Electric power marketing anti-cheating method and system

Abstract

The invention discloses an electric power marketing anti-cheating method and system. The method comprises the following steps: acquiring multi-source heterogeneous data associated with a payment behavior in an electric power marketing activity; performing feature extraction processing on the multi-source heterogeneous data, and constructing a payment behavior knowledge graph based on the obtained transaction feature data, behavior feature data and relation feature data; analyzing the interaction frequency and association strength among the nodes in the payment behavior knowledge graph to generate potential cheating data; obtaining full-link operation sequence data corresponding to the potential cheating data, and performing time sequence verification on the potential cheating data based on the full-link operation sequence data to obtain target cheating data; performing abnormal risk assessment processing on the target cheating data to obtain a behavior security level corresponding to the target cheating data; and executing an anti-cheating strategy matched with the behavior security level. According to the method, reasonable distribution of marketing resources and healthy operation of business activities are guaranteed.

Description

Technical Field

[0001] This invention relates to the field of information processing technology, and in particular to a method and system for preventing fraud in electricity marketing. Background Technology

[0002] Against the backdrop of electricity bill collection platforms widely implementing electricity marketing activities such as recharge discounts and coupon distribution to increase user activity, large-scale arbitrage attacks by "coupon hunters" have become a prominent pain point in the industry. These groups control a large number of virtual accounts, group control devices, and dynamic IP proxies to simulate normal users participating in activities, maliciously seizing marketing funds that should benefit genuine users. This directly leads to the ineffective consumption of the platform and power company's activity budgets, seriously disrupting the normal order and fairness of electricity marketing activities.

[0003] Existing anti-fraud technologies mostly rely on single-point risk characteristics such as the frequency of requests from a single IP address and the number of times a single account participates to make rule judgments and build defense rules. However, when faced with the evasion methods of black market gangs that disperse attack traffic and keep the behavior indicators of a single node within the threshold, it is difficult to identify group-collaborative fraud behaviors such as "multiple accounts sharing device fingerprints" and "centralized payment for the same batch of accounts". There is a lack of countermeasures against group-collaborative fraud by black market gangs, which makes anti-fraud defenses ineffective against large-scale arbitrage attacks.

[0004] This passive, single-point defense model allows large-scale arbitrage activities by criminal gangs to easily bypass monitoring, making it difficult for anti-fraud systems to effectively intercept them. Ultimately, this leads to the malicious appropriation of marketing funds, failing to achieve the core objectives of anti-fraud technology in protecting marketing resources and maintaining the fairness of activities. Summary of the Invention

[0005] This invention provides a method and system for combating fraud in electricity marketing, enabling accurate and real-time identification and handling of professional and large-scale arbitrage activities.

[0006] To address the aforementioned technical problems, this invention provides a method for combating fraud in electricity marketing, comprising: Acquire multi-source heterogeneous data related to payment behavior in electricity marketing activities; Feature extraction processing is performed on the multi-source heterogeneous data to obtain transaction feature data, behavioral feature data, and relationship feature data; A knowledge graph of payment behavior is constructed based on the transaction feature data, the behavioral feature data, and the relationship feature data; The frequency of interaction and the strength of association between nodes in the payment behavior knowledge graph are analyzed to identify high-risk association groups, and potential fraud data is generated based on these high-risk association groups. Obtain the end-to-end operation sequence data corresponding to the potential cheating data from the multi-source heterogeneous data, and perform time-series verification on the potential cheating data based on the end-to-end operation sequence data to obtain the target cheating data; An anomaly risk assessment is performed on the target cheating data to obtain the behavioral security level corresponding to the target cheating data; Implement anti-fraud strategies that match the security level of the behavior.

[0007] As one preferred embodiment, the analysis of the interaction frequency and association strength between various nodes in the payment behavior knowledge graph yields a high-risk association group, including: The payment behavior knowledge graph is filtered to obtain a first payment behavior knowledge graph. The filtering process is designed to remove invalid edges and isolated, unrelated single nodes in the payment behavior knowledge graph whose interaction frequency is lower than a preset frequency threshold and whose interaction duration is shorter than a preset duration threshold. The nodes in the first payment behavior knowledge graph are divided into communities based on a preset clustering algorithm to obtain an initial entity cluster; The initial entity clusters are filtered based on a preset threshold set to obtain high-risk associated groups. The filtering process is designed to locate high-risk associated groups by quantifying the probability of collaborative cheating in each entity cluster.

[0008] As one preferred embodiment, the preset threshold set includes a community modularity threshold, a node connection density threshold, and a core node proportion threshold. The preset threshold set is determined based on the comparative analysis results of historical cheating cluster characteristics and normal cluster characteristics. The process of filtering the initial entity cluster based on a preset threshold set to obtain high-risk nodes includes: Determine the community modularity of each initial entity cluster, compare the community modularity with the community modularity threshold, and retain the first type of clusters whose community modularity is higher than the community modularity threshold; Determine the node connection density of each first type of cluster, compare the node connection density with the node connection density threshold, and retain the second type of cluster whose node connection density exceeds the node connection density threshold; Identify the core nodes of the associated risk resources in each of the second type of clusters, determine the proportion of core nodes in the second type of clusters, compare the proportion of core nodes with the core node proportion threshold, and identify the third type of clusters whose core node proportion reaches the core node proportion threshold as high-risk associated groups.

[0009] As one preferred embodiment, the end-to-end operation data includes timestamps, unique account identifiers, and key operation steps; The step of performing time-series verification on the potential cheating data based on the full-link operation sequence data to obtain the target cheating data includes: Based on the unique identifier of the account, the full-link operation sequence data of the same user is aggregated to obtain a standardized user behavior sequence. The aggregation process is designed to map each key operation step in the full-link operation sequence data into a standardized operation code in ascending order of timestamp. Construct an exception pattern library, which includes multiple types of preset exception patterns; The standardized user behavior sequence is matched and compared one by one with each type of preset abnormal pattern in the abnormal pattern library, and the matching abnormal pattern type and the cumulative number of times the abnormal pattern of the same account is matched are marked. Based on the abnormal pattern type and the cumulative number of hits of the abnormal pattern, the target cheating data in the potential cheating data is determined.

[0010] As one preferred embodiment, the step of performing anomaly risk assessment processing on the target cheating data to obtain the behavioral security level corresponding to the target cheating data includes: Obtain basic features, group association features, and end-to-end anomaly features associated with the target cheating data; fuse the basic features, group association features, and end-to-end anomaly features to obtain fused feature data. The fused feature data is input into a pre-trained anomaly detection model, which outputs anomaly detection results. Determine the behavioral safety level that matches the anomaly detection results.

