model.

[0008] In an exemplary embodiment of the present disclosure, obtaining user behavior features, user portrait features and user group features corresponding to the to-be-identified order comprises:

[0009] determining a terminal object generating the to-be-identified order;

[0010] aggregating the click sequence of the terminal object according to the time information of the to-be-identified order;

[0011] inputting the result of the aggregation processing into a sequence identification module to obtain the user behavior features.

[0012] In an example embodiment of the present disclosure, obtaining the user behavior feature, the user portrait feature and the user group feature corresponding to the to-be-identified order further comprises:

[0013] determining SKU information to which the to-be-identified order belongs, and determining historical records of abnormal orders corresponding to the SKU information;

[0014] determining a time difference between a registration time of a user creating the to-be-identified order and an order placing time of the to-be-identified order;

[0015] obtaining a risk assessment record of the user creating the to-be-identified order;

[0016] inputting the historical records of abnormal orders, the time difference and the risk assessment record into a decision tree module to obtain the user portrait feature.

[0017] In an example embodiment of the present disclosure, obtaining the user behavior feature, the user portrait feature and the user group feature corresponding to the to-be-identified order further comprises:

[0018] determining attribute information of the to-be-identified order;

[0019] determining the to-be-identified order as a node and determining the attribute information as an edge, constructing a graph of the to-be-identified order to obtain the user group feature.

[0020] In an example embodiment of the present disclosure, the multi-feature fusion of the user-related data of the graph model in the dimension comprises:

[0021] randomly sending the user behavior feature and the user portrait feature to a graph model in a graph neural network pool and fusing to a center node of the graph model to obtain a fused node feature;

[0022] performing multi-feature fusion on the fused node feature through an aggregation function, the aggregation function comprising at least one function of splicing, dot multiplication and attention fusion.

[0023] In an example embodiment of the present disclosure, inputting the user behavior feature, the user group feature and the result of the multi-feature fusion into a neural network model for identification comprises:

[0024] determining that the neural network model is a logistic regression model or a multi-layer neural network model with a preset weight, the logistic regression model being one of an artificial neural network model, a logistic regression model, a random logistic regression model and a linear regression model;

[0025] inputting the user behavior feature, the user group feature and the result of the multi-feature fusion into the logistic regression model or the multi-layer neural network model.

[0026] In an example embodiment of the present disclosure, further comprising:

[0027] obtaining service attribute information corresponding to the to-be-identified order;

[0028] parsing a commodity category and / or an order channel included in the service attribute information, and performing statistical calculation;

[0029] setting the preset weight according to a statistical calculation result of the service attribute information.

[0030] According to a second aspect of the embodiments of the present disclosure, an abnormal order identification device is provided, comprising:

[0031] an obtaining module configured to obtain user behavior features, user portrait features, and user group features corresponding to a to-be-identified order in response to the to-be-identified order received;

[0032] a fusion module configured to form a graph corresponding to the user group features by using a preset composite edge relationship algorithm;

[0033] The fusion module is further configured to perform multi-feature fusion on the user-related data of the graph model dimension;

[0034] an identification module configured to input the user behavior features, the user portrait features, and the multi-feature fusion result into a neural network model for identification;

[0035] a determination module configured to determine an abnormal order in the to-be-identified order according to an identification result of the neural network model.

[0036] According to a third aspect of the present disclosure, an electronic device is provided, comprising a memory and a processor coupled to the memory, the processor being configured to execute a method as described in any of the above aspects based on instructions stored in the memory.

[0037] According to a fourth aspect of the present disclosure, a computer-readable storage medium is provided, which stores a program to be executed by a processor to implement an abnormal order identification method as described in any of the above aspects.

[0038] According to a fifth aspect of the present disclosure, a computer program product is provided, comprising a computer program to be executed by a processor to implement an abnormal order identification method as described in any of the above aspects.

[0039] Based on the embodiments of the present disclosure, the graph corresponding to the user group feature is formed by a preset composite edge relationship algorithm, the graph, the user behavior feature and the user portrait feature are input into a graph-adapted graph model for multi-feature fusion, the user behavior feature, the user portrait feature and the multi-feature fusion result are input into a neural network model for identification, and then the abnormal order in the to-be-identified order is determined according to the identification result of the neural network model. The properties of the to-be-identified order are expressed by fusing multi-aspect user-related data, and the reliability and accuracy of abnormal order identification are improved.

[0040] It should be understood that the foregoing general description and the following detailed description are only exemplary and explanatory, and are not limiting to the present disclosure. BRIEF DESCRIPTION OF DRAWINGS

[0041] The accompanying drawings, which are incorporated into and form part of the specification, illustrate embodiments consistent with the present disclosure and, together with the description, serve to explain the principles of the disclosure. Obviously, the drawings in the following description are only some embodiments of the present disclosure, and other drawings can be obtained by those skilled in the art without creative labor on the basis of these drawings.

