Order cheating detection method and device based on big data
By constructing a multi-source data feature set and a dynamic rule engine, combined with graph neural network analysis, the real-time and accuracy problems of order fraud detection in e-commerce transaction systems are solved, achieving efficient identification of new fraud patterns and precise defense across scenarios.
Patent Information
- Application Number
- CN202511145330.4
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-08-15
- Publication Date
- 2025-12-23
AI Technical Summary
Existing e-commerce transaction systems cannot detect new fraud patterns in real time during order fraud detection, nor can they analyze multi-dimensional abnormal collaborative relationships, resulting in poor detection accuracy and defense effectiveness, especially with a high false positive rate in different scenarios.
We employ a big data-based order fraud detection method. By constructing a multi-source data feature set, a dynamic rule engine, and graph neural network analysis, we can monitor and identify fraudulent behavior in real time, dynamically update detection strategies, and combine scenario-adaptive tiered detection models to achieve accurate risk assessment for different business scenarios.
It improves the timeliness and accuracy of order fraud detection, reduces the false positive rate, and enhances the identification coverage of covert fraud groups and the detection accuracy across scenarios.
Smart Images
Figure CN121190147A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of e-commerce risk control technology, specifically to a method and apparatus for detecting order fraud based on big data. Background Technology
[0002] E-commerce risk control refers to the systematic work of e-commerce platforms in identifying, assessing, monitoring, and handling potential risks throughout the entire transaction process to ensure transaction security and maintain a healthy ecosystem. Its core objectives are to prevent fraud, reduce losses, ensure compliance, and enhance trust. The big data-based order fraud detection method and device is a comprehensive solution integrating multiple advanced data analysis technologies. It aims to improve the efficiency and accuracy of identifying and preventing fraudulent orders in e-commerce and online trading platforms. This is one of the core technologies for ensuring transaction security. It is responsible for processing and analyzing massive amounts of transaction data streams. The complex data processing engine can efficiently mine potential risk signals, ensuring accurate identification of hidden fraudulent behaviors during the detection process. To ensure the comprehensiveness and real-time nature of risk identification, the system typically integrates multiple data sources for cross-validation. Currently, due to the diversification of e-commerce transaction scenarios and the rapid evolution of fraud methods, the static rule models relied upon for real-time fraud detection of transaction orders cannot detect newly emerging fraud patterns and their group characteristics in real time. If new and organized fraud methods emerge, the detection model may become ineffective and lag behind, failing to guarantee the timeliness of fraud detection. At the same time, when conducting risk assessment, it is impossible to analyze the abnormal collaborative relationships of multiple dimensions such as devices, networks, and user social circles behind the order in real time, which may lead to missed detection of highly concealed group fraud, and the detection strategy cannot be updated in real time when new fraud characteristics are discovered. In order fraud judgment, due to the huge differences in normal transaction patterns under different product categories and marketing activities, such as flash sales and group buying, it is impossible to achieve refined and dynamic risk modeling for different business lines when conducting fraud detection in specific scenarios. This may lead to misjudgment or missed detection of orders in specific scenarios, further affecting the accuracy and defense effectiveness of the overall anti-fraud system. Therefore, a big data-based method and system for detecting order fraud is proposed to solve the above problems. Summary of the Invention
[0003] (a) Technical problems to be solved
[0004] To address the shortcomings of existing technologies, this invention provides a method and apparatus for detecting order fraud based on big data, thus solving the problems mentioned in the background section.
[0005] (II) Technical Solution
[0006] To achieve the above objectives, the present invention provides the following technical solution: a method and apparatus for detecting order fraud based on big data, the method comprising the following steps: S1. Collect multi-source order data, including user behavior data, transaction data, and logistics data; S2. Perform feature engineering on the multi-source order data to generate a multi-dimensional fraud feature set; S3. Construct an order fraud detection model, including a static detection model based on machine learning and a real-time detection model based on stream processing; S4. Train the order fraud detection model using historical order data, and generate the trained model through parameter optimization; S5. Input the real-time order data into the trained model and output the fraudulent order detection results; S6. Verify the fraudulent order detection results, generate feedback data, and optimize model parameters; S7. Based on the correlation network analysis, identify the group behavior of fraudulent orders and generate group fraud feature data; S8. Establish a dynamic rule engine and update the detection rule base according to the group cheating feature data; S9. Intercept high-risk orders in real time and generate order interception instructions; S10. Generate an order fraud detection report and display it visually.
