Space-time two-dimensional fusion analysis method for network illegal transaction situation based on spatial relevance improvement

Abstract

The invention discloses an improved network illegal transaction situation space-time two-dimensional fusion analysis method based on spatial relevance. The method comprises the following steps: 1, pre-processing data; 2, constructing a knowledge graph; 3, embedding a migration and similarity matrix into the graph: generating a node embedding vector, and obtaining a high-order structure feature; calculating node similarity and forming an embedded vector matrix to represent spatial correlation features; 4, space and time dependence modeling: inputting the embedded matrix into a graph convolutional network, and extracting space dependence features; mining time-dependent characteristics of the transaction data by using a gating loop unit model; 5, time-space fusion analysis: constructing a time graph convolutional network, fusing space and time features, and realizing situation prediction; and 6, instance analysis and evaluation: analyzing a prediction result, identifying an abnormal node and evaluating a situation level. The method can effectively improve the modeling precision and prediction capability of the network illegal transaction situation, and achieves the dynamic perception and trend deduction of the illegal transaction risk.

Description

Technical Field

[0001] This invention relates to the field of network security and data intelligence analysis, specifically to a spatiotemporal dual-dimensional fusion analysis method for the situation of illegal network transactions based on spatial correlation improvement, which is applicable to the detection, risk assessment and situation warning of illegal network transactions. Background Technology

[0002] As the online transaction environment continues to evolve and transaction methods become increasingly complex, illegal online transactions exhibit characteristics such as cross-platform, cross-regional, complex behavior, and dynamic temporal patterns. As an extension of traditional market transactions, online transactions differ significantly from traditional market transactions. The most prominent difference is the shift from a direct to an indirect relationship between buyers and sellers, making information more prone to distortion and transaction security more difficult to guarantee. Therefore, online transactions can be considered an emerging regulatory field. Traditional methods of monitoring illegal online transactions, such as routine sampling inspections, are insufficient to fully grasp the complex and ever-changing risks of today's illegal transactions. Furthermore, traditional methods based on single time series or static network analysis struggle to simultaneously characterize spatial propagation paths and temporal evolution patterns. With the increasing maturity of big data technology and the growing application of artificial intelligence algorithms across various fields, the integration of these technologies provides innovative technical solutions for monitoring illegal online transactions. The introduction of these technologies makes it possible to extract characteristics of illegal behavior from complex data, thereby improving regulatory efficiency and early warning capabilities. However, existing methods for predicting the trend of illegal online transactions still face many challenges: most methods do not fully utilize the knowledge graph formed by multiple relational semantics between entities (such as subject-platform-region), and ignore the characteristic that illegal transaction behavior can evolve across platforms and regions; the accuracy of the analysis of the correlation of illegal transaction behavior is closely related to the timeliness of the data. Graph embedding and graph neural networks have potential in spatial modeling, but if they are not combined with time series models, they are insufficient in responding to changes in the trend; in addition, the interpretability of the model is often neglected, making it difficult to support regulatory decisions. Summary of the Invention

[0003] To address the problems of existing technologies, this invention provides a spatiotemporal dual-dimensional fusion analysis method for network illegal transaction trends based on spatial correlation. This method is applied to the novel field of network illegal transaction trend awareness. This method constructs a complete spatiotemporal fusion process within the framework of knowledge graphs, graph embeddings, GCN, GRU, and T-GCN. A similarity matrix is ​​obtained through graph embedding walks to represent the spatial correlation between regions and platforms. Then, GCN and GRU are used to model spatial and temporal dependencies respectively for spatiotemporal fusion learning, effectively capturing the spatial dependence and temporal evolution characteristics of illegal transactions. This improves both detection and prediction accuracy, and enhances the interpretability and operability of the results.

[0004] The technical solution of this invention is as follows: The method for analyzing the spatiotemporal dual-dimensional fusion of online illegal transaction trends based on spatial correlation improvement involves the following steps: Step 1) Collect and clean multi-source illegal online transaction data, extract key features such as transaction subject, transaction platform, transaction time, geographical location, goods and goods type, and construct a standardized dataset; 1.1) Data Source Selection and Acquisition: The "Retail_Transaction_Dataset" dataset from the publicly available Kaggle platform was selected as the basic transaction dataset. This dataset contains multi-dimensional information such as transaction number, product information, price, discount, store location, transaction date, payment method, merchant, and product type as raw information. To meet the needs of online illegal transaction correlation analysis, the raw data was collected and imported locally, and stored in the database of the data processing module.

[0005] 1.2) Data Cleaning and Trimming: Fields in the original data that are weakly related to the four entities (merchants, trading platforms, geographical regions, and traded goods) involved in illegal transactions and the content required for this study were removed. These fields include, but are not limited to, "TotalAmount," "Price," and "DiscountApplied(%)." Simultaneously, abnormal, null, and duplicate records were deleted to reduce noise interference and improve the structure and validity of the data.

[0006] 1.3) Spatiotemporal information standardization processing: To address the issue of overly fine-grained store-level location records in the "StoreLocation" field of the original data, an aggregation mapping method is used to uniformly summarize store locations to the provincial administrative division level; Specifically, this includes mapping all transaction records to 62 transaction areas based on geographical coordinates or administrative codes, and further mapping them one-to-one with my country's 31 provincial-level administrative regions (excluding Hong Kong, Macao and Taiwan) to form a standardized regional division result.

[0007] The original "TransactionDate" field is converted to the ISO8601 standard time format to ensure the consistency and computability of time data in the database and knowledge graph, providing a consistent time scale for subsequent time-dependent feature modeling.

[0008] 1.4) Because the original data lacked the two key fields "transaction entity" and "e-commerce platform", the following methods were used to supplement and construct them:

[0009] Transaction entity information is generated based on regional distribution characteristics: According to the geographical distribution characteristics of 31 provincial-level administrative regions, approximately 300 retail merchants are estimated, and merchants are associated with transaction records through random allocation to maintain the reasonableness of sample size and distribution; E-commerce platform information is constructed based on payment method mapping: Based on the correspondence between the "PaymentMethod" field and the platform type, a virtual e-commerce platform mapping is constructed, such as mapping "Cash" to the Taobao platform and "PayPal" to the Pinduoduo platform, thereby realizing the semantic mapping from offline payment methods to online transaction platforms.

