Request data number refreshing prevention risk control method based on medical scene

Abstract

The invention discloses a request data number swiping prevention risk control method based on a medical scene. The method comprises the steps that a user request sequence, equipment fingerprints, identity credentials and interaction behavior data are collected to construct a feature data set; constructing a depth behavior encoder model, and obtaining depth feature representation through multi-scale feature fusion and an attention mechanism; using a dynamic behavior clustering algorithm to identify a user behavior mode and track an evolution process; constructing an adversarial sample to enhance the robustness of the model; evaluating the number brushing behavior based on the reconstruction error, the depth feature representation and the behavior mode evolution trend; and outputting a detection result and executing risk early warning, access control and behavior traceability processing. Through deep feature learning and dynamic mode analysis, individual and group number brushing behaviors in a medical service platform can be effectively identified, the accuracy and adaptability of number brushing prevention detection are improved, and the fairness and safety of medical services are guaranteed.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of anti-brushing number risk control, in particular to a request data anti-brushing number risk control method based on a medical scenario. BACKGROUND

[0002] In recent years, with the acceleration of online and intelligent process of medical services, various medical service platforms (such as online registration, diagnosis, medicine reservation, etc.) have become an important channel for the public to obtain medical services. However, under the background of the relative scarcity of high-quality medical resources, some users or groups use technical means such as automated scripts, virtual identities, and high-frequency requests to maliciously occupy number sources, medicine reservation qualifications or service permissions, forming a "brushing number" behavior. Such behavior not only seriously disrupts the normal service order of the platform, infringes the fair rights and interests of other legitimate users, but also may cause the system resources to be maliciously exhausted, causing service response delay or even paralysis, posing a significant threat to the availability and security of medical services.

[0003] At present, the detection and prevention of brushing number behavior mainly rely on rule-based filtering mechanisms or traditional machine learning methods. For example, by setting fixed thresholds to limit user request frequency, IP address or device information, or using clustering and classification algorithms to identify abnormal behavior patterns. However, such methods have the following limitations: first, the rule system is difficult to adapt to the continuous evolution and concealment of brushing number means, and is easy to be bypassed; second, traditional feature engineering has limited representation ability for complex behavior sequences and multi-dimensional association relationships; third, most methods lack effective identification mechanisms for group and collaborative brushing number behavior; fourth, the model lacks robustness when facing adversarial attacks, resulting in a decline in detection effectiveness.

[0004] In addition, existing technologies focus more on static or offline anomaly detection, making it difficult to achieve dynamic tracking and real-time response to the evolution process of brushing number behavior. In particular, in the medical scenario, user behavior has strong time regularity and context dependence, and traditional methods often cannot effectively capture the timing features and deep associations in behavior patterns, limiting their applicability and accuracy in complex real-world environments.

[0005] In summary, the existing technical methods have not been able to deeply integrate multi-dimensional behavior features of users, have not been able to possess dynamic evolution rules, and have not been able to possess anti-interference ability for anti-brushing number risk control, thus the security protection level and service fairness of medical service platforms need to be improved. SUMMARY

[0006] The purpose of the present application is to provide a request data anti-brushing number risk control method based on a medical scenario, to solve the above-mentioned problems existing in the prior art.

[0007] The present application is as follows: Methods for preventing account fraud in medical request data include: S1. Collect user request sequences, device fingerprints, identity credentials and interaction behavior data from the medical service platform, construct a user behavior feature dataset, preprocess the user behavior feature dataset to obtain a standardized behavior feature dataset; S2. Based on the standardized behavioral feature dataset, a deep behavioral encoder model is constructed. The user behavioral features are encoded through a multi-layer neural network to obtain a deep feature representation of the behavior and output the reconstruction error of the behavioral features. S3. Based on deep feature representation, a dynamic behavior clustering algorithm is used to identify and classify user behavior patterns and dynamically track the evolution of abnormal behavior patterns. S4. Based on the standardized behavioral feature dataset and deep feature representation, construct adversarial examples, and input the standardized behavioral feature dataset and adversarial examples into the deep behavioral encoder model and dynamic behavioral clustering algorithm for training. S5. During the training process, based on the behavioral characteristics, reconstruction error, deep feature representation, behavioral pattern classification, and abnormal pattern evolution trend, the account-swiping behavior of individual users and user groups is evaluated and labeled to obtain account-swiping behavior detection results. S6. Output the results of account-swapping detection. For individual users and user groups identified as account-swapping users, execute the risk warning, access control, and behavior tracing process in sequence, and dynamically update the deep behavior encoder model parameters based on real-time feedback.

[0008] Furthermore, the preprocessing of the user behavior feature dataset specifically includes data cleaning, outlier removal, and feature normalization.