[0011] Another aspect of the present invention provides an anti-fraud system for electricity marketing, comprising: The acquisition module is used to acquire multi-source heterogeneous data related to payment behavior in electricity marketing activities; The extraction module is used to perform feature extraction processing on the multi-source heterogeneous data to obtain transaction feature data, behavioral feature data, and relationship feature data; The construction module is used to construct a knowledge graph of payment behavior based on the transaction feature data, the behavioral feature data, and the relationship feature data; The analysis module is used to analyze the interaction frequency and association strength between various nodes in the payment behavior knowledge graph, obtain high-risk association groups, and generate potential fraud data based on the high-risk association groups. The verification module is used to acquire the end-to-end operation sequence data corresponding to the potential cheating data in the multi-source heterogeneous data, and perform time-series verification on the potential cheating data based on the end-to-end operation sequence data to obtain the target cheating data. An evaluation module is used to perform anomaly risk assessment on the target cheating data to obtain the behavioral security level corresponding to the target cheating data; An execution module is used to execute anti-fraud strategies that match the security level of the behavior.

[0012] As one preferred embodiment, the analysis module is specifically used for: The payment behavior knowledge graph is filtered to obtain a first payment behavior knowledge graph. The filtering process is designed to remove invalid edges and isolated, unrelated single nodes in the payment behavior knowledge graph whose interaction frequency is lower than a preset frequency threshold and whose interaction duration is shorter than a preset duration threshold. The nodes in the first payment behavior knowledge graph are divided into communities based on a preset clustering algorithm to obtain an initial entity cluster; The initial entity clusters are filtered based on a preset threshold set to obtain high-risk associated groups. The filtering process is designed to locate high-risk associated groups by quantifying the probability of collaborative cheating in each entity cluster.

[0013] As one preferred embodiment, the preset threshold set includes a community modularity threshold, a node connection density threshold, and a core node proportion threshold. The preset threshold set is determined based on the comparative analysis results of historical cheating cluster characteristics and normal cluster characteristics. The analysis module is also used for: Determine the community modularity of each initial entity cluster, compare the community modularity with the community modularity threshold, and retain the first type of clusters whose community modularity is higher than the community modularity threshold; Determine the node connection density of each first type of cluster, compare the node connection density with the node connection density threshold, and retain the second type of cluster whose node connection density exceeds the node connection density threshold; Identify the core nodes of the associated risk resources in each of the second type of clusters, determine the proportion of core nodes in the second type of clusters, compare the proportion of core nodes with the core node proportion threshold, and identify the third type of clusters whose core node proportion reaches the core node proportion threshold as high-risk associated groups.

[0014] As one preferred embodiment, the end-to-end operation data includes timestamps, unique account identifiers, and key operation steps; The verification module is specifically used for: Based on the unique identifier of the account, the full-link operation sequence data of the same user is aggregated to obtain a standardized user behavior sequence. The aggregation process is designed to map each key operation step in the full-link operation sequence data into a standardized operation code in ascending order of timestamp. Construct an exception pattern library, which includes multiple types of preset exception patterns; The standardized user behavior sequence is matched and compared one by one with each type of preset abnormal pattern in the abnormal pattern library, and the matching abnormal pattern type and the cumulative number of times the abnormal pattern of the same account is matched are marked. Based on the abnormal pattern type and the cumulative number of hits of the abnormal pattern, the target cheating data in the potential cheating data is determined.

[0015] As one preferred embodiment, the evaluation module is specifically used for: Obtain basic features, group association features, and end-to-end anomaly features associated with the target cheating data; fuse the basic features, group association features, and end-to-end anomaly features to obtain fused feature data. The fused feature data is input into a pre-trained anomaly detection model, which outputs anomaly detection results. Determine the behavioral safety level that matches the anomaly detection results.

[0016] Compared with the prior art, the beneficial effects of the embodiments of the present invention are at least one of the following: 1) The electricity marketing anti-fraud method provided by this invention achieves multi-dimensional and in-depth correlation analysis of user payment behavior by integrating multi-source heterogeneous data and constructing a knowledge graph of payment behavior. Compared with traditional anti-fraud methods based on rules or single features, this solution not only comprehensively considers transaction features, behavioral features, and relationship features, but also uses knowledge graph technology to mine implicit connections between users, effectively identifying high-risk association groups with a tendency to collude in fraud.

[0017] 2) This invention combines end-to-end operation sequence data for time-series verification and relies on an anomaly pattern library to achieve dynamic matching and quantitative evaluation of potential cheating behaviors, thereby effectively distinguishing between occasional anomalies and systemic cheating. Based on this, by fusing basic features, group correlation features, and end-to-end anomaly features, and inputting them into an anomaly detection model, it performs fine-grained risk assessment of target cheating data, outputting the corresponding behavioral security level, providing a scientific basis for the implementation of differentiated anti-cheating strategies. Attached Figure Description

[0018] Figure 1 This is a flowchart illustrating an anti-fraud method for electricity marketing in one embodiment of the present invention. Figure 2 This is a structural block diagram of an anti-fraud system for electricity marketing in one embodiment of the present invention; Figure label: The module consists of: 11. Acquisition module; 12. Extraction module; 13. Construction module; 14. Analysis module; 15. Verification module; 16. Evaluation module; and 17. Execution module. Detailed Implementation

[0019] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. The purpose of providing these embodiments is to make the disclosure of the present invention more thorough and comprehensive. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention.

[0020] In the description of this application, the terms "first," "second," "third," etc., are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Therefore, a feature defined with "first," "second," "third," etc., may explicitly or implicitly include one or more of that feature. In the description of this application, unless otherwise stated, "a plurality of" means two or more.

[0021] In the description of this application, it should be noted that, unless otherwise defined, all technical and scientific terms used in this invention have the same meaning as commonly understood by one of ordinary skill in the art. The terminology used in this specification is for the purpose of describing specific embodiments only and is not intended to limit the invention. Those skilled in the art can understand the specific meaning of the above terms in this application based on the specific circumstances.

[0022] One embodiment of the present invention provides a method for preventing fraud in electricity marketing. For details, please refer to [link / reference]. Figure 1 , Figure 1 The diagram shown is a flowchart illustrating an anti-fraud method for electricity marketing according to one embodiment of the present invention, which includes steps S1-S7: S1: Obtain multi-source heterogeneous data related to payment behavior in electricity marketing activities.

[0023] It should be noted that, to meet the business characteristics of "massive transaction concurrency and real-time data flow" in electricity marketing activities, this embodiment uses a distributed real-time data acquisition framework based on Apache Flink to complete the aggregation of multi-source heterogeneous data. The Apache Flink distributed real-time data acquisition framework is a distributed computing framework that supports continuous processing of streaming data, featuring high throughput, low latency, and strong fault tolerance. It is specifically designed to solve the problem of acquiring and processing massive real-time data and is suitable for the high-concurrency scenarios of electricity marketing activities.