[0010] 1.5) Field Integration and Dataset Standardization: After cleaning, trimming, and expansion, the fields are integrated and formatted uniformly to form a standardized dataset of illegal online transactions containing the following core attribute columns: transaction time, merchant, product, region, platform, number of illegal transactions, and type of traded product. Through these steps, a complete, semantically clear dataset of illegal online transactions with temporal and spatial characteristics is established, providing a unified data foundation for subsequent knowledge graph construction, graph embedding walks, and spatiotemporal fusion analysis.

[0011] Step 2) Based on the four types of entities—transaction subjects, transaction platforms, geographical regions, and transaction commodities—and their relationships, construct a knowledge graph of illegal online transactions to characterize the semantic and spatial relationships between each node; 2.1) Graph Entity Definition and Node Construction: Based on the standardized online illegal transaction dataset obtained in Step 1, the key elements involved in the transactions are abstracted into graph nodes, including: Administrative Region nodes (Province), representing the geographical scope of the transaction; Transaction Platform nodes (Platform), representing e-commerce platforms or payment channels; Business Entity nodes (Merchant), representing the merchants or individuals participating in the transaction; and Product nodes (Product), describing the product information involved in the transaction. The Administrative Region, E-commerce Platform, and Business Entity nodes include a name attribute; while the Product node further includes a merchant identifier (merchant_id) and a product category (product_type) attribute to support subsequent transaction association analysis and cross-regional propagation modeling.

[0012] 2.2) Relationship Type Design and Edge Attribute Definition: Based on the logic of actual transaction behavior, multiple types of relationship edges are constructed between the above nodes, defined as follows: SELLS_ON(M, P): The sales relationship of business entity M on e-commerce platform P; AVAILABLE_ON(PD, P): The availability of product PD on platform P; LOCATED_IN(M, PR): The administrative region PR to which the operating entity M belongs; SELLS(M, PD): The direct sales relationship between business entity M and product PD.

[0013] The relationship edges include stored transaction attribute information, such as: transaction timestamp, number of illegal transactions by the merchant or platform (illegal_count), administrative division code of the transaction location (province_code), and product information involved in the case (product_info). To enhance the interpretability and structural hierarchy of the graph, the system assigns lower weights (e.g., 0.5) to potential inferred relationships (such as inferred indirect merchant-product connections), while setting the weight of directly observed transaction relationships to 1. This weighting mechanism helps to highlight the structural impact of real transaction behavior in subsequent graph embedding and node similarity calculations.

[0014] 2.3) Knowledge Graph Construction and Database Implementation: Neo4j graph database is used as the underlying storage and query engine for the knowledge graph. Cypher language is used to implement batch import and index optimization of nodes and relationships, supporting node creation, deletion, modification and query operations. The system visualizes the network structure between merchants, products, platforms and regions through Neo4j's web interface, which facilitates intuitive analysis of the cross-platform illegal transaction propagation path. Finally, a complete knowledge graph structure based on the "merchant-product-platform-region" quadruple is formed, which explicitly describes the semantic association, spatial diffusion and topological relationship of network illegal transaction behavior across multiple platforms and regions in the form of graph structure.

[0015] Step 3) Perform graph embedding modeling on the knowledge graph, generate structured representations of nodes through an improved random walk algorithm, and capture high-order neighborhood relationships between nodes; 3.1) Subgraph Sampling and Parameter Tuning: To achieve efficient modeling on a large-scale knowledge graph of illegal online transactions, subgraph sampling and parameter tuning are performed on the complete dataset. Perform subset extraction based on random walk sampling. Let the original dataset be D, its size be |D|, and the partition ratio be a. Then the subset index is calculated as follows:

[0016] in, Let represent a subset of dataset D from the i-th sample to the end. When When the size is small, the size of the extracted subset is relatively large; when When =1, the subset is empty, indicating that no sampling is performed. By adjusting... It can strike a balance between data scale and computational cost, thus facilitating efficient parameter tuning on subsets.

[0017] 3.2) Improved Random Walk Modeling: In the graph embedding stage, the Node2Vec model is adopted, which generates node sequences through a biased random walk strategy to capture local and global structural features. Let the current node be... The previous node is The candidate next node is Then from node To the node transition probability Defined as:

[0018] in, Representing an edge The weight, It is a bias factor, dependent on and shortest path distance Its value range is {0, 1, 2}:

[0019] Among them, the return parameters Control the probability of a random walk returning to the previous node; when When the values ​​are large, the walk tends to backtrack; input and output parameters This affects the tendency to wander and explore new areas. The larger the value, the more likely the wanderer is to move away from the current node and explore new communities.

[0020] 3.3) Parameter optimization and hyperparameter setting: By adjusting the returned parameters within the interval [0.5, 2] Input and output parameters A grid search was performed, and the optimal parameter combination was determined by comprehensively evaluating the clustering performance using metrics such as silhouette coefficient and elbow rule. The final experimental results show that when… =1.2, =0.8, other core parameters: embedding dimension is 64, walk length is 50, number of walks per node is 300, and context window size is 10. The best optimization effect is achieved when these parameters are: embedding dimension is 64, walk length is 50, number of walks per node is 300, and context window size is 10.

[0021] 3.4) Node Embedding Generation and Training: After parameter optimization, a biased random walk is performed on the complete knowledge graph to generate multiple node sequences. The generated node sequences are input into the Skip-Gram model for training. The node representation vector is learned using the node co-occurrence information in the context window to obtain a node embedding vector with a dimension of 64.

[0022] This vector can effectively characterize the potential semantic relationships and spatial propagation features between Province, Platform, and Merchant.

[0023] Step 4) Calculate the similarity vectors between nodes to form an embedding vector matrix, so as to characterize the spatial correlation between the entities involved in illegal online transactions; 4.1) Node Embedding Vector Preparation: After completing the graph embedding modeling in step 3, low-dimensional vector representations of region nodes and platform nodes in the knowledge graph are obtained. Let the node set be... The corresponding set of embedding vectors is ,in Represents a node of Dimensional embedding vector.

[0024] 4.2) Similarity Matrix Initialization: Construct an empty two-dimensional similarity matrix. This is used to store the similarity between nodes. The initial value is set to zero.

[0025] For the set of nodes Each pair of nodes in The vectors are traversed, and the spatial correlation between them is calculated using cosine similarity.

[0026] Remove node With nodes Embedded vector , ; Calculate the dot product and magnitude of vectors.

[0027] like and Then calculate the cosine similarity:

[0028] Otherwise, set the similarity to zero.

[0029] Store the calculation results in a similarity matrix.

[0030] Because cosine similarity satisfies symmetry, the final matrix will be... Symmetry processing,

[0031] This ensures the consistency and interpretability of the similarity between nodes in the matrix. Finally, a quantified similarity matrix reflecting the similarity between regional nodes and platform nodes is obtained.

