A credit mall operation and maintenance credible auditing method based on a blockchain distributed ledger

Abstract

This invention discloses a trusted auditing method for the operation and maintenance of an points mall based on a blockchain distributed ledger, comprising the following steps: Step 1: Monitoring the operation event flow in the points mall, collecting points operation behavior data, and parsing the event types; Step 2: Using an improved SHA-256 hash algorithm to form a points operation behavior evidence record; Step 3: Constructing an operation behavior graph based on the points operation behavior evidence record; Step 4: Performing numerical processing to generate behavior representation vectors; Step 5: Performing feature analysis, extracting explicit risk factors, and forming a risk score; Step 6: Generating interpretable audit records for operation paths exceeding a preset risk threshold, and performing digest compression; Step 7: Writing the structured audit evidence data into the blockchain ledger and performing manual review. This invention integrates on-chain evidence storage and behavior scoring mechanisms to achieve trusted auditing and risk control supervision throughout the entire points operation process.

Description

Technical Field

[0001] This invention relates to the fields of blockchain and operation and maintenance auditing technology, and in particular to a trusted auditing method for the operation and maintenance of an points mall based on a blockchain distributed ledger. Background Technology

[0002] With the widespread application of points malls in e-commerce platforms, brand membership systems, and digital rights management systems, the security, transparency, and auditability of user points transactions have become crucial factors for stable system operation and the establishment of user trust. Traditional points malls typically use centralized databases to record user and administrator points issuance, redemption, and refund operations. While possessing basic operational logging capabilities, they often face a series of technical challenges in complex scenarios involving multiple roles, terminals, and channels. Especially after risky behaviors such as abnormal points issuance, unauthorized redemption, high-frequency automated operations, and abuse of administrator privileges occur, existing technologies lack effective behavioral path modeling and verifiable audit traceability mechanisms, leading to frequent problems such as difficulty in determining responsibility, lack of evidence, and unreliable audits.

[0003] Existing point-based behavior recording mechanisms are mostly based on application-layer log output or database trigger capture methods. This approach has two fundamental flaws. First, the integrity and authenticity of operational behavior data heavily rely on database access control and log protection mechanisms, making it vulnerable to tampering or deletion by administrators with backend privileges, lacking non-repudiation and tamper-proof capabilities. Second, although some systems use hash digest protection during data storage, the digest granularity often remains at the transaction level, failing to perform structured modeling and graph analysis of the operational behavior itself (such as operation time, terminal, device information, and operation object), making it impossible to deeply mine the behavioral characteristics and identify risks in an operational chain. Furthermore, existing systems generally lack structured representation and numerical scoring mechanisms for user operation paths, making it difficult to support automated identification of high-risk behavioral paths, and even more difficult to achieve on-chain verifiable audit loops for high-risk operational paths.

[0004] Therefore, how to provide a reliable auditing method for the operation and maintenance of an points mall based on blockchain distributed ledger is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0005] One objective of this invention is to propose a trusted auditing method for the operation and maintenance of an points mall based on a blockchain distributed ledger. This invention integrates structured operational transaction modeling, an improved SHA-256 hash algorithm, behavioral graph construction, and a risk scoring mechanism to achieve full-process recording, trusted auditing, and on-chain verifiable management of points operation behavior. This improves the operational transparency, risk identification capability, and audit traceability of the points mall in multi-role, multi-terminal environments, ensuring the security and compliance of system operation and maintenance.

[0006] A trusted auditing method for the operation and maintenance of an points mall based on a blockchain distributed ledger, according to an embodiment of the present invention, includes the following steps:

[0007] Step 1: Monitor the operation event flow in the front-end application, back-end management system and third-party access interface of the points mall, collect the points operation behavior data between users, administrators or back-end management system, and generate structured operation transaction units by parsing the event types.

[0008] Step 2: Based on each structured operation transaction unit, use the improved SHA-256 hash algorithm to form a record of evidence storage for the integration operation behavior;

[0009] Step 3: Construct an operation behavior graph based on the evidence records of points-based operation behavior;

[0010] Step 4: Traverse each complete operation path in the operation behavior graph and perform numerical processing to generate behavior representation vectors;

[0011] Step 5: Perform feature analysis on the behavior representation vector of each operation path, extract explicit risk factors, and form a risk score for the corresponding operation path;

[0012] Step Six: For operation paths that exceed the preset risk threshold, proceed to the audit record generation process to form an interpretable audit record, and perform summary compression to generate a behavior path summary fingerprint;

[0013] Step 7: Extract interpretable audit records and path summary fingerprints to form structured audit evidence data, write it into the blockchain ledger, and manually review high-risk paths.

[0014] Optionally, step one specifically includes:

[0015] The points management operations include points issuance, points redemption, points refund, points invalidation, points freezing, and account adjustment operations.

