Cross-border e-commerce risk monitoring system and method based on data analysis

Abstract

The present application relates to the technical field of cross-border e-commerce risk monitoring, and discloses a cross-border e-commerce risk monitoring system and method based on data analysis. The method comprises cross-domain analysis and construction of an initial interaction chain on original trade records. Deviation of behavior from the compliance standard is identified through feature disturbance analysis, a disturbance signal is generated and injected into a deep audit process to guide event backtracking of a specific interaction chain segment, thereby locating the source operation event that causes the risk. Event attributes are extracted and mapped to a multi-dimensional risk assessment space for cluster analysis, and a risk evolution path is reconstructed. Key time sequence inflection points on the path are extracted and matched with a compliance time sequence grid for verification. If verification fails, a dynamic monitoring instruction is triggered and a customized monitoring parameter set is generated. Finally, all information is integrated to output a risk structure diagram. The method realizes accurate positioning of the risk source and time sequence monitoring of the evolution process.

Description

Technical Field

[0001] This invention relates to the field of cross-border e-commerce risk monitoring technology, specifically to a cross-border e-commerce risk monitoring system and method based on data analysis. Background Technology

[0002] In the cross-border e-commerce sector, the online and complex nature of trade makes illegal operations increasingly difficult to detect. Existing risk monitoring technologies primarily rely on rule matching and static model analysis of structured transaction data. These methods identify significant risk points that deviate from conventional statistical characteristics by using preset risk indicator thresholds or blacklist comparisons to mark abnormal transaction records. However, when faced with step-by-step, cross-stage evasion strategies, these methods typically only output a final anomaly score or label. Monitoring systems cannot penetrate the complex interactions between multiple layers of transaction entities, struggle to explain the causes of anomalies, and are unable to trace back to the initial operational stage that triggered the risk chain. This results in risk management remaining superficial and failing to effectively intervene at the source of the risk.

[0003] Another shortcoming of existing solutions lies in their insufficient analysis of the temporal logic of behaviors. Conventional time-series analysis focuses on detecting abnormal fluctuations in indicators such as transaction frequency and amount, lacking the ability to systematically compare the sequence and intervals of a series of operational events on a timeline with the mandatory time rules of compliant business processes. This makes it difficult to detect behaviors that appear compliant in individual steps but are actually achieved by reversing the order of key operations and compressing necessary time intervals to achieve circumvention goals. The output of monitoring systems is usually discrete risk points, unable to depict the dynamic evolution of risks from their inception to their manifestation, making it difficult to support proactive control and early warning. Summary of the Invention

[0004] The purpose of this invention is to provide a cross-border e-commerce risk monitoring system and method based on data analysis to solve the problems mentioned in the background art.

[0005] To achieve the above objectives, the present invention provides a cross-border e-commerce risk monitoring method based on data analysis, the method comprising:

[0006] Cross-domain parsing is performed on the acquired original trade records to construct an initial interaction chain that reflects the interaction behavior between the transaction entities;

[0007] Feature perturbation analysis is performed on the nodes in the initial interaction chain to identify the degree of deviation between the interaction behavior pattern and the preset compliance template;

[0008] Based on the degree of deviation, a characteristic perturbation signal is generated, and the characteristic perturbation signal is injected into a preset deep audit process;

[0009] In the deep audit process, the specific interaction chain segment is traced back based on the injected feature perturbation signal to locate the source operation event that caused the deviation.

[0010] Extract all trade attributes corresponding to the source operation event, and map all trade attributes to a multi-dimensional risk assessment space;

[0011] Within the multidimensional risk assessment space, clustering and deviation calculations are performed on all mapped trade attributes based on a pre-constructed risk profile library.

[0012] Based on the clustering and deviation calculation results, the risk evolution path associated with the source operation event is reconstructed;

[0013] Extract the key time-series inflection points on the risk evolution path and match and verify the key time-series inflection points with the compliance time-series grid.

[0014] When the matching verification fails, the dynamic monitoring instruction generation process is triggered, and a customized set of monitoring parameters is generated based on the attributes of the risk evolution path.

[0015] By integrating the customized set of monitoring parameters, the key time-series inflection points, and the risk evolution path, the final risk structure diagram is output.

[0016] Preferably, the step of performing cross-domain parsing on the acquired original trade records to construct an initial interaction chain reflecting the interaction behavior between transaction entities includes:

[0017] Simultaneously extract raw trade record fragments containing logistics, capital flow, and information flow from multiple heterogeneous data sources;

[0018] Each of the original trade record fragments is subjected to entity disambiguation and normalization processing to unify the referential identifiers of the same transaction entity in different fragments;

[0019] Based on the unified identifier, the original trade record fragments are spliced ​​into a continuous flow of trade activities according to the chronological order of the timestamps;

[0020] Analyze the interaction action type and interaction direction represented by each record in the trade behavior flow;

[0021] Based on the parsed interaction action type and interaction direction, the records in the trade behavior flow are transformed into weighted directed edges;

[0022] Using the transaction entities as nodes and the weighted directed edges as connections, an initial interaction chain representing the complete trade relationship over a period of time is constructed.

[0023] Preferably, the step of performing feature perturbation analysis on the nodes in the initial interaction chain to identify the degree of deviation between the interaction behavior pattern and the preset compliance template includes:

[0024] Extract a subgraph of nodes representing the behavior of a single transaction entity from the initial interaction chain;

[0025] Calculate the graph feature vectors of the node subgraph in terms of topology, connectivity strength, and interaction frequency.

[0026] The system invokes a pre-defined compliance template library, which stores the standard graph feature vector ranges for various compliant transaction entities.

[0027] The calculated graph feature vector is compared dimension by dimension with the corresponding range of the standard graph feature vector.

[0028] For dimensions that exceed the range of the standard graph feature vector, record the excess value and mark it as an abnormal feature dimension;

[0029] The number and severity of all the aforementioned abnormal feature dimensions are statistically analyzed, and the overall deviation of node behavior from the compliant template is calculated comprehensively.

[0030] Preferably, the step of generating a characteristic perturbation signal based on the degree of deviation and injecting the characteristic perturbation signal into a preset deep audit process includes:

[0031] Multiple threshold levels are set for the degree of deviation, and each threshold level corresponds to a signal strength level;

[0032] Based on the calculated threshold level of the overall deviation, the corresponding signal strength level is determined, and a feature perturbation signal packet containing the signal strength level, associated node identifier, and details of the abnormal feature dimension is generated.