[0032] Step 5) Input the embedded vector matrix into the graph convolutional network (GCN) model, extract the network spatial features, and establish the spatial dependency relationship of illegal transaction behavior; use the gated recurrent unit (GRU) model to model the time series data of illegal transactions and extract the time evolution law of transaction behavior; 5.1) Construct a graph convolutional network model to extract spatial features. This step first uses the embedding vector matrix obtained in step 4) as input data, combined with the adjacency matrix of the illegal transaction network. A Graph Convolutional Network (GCN) is constructed to capture the topological features between regions and the platform. The illegal transaction network is represented as an unweighted graph.

[0033] in This represents a set of nodes consisting of regions or platforms. The adjacency matrix represents the connecting edges of nodes. It contains only elements of 0 or 1 to indicate whether a transaction relationship exists between nodes.

[0034] Based on this, a two-layer graph convolutional model is used to extract features from the network. The model is defined as follows:

[0035] in, This represents the adjacency matrix after self-connection and normalization. and The weight matrix is ​​for a two-layer network. and This is the activation function.

[0036] This structure effectively models the spatial dependencies between regions and platform nodes in illegal transaction networks, yielding spatial feature representations with topological semantics.

[0037] 5.2) Extract time features using the gated recurrent unit model. To model the dynamic changes of illegal transaction behavior in the time dimension, input the spatial feature sequence obtained in the previous step into the gated recurrent unit (GRU) model to capture time dependence.

[0038] The GRU model achieves the memorization and updating of transaction time series through reset and update gate mechanisms. The update gate combines the input gate and forget gate of LSTM, while the reset gate can directly process previous hidden states. While maintaining performance, GRU's training speed is faster than LSTM. The calculation equations are shown below:

[0039] in This represents the current hidden state in the GRU, determined by the hidden state at the previous time step. and current input A joint decision. This is the candidate hidden state. For a moment Transaction information, For update gates in GRU, control the proportion of influence of historical states on the current state; This is the reset gate in the GRU, which controls the degree to which the state information from the previous time step is forgotten. To update the parameter matrix of the gate in GRU, This is the parameter matrix of the reset gate in the GRU. This is the parameter matrix of the hidden layer in GRU. This is the bias vector for updating the gate in GRU. Here is the bias vector for the reset gate in the GRU. This refers to the bias vector of the hidden layer in GRU. , For activation functions; This structure allows the model to capture current transaction changes while retaining long-term dependency information from historical transactions, thus effectively describing the temporal evolution of illegal transaction behavior.

[0040] 5.3) Establish the spatial and temporal dependency mapping relationship of illegal transactions. By combining the spatial features output by the graph convolutional network and the temporal features output by the gated recurrent unit, a spatial-temporal correlation feature matrix of illegal transaction behavior is formed, providing the basic input for the spatiotemporal fusion modeling in the next step.

[0041] Step 6) Construct a Temporal Graph Convolutional Network (T-GCN) model to fuse spatial and temporal features, capture the spatiotemporal coupling characteristics of illegal online transactions, and achieve dynamic situation prediction. 6.1) Establish the spatial and temporal dependency mapping relationship of illegal transactions. The inputs to the T-GCN model include: Network topology ,in This represents a set of nodes consisting of regions or platforms. Represents the connecting edges of nodes; adjacency matrix , used to describe the connection state between nodes; feature matrix This represents the historical illegal transaction sequence data of the node, where This represents the length of the time series.

[0042] Model output is the future Predicted value of illegal transactions at each time step By learning mapping functions

[0043] Achieve prediction based on spatiotemporal dependent features.

[0044] 6.2) Spatial Feature Extraction and Temporal Fusion. In the model structure, a graph convolutional network module is first used to extract features from the feature matrix. Adjacency Matrix Convolutional operations are performed to extract topological spatial features between regions or platforms, as mentioned in step 5). Subsequently, the spatial feature vector output by the GCN module is used as input and passed to the Gated Recurrent Unit (GRU) structure to capture the temporal evolution of illegal transaction behavior. The GRU remembers and updates historical states through reset and update gate mechanisms, and its state update formula is as follows:

[0045] The above describes the update and variation of the GRU calculation equation. Through this process, the model can dynamically respond to changes in current transaction data while maintaining historical trends of illegal transactions, thus achieving time-dependent modeling of transaction behavior.

[0046] 6.3) Spatiotemporal Feature Fusion and Predictive Output. To achieve spatiotemporal coupled modeling of illegal transaction behavior, spatial and temporal features are uniformly represented through a gating fusion strategy. The model generates a fused hidden state at each time step. The prediction results are then output through a fully connected layer:

[0047] Through the above process, the T-GCN model can simultaneously capture the spatial topological dependence and temporal dynamic changes of illegal transaction behavior, enabling cross-platform and cross-regional prediction of illegal transaction trends.

[0048] Step 7) Based on a multi-dimensional indicator system, visualize and quantitatively evaluate the model output results, and perform cluster analysis, correlation analysis, time series prediction, and ablation comparison. 7.1) Silhouette Score. It is an important indicator that comprehensively measures the reasonableness of clustering results and is used to evaluate the compactness of samples within a cluster and the separation between clusters.

[0049]

[0050] in, For the sample The average distance to other samples within the same cluster. For the sample The average distance to all samples in the nearest cluster.

[0051] 7.2) PCA Dimensionality Reduction and Visualization Reference Single-Domain Anomaly Node Set: To intuitively present the similarity features between different regions and platforms, this paper uses Principal Component Analysis (PCA) to perform two-dimensional dimensionality reduction on the embedding vectors.

[0052] in, The original embedding feature matrix, These are the eigenvector matrices corresponding to the first two principal components. This represents the low-dimensional situation after dimensionality reduction. By plotting a two-dimensional scatter plot, the distribution and clustering results of different provinces or platforms in the vector space can be visually displayed.

[0053] 7.3) Mean Absolute Error (MAE) Calculation: The mean absolute error is obtained by averaging the absolute differences between each predicted value and the actual value. The formula is: .