[0009] Furthermore, S2 specifically includes: S21. Based on the standardized behavioral feature dataset, construct a user behavior feature matrix X = [x1, x2, ..., x...]. n ] T ∈R (n×d) Where n is the number of users and d is the feature dimension, which includes request frequency feature, device fingerprint feature, time distribution feature, and behavior sequence feature; S22. In the encoder structure, design a multi-scale feature fusion mechanism, specifically including: Perform a multi-scale transformation on the input user behavior feature matrix X to obtain k feature representations {X} at different scales. 1 ,X 2 ,...,X k}; For each scale feature X k Perform linear transformations respectively: H k = Xk *W k + b k W k ∈R (n×d) For the learnable weight matrix, b k For bias terms; The weight coefficients α of features at each scale are calculated using an attention mechanism. k = softmax(q T tanh(W a *H k ), where W a ∈R (n×d) For the learnable weight matrix, q T This represents the transpose of the learnable attention query vector; Weighted fusion of multi-scale features: H = ; S23. In the L neural network layers of the encoder, each layer has a residual connection mechanism. The output of the f-th layer is calculated as follows: H (f) = σ(W (f) H (f-1) + b (f) ) + H (f-1) Where σ is the activation function, W (f) and b (f) These are the weights and biases of the f-th layer, respectively; S24. Represent the depth features Z = H of the encoder's final output. (L) As a low-dimensional feature representation of user behavior, where Z∈R (n×m) , m < d; S25. In the decoder part, the deep feature representation Z is reconstructed through a fully connected network: X̂ = σ(W d *Z + b d ) Among them W d ∈R (m×d) Let b be the decoder weight matrix. d For bias terms; S26. Calculate the reconstruction error between the original features and the reconstructed features, and define the loss function as follows: L = L recon + λ1L sparse + λ2L smooth Where L recon L represents the reconstruction loss. sparse L is the characteristic sparsity regularization term. smoothλ1, λ2 are super parameters for feature space smoothness regular term; S27, based on the loss function L, using gradient descent algorithm to update all the learnable parameters iteratively, the update formula is: θ ← θ - η▽θL Where θ represents the model parameter set, η is the learning rate, and △θL represents the gradient of the loss function L with respect to the parameter θ. Iterative training until the loss function converges, complete the deep behavior encoder model training, and output the behavior feature reconstruction error and deep feature representation.

[0010] Further, the S3 specifically includes: S31, based on the deep feature representation Z, all user behaviors are preliminarily patterned, and an initial behavior pattern label set C is obtained t ; S32, the obtained behavior pattern label C t At the current time t is paired with the behavior pattern label C t-1 At the previous time t-1, the behavior feature similarity, the time distribution similarity and the sequence pattern similarity are comprehensively considered, and the weighted comprehensive formula is used to calculate the behavior pattern stability score S c,t ; S33, according to the obtained behavior pattern stability score S c,t , set the stability score threshold, judge whether each behavior pattern is a stable pattern or a fluctuation pattern, and record the pattern state; S34, according to the judgment result, an adaptive adjustment mechanism is used to dynamically adjust the scale threshold of each pattern, and different types of patterns correspond to different adjustment strategies; S35, according to the determined pattern scale threshold, the current behavior pattern is adjusted, and the patterns whose scales are less than the pattern scale threshold are merged or discarded, and the adjusted behavior pattern division result is output; S36, for each behavior pattern, a time sequence memory unit is established, and the pattern label and scale change sequence H c In the last n time is recorded in sequence, and the adjusted pattern division result is taken as the latest history sequence; S37, based on the time sequence memory unit, the short-term fluctuation of the behavior pattern label and the scale is smoothed, and if it is observed that the behavior pattern features, structure or scale change continuously and significantly within the time sequence window, it is determined that the pattern splitting, merging or new pattern generation evolution event occurs, and the evolution event list is output.

[0011] Further, the S4 specifically includes: S41, based on the obtained standardized behavior feature data set and the obtained deep feature representation Z, using the method of disturbance injection, generating an adversarial disturbance matrix for behavior features, time features and sequence features; S42, add the original behavior features to the perturbation matrix to obtain the adversarial behavior features; S43, construct an adversarial sample behavior feature dataset; S44, jointly input the original standardized behavior feature dataset and the adversarial sample behavior feature dataset into the deep behavior encoder model for training to obtain an adversarial enhanced deep feature representation and a behavior feature reconstruction error; S45, based on the adversarial enhanced feature representation, synchronously input a dynamic behavior clustering algorithm to dynamically update user behavior pattern division and evolution information; S46, in the joint training process, calculate the reconstruction error of the original sample and the adversarial sample in behavior feature reconstruction, time feature reconstruction and sequence feature reconstruction respectively, and determine the overall joint training loss according to the weighted result of the original sample reconstruction error and the adversarial sample reconstruction error; S47, in the training process, constantly update all learnable parameters in the deep behavior encoder model and the dynamic behavior clustering algorithm according to the joint training loss; S48, output the deep feature representation trained by the adversarial sample enhancement, the behavior feature reconstruction error, and the behavior pattern division and pattern evolution information.

[0012] Further, the S5 specifically comprises: S51, based on the output deep feature representation, behavior feature reconstruction error, and output behavior pattern division and pattern evolution information, aggregate data for all user individuals and user groups to construct individual and group feature sets; S52, for each user individual, calculate the behavior feature reconstruction error, the time feature reconstruction error and the sequence feature reconstruction error to respectively reflect the reconstruction deviation of the user in the behavior feature, the time distribution and the sequence pattern; S53, for each user group, respectively count the average feature reconstruction error of all users in the group, calculate the size change ratio between two consecutive time points of the group, and count the change ratio of the user behavior pattern label in the adjacent time points to reflect the overall behavior change and member stability of the group; S54, according to the individual reconstruction error, the group average reconstruction error, the group size change rate and the behavior pattern evolution rate, set a multi-threshold discrimination criterion, and set an individual brush number discrimination threshold and a group brush number discrimination threshold respectively; S55, for the user individual whose reconstruction error or behavior change index exceeds the threshold, mark it as a brush number suspect individual; for the user group whose average reconstruction error, size change rate or pattern evolution rate exceeds the threshold, mark it as a brush number suspect group; S56, output the identification of all user individuals and user groups marked as suspected of brush number and the corresponding abnormal index value, and form a brush number behavior detection result.