[0016] The event type parsing process for the operation event stream includes the following steps:

[0017] Extract information from each field of the captured operation event. The information from each field includes operation subject identifier, operation object identifier, operation type, operation timestamp, operation points amount, operation terminal type, and network identifier information.

[0018] The operation subject identifier is a unique identity code, the operation object identifier is the target points account or product number, the operation type is the type of operation behavior identified by the standard operation code, including issuance, redemption, return and freezing, the operation points amount represents the points value involved in this operation, and is stored using a floating-point field, the operation terminal type includes three categories: Web, App and API interface, and the network identification information includes public IP, device MAC address and fingerprint recognition code;

[0019] The extracted field information is encapsulated into structured operation transaction units according to a preset field order and structural standard. The structured operation transaction units are labeled with field types and field values ​​in key-value pairs and have a unique transaction number and generation timestamp.

[0020] Optionally, the improved SHA-256 hash algorithm is specifically as follows:

[0021] The improved SHA-256 hash algorithm performs hash processing on each structured operation transaction unit to construct a hash list of operation behaviors. The specific steps of the hash processing include:

[0022] The content of each field in the structured operation transaction unit is sorted according to the field name and connected in key-value pair format to form a standardized text representation;

[0023] Standardized text is converted into binary byte data using UTF-8 encoding, generating a continuous bit stream as input information. A bit with a binary value of 1 is added to the end of the bit stream to mark the end of the message, and a 0 bit is added to the end of the bit stream until the overall length meets the requirement of being 64 bits less than an integer multiple of 512.

[0024] 64 bits of binary data are appended to the end of the bit stream to record the bit length of the original normalized text, resulting in a final fixed-length data block sequence;

[0025] The data block sequence is divided into 8 independent data blocks, with each data block serving as a processing unit.

[0026] Before processing each data block, eight variables are set for intermediate storage, with initial values ​​of fixed integers defined by the system.

[0027] For each data block, the first 32 bits are extracted as the initial data segment, and 64 data segments are expanded based on the initial data segment, each data segment being 32 bits in length;

[0028] The system is designed for 64 loops. In each loop, based on the current value of the intermediate variables, the system performs AND operations on the 64 expanded data segments in sequence, gradually updating the values ​​of the 8 intermediate variables.

[0029] After 64 iterations, each current intermediate variable value is added to the initial data segment as the output value after the corresponding data block has been processed.

[0030] Once all data blocks have been processed in sequence, the eight 32-bit output values ​​are concatenated in order to obtain a final digest value of 256 bits in length.

[0031] The final digest value is converted into a hexadecimal representation and used as a unique hash identifier for the corresponding structured operation transaction unit;

[0032] Sort all hash identifiers in ascending order of operation timestamp to construct a list of operation behavior hashes;

[0033] Constructing a Merkle tree structure based on a hash list of operation behaviors, the specific steps of constructing the Merkle tree structure include:

[0034] Use each hash digest value in the action hash list as the raw input to the Merkle leaf node;

[0035] The hash digest values ​​of two adjacent leaf nodes are concatenated to obtain the hash digest value of the parent node;

[0036] Repeat the pairwise concatenation and hash calculation operations to build the upper-level nodes layer by layer until a unique root node hash digest value is finally generated. The root node hash digest value is the Merkle tree root node of the corresponding batch of structured operation transaction unit.

[0037] The on-chain data structure is constructed based on the Merkle tree root node. The fields of the on-chain data structure include the Merkle tree root hash digest value, the start and end times of the time range of the covered operation transactions, the total number of structured operation transaction units contained therein, and the on-chain evidence storage timestamp.

[0038] Call the blockchain write interface accessed by the points mall system to submit the on-chain data structure to the blockchain system's write module;

[0039] The data structure is written and the block is packaged in the blockchain system. The corresponding Merkle tree evidence information is written into the designated block of the ledger on the blockchain, forming a queryable and tamper-proof record of the points operation behavior.

[0040] Optionally, step three specifically includes:

[0041] The node set and edge set of the operation behavior graph are constructed based on the evidence storage records of integral operation behavior.

[0042] The node set includes user nodes, administrator nodes, product nodes, and points account nodes. The user node represents the initiator of the points activity, the administrator node represents the executor of the points operation, the product node represents the object to which points are redeemed, and the points account node represents the account to which the points balance belongs.

[0043] Based on the operation subject identifier and operation object identifier in the structured operation transaction unit, and according to the semantic relationship of operation types such as issuance, exchange, return and freeze, directed connection edges between nodes are constructed. The starting node and target node of the connection edge correspond to the initiator and receiver in the operation behavior, respectively, forming different types of directed behavior edges including user-product, administrator-account and user-account.

[0044] Each directed action edge is assigned an edge attribute, which includes operation type, operation integral amount, operation time offset, operation terminal type and network identification information. The operation time offset is the difference between the current operation time and the time of the previous operation of the same type, calculated in minutes.