[0042] Figure 1 FIG. 1 shows a schematic diagram of an exemplary system architecture of an abnormal order identification scheme to which embodiments of the present disclosure can be applied;

[0043] Figure 2 FIG. 2 is a flowchart of an abnormal order identification method in an exemplary embodiment of the present disclosure;

[0044] Figure 3 FIG. 3 is a flowchart of another abnormal order identification method in an exemplary embodiment of the present disclosure;

[0045] Figure 4 FIG. 4 is a flowchart of another abnormal order identification method in an exemplary embodiment of the present disclosure;

[0046] Figure 5 FIG. 5 is a flowchart of another abnormal order identification method in an exemplary embodiment of the present disclosure;

[0047] Figure 6 FIG. 6 is a flowchart of another abnormal order identification method in an exemplary embodiment of the present disclosure;

[0048] Figure 7 FIG. 7 is a flowchart of another abnormal order identification method in an exemplary embodiment of the present disclosure;

[0049] Figure 8 FIG. 8 is a flowchart of another abnormal order identification method in an exemplary embodiment of the present disclosure;

[0050] Figure 9 is a schematic block diagram of an abnormal order identification scheme in an example embodiment of the present disclosure;

[0051] Figure 10 is a schematic block diagram of another abnormal order identification scheme in an example embodiment of the present disclosure;

[0052] Figure 11 is a block diagram of an abnormal order identification apparatus in an example embodiment of the present disclosure;

[0053] Figure 12 is a block diagram of an electronic device in an example embodiment of the present disclosure. DETAILED DESCRIPTION

[0054] Example embodiments now will be described more fully hereinafter with reference to the accompanying drawings. Example embodiments, however, can be implemented in many different forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the example embodiments to those skilled in the art. The described features, structures, or characteristics can be combined in one or more embodiments. In the following description, numerous specific details are recited to provide a thorough understanding of embodiments of the disclosure. One skilled in the relevant art, however, will recognize that the disclosure can be practiced without one or more of the specific details, or with other methods, components, materials, and so forth. In other instances, well-known structures have not been described in detail to avoid obscuring aspects of the disclosure.

[0055] Furthermore, the accompanying drawings are only schematic and are non-limiting detailed descriptions of exemplifying embodiments given herein with reference to the drawings. In the drawings, like reference numerals refer to like parts, wherein the following references are used: "exemplary" means "serving as an example, instance, or illustration," and not "preferred" over other examples. The detailed description includes specific details for the purpose of providing a thorough understanding of the exemplary constructions, compositions, devices, methods, and processes according to the disclosure. However, the

[0056] The terms and corresponding explanations related to the embodiments of the present disclosure are as follows:

[0057] Word2VEC: a method of word vectorization, the calculated word vector contains information such as word order semantics.

[0058] BERT: a text pre-training model, through unsupervised learning on a large amount of data, an efficient vector representation of text information is obtained.

[0059] XGBOOST: eXtreme Gradient Boosting, an engineering framework of gradient boosting method using decision tree as a learner, usually used for classification or regression tasks of numerical data.

[0060] LSTM: Long Short-Term Memory, a long short-term memory network, generally used in natural language processing to encode continuous text sequences to obtain numerical representation of text.

[0061] Attention model: a deep learning method that learns parameters according to input content, giving different weights to input content, thereby improving the attention of important words.

[0062] MLP: Multi-Layer Perceptron, which encodes features through full connection.

[0063] LR: logistic regression, a logistic regression model is a model that models the logarithmic odds of the output using a linear function of the input, commonly used for binary classification tasks.

[0064] LASSO: a generalized linear regression method that performs variable selection and regularization to improve prediction accuracy and interpretability of the result statistical model.

[0065] Figure 1 A schematic diagram of an exemplary system architecture of an abnormal order identification scheme to which embodiments of the present application can be applied is shown.

[0066] As shown in Figure 1 The system architecture 100 can include one or more of terminal devices 101, 102, 103, a network 104 and a server 105. The network 104 serves as a medium to provide communication links between the terminal devices 101, 102, 103 and the server 105. The network 104 can include various connection types, such as wired, wireless communication links or optical fiber cables, etc., but is not limited thereto.

[0067] It should be understood that Figure 1 The number of terminal devices, networks and servers in

[0068] The user can use the terminal device 101, 102, 103 to interact with the server 105 through the network 104 to receive or send messages, etc., but is not limited thereto. The terminal device 101, 102, 103 can be various electronic devices with a display screen, including but not limited to a smart phone, a tablet computer, a portable computer, a desktop computer, etc., but is not limited thereto.

[0069] In some embodiments, the method for identifying abnormal orders provided by the embodiments of the present application is generally executed by the server 105, and accordingly, the device for identifying abnormal orders is generally arranged in the terminal device 103 (may also be the terminal device 101 or 102). In other embodiments, some terminals can have similar functions as the server device to execute the present method.

[0070] The example embodiments of the present disclosure will be described in detail below with reference to the accompanying drawings.

[0071] Figure 2 is a flowchart of the method for identifying abnormal orders in the example embodiments of the present disclosure.