[0054] The beneficial effects of this invention are as follows: This invention proposes a spatiotemporal dual-dimensional fusion analysis method for network illegal transaction trends based on spatial correlation improvement. It constructs a temporal graph convolutional network (T-GCN) analysis and prediction method applied to the context of network illegal transaction trend awareness, integrating knowledge graphs, graph embedding, graph convolutional networks (GCN), and gated recurrent units (GRU). This method can extract key features from multi-source network transaction data, integrate the spatial topological relationships and temporal evolution patterns of regions and platforms, and achieve spatiotemporal coupled modeling and dynamic prediction of illegal transaction behavior. By introducing graph embedding and spatiotemporal fusion mechanisms, this invention not only significantly improves the accuracy and stability of illegal transaction trend prediction but also enhances the interpretability and scalability of the model, providing an efficient, intelligent, and operable technical means for network supervision and risk early warning. Attached Figure Description

[0055] Figure 1 This is a flowchart of the method of the present invention; Figure 2 Platform similarity heatmap; Figure 3 Region similarity heatmap; Figure 4 Platform clustering analysis diagram; Figure 5 Region clustering analysis diagram; Figure 6 Comparison charts of ablation processes on some platforms (Douyin Shop); Figure 7 Comparison of ablation procedures in selected areas (Hunan Province); Figure 8 Error comparison chart for some platforms (Douyin Shop); Figure 9 Error comparison chart for some regions (Hunan Province).

[0056] Specific implementation method

[0057] like Figure 1 As shown, the steps of the spatiotemporal dual-dimensional fusion analysis method for the situation of illegal online transactions based on spatial correlation are as follows: Step 1) Collect and clean multi-source illegal online transaction data, extract key features such as transaction subject, transaction platform, transaction time, geographical location, goods and goods type, and construct a standardized dataset; 1.1) Data Source Selection and Acquisition: The "Retail_Transaction_Dataset" dataset from the publicly available Kaggle platform was selected as the basic transaction dataset. This dataset contains multi-dimensional information such as transaction number, product information, price, discount, store location, transaction date, payment method, merchant, and product type as raw information. To meet the needs of online illegal transaction correlation analysis, the raw data was collected and imported locally, and stored in the database of the data processing module.

[0058] 1.2) Data Cleaning and Trimming: Fields in the original data that are weakly related to the four entities (merchants, trading platforms, geographical regions, and traded goods) involved in illegal transactions and the content required for this study were removed. These fields include, but are not limited to, "TotalAmount," "Price," and "DiscountApplied(%)." Simultaneously, abnormal, null, and duplicate records were deleted to reduce noise interference and improve the structure and validity of the data.

[0059] 1.3) Spatiotemporal information standardization processing: To address the issue of overly fine-grained store-level location records in the "StoreLocation" field of the original data, an aggregation mapping method is used to uniformly summarize store locations to the provincial administrative division level; Specifically, this includes mapping all transaction records to 62 transaction areas based on geographical coordinates or administrative codes, and further mapping them one-to-one with my country's 31 provincial-level administrative regions (excluding Hong Kong, Macao and Taiwan) to form a standardized regional division result.

[0060] The original "TransactionDate" field is converted to the ISO8601 standard time format to ensure the consistency and computability of time data in the database and knowledge graph, providing a consistent time scale for subsequent time-dependent feature modeling.

[0061] 1.4) Because the original data lacked the two key fields "transaction entity" and "e-commerce platform", the following methods were used to supplement and construct them:

[0062] Transaction entity information is generated based on regional distribution characteristics: According to the geographical distribution characteristics of 31 provincial-level administrative regions, approximately 300 retail merchants are estimated, and merchants are associated with transaction records through random allocation to maintain the reasonableness of sample size and distribution; E-commerce platform information is constructed based on payment method mapping: Based on the correspondence between the "PaymentMethod" field and the platform type, a virtual e-commerce platform mapping is constructed, such as mapping "Cash" to the Taobao platform and "PayPal" to the Pinduoduo platform, thereby realizing the semantic mapping from offline payment methods to online transaction platforms.

[0063] 1.5) Field Integration and Dataset Standardization: After cleaning, trimming, and expansion, the fields are integrated and formatted uniformly to form a standardized dataset of illegal online transactions containing the following core attribute columns: transaction time, merchant, product, region, platform, number of illegal transactions, and type of traded product. Through these steps, a complete, semantically clear dataset of illegal online transactions with temporal and spatial characteristics is established, providing a unified data foundation for subsequent knowledge graph construction, graph embedding walks, and spatiotemporal fusion analysis.

[0064] Step 2) Based on entities such as transaction subjects, transaction platforms, and geographical regions and their relationships, construct a knowledge graph of illegal online transactions to characterize the semantic and spatial relationships between nodes; 2.1) Graph Entity Definition and Node Construction: Based on the standardized online illegal transaction dataset obtained in Step 1, the key elements involved in the transactions are abstracted into graph nodes, including: Administrative Region nodes (Province), representing the geographical scope of the transaction; Transaction Platform nodes (Platform), representing e-commerce platforms or payment channels; Business Entity nodes (Merchant), representing the merchants or individuals participating in the transaction; and Product nodes (Product), describing the product information involved in the transaction. The Administrative Region, E-commerce Platform, and Business Entity nodes include a name attribute; while the Product node further includes attributes such as merchant_id and product_type to support subsequent transaction association analysis and cross-regional propagation modeling.

[0065] 2.2) Relationship Type Design and Edge Attribute Definition: Based on the logic of actual transaction behavior, multiple types of relationship edges are constructed between the above nodes, defined as follows: SELLS_ON(M, P): The sales relationship of business entity M on e-commerce platform P; AVAILABLE_ON(PD, P): The availability of product PD on platform P; LOCATED_IN(M, PR): The administrative region PR to which the operating entity M belongs; SELLS(M, PD): The direct sales relationship between business entity M and product PD.

[0066] The relationship edges include stored transaction attribute information, such as: transaction timestamp, number of illegal transactions by the merchant or platform (illegal_count), administrative division code of the transaction location (province_code), and product information involved in the case (product_info). To enhance the interpretability and structural hierarchy of the graph, the system assigns lower weights (e.g., 0.5) to potential inferred relationships (such as inferred indirect merchant-product connections), while setting the weight of directly observed transaction relationships to 1. This weighting mechanism helps to highlight the structural impact of real transaction behavior in subsequent graph embedding and node similarity calculations.

[0067] 2.3) Knowledge Graph Construction and Database Implementation: Neo4j graph database is used as the underlying storage and query engine for the knowledge graph. Cypher language is used to implement batch import and index optimization of nodes and relationships, supporting node creation, deletion, modification and query operations. The system visualizes the network structure between merchants, products, platforms and regions through Neo4j's web interface, which facilitates intuitive analysis of the cross-platform illegal transaction propagation path. Finally, a complete knowledge graph structure based on the "merchant-product-platform-region" quadruple is formed, which explicitly describes the semantic association, spatial diffusion and topological relationship of network illegal transaction behavior across multiple platforms and regions in the form of graph structure.

