Data processing method and device, equipment, medium and program product

Abstract

The invention provides a data processing method which can be applied to the technical field of artificial intelligence. The method comprises the following steps: in response to a transaction behavior of a user, obtaining a real-time touch screen behavior characteristic and a real-time keystroke behavior characteristic of the user; based on the real-time touch screen behavior characteristics and the real-time keystroke behavior characteristics, multi-dimensional characteristic extraction and construction processing is executed, and a to-be-evaluated joint characteristic set is obtained; the behavior matching degree of the user is evaluated on the basis of a target evaluation model and a to-be-evaluated joint feature set, the target evaluation model is obtained after an evaluation model is trained according to a historical joint feature set, and the historical joint feature set is obtained by executing multi-dimensional feature extraction and construction processing on the basis of historical touch screen behavior features and historical keystroke behavior features; and sending the behavior matching degree to a server side. The invention further provides a data processing device and equipment, a storage medium and a program product.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence technology, and more specifically to a data processing method, apparatus, device, medium, and program product. Background Technology

[0002] In the financial technology field, ensuring the security of electronic transactions is paramount. Existing transaction security assessment systems typically rely on single-dimensional verification based on static rules such as transaction amount, time, or recipient. This approach cannot effectively verify the true identity of the current operator. To address this issue, behavioral biometrics have begun to be introduced for identity assessment. However, existing biometric assessment schemes generally suffer from architectural flaws: they typically require uploading raw biometric data collected from the user's terminal (such as keystroke rhythm or swipe trajectory) to a cloud server for centralized comparison. This model not only introduces serious data privacy compliance risks but also suffers from high latency due to reliance on network communication, making it difficult to meet the performance requirements of real-time transactions.

[0003] Furthermore, these solutions are relatively limited in their feature dimensions, such as analyzing only keystroke dynamics or only touchscreen trajectories. This reliance on single-modal features results in insufficient accuracy in their evaluations, making them ill-suited for complex authentication scenarios. Summary of the Invention

[0004] In view of the above problems, this application provides data processing methods, apparatus, devices, media and program products.

[0005] According to a first aspect of this application, a data processing method is provided, applied to an edge device. The method includes: in response to a user's transaction behavior, acquiring the user's real-time touch screen behavior features and real-time keystroke behavior features; performing multi-dimensional feature extraction and construction processing based on the real-time touch screen behavior features and the real-time keystroke behavior features to obtain a joint feature set to be evaluated; evaluating the user's behavior matching degree based on a target evaluation model and the joint feature set to be evaluated, wherein the target evaluation model is obtained by training an evaluation model based on a historical joint feature set, and the historical joint feature set is obtained by performing multi-dimensional feature extraction and construction processing based on historical touch screen behavior features and historical keystroke behavior features; and sending the behavior matching degree to a server.

[0006] According to an embodiment of this application, the step of performing multi-dimensional feature extraction and construction processing based on the real-time touchscreen biological behavior features and the real-time keystroke biological behavior features to obtain a joint feature set to be evaluated includes: performing standardization processing on the real-time keystroke behavior features and the real-time touchscreen behavior features respectively to obtain first standard feature data corresponding to the real-time keystroke behavior and second standard feature data corresponding to the real-time touchscreen behavior; performing extraction processing based on time and pressure features based on the first standard feature data to obtain a first feature set; performing extraction processing based on speed and curvature features based on the second standard feature data to obtain a second feature set; and performing concatenation processing based on the first feature set and the second feature set to obtain the joint feature set to be evaluated.

[0007] According to an embodiment of this application, the standardization process performed on the real-time keystroke behavior features and the real-time touchscreen behavior features to obtain first standard feature data corresponding to the real-time keystroke behavior and second standard feature data corresponding to the real-time touchscreen behavior includes: performing timestamp alignment processing and pressure value normalization processing on the real-time keystroke behavior features to obtain the first standard feature data; and performing coordinate normalization processing and time series alignment processing on the real-time touchscreen behavior features to obtain the second standard feature data.

[0008] According to an embodiment of this application, the step of performing time and pressure feature extraction processing based on the first standard feature data to obtain a first feature set includes: performing time interval statistics calculation processing on the first standard feature data and the corresponding timestamp sequence to obtain time interval statistics; performing pressure fluctuation statistics calculation processing on the first standard feature data and the corresponding pressure value sequence to obtain pressure fluctuation statistics; and constructing the first feature set based on the time interval statistics and the pressure fluctuation statistics.

[0009] According to an embodiment of this application, the step of performing extraction processing based on velocity and curvature features to obtain a second feature set based on the second standard feature data includes: performing sliding velocity statistical processing based on the coordinate sequence in the second standard feature data to obtain sliding velocity statistics; performing trajectory curvature calculation processing based on the coordinate sequence in the second standard feature data to obtain trajectory curvature statistics; and constructing the second feature set based on the sliding velocity statistics and the trajectory curvature statistics.

[0010] According to an embodiment of this application, the step of training an evaluation model based on a historical joint feature set to obtain the target evaluation model includes: acquiring the user's historical touch screen behavior features and historical keystroke behavior features; performing multi-dimensional feature extraction and construction processing based on the historical touch screen behavior features and the historical keystroke behavior features to obtain a historical joint feature set; and using the historical joint feature set to train an evaluation model to obtain the target evaluation model. The evaluation model includes a hidden layer for capturing temporal behavior features, the hidden layer including a bidirectional temporal processing layer and an attention weighting layer, the attention weighting layer being used to weight key time steps in the temporal behavior features.

[0011] A second aspect of this application provides a data processing method applied to a server. The method includes: in response to a user's transaction behavior, obtaining a behavior matching degree sent by an edge device, wherein the behavior matching degree is obtained based on a target evaluation model and a joint feature set to be evaluated, the target evaluation model is obtained after training an evaluation model based on a historical joint feature set, the historical joint feature set is obtained after performing multi-dimensional feature extraction and construction processing based on the user's historical touch screen biometric behavior features and historical keystroke biometric behavior features, and the joint feature set to be evaluated is obtained after performing multi-dimensional feature extraction and construction processing based on the user's real-time touch screen biometric behavior features and real-time keystroke biometric behavior features; performing transaction context evaluation processing based on the user's transaction data and historical transaction data to obtain a transaction environment risk value; performing query processing based on payee data and preset risk account data to obtain a transaction object risk value; performing dynamic weight processing based on the behavior matching degree, the transaction environment risk value, and the transaction object risk value to obtain a transaction risk value; and blocking the user's transaction behavior in response to the transaction risk value exceeding a preset first threshold.

[0012] According to an embodiment of this application, the step of performing transaction context evaluation processing based on user transaction data and historical transaction data to obtain a transaction environment risk value includes: performing segmented scoring processing based on the historical transaction rules within the historical transaction data, as well as the real-time transaction amount, real-time transaction time, and real-time transaction location within the transaction data, to obtain the transaction environment risk value.

[0013] According to an embodiment of this application, the step of performing dynamic weighting processing to obtain a transaction risk value based on the behavior matching degree, the transaction environment risk value, and the transaction object risk value includes: performing inverse weight allocation processing based on the behavior matching degree to determine a first risk weight, wherein the value of the behavior matching degree is negatively correlated with the value of the first risk weight; performing amount proportion weighting processing based on the transaction amount in the transaction data to determine a second risk weight, wherein the value of the transaction amount is positively correlated with the value of the second risk weight; performing residual weight allocation processing based on the first risk weight and the second risk weight to determine a third risk weight; and performing weighted fusion processing based on the first risk weight, the second risk weight, the third risk weight, the behavior matching degree, the transaction environment risk value, and the transaction object risk value to obtain the transaction risk value.

[0014] According to an embodiment of this application, the method further includes: performing secondary authentication on the user in response to the transaction risk value being lower than the preset first threshold and higher than the preset second threshold.

[0015] A third aspect of this application provides a data processing apparatus applied to an edge device. The apparatus includes: a first acquisition module configured to acquire real-time touchscreen behavior features and real-time keystroke behavior features of the user in response to a user's transaction behavior; a first processing module configured to perform multi-dimensional feature extraction and construction processing based on the real-time touchscreen behavior features and the real-time keystroke behavior features to obtain a joint feature set to be evaluated; a second processing module configured to evaluate the user's behavior matching degree based on a target evaluation model and the joint feature set to be evaluated, wherein the target evaluation model is obtained by training an evaluation model based on a historical joint feature set, and the historical joint feature set is obtained by performing multi-dimensional feature extraction and construction processing based on historical touchscreen behavior features and historical keystroke behavior features; and a first transmission module configured to send the behavior matching degree to a server.