[0033] The characteristic disturbance signal packet is asynchronously pushed to the message queue of the deep audit process;

[0034] The deep audit process continuously monitors the message queue, and when the characteristic disturbance signal packet is captured, audit computing resources are dynamically allocated according to the signal strength level therein.

[0035] The deep audit process loads all interaction chain data of the associated node within a preset historical period from the historical database based on the associated node identifier, in order to perform event backtracking.

[0036] Preferably, the step of performing event backtracking on a specific interaction chain segment based on the injected feature perturbation signal to locate the source operation event that caused the deviation includes:

[0037] Event backtracking is performed on specific interaction chain segments based on the injected feature perturbation signal;

[0038] The node corresponding to the associated node identifier in the characteristic perturbation signal packet is used as the current backtracking center;

[0039] From all the interaction chain data loaded in the deep audit process, extract the interaction chain segment that traces back a specific time window from the current backtracking center as the endpoint as the segment to be analyzed;

[0040] In the segment to be analyzed, the source node of each fund or goods flowing into the current backtracking center is traced in reverse to form an upstream path set. The graph feature vector of each source node in the upstream path set and its interaction pattern with the current backtracking center are analyzed.

[0041] Identify the source node and corresponding interaction event where the anomalous feature dimension or its interaction mode first shows a significant jump;

[0042] The interaction event is identified as the source operation event that leads to the accumulation of subsequent deviations.

[0043] Preferably, the step of extracting all trade attributes corresponding to the source operation event and mapping all trade attributes to a multidimensional risk assessment space includes:

[0044] Extract the transaction amount, commodity category, counterparty region, logistics channel, payment instrument type, and customs declaration information attributes from the original trade record fragments that record the aforementioned source operation events;

[0045] Each extracted attribute is numerically or vectorized to form the original attribute vector of the source operation event;

[0046] A pre-trained multidimensional risk assessment space mapping model is invoked, which defines the transformation relationship from the original attribute vector to the risk assessment space coordinates;

[0047] The original attribute vector is input into the mapping model, and the multidimensional coordinates of the source operation event in the risk assessment space are output.

[0048] Preferably, the step of clustering and calculating the deviation of all mapped trade attributes within the multidimensional risk assessment space based on a pre-constructed risk profile database includes:

[0049] The risk profile database stores the centroid coordinates of known risk types and their influence radius in the risk assessment space;

[0050] Calculate the Euclidean distance between the multidimensional coordinates of the source operation event and the centroid coordinates of each known risk type in the risk profile database;

[0051] If the Euclidean distance is less than the influence radius of the corresponding risk type, then the source operation event is determined to belong to the risk type and is assigned to the corresponding cluster.

[0052] For event coordinate points belonging to the overlapping areas of influence radii of multiple risk types, calculate the weighted sum of their distances to each relevant centroid to determine the attribution of the primary risk;

[0053] For event coordinates that do not fall within the radius of influence of any known risk type, calculate the distance to the nearest centroid as the basic deviation.

[0054] The basic deviation is corrected based on the density distribution of its respective risk cluster to obtain the final aggregate deviation.

[0055] Preferably, the step of reconstructing the risk evolution path associated with the source operation event based on the clustering and deviation calculation results includes:

[0056] The path originates from the coordinates of the source operation event in the risk assessment space.

[0057] From the interaction chain data of the deep audit process, find subsequent events that are later in time than the source operation event and have direct or indirect interaction with the associated nodes;

[0058] Extract all trade attributes corresponding to each subsequent event, and map all trade attributes to a multidimensional risk assessment space. In the multidimensional risk assessment space, cluster and calculate the deviation of the mapped trade attributes based on a pre-built risk profile library to obtain the aggregated deviation.

[0059] Connect the starting point of the path to the coordinates of all subsequent events with aggregation deviation in chronological order;

[0060] The connected polylines are smoothed, and the event time, risk type, and aggregation deviation value of each node are labeled to form a complete risk evolution path.

[0061] Preferably, the step of extracting key time-series inflection points on the risk evolution path and matching and verifying the key time-series inflection points with the compliance time-series grid includes:

[0062] Analyze the curvature changes of the risk evolution path, identify the coordinate points where the path direction changes abruptly or the aggregation deviation increases sharply, and use them as key time-series inflection points. Obtain the actual occurrence time of the event corresponding to each key time-series inflection point.

[0063] The compliance time sequence grid defines the sequence and frequency of operations that are allowed to occur for different business types within a specific time period;

[0064] The actual occurrence time of the key time-series inflection point and the sequence of events before and after it are matched with the template of the corresponding time period in the compliant time-series grid.

[0065] Verify whether the actual occurrence time is within the time window allowed by the template, and whether the event sequence conforms to the order relationship specified by the template;

[0066] If the actual occurrence time deviates from the time window or the event sequence violates the order relationship, the key time inflection point matching verification is determined to have failed.

[0067] Preferably, the present invention also includes a cross-border e-commerce risk monitoring system based on data analysis. The system includes a memory, a processor, and a computer program stored in the memory and running on the processor. When the processor executes the computer program, it implements the steps of the cross-border e-commerce risk monitoring method based on data analysis described above.

[0068] Compared with the prior art, the beneficial effects of the present invention are:

[0069] By comparing the behavioral patterns of interaction chain nodes with compliance templates, characteristic disturbance signals are quantified and injected as guiding variables into subsequent audit processes. This technology transforms the audit process from a fixed procedure into a signal-driven dynamic response, automatically focusing resources on the most likely problematic and quantifiable deviations in the interaction chain. Guided by these signals, the selected segments undergo refined event backtracking, penetrating intermediate links to pinpoint the source operational event that triggered the entire abnormal behavior pattern. This allows risk analysis to move beyond mere symptom analysis, accurately identifying the starting point of risk, improving the targeting of audits and the accuracy of root cause tracing, and providing clear objectives for implementing precise control.

