Traffic fraud real-time detection method fusing user behavior time sequence analysis

Abstract

The invention discloses a traffic fraud real-time detection method fusing user behavior time sequence analysis, and relates to the technical field, the method comprises the following steps: carrying out long and short window aggregation on a real-time log stream, extracting user behavior time sequence features, constructing static cross features, and preliminarily identifying an abnormal rhythm by combining a click rate ratio and a click interval variation coefficient; inputting the features into a pre-training classification model to output a risk score, and performing preliminary risk judgment in combination with a threshold value dynamically adjusted by reinforcement learning; carrying out fine grading on high-risk traffic by adopting a double-threshold mechanism, and outputting blocking, rechecking or passing actions; model iteration and threshold updating are realized through gray scale deployment and continuous monitoring; according to the method, real-time, accurate and self-adaptive detection of the fraud traffic is realized, and the system response speed and the service adaptability are improved.

Description

Technical Field

[0001] This invention relates to the field of real-time traffic detection technology, and more specifically, to a real-time traffic fraud detection method that integrates user behavior time-series analysis. Background Technology

[0002] Fraudulent traffic and cheating behaviors, such as malicious click fraud, simulated clicks, and organized fraud, are prevalent in internet advertising and e-commerce, causing significant economic losses to businesses. Existing technologies largely rely on static rules or single-dimensional statistical features for detection, making it difficult to effectively capture dynamically evolving fraud patterns. Traditional methods often lack in-depth analysis of the temporal patterns of user behavior, failing to accurately identify fraudulent traffic with abnormal temporal rhythms, and exhibiting significant shortcomings in real-time performance and adaptability. Furthermore, most systems rely on fixed thresholds, making it difficult to adapt to changes in traffic distribution, resulting in high false positive rates or severe missed detections, failing to achieve accurate risk control while ensuring user experience.

[0003] To address the above problems, this invention proposes a solution. Summary of the Invention

[0004] To overcome the aforementioned deficiencies of the prior art, embodiments of the present invention provide a real-time traffic fraud detection method that integrates user behavior time-series analysis to solve the problems mentioned in the background art.

[0005] To achieve the above objectives, the present invention provides the following technical solution:

[0006] A real-time detection method for traffic fraud that integrates user behavior time-series analysis, including the following steps;

[0007] Step S1: Aggregate the real-time log stream using short and long windows, extract the time series features of user behavior, and construct cross- and count static features by combining contexts such as device, network, and ad placement. Use the ratio of short window click-through rate to long window click-through rate and the coefficient of variation of click interval to jointly determine whether there is an abnormal rhythm in user behavior.

[0008] Step S2 involves inputting the generated static and temporal features into a pre-trained offline classification model, which outputs a risk score for each request. Finally, the risk score output by the model and the business-defined scoring threshold are used to determine whether to grant permission directly or consider the request to have a high risk of fraud.

[0009] Step S3: For high-fraud risk traffic, set dual thresholds according to business objectives for fine classification. Make further judgment based on the combination of model score and the scoring threshold corresponding to target F1, and output three actions: block, review, or pass.

[0010] Step S4: Deploy the model and threshold strategy to real-time via a grayscale approach, continuously monitor model performance and latency, and trigger rollback or model iteration when the model's F1 score drops and latency exceeds the upper limit, periodically collect new labeled samples, retrain the model, and update the threshold according to new business requirements.

[0011] In a preferred embodiment, step S1 includes the following:

[0012] Real-time user behavior logs are aggregated and statistically analyzed according to preset short and long time windows to extract time-series feature parameters;

[0013] Calculate the ratio of short window click-through rate to long window click-through rate, and combine it with the coefficient of variation of click interval to determine whether there is an abnormal rhythm;

[0014] Collect static fields such as device fingerprints, network addresses, and ad placement identifiers, and construct cross-features;

[0015] Introduce user behavior heatmap analysis to statistically analyze the distribution of behavioral heat on the interface or geographical dimension, and set dynamic heat thresholds based on historical data to identify abnormal clusters.

[0016] The combined click-through rate ratio, behavioral popularity, time interval coefficient of variation, and dynamic weight are used to form a set of parameters for judging whether a single request is abnormal.

[0017] The combined parameters include click-through rate ratio × behavior popularity and time interval variation coefficient × dynamic weight. The click-through rate ratio × behavior popularity is a parameter obtained by multiplying the click-through rate ratio of a short time window by the behavior popularity of the corresponding request's region or interface position. The time interval variation coefficient × dynamic weight is a parameter obtained by multiplying the coefficient of variation of the click time interval by the above dynamically adjusted weight.