[0007] Preferably, S1 includes: S11. Collect user behavior data through user terminal tracking, including page dwell time, click frequency, and operation trajectory; S12. Obtain transaction data from the transaction system API, including payment method, transaction amount, and coupon usage frequency; S13. Obtain logistics data through the logistics platform interface, including delivery time, delivery location, and return rate.
[0008] Preferably, S2 includes: S21. Clean the user behavior data, remove outliers and fill in missing data; S22. Extract time-series features, including order submission frequency and payment interval standard deviation within a unit of time. The formula for calculating the payment interval standard deviation is: in, The standard deviation of the payment interval, Let i be the interval between payments. The average of the payment intervals. For the number of payments; S23. Construct graph neural network features and generate a centrality index for the user association network; S24. Portfolio transaction characteristics, including the deviation rate of single transaction amount from the historical average.
[0009] Preferably, S3 includes: S31. The static detection model is constructed using the XGBoost algorithm, and the input dimensions include user credit score, device fingerprint, and IP geographic features. S32. The real-time detection model is built on the Flink stream processing framework and dynamically adjusts the window according to business traffic. S33, Integrated Graph Convolutional Network Module, analyzes the ternary relationship subgraph of user-device-IP.
[0010] Preferably, S4 includes: S41. Divide the training set and the test set, and generate sample data using a sliding time window; S42. Adjust the model hyperparameters through Bayesian optimization, with the objective function being to maximize the F1-score. S43. Adversarial training is used to enhance the robustness of the model by injecting 10% perturbation samples.
[0011] Preferably, S5 includes: S51. Perform window aggregation on the real-time data stream and calculate feature statistics; S52. Input the aggregated features into the real-time detection model and output the anomaly probability value; S53. When the probability of an anomaly exceeds the threshold, a real-time interception process is triggered.
[0012] Preferably, S7 includes: S71. Construct a user association graph, with nodes including user ID, device number, and payment account; S72. The Louvain algorithm is used to detect community structure and identify high-risk groups by maximizing modularity. The modularity calculation formula for identifying high-risk groups is as follows: in, For community modularity, The sum of the weights of all edges in the graph. Let be the edge weight between node i and node j. It is the sum of the weights of all edges connected to node i. Let i be the community ID to which node i belongs. For community indicator functions; S73. Extract community features, including transaction density within the community and cross-community connectivity.
[0013] Preferably, S8 includes: S81. Establish a rule template library, including the rule for "short-term multi-account payment on the same device"; S82. Dynamically generate new rules based on the group cheating characteristic data; S83 uses a rule engine for priority sorting and real-time matching of high-risk patterns.
[0014] Preferably, the following steps are also included: S110. Establish a cross-platform risk device fingerprint database and periodically aggregate feature vectors of high-risk devices, wherein the feature vectors include: S111. Extract the hardware tampering feature values of the device and calculate the confidence level of the jailbreak operation; S112. Collect device network behavior fingerprints and generate proxy IP usage frequency indicators; S113. Associate historical cheating device characteristics and construct a similarity matching model.
[0015] Preferably, the following steps are also included: S120. Implement real-time blocking strategy for risky devices: S121. When a new order triggers 3 or more high-risk features in the device fingerprint database, the risk level is automatically upgraded to the highest level. S122. Dynamically adjust the verification strategy based on risk level, and freeze the payment channel for the highest risk orders; S123. Generate a device risk tracing report, and mark the feature matching degree and associated cheating history.