[0013] Further, the S6 specifically comprises: S61, receiving and arranging the generated brush number behavior detection result, determining the specific list of user individuals and user groups judged as suspected of brush number and the abnormal reasons; S62, issuing a brush number risk warning information to the background security management personnel or monitoring platform for the user individuals and user groups judged as suspected of brush number, reminding the relevant personnel to pay attention to and handle the brush number risk event in time; S63, according to the severity of the brush number behavior, taking access control measures on the user individuals and user groups judged as suspected of brush number, specifically including service flow control, account verification, function limitation, association interception; S64, for all user individuals and user groups that have taken control measures, carrying out behavior tracing operation, analyzing recent service request characteristics, interaction mode, historical behavior records and association relationship, locating suspicious brush number chain and potential brush number group; S65, arranging the feedback information obtained in the risk warning, access control and behavior tracing disposal process with the actual effect, dynamically adjusting and updating the parameters of the deep behavior encoder model according to the feedback information in the disposal process, and optimizing the detection ability for new brush number behavior.

[0014] Further, the user behavior feature matrix comprises request frequency, device fingerprint, IP address, request time distribution, identity verification times and historical behavior score.

[0015] Further, the behavior mode stability score S c,t is calculated according to the following formula: S c,t =β1·F c +β2·T c +β3·S c Wherein F c represents behavior feature similarity, T c represents time distribution similarity, S c represents sequence mode similarity, β1, β2 and β3 are weighting coefficients and β1+β2+β3=1.

[0016] Further, the setting of the individual brush number discrimination threshold and the group brush number discrimination threshold adopts a dynamic adjustment mechanism, according to the accuracy and false positive rate of the historical brush number detection result, the threshold is optimized and adjusted according to the preset period.

[0017] Compared with the prior art, the present application has the following beneficial effects: This invention constructs a feature dataset by collecting user request sequences, device fingerprints, identity credentials, and interaction behavior data; builds a deep behavior encoder model, obtaining deep feature representations through multi-scale feature fusion and attention mechanisms; employs a dynamic behavior clustering algorithm to identify user behavior patterns and track their evolution; constructs an adversarial example enhancement model for robustness; evaluates account-swapping behavior based on reconstruction error, deep feature representations, and behavioral pattern evolution trends; outputs detection results and performs risk warnings, access control, and behavior tracing. Through deep feature learning and dynamic pattern analysis, this invention can effectively identify individual and group account-swapping behaviors on medical service platforms, improving the accuracy and adaptability of anti-account-swapping detection and ensuring the fairness and security of medical services. Attached Figure Description

[0018] Figure 1 This is a flowchart illustrating the risk control method for preventing account fraud in medical scenarios based on request data, provided in an embodiment of the present invention. Detailed Implementation

[0019] The present invention will now be described in detail with reference to the accompanying drawings.

[0020] Example 1

[0021] This invention provides a method for preventing account fraud in medical request data, such as... Figure 1 This includes the following steps: S1. Collect user request sequences, device fingerprints, identity credentials and interaction behavior data from the medical service platform, construct a user behavior feature dataset, preprocess the user behavior feature dataset to obtain a standardized behavior feature dataset; S2. Based on the standardized behavioral feature dataset, a deep behavioral encoder model is constructed. The user behavioral features are encoded through a multi-layer neural network to obtain a deep feature representation of the behavior and output the reconstruction error of the behavioral features. S3. Based on deep feature representation, a dynamic behavior clustering algorithm is used to identify and classify user behavior patterns and dynamically track the evolution of abnormal behavior patterns. S4. Based on the standardized behavioral feature dataset and deep feature representation, construct adversarial examples, and input the standardized behavioral feature dataset and adversarial examples into the deep behavioral encoder model and dynamic behavioral clustering algorithm for training. S5. During the training process, based on the behavioral characteristics, reconstruction error, deep feature representation, behavioral pattern classification, and abnormal pattern evolution trend, the account-swiping behavior of individual users and user groups is evaluated and labeled to obtain account-swiping behavior detection results. S6, output the brush number behavior detection result, for the user individual and user group judged as brushing numbers, sequentially execute risk early warning, access control, behavior traceability processing flow, and dynamically update the deep behavior encoder model parameters according to real-time feedback.

[0022] Specifically, a feature data set is constructed by collecting user request sequences, device fingerprints, identity credentials and interaction behavior data; a deep behavior encoder model is constructed to obtain deep feature representation through multi-scale feature fusion and attention mechanism; a dynamic behavior clustering algorithm is used to identify user behavior patterns and track the evolution process; an adversarial sample enhancement model is constructed to improve robustness; brush number behavior is evaluated based on reconstruction error, deep feature representation and behavior pattern evolution trend; and detection results are output and risk early warning, access control and behavior traceability processing are performed. Through deep feature learning and dynamic pattern analysis, the present application can effectively identify individual and group brush number behavior in a medical service platform, improve the accuracy and adaptability of brush number detection, and ensure the fairness and safety of medical services.

[0023] It should be noted that first, the user registration request sequence, device MAC address, identity verification information and page click stream data are collected through the medical service platform API interface to construct a user behavior feature data set containing 100,000 records. After data preprocessing using the Pandas library of Python, a deep behavior encoder containing 5 layers of fully connected network is constructed based on the TensorFlow framework to output 256-dimensional deep feature representation. An improved dynamic clustering algorithm based on K-means is used to identify 3 types of abnormal behavior patterns, and a sliding window mechanism is used to track the pattern evolution. Adversarial samples are generated by the FGSM method to train the model, and finally the brush number behavior is determined based on the reconstruction error threshold. The confirmed brush number users are given a short message warning and access frequency limit.