[0018] If either of the two sets of combined parameters exceeds a preset threshold, the request is preliminarily identified as having an abnormal rhythm.

[0019] In a preferred embodiment, step S2 includes the following:

[0020] The feature vector containing time-series statistical features, static cross features, and behavioral heatmap features is input into the pre-trained classification model, and the risk score is output.

[0021] The initial score threshold is dynamically optimized online by combining a reinforcement learning threshold adjuster to adapt to changing fraudulent behavior and traffic environment;

[0022] The threshold adjuster uses reinforcement learning algorithms to dynamically update and optimize the threshold online. It treats real-time detection as a reinforcement learning agent, periodically evaluates the detection results under the current threshold and gives rewards or penalties. The state of reinforcement learning is defined as the statistics of recent model judgment results, and the action is to make small adjustments to the threshold. The reward function is designed in combination with the model's false alarm rate and false negative rate.

[0023] For each request, calculate or obtain the risk score output by the model and compare it with the threshold dynamically determined by reinforcement learning. If the risk score exceeds the current threshold, the request is marked as high fraud risk and enters the subsequent high-risk traffic processing flow.

[0024] If the score is lower than or equal to the threshold, the request is treated as normal traffic and allowed to pass.

[0025] In a preferred embodiment, step S3 includes the following:

[0026] Set a low-risk threshold and high risk threshold A second assessment is conducted on high-risk requests;

[0027] Based on whether the score exceeds Between and Between or below Each action is to block, verify, or pass;

[0028] Linked with the dynamic threshold in step S2, The trade-off point is set based on the model's high accuracy points on the validation set or the target F1 score.

[0029] In a preferred embodiment, step S4 includes the following:

[0030] Deploy models and strategies gradually in a gray-scale manner, and monitor the effects and latency metrics.

[0031] When the F1 value continues to decrease and the delay exceeds the limit, a rollback to the old model or the start of the model iteration process is triggered.

[0032] Periodically collect newly labeled samples to retrain the model, and update the thresholds based on the new data distribution and business needs;

[0033] Continuously monitor model performance and latency. When the model's F1 score drops and latency exceeds the upper limit, trigger a rollback or model iteration, periodically collect new labeled samples, retrain the model, and update the thresholds according to new business needs.

[0034] When online monitoring detects a significant drop in the model's F1 score and latency exceeding the upper limit, an emergency response mechanism is triggered, automatically executing either a rollback or model iteration plan. Rollback involves switching the detection back to the previous stable model or strategy, while model iteration initiates a model improvement process that includes data collection, retraining, and strategy adjustment.

[0035] Regularly collect fraudulent and legitimate samples from the internet that have been manually verified, add them to the training set to retrain the model, re-evaluate the threshold settings, and adjust the initial threshold.

[0036] The technical effects and advantages of this invention's real-time traffic fraud detection method that integrates user behavior time-series analysis are as follows:

[0037] This invention, by integrating user behavior time-series analysis with multi-dimensional contextual features, can more accurately capture the dynamic behavior patterns of fraudulent traffic, and is particularly adept at identifying cheating behaviors with fixed rhythms or sudden clustering. It adopts reinforcement learning to dynamically adjust thresholds, enabling the system to have online self-optimization capabilities, significantly reducing false positive and false negative rates. The dual-threshold grading mechanism ensures the effectiveness of risk control while minimizing interference with normal users.

[0038] Furthermore, through canary deployment and continuous monitoring mechanisms, the system possesses excellent scalability and stability, enabling it to adapt to long-term business changes and the evolution of fraudulent methods, thus demonstrating high practical value and promising prospects for widespread adoption. Attached Figure Description

[0039] Figure 1 This is a schematic diagram of the real-time traffic fraud detection method that integrates user behavior time-series analysis according to the present invention.

[0040] Figure 2 This is a schematic diagram illustrating the steps of the real-time traffic fraud detection method that integrates user behavior time-series analysis according to the present invention. Detailed Implementation

[0041] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0042] Example

[0043] Please see Figures 1 to 2 As shown, this invention discloses a real-time detection method for traffic fraud that integrates user behavior time-series analysis, including the following steps:

[0044] Step S1: Aggregate the real-time log stream using short and long windows, extract the time series features of user behavior, and construct cross- and count static features by combining contexts such as device, network, and ad placement. Use the ratio of short window click-through rate to long window click-through rate and the coefficient of variation of click interval to jointly determine whether there is an abnormal rhythm in user behavior.