[0070] Key temporal inflection points are extracted from the reconstructed risk evolution path and matched against a pre-defined compliance temporal grid. The compliance temporal grid encodes the time-dimensional rule constraints of compliant business processes, such as the sequence of specific operations, necessary time intervals, or allowed time windows. Matching key time points in the actual behavioral path with this grid identifies behaviors that are compliant in individual attributes but violate business rules in the overall operational temporal logic. When temporal matching fails, the system dynamically generates customized monitoring parameters based on the attributes of the risk path, realizing a shift from static general to dynamic specific monitoring strategies. This enhances the ability to detect and continuously monitor complex risks that are circumvented by exploiting time differences and operational sequences. Attached Figure Description

[0071] Figure 1 This is a schematic diagram illustrating the working principle of the cross-border e-commerce risk monitoring method based on data analysis described in this invention.

[0072] Figure 2 A flowchart for constructing the initial interaction chain;

[0073] Figure 3 A flowchart for generating and injecting characteristic perturbation signals;

[0074] Figure 4 PCA principal component contribution rate analysis chart for cross-border e-commerce trade attribute coding;

[0075] Figure 5 A three-dimensional risk evolution path diagram for cross-border e-commerce transactions. Detailed Implementation

[0076] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0077] Please see Figure 1 This invention provides a data analysis-based method for cross-border e-commerce risk monitoring. The method includes: constructing an initial interaction chain reflecting the interactive behavior between trading entities by acquiring original trade records and performing cross-domain parsing; performing feature perturbation analysis on nodes in the initial interaction chain to identify the degree of deviation between their interaction behavior patterns and preset compliance templates; generating feature perturbation signals based on this deviation degree and injecting them into a preset deep audit process; in the deep audit process, performing event backtracking on specific interaction chain segments based on the injected feature perturbation signals to locate the source operation event that caused the deviation; extracting all trade attributes corresponding to the source operation event and mapping these attributes to a multi-dimensional risk assessment space; clustering and calculating the deviation degree of all mapped trade attributes based on a pre-constructed risk profile library within this space; reconstructing the risk evolution path associated with the source operation event based on the calculation results; extracting key temporal inflection points on the risk evolution path and matching them with a compliance temporal grid for verification; when the matching verification fails, triggering a dynamic monitoring instruction generation process and generating a customized set of monitoring parameters based on the attributes of the risk evolution path. Finally, by integrating the customized set of monitoring parameters, key time-series inflection points, and risk evolution paths, the final risk structure diagram is output.

[0078] Example 1: See Figure 2This process synchronously extracts raw trade record fragments containing logistics, capital flow, and information flow from multiple heterogeneous data sources. Each raw trade record fragment undergoes entity disambiguation and normalization to unify the identifiers of the same transaction entity across different fragments. Based on these unified identifiers, the raw trade record fragments are concatenated into a continuous trade behavior flow according to their timestamps. The interaction type and direction represented by each record in the trade behavior flow are analyzed. Based on the analyzed interaction type and direction, the records in the trade behavior flow are transformed into weighted directed edges. Using transaction entities as nodes and weighted directed edges as connections, an initial interaction chain representing the complete trade relationship over a period of time is constructed.

[0079] Extract a node subgraph representing the behavior of a single transaction entity from the initial interaction chain. Calculate the graph feature vector of this node subgraph in terms of topology, connection strength, and interaction frequency. Call a pre-defined compliance template library, which stores the standard graph feature vector ranges for various compliant transaction entities. Compare the calculated graph feature vectors with the corresponding standard graph feature vector ranges dimension by dimension. For dimensions that exceed the standard graph feature vector ranges, record the excess value and mark them as anomalous feature dimensions. Count the number and severity of all anomalous feature dimensions, and comprehensively calculate the overall deviation of node behavior from the compliance template.

[0080] In practice, original trade record fragments containing logistics, capital flow, and information flow are extracted simultaneously from multiple heterogeneous data sources. For example, a batch of record fragments containing the shipper "Company_A_US", consignee "Company_B_CN", commodity code "84713000" and logistics status "signed" are extracted from the waybill database of logistics companies. At the same time, record fragments with the payer "A_Corp_US", the payee "B_Tech_CN", the amount "15,000.00" and status "settlement completed" are extracted from the transaction flow database of payment institutions. Each original trade record fragment undergoes entity disambiguation and normalization processing to unify the referent of the same transaction entity in different fragments. For example, “Company_A_US” in the logistics record and “A_Corp_US” in the payment record are associated with the unified social credit code of the enterprise or the registration ID of the cross-border e-commerce platform and normalized to the standard entity identifier “ENT_A_US”. “Company_B_CN” and “B_Tech_CN” are normalized to the standard entity identifier “ENT_B_CN”. Based on the unified identifier, the original trade record fragments are pieced together into a continuous flow of trade activities according to the chronological order of the timestamps. For example, one record is "2023-10-26 09:30:00, ENT_A_US shipped goods 84713000 to ENT_B_CN, waybill number EXP123", followed by the next record "2023-10-28 14:15:00, ENT_A_US paid 15,000.00 to ENT_B_CN, transaction number TXN456". The process analyzes the interaction type and direction represented by each record in the trade flow. For example, the record "ENT_A_US sends goods 84713000 to ENT_B_CN" is analyzed as the action type "shipment" and the direction "ENT_A_US->ENT_B_CN". The record "ENT_A_US pays 15,000.00 to ENT_B_CN" is analyzed as the action type "payment" and the direction "ENT_A_US->ENT_B_CN". Based on the analyzed interaction type and direction, the records in the trade flow are transformed into weighted directed edges. For example, the weight of the directed edge corresponding to the shipment action can be set to "15000" based on the value and quantity of the goods, and the weight of the directed edge corresponding to the payment action is directly the transaction amount "15000". Using transaction entities as nodes and weighted directed edges as connections, an initial interaction chain representing the complete trade relationship over a period of time is constructed. This initial interaction chain is a graph structure containing nodes “ENT_A_US” and “ENT_B_CN” and multiple directed edges with weights, timestamps, and action type labels connecting these two nodes.