[0024] In the above embodiment, specifically, the preprocessing of the user behavior feature data set specifically includes data cleaning, outlier rejection and feature normalization processing.

[0025] It should be noted that the 3σ rule is used to reject outliers with a request interval time of less than 100ms, the MinMaxScaler is used to normalize the request frequency feature to the [0, 1] interval, the One-Hot encoding is used for the device fingerprint feature, the timestamp feature is converted to 24-hour sine cosine encoding, and the Z-score standardization is used to process the identity verification frequency feature.

[0026] In the above embodiment, specifically, S2 specifically includes: S21, based on the standardized behavior feature data set, a user behavior feature matrix X=[x1,x2,...,x n ] T ∈R(n×d) Where n is the number of users and d is the feature dimension, which includes request frequency feature, device fingerprint feature, time distribution feature, and behavior sequence feature; S22. In the encoder structure, design a multi-scale feature fusion mechanism, specifically including: Perform a multi-scale transformation on the input user behavior feature matrix X to obtain k feature representations {X} at different scales. 1 ,X 2 ,...,X k}; For each scale feature X k Perform linear transformations respectively: H k = X k *W k + b k W k ∈R (n×d) b is a learnable weight matrix k For bias terms; The weight coefficients α of features at each scale are calculated using an attention mechanism. k = softmax(q T tanh(W a *H k ), where W a ∈R (n×d) For the learnable weight matrix, q T This represents the transpose of the learnable attention query vector; Weighted fusion of multi-scale features: H = ; S23. In the L neural network layers of the encoder, each layer has a residual connection mechanism. The output of the f-th layer is calculated as follows: H (f) = σ(W (f) H (f-1) + b (f) ) + H (f-1) Where σ is the activation function, W (f) and b (f) These are the weights and biases of the f-th layer, respectively; S24. Represent the depth features Z = H of the encoder's final output. (L) As a low-dimensional feature representation of user behavior, where Z∈R (n×m) , m < d; S25. In the decoder part, the deep feature representation Z is reconstructed through a fully connected network: X̂ = σ(W d *Z + b d ) Among them Wd ∈R (m×d) is the decoder weight matrix, b d is the bias term; S26, calculate the reconstruction error between the original feature and the reconstructed feature, define the loss function as: L = L recon + λ1L sparse + λ2L smooth wherein L recon represents the reconstruction loss, L sparse is the feature sparsity regularization term, L smooth is the feature space smoothness regularization term, λ1, λ2 are hyperparameters; S27, based on the loss function L, use gradient descent algorithm to iteratively update all learnable parameters, the update formula is: θ ← θ - η▽θL wherein θ represents the model parameter set, η is the learning rate,▽θL represents the gradient of the loss function L with respect to the parameter θ, iteratively train until the loss function converges, complete the deep behavior encoder model training, and output the behavior feature reconstruction error and the deep feature representation.

[0027] It should be noted that a 10000x50 dimensional feature matrix is constructed, which contains request frequency, device type, IP region, operation time, behavior sequence and other features. Three scale transformations are set: original scale, 2 times down-sampling scale and 4 times down-sampling scale. In the attention mechanism, Wa is set as a 50x30 dimensional weight matrix, and the query vector q has a dimension of 30. The encoder uses a 5-layer network, each layer uses a ReLU activation function, and finally outputs a 10000x256 dimensional deep feature Z. The decoder uses a Sigmoid activation function, the hyperparameters are set as λ1=0.01, λ2=0.05, the learning rate η=0.001, and the training is iterated for 500 rounds.

[0028] In the above embodiment, specifically, the S3 specifically comprises: S31, based on the deep feature representation Z, preliminarily mode-dividing all user behaviors to obtain an initial behavior mode label set C t ; S32, multi-feature pairing is performed on the obtained behavior mode label C t of the current time t and the behavior mode label C t-1 of the previous time t-1, and the behavior feature similarity, the time distribution similarity and the sequence mode similarity are comprehensively considered to calculate a behavior mode stability score S c,t ; It should be noted that the behavior mode stability score S c,tBy weightedly fusing the behavior feature similarity, the time distribution similarity and the sequence pattern similarity, the behavior pattern is multi-dimensionally quantified in the feature consistency and the evolution stability at different time, the persistence and the change trend of the user behavior pattern are accurately described, and the dynamic changes such as the pattern splitting, the pattern merging and the like caused by the brush number behavior, the collaborative cheating or the abnormal operation are sensitively identified. The behavior feature similarity measures whether the behavior features of the users in the pattern remain consistent, the time distribution similarity reflects the regularity of the user active period and the request rhythm, and the sequence pattern similarity captures the change of the user operation process and the interaction path. By flexibly setting the weights of the indicators, the system can automatically adjust the detection focus according to the brush number prevention demand of the actual medical scene, and the behavior pattern stability score S c,t The scientificity and the precision of the evolution detection of the behavior pattern are improved, and a quantitative basis is provided for the abnormal brush number behavior identification and the subsequent risk control.