[0045] Step S2 involves inputting the generated static and temporal features into a pre-trained offline classification model, which outputs a risk score for each request. Finally, the risk score output by the model and the business-defined scoring threshold are used to determine whether to grant permission directly or consider the request to have a high risk of fraud.

[0046] Step S3: For high-fraud risk traffic, set dual thresholds according to business objectives for fine classification. Make further judgment based on the combination of model score and the scoring threshold corresponding to target F1, and output three actions: block, review, or pass.

[0047] Step S4: Deploy the model and threshold strategy to real-time via a grayscale approach, continuously monitor model performance and latency, and trigger rollback or model iteration when the model's F1 score drops and latency exceeds the upper limit, periodically collect new labeled samples, retrain the model, and update the threshold according to new business requirements.

[0048] In step S1, the real-time log stream is aggregated using short and long windows to extract time-series features of user behavior. These features are then combined with contextual information such as device, network, and ad placement to construct cross-cutting and counting static features. The ratio of short-window click-through rate to long-window click-through rate and the coefficient of variation of click interval are used to jointly determine whether there are abnormal rhythms in user behavior. Specific details include...

[0049] The real-time generated user behavior logs are aggregated and statistically analyzed according to preset short and long time windows, and time-series related feature parameters are extracted. The user behavior logs are all recordable interactive events and their contexts that occur in e-commerce, advertising applications or web pages. They are event-level records written by the front-end SDK, tracking scripts or gateways, and the server according to timestamps when the events occur.

[0050] For example, a short time window can be set to, say, 5 minutes, and a long time window can be set to 1 hour. The specific time window length can be configured according to business needs.

[0051] User click behavior data is aggregated within each short time window and compared with user click behavior data collected in a long time window to calculate the click-through rate ratio (CTR) metric, which is expressed as the ratio of the CTR within the short time window to the CTR within the long time window.

[0052] Click-through rate (CTR) is the ratio of the number of clicks to the number of impressions of an ad within a given time period, reflecting the frequency of user clicks. By comparing the CTR of a short-term window with that of a long-term window, the degree of abnormality of recent click frequency relative to the historical average can be measured.

[0053] If the click-through rate (CTR) is significantly higher than the long-term average in a short period of time, that is, the CTR ratio is much greater than 1, it indicates an abnormal surge in clicks, which may be caused by traffic fraud. Conversely, if the CTR ratio drops sharply in a short period of time, it may also reflect abnormal behavior, but fraudulent traffic usually pays more attention to the situation of a surge in clicks.

[0054] At the same time, the coefficient of variation of user behavior events is also calculated within a short time window. The coefficient of variation of the time interval refers to the dispersion of the time interval between two adjacent click events. It is measured by the statistical coefficient of variation (CV), which is the ratio of the standard deviation of the time interval to its mean. It reflects the regularity of the user's click rhythm. When the time intervals of a series of clicks are almost equal, the coefficient of variation approaches 0; when the intervals are of different lengths and have large random fluctuations, the coefficient of variation is higher.

[0055] Clicks by normal human users are often random, with varying time intervals and a relatively high coefficient of variation. In contrast, cheating programs often trigger clicks at a fixed frequency, resulting in almost constant time intervals, extremely low coefficients of variation, and a pattern of uniformly spaced clicks. Therefore, by monitoring the coefficient of variation of click time intervals over a period of time, suspicious regular click behaviors can be identified.

[0056] For example, if a device consistently displays clicks at intervals close to a fixed value, such as clicking once every 10 seconds, it is highly likely that a spoofing program is being executed, which constitutes click fraud with an abnormal rhythm.

[0057] By using two time-series statistical features—the ratio of short-window CTR to long-window CTR and the coefficient of variation of time intervals—the temporal anomaly characteristics of traffic can be preliminarily characterized, laying the foundation for subsequent detection.

[0058] Secondly, while aggregating logs, collect various static field information carried by each request, including device fingerprint, network address and ad placement identifier;

[0059] Among them, device fingerprint refers to a set of characteristic information used to uniquely identify a user device, such as the device's hardware serial number, operating version, browser characteristic string, etc., which can be used to identify the same physical device or environment;

[0060] A network address refers to an IP address, which can be used to identify the network region from which a request originates; an ad placement refers to the location or ID of an ad on an application page, used to identify which specific ad display area generated the click. Because a single field is often insufficient to fully describe abnormal behavior patterns;

[0061] Cross features are constructed on the above static fields. Cross features refer to new features formed by combining two or more original features in order to capture the correlation between the features.