[0016] A fourth aspect of this application provides a data processing apparatus applied to a server. The apparatus includes a second acquisition module configured to perform a response to a user's transaction behavior by acquiring a behavior matching degree sent from an edge device. The behavior matching degree is obtained based on an evaluation model and a joint feature set to be evaluated. The target evaluation model is obtained by training an evaluation model based on a historical joint feature set. The historical joint feature set is obtained by performing multi-dimensional feature extraction and construction processing based on the user's historical touchscreen biometric behavior features and historical keystroke biometric behavior features. The joint feature set to be evaluated is based on the user's real-time touchscreen biometric behavior features and real-time keystroke biometric behavior features. The risk values ​​are obtained after multi-dimensional feature extraction and construction of key biological behavioral characteristics; the third processing module is configured to perform transaction context evaluation based on user transaction data and historical transaction data to obtain a transaction environment risk value; the fourth processing module is configured to perform query processing based on payee data and preset risk account data to obtain a transaction object risk value; the fifth processing module is configured to perform dynamic weight processing based on the behavior matching degree, the transaction environment risk value, and the transaction object risk value to obtain a transaction risk value; and the sixth processing module is configured to block the user's transaction behavior in response to the transaction risk value exceeding a preset first threshold.

[0017] A fifth aspect of this application provides an electronic device comprising: one or more processors; and a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the method described above.

[0018] A sixth aspect of this application also provides a computer-readable storage medium having a computer program or instructions stored thereon, which, when executed by a processor, implement the steps of the above-described method.

[0019] A seventh aspect of this application also provides a computer program product, including a computer program or instructions that, when executed by a processor, implement the steps of the above-described method. Attached Figure Description

[0020] The above-mentioned contents, other objects, features and advantages of this application will become clearer from the following description of embodiments with reference to the accompanying drawings, in which:

[0021] Figure 1 The illustrations depict application scenarios of data processing methods, apparatuses, devices, media, and program products according to embodiments of this application.

[0022] Figure 2 A flowchart illustrating a data processing method applied to an edge device according to an embodiment of this application is shown schematically.

[0023] Figure 3 A flowchart illustrating step S200 of a data processing method applied to an edge device according to an embodiment of this application is shown schematically.

[0024] Figure 4 A flowchart illustrating step S210 of a data processing method applied to an edge device according to an embodiment of this application is shown schematically.

[0025] Figure 5 A flowchart illustrating step S220 of a data processing method applied to an edge device according to an embodiment of this application is shown schematically.

[0026] Figure 6 A flowchart illustrating step S230 of a data processing method applied to an edge device according to an embodiment of this application is shown schematically.

[0027] Figure 7 A flowchart illustrating step S300 of a data processing method applied to an edge device according to an embodiment of this application is shown schematically.

[0028] Figure 8 A flowchart illustrating a data processing method applied to a server according to an embodiment of this application is shown schematically.

[0029] Figure 9 This illustration schematically shows a flowchart of step S800 of a data processing method applied to a server according to an embodiment of the present application;

[0030] Figure 10 This schematically illustrates a structural block diagram of a data processing apparatus applied to an edge device according to an embodiment of this application;

[0031] Figure 11 This schematically illustrates a structural block diagram of a data processing apparatus applied to a server according to an embodiment of the present application;

[0032] as well as

[0033] Figure 12 A block diagram schematically illustrates an electronic device suitable for implementing a data processing method according to an embodiment of this application. Detailed Implementation

[0034] The embodiments of this application will now be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of this application. In the following detailed description, numerous specific details are set forth to provide a thorough understanding of the embodiments of this application for ease of explanation. However, it will be apparent that one or more embodiments may be implemented without these specific details. Furthermore, descriptions of well-known structures and technologies are omitted in the following description to avoid unnecessarily obscuring the concepts of this application.

[0035] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the scope of this application. The terms “comprising,” “including,” etc., as used herein indicate the presence of the stated features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0036] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein are to be interpreted in a manner consistent with the context of this specification, and not in an idealized or overly rigid way.

[0037] When using expressions such as "at least one of A, B, and C," the meaning should generally be interpreted according to the understanding of someone skilled in the art. For example, "a system having at least one of A, B, and C" should include, but is not limited to, systems having A alone, having B alone, having C alone, having A and B, having A and C, having B and C, and / or having A, B, and C. Similarly, when using expressions such as "at least one of A, B, or C," the meaning should generally be interpreted according to the understanding of someone skilled in the art. For example, "a system having at least one of A, B, or C" should include, but is not limited to, systems having A alone, having B alone, having C alone, having A and B, having A and C, having B and C, and / or having A, B, and C.

[0038] In today's financial technology services sector, with the increasing prevalence of electronic transactions and online payments, ensuring the security, reliability, and compliance of these transactions has become a key challenge for technological development. To protect user assets and maintain transaction order, existing technological solutions typically deploy transaction security assessment systems. However, traditional assessment mechanisms largely rely on single-dimensional verification of the transaction context. Specifically, these systems primarily use a series of preset static rules to determine the compliance of a current transaction; for example, they analyze the transaction amount, time, geographical location, or assess the historical status of the recipient's account. This assessment method, which relies solely on static rules, has an inherent limitation: it can assess the contextual information of the transaction itself, but it cannot effectively identify the true identity of the operator initiating the transaction.

[0039] To address these shortcomings, efforts have begun to explore incorporating user behavioral biometrics into the security assessment process, aiming to verify the operator's identity by confirming the consistency of their behavior. However, existing biometric-based assessment schemes generally suffer from serious architectural design flaws. A mainstream technical approach involves uploading raw biometric data collected from the user's terminal (such as key press timestamps or swipe trajectory coordinates) entirely to a cloud server for centralized processing and comparison. This "data upload to the cloud" model presents two irreconcilable problems: First, it poses a serious data compliance challenge because the user's raw biometric information is transmitted and stored on an external server, which contradicts the minimization principle of increasingly stringent global data privacy regulations (such as GDPR); second, this architecture relies on network communication, and the round-trip data transmission and centralized cloud computing inevitably lead to high latency, making it difficult to meet the performance requirements for instantaneous response in real-time transactions.

[0040] Furthermore, existing technologies exhibit limitations in their feature extraction dimensions. For example, some solutions focus solely on analyzing the user's keystroke dynamics, while others analyze only the user's touchscreen gesture trajectories. This evaluation method, reliant on a single modality, has limited discriminative power, making it difficult to construct sufficiently robust and accurate user profiles. Consequently, its overall recognition accuracy is often insufficient, failing to effectively address increasingly complex identity fraud scenarios. Therefore, how to efficiently and accurately assess the operator's identity while ensuring the privacy and security of users' biometric information has become a pressing technical problem in this field.

[0041] The data processing methods, apparatus, devices, media, and program products of this application can be used in the field of artificial intelligence technology, as well as in any field other than artificial intelligence. The application areas of the data processing methods, apparatus, devices, media, and program products of this application are not limited.

[0042] In the technical solution of this application, the user information (including but not limited to user personal information, user image information, user device information, such as location information) and data (including but not limited to data used for analysis, stored data, and displayed data) involved are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, application, and application of related data all comply with relevant laws, regulations, and standards, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entry points for users to choose to authorize or refuse.

[0043] In scenarios where personal information is used for automated decision-making, the methods, devices, and systems provided in this application all provide users with corresponding operation entry points for users to choose to agree to or reject the automated decision results; if the user chooses to reject, the process enters the expert decision-making process.

[0044] Figure 1 The illustrations depict application scenarios of data processing methods, apparatuses, devices, media, and program products according to embodiments of this application.

[0045] like Figure 1 As shown, application scenario 100 according to this embodiment may include a data processing method, apparatus, device, medium, and program product. Network 104 serves as a medium for providing a communication link between a first terminal device 101, a second terminal device 102, a third terminal device 103, and a server 105. Network 104 may include various connection types, such as wired or wireless communication links, or fiber optic cables, etc.

[0046] Users can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 via the network 104 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as financial service applications, web browser applications, search applications, email clients, social media platform software, etc. (for example only).

[0047] The first terminal device 101, the second terminal device 102, and the third terminal device 103 can be various electronic devices with displays and support web browsing, including but not limited to smartphones, tablets, laptops, and desktop computers.

[0048] Server 105 can be a server that provides various services, such as a backend management server that supports information browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103 (this is just an example). The backend management server can analyze and process data such as received user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal devices.

[0049] It should be noted that, in the first aspect, the data processing method provided in the embodiments of this application can be executed by server 105; in the second aspect, the data processing method provided in the embodiments of this application can be executed by first terminal device 101, second terminal device 102, or third terminal device 103. Correspondingly, in the third aspect, the data processing apparatus provided in the embodiments of this application can be disposed in server 105; in the fourth aspect, the data processing apparatus provided in the embodiments of this application can be disposed in first terminal device 101, second terminal device 102, or third terminal device 103. The data processing method provided in the embodiments of this application can also be executed by a server or server cluster that is different from server 105 and capable of communicating with first terminal device 101, second terminal device 102, third terminal device 103, and / or server 105. Correspondingly, the data processing apparatus provided in the embodiments of this application can also be disposed in a server or server cluster that is different from server 105 and capable of communicating with first terminal device 101, second terminal device 102, third terminal device 103, and / or server 105.