[0024] Compared to traditional batch processing frameworks, Apache Flink supports continuous processing of streaming data, keeping data collection latency within seconds, perfectly matching the core requirements of real-time anti-fraud. The framework employs a distributed cluster architecture during deployment, using data sharding and parallel processing mechanisms to avoid data loss due to single points of failure. This ensures stable collection of all relevant data even in high-concurrency scenarios (such as peak marketing campaigns or mass attacks by malicious actors), without missing any critical operational traces.

[0025] In this embodiment, the multi-source heterogeneous data consists of multi-dimensional data from different business modules, in various formats, but directly or indirectly related to payment behavior, including transaction flow data, user account data, device fingerprint data, IP address data, and coupon issuance and redemption records.

[0026] The transaction log data includes information such as the unique identifier of each transaction, transaction amount, transaction timestamp, payment account number, payment channel, and transaction status. This data directly reflects the core characteristics of a user's payment behavior. For example, the transaction timestamp can be used to count the frequency of requests within a unit of time, and the transaction amount can be used to classify different consumption tiers to identify abnormal payment patterns.

[0027] User account data collection includes basic identity and behavioral information associated with users on the platform, such as unique account identifier, registration time, linked mobile phone number, historical transaction records, and account status (normal / frozen / abnormal). Its core function is to identify cheating characteristics such as "newly registered accounts participating in activities in bulk" and "long-dormant accounts suddenly making frequent payments." For example, newly registered accounts (registration time too short after the first coupon claim) are a common tool for "coupon hunters."

[0028] Device fingerprint data includes hardware information (device model, CPU model, memory capacity, hard drive serial number), operating system information, network settings information (network card MAC address, router identifier), browser characteristics, etc. After collection, a unique string identifier (i.e., device fingerprint) is generated through a hash algorithm or a specific encoding method. This identifier has the characteristics of being resistant to clearing and continuous tracking across sessions, which can effectively avoid cheating methods such as clearing cache and switching accounts to disguise device identity by "coupon hunters".

[0029] The IP address data is collected based on the user's actual IP address during operations, and is simultaneously linked to auxiliary information such as the IP's ISP and network type. The core value of this data lies in its integration with a subsequent IP geographic information database to determine the consistency between the user's login location and the registered location of the payment account, while also identifying commonly used resources by black market activities such as dynamic IP proxies and instant-dial IPs. For example, the same IP being associated with multiple payment accounts within a short period, frequent IP address switching, and abnormal geographical spans are all high-risk cheating signals.

[0030] The coupon issuance and redemption records collect data throughout the entire lifecycle of coupons, including the coupon's unique identifier, face value, usage threshold, issuance time, receiving account, redemption time, and the corresponding payment order number. This data is used to track the circulation of coupons and identify fraudulent behaviors such as "bulk redemption of high-value coupons," "immediate redemption of coupons after redemption," and "reuse of the same coupon by multiple accounts."

[0031] To ensure that the data can fully support subsequent feature extraction and fraud identification, this embodiment establishes a full-link data coverage mechanism during the collection process. That is, from the user's first contact with the marketing activity (registration / login) to the end of the activity (payment completed / refund terminated), all related data of key operations are fully collected without any data breakpoints.

[0032] Meanwhile, the data collection process in this embodiment strictly follows data compliance requirements, and sensitive personal information such as mobile phone numbers and ID card numbers is anonymized (e.g., only the first 3 and last 4 digits of the mobile phone number are retained). Only necessary data related to anti-fraud is collected, and no additional irrelevant user information is collected. All data storage and transmission adopt encryption protocols to prevent data leakage or tampering, while taking into account both data availability and user privacy protection.

[0033] In this embodiment, after the collection of multi-source heterogeneous data, the process does not directly proceed to the feature extraction stage. Instead, it first undergoes preprocessing operations such as cleaning and standardization to eliminate data noise and format differences. Specific preprocessing rules include data cleaning and data standardization. Data cleaning includes removing duplicate data (such as duplicate submissions of the same payment order), filtering invalid data (such as incorrectly formatted IP addresses or transaction records missing core fields), and completing missing data (such as indirectly inferring the device model through the User-Agent field for records lacking it). Data standardization involves converting data of different formats into a standard format recognizable by the system, for example, converting transaction timestamps to UTC time format and IP addresses to decimal format. The core purpose of preprocessing is to ensure data quality, avoid distortion in subsequent feature extraction due to chaotic data formats and noise, and ensure the reliability of the input data for the anti-fraud model.

[0034] S2: Perform feature extraction processing on the multi-source heterogeneous data to obtain transaction feature data, behavioral feature data, and relationship feature data.

[0035] In this embodiment, the transaction feature data includes single transaction amount, transaction time, and request frequency per unit time. It is a feature set that directly reflects the core attributes of user payment behavior, aiming to identify fraud signals such as "high-frequency payments" and "abnormal amount tier payments." The specific extraction process is as follows: Regarding transaction request frequency, a "time window sliding statistics method" is adopted. Specifically, a fixed time window is set, and the number of transaction requests corresponding to the same account, device, or IP within the window is counted. If the frequency exceeds a preset baseline (based on the 95th percentile of the average transaction frequency of normal users), it is marked as a potential anomaly. Regarding transaction amount, segmented discretization processing is adopted. Specifically, the amount is divided into fixed tiers and converted into discretized feature values ​​to avoid interference from the fluctuation of continuous amount data. At the same time, it is easier to identify the cheating pattern of "concentrating on the discount threshold (such as paying 50 yuan in a promotion of 10 yuan off for every 50 yuan spent)".

[0036] Behavioral characteristic data includes user operating habits, device stability, and consistency between login and payment locations. The specific extraction process is as follows: To quantify the similarity features of operation trajectories, the Dynamic Time Warping (DTW) algorithm is employed. Specifically, the touchscreen click sequence or mouse movement trajectory of the user throughout the entire process of "login - select coupon - enter account number - confirm payment" is first converted into screen coordinates, and then the coordinates are normalized to the [0,1] interval to eliminate differences in resolution between different devices. Subsequently, the DTW distance (i.e., the cumulative distance under the optimal matching path) between the current user's trajectory and the trajectories of other users within the same time window is calculated, and the average distance is taken as the feature value. The lower this value, the more similar the user's operation pattern is to other users (possibly a cheating group), and the more likely it is machine script or group control operation. The Dynamic Time Warping (DTW) algorithm is an algorithm used to quantify the similarity between two time series. Its core advantage is that it allows for flexible alignment of time series, making it suitable for data scenarios such as user operation trajectories where there are speed differences but consistent patterns. It can effectively identify the trajectory differences between machine scripts and human operations. To assess device stability, the Shannon-Wiener index is calculated using the device fingerprint. Specifically, within a preset historical period (e.g., the past 7 days), the number of unique user accounts (S) that logged in or transacted using the device fingerprint is counted, and a device diversity index is calculated. A higher index indicates more associated accounts, a greater probability of abuse by group control devices or shared devices, and a higher risk level. The Shannon-Wiener index is a quantitative indicator for assessing the diversity of accounts associated with a device fingerprint. It is obtained by calculating the natural logarithm of the number of accounts. A higher index indicates a greater likelihood of device abuse and is a key indicator for identifying group control devices. To address the issue of geographic consistency, the system obtains the actual location corresponding to the user's login IP based on an IP geographic information database. It then calculates the geographic distance between the actual location and the registered address of the payment account, and normalizes the distance value to the [0,1] range. The closer the normalized value is to 1, the greater the difference between the login location and the registered location, and the more likely it is to be a dynamic IP proxy, cross-regional bulk cheating, or other similar behavior.