[0045] A complete operational behavior graph is constructed based on the set of nodes and the set of edges. The operational behavior graph is a multi-type heterogeneous graph structure with heterogeneous node types, multiple edge types with attributes, and the ability to represent behavioral links in the time dimension.

[0046] Optionally, step four specifically includes:

[0047] Traverse the path number of each complete operation path in the operation behavior graph and add the path number of each operation path, wherein the complete operation path consists of multiple nodes and connecting edges;

[0048] For each complete operation path, the attribute information of the constituent units is extracted, and the attribute information of the constituent units includes node attributes and edge attributes.

[0049] The node attributes are the basic type code and additional attribute values ​​of each node in the operation path. The basic type code includes user, administrator, product and account. The additional attribute values ​​include account points balance, user credit score, administrator operation permission level and product risk control level.

[0050] The attribute information of all constituent units is numerically processed to generate various behavioral features, and behavioral representation vectors are constructed. The numerical processing steps include:

[0051] Calculate the frequency percentage of each type of operation in each operation path;

[0052] Calculate the mean, maximum, and standard deviation of the integral amounts of all operations in each operation path;

[0053] Calculate the mean, variance, and minimum interval between consecutive operation paths;

[0054] Count the number of operation terminal types and their distribution entropy values ​​involved in each operation path;

[0055] Count the number and variety of combination patterns of different role nodes in each operation path;

[0056] Calculate the number of operating devices in each operation path based on the device fingerprint identifier;

[0057] Each behavioral feature is combined in a preset order to form a set of numerical vectors, which are the behavioral representation vectors of the corresponding operation paths.

[0058] Optionally, step five specifically includes:

[0059] For each operation path's behavior representation vector, feature analysis is performed to extract four types of explicit risk factors: operation integral factor, operation frequency factor, time series factor, and behavior consistency factor.

[0060] The operation points factor is the ratio of the total points of each operation within the corresponding operation path to the total points of the user's account.

[0061] The operation frequency factor is the frequency of occurrence of various operation types in the corresponding operation path, and the repetition frequency of the same operation type within a fixed sliding time window is calculated to form an operation density index.

[0062] The time series factor is the time interval between consecutive operations in the corresponding operation path, calculated based on the operation timestamp.

[0063] The behavior consistency factor is the number of device fingerprints and the number of times the terminal type is switched in the corresponding operation path.

[0064] Based on a preset risk rule base, the four types of explicit risk factors are conditionally assessed and labeled. The specific steps for conditional assessment and labeling are as follows:

[0065] If the time interval between consecutive operations in an operation path is less than a set threshold, and the total amount of operation points accounts for a proportion of the user's total points greater than a set threshold, then it is marked as a high-frequency, high-value operation.

[0066] If the operation density index of an operation type in an operation path is greater than a preset threshold, it is marked as having a simple behavioral structure.

[0067] If the number of device fingerprints in an operation path exceeds a preset value, and the number of times the terminal type is switched within a preset time exceeds a preset threshold, it is marked as an abnormal operation environment.

[0068] A fixed risk score is assigned to each type of marker in an operation path, and the risk scores of all markers are summed to form the risk score of the corresponding operation path.

[0069] Optionally, step six specifically includes:

[0070] After completing the risk scoring of all operation paths, it is determined whether there are any operation paths whose risk scores exceed the preset risk threshold. If so, the corresponding operation path is identified as a high-risk path and enters the audit record generation process.

[0071] The audit record generation process specifically includes:

[0072] A unique audit marker is generated for high-risk paths, and the audit marker includes the risk score, score timestamp and path number of the corresponding operation path;

[0073] By binding audit markers with behavioral representation vectors of corresponding operational paths and details of explicit risk factors, a structured and interpretable audit record is formed.

[0074] The audit records are subjected to digest compression to generate a behavior path digest fingerprint. The digest compression step includes formatting the structured and interpretable audit records by field and sorting them by time, concatenating them to form a standard description string, and performing an improved SHA-256 hash algorithm on the standard description string to obtain a unique path digest fingerprint, which is used as the identity confirmation information for the corresponding operation path.

[0075] Optionally, step seven specifically includes:

[0076] Extract interpretable audit record and path summary fingerprints to form structured audit evidence data;

[0077] Call the blockchain write interface to write structured audit evidence data into the blockchain ledger;

[0078] Record the block number and on-chain timestamp of each audit and evidence storage data entry;

[0079] Provides an on-chain audit verification interface based on path digest fingerprints for e-commerce users and third-party audit nodes. The specific steps of the on-chain audit verification interface include:

[0080] Mall users can submit verification requests to the audit verification interface using the path summary fingerprint corresponding to their transaction behavior;

[0081] The points mall system queries the corresponding audit record in the blockchain based on the submitted path digest fingerprint and returns the risk score and score timestamp;

[0082] Third-party audit nodes can gain access through the points mall system to query audit records and path summary fingerprint lists for specified areas in batches according to the audit cycle, and perform structural consistency and quantity integrity checks.