[0050] It should be understood that Figure 1 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0051] The following will be based on Figure 1 The described scene, through Figures 2-9 The data processing method of the application embodiments will be described in detail.

[0052] Figure 2 A flowchart illustrating a data processing method applied to an edge device according to an embodiment of this application is shown schematically.

[0053] like Figure 2 As shown, this application provides a data processing method applied to an edge device, including operations S100 to S400.

[0054] Specifically, in operation S100, in response to the user's transaction behavior, the user's real-time touchscreen behavior characteristics and real-time keystroke behavior characteristics are acquired. In some specific embodiments, the user's transaction behavior may include a series of operations performed on the edge device that require identity verification, such as entering a payment password, performing a swipe confirmation, or selecting a transaction button. At the moment the user performs these operations, the sensors on the edge device are activated, synchronously collecting two different modalities of raw biometric behavior data in the background at a high frequency. The real-time touchscreen behavior characteristics refer to the raw spatiotemporal data stream generated when the user's fingers perform operations such as swiping and tapping on the touch screen of the edge device. These raw spatiotemporal data streams may specifically include a coordinate sequence for depicting the physical trajectory of the gesture, a sequence of touchscreen pressure values ​​corresponding to each sampling point on the trajectory, and a sequence of touchscreen timestamps recording the time of occurrence of each sampling point. The real-time keystroke behavior characteristics refer to the time and pressure data generated when the user presses keys on a (e.g., virtual) keyboard. These data may specifically include the timestamp of each key press, the timestamp of each key release, and the pressure value recorded by the sensor during key presses. These two types of characteristics reflect the user's individual operating habits from different dimensions.

[0055] In some specific embodiments, the acquisition of real-time touchscreen behavior features can be achieved through a capacitive touchscreen sensor built into the edge device. This sensor needs to have a sufficiently high reporting rate, such as no less than 100 samples per second, to ensure that it can capture subtle changes and high-frequency dynamics in the user's gesture trajectory. In other embodiments, the acquisition of real-time touchscreen behavior features can also be achieved through other types of touchscreen sensors. The acquisition of real-time keystroke behavior features can be achieved through a pressure-sensitive touchscreen or physical keyboard, and its sampling rate also needs to reach a certain threshold, such as no less than 100 Hz, in order to accurately record the start and end times and force changes of the user's keystrokes, providing a high-precision data foundation for subsequent rhythm and pressure fluctuation analysis. In other embodiments, the acquisition of real-time keystroke behavior features can also be achieved through other forms of pressure-sensitive touch tools.

[0056] Specifically, in operation S200, based on the real-time touchscreen behavior features and the real-time keystroke behavior features, multi-dimensional feature extraction and construction processing is performed to obtain the joint feature set to be evaluated. In some specific embodiments, operation S200 is a core step in solving the problem of insufficient evaluation accuracy caused by relying on single-modal features in the prior art. The technical concept of operation S200 is that a single behavioral feature (e.g., only keystroke features or only touchscreen features) is easily imitated or affected by the user's state (e.g., tension, distraction). However, by fusing two or more orthogonal behavioral features of different dimensions, a more stable and harder-to-forge user behavior profile can be constructed. The multi-dimensional features can specifically refer to the temporal rhythm dimension and pressure dimension derived from the real-time keystroke behavior features; and the spatial trajectory dimension and kinematic dimension (e.g., speed, acceleration) derived from the real-time touchscreen behavior features. The processing logic of operation S200 is as follows: First, the two types of heterogeneous raw data streams are preprocessed using standardization to eliminate device differences and noise interference. Then, quantitative indicators that most effectively represent individual user habits are extracted from the standardized data. Finally, these quantitative indicators extracted from different modalities and dimensions are concatenated and combined to construct a unified, high-dimensional feature vector, i.e., the joint feature set to be evaluated. The execution of operation S200 enables subsequent evaluation models to make judgments based on input data with strong information entropy and discriminative power, thereby significantly improving the accuracy and robustness of the evaluation results.

[0057] like Figure 3 As shown, in some exemplary embodiments, the step of performing multi-dimensional feature extraction and construction processing based on the real-time touch screen biological behavior features and real-time keystroke biological behavior features to obtain a joint feature set to be evaluated includes: operations S210 to S240.

[0058] Specifically, in operation S210, standardization processing is performed on the real-time keystroke behavior features and the real-time touchscreen behavior features respectively to obtain first standard feature data corresponding to the real-time keystroke behavior and second standard feature data corresponding to the real-time touchscreen behavior. In some specific embodiments, performing standardization processing is a prerequisite for effective feature extraction. Since the raw behavioral feature data directly obtained from the sensor usually contains noise introduced by hardware jitter or involuntary micro-tremors of the user, and the scale and unit of the data (e.g., coordinates, pressure, time) will vary with the physical specifications of the edge device (e.g., screen resolution, sensor maximum range, system clock frequency), without standardization processing, subsequent feature extraction and model evaluation will be severely inaccurate, causing the model to learn the physical characteristics of the device rather than the behavioral characteristics of the user. Therefore, the processing logic of operation S210 is to apply specific data cleaning and scaling algorithms for different modal data characteristics. The purpose is to remove noise, align the timing, and unify the dimensions of the data, ultimately producing clean, regular first standard feature data and second standard feature data that are independent of the specific device, laying the foundation for obtaining stable and reproducible feature values ​​in the future.

[0059] like Figure 4 As shown, in some exemplary embodiments, the standardization process performed on the real-time keystroke behavior features and the real-time touch screen behavior features to obtain the first standard feature data corresponding to the real-time keystroke behavior and the second standard feature data corresponding to the real-time touch screen behavior includes: operations S211 to S212.

[0060] Specifically, in operation S211, based on the real-time keystroke behavior characteristics, timestamp alignment processing and pressure value normalization processing are performed to obtain the first standard feature data. In some specific embodiments, operation S212 is used to process the timestamp sequence and pressure value sequence contained in the real-time keystroke behavior characteristics. The purpose of the timestamp alignment processing is not resampling, but to convert absolute system timestamps into relative time interval features, because what characterizes the user's rhythm characteristics is the relative duration between keys, not the absolute moment when the key occurs. This processing may specifically include: calculating the time interval between pressing adjacent keys, the time interval between pressing and releasing (i.e., key holding time), the time interval between releasing and pressing (i.e., idle time), etc., to generate a sequence composed of relative time intervals. Among them, the pressure value normalization processing aims to eliminate the influence caused by the difference in pressure measurement range of different sensors; in some specific embodiments, this normalization processing is performed by dividing the original pressure value by the maximum range value of the device sensor, uniformly scaling it to a standard floating-point range of [0, 1].

[0061] Specifically, in operation S212, coordinate normalization and time series alignment are performed based on the real-time touchscreen behavior characteristics to obtain the second standard feature data. In some specific embodiments, operation S212 is used to process the trajectory coordinate sequence and timestamp sequence contained in the real-time touchscreen behavior characteristics; in order to eliminate glitches introduced by sensor jitter or finger tremors, a noise reduction process can be performed on the original trajectory coordinate sequence first; for example, a filter prediction and update mechanism, such as a Kalman filter-like mechanism, is applied to smooth the position and speed of the trajectory points to generate a smooth trajectory that is closer to the user's true intention; then the coordinate normalization process is performed, which aims to eliminate the influence of differences in screen resolution and size of different devices; for example, all absolute pixel coordinates (e.g., X and Y coordinates) in the trajectory sequence are converted into a standardized relative coordinate system, for example, mapping all X coordinate values ​​to the interval [0, 1], for example, by dividing by the total screen width, and mapping all Y coordinate values ​​to [0, 1]. The interval of [1] is decoupled from the physical specifications of the specific device by dividing by the total screen height, for example. Then, the time series alignment process is performed, which aims to address the problem of inconsistent sampling rates under different devices or system loads. For example, the time intervals of the original trajectory points may be uneven. By applying an interpolation algorithm, the smoothed trajectory can be resampled at a fixed time frequency to generate a trajectory sequence with uniform time intervals and standard lengths. Through the above processing, the first standard feature data finally obtained is a set of regular, device-independent, standardized spatiotemporal trajectory data.

[0062] By performing operations S211 and S212, the two sets of raw data from different sensors with different physical meanings and data scales are converted into standardized first standard feature data and second standard feature data that can be uniformly processed by subsequent algorithms, thus ensuring the stability and effectiveness of subsequent feature extraction.