[0081] In practical implementation, a subgraph representing the behavior of a single transaction entity is extracted from the initial interaction chain. For example, centered on entity "ENT_B_CN", all interaction edges where it acted as a recipient or payee in the past thirty days, along with their corresponding counterparty nodes, are extracted to form a star-shaped or more complex subgraph centered on "ENT_B_CN". The graph feature vectors of the subgraph are calculated in terms of topology, connection strength, and interaction frequency. In some embodiments, the topology dimension may include standardized values ​​of indicators such as node degree, clustering coefficient, and average path length; the connection strength dimension can be calculated based on the sum and standard deviation of the weights of the interaction edges; and the interaction frequency dimension can be calculated based on the number of interactions per unit time and its rate of change. An optional formula for quantifying topological heterogeneity is as follows:

[0082]

[0083] in: The eigenvalues ​​representing the degree distribution heterogeneity of the node subgraph are... This represents the set of all nodes in the subgraph of this node. This indicates the number of nodes in the set. Represents a node The degree, Represents a set The average degree of all nodes in the graph. The pre-defined compliance template library is invoked. This library stores the standard graph feature vector ranges for various compliant transaction entities. For example, for the entity type "small and medium-sized importers of electronic products," the standard graph feature vector range specifies that the connection strength dimension value is in the range [1000, 50000], the interaction frequency dimension value is in the range [5, 30], and the topological heterogeneity... The value is in the range [0.2, 1.5].

[0084] In some embodiments, for dimensions that exceed the range of the standard graph feature vector, the excess value is recorded and marked as an anomalous feature dimension. For example, if the calculated interaction frequency dimension value of entity "ENT_B_CN" is 45, exceeding the upper limit of 30 specified for the "Small and Medium Importers of Electronic Products" type, then the excess value of 15 is recorded, and "interaction frequency" is marked as an anomalous feature dimension; simultaneously, its topological heterogeneity... The calculated value is 2.3, exceeding the upper limit of 1.5. The excess value of 0.8 is recorded and marked as "topological heterogeneity" as an anomalous feature dimension. The number and severity of all anomalous feature dimensions are statistically analyzed. It can be understood that the severity can be measured by the relative ratio of the excess value to the standard range boundary value. The overall deviation of node behavior from the compliant template is calculated by comprehensively calculating the overall deviation. An optional comprehensive calculation method is to assign weights to each anomalous dimension and then perform a weighted summation.

[0085] Example 2: See Figure 3 Multiple threshold levels are set for the degree of deviation, each corresponding to a signal strength level. Based on the calculated overall deviation level's threshold level, the corresponding signal strength level is determined, generating a feature disturbance signal packet containing the signal strength level, associated node identifier, and details of the abnormal characteristics. This feature disturbance signal packet is asynchronously pushed to the message queue of the deep audit process. The deep audit process continuously monitors the message queue, and when a feature disturbance signal packet is captured, it dynamically allocates audit computing resources based on the signal strength level within it. Based on the associated node identifier, the deep audit process loads all interaction chain data of the associated nodes within a preset historical period from the historical database for event backtracking.

[0086] In practical implementation, multiple level thresholds are set for the degree of deviation, and each level threshold corresponds to a signal strength level. For example, the overall deviation value range [0, 20) is defined as level threshold L1 corresponding to the signal strength level "low", the range [20, 50) is level threshold L2 corresponding to the signal strength level "medium", and the range [50, +∞) is level threshold L3 corresponding to the signal strength level "high". Based on the level threshold to which the calculated overall deviation belongs, the corresponding signal strength level is determined. For example, the overall deviation of entity "ENT_B_CN" is calculated to be 65, which falls within the range of level threshold L3, so the signal strength level is determined to be "high". A feature perturbation signal packet containing the "high" signal strength level, the associated node identifier "ENT_B_CN", and the abnormal feature dimension details "interaction frequency exceeds the standard upper limit by 15, topological heterogeneity exceeds the standard upper limit by 0.8" is generated. The data structure of the feature perturbation signal packet can be represented as a data object containing a signal strength level field, a node identifier field, and an abnormal dimension list field. The feature disturbance signal packet is asynchronously pushed to the message queue of the deep audit process. The message queue can be implemented using message middleware such as RabbitMQ or Kafka. The feature disturbance signal packet is encapsulated into a message body of a specific format and sent to a message topic named "deep audit queue".

[0087] The deep audit process continuously monitors the message queue. When a characteristic disturbance signal packet is captured, audit computing resources are dynamically allocated based on its signal strength level. In some embodiments, the deep audit process is deployed in a cloud computing environment, and its resource allocation strategy can preset different computing resource specifications based on the signal strength level. For example, when the signal strength level is "high," a container instance with 4 CPU cores and 16GB of memory is dynamically allocated for this audit task; when the signal strength level is "medium," a container instance with 2 CPU cores and 8GB of memory is allocated; and when the signal strength level is "low," a container instance with 1 CPU core and 4GB of memory is allocated. An optional formula for calculating the initial resource allocation weight based on the signal strength level is as follows:

[0088]

[0089] in: Indicates the initial resource allocation weight. Numerical values ​​representing signal strength level mappings. This is a basic resource coefficient greater than 1. It can be understood that the final allocated computing resources are the product of the initial resource allocation weight and a basic resource unit. The deep audit process, based on the associated node identifier, loads all interaction chain data of the associated node within a preset historical period from the historical database for event backtracking. For example, if the associated node identifier is "ENT_B_CN" and the preset historical period is "the past 180 days," the deep audit process retrieves all interaction edges starting or ending with "ENT_B_CN" and their associated complete transaction records from the graph database or time-series database within the past 180 days, forming a dataset for deep analysis. In some embodiments, the loaded all interaction chain data includes not only the direct interaction data of "ENT_B_CN" but also the entities and interaction data that have a second-order association with "ENT_B_CN," forming a broader-spectrum audit data network.

[0090] Example 3: The node corresponding to the associated node identifier in the feature disturbance signal packet is used as the current backtracking center. From all the interaction chain data loaded in the deep audit process, an interaction chain segment tracing back a specific time window from the current backtracking center is extracted as the segment to be analyzed. In the segment to be analyzed, the source node of each fund or goods flowing into the current backtracking center is traced in reverse to form an upstream path set. The graph feature vector of each source node in the upstream path set and its interaction pattern with the current backtracking center are analyzed. The source node where the abnormal feature dimension or its interaction pattern first shows a significant jump and the corresponding interaction event are identified. This interaction event is determined as the source operation event that leads to the subsequent accumulation of deviation.