[0016] (III) Beneficial Effects
[0017] Compared with existing technologies, the present invention provides a method and apparatus for detecting order fraud based on big data, which has the following beneficial effects: 1. In this invention, by setting up a real-time monitoring terminal, when performing real-time fraud detection of transaction orders, a dynamic risk feature library is constructed, and a risk threshold adjustment mechanism based on business scenarios is adopted to ensure the consistency of risk judgment under different marketing activity scenarios. At the same time, the features of new fraud patterns are captured in real time through a streaming data pipeline. When abnormal payment behavior is identified, the early warning model is updated immediately. This can effectively solve the problem that traditional systems cannot detect new fraud patterns in real time, ensure the timeliness of high-risk order identification, and further reduce the fraud detection error rate.
[0018] 2. In this invention, by setting up associated network terminals, when analyzing group cheating behavior, the modularity of the user-device-IP ternary relationship is calculated using a graph neural network. The system monitors the topology anomalies of the transaction network in real time, enabling it to accurately locate hidden cross-account cheating links. When anomalies in the community structure are detected, the system automatically activates the dynamic rule engine to update the interception strategy in real time. For example, the priority of multi-account payment rules for the same device is increased. Through community feature tracking technology, the system can improve the coverage of cheating gang identification and ensure the ability to accurately combat organized cheating.
[0019] 3. In this invention, by setting up a scenario adaptation terminal, when performing risk assessment for specific business scenarios, a tiered detection model is constructed through deep transfer learning. This model divides independent feature spaces in real time for different scenarios such as flash sales, group buying, and cross-border payments. Based on the tiered feature weights, the order risk value is dynamically calculated. For example, in the group buying scenario, the associated weight of abnormal devices is increased, enabling the system to automatically match differentiated risk control strategies. Through multi-dimensional tiered modeling, the accuracy of customized business detection is improved, fundamentally solving the problem of cross-scenario misjudgment and further reducing the false interception rate caused by differences in business characteristics. Attached Figure Description
[0020] Figure 1 This is a schematic diagram of the method steps of the present invention; Figure 2 This is a schematic diagram of the overall device structure of the present invention. Detailed Implementation
[0021] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0022] Please see Figure 1-2 The method and apparatus for detecting order fraud based on big data include the following steps: S1. Collect multi-source order data, including user behavior data, transaction data, and logistics data; S2. Perform feature engineering on multi-source order data to generate a multi-dimensional fraud feature set; S3. Construct an order fraud detection model, including a static detection model based on machine learning and a real-time detection model based on stream processing; S4. Train an order fraud detection model using historical order data, and generate the trained model through parameter optimization. S5. Input real-time order data into the trained model and output the fraudulent order detection results; S6. Verify the results of fraudulent order detection, generate feedback data, and optimize model parameters; S7. Based on the correlation network analysis, identify the group behavior of fraudulent orders and generate group fraud feature data; S8. Establish a dynamic rule engine and update the detection rule base based on group cheating characteristic data; S9. Intercept high-risk orders in real time and generate order interception instructions; S10. Generate an order fraud detection report and display it visually; S11. Collect user behavior data through user terminal tracking, including page dwell time, click frequency, and operation trajectory; S12. Obtain transaction data from the transaction system API, including payment method, transaction amount, and coupon usage frequency; S13. Obtain logistics data through the logistics platform interface, including delivery time, delivery location, and return rate; S21. Clean and process user behavior data, remove outliers and fill in missing data; S22. Extract time-series features, including order submission frequency and payment interval standard deviation within a unit of time. The formula for calculating the payment interval standard deviation is: in, The standard deviation of the payment interval, Let i be the interval between payments. The average of the payment intervals. For the number of payments; S23. Construct graph neural network features and generate a centrality index for the user association network; S24. Portfolio transaction characteristics, including the