[0062] The analysis of user behavior heatmaps has been added as an auxiliary feature. This feature represents the distribution of user click locations on the application interface or the geographical distribution of online activities in a visual heatmap. By statistically analyzing the location coordinates or geographical locations of a large number of user interaction events, the heatmap can be used to obtain the heatmap distribution of behavior across the entire application interface or map. Under normal circumstances, the heatmap distribution of user behavior should be consistent with the interface layout or user geographical distribution, being relatively dispersed and conforming to a certain pattern. However, when a large number of abnormal clicks occur, abnormally clustered high-heat areas often form on the heatmap. If a certain coordinate area is clicked far more times than normal in a short period of time, forming a conspicuous high-heat red dot, it may mean that a program is simulating repeated clicks at that location. Geographically, if a large number of clicks are concentrated in a certain local area and far exceed the normal user base in that area, it is also a kind of abnormal clustering phenomenon.

[0063] Therefore, behavioral heatmap analysis is introduced. By monitoring the spatial distribution of user behavior, the heat distribution of user behavior on interface elements or geographical locations is statistically analyzed periodically, for example, every N hours, and a heat threshold is calculated. The heat threshold refers to the upper limit of the heat value determined based on historical normal data. Areas above this value can be regarded as abnormal hot spots.

[0064] The heat threshold can be dynamically adjusted according to the statistical quantile, so that under normal circumstances, only a very few areas with the highest heat will exceed the threshold. When an area is detected to have heat exceeding the heat threshold, it can be determined that a large-scale abnormal cluster has occurred, indicating potential gang fraud activities or centralized operation of automated programs. Through the geographic heat map, it can be found that the click requests of a certain marketing campaign are highly concentrated in a remote area, which is not normal. The relevant requests in that area may need to be reviewed more closely.

[0065] Finally, the various features obtained above are combined to form a set of parameters for judging whether a single request is abnormal, including click-through rate ratio × behavior popularity and time interval variation coefficient × dynamic weight.

[0066] Click-through rate ratio × behavior heat is a parameter obtained by multiplying the short-term window CTR ratio by the behavior heat of the corresponding request's region or interface position. On the one hand, a high short-term window CTR ratio indicates an abnormal increase in recent click frequency. On the other hand, the request falls in a cluster area of ​​high behavior heat. If both are high, the product will also show a high value, which means that the request is likely to belong to a concentrated and high-frequency abnormal click event, that is, it has an obvious abnormal rhythm.

[0067] The time interval variation coefficient × dynamic weight is a parameter obtained by multiplying the coefficient of variation of the click time interval by the above dynamically adjusted weight. The dynamic weight can be regarded as a coefficient that is dynamically adjusted according to the context, used to balance the influence of the interval regularity in different scenarios.

[0068] For example, when traffic is low at night, the weight of abnormal intervals can be increased to more sensitively capture bot frequency fraud, while the weight can be appropriately reduced during peak traffic periods to reduce false positives. By introducing dynamic weights, the degree of attention to abnormal click rhythms can be adaptively adjusted for different business scenarios, avoiding missed or false positives caused by using fixed thresholds. When the coefficient of variation of a request's time interval × dynamic weight parameter is too high, it indicates that the click time interval pattern of the sequence in which the request is located is obviously abnormal, which should raise a red flag.

[0069] In summary, the two sets of combined parameters reflect whether the request's behavioral rhythm is abnormal from the perspectives of click frequency and spatial clustering, as well as the regularity of click intervals. Using the two sets of combined parameters as the basis for judgment, if either of the combined parameters deviates significantly from the normal range, i.e. exceeds the preset threshold, it can be preliminarily determined that the request has an abnormal rhythm.

[0070] In step S2, the generated static and temporal features are input into a pre-trained offline classification model, which outputs a risk score for each request. Finally, the risk score output by the model and the scoring threshold set by the business are used to determine whether to grant permission directly or consider it to have a high risk of fraud. Specific details include...

[0071] After completing the above feature extraction, each request is represented as a high-dimensional feature vector, which includes time-series statistical features such as short window click-through rate ratio and time interval variation coefficient, static fields and their cross features such as device fingerprint ID, IP address and ad placement combination features, behavioral heatmap related features such as the popularity value of the region, whether the popularity threshold is exceeded, and rhythm anomaly markers based on rule judgment.

[0072] The feature vector is input into a pre-trained fraud detection model to obtain a risk score corresponding to the request, which is then processed and calculated using a tree model based on a random forest of decision trees.