[0029] S33, according to the obtained behavior pattern stability score S c,t , a stability score threshold is set, each behavior pattern is determined as a stable pattern or a fluctuant pattern, and the pattern state is recorded; S34, according to the determination result, an adaptive adjustment mechanism is adopted to dynamically adjust each pattern size threshold, different types of patterns correspond to different adjustment strategies; It should be noted that for the stable pattern: q = q0 × exp(γ1 × S c,t ), for the fluctuant pattern: q = q0 × [1 + γ2 × (1 - S c,t ) δ ], wherein q represents the size threshold, q0 is a basic threshold, γ1, γ2 and δ are adjustment coefficients; The introduction of the pattern size threshold θsize,t enables the system to dynamically and flexibly set the standard of retaining or merging the pattern according to the behavior pattern stability score. For the behavior pattern with stable features, the threshold adjustment adopts a smooth exponential function, prevents the pattern misjudgment and the invalid splitting caused by the fluctuation of the normal user behavior, and guarantees the good experience of the real user group. For the abnormal pattern with greater feature fluctuation, a more strict nonlinear growth strategy is adopted, effectively inhibits the arbitrary expansion and the noise influence of the abnormal behavior pattern such as the brush number group and the machine account. Through the adaptive adjustment mechanism, the platform can sensitively capture and contain the generation and the spread of the abnormal brush number behavior while protecting the natural evolution of the normal user behavior pattern. The pattern size threshold θsize,t strategy enhances the adaptability and the robustness of the behavior pattern division and the evolution process, and provides an efficient and scientific decision basis for the brush number risk detection and the safety control in the medical scene.

[0030] S35, according to the determined mode size threshold, adjusting the current behavior mode, merging or discarding the mode whose size is less than the mode size threshold, and outputting the adjusted behavior mode division result; S36, for each behavior mode, establishing a time sequence memory unit to continuously record the mode label and size change sequence H of the last n time points c , and taking the adjusted mode division result as the latest history sequence; S37, based on the time sequence memory unit, smoothing the short-term fluctuations of the behavior mode label and size, and if it is observed that the behavior mode characteristics, structure or size continuously and significantly change within the time sequence window, it is determined that a mode splitting, merging or new mode generation evolution event occurs, and an evolution event list is output.

[0031] It should be noted that the behavior feature similarity calculation: based on the deep feature representation Z, the cosine similarity is used to calculate the feature vector similarity of the same mode in different time slices, and the consistency of the features such as registration frequency, device diversity and request parameter distribution is focused on; the time distribution similarity calculation: the time regularity of user request is analyzed, the DTW algorithm is used to align the activity mode of different time slices, the similarity of 24-hour active distribution is calculated, and the abnormal time aggregation phenomenon is identified; the sequence mode similarity calculation: based on the n-gram model of user operation sequence, the Jaccard similarity is used to measure the consistency of the behavior sequence, and the fixed operation mode generated by the brushing tool is detected; the threshold parameter setting: the basic threshold q0 is set to 20 according to the historical data, the adjustment coefficients γ1=0.1, γ2=0.3, δ=2, which ensures sensitive detection of brushing groups while reducing false positives; time sequence memory management: setting n=24 time slices (corresponding to 24 hours), establishing a ring buffer to store mode evolution history, and providing sufficient time span support for real-time detection; this method effectively distinguishes between normal medical behavior and malicious brushing behavior through multi-dimensional stability analysis and adaptive threshold adjustment, and provides technical support for fair allocation of medical resources.

[0032] In the above embodiment, specifically, the S4 specifically comprises: S41, based on the obtained standardized behavior feature data set and the obtained deep feature representation Z, using a perturbation injection method, generating an adversarial perturbation matrix for behavior features, time features and sequence features; S42, adding the original behavior features and the perturbation matrix to obtain the adversarial behavior features; S43, constructing an adversarial sample behavior feature data set; S44, inputting the original standardized behavior feature data set and the adversarial sample behavior feature data set into the deep behavior encoder model together for training, obtaining the adversarial enhanced deep feature representation and the behavior feature reconstruction error; S45, synchronizing the input dynamic behavior clustering algorithm based on the adversarial enhanced feature representation, dynamically updating the user behavior pattern division and evolution information; S46, in the joint training process, respectively calculating the reconstruction error of the original sample and the adversarial sample in the behavior feature reconstruction, the time feature reconstruction and the sequence feature reconstruction, and determining the overall joint training loss according to the weighted result of the original sample reconstruction error and the adversarial sample reconstruction error; S47, in the training process, constantly updating all learnable parameters in the deep behavior encoder model and the dynamic behavior clustering algorithm according to the joint training loss; S48, outputting the deep feature representation trained by the adversarial sample, the behavior feature reconstruction error, and the behavior pattern division and pattern evolution information.

[0033] In the above embodiment, specifically, the S5 specifically comprises: S51, based on the output deep feature representation, the behavior feature reconstruction error, and the output behavior pattern division and pattern evolution information, data summary is performed on all user individuals and user groups to construct the feature set of individuals and groups; S52, for each user individual, the behavior feature reconstruction error, the time feature reconstruction error and the sequence feature reconstruction error are calculated to respectively reflect the reconstruction deviation of the user in the behavior feature, the time distribution and the sequence pattern; S53, for each user group, the average feature reconstruction error of all users in the group is respectively counted, the scale change ratio of the group between two adjacent time points is calculated, and the change ratio of the user behavior pattern label in the adjacent time points is counted to reflect the overall behavior change and member stability of the group; S54, according to the individual reconstruction error, the group average reconstruction error, the group scale change rate and the behavior pattern evolution rate, a multi-threshold discrimination criterion is set, and individual and group identification threshold values are respectively set; S55, for the user individual whose reconstruction error or behavior change index exceeds the threshold value, the user individual is marked as a suspected individual; for the user group whose average reconstruction error, scale change rate or pattern evolution rate exceeds the threshold value, the user group is marked as a suspected group; S56, outputting the identification and corresponding abnormal index value of all user individuals and user groups marked as suspected, and forming the result of the brush number behavior detection.