[0072] Reference Figure 2 The method for identifying abnormal orders can include:

[0073] In step S202, in response to the received order to be identified, the user behavior features, user portrait features and user group features corresponding to the order to be identified are obtained, and the user-related data includes at least two of the user behavior features, the user portrait features and the user group features.

[0074] In an example embodiment of the present disclosure, the user behavior features include the click operation records of the user creating the order to be identified on various terminals, including PC, web, application, applet, etc., but are not limited thereto.

[0075] In an example embodiment of the present disclosure, the operation records include login time, login times, click sequence, browsing records, logout time, etc., but are not limited thereto.

[0076] In an example embodiment of the present disclosure, the user portrait features include the risk score records, order cancellation records and credit records of the user, etc., but are not limited thereto.

[0077] In an example embodiment of the present disclosure, the user group features include sku, shop information, order IP, delivery address, payment account, etc., but are not limited thereto.

[0078] In step S204, a graph corresponding to the user group features is formed by using a preset composite edge relationship algorithm.

[0079] Step S206, inputting the graph, the user behavior feature and the user portrait feature into the graph-adapted graph model for multi-feature fusion.

[0080] In an exemplary embodiment of the present disclosure, the user-related data of the dimensions is input into one graph model of a graph neural network pool to output fused node features, and then an aggregation function such as splicing, dot multiplication, attention fusion, etc. is used for aggregation processing to form a final order node recognition result as a result of multi-feature fusion.

[0081] Step S208, inputting the user behavior feature, the user portrait feature and the result of multi-feature fusion into a neural network model for recognition.

[0082] In an exemplary embodiment of the present disclosure, by inputting the user behavior feature, the user portrait feature and the result of multi-feature fusion into a neural network model for recognition, the user behavior feature, the user portrait feature and the multi-feature fusion can adapt to the optimal convolution layer, and the aggregation of the output results of different convolution layers also plays a feature cross function, thereby improving the accuracy of abnormal order recognition.

[0083] Step S210, determining the abnormal order in the to-be-recognized order according to the recognition result of the neural network model.

[0084] In the embodiments of the present disclosure, the user-related data of multiple dimensions is fused, i.e., the user behavior feature, the user portrait feature and the result of multi-feature fusion are input into a neural network model for recognition, the abnormal order in the to-be-recognized order is determined according to the recognition result of the neural network model, the properties of the to-be-recognized order are expressed by fusing the user-related data from multiple aspects, and the reliability and accuracy of abnormal order recognition are improved.

[0085] Next, each step of the abnormal order recognition method will be described in detail.

[0086] In an exemplary embodiment of the present disclosure, as shown in Figure 3 The user behavior feature, the user portrait feature and the user group feature corresponding to the to-be-recognized order include:

[0087] Step S302, determining a terminal object generating the to-be-recognized order.

[0088] Step S304, aggregating the click sequence of the terminal object according to the time information of the to-be-recognized order.

[0089] In an example embodiment of the present disclosure, the click sequence of the terminal object is aggregated according to the time information of the order to be identified, so as to classify the user operation on the terminal object, and then the user operation is expressed in multiple dimensions.

[0090] In step S306, the result of the aggregation is input into a sequence recognition module to obtain the user behavior feature.

[0091] In an example embodiment of the present disclosure, the result of the aggregation is input into the sequence recognition module to obtain the user behavior feature, and then it is determined whether the user behavior feature expression is related to the behavior of brushing orders, malicious order cancellation, etc., but not limited thereto.

[0092] In combination Figure 10 As shown in the figure, the sequence recognition module is carried in the behavior feature embedding model, and the object processed by the sequence recognition module is the click sequence of the user, including the click sequence of the user's main station app, the click sequence of the mobile terminal app, the click sequence of the PC app, the click sequence through the third-party app jump, etc., but not limited thereto. The user behavior feature obtained by processing the click sequence of the user by the sequence recognition module is used to reflect the hidden behavior feature of the user.

[0093] In an example embodiment of the present disclosure, as Figure 4 As shown in the figure, obtaining the user behavior feature, the user portrait feature and the user group feature corresponding to the order to be identified further includes:

[0094] In step S402, the SKU information to which the order to be identified belongs is determined, and the historical record of the abnormal order corresponding to the SKU information is determined.

[0095] In step S404, the time difference between the registration time of the user who creates the order to be identified and the order time of the order to be identified is determined.

[0096] In an example embodiment of the present disclosure, if the time difference between the registration time and the order time of the order to be identified is less than the preset time difference, it can be reflected that the motivation of creating the order to be identified is abnormal.

[0097] In step S406, the risk assessment record of the user who creates the order to be identified is obtained.

[0098] In an example embodiment of the present disclosure, the risk assessment record is used to reflect whether the user has a record of brushing orders, malicious comments or malicious order cancellation, etc., but not limited thereto.

[0099] Step S408: Input the historical records of the abnormal orders, the time difference, and the risk assessment records into a decision tree module to obtain the user portrait features.