[0073] Tree models are used to quickly and accurately model structured features, while deep learning models capture user behavior sequence features. The two are then combined to improve performance.

[0074] After the model outputs a risk score for each request, it compares it with a preset initial score threshold to determine whether the request should be considered high-risk for fraud. At the start of deployment, an initial score threshold needs to be set based on historical model performance data as a cutoff value for the risk score. When the score is higher than this value, the model determines that the request is suspected of fraud; if it is lower, it is considered normal.

[0075] The initial score threshold is selected with reference to the model's performance metrics on the validation set. For example, the score that makes the balance between a certain evaluation metric, such as F1 score or precision and recall, optimal is selected as the starting point. For example, if the model achieves the best overall performance around the threshold of 0.7 in offline testing, then 0.7 can be used as the initial threshold. Static thresholds are difficult to adapt to the constantly changing fraud behavior and traffic environment in the long term. Therefore, a threshold regulator is introduced to dynamically update and optimize the threshold online using reinforcement learning algorithms.

[0076] The threshold adjuster treats the initial score threshold as a decision parameter that needs to be optimized. Through reinforcement learning, it learns autonomously how to adjust the threshold to achieve better detection results during operation. Real-time detection is regarded as the intelligent agent of RL, which periodically evaluates the detection results under the current threshold and gives rewards or penalties accordingly to guide the direction of threshold adjustment. The state of RL is defined as the statistics of recent model judgment results, such as false positive rate and false negative rate within a certain time window. The action is to make small adjustments to the threshold. The reward function is designed based on the model's false positive rate and false negative rate.

[0077] The false positive rate usually refers to the proportion of normal traffic that is incorrectly labeled as fraudulent, i.e., the false positive rate. The false negative rate refers to the proportion of fraudulent traffic that is not identified and is let through, i.e., the false negative rate. The reward function is set to be related to the key performance indicators of detection, such as the model's combined performance of precision and recall, rewarding high precision and high recall while penalizing false positives and false negatives.

[0078] Each threshold adjustment is treated as an action, and rewards are given based on the improvement in precision and recall after the adjustment. If lowering the threshold results in a greater increase in recall with a limited increase in false positives, a reward is given; if the threshold adjustment leads to a significant drop in precision, a penalty is imposed. Through this reward and penalty feedback mechanism, the RL agent can gradually learn the optimal threshold setting under the current traffic distribution to achieve the required balance between precision and recall for the business.

[0079] Through online learning of the threshold regulator, the threshold is no longer fixed but can adaptively adjust over time. For example, when an increase in recent fraudulent activities leads to higher false negatives, the RL agent may appropriately lower the threshold to improve model sensitivity and capture more suspicious traffic; conversely, when a high false positive rate interferes with normal users, the agent will raise the threshold to reduce the interception of edge instances, thereby improving the user experience. This dynamic threshold adjustment is equivalent to giving the agent the ability to optimize according to environmental changes, which is more timely and effective than manual static setting. After a period of training, the threshold regulator will converge to an equilibrium point, achieving a better trade-off between the model's precision and recall.

[0080] In the real-time decision-making process, this step actually considers two key parameters: the risk score output by the model and the threshold dynamically determined through reinforcement learning. For each request, these two parameters are calculated or obtained simultaneously and then compared. If the risk score exceeds the current threshold, the request is marked as high-risk fraud and enters the subsequent high-risk traffic processing flow; if the score is below or equal to the threshold, the request is considered to have no obvious signs of fraud and is directly treated as normal traffic and allowed to pass.

[0081] The continuous output of complex models is simplified into a threshold-based binary decision, which facilitates the execution of subsequent actions. At the same time, since the initial score threshold is continuously adaptively optimized, this decision criterion maintains reasonable sensitivity and specificity as the environment changes.

[0082] In step S3, high-fraud-risk traffic is finely classified according to dual thresholds set based on business objectives. Further judgment is made based on the model score and the scoring threshold corresponding to the target F1, outputting one of three actions: blocking, review, or approval. Specific details include...

[0083] For traffic initially identified as high-risk suspicious traffic and normal traffic, a dual-threshold mechanism is introduced for fine-grained classification, with a low-risk threshold pre-set based on business objectives. and high risk threshold And ensure the settings It can be determined based on a combination of performance indicators such as model score and target F1 value;

[0084] For example, the dynamically adjusted threshold can be regarded as Then choose a higher threshold. To identify the level of fraud. The selection can be based on the model's score at a high precision point on the validation set, or by analyzing the precision and recall curves corresponding to the target F1 score to determine a trade-off point, with the expectation that... The corresponding rating at a higher confidence level The scores corresponding to higher coverage create a tiered screening range.