[0034] In the above embodiment, specifically, the S6 specifically comprises: S61, receiving and sorting the generated brush number behavior detection result, determining the specific list and abnormal reason of the user individual and user group determined as the brush number suspect; S62, for the user individual and user group determined as suspected of brushing number, send a brushing number risk warning information to the background security management personnel or monitoring platform, remind the relevant personnel to pay attention to and handle the brushing number risk event in time; S63, according to the severity of the brushing number behavior, the user individual and user group determined as suspected of brushing number are taken access control measures, including service flow limiting, account verification, function limiting, association interception; S64, for all user individuals and user groups that have taken control measures, carry out behavior tracing operation, analyze recent service request characteristics, interaction mode, historical behavior records and association relationship, locate suspicious brushing number chain and potential brushing number group; S65, the feedback information obtained in the risk warning, access control, behavior tracing disposal process is sorted out with the actual effect, according to the feedback information in the disposal process, dynamically adjust and update the parameters of the deep behavior encoder model, optimize the detection ability for new brushing number behavior.

[0035] In the above embodiment, specifically, the user behavior feature matrix includes request frequency, device fingerprint, IP address, request time distribution, identity verification times, historical behavior score.

[0036] In the above embodiment, specifically, the behavior mode stability score S c,t The calculation formula is: S c,t =β1·F c +β2·T c +β3·S c Wherein F c represents the behavior feature similarity, T c represents the time distribution similarity, S c represents the sequence mode similarity, β1, β2, β3 are weighting coefficients and β1+β2+β3=1.

[0037] In the above embodiment, specifically, the setting of the individual brushing number discrimination threshold and the group brushing number discrimination threshold adopts dynamic adjustment mechanism, according to the accuracy and false alarm rate of historical brushing number detection results, the threshold is optimized and adjusted according to the preset period.

[0038] Embodiment 2

[0039] In order to verify the actual effect of the application in the medical scene, the application is applied to a provincial medical appointment service platform. With the rapid increase in the number of platform users, the problem of number traffickers using automated scripts, virtual identities and other technical means to maliciously occupy high-quality medical resources is becoming increasingly prominent. The traditional anti-number brushing system mainly relies on rule-based frequency limits, IP bans and simple identity verification, which is difficult to cope with the constantly upgrading number brushing technology, especially in the aspects of group crime, identity forgery and behavior simulation. In actual operation, the platform frequently receives complaints from patients about "number source seconds light", "system lag", "identity fraud" and other issues, which seriously affects the medical experience of normal patients and damages the fair distribution of medical resources.

[0040] In view of the above problems, the platform deploys a request data anti-number brushing risk control method based on a medical scene in the core appointment module. The scheme is based on a deep behavior encoder model and a dynamic behavior clustering algorithm, which comprehensively models the request sequence, device fingerprint, identity certificate and interaction behavior data of the user, and constructs a multi-dimensional behavior feature dataset. Each user is regarded as an independent behavior subject, and its features include request frequency, time distribution, device characteristics, behavior sequence and other dimensions. The system standardizes the collected behavior data for preprocessing, and eliminates abnormal values and noise data. The deep behavior encoder performs deep encoding and reconstruction on the user behavior features through multi-scale feature fusion and attention mechanism, which significantly improves the identifiability of abnormal behavior.

[0041] To solve the problem that the traditional system is easy to be evaded by professional number brushing tools, the application introduces an adversarial sample training mechanism, which injects intelligent disturbance on the behavior features, time features and sequence features, so that the model has stronger generalization ability and robustness. The dynamic behavior clustering algorithm can track the evolution process of the user behavior pattern in real time, accurately identify abnormal behavior patterns such as group number brushing and machine operation through pattern stability analysis and adaptive adjustment of scale threshold. When the system detects suspicious individual or group number brushing behavior, it automatically triggers a risk warning, and can implement graded control measures such as service flow control, identity review, access interception according to the risk level. The model parameters are dynamically updated according to real-time feedback data, forming a continuously optimized security protection system.

[0042] In a three-month implementation cycle, the platform accumulatively monitored 1.25 million active users, about 56 million service request data, and the method identified 15,820 suspected individuals, 96 high-risk groups, and 42 organized professional teams. Compared with traditional anti-brushing systems, the detected brushing accounts showed obvious abnormalities in request frequency, device correlation, and behavior regularity. Statistical data showed that after deploying the invention, the number of complaints about the number source decreased by 52.3%, system abnormal access events decreased by 68.7%, and the reservation success rate of normal users increased by 18.6%. The model's detection accuracy in normal business environment reached 96.5%, and remained 91.8% in the anti-attack environment, while the traditional solution's accuracy was only 79.2%. The average response time of the system to high-risk brushing behavior was shortened from 5.2 minutes to 2.8 minutes, and the false positive rate and false negative rate were controlled within 2.1% and 2.7%, respectively.