deviation rate of single transaction amount from the historical average; S31. The static detection model is constructed using the XGBoost algorithm, with input dimensions including user credit score, device fingerprint, and IP geographic features. S32. The real-time detection model is built on the Flink stream processing framework and dynamically adjusts the time window according to business traffic. S33, Integrated Graph Convolutional Network Module, analyzes the ternary relationship subgraph of user-device-IP; S41. Divide the training set and the test set, and generate sample data using a sliding time window; S42. Adjust the model hyperparameters through Bayesian optimization, with the objective function being to maximize the F1-score. S43. Adversarial training is used to enhance the robustness of the model by injecting 10% perturbation samples; S51. Perform window aggregation on the real-time data stream and calculate feature statistics; S52. Input the aggregated features into the real-time detection model and output the anomaly probability value; S53. When the probability of an anomaly exceeds the threshold, a real-time interception process is triggered. S71. Construct a user association graph, with nodes including user ID, device number, and payment account; S72. The Louvain algorithm is used to detect community structure and identify high-risk groups by maximizing modularity. The modularity calculation formula for identifying high-risk groups is as follows: in, For community modularity, The sum of the weights of all edges in the graph. Let be the edge weight between node i and node j. It is the sum of the weights of all edges connected to node i. Let i be the community ID to which node i belongs. For community indicator functions; S73. Extract community features, including transaction density within the community and cross-community connectivity; S81. Establish a rule template library, including the rule for "short-term multi-account payment on the same device"; S82. Dynamically generate new rules based on group cheating characteristic data; S83: Employs a rule engine for priority sorting and real-time matching of high-risk patterns; S110. Establish a cross-platform risky device fingerprint database and periodically aggregate the feature vectors of high-risk devices. The feature vectors include: S111. Extract the hardware tampering feature values of the device and calculate the confidence level of the jailbreak operation; S112. Collect device network behavior fingerprints and generate proxy IP usage frequency indicators; S113. Associate historical cheating device characteristics to construct a similarity matching model; S120. Implement real-time blocking strategy for risky devices: S121. When a new order triggers 3 or more high-risk features in the device fingerprint database, the risk level will be automatically upgraded to the highest level; if the user is a historically low-risk account, manual review is required before execution. S122. Dynamically adjust the verification strategy based on risk level, and freeze the payment channel for the highest risk orders; S123. Generate a device risk tracing report, and mark the feature matching degree and associated cheating history.
[0023] Example 1: Implementation of Dynamic Risk Perception Terminal During e-commerce promotional events, the system dynamically scans thousands of orders flooding in every second through real-time monitoring. When user A submits five high-value mobile phone orders within three seconds, the system immediately activates the payment behavior analysis engine. First, it obtains the user's historical average payment interval of 2.1 seconds. The current payment interval standard deviation σ is calculated to be 4.8 seconds, exceeding the 3.0-second threshold. At this point, the streaming feature extraction module detects an abnormal change in the user's device fingerprint: this time using an Android emulator, while historically used a real iOS device. Simultaneously, IP geographic features show that the login location and delivery address span three provinces. The dynamic rule engine immediately activates a three-level response mechanism: freezing coupon usage permissions and forcing facial recognition verification. The system temporarily suspends the order outbound process; after triggering facial verification, the data is used only for risk control purposes and is automatically deleted within 24 hours; the freezing is specifically a temporary freeze, and an appeal link is sent to the user simultaneously. If the temporary freeze is confirmed by manual review within 72 hours, it will be converted to a permanent freeze; when the risk control personnel confirm that the user has a risk of account theft, the system automatically intercepts all abnormal orders within 8 seconds and synchronizes the attack feature vector (high-frequency ordering + device mutation + cross-province IP) to the entire platform's defense nodes in real time. This process shortens the identification response time of the new "lightning order brushing" attack from 15 minutes in the traditional system to within 20 seconds. Test data shows that the proportion of high-risk orders mistakenly released during the promotion period has dropped to 0.7%.