[0063] Specifically, in operation S220, based on the first standard feature data, extraction processing based on time and pressure features is performed to obtain a first feature set. In some specific embodiments, operation S220 aims to extract quantitative indicators from the first standard feature data that best reflect the user's individualized operational rhythm and habits. The reason for extracting based on time and pressure features is that the user's keystroke dynamics are a unique and difficult-to-imitate biological characteristic. When a legitimate user inputs a specific sequence (such as a password), the interval between keystrokes, the duration of keystrokes, and the distribution of pressure applied to the keystrokes usually remain within a stable and personalized range. In contrast, it is difficult for an abnormal operator to reproduce this subconscious rhythm and pressure pattern when attempting to imitate it. Therefore, the processing logic of operation S220 is to apply statistical and information theory calculations to the timestamp sequence and pressure value sequence contained in the first standard feature data, transforming the first standard feature data from its original data stream form into a set of numerical values ​​with clear statistical significance, i.e., the first feature set. The S220 operation transforms the user's abstract typing rhythm and key pressure into machine-readable and comparable mathematical features, providing the first dimension of judgment basis for subsequent evaluation models.

[0064] like Figure 5 As shown, in some exemplary embodiments, the step of performing time and pressure feature extraction processing based on the first standard feature data to obtain the first feature set includes: operations S221 to S223.

[0065] Specifically, in operation S221, based on the first standard feature data and the corresponding timestamp sequence, the time interval statistics of adjacent operations are calculated to obtain the time interval statistics. In some specific embodiments, operation S221 is used to quantify the "rhythmic" characteristics of the user's keystroke behavior. The first standard feature data includes aligned key press timestamps and key release timestamp sequences. In some specific embodiments of operation S221, a series of relative time intervals are first calculated based on these timestamps, such as calculating the time interval between two adjacent key presses to reflect the user's typing speed; or calculating the time interval between the press and release of the same key, i.e., the key hold duration, to reflect the user's decisiveness in keystrokes. After obtaining the sequence of these time interval values, statistical calculations are performed on the sequence, such as calculating its mean, standard deviation, median, etc.; these calculation results together constitute the time interval statistics; operation S221 extracts and solidifies the user's time rhythm pattern from the original timestamp stream into a set of stable statistical values, such as average typing interval, rhythm stability, etc., which are the core time dimension features for identifying user identity.

[0066] Specifically, in operation S222, based on the first standard feature data and the corresponding pressure value sequence, pressure fluctuation statistics are calculated to obtain pressure fluctuation statistics. In some specific embodiments, operation S222 is used to quantify the force characteristics of the user's keystroke behavior. The first standard feature data includes a pressure value sequence normalized to a standard interval. In some specific embodiments, operation S222 performs statistical distribution processing on the pressure value sequence to comprehensively evaluate the user's keystroke pressure habits. For example, it calculates the average value of the pressure sequence to reflect whether the user's average keystroke pressure is too light or too heavy; it calculates the standard deviation of the pressure value sequence to reflect the stability or fluctuation range of the user's keystroke pressure during continuous keystrokes; and it calculates the information entropy of the pressure value sequence to reflect the complexity or disorder of the user's pressure changes. The calculated statistical values, such as the mean, standard deviation, and information entropy, together constitute the pressure fluctuation statistics. Operation S222 provides a force-related dimension feature independent of time rhythm. This dimension feature is a core dimension feature for distinguishing abnormal operators who may deliberately imitate typing speed but cannot reproduce the user's unique keystroke pressure.

[0067] Specifically, in operation S223, the first feature set is constructed based on the time interval statistics and the pressure fluctuation statistics. In some specific embodiments, operation S223 is a feature fusion and vectorization process. Operation S223 collects and combines the time interval statistics obtained in operation S221, such as total duration, interval mean, and interval standard deviation, with the pressure fluctuation statistics obtained in operation S222, such as pressure mean, pressure standard deviation, and pressure information entropy. For example, these statistics are arranged and concatenated in a predefined order to form a fixed-dimensional feature vector. This fixed-dimensional feature vector is the first feature set, which summarizes the user's behavioral characteristics in terms of time and pressure dimensions when performing touch screen operations.

[0068] Specifically, in operation S230, based on the second standard feature data, extraction processing based on speed and curvature features is performed to obtain a second feature set. In some specific embodiments, operation S230 aims to extract kinematic and geometric features from the second standard feature data that reflect the user's unique kinematic and geometric characteristics when performing spatial gestures (such as swipe to confirm). The reason for extracting based on speed and curvature features is that the user's touchscreen gesture trajectory is another highly personalized biometric feature. When a legitimate user performs a specific gesture, the smoothness of their swipe, speed changes, and the arc of their turn are usually stable and unique, while when an abnormal operator imitates them, their trajectory often reveals unnatural jitter, sudden speed changes, or abnormal turning angles. Therefore, the processing logic of operation S230 is to apply kinematic and differential geometry calculations to the trajectory coordinate sequence contained in the second standard feature data, transforming it from the original set of coordinate points into a set of values ​​that can quantify its motion style and geometric shape, i.e., the second feature set. By capturing the user's operating habits in the spatial dimension, operation S230 provides a second key judgment criterion that is completely orthogonal to the keystroke features for evaluating the model.

[0069] like Figure 6 As shown, in some exemplary embodiments, the step of performing extraction processing based on velocity and curvature features to obtain a second feature set according to the second standard feature data includes: operations S231 to S233.

[0070] Specifically, in operation S231, based on the coordinate sequence within the second standard feature data, statistical processing of the sliding speed is performed to obtain a sliding speed statistic. In some specific embodiments, operation S231 is used to quantify the kinematic characteristics of the user's touchscreen gestures; wherein, the second standard feature data contains a time-aligned and coordinate-normalized trajectory coordinate sequence. In some specific embodiments of operation S231, based on the coordinate sequence and its corresponding timestamp sequence, the instantaneous velocity vector between each sampling point on the trajectory is calculated, that is, the displacement difference between adjacent coordinate points divided by the time difference; subsequently, the magnitude of these velocity vectors is calculated. After obtaining this sequence composed of a series of instantaneous rate values, statistical processing is performed on the sequence, such as calculating its average value to reflect the overall speed of the user's sliding, and calculating its variance to reflect the stability or jitter of the user's speed during the sliding process; these calculation results (e.g., mean, variance, etc.) together constitute the sliding speed statistic. Operation S231 provides data support for distinguishing between smooth, habitual operations and hesitant, abnormal operations by accurately quantifying the speed and stability of the user's gestures.

[0071] Specifically, in operation S232, based on the coordinate sequence within the second standard feature data, trajectory curvature calculation processing is performed to obtain trajectory curvature statistics. In some specific embodiments, operation S232 is used to quantify the geometric characteristics of a user's touchscreen gesture, wherein the coordinate sequence within the second standard feature data describes the physical shape of the gesture. Operation S232 approximates the curvature of the trajectory by analyzing the directional changes between adjacent line segments on the trajectory. In some specific implementations, operation S232 may be: traversing each sampling point (non-endpoint) on the trajectory, constructing a first vector formed by the point and its previous point, and a second vector formed by the point and its next point; then calculating the angle between these two vectors, for example, by calculating the cosine value using the dot product method; finally, using a function value related to the angle to approximate the instantaneous curvature of the point; after obtaining the instantaneous curvature value sequence of all points on the trajectory, performing statistical processing on the sequence, for example, extracting its maximum value to capture the sharpest corners in the trajectory; or calculating its integral value to reflect the overall curvature of the trajectory; these statistical results together constitute the trajectory curvature statistics. Operation S232 effectively distinguishes between the user's smooth "signature-like" arc and the stiff, shaky imitation trajectory of an abnormal operator by quantifying the shape characteristics of the user's gesture.

[0072] Specifically, in operation S233, the second feature set is constructed based on the sliding speed statistics and the trajectory curvature statistics. In some specific embodiments, operation S233 performs feature combination, collecting and arranging the sliding speed statistics obtained in operation S231 and the trajectory curvature statistics obtained in operation S232. For example, these statistics are concatenated into a fixed-dimensional feature vector in a predefined order. This vector is the second feature set, which quantitatively summarizes the kinematic and geometric behavioral characteristics of the user when performing touch gestures.

[0073] Specifically, in operation S240, a concatenation process is performed based on the first feature set and the second feature set to obtain the joint feature set to be evaluated. In some specific embodiments, operation S240 is the final step in bimodal feature fusion; in some specific embodiments, the concatenation process can merge the first feature set, which represents the "time-pressure" characteristic of keystrokes, obtained in operation S223, with the second feature set, which represents the "speed-curvature" characteristic of touchscreens, obtained in operation S233, at the vector level; for example, if the first feature set is a 16-dimensional vector and the second feature set is another 16-dimensional vector, then the concatenation process will generate a unified 32-dimensional vector; this fused vector is the joint feature set to be evaluated. Operation S240 integrates behavioral features from two completely different modalities (keystrokes and touchscreens) and multiple different dimensions (time, pressure, speed, curvature) into a unified mathematical expression, enabling the subsequent evaluation model to make comprehensive judgments based on global, cross-modal information, with robustness and accuracy superior to any single-modal feature set. By executing operations S210 to S240, a standardized and robust multimodal feature extraction and construction pipeline was implemented. This pipeline transformed the raw and noisy sensor data generated by users during transactions into a high-dimensional, information-dense, and model-evaluable joint feature set, laying the data foundation for subsequent accurate identity assessment.