[0085] The specific decision-making strategy is to further classify requests already marked as high-risk based on a higher threshold. A second judgment is made, triggering different actions.

[0086] Score exceeded The traffic has been classified as the highest risk level, with an extremely high score, and it can be almost certainly identified as fraudulent traffic. Therefore, blocking measures will be implemented directly, namely, intercepting the request or rejecting the transaction.

[0087] For example, for ad clicks, you can choose not to charge and reject subsequent related requests; for API requests, you can directly return an error or a CAPTCHA challenge. The blocking action aims to cut off obvious fraudulent behavior in a timely manner and prevent it from continuing to harm the business. Due to the use of high thresholds, the probability of false blocking is extremely low, ensuring that most of the blocked behaviors are undoubtedly fraudulent.

[0088] Score at and If the risk level is between these, it is determined to be medium risk, which is in the suspicious range. The model believes that there is a certain probability of fraud, but it is not high enough to draw a direct conclusion. Therefore, a review process is adopted, which means that the request is marked as suspicious and handed over to a manual or secondary review process.

[0089] For example, the key operations of the request can be recorded and suspended, triggering a manual review queue, allowing risk control personnel to judge the authenticity based on more context; or a secondary verification process can be initiated, such as sending SMS verification codes or requiring users to complete human-machine verification, to further confirm the authenticity of user behavior. The review strategy can give edge cases a chance to be reviewed while ensuring that risks are controllable, thereby minimizing the interference of false alarms on normal users.

[0090] Score below If a risk level is determined to be low, even if it is considered a high-risk candidate in step two, a further comparison will reveal that its risk score does not reach the lower threshold. Pass directly;

[0091] The dual-threshold strategy described above allows for a more flexible balance between precision and recall based on business strategies.

[0092] For example, if you place great importance on user experience, you can increase the [adjustment / adjustment]. and The overall level ensures that only requests with very high scores enter the review and blocking process, thereby reducing disturbance to normal users; conversely, during periods of high fraud incidence, two thresholds can be lowered to increase the blocking effect.

[0093] It should be noted that the threshold Essentially, it can be linked to the dynamic threshold in step two. The RL regulator provides a basic threshold reference, and then the policy module further subdivides it based on this. To achieve two-level classification.

[0094] The dual-threshold strategy ultimately classifies all requests into three categories: safe passage, suspicious pending investigation, and definitive blocking, achieving hierarchical risk control and assigning corresponding actions to downstream processes.

[0095] In step S4, the model and threshold strategy are deployed to real-time via a canary deployment method. Model performance and latency are continuously monitored. When the model's F1 score decreases and latency exceeds the upper limit, a rollback or model iteration is triggered. New labeled samples are periodically collected, the model is retrained, and the threshold is updated according to new business requirements. Specific details include...

[0096] The model and threshold strategy are deployed to actual real-time detection, focusing on the model deployment method, online performance monitoring, and the continuous optimization and update mechanism of the model and threshold, so as to ensure that the method of the present invention can play a stable and efficient role in the long term.

[0097] To reduce the risk of new models or strategies impacting existing network services, a gradual deployment approach is adopted. In the initial stage of deployment, only a portion of traffic, such as 5% or 10% of random requests, is introduced into the new fraud detection model and strategy, while the remaining traffic continues to follow the original path. The detection results of the new model on this portion of traffic and its impact on business metrics are monitored. If everything is normal, the traffic proportion is gradually increased, and eventually the old model is fully replaced.

[0098] During canary deployments, key performance indicators (KPIs) are monitored, including the accuracy of model assessments and the impact on operational overhead. This allows for early detection of potential issues and rapid rollback, avoiding uncontrollable problems that might arise from a one-time full deployment. The deployment is increased gradually according to a pre-defined canary plan. For example, deploying 1% of traffic on the first day, observing no significant increase in false positives, then increasing to 10%, then to 50% after one week, and finally to 100%. Simultaneously, during the canary deployment period, differences between the old and new outputs are collected to analyze for any missed or misjudged errors, continuously optimizing model parameters to ensure a smooth transition.

[0099] Once the model and strategy are deployed in the real-time operating environment, a comprehensive online monitoring mechanism should be established to continuously track model performance and operating metrics.