[0037] Relationship feature data includes centralized payment mode and equipment sharing mode. The specific extraction process is as follows: For the centralized payment model, a time window T1 is set (e.g., 5 minutes, based on the time characteristics of bulk payments by black market operators). The number of independent accounts and independent devices corresponding to payment operations received by the same electricity account number within T1 is counted. When the number of independent accounts > the first threshold or the number of independent devices > the second threshold, this feature is triggered, indicating that multiple accounts or devices are making payments for the same account number in a concentrated manner, which conforms to the cheating model of "coupon hunters" who use bulk arbitrage to target account numbers. For device sharing mode, a time window T2 (e.g., 1 hour, based on normal user device usage habits) is set to count the number of independent accounts associated with the fingerprint of the same device. When the number of independent accounts exceeds the third threshold, this feature is triggered, indicating that the same device is shared by multiple accounts, which is highly likely to be a group control device or a shared cheating device; The first threshold, the second threshold, the third threshold, and other thresholds are all determined based on historical normal user behavior data statistics and black market cheating case analysis.

[0038] After the transaction feature data, behavioral feature data, and relational feature data are extracted, preprocessing operations such as standardization and normalization are required to ensure the usability and consistency of the feature data. Specifically, for continuous features such as transaction amount and geographical distance, Z-score standardization is used to convert the data into a standard normal distribution with a mean of 0 and a variance of 1, eliminating the difference in units of measurement between different feature dimensions (e.g., amount is measured in "yuan" and frequency in "times"); for features such as similarity of operation trajectories and device diversity index, they are mapped to the [0,1] interval to ensure the comparability of feature values.

[0039] S3: Construct a knowledge graph of payment behavior based on the transaction feature data, the behavioral feature data, and the relationship feature data.

[0040] In this embodiment, the three types of discrete feature data extracted in step S2—transaction, behavior, and relationship—are transformed into a visualized and associative network structure, a knowledge graph of payment behavior. This embodiment breaks the isolation of single feature data through graph-based modeling, connecting scattered entities such as accounts, devices, IPs, and electricity bill numbers through interactive relationships, providing a structured analysis carrier for subsequent mining of high-risk related groups and identification of gang cheating.

[0041] The construction of the graph first clarifies the types and attributes of nodes. Nodes are the core entities of the graph, and their design directly determines the depth of association analysis. Specifically, the node type classification is based on the business scenarios and fraud detection needs of electricity marketing activities. The graph nodes cover six core entity types: users, accounts, devices, IP addresses, coupons, and electricity account numbers, covering the entire chain of "participating entities - operational resources - business objects." Each node is associated with the corresponding feature data extracted in step S2, achieving a binding of "entity identifier + risk feature," as detailed below: Account Node: Associated with attributes such as unique account identifier, registration time, historical transaction frequency, and centralized payment flag; Device node: Associated with attributes such as device fingerprint, device diversity index, operating system version, and hardware characteristics; IP address node: Associated with IP geographic information, network type, abnormal handover flags, and other attributes; Electricity bill account number node: associated with attributes such as registered location, payment amount tier, and number of times centralized payments have been made; Coupon details: Attributes such as associated face value, usage threshold, redemption account, and abnormal redemption flag; User nodes: As the core of the association, they are bound to aggregated attributes such as all accounts under their name, frequently used devices, and historical operation patterns. Through attribute mapping, each node is not only an entity identifier but also a carrier of risk characteristics, providing data support for subsequent association strength analysis.

[0042] Edges in a graph are the core elements that connect nodes and reflect interactive relationships. Their design focuses on the strength of business interactions and risk associations between entities. Specifically, the types of edges are determined based on the actual interaction scenarios between entities, including three types of relationships: usage (e.g., account-device: the account uses the device to operate), ownership (e.g., user-account: the account belongs to a user), and access / operation (e.g., account-electricity bill number: the account pays the bill for the account number, account-coupon: the account receives / redeems the coupon).

[0043] Furthermore, the edge weights are used to quantify the degree of connection between nodes, directly affecting the accuracy of subsequent group clustering. The assignment rules are as follows: Basic weight: Calculated based on interaction frequency. For example, the higher the frequency of operations between the same account and device, the greater the basic weight of the "account-device" edge. Risk weighting: Adjustment based on the relationship features extracted by S2. For example, if the account and the account number have the feature of "centralized payment", the weight of the "account-account number" edge will be additionally weighted with a risk coefficient. Dynamic weight adjustment: The weight of the edge is not a fixed value. It is continuously updated based on real-time interaction data (such as new payment operations and device switching behavior) to ensure the real-time nature of the association strength.

[0044] S4: Analyze the interaction frequency and association strength between each node in the payment behavior knowledge graph to obtain high-risk association groups, and generate potential fraud data based on the high-risk association groups.

[0045] In this embodiment, the payment behavior knowledge graph constructed by S3 is used to accurately uncover hidden high-risk related groups through quantifying node interaction relationships, clustering analysis, and multi-dimensional filtering, thereby generating potential fraud data. This step breaks through the limitations of traditional anti-fraud single-point identification, focusing on the collaborative behavior of scattered nodes. It aggregates seemingly independent low-risk entities (accounts, devices, IPs) into high-risk groups through association strength analysis, technically solving the core problem of "wool party" dispersed attacks and evasion of single-point detection. Its technical significance lies in realizing the leap from individual risk assessment to group risk suppression, providing clear target objects for subsequent time-series verification and precise handling.

[0046] Preferably, in one embodiment of the present invention, the interaction frequency and association strength between various nodes in the payment behavior knowledge graph are analyzed to obtain a high-risk association group, including: The knowledge graph of payment behavior is filtered to obtain the first knowledge graph of payment behavior.