[0100] In an exemplary embodiment of the present disclosure, the historical records of the abnormal orders, the time difference and the risk assessment records are input into a decision tree module to obtain the user portrait features, thereby reflecting the risk that the order to be identified is an abnormal order.

[0101] Combine Figure 10 As shown, the decision tree module is carried in the feature filtering model. The user portrait features include order categories, sku categories, store categories, account categories, etc. in terms of categories, and include days, hours, months, etc. in terms of time windows. The combination of these indicators can effectively reflect whether the user has fake order behavior. The decision tree module processes the historical records of abnormal orders, the time difference and the risk assessment records, and eliminates about 50% of the non-fake order indicator features with low correlation. The remaining highly correlated indicators are retained as user historical features. At the same time, the model is retrained based on the highly correlated indicators and the predicted results are used as pure indicator labels. In an exemplary embodiment of the present disclosure, as Figure 5 As shown, obtaining the user behavior characteristics, user portrait characteristics, and user group characteristics corresponding to the order to be identified also includes:

[0102] Step S502: Determine the attribute information of the order to be identified.

[0103] Step S504 : determining the order to be identified as a node and the attribute information as an edge, and constructing a graph of the order to be identified to obtain the user group characteristics.

[0104] In an exemplary embodiment of the present disclosure, by determining the orders to be identified as nodes and the attribute information as edges, a graph of the orders to be identified is constructed to obtain the user group characteristics, reflecting the deep aggregation of order nodes.

[0105] Combine Figure 10 As shown, the user group graph includes multiple graphs of orders to be identified. The graphs can be isomorphic or heterogeneous. The graphs use the orders to be identified as nodes and use at least one of the attribute information such as sku, shop, order IP, delivery address, payment number, pin, uuid and eid as edges. The large number of graphs in the user group graph can accurately reflect the group structure characteristics, that is, a large number of user group features in graph form are obtained.

[0106] In an exemplary embodiment of the present disclosure, Figure 6 As shown, the graph model performs multi-feature fusion on the user-related data of the dimension, including:

[0107] Step S602, the user behavior features and the user portrait features are randomly sent to a graph model in a graph neural network pool and fused to a center node of the graph model to obtain fused node features.

[0108] Step S604, multi-feature fusion is performed on the fused node features by an aggregation function, and the aggregation function includes at least one function of splicing, point multiplication and attention fusion.

[0109] In an exemplary embodiment of the present disclosure, a user or an order is no longer identified as an isolated sample, but is identified after the surrounding neighbor node information (i.e., features) is fused, that is, by inputting the graph, the user behavior features and the user portrait features into the graph-adapted graph model to perform multi-feature fusion, and then the fusion label of the to-be-identified order is reflected in the dimension, and the optimal graph model of different types of features can also be determined based on continuous iterative calculation.

[0110] In an exemplary embodiment of the present disclosure, as shown in Figure 7 The user behavior features, user group features and the result of multi-feature fusion are input into a neural network model for identification, including:

[0111] Step S702, determining that the neural network model is a logistic regression model or a multi-layer neural network model with a preset weight, and the logistic regression model is one of an artificial neural network model, a logistic regression model, a random logistic regression model and a linear regression model.

[0112] Step S704, inputting the user behavior features, user group features and the result of multi-feature fusion into the logistic regression model or the multi-layer neural network model.

[0113] In an exemplary embodiment of the present disclosure, the neural network model is determined to be a logistic regression model or a multi-layer neural network model with a preset weight, and the user behavior features, user group features and the result of multi-feature fusion are input into the logistic regression model or the multi-layer neural network model, that is, the user behavior features, user group features and the result of multi-feature fusion are configured with a preset weight, and the preset weight is adjusted through the feedback result of the reliability and accuracy of the iterative calculation and identification result.

[0114] In combination with Figure 10As shown, the neural network model is an LR (Logistic Regression) model or an MLP (Multi-Layer Perceptron) model with preset weights, which are used to perform weighted calculation on the user behavior features, the user group features, and the result of the multi-feature fusion, and input the weighted calculation result into the neural network model.

[0115] In an exemplary embodiment of the present disclosure, as shown in Figure 8 The abnormal order identification method further includes:

[0116] In step S802, the business attribute information corresponding to the to-be-identified order is acquired.

[0117] In step S804, the commodity category and / or the order channel included in the business attribute information are parsed and statistically calculated.

[0118] In step S806, the preset weights are set according to the statistical calculation result of the business attribute information.

[0119] In an exemplary embodiment of the present disclosure, the preset weights are updated by periodically statistically calculating and calculating the proportion of the brushing order situation of different categories and channels in history, different weights have different scores, the user behavior features, the user portrait features, and the fused node features are respectively determined as pure click labels and pure index labels, mixed labels of the to-be-identified order, different weights are assigned to the above labels, and the LR or MLP is inputted for integrated processing, thereby further improving the reliability and accuracy of the abnormal order identification.