[0100] The first step is to monitor the model's performance metrics, such as the performance of classification metrics like Precision, Recall, F1 score, and AUC on actual online data. Among these, the F1 score, which is the harmonic mean of precision and recall, is a commonly used comprehensive metric and is one of the main monitoring targets.

[0101] If a significant downward trend is observed in the model's F1 score, such as falling below the previous baseline level and continuing to decline over a period of time, it indicates that the model's ability to identify the latest fraudulent activities may be weakening, which should be noted. The reasons for the decline in F1 may be that the evolution of fraudulent methods has led to the failure of model features, data distribution drift, or the model itself has become outdated.

[0102] Simultaneously monitor performance metrics such as latency, which is the processing delay added to real-time requests during the entire detection decision process. If the latency exceeds the upper limit, for example, if a certain business requires the detection to be completed within 50 milliseconds, and the average latency is found to exceed this threshold, it indicates that the model complexity or server load may be too high, affecting real-time performance, and it also needs to be dealt with in a timely manner.

[0103] The model performance and latency are the two main monitoring dimensions. When online monitoring finds that the model F1 index drops significantly and latency exceeds the standard at the same time, the emergency handling mechanism is triggered. When it is detected that the model effect and running efficiency are both substandard, it can be confirmed that it is no longer in the best state and strategy adjustment is required.

[0104] Once the above abnormal conditions are triggered, the predetermined rollback or model iteration scheme will be executed automatically. Rollback means switching the detection back to the stable model or strategy of the previous version.

[0105] For example, if the latest model performs worse than expected and impacts business, the system should quickly revert to the previous version to minimize losses. With canary deployment, the impact can be limited to the traffic covered by the new model, without affecting the normal operation of other businesses. On the other hand, model iteration refers to initiating a new round of model improvement processes, including data collection, retraining, and strategy adjustment.

[0106] Specifically, the focus will be on analyzing fraudulent samples missed by the current model and including incorrectly blocked normal samples in subsequent training sets. Furthermore, new fraud trends will be analyzed using expert rules, new features will be designed, or model hyperparameters will be adjusted. The model will then be retrained based on the latest full dataset to improve its ability to identify new types of fraud. For example, after a period of operation, if certain fraudulent clicks are found to differ from past behavioral patterns and are not effectively detected by the model, features targeting these patterns will need to be introduced or the model structure adjusted in the next version to enable it to learn the new patterns.

[0107] During model retraining, the threshold settings are re-evaluated. Based on the new model output distribution and business requirements, the initial threshold is adjusted to allow the reinforcement learning threshold adjuster to continue functioning in the new environment. Periodically collecting new labeled samples is crucial for maintaining model vitality. Typically, this is done regularly, such as monthly or quarterly, by collecting manually verified fraudulent and legitimate samples online and adding them to the training set to update the model, thereby achieving continuous learning.

[0108] The above formulas are all dimensionless calculations. The formulas are derived from software simulations based on a large amount of collected data to obtain the most recent real-world results. The preset parameters in the formulas are set by those skilled in the art according to the actual situation.

[0109] The above embodiments can be implemented, in whole or in part, by software, hardware, firmware, or any other combination thereof. When implemented using software, the above embodiments can be implemented, in whole or in part, in the form of a computer program product.

[0110] Those skilled in the art will recognize that the modules and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and inventive constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0111] In addition, the functional modules in the various embodiments of this application can be integrated into one processing module, or each module can exist physically separately, or two or more modules can be integrated into one module.

[0112] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0113] Finally, the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A real-time detection method for traffic fraud integrating user behavior time-series analysis, characterized in that, Includes steps; Step S1: Aggregate the real-time log stream using short and long windows, extract the time series features of user behavior, and construct cross- and count static features by combining contexts such as device, network, and ad placement. Use the ratio of short window click-through rate to long window click-through rate and the coefficient of variation of click interval to jointly determine whether there is an abnormal rhythm in user behavior. Step S2: Input the generated static features and time-series features into the pre-trained offline classification model, output the risk score of each request, and finally use the risk score output by the model and the scoring threshold set by the business to jointly determine whether to directly allow the request or consider it to have a high risk of fraud. Step S3: For high-fraud risk traffic, set dual thresholds according to business objectives for fine classification. Make further judgment based on the combination of model score and the scoring threshold corresponding to target F1, and output three actions: block, review, or pass. Step S4: Deploy the model and threshold strategy to real-time via a grayscale approach, continuously monitor model performance and latency, and trigger rollback or model iteration when the model's F1 score drops and latency exceeds the upper limit, periodically collect new labeled samples, retrain the model, and update the threshold according to new business requirements.