[0047] Specifically, preset frequency and duration thresholds are set to eliminate two types of invalid edges: edges with an interaction frequency lower than the preset frequency threshold (such as a single, brief interaction between an account and a device with no lasting connection), and edges with an interaction duration shorter than the preset duration threshold (such as an account logging into a device but not performing core operations like payment or coupon redemption, rendering the interaction meaningless). The preset frequency threshold is determined based on the 95th percentile of the average interaction frequency of historical normal users, and the preset duration threshold is set based on the minimum effective duration of normal business interactions (such as the lower limit of the average time required to complete a payment after logging in), ensuring that only valid edges with business relevance are retained. Simultaneously, single nodes without any associated edges are eliminated (such as "empty accounts" that are not bound to a device or have not initiated any transactions, or invalid IPs that are not associated with an account). These nodes lack interaction relationships with other entities and cannot form a collaborative fraud group; cleaning them up significantly reduces the computational load of subsequent cluster analysis.

[0048] The nodes in the knowledge graph of the first payment behavior are divided into communities based on a preset clustering algorithm to obtain an initial entity cluster.

[0049] The preset clustering algorithms include the Louvain community discovery algorithm or the label propagation algorithm. The Louvain algorithm aims to maximize modularity and can quickly identify tightly connected node clusters in a large-scale graph. The label propagation algorithm (LPA) does not require a preset number of clusters and achieves community division through iterative propagation of node labels. It has high computational efficiency and supports real-time or near real-time analysis.

[0050] Specifically, the knowledge graph of the first payment behavior is input into the selected algorithm. The algorithm automatically analyzes the edge weights (interaction frequency, association strength) between nodes, aggregating nodes with high edge weights and frequent interactions into the same community, forming an initial entity cluster. For example, multiple accounts frequently using the same batch of devices and paying for the same batch of electricity bills will be clustered into an initial entity cluster by the algorithm. This type of cluster is essentially a potential group of "behavioral collaboration and resource sharing," which may include normal user groups and fraud groups. Each initial entity cluster has the characteristics of "diverse node types and close associations," covering multiple types of entities such as accounts, devices, IPs, and electricity bills. Their core commonality is that the interaction frequency and association strength of entities within the cluster are significantly higher than those between clusters.

[0051] The initial entity clusters are screened based on a preset threshold set to obtain high-risk associated groups. The screening process is designed to locate high-risk associated groups by quantifying the probability of collaborative cheating in each entity cluster.

[0052] Preferably, in one embodiment of the present invention, the preset threshold set includes a community modularity threshold, a node connection density threshold, and a core node proportion threshold. The preset threshold set is determined based on the comparison analysis results of historical cheating cluster characteristics and normal cluster characteristics.

[0053] The initial entity cluster is filtered based on a preset threshold set to identify high-risk nodes, including: Determine the community modularity of each initial entity cluster, compare the community modularity with the community modularity threshold, and retain the first type of clusters whose community modularity is higher than the community modularity threshold.

[0054] Specifically, the community modularity of each initial entity cluster is calculated. This metric measures the tightness of connections between nodes within the cluster, and is calculated as the percentage difference between the actual number of edges in the cluster and the expected number of edges in a cluster of the same size in a random network. The community modularity is compared with a preset threshold (based on historical cheating cluster modularity statistics, typically not lower than 0.6), and clusters with a modularity higher than the threshold are retained. The higher the modularity, the stronger the collaboration among entities within the cluster, and the more likely it is to be an organized cheating group.

[0055] Determine the node connection density of each first-class cluster, compare the node connection density with the node connection density threshold, and retain the second-class clusters whose node connection density exceeds the node connection density threshold.

[0056] Specifically, the node connection density of the first type of cluster is calculated using the formula "actual number of interacting edges within the cluster ÷ maximum possible number of edges for all nodes within the cluster". This density is then compared to a preset threshold (based on the upper limit of connection density for normal user groups, typically not lower than 0.3), retaining the second type of clusters whose density exceeds the threshold. Higher connection density indicates more frequent interactions and closer resource sharing among entities within the cluster, further excluding normal user groups engaging in "accidental collaboration". Identify the core nodes of associated risk resources in each second-type cluster, determine the proportion of core nodes in the second-type cluster, compare the proportion of core nodes with the core node proportion threshold, and identify the third-type clusters whose core node proportion reaches the core node proportion threshold as high-risk associated groups.

[0057] Specifically, the core nodes in the second type of cluster are identified. Core nodes are defined as "nodes associated with risky resources" (such as accounts bound to malicious IPs or fingerprints of cheating devices), "nodes historically marked as cheating," or "key nodes ranking in the top 30% of interaction frequency within the cluster." The percentage of core nodes is then calculated (core node percentage = number of core nodes ÷ total number of nodes in the cluster) and compared with a preset threshold (usually not less than 20%). Clusters meeting this percentage are identified as high-risk associated groups. The higher the percentage of core nodes, the more significant the cheating attributes of the cluster, and the more likely it is an organized arbitrage group of "wool party" members.

[0058] S5: Obtain the end-to-end operation sequence data corresponding to the potential cheating data from the multi-source heterogeneous data, and perform time-series verification on the potential cheating data based on the end-to-end operation sequence data to obtain the target cheating data. The end-to-end operation data includes timestamps, unique account identifiers, and key operation steps.

[0059] In this embodiment, the potential cheating data generated by S4 undergoes secondary verification in the time-series dimension. By reconstructing the entire operation trajectory and matching abnormal behavior patterns, false positive data (such as accidental collaborative behavior of normal users) is filtered out, ultimately identifying target cheating data with clear fraudulent intent. The technical significance of this step lies in breaking the single judgment logic of "group association = cheating." Through dual verification of "behavioral sequence + time dimension," it solves the problem of potential misjudgment in group identification, achieving accurate matching between "group association characteristics" and "individual fraudulent intent," and providing conclusive evidence of cheating for subsequent risk assessment and tiered handling.

[0060] Before completing the timing verification, it is necessary to extract the full-link operation sequence data corresponding to the potential fraud data from the multi-source heterogeneous data collected by S1. Specifically, using the "unique account identifier" in the potential fraud data as the core association key, all operation records corresponding to the account are filtered from multi-source data such as transaction records, user accounts, and coupon redemption records to ensure that the data covers the complete business link of "account registration / login → coupon redemption → electricity bill payment → transaction refund". The extracted data includes timestamps (accurate to milliseconds, recording the occurrence time of each operation), unique account identifiers (bound to the operation subject to ensure the uniqueness of the sequence), and key operation links (corresponding to the core nodes of the business link, such as "registration", "coupon redemption", "payment", and "refund").

[0061] Preferably, in one embodiment of the present invention, the potential cheating data is temporally verified based on the end-to-end operation sequence data to obtain the target cheating data, including: Based on the unique identifier of the account, the full-link operation sequence data of the same user is aggregated to obtain a standardized user behavior sequence. The aggregation process is designed to map each key operation step in the full-link operation sequence data into a standardized operation code in ascending order of timestamp.