[0024] Example 2: Implementation on the Associated Network Terminal A cross-border e-commerce platform discovered multiple abnormal orders paid with gift cards. In-depth source tracing analysis was initiated on the related network. The system first constructed a relationship graph covering 32 accounts. Device fingerprinting identified 6 accounts sharing the same jailbroken phone. Payment account association showed that 3 of these accounts were linked to the same virtual credit card. The graph neural network calculated the group's modularity Q-value to be 0.79, far exceeding the warning line of 0.6. The feature analysis engine detected an abnormal pattern: all accounts placed orders in a concentrated manner at 3:00 AM Moscow time, and the order amounts were precisely controlled below the risk control threshold. The dynamic rule generator immediately created a new rule, "Cross-Account Dispersed Payment Detection Strategy," which automatically triggers interception when the daily cumulative payment of a group of related accounts on the same device exceeds $2000. Simultaneously, the rule priority arbitrator elevated this rule to the highest level, covering the European servers in real time. Within the first week of implementation, it blocked the operations of 3 professional fraud gangs, improved the data display group fraud detection rate, and expanded the coverage of related account identification to secondary indirect association nodes.
[0025] Example 3: Implementation of Scene Adaptation Terminal When the platform conducts a "fresh food flash sale" event, the scenario adaptation end automatically switches to a fresh food-specific detection mode. The hierarchical modeling engine first loads a pre-trained cold chain product risk feature library, increasing the weight of delivery address verification by 300%. Because fresh food requires immediate delivery, the payment time tolerance is compressed from the usual 5 minutes to 90 seconds. When user B tries to purchase 20 high-priced seafood gift boxes 0.3 seconds after the flash sale starts, the system detects three key anomalies: the account's history only includes digital products, the device's location is 1200 kilometers away from the delivery address, and the coupon used for payment comes from a black market channel. The scenario-based decision tree automatically triggers triple verification: requiring the upload of photos of refrigerated equipment, forcing the user to choose in-store pickup, and freezing the batch of coupons. The freezing is specifically a temporary freeze, with an appeal link sent to the user simultaneously. If the temporary freeze is manually reviewed and confirmed within 72 hours, it becomes a permanent freeze. Post-event analysis shows that this strategy reduced the misjudgment rate in fresh food scenarios. A regional central warehouse reduced its monthly operating costs by $180,000 by accurately intercepting 23 fake orders, thus avoiding waste of cold storage resources.
[0026] Example 4: Device fingerprinting and real-time blocking implementation A payment platform discovered multiple "coupon-grabbing" attacks carried out through device farms. The system initiated the cross-platform risk device fingerprint database construction process as described in claim 11. In step S111, the device fingerprint analysis engine detected highly suspicious characteristics in the current batch of registered devices: 87% of the devices returned forged unique device identifiers, and 62% triggered kernel-level tampering alarms. Simultaneously, network behavior analysis in step S112 showed that this batch of devices switched proxy IPs an average of 19 times within 24 hours, with an anonymous network usage rate as high as 96%, far exceeding the baseline of 3% for normal users. The similarity matching model in step S113, through cosine similarity calculation, compared the characteristics of this batch of devices with the historical cheating device database, matching a similarity of 0.91 with the device characteristics of the "Spring Festival red envelope attack" incident six months prior. Based on the dynamic blocking strategy of claim 12, when a new order... When step S121 simultaneously triggers three high-risk indicators—hardware tampering, high-frequency proxy IPs, and historical feature matching—the system immediately raises the risk level to the highest level. Step S122 simultaneously freezes 12 associated payment channels and terminates 23 pending transactions, preventing a loss of approximately $85,000. Specifically, the freeze is a temporary freeze on the highest-risk order, and an appeal link is sent to the user simultaneously. If the temporary freeze is confirmed by manual review within 72 hours, it will be converted to a permanent freeze. The device risk tracing report generated in step S123 shows that the "kernel signature anomaly" and "IP hopping frequency" indicators in the heatmap of the attack source device both exceeded historical peaks. Correlation analysis reveals that it has a 92% traffic overlap with an IP pool in Southeast Asia. After implementing this solution, the fraud detection rate in the new device registration process is improved, and the average response time for freezing payment channels is shortened to 280 milliseconds.
Claims
1. A big data-based order fraud detection device, characterized in that, include: The system includes a data acquisition module, a feature engineering module, a model training module, a real-time detection module, a network analysis module, a rule engine module, a risk interception module, and a visualization module.