[0074] Specifically, in operation S300, the user's behavior matching degree is evaluated based on the target evaluation model and the joint feature set to be evaluated. The target evaluation model is obtained by training an evaluation model based on a historical joint feature set, which is obtained by performing multi-dimensional feature extraction and construction processing based on historical touch screen behavior features and historical keystroke behavior features. In some specific embodiments, operation S300 is the core step in performing local real-time inference on the edge device. After obtaining the joint feature set to be evaluated in operation S200, the edge device loads the target evaluation model pre-stored in a local secure area, and uses the joint feature set to be evaluated as input data, feeding it into the target evaluation model for forward propagation calculation. The target evaluation model analyzes the input vector and outputs a scalar value, which is defined as the user's behavior matching degree. In some embodiments, the behavior matching degree can be a continuous floating-point number in the range [0, 1], used to quantify the similarity between the current operation and the user's inherent behavioral habits, that is, the behavioral habits represented by the joint feature set to be evaluated and the behavioral habits represented by the target evaluation model, wherein a higher scalar value represents a high degree of matching, and a lower scalar value represents a significant deviation or anomaly.

[0075] The target evaluation model is obtained by training an evaluation model based on a historical joint feature set. This historical joint feature set is obtained through multi-dimensional feature extraction and construction based on historical touch screen behavior features and historical keystroke behavior features. This ensures that the data encountered by the evaluation model during the training phase (using the historical joint feature set) and the real-time evaluation phase (using the joint feature set to be evaluated) are completely consistent and aligned in the feature space. In other words, the data used for training and the data used for evaluation have undergone the exact same standardization, feature extraction, and construction process. This "same source, same process" data processing method ensures that the model learns the essential features of user behavior patterns, rather than artificial features introduced by noise, device differences, or different data processing procedures. This makes the final evaluated behavior matching degree credible and accurate, laying a data foundation for subsequent server-side decision-making.

[0076] like Figure 7 As shown, in some exemplary embodiments, the step of training the evaluation model based on the historical joint feature set to obtain the target evaluation model includes: operations S310 to S330.

[0077] Specifically, in operation S310, the user's historical touchscreen behavior characteristics and historical keystroke behavior characteristics are acquired. In some specific embodiments, operation S310 is executed by the edge device during the initialization phase or user calibration phase after deployment; in order to establish a personalized baseline model that can represent the user, it is necessary to first collect operation samples from legitimate users. Operation S310 may specifically include: guiding the user to repeatedly perform normal transaction operations on the edge device a specific number of times, such as entering a password, swiping to confirm, etc. During the user's execution of these historical operations, the edge device's sensors synchronously collect and store multiple sets of the historical touchscreen behavior characteristics (e.g., historical trajectory coordinates, pressure, timestamp sequences) and the historical keystroke behavior characteristics (e.g., historical key press and release timestamps and pressure value sequences) in the background in a manner completely consistent with the real-time collection in operation S100.

[0078] Specifically, in operation S320, based on the historical touchscreen behavior features and the historical keystroke behavior features, multi-dimensional feature extraction and construction processing is performed to obtain a historical joint feature set. In some specific embodiments, the purpose of operation S320 is to convert the multiple sets of raw historical data collected in operation S310 into a standardized feature vector sequence that can be used to evaluate model training. The "multi-dimensional feature extraction and construction processing" performed in operation S320 is completely consistent with the processing performed on real-time data in operations S210 to S240 in terms of algorithm and logic. Specifically, operation S320 will traverse all collected historical data samples and perform the following for each sample: standardize the historical keystroke behavior features and historical touchscreen behavior features respectively to obtain historical first standard feature data and historical second standard feature data; then, extract the historical first feature set based on time and pressure and the historical second feature set based on speed and curvature from these two sets of standard data respectively; finally, perform concatenation processing on these two sets of historical feature sets. By repeating this process on all historical samples, a sequence consisting of multiple high-dimensional feature vectors is finally obtained, namely the historical joint feature set, which serves as the input data for training and evaluating the model in subsequent operation S330.

[0079] Specifically, in operation S330, the historical joint feature set is used to train an evaluation model to obtain the target evaluation model. The evaluation model includes a hidden layer for capturing temporal behavioral features. This hidden layer includes a bidirectional temporal processing layer and an attention-weighted layer. The attention-weighted layer is used to weight key time steps in the temporal behavioral features. In some specific embodiments, operation S330 is a personalized model training process executed locally on the edge device, where the historical joint feature set is input into an evaluation model with a specific architecture for training. The evaluation model's architecture is specifically designed to capture non-linear temporal behavioral patterns: First, data passes through an input layer, for example, with 32 nodes to match the dimension of the joint feature set. Next, the data enters the hidden layer, which contains a bidirectional temporal processing layer (e.g., a bidirectional long short-term memory network layer). This bidirectional processing layer analyzes the user's behavioral sequence not only from beginning to end (forward) but also from end to beginning (backward). This bidirectional processing capability allows the model to capture anomalous patterns that may appear at any point in the action sequence (such as hesitation in the middle or haste at the end), which is impossible with traditional unidirectional temporal models. Subsequently, the output sequence of the bidirectional temporal processing layer is fed into the attention weighting layer. The bidirectional temporal processing layer automatically identifies and amplifies the key time steps in the sequence that best represent the user's identity (e.g., the unique rhythm of inputting a specific character, or the specific curvature of a key corner when swiping a signature), while suppressing the weights of time steps with high commonality or noise, thereby improving the model's recognition accuracy. Finally, the output of the attention-weighted layer is fed into an output layer, which is used for the final similarity determination. After the training process is completed, for example, after several iterations using the backpropagation algorithm, the resulting evaluation model with fixed parameters is the target evaluation model. This target evaluation model is then securely stored in the local secure area of ​​the edge device. By executing operations S310 to S330, a highly personalized target evaluation model is built locally on the edge device. This target evaluation model, due to its feature extraction process being completely consistent with real-time evaluation and its network architecture optimized for temporal characteristics, is able to perform high-precision and robust evaluation of user behavior features.

[0080] Specifically, in operation S400, the behavioral matching score is sent to the server. In some specific embodiments, after evaluating and obtaining the behavioral matching score in operation S300, the edge device constructs a data packet containing the matching score, transaction context information such as transaction amount and payee, and other non-biometric features. In operation S400, all original biometric data collected in operation S100 (real-time touchscreen and keystroke features) and the joint feature set to be evaluated constructed in operation S200 are not included in this data packet and are immediately destroyed or discarded after local inference is completed. Subsequently, the edge device encrypts the data packet and sends it to the server through a secure network channel. Upon receiving the data packet, the server performs a final risk assessment based on this behavioral matching score, which does not contain any original biometric features, combined with other risk dimensions.

[0081] By executing the complete process from S100 to S400, a complete, closed-loop identity assessment and data processing flow was achieved at the edge device. This not only improved the accuracy of identity assessment by integrating bimodal biometrics and temporal models, but also fundamentally solved the serious privacy leakage risks and high network latency problems caused by uploading biometric data to the cloud in existing technologies by using an edge computing architecture that allows raw data to remain on the edge and only uploads assessment results. This enabled secure, accurate, and efficient transaction behavior assessment.

[0082] like Figure 8 As shown, this application provides a data processing method applied to a server, including operations S500 to S900.

[0083] Specifically, in operation S500, in response to the user's transaction behavior, the behavior matching degree sent by the edge device is obtained. This behavior matching degree is obtained based on an evaluation model and a joint feature set to be evaluated. The target evaluation model is obtained by training an evaluation model based on historical joint feature sets, which are obtained by performing multi-dimensional feature extraction and construction processing based on the user's historical touchscreen biometric behavior features and historical keystroke biometric behavior features. The joint feature set to be evaluated is obtained by performing multi-dimensional feature extraction and construction processing based on the user's real-time touchscreen biometric behavior features and real-time keystroke biometric behavior features. In some specific embodiments, the responsibility for data processing is transferred from the edge device to the cloud server. On the server side, operation S500 receives data packets from the edge device. A key characteristic of these data packets is that they do not contain any original user biometric data; the server only obtains a scalar value generated after local processing on the edge device, namely the behavior matching degree. This behavior matching score quantifies the similarity between the current operator and the account holder's behavioral habits; this design ensures that subsequent processing on the server side is carried out without accessing the user's biometric privacy data, thus architecturally resolving the privacy compliance risks brought about by data uploading to the cloud in existing technologies.