[0120] The present disclosure provides an embodiment taking the brushing order as the abnormal order, which is described below in combination with Figure 9 and Figure 10 The abnormal order identification scheme of the present disclosure is specifically described.

[0121] First, as shown in Figure 9 The architecture 900 of the abnormal order identification scheme in an exemplary embodiment of the present disclosure divides the data features of the brushing identification into the following three categories:

[0122] I. User click behavior, such as the click sequence left by the user on the main station App, WeChat, etc. before ordering, which is an embodiment of the above user behavior features;

[0123] II. User historical behavior, such as the account once logged in by the user and the goods once purchased by the user, which reflects the user portrait information, which is an embodiment of the above user portrait features;

[0124] III. User group relationship, i.e. the aggregation of user groups through goods, stores, and the same delivery address, etc. relationship, i.e. an embodiment of the above user group features.

[0125] Secondly, the architecture 1000 of the abnormal order identification scheme in the exemplary embodiment of the present disclosure is used to process the above three types of data features, including a behavior feature embedding model, a feature filtering model, and a user+feature fusion model, wherein: Figure 10

[0126] 1) Behavior feature embedding model: the purpose of this model is to abstract the user's click sequence through the model into an Embedding feature with stronger representation ability, so as to better express the user's behavior characteristics.

[0127] Firstly, the user's click behavior is interspersed on the whole platform, including the main station App, M (mobile) end, PC end, and third-party applications such as WeChat or QQ end. The preprocessing stage of this model will set a time window, and the user's full-end clicks in this time window will be aggregated in turn according to the order time.

[0128] Secondly, since the number of full-end clicks often exceeds the conventional length of the model (such as 128, 512 dimensions), through the analysis of the proportion of clicks in the click word presented by the brushing label, more than 80% of the clicks with no distinguishing degree will be filtered out, and the remaining clicks will be used as the effective click sequence for the final input model. The model is trained using BERT, LSTM, WORD2VEC, etc., and the recognition result is output as a pure click label, and the Embedding output by the last hidden layer is used as the behavior hidden layer feature.

[0129] 2) Feature filtering model: the purpose of this model is to capture the user's historical behavior representation related to the business. The user's historical behavior representation is embodied in the user portrait indicators after the online order business is deposited, and is processed into user portrait features by the above decision tree module. The user portrait features include order categories, sku categories, store categories, account categories, etc. in terms of categories, and days, hours, months, etc. in terms of time windows. The combination of these indicators can effectively reflect the user's brushing behavior, but the unfiltered indicators are not suitable for brushing business.

[0130] Further, the model uses XGBOOST, random forest, LASSO, etc. to evaluate the importance of the features, and about 50% of the low-correlation non-brushing indicator features are removed. The remaining high-correlation indicators are retained as user historical features, and the results obtained by retraining the model based on the high-correlation indicators are used as pure indicator labels.

[0131] ​3) User + Feature Fusion Model: The purpose of this model is to model the implicit relationship between multiple users (or multiple orders), that is, a user or an order is no longer identified as a isolated sample, but is identified after fusing the information of the surrounding neighbor nodes (i.e., features). This model is divided into the following two steps:

[0132] 3.1) Graph construction step: The nodes on the graph are orders, and the edge relationships on the graph are sku, Shop, order IP, delivery address, payment number, etc., but are not limited thereto.

[0133] In order to reflect the deep aggregation of order nodes, the present disclosure designs a graph construction strategy based on composite edge relationships: For example, the order IP of the order to be identified can be parsed into a two-level address, and when the same sku and the same order IP two-level address are combined as an edge, it can better reflect the deep aggregation than using only sku as an edge or order IP two-level address as an edge. For the composite edge relationship formed by different types of edge relationships.

[0134] The graph construction strategy of the present disclosure automatically calculates the graph homogeneity index generated by the selected composite edge to score, and in addition, any isomorphic or heterogeneous graph can be generated through configuration information to adapt to different types of graph algorithms downstream.

[0135] 3.2) Graph model processing step: The previous graph model classifies nodes, and the nodes only contain features of the same type. In the scenario of the present disclosure, the nodes use behavior hidden layer features (i.e., Embedding output by the feature embedding model) and user historical features (i.e., multiple dimension statistical features output by the feature filtering model). The two types of features have a large difference in representation, and cannot be treated as the same data feature for processing.

[0136] Therefore, the present disclosure proposes a mechanism for fusing user click behavior features and historical behavior features using different graph neural networks on the same user group structure (i.e., on the network generated by the same graph construction).

[0137] Specifically, the present disclosure also provides a graph neural network pool, and the graph models in the graph neural network pool all have the function of aggregating the features of the surrounding neighbors and fusing them into the center node. The aggregation and fusion methods of different graph models are different, which will not be expanded here.

[0138] Among them, the behavior hidden layer features and the user historical features are randomly connected to a graph model in the graph neural network pool and output the fused node features. Finally, the final order node recognition result is formed as a fusion label through an aggregation function such as splicing, dot multiplication, attention fusion, etc. In this mode, the optimal graph neural network for processing different types of features can be selected.