[0091] From fragments of original trade records documenting source operation events, attributes such as transaction amount, commodity category, counterparty location, logistics channel, payment instrument type, and customs declaration information are extracted. Each extracted attribute is numerically or vectorized to form an original attribute vector for the source operation event. A pre-trained multidimensional risk assessment space mapping model is invoked, which defines the transformation relationship from the original attribute vector to risk assessment space coordinates. The original attribute vector is input into the mapping model, which outputs the multidimensional coordinate points of the source operation event in the risk assessment space.

[0092] In practice, event backtracking is performed on specific interaction chain segments based on injected characteristic perturbation signals. The node corresponding to the associated node identifier in the characteristic perturbation signal packet is used as the current backtracking center. For example, if the associated node identifier is "ENT_B_CN", then "ENT_B_CN" is established as the current backtracking center. From all interaction chain data loaded in the deep audit process, interaction chain segments that trace back a specific time window from the current backtracking center are extracted as segments to be analyzed. For example, if the specific time window is set to "72 hours", then all interaction records of "ENT_B_CN" as a recipient of funds or goods and their associated complete upstream chains within 72 hours before the current time point are extracted to constitute the segment to be analyzed. In the segment to be analyzed, the source node of each fund or goods flowing into the current backtracking center is traced in reverse to form an upstream path set. For example, if a fund of "50,000.00" is found to flow into "ENT_B_CN", its payer is traced in reverse to node "ENT_X_HK"; at the same time, a batch of goods with commodity code "85171200" is found to be delivered to "ENT_B_CN", and its shipper is traced in reverse to node "ENT_Y_JP". Then nodes "ENT_X_HK" and "ENT_Y_JP" and their corresponding interaction events are included in the upstream path set. Analyzing the graph feature vectors of each source node in the upstream path set and their interaction patterns with the current backtracking center, in some embodiments, the graph feature vector analysis of node "ENT_X_HK" reveals that its "average transaction amount" dimension value is 85,000, far exceeding the upper limit of 20,000 for the "general trader" type standard range. The interaction pattern between node "ENT_B_CN" and this node shows that the two had three high-value transfers within a 72-hour window, but the corresponding logistics record only showed one low-value item. The interaction pattern exhibits the characteristics of "high-frequency capital flow and low-frequency goods flow".

[0093] Identify the source node and corresponding interaction event where a significant jump occurs in the first abnormal feature dimension or its interaction pattern. For example, analyzing the upstream path set sorted by timestamp reveals that before the first interaction event with the source node "ENT_X_HK", the "standard deviation of single transaction amount" dimension value of "ENT_B_CN" in its interaction pattern with other trading counterparties was stable below 5000; however, after event E1, the "standard deviation of single transaction amount" dimension value of "ENT_B_CN" jumped to over 15000, and the interaction pattern of "high-frequency capital flow and low-frequency goods flow" began to appear continuously. An optional formula for quantifying the degree of change in interaction pattern is as follows:

[0094]

[0095] in: Indicates the interaction mode transition index. This represents the average value of a certain feature dimension of the graph within a specific time window before the occurrence of the abrupt change event. This represents the average value of the same feature dimension of the graph within the same time window after a jump event occurs. This represents the standard deviation of that feature dimension before the abrupt change event occurred. It can be understood that when... When the value exceeds the preset threshold, a significant change occurs in the judgment. Interaction event E1 is determined to be the source operation event that leads to the accumulation of subsequent deviations.

[0096] In practice, the transaction amount, commodity category, counterparty region, logistics channel, payment instrument type, and customs declaration information attributes are extracted from the original trade record fragments that record the source operation event. For example, for the source operation event E1, the transaction amount "18000" is extracted from its associated payment record, the commodity category information is extracted from the associated logistics order or order as "mobile communication equipment", the counterparty region is "region E", the logistics channel is "air express", the payment instrument type is "overseas credit card", and the customs declaration information attributes include the declared value "18000" and the commodity code "85171200". Each extracted attribute is coded numerically or vectorized to form the original attribute vector of the source operation event. For example, the transaction amount "18000" is directly used as a numerical value, the commodity category "mobile communication equipment" is mapped to the numerical value "8517" through the predefined category coding table, the counterparty region "E region" is mapped to the vector "[0.8,0.1,0.05]" through the regional risk code, the logistics channel "air express" is mapped to "[1,0,0]", the payment tool type "overseas credit card" is mapped to "[0,0,1]", the commodity code "85171200" in the customs declaration information is used as a numerical value, and the declared value "18000" is used as a numerical value. Finally, they are concatenated to form a multi-dimensional original attribute vector, such as [18000,8517,0.8,0.1,0.05,1,0,0,0,0,1,85171200,18000].

[0097] A pre-trained multidimensional risk assessment space mapping model is invoked. This model defines the transformation relationship from the original attribute vector to the coordinates in the risk assessment space. In some embodiments, the multidimensional risk assessment space mapping model can be a trained deep autoencoder or a projection matrix obtained through principal component analysis (PCA). The original attribute vector is input into the multidimensional risk assessment space mapping model, which outputs the multidimensional coordinates of the source operational event in the risk assessment space. For example, a coordinate point in a three-dimensional risk assessment space is calculated as (12.5, -3.2, 8.1). In specific implementations, the multidimensional risk assessment space mapping model is pre-trained using machine learning algorithms. The deep autoencoder learns the intrinsic feature representation of the original attribute vector through a neural network structure, while principal component analysis extracts the main variation direction of the data through linear transformation. Historical trade data, including attribute vectors of known compliant and risk events, is used during model training to learn the mapping relationship from the original attributes to the risk assessment space. The trained model can map the original attribute vector of the source operational event to coordinate points in the multidimensional risk assessment space, which represent the distribution of the event's risk characteristics.

[0098] See Figure 4 This is a PCA principal component contribution rate analysis chart for cross-border e-commerce trade attribute coding. Dimension 1's contribution rate (approximately 0.42) is significantly higher than other dimensions, followed by Dimension 2 (approximately 0.28). The contribution rates of subsequent dimensions decrease rapidly, reflecting the PCA characteristic of "a few principal components carrying most information." This chart corresponds to the vectorized coding process of trade attributes. Principal components with high contribution rates (such as dimensions 1 and 2) are the core feature dimensions for risk assessment, simplifying the computational complexity of subsequent risk space mapping. This helps technical personnel identify key coding dimensions, allowing them to retain only the first 2-3 principal components while ensuring the accuracy of risk assessment, thus improving the computational efficiency of risk monitoring.