[0083] Freeze the points accounts of users associated with high-risk paths; if a high-risk path involves specific products or redemption channels, temporarily remove the relevant products from the shelves.

[0084] Send a notification of risk behavior details to human auditors to initiate a human review process, which includes reviewing operation logs, contacting users for verification, or re-scoring and analyzing the data.

[0085] The beneficial effects of this invention are:

[0086] This invention effectively enhances the security and audit verifiability of points mall operations by incorporating the entire process of points-based operations into structured modeling and a blockchain-based trusted evidence storage mechanism. By monitoring operation event streams from multiple roles and terminals and generating standardized structured operation transaction units, a unified representation and high-precision recording of points-based behaviors are achieved. An improved SHA-256 hash algorithm combined with a Merkle tree structure establishes an immutable chain-like evidence record for all points-based operations, significantly enhancing data integrity and traceability. An operation behavior graph based on multi-type heterogeneous graphs is introduced, and behavior representation vectors are generated through numerical representation of behavior paths, breaking through the traditional static judgment method of operation logs in auditing. Furthermore, risk scores for operation paths are calculated based on explicit risk factors, and interpretable audit records and path summary fingerprints are generated for high-risk paths, achieving dual protection of risk paths with on-chain queryability and off-chain traceability. This method achieves closed-loop management of the entire process of points-based behavior, from occurrence, identification, evaluation, compression, storage and verification. While ensuring data privacy, it significantly improves the transparency, fairness and credibility of points-based operations. It has strong adaptability and scalability and is suitable for the operation and maintenance auditing needs of various high-security-level points-based systems. Attached Figure Description

[0087] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings:

[0088] Figure 1 This is an overall flowchart of a trusted auditing method for the operation and maintenance of an points mall based on a blockchain distributed ledger, as proposed in this invention.

[0089] Figure 2This is a schematic diagram illustrating the formation of evidence records for points operation behavior based on the improved SHA-256 algorithm in a trusted auditing method for the operation and maintenance of a points mall based on a blockchain distributed ledger proposed in this invention.

[0090] Figure 3 This is a flowchart illustrating the construction of a behavioral representation vector for a trusted auditing method for the operation and maintenance of an points mall based on a blockchain distributed ledger, as proposed in this invention. Detailed Implementation

[0091] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, illustrating only the basic structure of the invention, and therefore only show the components relevant to the invention.

[0092] refer to Figure 1-3 A trusted auditing method for the operation and maintenance of an points mall based on blockchain distributed ledger includes the following steps:

[0093] Step 1: Monitor the operation event flow in the front-end application, back-end management system and third-party access interface of the points mall, collect the points operation behavior data between users, administrators or back-end management system, and generate structured operation transaction units by parsing the event types.

[0094] Step 2: Based on each structured operation transaction unit, use the improved SHA-256 hash algorithm to form a record of evidence storage for the integration operation behavior;

[0095] Step 3: Construct an operation behavior graph based on the evidence records of points-based operation behavior;

[0096] Step 4: Traverse each complete operation path in the operation behavior graph and perform numerical processing to generate behavior representation vectors;

[0097] Step 5: Perform feature analysis on the behavior representation vector of each operation path, extract explicit risk factors, and form a risk score for the corresponding operation path;

[0098] Step Six: For operation paths that exceed the preset risk threshold, proceed to the audit record generation process to form an interpretable audit record, and perform summary compression to generate a behavior path summary fingerprint;

[0099] Step 7: Extract interpretable audit records and path summary fingerprints to form structured audit evidence data, write it into the blockchain ledger, and manually review high-risk paths.

[0100] This step, through the introduction of structured operational behavior modeling, an improved SHA-256 hash algorithm, operational behavior graph construction, and a risk scoring mechanism, achieves full-process collection, in-depth analysis, and tamper-proof storage of points operation data. Compared to traditional centralized log auditing methods, this approach offers advantages such as on-chain verifiability, quantifiable paths, explainable risks, and traceable behaviors, significantly improving the credibility and risk control capabilities of the points mall's operation and maintenance audit in a multi-role environment.

[0101] In this embodiment, step one specifically includes:

[0102] The points management operations include points issuance, points redemption, points refund, points invalidation, points freezing, and account adjustment operations.

[0103] The event type parsing process for the operation event stream includes the following steps:

[0104] Extract information from each field of the captured operation event. The information from each field includes operation subject identifier, operation object identifier, operation type, operation timestamp, operation points amount, operation terminal type, and network identifier information.