[0068] Step 3) Perform graph embedding modeling on the knowledge graph, generate structured representations of nodes through an improved random walk algorithm, and capture high-order neighborhood relationships between nodes; 3.1) Subgraph Sampling and Parameter Tuning: To achieve efficient modeling on a large-scale knowledge graph of illegal online transactions, subgraph sampling and parameter tuning are performed on the complete dataset. Perform subset extraction based on random walk sampling. Let the original dataset be D, its size be |D|, and the partition ratio be a. Then the subset index is calculated as follows:

[0069] in, Let represent a subset of dataset D from the i-th sample to the end. When When the size is small, the size of the extracted subset is relatively large; when When =1, the subset is empty, indicating that no sampling is performed. By adjusting... It can strike a balance between data scale and computational cost, thus facilitating efficient parameter tuning on subsets.

[0070] 3.2) Improved Random Walk Modeling: In the graph embedding stage, the Node2Vec model is adopted, which generates node sequences through a biased random walk strategy to capture local and global structural features. Let the current node be... The previous node is The candidate next node is Then from node To the node transition probability Defined as:

[0071] in, Representing an edge The weight, It is a bias factor, dependent on and shortest path distance Its value range is {0, 1, 2}:

[0072] Among them, the return parameters Control the probability of a random walk returning to the previous node; when When the values ​​are large, the walk tends to backtrack; input and output parameters This affects the tendency to wander and explore new areas. The larger the value, the more likely the wanderer is to move away from the current node and explore new communities.

[0073] 3.3) Parameter optimization and hyperparameter setting: By adjusting the returned parameters within the interval [0.5, 2] Input and output parameters A grid search was performed, and the optimal parameter combination was determined by comprehensively evaluating the clustering performance using metrics such as silhouette coefficient and elbow rule. The final experimental results show that when… =1.2, =0.8, other core parameters: embedding dimension is 64, walk length is 50, number of walks per node is 300, and context window size is 10. The best optimization effect is achieved when these parameters are: embedding dimension is 64, walk length is 50, number of walks per node is 300, and context window size is 10.

[0074] 3.4) Node Embedding Generation and Training: After parameter optimization, a biased random walk is performed on the complete knowledge graph to generate multiple node sequences. The generated node sequences are input into the Skip-Gram model for training. The node representation vector is learned using the node co-occurrence information in the context window to obtain a node embedding vector with a dimension of 64.

[0075] This vector can effectively characterize the potential semantic relationships and spatial propagation features between Province, Platform, and Merchant.

[0076] Step 4) Calculate the similarity vectors between nodes to form an embedding vector matrix, so as to characterize the spatial correlation between the entities involved in illegal online transactions; 4.1) Node Embedding Vector Preparation: After completing the graph embedding modeling in step 3, low-dimensional vector representations of region nodes and platform nodes in the knowledge graph are obtained. Let the node set be... The corresponding set of embedding vectors is ,in Represents a node of Dimensional embedding vector.

[0077] 4.2) Similarity Matrix Initialization: Construct an empty two-dimensional similarity matrix. This is used to store the similarity between nodes. The initial value is set to zero.

[0078] For the set of nodes Each pair of nodes in The vectors are traversed, and the spatial correlation between them is calculated using cosine similarity.

[0079] Remove node With nodes Embedded vector , ; Calculate the dot product and magnitude of vectors.

[0080] like and Then calculate the cosine similarity:

[0081] Otherwise, set the similarity to zero.

[0082] Store the calculation results in a similarity matrix.

[0083] Because cosine similarity satisfies symmetry, the final matrix will be... Symmetry processing,

[0084] This ensures the consistency and interpretability of the similarity between nodes in the matrix. Finally, a quantified similarity matrix reflecting the similarity between regional nodes and platform nodes is obtained.

[0085] Step 5) Input the embedded vector matrix into the graph convolutional network (GCN) model, extract the network spatial features, and establish the spatial dependency relationship of illegal transaction behavior; use the gated recurrent unit (GRU) model to model the time series data of illegal transactions and extract the time evolution law of transaction behavior; 5.1) Construct a graph convolutional network model to extract spatial features. This step first uses the embedding vector matrix obtained in step 4) as input data, combined with the adjacency matrix of the illegal transaction network. A Graph Convolutional Network (GCN) is constructed to capture the topological features between regions and the platform. The illegal transaction network is represented as an unweighted graph.

[0086] in This represents a set of nodes consisting of regions or platforms. The adjacency matrix represents the connecting edges of nodes. It contains only elements of 0 or 1 to indicate whether a transaction relationship exists between nodes.

[0087] Based on this, a two-layer graph convolutional model is used to extract features from the network. The model is defined as follows:

[0088] in, This represents the adjacency matrix after self-connection and normalization. and The weight matrix is ​​for a two-layer network. and This is the activation function.

[0089] This structure effectively models the spatial dependencies between regions and platform nodes in illegal transaction networks, yielding spatial feature representations with topological semantics.

[0090] 5.2) Extract time features using the gated recurrent unit model. To model the dynamic changes of illegal transaction behavior in the time dimension, input the spatial feature sequence obtained in the previous step into the gated recurrent unit (GRU) model to capture time dependence.

[0091] The GRU model achieves the memorization and updating of transaction time series through reset and update gate mechanisms. The update gate combines the input gate and forget gate of LSTM, while the reset gate can directly process previous hidden states. While maintaining performance, GRU's training speed is faster than LSTM. The calculation equations are shown below:

[0092] in This represents the current hidden state in the GRU, determined by the hidden state at the previous time step. and current input A joint decision. This is the candidate hidden state. For a moment Transaction information, For update gates in GRU, control the proportion of influence of historical states on the current state; This is the reset gate in the GRU, which controls the degree to which the state information from the previous time step is forgotten. To update the parameter matrix of the gate in GRU, This is the parameter matrix of the reset gate in the GRU. This is the parameter matrix of the hidden layer in GRU. This is the bias vector for updating the gate in GRU. Here is the bias vector for the reset gate in the GRU. This refers to the bias vector of the hidden layer in GRU. , For activation functions; This structure allows the model to capture current transaction changes while retaining long-term dependency information from historical transactions, thus effectively describing the temporal evolution of illegal transaction behavior.