[0099] Example 4: The risk profile library stores the centroid coordinates of known risk types and their influence radii in the risk assessment space. The Euclidean distance between the multidimensional coordinates of the source operation event and the centroid coordinates of each known risk type in the risk profile library is calculated. If the Euclidean distance is less than the influence radius of the corresponding risk type, the source operation event is determined to belong to that risk type and is assigned to the corresponding cluster. For event coordinates belonging to the overlapping areas of the influence radii of multiple risk types, the weighted sum of their distances to each relevant centroid is calculated to determine the primary risk attribution. For event coordinates not falling within the influence radius of any known risk type, their distance to the nearest centroid is calculated as the basic deviation. The basic deviation is corrected based on the density distribution of the risk cluster to which it belongs, resulting in the final aggregated deviation.

[0100] The path originates from the coordinates of the source operation event within the risk assessment space. From the interaction chain data of the deep audit process, subsequent events that are chronologically later than the source operation event and have direct or indirect interactions with related nodes are identified. All trade attributes corresponding to each subsequent event are extracted and mapped to a multi-dimensional risk assessment space. Within this space, clustering and deviation calculations are performed on all mapped trade attributes based on a pre-built risk profile library to obtain the aggregated deviation. The path origin is then sequentially connected to the coordinates of all subsequent events with aggregated deviations in chronological order. The resulting polyline is smoothed, and the event time, risk type, and aggregated deviation value of each node are labeled to form a complete risk evolution path.

[0101] In practice, the risk profile database stores the centroid coordinates of known risk types and their radius of influence in the risk assessment space. The data structure of the risk profile database can use a relational database table or a dedicated configuration file, such as a table containing risk type name, centroid coordinate vector, radius of influence value, and typical feature description fields. Refer to Table 1, which shows a simplified risk profile database data table.

[0102] Table 1: Risk Profile Database Data Table

[0103] Risk type Centroid coordinates (x, y, z) Radius of influence (R) Typical feature description Risk A (10.0,-5.0,15.0) 8.0 High frequency, high amount, geographically dispersed opponents Risk B (5.0,12.0,-2.0) 6.0 The declared value of the commodity deviates significantly from its fair market value. Risk C (-8.0,-10.0,3.0) 7.5 Involving sensitive product categories and concealed logistics channels

[0104] Calculate the Euclidean distance between the multidimensional coordinates of the source operation event and the centroid coordinates of each known risk type in the risk profile database. For example, if the coordinates of the source operation event are (12.5, -3.2, 8.1), calculate its Euclidean distance to the centroid (10.0, -5.0, 15.0) of "Risk A". An optional formula for calculating the normalized distance is as follows:

[0105]

[0106] in: Represents the normalized distance. This indicates the dimensions of the risk assessment space. Indicates the source operation event at the 1st dimensional coordinates, This indicates that the centroid of a certain risk type is at the 1st position. dimensional coordinates, This represents the radius of influence for that risk type. If the calculated... If the value is less than 1, the source operation event is determined to belong to risk type "A" and is assigned to the corresponding cluster. For event coordinate points belonging to the overlapping areas of influence radii of multiple risk types, the weighted sum of their distances to each relevant centroid is calculated to determine the primary risk attribution. For example, the distance from event coordinate point (4.0, 10.0, 0.5) to the centroid of "B" risk is... The value is 0.8, reaching the centroid of "Risk A". It is 2.1, but the centroid of "C risk" is... The value is 0.9. By comparing the weighted sum, it can be determined that the event primarily belongs to "Risk B". For event coordinates that do not fall within the influence radius of any known risk type, the distance to the nearest centroid is calculated as the basic deviation. For example, an event point with coordinates (0.0, 0.0, 0.0) has the closest Euclidean distance to the centroid of "Risk B", and this distance value is the basic deviation. The basic deviation is then corrected by combining it with the density distribution of the risk cluster to which it belongs. It can be understood that the density distribution of the risk cluster can be estimated by the kernel density of historical event coordinates within the cluster. One correction method is to multiply the basic deviation by a factor inversely proportional to the local density to obtain the final aggregate deviation.

[0107] In some embodiments, the coordinates of the source operation event in the risk assessment space are used as the starting point of the path, for example, the coordinates (12.5, -3.2, 8.1) are used as the starting point S of the risk evolution path. From the interaction chain data of the deep audit process, subsequent events that are later in time than the source operation event and have direct or indirect interaction with the associated node are searched. The associated node is "ENT_B_CN". All transaction events involving "ENT_B_CN" after the occurrence time T1 of the source operation event E1 are searched. All trade attributes corresponding to each subsequent event are extracted and mapped to the multidimensional risk assessment space. In the multidimensional risk assessment space, the mapped trade attributes are clustered and the deviation is calculated based on the pre-built risk profile library to obtain the aggregated deviation. For example, the coordinates of event E2 after mapping are (9.0, -4.0, 12.0), and its deviation is calculated. With a centroid of 0.65 relative to "Risk A", the calculated aggregation deviation is 0.65; the mapped coordinates of event E3 are (14.0, -2.0, 6.0). The aggregation deviation is calculated to be 1.2. Following the chronological order, the path starting point S is sequentially connected to all subsequent event coordinate points E2 and E3 with aggregation deviation. The resulting polyline is smoothed, and the event time, risk type, and aggregation deviation value of each node are labeled to form a complete risk evolution path. For example, the path is displayed as a curve from S(12.5, -3.2, 8.1, T1, Risk A, 0.72) to E2(9.0, -4.0, 12.0, T2, Risk A, 0.65) and then to E3(14.0, -2.0, 6.0, T3, Risk A, 1.2). An optional smoothing method is Bézier curve fitting or moving average. It can be understood that the labeling information is stored as metadata associated with each coordinate point on the path.

[0108] Example 5: Analyze the curvature changes of the risk evolution path, identify coordinate points where the path direction changes abruptly or the aggregation deviation increases sharply, as key time-series inflection points, and obtain the actual occurrence time of the event corresponding to each key time-series inflection point. The compliance time-series grid defines the allowed operation sequences and frequencies for different business types within a specific time period. Match the actual occurrence time of the key time-series inflection point and the sequence of events before and after it with the template of the corresponding time period in the compliance time-series grid. Verify whether the actual occurrence time is within the time window allowed by the template, and whether the event sequence conforms to the order relationship specified by the template. If the actual occurrence time deviates from the time window or the event sequence violates the order relationship, the key time-series inflection point matching verification is deemed to have failed.