[0105] The operation subject identifier is a unique identity code, the operation object identifier is the target points account or product number, the operation type is the type of operation behavior identified by the standard operation code, including issuance, redemption, return and freezing, the operation points amount represents the points value involved in this operation, and is stored using a floating-point field, the operation terminal type includes three categories: Web, App and API interface, and the network identification information includes public IP, device MAC address and fingerprint recognition code;

[0106] The extracted field information is encapsulated into structured operation transaction units according to a preset field order and structural standard. The structured operation transaction units are labeled with field types and field values ​​in key-value pairs and have a unique transaction number and generation timestamp.

[0107] This step involves comprehensive monitoring of all types of point issuance, redemption, refund, and freezing operations. Key fields such as the operation subject, object, time, terminal, and network environment are extracted to generate structured transaction units with unified structure and complete content. This ensures that each point operation is accurately recorded and standardizedly encapsulated at the moment it occurs. This method effectively improves the standardization, comparability, and adaptability of point behavior data for subsequent analysis, providing a high-quality data foundation for behavior modeling, risk identification, and on-chain evidence storage, significantly enhancing the system's audit accuracy and data credibility.

[0108] In this embodiment, the improved SHA-256 hash algorithm is specifically as follows:

[0109] The improved SHA-256 hash algorithm performs hash processing on each structured operation transaction unit to construct a hash list of operation behaviors. The specific steps of the hash processing include:

[0110] The content of each field in the structured operation transaction unit is sorted according to the field name and connected in key-value pair format to form a standardized text representation;

[0111] Standardized text is converted into binary byte data using UTF-8 encoding, generating a continuous bit stream as input information. A bit with a binary value of 1 is added to the end of the bit stream to mark the end of the message, and a 0 bit is added to the end of the bit stream until the overall length meets the requirement of being 64 bits less than an integer multiple of 512.

[0112] 64 bits of binary data are appended to the end of the bit stream to record the bit length of the original normalized text, resulting in a final fixed-length data block sequence;

[0113] The data block sequence is divided into 8 independent data blocks, with each data block serving as a processing unit.

[0114] Before processing each data block, eight variables are set for intermediate storage, with initial values ​​of fixed integers defined by the system.

[0115] For each data block, the first 32 bits are extracted as the initial data segment, and 64 data segments are expanded based on the initial data segment, each data segment being 32 bits in length;

[0116] The system is designed for 64 loops. In each loop, based on the current value of the intermediate variables, the system performs AND operations on the 64 expanded data segments in sequence, gradually updating the values ​​of the 8 intermediate variables.

[0117] After 64 iterations, each current intermediate variable value is added to the initial data segment as the output value after the corresponding data block has been processed.

[0118] Once all data blocks have been processed in sequence, the eight 32-bit output values ​​are concatenated in order to obtain a final digest value of 256 bits in length.

[0119] The final digest value is converted into a hexadecimal representation and used as a unique hash identifier for the corresponding structured operation transaction unit;

[0120] Sort all hash identifiers in ascending order of operation timestamp to construct a list of operation behavior hashes;

[0121] Constructing a Merkle tree structure based on a hash list of operation behaviors, the specific steps of constructing the Merkle tree structure include:

[0122] Use each hash digest value in the action hash list as the raw input to the Merkle leaf node;

[0123] The hash digest values ​​of two adjacent leaf nodes are concatenated to obtain the hash digest value of the parent node;

[0124] Repeat the pairwise concatenation and hash calculation operations to build the upper-level nodes layer by layer until a unique root node hash digest value is finally generated. The root node hash digest value is the Merkle tree root node of the corresponding batch of structured operation transaction unit.

[0125] The on-chain data structure is constructed based on the Merkle tree root node. The fields of the on-chain data structure include the Merkle tree root hash digest value, the start and end times of the time range of the covered operation transactions, the total number of structured operation transaction units contained therein, and the on-chain evidence storage timestamp.

[0126] Call the blockchain write interface accessed by the points mall system to submit the on-chain data structure to the blockchain system's write module;

[0127] The data structure is written and the block is packaged in the blockchain system. The corresponding Merkle tree evidence information is written into the designated block of the ledger on the blockchain, forming a queryable and tamper-proof record of the points operation behavior.

[0128] This step generates a unique 256-bit digest value by performing standardized hashing on structured operation transaction units, combined with data filling, block partitioning, and a 64-round intermediate variable iteration update mechanism. This constructs a hash list of operation behaviors and further generates a Merkle tree structure to ensure the overall integrity of batch point-based behavior data. By combining the Merkle tree root hash with the operation scope, data quantity, timestamp, etc., into an on-chain data structure and writing it into the blockchain ledger, immutable, batch-level chain-based evidence storage of point-based operation behaviors is achieved, effectively improving the integrity, security, and credibility of audit data.

[0129] In this embodiment, step three specifically includes:

[0130] The node set and edge set of the operation behavior graph are constructed based on the evidence storage records of integral operation behavior.