[0093] 5.3) Establish the spatial and temporal dependency mapping relationship of illegal transactions. By combining the spatial features output by the graph convolutional network and the temporal features output by the gated recurrent unit, a spatial-temporal correlation feature matrix of illegal transaction behavior is formed, providing the basic input for the spatiotemporal fusion modeling in the next step.

[0094] Step 6) Construct a Temporal Graph Convolutional Network (T-GCN) model to fuse spatial and temporal features, capture the spatiotemporal coupling characteristics of illegal online transactions, and achieve dynamic situation prediction. 6.1) Establish the spatial and temporal dependency mapping relationship of illegal transactions. The inputs to the T-GCN model include: Network topology ,in This represents a set of nodes consisting of regions or platforms. Represents the connecting edges of nodes; adjacency matrix , used to describe the connection state between nodes; feature matrix This represents the historical illegal transaction sequence data of the node, where This represents the length of the time series.

[0095] Model output is the future Predicted value of illegal transactions at each time step By learning mapping functions

[0096] Achieve prediction based on spatiotemporal dependent features.

[0097] 6.2) Spatial Feature Extraction and Temporal Fusion. In the model structure, a graph convolutional network module is first used to extract features from the feature matrix. Adjacency Matrix Convolutional operations are performed to extract topological spatial features between regions or platforms, as mentioned in step 5). Subsequently, the spatial feature vector output by the GCN module is used as input and passed to the Gated Recurrent Unit (GRU) structure to capture the temporal evolution of illegal transaction behavior. The GRU remembers and updates historical states through reset and update gate mechanisms, and its state update formula is as follows:

[0098] The above describes the update and variation of the GRU calculation equation. Through this process, the model can dynamically respond to changes in current transaction data while maintaining historical trends of illegal transactions, thus achieving time-dependent modeling of transaction behavior.

[0099] 6.3) Spatiotemporal Feature Fusion and Predictive Output. To achieve spatiotemporal coupled modeling of illegal transaction behavior, spatial and temporal features are uniformly represented through a gating fusion strategy. The model generates a fused hidden state at each time step. The prediction results are then output through a fully connected layer:

[0100] Through the above process, the T-GCN model can simultaneously capture the spatial topological dependence and temporal dynamic changes of illegal transaction behavior, enabling cross-platform and cross-regional prediction of illegal transaction trends.

[0101] Step 7) Based on a multi-dimensional indicator system, visualize and quantitatively evaluate the model output results, and perform cluster analysis, correlation analysis, time series prediction, and ablation comparison. 7.1) Silhouette Score. It is an important indicator that comprehensively measures the reasonableness of clustering results and is used to evaluate the compactness of samples within a cluster and the separation between clusters.

[0102]

[0103] in, For the sample The average distance to other samples within the same cluster. For the sample The average distance to all samples in the nearest cluster.

[0104] 7.2) PCA Dimensionality Reduction and Visualization Reference Single-Domain Anomaly Node Set: To intuitively present the similarity features between different regions and platforms, this paper uses Principal Component Analysis (PCA) to perform two-dimensional dimensionality reduction on the embedding vectors.

[0105] in, The original embedding feature matrix, These are the eigenvector matrices corresponding to the first two principal components. This represents the low-dimensional situation after dimensionality reduction. By plotting a two-dimensional scatter plot, the distribution and clustering results of different provinces or platforms in the vector space can be visually displayed.

[0106] 7.3) Mean Absolute Error (MAE) Calculation: The mean absolute error is obtained by averaging the absolute differences between each predicted value and the actual value. The formula is: .

[0107] Example 1: Experiments were conducted using the entire modified standard illegal transaction dataset.

[0108] like Figure 2 Figure 3 shows a heatmap reflecting the similarity between platforms and regions. Different colors represent different levels of similarity. Figure 4 ,5 indicates the clustering analysis of the platform and region under the contour coefficient, elbow rule and PCA visualization.

[0109] like Figure 4 As shown, the platform data has only 4 sample points. The optimal clustering number for the platform data is 2, which can effectively distinguish the similarity of illegal transactions across different types of platforms.

[0110] like Figure 5 As shown, the regional data contains 31 sample points. The optimal number of clusters for the regional data is 6. This effectively distinguishes the similarity of illegal transactions in different regions.

[0111] like Figure 6 As shown in Figure 7, the first 80% is the training set, and the last 20% is the test set. A comparison of the actual values, LSTM single-time-series predictions, and T-GCN spatiotemporal fusion predictions over 37 days on the platform and regional test sets in this example shows that the spatiotemporal fusion predictions for both the platform (Douyin Shop) and the region (Hunan Province) are closer to the actual values ​​than the LSTM predictions.

[0112] like Figure 8 Figure 9 shows the comparison of the mean absolute error (MAE) of LSTM single time series prediction and T-GCN fusion prediction on the test set for 37 days in this example. It can be seen that the spatiotemporal fusion prediction has achieved better improvement than LSTM time series prediction.

Claims

1. A spatiotemporal dual-dimensional fusion analysis method for the situation of illegal online transactions based on spatial correlation, characterized by: Step 1) Collect and clean multi-source illegal online transaction data, extract key features such as transaction merchants, transaction platforms, transaction time and geographical location, goods and product types, and construct a standardized illegal online transaction dataset; Step 2) Based on the four types of entities—trading merchants, trading platforms, geographical regions, and traded goods—and their relationships, construct a knowledge graph of illegal online transactions to characterize the semantic and spatial relationships between each node; Step 3) Perform graph embedding modeling on the knowledge graph, generate structured representations of nodes through an improved random walk algorithm, and capture high-order neighborhood relationships between nodes; Step 4) Calculate the similarity vectors between nodes to form an embedding vector matrix, which characterizes the spatial correlation between entities involved in illegal online transactions; Step 5) Input the embedded vector matrix into the graph convolutional network (GCN) model, extract the network spatial features, and establish the spatial dependency relationship of illegal transaction behavior; use the gated recurrent unit (GRU) model to model the time series data of illegal transactions and extract the temporal evolution law of transaction behavior; Step 6) Construct a temporal graph convolutional network (T-GCN) model to fuse spatial and temporal features, capture the spatiotemporal coupling characteristics of illegal online transactions, and achieve dynamic situation prediction. Step 7) Based on the multi-dimensional indicator system, visualize and quantitatively evaluate the model output results, and perform cluster analysis, correlation analysis, time series prediction, and ablation comparison.