[0062] Specifically, the system groups users by unique account identifiers and arranges all operation records of the same account in ascending order of timestamps to reconstruct the actual order of user participation in marketing activities, ensuring that the sequence reflects the true temporal relationship. Key operational steps are mapped to unified standardized operation codes to eliminate differences in natural language descriptions. For example, "claim coupon" and "receive coupon" are uniformly coded as "2". An example coding rule in this embodiment is: Account registration / login = 1, Coupon claim = 2, Electricity bill payment = 3, Transaction refund = 4. The standardized user behavior sequence is output as an array [code 1, code 2, code 3, ...], synchronously associated with the timestamp difference corresponding to each code.

[0063] An anomaly pattern library is constructed, comprising various types of preset anomaly patterns. This library is the core basis for time-series verification, and its preset anomaly patterns are derived from the analysis of historical black market cheating behavior and comparisons with normal user operation patterns. The centralized preset anomaly patterns in this embodiment include: The new account bulk coupon payment mode means that after the account is registered, within the time window T3 (e.g., 10 minutes, determined based on the 95th percentile of the reasonable interval for normal users to claim coupons and make payments), the coupons are claimed in batches N times and the payment is initiated immediately. The "payment followed by immediate refund" arbitrage model involves initiating a batch refund request within a time window T4 (e.g., 5 minutes, determined based on the lower limit of normal user refund behavior statistics) after receiving the coupon and completing the payment.

[0064] The standardized user behavior sequence is matched one by one with the preset abnormal patterns in the abnormal pattern library, and the matching abnormal pattern type and the cumulative number of times the abnormal pattern of the same account is matched are marked.

[0065] Specifically, a sequence similarity matching algorithm is used to compare the encoding order and time interval of the standardized user behavior sequence with the preset abnormal patterns. If the encoded sequences match perfectly and the time interval of the key steps is within the preset window (T3, T4), the match is considered successful. For the successfully matched sequence, two core pieces of information are marked: one is the type of the matched abnormal pattern (such as "pattern 1" and "pattern 2"), and the other is the cumulative number of times the same account has hit the abnormal pattern within the statistical period (such as 24 hours). For sequences that hit multiple abnormal patterns at the same time, they are marked as high-priority anomalies.

[0066] Based on the anomaly pattern type and the cumulative number of hits of the anomaly pattern, the target cheating data in the potential cheating data is identified.

[0067] Specifically, two core judgment conditions are set. Meeting either one is sufficient to classify it as target fraudulent data: 1) The cumulative number of hits of abnormal patterns from the same account is greater than or equal to a preset hit threshold (e.g., 2 times, determined based on the probability of accidental touches by normal users); 2) Hitting any high-priority abnormal pattern (e.g., simultaneously hitting pattern 1 and pattern 2, or hitting pattern 2 and refunding ≥ 3 times). Sequences that only hit a single low-risk abnormal pattern (e.g., only hitting pattern 1 but the number of coupon redemptions does not meet the batch standard) are not initially classified as target fraudulent data and are returned to the potential fraudulent data pool for re-verification after subsequent data replenishment, avoiding misjudging normal users. Target fraudulent data is output in a structured format of "unique account identifier - standardized behavior sequence - matched abnormal pattern - cumulative hit count," clearly presenting the temporal trajectory and core evidence of fraudulent behavior, providing clear evidence of fraud for subsequent risk assessment.

[0068] S6: Perform anomaly risk assessment on the target cheating data to obtain the behavioral security level corresponding to the target cheating data.

[0069] In this embodiment, a multi-dimensional and refined anomaly risk assessment is performed on the target cheating data locked by S5, transforming qualitative cheating behaviors into quantifiable risk scores, which are ultimately mapped to a clear behavioral security level. This embodiment breaks away from the single-handed logic of intercepting cheating immediately. By scientifically quantifying the degree of risk, it provides a precise basis for subsequent graded handling, ensuring that high-risk cheating behaviors are completely intercepted while avoiding over-control of medium- and low-risk behaviors that could affect the normal user experience. At the same time, it solves the pain points of low efficiency and strong subjectivity in traditional manual review, achieving automation, standardization, and precision in risk assessment.

[0070] Preferably, in one embodiment of the present invention, an anomaly risk assessment is performed on the target cheating data to obtain a behavioral security level corresponding to the target cheating data, including: Obtain basic features, group association features, and end-to-end anomaly features associated with the target cheating data. Then, fuse these features to obtain fused feature data.

[0071] Using the "unique account identifier" of the target cheating data as the association key, three types of core features are extracted simultaneously: Basic characteristics: derived from step S2, including transaction characteristics (transaction amount, frequency of requests per unit time), behavioral characteristics (similarity of operation trajectory, device diversity index, normalized value of geographical distance), and relationship characteristics (centralized payment indicator, device sharing indicator), reflecting the basic risk attributes of individual operations; Group association characteristics: derived from step S4, including the community risk score (0-1 range, calculated based on the proportion of historical cheating nodes and modularity within the group) of the high-risk associated group to which the target account belongs, group size (total number of nodes), and group density (actual number of edges / maximum possible number of edges), reflecting the collaborative cheating risk of the group to which the individual belongs; End-to-end anomaly features: derived from step S5, including anomaly pattern binary vectors (e.g., 5 types of anomaly patterns correspond to 5-dimensional vectors, with the hit pattern position being 1), and the cumulative number of hits for anomaly patterns, representing the fraudulent attributes of an individual operation trajectory.

[0072] The three types of features are concatenated in the order of "basic features → group association features → full-link anomaly features" to form a unified high-dimensional fusion feature vector. For example: [transaction amount, request frequency, operation trajectory similarity, device diversity index, centralized payment indicator, community risk score, group size, group density, pattern P1 indicator, pattern P2 indicator, number of times anomaly patterns are hit]. This vector comprehensively covers risk information of micro-behavior, meso-group, and macro-link, providing complete input for model evaluation.

[0073] The fused feature data is input into a pre-trained anomaly detection model, which outputs anomaly detection results. The pre-trained anomaly detection model employs a hybrid architecture of "unsupervised anomaly detection + supervised risk classification," balancing the identification of unknown cheating patterns with accurate risk grading. The specific implementation is as follows: Unsupervised anomaly detection identifies anomalous data that deviates from normal patterns from the perspective of global feature distribution, and is highly robust to novel cheating patterns not covered by historical data. Specifically, fused feature vectors are input into the unsupervised anomaly detection model, which is built based on the isolated forest algorithm.