[0131] The node set includes user nodes, administrator nodes, product nodes, and points account nodes. The user node represents the initiator of the points activity, the administrator node represents the executor of the points operation, the product node represents the object to which points are redeemed, and the points account node represents the account to which the points balance belongs.

[0132] Based on the operation subject identifier and operation object identifier in the structured operation transaction unit, and according to the semantic relationship of operation types such as issuance, exchange, return and freeze, directed connection edges between nodes are constructed. The starting node and target node of the connection edge correspond to the initiator and receiver in the operation behavior, respectively, forming different types of directed behavior edges including user-product, administrator-account and user-account.

[0133] Each directed action edge is assigned an edge attribute, which includes operation type, operation integral amount, operation time offset, operation terminal type and network identification information. The operation time offset is the difference between the current operation time and the time of the previous operation of the same type, calculated in minutes.

[0134] A complete operational behavior graph is constructed based on the set of nodes and the set of edges. The operational behavior graph is a multi-type heterogeneous graph structure with heterogeneous node types, multiple edge types with attributes, and the ability to represent behavioral links in the time dimension.

[0135] This step constructs a multi-type node set consisting of users, administrators, products, and points accounts, and generates directed operation edges based on the semantic relationships between the operation subjects and objects, forming a structured points operation behavior graph. Each edge is appended with multi-dimensional attributes such as operation type, points amount, time offset, terminal type, and network identifier, comprehensively reflecting the dynamic relationships of points operations among different roles. This graph adopts a multi-type heterogeneous structure design, possessing the ability to express behavioral links across roles, terminals, and time dimensions, providing a graph structure foundation and semantic support for subsequent path analysis, risk identification, and audit tracing.

[0136] In this embodiment, step four specifically includes:

[0137] Traverse the path number of each complete operation path in the operation behavior graph and add the path number of each operation path. The complete operation path consists of multiple nodes and connecting edges.

[0138] For each complete operation path, the attribute information of the constituent units is extracted, and the attribute information of the constituent units includes node attributes and edge attributes.

[0139] The node attributes are the basic type code and additional attribute values ​​of each node in the operation path. The basic type code includes user, administrator, product and account. The additional attribute values ​​include account points balance, user credit score, administrator operation permission level and product risk control level.

[0140] The attribute information of all constituent units is numerically processed to generate various behavioral features, and behavioral representation vectors are constructed. The numerical processing steps include:

[0141] Calculate the frequency percentage of each type of operation in each operation path;

[0142] Calculate the mean, maximum, and standard deviation of the integral amounts of all operations in each operation path;

[0143] Calculate the mean, variance, and minimum interval between consecutive operation paths;

[0144] Count the number of operation terminal types and their distribution entropy values ​​involved in each operation path;

[0145] Count the number and variety of combination patterns of different role nodes in each operation path;

[0146] Calculate the number of operating devices in each operation path based on the device fingerprint identifier;

[0147] Each behavioral feature is combined in a preset order to form a set of numerical vectors, which are the behavioral representation vectors of the corresponding operation paths.

[0148] This step involves systematically collecting attribute information from each node and edge in the operational behavior graph by assigning path numbers and extracting attributes for each complete path. It then integrates account points, user reputation, operational permissions, risk control levels, and other data with operational behavior characteristics. By numerically processing operational type frequency, point statistics, time interval distribution, terminal usage distribution, role combination patterns, and device quantity, a clear and complete behavioral representation vector is formed. This enhances the computability and comparability of complex point-based behavioral paths, providing a quantitative basis for subsequent risk factor extraction and audit scoring.

[0149] In this embodiment, step five specifically includes:

[0150] For each operation path's behavior representation vector, feature analysis is performed to extract four types of explicit risk factors: operation integral factor, operation frequency factor, time series factor, and behavior consistency factor.

[0151] The operation points factor is the ratio of the total points of each operation within the corresponding operation path to the total points of the user's account.

[0152] The operation frequency factor is the frequency of occurrence of various operation types in the corresponding operation path, and the repetition frequency of the same operation type within a fixed sliding time window is calculated to form an operation density index.

[0153] The time series factor is the time interval between consecutive operations in the corresponding operation path, calculated based on the operation timestamp.

[0154] The behavior consistency factor is the number of device fingerprints and the number of times the terminal type is switched in the corresponding operation path.

[0155] Based on a preset risk rule base, the four types of explicit risk factors are conditionally assessed and labeled. The specific steps for conditional assessment and labeling are as follows:

[0156] If the time interval between consecutive operations in an operation path is less than a set threshold, and the total amount of operation points accounts for a proportion of the user's total points greater than a set threshold, then it is marked as a high-frequency, high-value operation.

[0157] If the operation density index of an operation type in an operation path is greater than a preset threshold, it is marked as having a simple behavioral structure.

[0158] If the number of device fingerprints in an operation path exceeds a preset value, and the number of times the terminal type is switched within a preset time exceeds a preset threshold, it is marked as an abnormal operation environment.