2. The real-time traffic fraud detection method based on user behavior time-series analysis according to claim 1, characterized in that, Real-time user behavior logs are aggregated and statistically analyzed according to preset short and long time windows to extract time-series feature parameters; Calculate the ratio of short window click-through rate to long window click-through rate, and combine it with the coefficient of variation of click interval to determine whether there is an abnormal rhythm.

3. The real-time detection method for traffic fraud based on integrated user behavior time-series analysis according to claim 2, characterized in that, Collect static fields such as device fingerprints, network addresses, and ad placement identifiers, and construct cross-features; Introducing user behavior heatmap analysis, statistically analyzing the distribution of behavioral heat on the interface or geographical dimension, and setting dynamic heat thresholds based on historical data to identify abnormal clusters.

4. The real-time traffic fraud detection method based on user behavior time-series analysis according to claim 2, characterized in that, The combined click-through rate ratio, behavioral popularity, time interval coefficient of variation, and dynamic weight are used to form a set of parameters for judging whether a single request is abnormal. The combined parameters include click-through rate ratio × behavior popularity and time interval variation coefficient × dynamic weight. The click-through rate ratio × behavior popularity is a parameter obtained by multiplying the click-through rate ratio of a short time window by the behavior popularity of the corresponding request's region or interface position. The time interval variation coefficient × dynamic weight is a parameter obtained by multiplying the coefficient of variation of the click time interval by the above dynamically adjusted weight. If either of the two sets of combined parameters exceeds a preset threshold, the request is preliminarily identified as having an abnormal rhythm.

5. The real-time traffic fraud detection method based on user behavior time-series analysis according to claim 1, characterized in that, The feature vector containing time-series statistical features, static cross features, and behavioral heatmap features is input into the pre-trained classification model, and the risk score is output. The initial score threshold is dynamically optimized online by combining a reinforcement learning threshold adjuster to adapt to changing fraudulent behavior and traffic environment.

6. The real-time traffic fraud detection method based on user behavior time-series analysis according to claim 5, characterized in that, The threshold adjuster uses reinforcement learning algorithms to dynamically update and optimize the threshold online. It treats real-time detection as a reinforcement learning agent, periodically evaluates the detection results under the current threshold and gives rewards or penalties. The state of reinforcement learning is defined as the statistics of recent model judgment results, and the action is to make small adjustments to the threshold. The reward function is designed in combination with the model's false alarm rate and false negative rate. For each request, calculate or obtain the risk score output by the model and compare it with the threshold dynamically determined by reinforcement learning. If the risk score exceeds the current threshold, the request is marked as high fraud risk and enters the subsequent high-risk traffic processing flow. If the score is lower than or equal to the threshold, the request is treated as normal traffic and allowed to pass.

7. The real-time traffic fraud detection method based on user behavior time-series analysis according to claim 1, characterized in that, Set a low-risk threshold and high risk threshold A second assessment is conducted on high-risk requests; Based on whether the score exceeds Between and Between or below Each of these actions will perform either blocking, verification, or approval.

8. The real-time traffic fraud detection method based on user behavior time-series analysis according to claim 7, characterized in that, Linked with the dynamic threshold in step S2, The trade-off point is set based on the model's high accuracy points on the validation set or the target F1 score.

9. The real-time detection method for traffic fraud based on integrated user behavior time-series analysis according to claim 1, characterized in that, Deploy models and strategies gradually in a gray-scale manner, and monitor the effects and latency metrics. When the F1 value continues to decrease and the delay exceeds the limit, a rollback to the old model or the start of the model iteration process is triggered. The model is retrained by periodically collecting newly labeled samples, and the thresholds are updated based on the new data distribution and business needs.

10. The real-time detection method for traffic fraud based on integrated user behavior time-series analysis according to claim 9, characterized in that... Continuously monitor model performance and latency. When the online monitoring detects a drop in the model's F1 score and a latency exceeding the upper limit, trigger a rollback or model iteration, periodically collect new labeled samples, retrain the model, and update the thresholds according to new business needs. When online monitoring detects a significant drop in the model's F1 score and latency exceeding the upper limit, an emergency response mechanism is triggered, automatically executing either a rollback or model iteration plan. Rollback involves switching the detection back to the previous stable model or strategy, while model iteration initiates a model improvement process that includes data collection, retraining, and strategy adjustment. Regularly collect fraudulent and legitimate samples from the internet that have been manually verified, add them to the training set to retrain the model, re-evaluate the threshold settings, and adjust the initial threshold.

Images