[0084] Specifically, in operation S600, based on the user's transaction data and historical transaction data, a transaction context assessment is performed to obtain a transaction environment risk value. In some specific embodiments, this transaction environment risk value is set because behavioral matching alone is insufficient to comprehensively assess the security of a transaction. For example, even a legitimate user (with high behavioral matching) might initiate an extremely large transfer at an abnormal time and place; the context of such a transaction itself also carries risk. Therefore, a risk dimension independent of behavioral characteristics and based on traditional rules needs to be introduced; the transaction context assessment is a rule engine-based assessment operation. Among the data required for this operation, the user's transaction data refers to the metadata of the current real-time transaction, such as the real-time transaction amount, real-time transaction time, and the geographical location where the real-time transaction occurred; the historical transaction data refers to a rule base or historical pattern stored on the server side that defines what is "normal" or "abnormal," such as the user's average transaction amount, common transaction time windows, and common login locations.

[0085] In some exemplary embodiments, the step of performing transaction context assessment processing based on user transaction data and historical transaction data to obtain a transaction environment risk value includes: performing segmented scoring processing based on historical transaction rules within the historical transaction data, as well as real-time transaction amount, real-time transaction time, and real-time transaction location within the transaction data, to obtain the transaction environment risk value. In some specific embodiments, operation S600 loads the historical transaction rules, which may be predefined by experts (e.g., transactions with amounts exceeding a certain threshold are defined as high-risk) or patterns learned from historical transaction data through data mining; upon receiving real-time transaction data, each item is evaluated: for example, the real-time transaction amount is compared with the historical average amount, and segmented scoring processing is performed; the real-time transaction time is compared with the user's commonly used transaction times, and a higher score is assigned if it occurs late at night; the real-time transaction location is compared with the user's commonly used geofences, and a higher score is assigned if it is in a different location. Finally, these sub-scores are combined according to preset business logic to generate a quantified transaction environment risk value that characterizes the degree of transaction context anomalies.

[0086] Specifically, in operation S700, based on the payee data and preset risk account data, a query process is performed to obtain the risk value of the transaction counterparty. In some specific embodiments, operation S700 is the third dimension of server-side evaluation, focusing on assessing the risk of the counterparty. The payee data refers to the target account information specified in the current transaction request; the preset risk account data refers to one or more risk list sets maintained by the server-side risk control center, which are dynamically updated based on historical abnormal transaction cases, regulatory notices, or complaint information. The specific process of performing the query process involves retrieving the payee data from the risk control list set, which includes a first list covering known abnormal accounts, a second list covering suspected abnormal accounts, and a third list covering accounts without abnormalities. If the query matches the first list (e.g., a known abnormal account), an extremely high risk value is directly assigned to the transaction counterparty; if it matches the second list (e.g., a newly registered account or an account with suspicious complaints), a medium value is assigned; and if it matches the third list (e.g., a frequently used payee account or a certified enterprise account), an extremely low value is assigned.

[0087] Specifically, in operation S800, dynamic weighting is performed based on the behavioral matching degree, the transaction environment risk value, and the transaction object risk value to obtain a transaction risk value. In some specific embodiments, dynamic weighting aims to solve the "one-size-fits-all" and model rigidity problems caused by traditional static weighting. Conventional static weighting cannot adapt to complex transaction scenarios. For example, when the transaction amount is extremely high, more attention should be paid to the transaction rules themselves, while when the behavioral matching degree is extremely low, more trust should be placed on the judgment of the behavioral dimension. To achieve this "intelligent" trust allocation, the dynamic weighting calculates the weight of each of the three risk dimensions in real time and non-linearly based on the real-time input values ​​of the three risk dimensions. The technical effect of this step is that it enables the entire evaluation process to have context awareness and adaptability, and can dynamically adjust the focus of the decision based on the most significant risk signal, thereby significantly reducing the false positive rate for normal users while maintaining a high recognition rate.

[0088] like Figure 9 As shown, in some exemplary embodiments, the step of performing dynamic weighting processing to obtain a transaction risk value based on the behavior matching degree, the transaction environment risk value, and the transaction object risk value includes: operations S810 to S840.

[0089] Specifically, in operation S810, based on the behavioral matching degree, an inverse weight allocation process is performed to determine a first risk weight, wherein the value of the behavioral matching degree is negatively correlated with the value of the first risk weight. In some specific embodiments, operation S810 is used to calculate the weight of the behavioral dimension. The inverse weight allocation process is a non-linear mapping process. Its core logic is that when the value of the behavioral matching degree is high, it is considered to have high trust, but its contribution to the identification of "abnormal risk" is considered to be low, so a lower first risk weight is assigned; conversely, when the value of the behavioral matching degree is very low, it is considered to be an extremely strong abnormal signal that must be given extremely high attention, so a significantly increased first risk weight is assigned to it through this process.

[0090] Specifically, in operation S820, based on the transaction amount in the transaction data, an amount-based weighting process is performed to determine a second risk weight, wherein the value of the transaction amount is positively correlated with the value of the second risk weight. In some specific embodiments, operation S820 is used to calculate the weight of the transaction rule dimension; the amount-based weighting process is a linear or piecewise linear mapping process. Its core logic is that the transaction amount is one of the most important factors to consider when assessing transaction context risk; when the transaction amount is low, a lower second risk weight is assigned; as the transaction amount increases, its potential risk also increases, therefore, through this process, for example, a linear function proportional to the amount, a linearly increasing second risk weight is assigned to the transaction rule dimension.

[0091] Specifically, in operation S830, based on the first risk weight and the second risk weight, a residual weight allocation process is performed to determine the third risk weight. In some specific embodiments, operation S830 is used to calculate the weight of the payee dimension; to ensure that the total weight of the three dimensions is normalized, the calculation logic of the residual weight allocation process is to subtract the first risk weight determined in operation S810 and the second risk weight determined in operation S820 from the total weight, and the difference obtained is determined as the third risk weight.

[0092] Specifically, in operation S840, a weighted fusion process is performed based on the first risk weight, the second risk weight, the third risk weight, the behavioral matching degree, the transaction environment risk value, and the transaction object risk value to obtain the transaction risk value. In some specific embodiments, the weighted fusion process is specifically manifested as a weighted summation operation, that is, multiplying the first risk weight determined in operation S810 by the behavioral matching degree obtained in operation S500; multiplying the second risk weight determined in operation S820 by the transaction environment risk value obtained in operation S600; multiplying the third risk weight determined in operation S830 by the transaction object risk value obtained in operation S700; and finally, adding these three products together to obtain the final sum, which is the transaction risk value. By executing operations S810 to S840, an adaptive and intelligent risk fusion calculation process is realized, and the output transaction risk value is a comprehensive and dynamic score that reflects all dimensions of risk in the current transaction.

[0093] Specifically, in operation S900, in response to the transaction risk value exceeding a preset first threshold, the user's transaction behavior is blocked. In some specific embodiments, the preset first threshold is a critical value representing high risk; when the obtained transaction risk value exceeds this threshold, it means that after comprehensive evaluation, the transaction is determined to have extremely high risk attributes; at this time, blocking processing will be automatically executed, for example, immediately stopping the execution of the transaction, and possibly simultaneously triggering account locking or sending a high-risk warning to the user.

[0094] By executing the complete process from S500 to S900, a multi-dimensional collaborative risk control system that does not rely on original biometrics was built on the server side. This system receives the behavioral matching degree assessed by the edge end and combines it with the transaction environment risk and transaction object risk assessed locally on the server side. It then uses a dynamic weighting algorithm to fuse these factors, ultimately achieving accurate and automated risk adjudication and ensuring the security of transactions.

[0095] By combining operations S100 to S400 and operations S500 to S900, the data processing method disclosed in this application solves the limitation of single-dimensional verification: by introducing behavioral matching degree, a multi-dimensional verification system is constructed; it also solves the problem of biological data leakage risk: through the collaborative architecture from edge device to server, it ensures that the original biological data does not leave the edge device, and only the evaluation results are transmitted, fundamentally solving the privacy leakage risk; it also solves the problem of single feature extraction: by fusing real-time touch screen behavior features and real-time keystroke behavior features, the accuracy of evaluation is improved, while ensuring a low level of response latency.

[0096] In some exemplary embodiments, the data processing method further includes operation S1000. In operation S1000, in response to the transaction risk value being lower than the preset first threshold and higher than the preset second threshold, secondary authentication processing is performed on the user. In some specific embodiments, operation S1000 is designed to handle medium-risk scenarios. The preset first threshold is a high-risk blocking line, while the preset second threshold is a low-risk allowing line; when the transaction risk value falls between these two thresholds, it indicates that the current transaction has some suspicious points, but has not yet reached the level requiring immediate blocking; at this time, the secondary authentication processing is triggered, for example, requiring the user to perform an additional facial recognition, fingerprint verification, or enter an SMS dynamic code. Operation S1000 provides a balanced intermediate state between immediate blocking (high security but poor experience) and direct allowing (good experience but low security), effectively intercepting medium-risk transactions while avoiding frequent blocking of the user's normal operation due to oversensitivity, thereby optimizing the user experience while ensuring security.

[0097] In this embodiment, the operations S100~S400, S500, S600, S700, S800, S900, S210, S220, S230, S240, S211, S212, S221, S222, S223, S231, S232, S233, S310, S320, S330, S810, S820, S830, S840, and S1000 described above can also be executed on the system side, and will not be repeated here.