[0074] The Isolation Forest algorithm constructs multiple isolation trees. When constructing each tree, it randomly selects a feature (such as the device diversity index) from all features represented by the fused feature vector, and randomly chooses a splitting value between the maximum and minimum values ​​of that feature, thus dividing the dataset into two parts. This process is repeated recursively until each data point is isolated or the maximum depth of the tree is reached. The path length and anomaly score of the fused feature vector are then calculated, as expressed by the formula: Where x is a fusion feature vector representing a user, and it is the sample input for the entire computation. n is the size of the dataset used to construct the isolation trees. h(x) is the path length from the root node to a leaf node in each isolation tree for a given sample x. E(h(x)) is the expected path length of vector x across all isolation trees. c(n) is the average path length given n, used for standardization. s(x,n) is the anomaly score of the output, and the closer its value is to 1, the more likely the sample is to be an anomaly.

[0075] In this formula, the fused feature vector x is the core input, and all subsequent calculations of the algorithm are based on the individual feature values ​​contained in x. The output s(x,n) of the formula is the anomaly score for the first level.

[0076] The anomaly score from the first level is used as a new feature and fed into a Gradient Boosting Decision Tree (GBDT) model along with the original fused feature vector. This GBDT model is trained using historical labeled data (normal / cheating) and is responsible for fine-grained risk classification, outputting a final risk score between 0 and 1.

[0077] Determine the behavioral safety level that matches the anomaly detection results.

[0078] S7: Implement anti-fraud strategies that match the security level of the behavior.

[0079] Specifically, based on the scoring results, a tiered response strategy will be implemented: High risk (S≥0.8): For identified members of fraud gangs or transactions that hit the full-chain fraud path, perform real-time interception and automatically add relevant resources (IP, device, account, account number) to the dynamic blacklist.

[0080] Medium risk (0.3≤S<0.8): For suspicious transactions with insufficient evidence, enhanced verification is triggered, such as requiring facial recognition or SMS secondary verification.

[0081] Low risk (S<0.3): Provides a seamless experience for users with normal behavior.

[0082] Another embodiment of the present invention provides an anti-fraud system for electricity marketing. For details, please refer to [link / reference]. Figure 2 , Figure 2 The diagram shown is a structural block diagram of an anti-fraud system for electricity marketing according to one embodiment of the present invention, which includes: Module 11 is used to acquire multi-source heterogeneous data related to payment behavior in electricity marketing activities; Extraction module 12 is used to perform feature extraction processing on the multi-source heterogeneous data to obtain transaction feature data, behavioral feature data and relationship feature data; Module 13 is used to construct a knowledge graph of payment behavior based on the transaction feature data, the behavioral feature data, and the relationship feature data; Analysis module 14 is used to analyze the interaction frequency and association strength between various nodes in the payment behavior knowledge graph, obtain high-risk association groups, and generate potential fraud data based on the high-risk association groups. The verification module 15 is used to obtain the end-link operation sequence data corresponding to the potential cheating data in the multi-source heterogeneous data, and perform time-series verification on the potential cheating data based on the end-link operation sequence data to obtain the target cheating data. Evaluation module 16 is used to perform anomaly risk assessment on the target cheating data to obtain the behavior security level corresponding to the target cheating data; Execution module 17 is used to execute an anti-fraud strategy that matches the security level of the behavior.

[0083] Preferably, in one embodiment of the present invention, the analysis module is specifically used for: The payment behavior knowledge graph is filtered to obtain a first payment behavior knowledge graph. The filtering process is designed to remove invalid edges and isolated, unrelated single nodes in the payment behavior knowledge graph whose interaction frequency is lower than a preset frequency threshold and whose interaction duration is shorter than a preset duration threshold. The nodes in the first payment behavior knowledge graph are divided into communities based on a preset clustering algorithm to obtain an initial entity cluster; The initial entity clusters are filtered based on a preset threshold set to obtain high-risk associated groups. The filtering process is designed to locate high-risk associated groups by quantifying the probability of collaborative cheating in each entity cluster.

[0084] Preferably, in one embodiment of the present invention, the preset threshold set includes a community modularity threshold, a node connection density threshold, and a core node proportion threshold, and the preset threshold set is determined based on the comparison analysis results of historical cheating cluster characteristics and normal cluster characteristics; The analysis module is also used for: Determine the community modularity of each initial entity cluster, compare the community modularity with the community modularity threshold, and retain the first type of clusters whose community modularity is higher than the community modularity threshold; Determine the node connection density of each first type of cluster, compare the node connection density with the node connection density threshold, and retain the second type of cluster whose node connection density exceeds the node connection density threshold; Identify the core nodes of the associated risk resources in each of the second type of clusters, determine the proportion of core nodes in the second type of clusters, compare the proportion of core nodes with the core node proportion threshold, and identify the third type of clusters whose core node proportion reaches the core node proportion threshold as high-risk associated groups.

[0085] Preferably, in one embodiment of the present invention, the end-to-end operation data includes timestamps, unique account identifiers, and key operation steps; The verification module is specifically used for: Based on the unique identifier of the account, the full-link operation sequence data of the same user is aggregated to obtain a standardized user behavior sequence. The aggregation process is designed to map each key operation step in the full-link operation sequence data into a standardized operation code in ascending order of timestamp. Construct an exception pattern library, which includes multiple types of preset exception patterns; The standardized user behavior sequence is matched and compared one by one with each type of preset abnormal pattern in the abnormal pattern library, and the matching abnormal pattern type and the cumulative number of times the abnormal pattern of the same account is matched are marked. Based on the abnormal pattern type and the cumulative number of hits of the abnormal pattern, the target cheating data in the potential cheating data is determined.

[0086] Preferably, in one embodiment of the present invention, the evaluation module is specifically used for: Obtain basic features, group association features, and end-to-end anomaly features associated with the target cheating data; fuse the basic features, group association features, and end-to-end anomaly features to obtain fused feature data. The fused feature data is input into a pre-trained anomaly detection model, which outputs anomaly detection results. Determine the behavioral safety level that matches the anomaly detection results.

[0087] The embodiments described above are merely illustrative of several implementations of the present invention, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of the present invention. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the present invention, and these modifications and improvements all fall within the scope of protection of the present invention. Therefore, the scope of protection of this patent should be determined by the appended claims.

Claims

1. An electricity marketing anti-cheating method, characterized in that, The method comprises the following steps: acquiring multi-source heterogeneous data associated with payment behavior in power marketing activities; performing feature extraction processing on the multi-source heterogeneous data to obtain transaction feature data, behavior feature data, and relationship feature data; constructing a payment behavior knowledge graph based on the transaction feature data, the behavior feature data, and the relationship feature data; analyzing the interaction frequency and the association strength between each node in the payment behavior knowledge graph to obtain a high-risk associated group, and generating potential cheating data according to the high-risk associated group; acquiring full-link operation sequence data corresponding to the potential cheating data in the multi-source heterogeneous data, and performing time sequence verification on the potential cheating data based on the full-link operation sequence data to obtain target cheating data; performing abnormal risk assessment processing on the target cheating data to obtain a behavior security level corresponding to the target cheating data; executing an anti-cheating strategy matched with the behavior security level.