[0139] After the three model plates are based on the above, in order to make full use of the identification results of respective models, and fuse the related business criteria, the integrated model is designed as follows:

[0140] 4) Integrated model: The end point discrimination of the present disclosure uses the pure click label, pure index label and mixed label produced in the foregoing, and combines business rules such as commodity categories and order channels, to update the biased weight of the order by periodically counting and calculating the proportion of the history of brushing orders of different categories and channels. Different weights have different scores, and the labels are integrated by LR or MLP with different weights, to finally determine whether the order of a day is a brushing order.

[0141] Compared with the prior art, the embodiment of the present disclosure has the following significant technical effects:

[0142] 1. Compared with the model using only one type of feature, the model processes various features in parallel, greatly improving the discrimination ability of the model to brushing behavior. The integrated model of the present disclosure fusing users and features has about 15% improvement in accuracy rate compared with the best result of the single feature model.

[0143] 2. The advantage of aggregating different types of features with different convolution layers is that the features can adapt to the optimal convolution layer, and aggregating the output results of different convolution layers also plays a feature cross function, which improves the accuracy rate by about 7%.

[0144] 3. The identification result of the abnormal order can effectively improve the accuracy rate and reduce the complaint rate. The order complaint rate is reduced from the thousandth to the ten-thousandth, and the accuracy rate is improved by about 8%.

[0145] 4. Effect table: Compared with the single-task brushing model or the multi-user single-feature fusion model, the integrated model of the present disclosure fusing multi-user and multi-feature has a significant improvement in accuracy rate and complaint rate. The specific experimental effect is shown in Tables 1 to 5.

[0146] Table 1

[0147]

[0148] Table 2

[0149]

[0150] Table 3

[0151]

[0152] Table 4

[0153]

[0154]

[0155] Table 5

[0156]

[0157] Figure 11 It is a block diagram of an apparatus for identifying abnormal orders in an exemplary embodiment of the present disclosure.

[0158] refer to Figure 11 The abnormal order identification device 1100 may include:

[0159] The acquisition module 1102 is configured to obtain user behavior characteristics, user portrait characteristics, and user group characteristics corresponding to the order to be identified in response to the received order to be identified.

[0160] The fusion module 1104 is configured to use a preset composite edge relationship algorithm to form a graph corresponding to the user group characteristics.

[0161] The fusion module 1104 is further configured to perform multi-feature fusion on the user-related data of the dimension using a graph model.

[0162] The recognition module 1106 is configured to input the user behavior features, the user portrait features and the result of the multi-feature fusion into a neural network model for recognition.

[0163] The determination module 1108 is configured to determine abnormal orders among the orders to be identified based on the recognition results of the neural network model.

[0164] In an exemplary embodiment of the present disclosure, the obtaining module 1102 is further configured to:

[0165] Determining the terminal object that generates the order to be identified;

[0166] Aggregating the click sequence of the terminal object according to the time information of the order to be identified;

[0167] The result of the aggregation process is input into a sequence recognition module to obtain the user behavior characteristics.

[0168] In an exemplary embodiment of the present disclosure, the obtaining module 1102 is further configured to:

[0169] Determine the SKU information to which the order to be identified belongs, and determine the historical records of abnormal orders corresponding to the SKU information;

[0170] Determining a time difference between a registration time of a user who created the order to be identified and a time when the order to be identified was placed;

[0171] Obtaining a risk assessment record of the user who created the order to be identified;

[0172] inputting the historical record of the abnormal order, the time difference and the risk assessment record into a decision tree module to obtain the user portrait feature.

[0173] In an example embodiment of the present disclosure, the obtaining module 1102 is further configured to:

[0174] determine attribute information of the to-be-identified order;

[0175] construct a graph of the to-be-identified order by taking the to-be-identified order as a node and the attribute information as an edge, to obtain the user group feature.

[0176] In an example embodiment of the present disclosure, the fusion module 1104 is further configured to:

[0177] randomly send the user behavior feature and the user portrait feature to a graph model in a graph neural network pool, and fuse them into a center node of the graph model to obtain a fused node feature;

[0178] perform multi-feature fusion on the fused node feature through an aggregation function, the aggregation function including at least one function of concatenation, dot multiplication and attention fusion.

[0179] In an example embodiment of the present disclosure, the identification module 1106 is further configured to:

[0180] determine the neural network model to be a logistic regression model or a multi-layer neural network model with preset weights, the logistic regression model being one of an artificial neural network model, a logistic regression model, a random logistic regression model and a linear regression model;

[0181] input the user behavior feature, the user group feature and the result of the multi-feature fusion into the logistic regression model or the multi-layer neural network model.

[0182] In an example embodiment of the present disclosure, the obtaining module 1102 is further configured to:

[0183] obtain service attribute information corresponding to the to-be-identified order;

[0184] parse a commodity category and / or an order channel included in the service attribute information and perform statistical calculation;

[0185] set the preset weights according to a statistical calculation result of the service attribute information.