[0098] Based on the above-described data processing method applied to edge devices, this application also provides a data processing apparatus applied to edge devices, which will be described below in conjunction with... Figure 10 The device is described in detail.

[0099] Figure 10 A schematic block diagram of a data processing apparatus applied to an edge device according to an embodiment of this application is shown.

[0100] like Figure 10 As shown, the data processing device 200 applied to the edge device in this embodiment includes a first acquisition module 210, a first processing module 220, a second processing module 230, and a first transmission module 240.

[0101] The first acquisition module 210 is configured to perform actions in response to a user's transaction behavior, acquiring the user's real-time touchscreen behavior characteristics and real-time keystroke behavior characteristics. In one embodiment, the first acquisition module 210 can be used to perform the operation S100 described above, which will not be repeated here.

[0102] The first processing module 220 is configured to perform multi-dimensional feature extraction and construction processing based on the real-time touch screen behavior features and the real-time keystroke behavior features to obtain a joint feature set to be evaluated. In some embodiments, the first processing module 220 may be used to execute the operation S200 described above, as well as operations S210, S220, S230, S240, S211, S212, S221, S222, S223, S231, S232, and S233, which will not be described in detail here.

[0103] The second processing module 230 is configured to evaluate the user's behavior matching degree based on the target evaluation model and the joint feature set to be evaluated. The target evaluation model is obtained by training an evaluation model based on a historical joint feature set, which is obtained by performing multi-dimensional feature extraction and construction processing based on historical touch screen behavior features and historical keystroke behavior features. In one embodiment, the second processing module 230 can be used to execute the previously described operation S300, as well as operations S310, S320, and S330, which will not be elaborated further here.

[0104] The first transmission module 240 is configured to send the behavior matching score to the server. In one embodiment, the first transmission module 240 can be used to perform the operation S400 described above, which will not be repeated here.

[0105] According to embodiments of this application, any multiple modules among the first acquisition module 210, first processing module 220, second processing module 230, and first conveying module 240 can be combined into one module, or any one of these modules can be split into multiple modules. Alternatively, at least some of the functions of one or more of these modules can be combined with at least some of the functions of other modules and implemented in one module.

[0106] Based on the above-described data processing method applied to the server side, this application also provides a data processing apparatus applied to the server side, which will be described below in conjunction with... Figure 11 The device is described in detail.

[0107] Figure 11 A schematic block diagram of a data processing apparatus applied to a server side according to an embodiment of this application is shown.

[0108] like Figure 11 As shown, the data processing device 200 applied to the server side in this embodiment includes a second acquisition module 250, a third processing module 260, a fourth processing module 270, a fifth processing module 280, and a sixth processing module 290.

[0109] The second acquisition module 250 is configured to respond to the user's transaction behavior by acquiring the behavior matching degree sent by the edge device. The behavior matching degree is obtained based on an evaluation of a target evaluation model and a joint feature set to be evaluated. The target evaluation model is obtained by training an evaluation model based on a historical joint feature set. The historical joint feature set is obtained by performing multi-dimensional feature extraction and construction processing based on the user's historical touchscreen biometric behavior features and historical keystroke biometric behavior features. The joint feature set to be evaluated is obtained by performing multi-dimensional feature extraction and construction processing based on the user's real-time touchscreen biometric behavior features and real-time keystroke biometric behavior features. In one embodiment, the second acquisition module 250 can be used to execute the operation S500 described above, which will not be repeated here.

[0110] The third processing module 260 is configured to perform transaction context evaluation processing based on user transaction data and historical transaction data to obtain a transaction environment risk value. In some embodiments, the third processing module 260 can be used to perform the operation S600 described above, which will not be repeated here.

[0111] The fourth processing module 270 is configured to perform a query based on the payee data and preset risk account data to obtain the risk value of the transaction object. In one embodiment, the fourth processing module 270 can be used to perform the operation S700 described above, which will not be repeated here.

[0112] The fifth processing module 280 is configured to perform dynamic weighting processing based on the behavior matching degree, the transaction environment risk value, and the transaction object risk value to obtain a transaction risk value. In one embodiment, the fifth processing module 280 can be used to execute the operation S800 described above, as well as operations S810, S820, S830, and S840, which will not be described again here.

[0113] The sixth processing module 290 is configured to block the user's transaction behavior in response to the transaction risk value exceeding a preset first threshold. In one embodiment, the sixth processing module 290 can be used to execute the operation S900 described above, which will not be repeated here.

[0114] According to embodiments of this application, any and multiple modules among the second acquisition module 250, the third processing module 260, the fourth processing module 270, the fifth processing module 280, and the sixth processing module 290 can be combined into one module, or any one of these modules can be split into multiple modules. Alternatively, at least some of the functions of one or more of these modules can be combined with at least some of the functions of other modules and implemented in one module.

[0115] According to embodiments of this application, at least one of the first acquisition module 210, first processing module 220, second processing module 230, first conveying module 240, second acquisition module 250, third processing module 260, fourth processing module 270, fifth processing module 280, and sixth processing module 290 can be at least partially implemented as hardware circuits, such as field-programmable gate arrays (FPGAs), programmable logic arrays (PLAs), systems-on-a-chip, systems-on-a-substrate, systems-on-package, application-specific integrated circuits (ASICs), or any other reasonable means of integrating or packaging circuits, or implemented in software, hardware, or firmware, or in any appropriate combination of any of these three implementation methods. Alternatively, at least one of the first acquisition module 210, first processing module 220, second processing module 230, first conveying module 240, second acquisition module 250, third processing module 260, fourth processing module 270, fifth processing module 280, and sixth processing module 290 can be at least partially implemented as computer program modules, which can perform corresponding functions when the computer program module is run.

[0116] Figure 12 A block diagram schematically illustrates an electronic device suitable for implementing a data processing method according to an embodiment of this application.

[0117] like Figure 12 As shown, an electronic device 900 according to an embodiment of this application includes a processor 901, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 902 or a program loaded from a storage portion 908 into a random access memory (RAM) 903. The processor 901 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or an associated chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 901 may also include onboard memory for caching purposes. The processor 901 may include a single processing module or multiple processing modules for performing different actions of the method flow according to an embodiment of this application.

[0118] RAM 903 stores various programs and data required for the operation of electronic device 900. Processor 901, ROM 902, and RAM 903 are interconnected via bus 904. Processor 901 executes various operations of the method flow according to embodiments of this application by executing programs in ROM 902 and / or RAM 903. It should be noted that programs may also be stored in one or more memories other than ROM 902 and RAM 903. Processor 901 may also execute various operations of the method flow according to embodiments of this application by executing programs stored in one or more memories.

[0119] According to embodiments of this application, the electronic device 900 may further include an input / output (I / O) interface 905, which is also connected to a bus 904. The electronic device 900 may also include one or more of the following components connected to the input / output (I / O) interface 905: an input section 906 including a keyboard, mouse, etc.; an output section 907 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 908 including a hard disk, etc.; and a communication section 909 including a network interface card such as a LAN card, modem, etc. The communication section 909 performs communication processing via a network such as the Internet. A drive 910 is also connected to the input / output (I / O) interface 905 as needed. A removable medium 911, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 910 as needed so that computer programs read from it can be installed into the storage section 908 as needed.

[0120] This application also provides a computer-readable storage medium, which may be included in the apparatus described in the above embodiments; or it may exist independently and not assembled into the apparatus. The computer-readable storage medium carries one or more programs, which, when executed, implement the method according to the embodiments of this application.

[0121] According to embodiments of this application, the computer-readable storage medium can be a non-volatile computer-readable storage medium, such as including but not limited to: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this application, the computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to embodiments of this application, the computer-readable storage medium may include ROM 902 and / or RAM 903 and / or one or more memories other than ROM 902 and RAM 903 described above.

[0122] Embodiments of this application also include a computer program product comprising a computer program containing program code for performing the methods shown in the flowchart. When the computer program product is run on a computer system, the program code is used to enable the computer system to implement the data processing methods provided in the embodiments of this application.

[0123] When the computer program is executed by the processor 901, it performs the functions defined in the apparatus of the embodiments of this application. According to the embodiments of this application, the apparatus and the like described above can be implemented by computer program modules.

[0124] In one embodiment, the computer program may rely on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may also be transmitted and distributed in the form of signals over a network medium, and downloaded and installed via the communication section 909, and / or installed from a removable medium 911. The program code contained in the computer program can be transmitted using any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination thereof.

[0125] In such an embodiment, the computer program can be downloaded and installed from a network via the communication section 909, and / or installed from the removable medium 911. When the computer program is executed by the processor 901, it performs the functions defined in the system of the embodiments of this application. According to embodiments of this application, the apparatuses described above can be implemented by computer program modules.