2. The power marketing anti-cheating method of claim 1, wherein, The method comprises the following steps: performing filtering processing on the payment behavior knowledge graph to obtain a first payment behavior knowledge graph, wherein the filtering processing is designed to remove invalid edges and isolated single nodes in the payment behavior knowledge graph, the invalid edges having an interaction frequency lower than a preset frequency threshold and an interaction duration shorter than a preset duration threshold; performing community division on the nodes in the first payment behavior knowledge graph based on a preset clustering algorithm to obtain an initial entity cluster; performing screening processing on the initial entity cluster based on a preset threshold set to obtain a high-risk associated group, wherein the screening processing is designed to locate the high-risk associated group by quantifying the cooperative cheating probability of each entity cluster.

3. The power marketing anti-cheating method of claim 2, wherein, The preset threshold set comprises a community modularity threshold, a node connection density threshold, and a core node proportion threshold, and the preset threshold set is determined based on comparison and analysis results of historical cheating cluster characteristics and normal cluster characteristics; The method comprises the following steps: determining the community modularity of each initial entity cluster, comparing the community modularity with the community modularity threshold, and retaining a first type of cluster having a community modularity higher than the community modularity threshold; determining the node connection density of each first type of cluster, comparing the node connection density with the node connection density threshold, and retaining a second type of cluster having a node connection density exceeding the node connection density threshold; identifying the core nodes of associated risk resources in each second type of cluster, determining the core node proportion in the second type of cluster, comparing the core node proportion with the core node proportion threshold, and determining a third type of cluster having a core node proportion reaching the core node proportion threshold as a high-risk associated group.

4. The power marketing anti-cheating method of claim 1, wherein, The full-link operation data comprises a timestamp, a unique account identifier, and a key operation link; The method comprises the following steps: The full-link operation sequence data of the same user is aggregated based on the account unique identifier to obtain a standardized user behavior sequence, wherein the aggregation processing is designed to map each key operation link in the full-link operation sequence data into a standardized operation code in ascending order of timestamp; An abnormal pattern library is constructed, and the abnormal pattern library includes multiple types of preset abnormal patterns; The standardized user behavior sequence is matched and compared with each type of preset abnormal pattern in the abnormal pattern library, and the matched abnormal pattern type and the abnormal pattern cumulative hit number of the same account are marked; Based on the abnormal pattern type and the abnormal pattern cumulative hit number, the target cheating data in the potential cheating data is determined.

5. The power marketing anti-cheating method of claim 1, wherein, The abnormal risk assessment processing of the target cheating data obtains a behavior security level corresponding to the target cheating data, including: Obtaining basic features, group correlation features and full-link abnormal features associated with the target cheating data, and performing fusion processing on the basic features, the group correlation features and the full-link abnormal features to obtain fusion feature data; The fusion feature data is input into a pre-trained abnormal detection model, and an abnormal detection result is output; Determine the behavior security level matched with the abnormal detection result.

6. A power marketing anti-cheating system, characterized by, It includes: An acquisition module is configured to acquire multi-source heterogeneous data associated with payment behavior in a power marketing activity; An extraction module is configured to perform feature extraction processing on the multi-source heterogeneous data to obtain transaction feature data, behavior feature data and relationship feature data; A construction module is configured to construct a payment behavior knowledge graph based on the transaction feature data, the behavior feature data and the relationship feature data; An analysis module is configured to analyze the interaction frequency and correlation strength between each node in the payment behavior knowledge graph to obtain a high-risk associated group, and generate potential cheating data according to the high-risk associated group; A verification module is configured to obtain full-link operation sequence data corresponding to the potential cheating data in the multi-source heterogeneous data, and perform time sequence verification on the potential cheating data based on the full-link operation sequence data to obtain target cheating data; An evaluation module is configured to perform abnormal risk assessment processing on the target cheating data to obtain a behavior security level corresponding to the target cheating data; An execution module is configured to execute an anti-cheating strategy matched with the behavior security level.

7. The power marketing anti-cheating system of claim 6, wherein, The analysis module is specifically configured to: Filter the payment behavior knowledge graph to obtain a first payment behavior knowledge graph, wherein the filtering processing is designed to eliminate invalid edges and isolated unrelated single nodes in the payment behavior knowledge graph, which have an interaction frequency lower than a preset frequency threshold and an interaction duration shorter than a preset duration threshold; Divide the nodes in the first payment behavior knowledge graph into communities based on a preset clustering algorithm to obtain an initial entity cluster; Filter the initial entity cluster based on a preset threshold set to obtain a high-risk associated group, wherein the filtering processing is designed to locate the high-risk associated group by quantifying the cooperative cheating probability of each entity cluster.

8. The power marketing anti-cheating system of claim 7, wherein, The preset threshold set includes a community modularity threshold, a node connection density threshold, and a core node proportion threshold, and the preset threshold set is determined based on comparison and analysis results of historical cheating cluster characteristics and normal cluster characteristics; The analysis module is further configured to: determine a community modularity of each initial entity cluster, compare the community modularity with the community modularity threshold, and retain a first type of cluster with a community modularity higher than the community modularity threshold; determine a node connection density of each first type of cluster, compare the node connection density with the node connection density threshold, and retain a second type of cluster with a node connection density exceeding the node connection density threshold; identify a core node of an associated risk resource in each second type of cluster, determine a core node proportion in the second type of cluster, compare the core node proportion with the core node proportion threshold, and determine a third type of cluster with a core node proportion reaching the core node proportion threshold as a high-risk associated group.

9. The anti-cheating system for power marketing as claimed in claim 6, wherein, The full-link operation data includes a timestamp, a unique account identifier, and a key operation link; The verification module is specifically configured to: aggregate the full-link operation sequence data of the same user based on the unique account identifier to obtain a standardized user behavior sequence, wherein the aggregation processing is designed to map each key operation link in the full-link operation sequence data to a standardized operation code in ascending order of the timestamp; construct an abnormal pattern library, the abnormal pattern library including multiple types of preset abnormal patterns; match and compare the standardized user behavior sequence with each type of preset abnormal pattern in the abnormal pattern library one by one, mark the matched abnormal pattern type and the abnormal pattern cumulative hit number of the same account; determine target cheating data in the potential cheating data based on the abnormal pattern type and the abnormal pattern cumulative hit number.

10. The anti-cheating system for power marketing as claimed in claim 6, wherein, The evaluation module is specifically configured to: obtain basic features, group association features, and full-link abnormal features associated with the target cheating data, fuse the basic features, the group association features, and the full-link abnormal features to obtain fused feature data; input the fused feature data into a pre-trained abnormal detection model to output an abnormal detection result; determine a behavior security level matched with the abnormal detection result.

Images