2. The spatiotemporal dual-dimensional fusion analysis method for network illegal transaction trends based on spatial correlation improvement according to claim 1, characterized in that, In step 1), the specific method is as follows: Step 1.1) Data Source Selection and Acquisition: Select the "Retail_Transaction_Dataset" dataset from the public data source Kaggle platform as the basic transaction dataset. The dataset contains multi-dimensional information such as transaction number, product information, price, discount, store location, transaction date, payment method, merchant, and product type as the raw information; collect and import the raw data locally, and store it in the database of the data processing module; Step 1.2) Data cleaning and trimming: Remove fields from the original data that are weakly related to the four types of entities in illegal transactions (merchants, trading platforms, geographical regions, and traded goods) and the content required for this study; at the same time, delete abnormal records, null records, and duplicate records. Step 1.3) Spatiotemporal information standardization processing: To address the issue of overly fine-grained store-level location records in the "StoreLocation" field of the original data, an aggregation mapping method is used to uniformly summarize store locations to the provincial administrative division level; Specifically, this includes mapping all transaction records to 62 transaction areas based on geographic coordinates or administrative codes, and further mapping them one-to-one with the 31 provincial-level administrative regions of my country (excluding Hong Kong, Macao and Taiwan) to form a standardized regional division result. The original "TransactionDate" field is converted to the ISO8601 standard time format to provide a consistent time scale for subsequent time-dependent feature modeling; Step 1.4) Since the original data lacks the two key fields "transaction entity" and "e-commerce platform", the following methods are used to supplement and construct them: Transaction entity information is generated based on regional distribution characteristics: According to the geographical distribution characteristics of 31 provincial-level administrative regions, approximately 300 retail merchants are estimated, and merchants are associated with transaction records through random allocation; E-commerce platform information is constructed based on payment method mapping: Based on the correspondence between the "PaymentMethod" field and the platform type, a virtual e-commerce platform mapping is constructed to realize the semantic mapping from offline payment methods to online transaction platforms; Step 1.5) Field Integration and Dataset Standardization Construction: After cleaning, trimming and expansion, the fields are integrated and formatted to form a standardized dataset of illegal online transactions containing the following core attribute columns: transaction time, merchant, product, region, platform, number of illegal transactions, and type of traded product. This dataset of illegal online transactions is used for subsequent knowledge graph construction, graph embedding walks and spatiotemporal fusion analysis.

3. The spatiotemporal dual-dimensional fusion analysis method for network illegal transaction trends based on spatial correlation improvement according to claim 1, characterized in that, In step 2), the specific method is as follows: Step 2.1) Graph Entity Definition and Node Construction: Based on the standardized network illegal transaction dataset obtained in Step 1, the key elements involved in the transaction are abstracted into graph nodes, including: the administrative region node Province, which represents the geographical scope of the transaction; the transaction platform node Platform, which represents the e-commerce platform or payment channel; the business entity node Merchant, which represents the merchants or individuals participating in the transaction; and the product node Product, which describes the product information involved in the transaction. Among them, the administrative region, e-commerce platform and business entity nodes include the name attribute; the product node, in addition to the name attribute, further includes the merchant identifier merchant_id and the product category product_type attribute, which are used for subsequent transaction association analysis and cross-regional propagation modeling; Step 2.2) Relationship Type Design and Edge Attribute Definition: Based on the logic of actual transaction behavior, construct multiple types of relationship edges between nodes, defined as follows: SELLS_ON(M, P): The sales relationship of business entity M on e-commerce platform P; AVAILABLE_ON(PD, P): The availability of product PD on platform P; LOCATED_IN(M, PR): The administrative region PR to which the operating entity M belongs; SELLS(M, PD): The direct sales relationship between business entity M and product PD; Among them, the relationship edge stores transaction attribute information, including: transaction timestamp, illegal_count of illegal transactions by the merchant or platform, province_code of the administrative division where the transaction is located, and product_info of the involved products; the system sets the weight of the directly observed transaction relationship to a lower weight value than the inferred relationship. Step 2.3) Knowledge Graph Construction and Database Implementation: Neo4j graph database is used as the underlying storage and query engine for the knowledge graph. Cypher language is used to implement batch import and index optimization of nodes and relationships, supporting node creation, deletion, modification and query operations. The system visualizes the network structure between merchants, products, platforms and regions through Neo4j's web interface, and finally forms a complete knowledge graph structure based on the "merchant-product-platform-region" quadruple. The graph structure explicitly depicts the semantic association, spatial diffusion and topological relationship of illegal online transactions across multiple platforms and regions.

4. The spatiotemporal dual-dimensional fusion analysis method for network illegal transaction trends based on spatial correlation improvement according to claim 1, characterized in that, In step 3), the specific method is as follows: Step 3.1) Subgraph Sampling and Parameter Tuning: For the complete dataset Perform subset extraction based on random walk sampling; let the original dataset be D, its size be |D|, and the partition ratio be a, then the subset index is calculated as follows: in, This represents a subset of dataset D from the i-th sample to the end; when The longer the time, the larger the size of the extracted subset; when When =1, the subset is empty, indicating that no sampling is performed; by adjusting... This achieves a balance between data scale and computational cost; Step 3.2) Improved Random Walk Modeling: In the graph embedding stage, the Node2Vec model is used to generate node sequences through a biased random walk strategy, capturing local and global structural features; let the current node be... The previous node is The candidate next node is Then from node To the node transition probability Defined as: in, Representing an edge The weight, It is a bias factor, dependent on and shortest path distance The value range is {0, 1, 2}: Among them, the return parameters Control the probability of a random walk returning to the previous node; when As the input and output parameters increase, the wander tends to backtrack; This affects the tendency to wander and explore new areas. The larger the value, the more likely the wanderer is to move away from the current node and explore new communities; Step 3.3) Parameter optimization and hyperparameter setting: By adjusting the returned parameters within the interval [0.5, 2] Input and output parameters Perform a grid search and conduct a comprehensive evaluation based on clustering performance metrics; Step 3.4) Node Embedding Generation and Training: After parameter optimization, perform a biased random walk on the complete knowledge graph to generate multiple node sequences; input the generated node sequences into the Skip-Gram model for training, and learn the node representation vector using the node co-occurrence information in the context window to obtain a node embedding vector with a dimension of 64. Node embedding vectors represent the potential semantic relationships and spatial propagation features between the Province, the Platform, and the Merchant.