[0126] According to embodiments of this application, program code for executing the computer programs provided in the embodiments of this application can be written in any combination of one or more programming languages. Specifically, these computational programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, Python, "C", or similar programming languages. The program code can be executed entirely on the user's computing device, partially on the user's device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0127] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of methods and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0128] Those skilled in the art will understand that the features described in the various embodiments of this application can be combined and / or combined in various ways, even if such combinations or combinations are not explicitly described in this application. In particular, the features described in the various embodiments of this application can be combined and / or combined in various ways without departing from the spirit and teachings of this application. All such combinations and / or combinations fall within the scope of this application.

[0129] The embodiments of this application have been described above. However, these embodiments are merely illustrative and not intended to limit the scope of this application. Although various embodiments have been described above, this does not mean that the measures in the various embodiments cannot be used advantageously in combination. Without departing from the scope of this application, those skilled in the art can make various substitutions and modifications, all of which should fall within the scope of this application.

Claims

1. A data processing method applied to an edge device, characterized in that, The method includes: In response to user transaction behavior, acquire real-time touch screen behavior characteristics and real-time keystroke behavior characteristics of users; Based on the real-time touch screen behavior features and the real-time keystroke behavior features, multi-dimensional feature extraction and construction processes are performed to obtain a joint feature set to be evaluated. The user's behavior matching degree is evaluated based on the target evaluation model and the joint feature set to be evaluated. The target evaluation model is obtained by training the evaluation model based on the historical joint feature set, which is obtained by performing multi-dimensional feature extraction and construction processing based on historical touch screen behavior features and historical keystroke behavior features. The behavior matching score is sent to the server.

2. The method according to claim 1, characterized in that, Based on the real-time touchscreen biological behavior features and real-time keystroke biological behavior features, multi-dimensional feature extraction and construction processing is performed to obtain a joint feature set to be evaluated, including: Standardization processing is performed on the real-time keystroke behavior features and the real-time touch screen behavior features respectively to obtain the first standard feature data corresponding to the real-time keystroke behavior and the second standard feature data corresponding to the real-time touch screen behavior. Based on the first standard feature data, perform extraction processing based on time and pressure features to obtain the first feature set; Based on the second standard feature data, an extraction process based on velocity and curvature features is performed to obtain the second feature set; Based on the first feature set and the second feature set, a splicing process is performed to obtain the joint feature set to be evaluated.

3. The method according to claim 2, characterized in that, The standardization process is performed on the real-time keystroke behavior features and the real-time touchscreen behavior features respectively to obtain first standard feature data corresponding to real-time keystroke behavior and second standard feature data corresponding to real-time touchscreen behavior, including: Based on the real-time keystroke behavior characteristics, timestamp alignment and pressure value normalization are performed to obtain the first standard feature data; Based on the real-time touch screen behavior characteristics, coordinate normalization and time series alignment are performed to obtain the second standard feature data.

4. The method according to claim 2, characterized in that, The step of performing time and pressure feature extraction processing based on the first standard feature data to obtain the first feature set includes: Based on the first standard feature data and the corresponding timestamp sequence, the time interval statistics of adjacent operations are calculated and processed to obtain the time interval statistics; Based on the first standard feature data and the corresponding pressure value sequence, pressure fluctuation statistics are calculated to obtain pressure fluctuation statistics. The first feature set is constructed based on the time interval statistics and the pressure fluctuation statistics.

5. The method according to claim 2, characterized in that, The step involves performing extraction processing based on velocity and curvature features according to the second standard feature data to obtain a second feature set, including: Based on the coordinate sequence within the second standard feature data, perform sliding speed statistical processing to obtain sliding speed statistics; Based on the coordinate sequence within the second standard feature data, trajectory curvature calculation is performed to obtain trajectory curvature statistics. The second feature set is constructed based on the sliding speed statistics and the trajectory curvature statistics.

6. The method according to claim 1, characterized in that, The step of training the evaluation model based on the historical joint feature set to obtain the target evaluation model includes: Obtain the user's historical touch screen behavior characteristics and historical keystroke behavior characteristics; Based on the historical touch screen behavior features and the historical keystroke behavior features, multi-dimensional feature extraction and construction processes are performed to obtain a historical joint feature set; The evaluation model is trained using the historical joint feature set to obtain the target evaluation model. The evaluation model includes a hidden layer for capturing temporal behavioral features. The hidden layer includes a bidirectional temporal processing layer and an attention weighting layer. The attention weighting layer is used to weight key time steps in the temporal behavioral features.

7. A data processing method applied to a server, characterized in that, The method includes: In response to a user's transaction behavior, the behavior matching degree sent by the edge device is obtained. The behavior matching degree is obtained based on the evaluation of the target evaluation model and the joint feature set to be evaluated. The target evaluation model is obtained after training the evaluation model based on the historical joint feature set. The historical joint feature set is obtained after performing multi-dimensional feature extraction and construction processing based on the user's historical touch screen biometric behavior characteristics and historical keystroke biometric behavior characteristics. The joint feature set to be evaluated is obtained after performing multi-dimensional feature extraction and construction processing based on the user's real-time touch screen biometric behavior characteristics and real-time keystroke biometric characteristics. Based on the user's transaction data and historical transaction data, a transaction context assessment is performed to obtain the transaction environment risk value; Based on the payee data and the preset risk account data, a query process is performed to obtain the risk value of the transaction object; Based on the behavioral matching degree, the transaction environment risk value, and the transaction object risk value, dynamic weighting is performed to obtain the transaction risk value; In response to the transaction risk value exceeding a preset first threshold, the user's transaction behavior is blocked.

8. The method according to claim 7, characterized in that, The process of performing transaction context assessment based on user transaction data and historical transaction data to obtain a transaction environment risk value includes: performing segmented scoring based on historical transaction rules within the historical transaction data, as well as real-time transaction amount, real-time transaction time, and real-time transaction location within the transaction data, to obtain the transaction environment risk value.

9. The method according to claim 7, characterized in that, The step of performing dynamic weighting processing based on the behavior matching degree, the transaction environment risk value, and the transaction object risk value to obtain the transaction risk value includes: Based on the behavior matching degree, an inverse weight allocation process is performed to determine the first risk weight, wherein the value of the behavior matching degree is negatively correlated with the value of the first risk weight; Based on the transaction amount in the transaction data, a weighted average of the transaction amount is applied to determine a second risk weight, wherein the value of the transaction amount is positively correlated with the value of the second risk weight. Based on the first risk weight and the second risk weight, perform the remaining weight allocation process to determine the third risk weight; Based on the first risk weight, the second risk weight, the third risk weight, the behavior matching degree, the transaction environment risk value, and the transaction object risk value, a weighted fusion process is performed to obtain the transaction risk value.

10. The method according to claim 7, characterized in that, The method further includes: In response to the transaction risk value being lower than the preset first threshold and higher than the preset second threshold, a secondary authentication process is performed on the user.

11. A data processing apparatus, applied to an edge device, characterized in that, The device includes: The first acquisition module is configured to execute responses to user transaction behavior and acquire real-time touch screen behavior characteristics and real-time keystroke behavior characteristics of the user. The first processing module is configured to perform multi-dimensional feature extraction and construction processing based on the real-time touch screen behavior features and the real-time keystroke behavior features to obtain a joint feature set to be evaluated. The second processing module is configured to evaluate the user's behavior matching degree based on the target evaluation model and the joint feature set to be evaluated. The target evaluation model is obtained by training the evaluation model based on the historical joint feature set, which is obtained by performing multi-dimensional feature extraction and construction processing based on historical touch screen behavior features and historical keystroke behavior features. The first delivery module is configured to send the behavior matching degree to the server.

12. A data processing apparatus, applied to a server, characterized in that, The device includes: The second acquisition module is configured to respond to the user's transaction behavior and acquire the behavior matching degree sent by the edge device. The behavior matching degree is obtained based on the evaluation of the target evaluation model and the joint feature set to be evaluated. The target evaluation model is obtained after training the evaluation model based on the historical joint feature set. The historical joint feature set is obtained after performing multi-dimensional feature extraction and construction processing based on the user's historical touch screen biometric behavior characteristics and historical keystroke biometric behavior characteristics. The joint feature set to be evaluated is obtained after performing multi-dimensional feature extraction and construction processing based on the user's real-time touch screen biometric behavior characteristics and real-time keystroke biometric characteristics. The third processing module is configured to perform transaction context evaluation based on user transaction data and historical transaction data to obtain a transaction environment risk value. The fourth processing module is configured to perform a query based on the payee data and preset risk account data to obtain the risk value of the transaction object; The fifth processing module is configured to perform dynamic weighting based on the behavior matching degree, the transaction environment risk value, and the transaction object risk value to obtain a transaction risk value; The sixth processing module is configured to block the user's transaction behavior in response to the transaction risk value exceeding a preset first threshold.

13. An electronic device, comprising: One or more processors; Memory, used to store one or more computer programs. The characteristic feature is that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 10.

14. A computer-readable storage medium having a computer program or instructions stored thereon, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 10.

15. A computer program product, comprising a computer program or instructions, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 10.

Images