[0186] Since the functions of the apparatus 1100 have been described in detail in the corresponding method embodiments, the present disclosure will not be repeated here.

[0187] It should be noted that although several modules or units of the devices for action execution are mentioned in the above detailed description, such division is not mandatory. Indeed, features and functionalities of two or more modules or units described above can be embodied in one module or unit according to embodiments of the present disclosure. Conversely, features and functionalities of one module or unit described above can be further divided into embodied by multiple modules or units.

[0188] In exemplary embodiments of the present disclosure, an electronic device capable of implementing the above-described method is also provided.

[0189] Those skilled in the art can understand that various aspects of the present disclosure can be implemented as a system, a method or a program product. Therefore, various aspects of the present disclosure can be embodied as a complete hardware embodiment, a complete software embodiment (including firmware, microcode, etc.), or an embodiment combining hardware and software aspects, which can be collectively referred to as "circuitry", "module" or "system" herein.

[0190] The electronic device 1200 according to this embodiment of the present disclosure will be described below with reference to Figure 12 Figure 12 The electronic device 1200 shown is merely an example and should not impose any limitation on the functions and use range of embodiments of the present disclosure.

[0191] As Figure 12 shown, the electronic device 1200 is in the form of a general computing device. Components of the electronic device 1200 can include, but are not limited to, the at least one processing unit 1210 described above, the at least one storage unit 1220 described above, and a bus 1230 connecting different system components, including the storage unit 1220 and the processing unit 1210.

[0192] The storage unit stores program code that can be executed by the processing unit 1210, so that the processing unit 1210 performs steps according to various exemplary embodiments of the present disclosure described in the "Exemplary Method" section of the present specification. For example, the processing unit 1210 can perform the method as shown in embodiments of the present disclosure.

[0193] The storage unit 1220 can include a readable medium in the form of a volatile storage unit, such as a random access memory (RAM) 12201 and / or a cache memory unit 12202, and can further include a read-only memory (ROM) 12203.

[0194] ​The storage unit 1220 can also include a program / utility 12204 having a set of programs / modules 12205, each of which performs one or more tasks. The programs and modules 12205 can include, but are not limited to, one or more of the following: an operating system, one or more application programs, other program modules, and program data, each of which can include implementations of the network environment in whole or in part.

[0195] The bus 1230 can represent one or more of several types of bus structures, including a storage bus or bus controller, a peripheral bus, a graphics bus, a processor or local bus, using any of a variety of bus structures.

[0196] The electronic device 1200 can also communicate with one or more external devices 1240 such as a keyboard or pointing device, using one or more communication interfaces 1250. Communication interfaces 1250 can include, without limitation, a modem, a network interface card (e.g. an Ethernet card), a wireless network interface card, etc. One will further recognize that not all of these components are required, that modifications are possible, and that some components can be utilized in one embodiment and not in another. For example, as the electronic device 1200 is described as a computing device, it is contemplated that some embodiments can not contain some components shown. Similarly, if the electronic device 1200 is described as a mobile device, it is contemplated that some embodiments can not contain some other components not shown. The electronic device 1200 can also communicate with one or more devices 1240 that enable user interaction with the electronic device 1200 and / or one or more devices 1241 that enable communication of the electronic device 1200 with other devices. Communication can occur via an input / output (I / O) interface 1250. Still yet, one will recognize that the electronic device 1200 can communicate with any other electronic device, entity, or component (not shown), not just an example electronic device.

[0197] Those skilled in the art will readily recognize that the example embodiments described herein can be implemented using software, hardware, or a combination thereof. Thus, the technical solutions according to the embodiments of the present disclosure can be embodied in a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash disk, a mobile hard disk, or the like) or a network, and includes a number of instructions to make a computing device (which can be a personal computer, a server, a terminal device, or a network device, etc.) execute the methods according to the embodiments of the present disclosure.

[0198] In the exemplary embodiments of the present disclosure, a computer readable storage medium having stored thereon a program product capable of implementing the above-described method of the specification is also provided. In some possible implementations, various aspects of the present application can also be implemented in the form of a program product including program code, which, when run on a terminal device, causes the terminal device to perform the steps described in the above "Exemplary Method" section according to various exemplary embodiments of the present application.

[0199] The program product for implementing the above-described method according to the embodiments of the present application can take a portable compact disc read-only memory (CD-ROM) and include program code, and can be run on a terminal device, such as a personal computer. However, the program product of the present application is not limited thereto, and in the present document, the readable storage medium can be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus or device.

[0200] The program product can take any combination of one or more readable media. The readable medium can be a readable signal medium or a readable storage medium. The readable storage medium, for example, can be, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus or device, or any combination thereof. More specific examples (non-exhaustive list) of the readable storage medium include an electrical connection having one or more wires, a portable disc, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof.

[0201] The computer readable signal medium can include a data signal propagated in a baseband or as part of a carrier wave, in which readable program code is borne. Such propagated data signal can take various forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination thereof. The readable signal medium can also be any readable medium other than the readable storage medium, which can send, propagate or transmit the program for use by or in connection with an instruction execution system, apparatus or device.