[0159] A fixed risk score is assigned to each type of marker in an operation path, and the risk scores of all markers are summed to form the risk score of the corresponding operation path.

[0160] This step involves in-depth analysis of the behavioral representation vector of the operation path, clearly identifying four explicit risk factors: operation points, operation frequency, time series, and behavioral consistency. Based on quantitative characteristics such as the proportion of operation amount, operation density, time interval, and changes in equipment fingerprints, conditional judgments are made to identify risk patterns such as high-frequency, high-value, structurally simple, and abnormal operating environments. Each risk marker has a clearly defined trigger threshold and corresponding score. Finally, by weighted summation of the risk scores, a quantifiable and interpretable path-level risk score is generated, improving the accuracy and operability of point-based behavioral risk identification.

[0161] In this embodiment, step six specifically includes:

[0162] After completing the risk scoring of all operation paths, it is determined whether there are any operation paths whose risk scores exceed the preset risk threshold. If so, the corresponding operation path is identified as a high-risk path and enters the audit record generation process.

[0163] The audit record generation process specifically includes:

[0164] A unique audit marker is generated for high-risk paths, and the audit marker includes the risk score, score timestamp and path number of the corresponding operation path;

[0165] By binding audit markers with behavioral representation vectors of corresponding operational paths and details of explicit risk factors, a structured and interpretable audit record is formed.

[0166] The audit records are subjected to digest compression to generate a behavior path digest fingerprint. The digest compression step includes formatting the structured and interpretable audit records by field and sorting them by time, concatenating them to form a standard description string, and performing an improved SHA-256 hash algorithm on the standard description string to obtain a unique path digest fingerprint, which is used as the identity confirmation information for the corresponding operation path.

[0167] After scoring all operational paths, this step identifies high-risk paths by comparing them with preset thresholds and generates a unique audit tag for each path, containing the score, timestamp, and path number, thus achieving precise location of risky paths. This audit tag is then bound to the path's behavioral representation vector and risk factor details to construct an audit record with structured semantics and traceability. The audit record is then compressed into a standard description string, and a digest fingerprint is generated using an improved SHA-256 algorithm, giving each high-risk path a unique identifier and improving the verifiability, evidence storage efficiency, and subsequent on-chain citation capabilities of the audit results.

[0168] In this embodiment, step seven specifically includes:

[0169] Extract interpretable audit record and path summary fingerprints to form structured audit evidence data;

[0170] Call the blockchain write interface to write structured audit evidence data into the blockchain ledger;

[0171] Record the block number and on-chain timestamp of each audit and evidence storage data entry;

[0172] Provides an on-chain audit verification interface based on path digest fingerprints for e-commerce users and third-party audit nodes. The specific steps of the on-chain audit verification interface include:

[0173] Mall users can submit verification requests to the audit verification interface using the path summary fingerprint corresponding to their transaction behavior;

[0174] The points mall system queries the corresponding audit record in the blockchain based on the submitted path digest fingerprint and returns the risk score and score timestamp;

[0175] Third-party audit nodes can gain access through the points mall system to query audit records and path summary fingerprint lists for specified areas in batches according to the audit cycle, and perform structural consistency and quantity integrity checks.

[0176] Freeze the points accounts of users associated with high-risk paths; if a high-risk path involves specific products or redemption channels, temporarily remove the relevant products from the shelves.

[0177] Send a notification of risk behavior details to human auditors to initiate a human review process, which includes reviewing operation logs, contacting users for verification, or re-scoring and analyzing the data.

[0178] This step combines interpretable audit records with path digest fingerprints to create structured audit evidence data, which is then written to the blockchain ledger, achieving immutable evidence storage and highly available indexing of points-based transactions. On-chain timestamps and block numbers ensure the audit process has time-traceability capabilities. The system provides a verification interface based on digest fingerprints, allowing users to self-verify their transactions, enhancing user trust; third-party audit nodes can also batch-obtain segment data and perform consistency checks, strengthening audit independence. Simultaneously, the system automatically freezes high-risk path-related accounts and products, combined with manual review processes, to achieve a closed-loop risk control system of automated handling and manual intervention.

[0179] Example 1:

[0180] To verify the feasibility of this invention in practice, it was applied to a points mall built by a large e-commerce platform. The platform has long faced problems such as users illegally accumulating points, internal administrators abusing their privileges to manipulate points accounts, and unclear and difficult-to-track product redemption paths. Traditional risk control methods previously relied upon mainly included operation log retention, blacklist mechanisms, and periodic manual spot checks. However, these methods have significant drawbacks: log information is difficult to guarantee immutability, making it impossible to perform structural analysis of high-frequency transaction behavior; blacklist strategies are lagging, often intervening only after risks have occurred; and manual auditing is inefficient, with long processing cycles and limited coverage.