[0043] Effect analysis: Through the actual deployment of the invention, the medical appointment platform has achieved significant improvements in the following aspects: Fairness of resource allocation: The success rate of expert number reservation for normal patients has increased from 31% before deployment to 49.6%, effectively curbing the malicious occupation behavior of number traffickers; System stability: High-concurrency requests generated by brushing scripts are effectively controlled, and the response time of the system during peak hours is shortened by 42%; User experience improvement: The patient's satisfaction score for the reservation system has increased from 3.2 (out of 5) to 4.1; Reduced operating costs: Artificial review workload reduced by 65%, and system automation processing capacity significantly improved; This embodiment fully demonstrates the effectiveness and practicality of the invention in preventing brushing in the medical field, providing a reliable technical guarantee for the fair allocation of medical resources and the safe operation of the platform.

[0044] It should be understood that the above embodiments are one or more embodiments of the invention, and there are many other embodiments and variations based on the invention; the modifications and modifications made by ordinary skilled persons in the industry without making pioneering innovations are within the protection scope of the invention.

Claims

1. A method for preventing account fraud in medical request data, characterized in that, include: S1. Collect user request sequences, device fingerprints, identity credentials and interaction behavior data from the medical service platform, construct a user behavior feature dataset, preprocess the user behavior feature dataset to obtain a standardized behavior feature dataset; S2. Based on the standardized behavioral feature dataset, a deep behavioral encoder model is constructed. The user behavioral features are encoded through a multi-layer neural network to obtain a deep feature representation of the behavior and output the reconstruction error of the behavioral features. S3. Based on deep feature representation, a dynamic behavior clustering algorithm is used to identify and classify user behavior patterns and dynamically track the evolution of abnormal behavior patterns. S4. Based on the standardized behavioral feature dataset and deep feature representation, construct adversarial examples, and input the standardized behavioral feature dataset and adversarial examples into the deep behavioral encoder model and dynamic behavioral clustering algorithm for training. S5. During the training process, based on the reconstruction error of behavioral features, the deep feature representation, the classification of behavioral patterns and the evolution trend of abnormal patterns, the account-swiping behavior of individual users and user groups is evaluated and labeled to obtain the account-swiping behavior detection results. S6. Output the results of account-swapping detection. For individual users and user groups identified as account-swapping users, execute the risk warning, access control, and behavior tracing process in sequence, and dynamically update the deep behavior encoder model parameters based on real-time feedback.

2. The method for preventing account fraud in medical scenario request data according to claim 1, characterized in that, The preprocessing of the user behavior feature dataset specifically includes data cleaning, outlier removal, and feature normalization.

3. The method for preventing account fraud in medical scenario request data according to claim 1, characterized in that, S2 specifically includes: S21. Based on the standardized behavioral feature dataset, construct a user behavior feature matrix X = [x1, x2, ..., x...]. n ] T ∈R (n×d) Where n is the number of users and d is the feature dimension, which includes request frequency feature, device fingerprint feature, time distribution feature, and behavior sequence feature; S22. In the encoder structure, design a multi-scale feature fusion mechanism, specifically including: Perform a multi-scale transformation on the input user behavior feature matrix X to obtain k feature representations {X} at different scales. 1 ,X 2 ,...,X k }; For each scale feature X k Perform linear transformations respectively: H k = X k *W k + b k W k ∈R (n×d) b is a learnable weight matrix k For bias terms; The weight coefficients α of features at each scale are calculated using an attention mechanism. k = softmax(q T tanh(W a *H k ), where W a ∈R (n×d) For the learnable weight matrix, q T This represents the transpose of the learnable attention query vector; Weighted fusion of multi-scale features: H = ; S23. In the L neural network layers of the encoder, each layer has a residual connection mechanism. The output of the f-th layer is calculated as follows: H (f) = σ(W (f) H (f-1) + b (f) ) + H (f-1) Where σ is the activation function, W (f) and b (f) These are the weights and biases of the f-th layer, respectively; S24. Represent the depth features Z = H of the encoder's final output. (L) As a low-dimensional feature representation of user behavior, where Z∈R (n×m) , m < d; S25. In the decoder part, the deep feature representation Z is reconstructed through a fully connected network: X̂ = σ(W d *Z + b d ) Among them W d ∈R (m×d) Let b be the decoder weight matrix. d For bias terms; S26. Calculate the reconstruction error between the original features and the reconstructed features, and define the loss function as follows: L = L recon + λ1L sparse + λ2L smooth Where L recon L represents the reconstruction loss. sparse L is the characteristic sparsity regularization term. smooth λ1 and λ2 are hyperparameters for the smoothness regularization of the feature space. S27. Based on the loss function L, the gradient descent algorithm is used to iteratively update all learnable parameters. The update formula is as follows: θ ← θ - η▽θL Where θ represents the set of model parameters, η is the learning rate, and ▽θL represents the gradient of the loss function L with respect to the parameter θ. Iterative training continues until the loss function converges, completing the training of the deep behavior encoder model and outputting the behavior feature reconstruction error and deep feature representation.

4. The method for preventing account fraud in medical scenario request data according to claim 1, characterized in that, S3 specifically includes: S31. Based on the deep feature representation Z, perform preliminary pattern segmentation on all user behaviors to obtain an initial set of behavior pattern labels C. t ; S32. Obtain the behavior pattern label C at the current time t. t The behavioral pattern label C at the previous time t-1 t-1 Multi-feature pairing is performed, and behavioral feature similarity, temporal distribution similarity, and sequence pattern similarity are combined. A weighted comprehensive formula is used to calculate the behavioral pattern stability score S. c,t ; S33. Based on the obtained behavioral pattern stability score S c,t Set a stability score threshold, determine whether each behavior pattern is a stable pattern or a fluctuating pattern, and record the pattern status; S34. Based on the discrimination results, an adaptive adjustment mechanism is used to dynamically adjust the scale threshold of each mode, with different adjustment strategies corresponding to different types of modes. S35. Based on the determined pattern size threshold, adjust the current behavior pattern, merge or discard patterns with a size smaller than the pattern size threshold, and output the adjusted behavior pattern division result. S36. For each behavioral pattern, establish a temporal memory unit to continuously record the pattern label and scale change sequence H of the most recent n time moments. c The adjusted pattern partitioning results will be used as the latest historical sequence. S37. Based on the temporal memory unit, smooth the short-term fluctuations of behavioral pattern labels and scales. If the behavioral pattern characteristics, structure, or scale are observed to change continuously and significantly within the temporal window, it is determined to be a pattern splitting, merging, or new pattern generation evolution event, and a list of evolution events is output.