[0109] In practical implementation, the curvature changes of the risk evolution path are analyzed to identify coordinate points where the path direction changes abruptly or the aggregation deviation increases sharply. These are considered key time-series inflection points. The risk evolution path is represented by a series of coordinate points with timestamps and aggregation deviation values. For example, the path point sequence could be: S(12.5,-3.2,8.1,T1,0.72), E2(9.0,-4.0,12.0,T2,0.65), E3(14.0,-2.0,6.0,T3,1.2). An optional formula for quantifying the directional changes of adjacent path segments to identify abrupt changes is as follows:

[0110]

[0111] in: This represents the rate of change of curvature parameter. This represents the vector pointing from path point S to path point E2. This represents the vector pointing from path point E2 to path point E3. This represents the total time span from time T1 to T3. When When the value exceeds a preset mutation threshold, or the rate of change of the aggregation deviation value between consecutive points exceeds a preset steep increase threshold, the corresponding coordinate point is identified as a key time-series inflection point. For example, the direction vector at point E2 changes from pointing to (9.0-12.5, -4.0+3.2, 12.0-8.1) to pointing to (14.0-9.0, -2.0+4.0, 6.0-12.0), which is a significant change. Moreover, the aggregation deviation drops from 0.72 to 0.65 and then increases sharply to 1.2. Therefore, both E2 and E3 are identified as key time-series inflection points. The actual occurrence time of the event corresponding to each key time-series inflection point is obtained, such as E2 corresponding to time T2 and E3 corresponding to time T3.

[0112] The compliance time sequence grid defines the sequence and frequency of operations that are allowed to occur within a specific time period for different business types. The compliance time sequence grid can be a set of rules stored in a database or configuration file. For example, for the business type of "general trade import of electronic products", a compliance time sequence grid template stipulates that: within 24 to 72 hours after the "order payment" event (classified as an A event) occurs, the corresponding "logistics delivery" event (classified as a B event) should occur, and within 0 to 10 days after the "logistics delivery" event occurs, the "customs declaration" event (classified as a C event) should occur. The operation sequence must follow the order of A->B->C. The actual occurrence time of key time-series inflection points and the sequence of events before and after them are matched with the template of the corresponding time period in the compliant time-series grid. For example, if the event corresponding to the key time-series inflection point E2 is identified as "logistics delivery" event type B, and its actual occurrence time is T2, and the closest event in the path before it is the source operation event E1, which is classified as "order payment" event type A, and its occurrence time is T1, then it is necessary to verify whether the event sequence "E1(type A, T1)->E2(type B, T2)" conforms to the compliant time-series grid template.

[0113] When verifying whether the actual occurrence time falls within the time window allowed by the template and whether the event sequence conforms to the order relationship specified in the template, the time difference between T2 and T1 is calculated, and it is determined whether this time difference falls within the 24 to 72-hour window specified in the template. In some embodiments, if the time difference between T2 and T1 is 18 hours, it deviates from the allowed time window. Simultaneously, the order of the event sequence is checked. For example, if the event corresponding to the next critical time-series inflection point E3 after E2 is classified as an "order payment" event, this causes the sequence to become A->B->A, violating the A->B->C order relationship specified in the template. If the actual occurrence time deviates from the time window or the event sequence violates the order relationship, the critical time-series inflection point matching verification is deemed to have failed.

[0114] See Figure 5This is a three-dimensional risk evolution path diagram for cross-border e-commerce transactions. The path gradually upgrades from "normal" (green) to "suspicious," "high risk," and "extremely high risk," ultimately showing "risk reduction" (blue), reflecting the dynamic trajectory of transaction risk changes. The color segments correspond to the leaps in risk levels, reflecting the continuous deviation of risk characteristics. It intuitively displays the risk escalation and mitigation process of a single transaction, helping monitoring personnel to locate key nodes in risk transitions and assisting in subsequent traceability and control decisions.

[0115] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus.

[0116] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A data analysis-based method for monitoring risks in cross-border e-commerce, characterized in that, The method includes: Cross-domain parsing is performed on the acquired original trade records to construct an initial interaction chain that reflects the interaction behavior between the transaction entities; Feature perturbation analysis is performed on the nodes in the initial interaction chain to identify the degree of deviation between the interaction behavior pattern and the preset compliance template; Based on the degree of deviation, a characteristic perturbation signal is generated, and the characteristic perturbation signal is injected into a preset deep audit process; In the deep audit process, based on the injected characteristic perturbation signal, event backtracking is performed on specific interaction chain segments to locate the source operation event that caused the deviation, including: Event backtracking is performed on specific interaction chain segments based on the injected feature perturbation signal; The node corresponding to the associated node identifier in the characteristic perturbation signal packet is used as the current backtracking center; The characteristic disturbance signal packet includes signal strength level, associated node identifier, and details of abnormal feature dimensions; From all the interaction chain data loaded in the deep audit process, extract the interaction chain segment that traces back a specific time window from the current backtracking center as the endpoint as the segment to be analyzed; In the segment to be analyzed, the source node of each fund or goods flowing into the current backtracking center is traced in reverse to form an upstream path set. The graph feature vector of each source node in the upstream path set and its interaction pattern with the current backtracking center are analyzed. Identify the source node and corresponding interaction event where the anomalous feature dimension or its interaction mode first shows a significant jump; The interaction event is identified as the source operation event that leads to the accumulation of subsequent deviations; Extract all trade attributes corresponding to the source operation event, and map all trade attributes to a multi-dimensional risk assessment space; Within the multidimensional risk assessment space, clustering and deviation calculations are performed on all mapped trade attributes based on a pre-constructed risk profile library. Based on the clustering and deviation calculation results, the risk evolution path associated with the source operation event is reconstructed; Extract the key time-series inflection points on the risk evolution path and match and verify the key time-series inflection points with the compliance time-series grid. When the matching verification fails, the dynamic monitoring instruction generation process is triggered, and a customized set of monitoring parameters is generated based on the attributes of the risk evolution path. By integrating the customized set of monitoring parameters, the key time-series inflection points, and the risk evolution path, the final risk structure diagram is output.