5. The spatiotemporal dual-dimensional fusion analysis method for network illegal transaction trends based on spatial correlation improvement according to claim 1, characterized in that, In step 4), the specific method is as follows: Step 4.1) Node Embedding Vector Preparation: After completing the graph embedding modeling in Step 3, obtain the low-dimensional vector representations of the Province nodes and Platform nodes in the knowledge graph. Let the node set be... The corresponding set of embedding vectors is ,in Represents a node of 3D embedding vector; Step 4.2) Similarity Matrix Initialization: Construct an empty two-dimensional similarity matrix. Used to store the similarity between nodes, with an initial value set to zero. For the set of nodes Each pair of nodes in Perform a traversal and calculate the spatial correlation between their vectors using cosine similarity; Remove node With nodes Embedded vector , ; Calculate the dot product and magnitude of vectors. like and Then calculate the cosine similarity: Otherwise, set the similarity to zero; Store the calculation results in a similarity matrix. Because cosine similarity satisfies symmetry, the final matrix will be... Symmetry processing, Finally, a quantized similarity matrix reflecting the relationships between regional nodes and platform nodes is obtained.

6. The spatiotemporal dual-dimensional fusion analysis method for network illegal transaction trends based on spatial correlation improvement according to claim 1, characterized in that, In step 5), the specific method is as follows: By embedding the vector matrix into the graph convolutional network (GCN) model, spatial features of the network are extracted to establish the spatial dependencies of illegal transaction behaviors. The gated recurrent unit (GRU) model is used to model the time series data of illegal transactions and extract the temporal evolution law of transaction behaviors. Step 5.1) Construct a graph convolutional network model to extract spatial features. First, use the embedding vector matrix obtained in Step 4) as input data, and combine it with the adjacency matrix of the illegal transaction network. A Graph Convolutional Network (GCN) is constructed to capture the topological features between regions and the platform; the illegal transaction network is represented as an unweighted graph. in This represents a set of nodes consisting of regions or platforms. The adjacency matrix represents the connecting edges of nodes. It contains only elements of 0 or 1 to indicate whether a transaction relationship exists between nodes; Based on this, a two-layer graph convolutional model is used to extract features from the network. The model is defined as follows: in, This represents the adjacency matrix after self-connection and normalization. and The weight matrix is ​​for a two-layer network. and For activation functions; This structure is used to model the spatial dependencies between regions and platform nodes in an illegal transaction network, and to obtain spatial feature representations with topological semantics. Step 5.2) Extract time features using the gated recurrent unit model. To model the dynamic changes of illegal transaction behavior in the time dimension, input the spatial feature sequence obtained in Step 5.1) into the gated recurrent unit (GRU) model to capture time dependence. The GRU model uses a reset gate and an update gate mechanism to remember and update transaction time series. The update gate combines the input gate and forget gate of LSTM, while the reset gate can directly process the previous hidden state. The calculation equation is as follows: in This represents the current hidden state in the GRU, determined by the hidden state at the previous time step. and current input Joint decision, In the candidate hidden state, For a moment Transaction information, For update gates in GRU, control the proportion of influence of historical states on the current state; This is the reset gate in the GRU, which controls the degree to which the state information from the previous time step is forgotten. To update the parameter matrix of the gate in GRU, This is the parameter matrix of the reset gate in the GRU. This is the parameter matrix of the hidden layer in GRU. This is the bias vector for updating the gate in GRU. Here is the bias vector for the reset gate in the GRU. This refers to the bias vector of the hidden layer in GRU. , For activation functions; The model captures current transaction changes while retaining long-term dependency information from historical transactions, describing the temporal evolution characteristics of illegal transaction behavior. Step 5.3) Establish the spatial and temporal dependency mapping relationship of illegal transactions: Combine the spatial features output by the graph convolutional network with the temporal features output by the gated recurrent unit to form a spatial-temporal correlation feature matrix of illegal transaction behavior, which provides the basic input for the spatiotemporal fusion modeling in Step 6).

7. The spatiotemporal dual-dimensional fusion analysis method for network illegal transaction trends based on spatial correlation improvement according to claim 1, characterized in that, In step 6), the specific method is as follows: Step 6.1) Establish the spatial and temporal dependency mapping relationship of illegal transactions: The inputs to the T-GCN model include: Network topology ,in This represents a set of nodes consisting of regions or platforms. Represents the connecting edges of nodes; adjacency matrix , used to describe the connection state between nodes; feature matrix This represents the historical illegal transaction sequence data of the node, where The length of the time series; Model output is the future Predicted value of illegal transactions at each time step Prediction based on spatiotemporal dependent features is achieved by learning a mapping function; the mapping function is: Step 6.2) Spatial Feature Extraction and Temporal Fusion: In the model structure, the graph convolutional network module is first used to extract the feature matrix. Adjacency Matrix Convolutional operations are performed to extract topological spatial features between regions or platforms. The spatial feature vector output by the GCN module is then used as input and passed to the Gated Recurrent Unit (GRU) structure to capture the temporal evolution of illegal transaction behavior. The GRU remembers and updates historical states through reset and update gate mechanisms. The update and variation of the GRU computation equation are as follows: While maintaining historical trends in illegal transactions, the model can dynamically respond to changes in current transaction data, thus achieving spatiotemporal dependency modeling of transaction behavior. Step 6.3) Spatiotemporal Feature Fusion and Prediction Output: To achieve spatiotemporal coupled modeling of illegal transaction behavior, spatial and temporal features are uniformly represented through a gating fusion strategy. The model generates a fused hidden state at each time step. The prediction results are then output through a fully connected layer: Through the above process, the T-GCN model can simultaneously capture the spatial topological dependence and temporal dynamic changes of illegal transaction behavior, enabling cross-platform and cross-regional prediction of illegal transaction trends.

8. The spatiotemporal dual-dimensional fusion analysis method for network illegal transaction trends based on spatial correlation improvement according to claim 1, characterized in that, In step 7), the specific method is as follows: Step 7.1) Calculate the silhouette score, which is used to evaluate the compactness of samples within a cluster and the separation between clusters: in, For the sample The average distance to other samples within the same cluster. For the sample The average distance to all samples in the nearest cluster; Step 7.2) PCA Dimensionality Reduction and Visualization: Principal Component Analysis (PCA) is used to perform two-dimensional dimensionality reduction on the embedding vectors. in, The original embedding feature matrix, These are the eigenvector matrices corresponding to the first two principal components. To represent the low-dimensional situation after dimensionality reduction, a two-dimensional scatter plot is drawn to show the distribution and clustering results of different provinces or platforms in the vector space; Step 7.3) Calculate the Mean Absolute Error (MAE): The Mean Absolute Error is obtained by averaging the absolute differences between each predicted value and the actual value. The formula is: 。

Images