5. The method for preventing account fraud in medical scenario request data according to claim 1, characterized in that, S4 specifically includes: S41. Based on the obtained standardized behavioral feature dataset and the obtained deep feature representation Z, an adversarial perturbation matrix is ​​generated for behavioral features, temporal features and sequence features using the perturbation injection method. S42. Add the original behavioral features to the perturbation matrix to obtain the adversarial behavioral features; S43. Construct a dataset of adversarial example behavior features; S44. Input the original standardized behavior feature dataset and the adversarial example behavior feature dataset into the deep behavior encoder model for training to obtain the deep feature representation of adversarial enhancement and the behavior feature reconstruction error. S45. Based on adversarial enhancement feature representation, synchronously input dynamic behavior clustering algorithm to dynamically update user behavior pattern division and evolution information; S46. During joint training, calculate the reconstruction errors of the original samples and adversarial samples in terms of behavioral feature reconstruction, temporal feature reconstruction and sequence feature reconstruction respectively, and determine the overall joint training loss based on the weighted result of the reconstruction error of the original samples and the reconstruction error of the adversarial samples. S47. During the training process, all learnable parameters in the deep behavior encoder model and the dynamic behavior clustering algorithm are continuously updated based on the joint training loss. S48. Output the deep feature representation, behavior feature reconstruction error, behavior pattern division and pattern evolution information after training with adversarial example enhancement.

6. The method for preventing account fraud in medical scenario request data according to claim 1, characterized in that, S5 specifically includes: S51. Based on the deep feature representation of the output, the behavioral feature reconstruction error, and the behavioral pattern division and pattern evolution information of the output, the data of all individual users and user groups are summarized to construct the feature set of individuals and groups. S52. For each individual user, calculate the behavioral feature reconstruction error, temporal feature reconstruction error, and sequence feature reconstruction error, which respectively reflect the user's reconstruction deviation in behavioral features, temporal distribution, and sequence pattern. S53. For each user group, calculate the average feature reconstruction error of all users in the group, calculate the proportion of group size change between two consecutive time points, and calculate the proportion of change of user behavior pattern labels in adjacent time points to reflect the overall behavior change and member stability of the group. S54. Based on individual reconstruction error, average group reconstruction error, group size change rate and behavioral pattern evolution rate, set multiple threshold discrimination criteria, and set individual account fraud discrimination threshold and group account fraud discrimination threshold respectively. S55. Individual users whose reconstruction error or behavioral change indicators exceed the threshold are marked as suspected account spoofing individuals; user groups whose average reconstruction error, scale change rate, or pattern evolution rate exceed the threshold are marked as suspected account spoofing groups. S56. Output the identifiers and corresponding abnormal indicator values ​​of all users and user groups marked as suspected of account fraud, forming the account fraud detection results.

7. The method for preventing account fraud in medical scenario request data according to claim 1, characterized in that, S6 specifically includes: S61. Receive and organize the generated account-swiping behavior detection results, and determine the specific list of individual users and user groups suspected of account swiping and the reasons for the anomalies. S62. For individual users and groups of users suspected of account fraud, send account fraud risk warning information to the backend security management personnel or monitoring platform to remind relevant personnel to pay attention to and handle account fraud risk events in a timely manner. S63. Depending on the severity of the account-boosting behavior, access control measures shall be taken against individual users and user groups suspected of account-boosting, including service throttling, account verification, function restriction, and association blocking. S64. Conduct behavior tracing operations for all individual users and user groups for which control measures have been taken, analyze recent service request characteristics, interaction patterns, historical behavior records and correlations, and locate suspicious account-swapping chains and potential account-swapping groups. S65. Organize the feedback information and actual results obtained during the risk warning, access control, and behavior tracing process, and dynamically adjust and update the parameters of the deep behavior encoder model based on the feedback information during the process to optimize the detection capability for new types of account-swiping behavior.

8. A method for preventing account fraud in medical scenario request data according to claim 3, characterized in that, The user behavior feature matrix includes request frequency, device fingerprint, IP address, request time distribution, number of authentication attempts, and historical behavior score.

9. A method for preventing account fraud in medical scenario request data according to claim 4, characterized in that, The behavioral pattern stability score S c,t The calculation formula is: S c,t =β1·F c +β2·T c +β3·S c Where F c T represents the similarity of behavioral characteristics. c S represents the similarity of time distributions. c The similarity of sequence patterns is represented by β1, β2, and β3, which are weighting coefficients and β1 + β2 + β3 = 1.

10. A method for preventing account fraud in medical scenario request data according to claim 6, characterized in that, The thresholds for identifying individual account fraud and group account fraud are set using a dynamic adjustment mechanism. The thresholds are optimized and adjusted according to the accuracy and false alarm rate of historical account fraud detection results at preset cycles.

Images