2. The cross-border e-commerce risk monitoring method based on data analysis according to claim 1, characterized in that, The step of performing cross-domain parsing on the acquired original trade records to construct an initial interaction chain reflecting the interaction behavior between transaction entities includes: Simultaneously extract raw trade record fragments containing logistics, capital flow, and information flow from multiple heterogeneous data sources; Each of the original trade record fragments is subjected to entity disambiguation and normalization processing to unify the referential identifiers of the same transaction entity in different fragments; Based on the unified identifier, the original trade record fragments are spliced ​​into a continuous flow of trade activities according to the chronological order of the timestamps; Analyze the interaction action type and interaction direction represented by each record in the trade behavior flow; Based on the parsed interaction action type and interaction direction, the records in the trade behavior flow are transformed into weighted directed edges; Using the transaction entities as nodes and the weighted directed edges as connections, an initial interaction chain representing the complete trade relationship over a period of time is constructed.

3. The cross-border e-commerce risk monitoring method based on data analysis according to claim 2, characterized in that, The step of performing feature perturbation analysis on the nodes in the initial interaction chain to identify the degree of deviation between the interaction behavior pattern and the preset compliant template includes: Extract a subgraph of nodes representing the behavior of a single transaction entity from the initial interaction chain; Calculate the graph feature vectors of the node subgraph in terms of topology, connectivity strength, and interaction frequency. The system invokes a pre-defined compliance template library, which stores the standard graph feature vector ranges for various compliant transaction entities. The calculated graph feature vector is compared dimension by dimension with the corresponding range of the standard graph feature vector. For dimensions that exceed the range of the standard graph feature vector, record the excess value and mark it as an abnormal feature dimension; The number and severity of all the aforementioned abnormal feature dimensions are statistically analyzed, and the overall deviation of node behavior from the compliant template is calculated comprehensively.

4. The cross-border e-commerce risk monitoring method based on data analysis according to claim 3, characterized in that, The step of generating a characteristic perturbation signal based on the degree of deviation and injecting the characteristic perturbation signal into a preset deep audit process includes: Multiple threshold levels are set for the degree of deviation, and each threshold level corresponds to a signal strength level; Based on the calculated threshold level of the overall deviation, the corresponding signal strength level is determined, and a feature perturbation signal packet containing the signal strength level, associated node identifier, and details of the abnormal feature dimension is generated. The characteristic disturbance signal packet is asynchronously pushed to the message queue of the deep audit process; The deep audit process continuously monitors the message queue, and when the characteristic disturbance signal packet is captured, audit computing resources are dynamically allocated according to the signal strength level therein. The deep audit process loads all interaction chain data of the associated node within a preset historical period from the historical database based on the associated node identifier, in order to perform event backtracking.

5. The cross-border e-commerce risk monitoring method based on data analysis according to claim 4, characterized in that, The step of extracting all trade attributes corresponding to the source operation event and mapping all trade attributes to a multidimensional risk assessment space includes: Extract the transaction amount, commodity category, counterparty region, logistics channel, payment instrument type, and customs declaration information attributes from the original trade record fragments that record the aforementioned source operation events; Each extracted attribute is numerically or vectorized to form the original attribute vector of the source operation event; A pre-trained multidimensional risk assessment space mapping model is invoked, which defines the transformation relationship from the original attribute vector to the risk assessment space coordinates; The original attribute vector is input into the mapping model, and the multidimensional coordinates of the source operation event in the risk assessment space are output.

6. The cross-border e-commerce risk monitoring method based on data analysis according to claim 5, characterized in that, The step of clustering and calculating the deviation of all mapped trade attributes within the multidimensional risk assessment space based on a pre-constructed risk profile database includes: The risk profile database stores the centroid coordinates of known risk types and their influence radius in the risk assessment space; Calculate the Euclidean distance between the multidimensional coordinates of the source operation event and the centroid coordinates of each known risk type in the risk profile database; If the Euclidean distance is less than the influence radius of the corresponding risk type, then the source operation event is determined to belong to the risk type and is assigned to the corresponding cluster; For event coordinate points belonging to the overlapping areas of influence radii of multiple risk types, calculate the weighted sum of their distances to each relevant centroid to determine the attribution of the primary risk; For event coordinates that do not fall within the radius of influence of any known risk type, calculate the distance to the nearest centroid as the basic deviation. The basic deviation is corrected based on the density distribution of its respective risk cluster to obtain the final aggregate deviation.

7. The cross-border e-commerce risk monitoring method based on data analysis according to claim 6, characterized in that, The step of reconstructing the risk evolution path associated with the source operation event based on the clustering and deviation calculation results includes: The path originates from the coordinates of the source operation event in the risk assessment space. From the interaction chain data of the deep audit process, find subsequent events that are later in time than the source operation event and have direct or indirect interaction with the associated nodes; Extract all trade attributes corresponding to each subsequent event, and map all trade attributes to a multidimensional risk assessment space. In the multidimensional risk assessment space, cluster and calculate the deviation of the mapped trade attributes based on a pre-built risk profile library to obtain the aggregated deviation. Connect the starting point of the path to the coordinates of all subsequent events with aggregation deviation in chronological order; The connected polylines are smoothed, and the event time, risk type, and aggregation deviation value of each node are labeled to form a complete risk evolution path.

8. The cross-border e-commerce risk monitoring method based on data analysis according to claim 7, characterized in that, The step of extracting key time-series inflection points on the risk evolution path and matching and verifying these key time-series inflection points with the compliance time-series grid includes: Analyze the curvature changes of the risk evolution path, identify the coordinate points where the path direction changes abruptly or the aggregation deviation increases sharply, and use them as key time-series inflection points. Obtain the actual occurrence time of the event corresponding to each key time-series inflection point. The compliance time sequence grid defines the sequence and frequency of operations that are allowed to occur for different business types within a specific time period; The actual occurrence time of the key time-series inflection point and the sequence of events before and after it are matched with the template of the corresponding time period in the compliant time-series grid. Verify whether the actual occurrence time is within the time window allowed by the template, and whether the event sequence conforms to the order relationship specified by the template; If the actual occurrence time deviates from the time window or the event sequence violates the order relationship, the key time inflection point matching verification is determined to have failed.

9. A cross-border e-commerce risk monitoring system based on data analysis, comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the cross-border e-commerce risk monitoring method based on data analysis as described in any one of claims 1 to 8.

Images