2. The order fraud detection device based on big data according to claim 1, characterized in that: The data acquisition module includes a user behavior acquisition submodule, a transaction interface submodule, and a logistics analysis submodule; The feature engineering module integrates a time-series feature extraction unit and a graph neural network unit; The rule engine module includes a dynamic rule generator and a rule priority arbitrator.
3. A big data-based method for detecting order fraud, characterized in that: The method includes the following steps: S1. Collect multi-source order data, including user behavior data, transaction data, and logistics data; S2. Perform feature engineering on the multi-source order data to generate a multi-dimensional fraud feature set; S3. Construct an order fraud detection model, including a static detection model based on machine learning and a real-time detection model based on stream processing; S4. Train the order fraud detection model using historical order data, and generate the trained model through parameter optimization; S5. Input the real-time order data into the trained model and output the fraudulent order detection results; S6. Verify the fraudulent order detection results, generate feedback data, and optimize model parameters; S7. Based on the correlation network analysis, identify the group behavior of fraudulent orders and generate group fraud feature data; S8. Establish a dynamic rule engine and update the detection rule base according to the group cheating feature data; S9. Intercept high-risk orders in real time and generate order interception instructions; S10. Generate an order fraud detection report and display it visually.
4. The method for detecting order fraud based on big data according to claim 3, characterized in that: S1 includes: S11. Collect user behavior data through user terminal tracking, including page dwell time, click frequency, and operation trajectory; S12. Obtain transaction data from the transaction system API, including payment method, transaction amount, and coupon usage frequency; S13. Obtain logistics data through the logistics platform interface, including delivery time, delivery location, and return rate.
5. The method for detecting order fraud based on big data according to claim 3, characterized in that: S2 includes: S21. Clean the user behavior data, remove outliers and fill in missing data; S22. Extract time-series features, including order submission frequency and payment interval standard deviation within a unit of time. The formula for calculating the payment interval standard deviation is: in, The standard deviation of the payment interval, Let i be the interval between payments. The average of the payment intervals. For the number of payments; S23. Construct graph neural network features and generate a centrality index for the user association network; S24. Portfolio transaction characteristics, including the deviation rate of single transaction amount from the historical average.
6. The method for detecting order fraud based on big data according to claim 3, characterized in that: S3 includes: S31. The static detection model is constructed using the XGBoost algorithm, and the input dimensions include user credit score, device fingerprint, and IP geographic features. S32. The real-time detection model is built on the Flink stream processing framework and dynamically adjusts the window according to business traffic. S33, Integrated Graph Convolutional Network Module, analyzes the ternary relationship subgraph of user-device-IP.
7. The method for detecting order fraud based on big data according to claim 3, characterized in that: S4 includes: S41. Divide the training set and the test set, and generate sample data using a sliding time window; S42. Adjust the model hyperparameters through Bayesian optimization, with the objective function being to maximize the F1-score. S43. Adversarial training is used to enhance the robustness of the model by injecting 10% perturbation samples.
8. The method for detecting order fraud based on big data according to claim 3, characterized in that: S5 includes: S51. Perform window aggregation on the real-time data stream and calculate feature statistics; S52. Input the aggregated features into the real-time detection model and output the anomaly probability value; S53. When the probability of an anomaly exceeds the threshold, a real-time interception process is triggered.
9. The method for detecting order fraud based on big data according to claim 3, characterized in that: S7 includes: S71. Construct a user association graph, with nodes including user ID, device number, and payment account; S72. The Louvain algorithm is used to detect community structure and identify high-risk groups by maximizing modularity. The modularity calculation formula for identifying high-risk groups is as follows: in, For community modularity, The sum of the weights of all edges in the graph. Let be the edge weight between node i and node j. It is the sum of the weights of all edges connected to node i. Let i be the community ID to which node i belongs. For community indicator functions; S73. Extract community features, including transaction density within the community and cross-community connectivity.
10. The method for detecting order fraud based on big data according to claim 3, characterized in that: S8 includes: S81. Establish a rule template library, including the rule for "short-term multi-account payment on the same device"; S82. Dynamically generate new rules based on the group cheating characteristic data; S83 uses a rule engine for priority sorting and real-time matching of high-risk patterns.