[0202] The program code contained on the readable medium can be transmitted using any suitable medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination thereof.

[0203] The program code may, for example, be written in any combination of one or more programming languages, including an object oriented programming language such as Java, C++ or the like, and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code may execute entirely on the user's computing device, partly on the user's computing device, as a stand-alone software package, partly on the user's computing device and partly on a remote computing device or entirely on the remote computing device or server. In the latter scenario, the remote computing device can be connected to the user's computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computing device, for example, through the Internet using an Internet Service Provider.

[0204] Furthermore, the above-described diagrams are merely schematic illustrations of the processes included in the method according to the exemplary embodiments of the present application, and are not intended to be limiting. It is readily understood that the processes shown in the above-described diagrams do not indicate or limit the time sequence of the processes. In addition, it is readily understood that the processes can be executed synchronously or asynchronously, for example, in a plurality of modules.

[0205] Other embodiments of the disclosure will be apparent to those skilled in the art from consideration of the specification and practice of the features disclosed herein. It is intended that the specification and examples be considered as exemplary only, with the true scope and spirit of the disclosure being indicated by the following claims.

Claims

1. An abnormal order identification method, characterized by, The method comprises the following steps: in response to the received to-be-identified order, obtaining user behavior features, user portrait features and user group features corresponding to the to-be-identified order; adopting a preset composite edge relationship algorithm to form a graph corresponding to the user group features; inputting the graph, the user behavior features and the user portrait features into a graph-adapted graph model for multi-feature fusion; inputting the user behavior features, the user portrait features and the multi-feature fusion result into a neural network model for identification; determining an abnormal order in the to-be-identified order according to the identification result of the neural network model.

2. The method of claim 1, wherein the step of identifying the abnormal order is performed by using a machine learning algorithm. The method comprises the following steps: determining a terminal object for generating the to-be-identified order; aggregating a click sequence of the terminal object according to time information of the to-be-identified order; inputting the aggregation result into a sequence identification module to obtain the user behavior features.

3. The method of claim 1, wherein the step of identifying the abnormal order is performed by using a machine learning algorithm. The method further comprises the following steps: determining SKU information to which the to-be-identified order belongs, and determining a historical record of an abnormal order corresponding to the SKU information; determining a time difference between a registration time of a user creating the to-be-identified order and an order placement time of the to-be-identified order; obtaining a risk assessment record of the user creating the to-be-identified order; inputting the historical record of the abnormal order, the time difference and the risk assessment record into a decision tree module to obtain the user portrait features.

4. The method of identifying abnormal orders according to claim 1, wherein, The method further comprises the following steps: determining attribute information of the to-be-identified order; constructing a graph of the to-be-identified order by taking the to-be-identified order as a node and taking the attribute information as an edge, to obtain the user group features.

5. The method of claim 1, wherein the step of identifying the abnormal order is performed by using a decision tree. The method comprises the following steps: randomly sending the user behavior features and the user portrait features to a graph model in a graph neural network pool, and fusing them to a center node of the graph model to obtain fused node features; performing multi-feature fusion on the fused node features through an aggregation function.

6. The method of identifying abnormal orders according to claim 1, wherein, The method comprises the following steps: determining that the neural network model is a logistic regression model or a multi-layer neural network model with a preset weight, wherein the logistic regression model is one of an artificial neural network model, a logistic regression model, a random logistic regression model and a linear regression model; inputting the user behavior features, the user group features and the multi-feature fusion result into the logistic regression model or the multi-layer neural network model.

7. The method of identifying abnormal orders according to claim 6, wherein, The method further comprises the following steps: obtaining business attribute information corresponding to the to-be-identified order; parsing a commodity category and / or an order channel included in the business attribute information, and performing statistical calculation; setting the preset weight according to the statistical calculation result of the business attribute information.

8. An abnormal order identifying device characterized by comprising: The method comprises the following steps: An acquisition module is configured to acquire user behavior features, user portrait features and user group features corresponding to the to-be-identified order in response to the received to-be-identified order; A fusion module is configured to form a graph corresponding to the user group features by using a preset composite edge relationship algorithm; The fusion module is further configured to perform multi-feature fusion on the user-related data of the graph model in the dimension; An identification module is configured to input the user behavior features, the user portrait features and the multi-feature fusion result into a neural network model for identification; A determination module is configured to determine an abnormal order in the to-be-identified order according to an identification result of the neural network model.

9. An electronic device, comprising: comprise: a memory; and a processor coupled to the memory, the processor being configured to execute instructions stored in the memory to perform the method of identifying an abnormal order according to any one of claims 1-7. The program is executed by the processor to implement the method of identifying an abnormal order according to any one of claims 1-7.

10. A computer-readable storage medium having stored thereon a program, characterized in that, The computer program is executed by the processor to implement the method of identifying an abnormal order according to any one of claims 1-7.

11. A computer program product comprising a computer program, characterized in that, ​

Images