[0181] To address the aforementioned issues, this embodiment applies the proposed trusted auditing method for the operation and maintenance of an e-commerce points mall based on blockchain distributed ledgers to the operating environment of this platform. The system first introduces an operation event monitoring module into the points operation chain to collect real-time user-initiated data on points issuance, redemption, and refund actions. This data, combined with administrator actions, product identification codes, and points account information, generates structured operation transaction units. Each transaction is tagged with high-precision timestamps, terminal type, network identifiers, and other metadata to ensure the reproducibility of operation details.

[0182] In the data processing flow, the system utilizes an improved SHA-256 hash algorithm to construct a Merkle tree digest of daily operational behavior. The root node is synchronously written to the blockchain consortium chain, while the original transaction units are stored in an encrypted off-chain database, forming a two-layer data structure that is verifiable on the blockchain and traceable off-chain. Subsequently, the system dynamically constructs an operational behavior graph based on daily data, including user nodes, administrator nodes, product nodes, and account nodes, and introduces edge attributes such as operation type, points amount, and device fingerprint to complete the heterogeneous graph construction. The system analyzes the complete paths in the graph, extracting explicit risk factors such as time intervals, points amount statistics, and terminal switching, and generates behavioral tags based on a preset rule base. For example, if a user completes five high-value redemption operations within 10 minutes and frequently switches terminals, the system assigns a dual risk label of "high-frequency, high-value operation" and "abnormal operating environment." After all risk tags are quantified and scored, paths exceeding the threshold are packaged to generate interpretable audit records, and a unique digest fingerprint is generated using the improved SHA-256 hash algorithm and written to the blockchain.

[0183] During actual operation, the system continuously identified multiple high-risk paths. For example, a user used five different devices to repeatedly perform redemption operations on the same product account within a short period of time, accumulating 78% of the account balance in points. This resulted in a risk score as high as 86.5, which was identified as a high-risk path by the system, and the account was frozen. The platform's backend initiated a manual review of the user, confirming the existence of system vulnerability exploitation, and adjusted the product redemption rules accordingly.

[0184] To verify the practical effectiveness of this method, we compared it with three traditional auditing solutions: a "post-audit mechanism based on log retention," a "rule-based sampling mechanism based on user behavior frequency," and a "periodic screening mechanism based on score change thresholds." The statistical comparison is shown in the table below.

[0185] Table 1 Comparison of Risk Audit Mechanisms in Points Malls

[0186]

[0187] As can be seen from the data analysis in Table 1, the method of this invention significantly outperforms traditional solutions in terms of audit response time, suspicious operation identification rate, multi-device switching identification rate, audit record interpretability, verifiability, and average review cycle. Especially in multi-device environments, traditional methods often miss detections due to the lack of terminal tracking mechanisms, while this invention effectively identifies spoofed transaction behavior by introducing device fingerprints and terminal switching indicators. Simultaneously, by combining the immutable on-chain verification capabilities of blockchain, the credibility and external verifiability of the entire audit process are enhanced, truly achieving credible supervision and efficient auditing closed loop throughout the entire lifecycle of points transactions.

[0188] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A trusted auditing method for the operation and maintenance of an points mall based on a blockchain distributed ledger, characterized in that, Includes the following steps: Step 1: Monitor the operation event flow in the front-end application, back-end management system and third-party access interface of the points mall, collect points operation behavior data between users, administrators and back-end management system, and perform event type parsing to generate structured operation transaction units; Step 2: Based on each structured operation transaction unit, use the improved SHA_256 hash algorithm to form a record of evidence storage for the integration operation behavior; Step 3: Construct an operation behavior graph based on the evidence records of points-based operation behavior; Step 4: Traverse each complete operation path in the operation behavior graph and perform numerical processing to generate behavior representation vectors; Step 5: Perform feature analysis on the behavior representation vector of each operation path, extract four types of explicit risk factors, and form a risk score for the corresponding operation path; The four types of explicit risk factors include operation integral factors, operation frequency factors, time series factors, and behavioral consistency factors: The operation points factor is the ratio of the total points of each operation within the corresponding operation path to the total points of the user's account. The operation frequency factor is the frequency of occurrence of various operation types in the corresponding operation path, and the repetition frequency of the same operation type within a fixed sliding time window is calculated to form an operation density index. The time series factor is the time interval between consecutive operations in the corresponding operation path, calculated based on the operation timestamp. The behavior consistency factor is the number of device fingerprints and the number of times the terminal type is switched in the corresponding operation path. Step Six: After completing the risk scoring of all operation paths, determine whether there are any operation paths whose risk scores exceed the preset risk threshold. If so, the corresponding operation path is identified as a high-risk path, enters the audit record generation process, forms an interpretable audit record, and performs summary compression to generate a behavior path summary fingerprint. Step 7: Extract interpretable audit records and path summary fingerprints to form structured audit evidence data, write it into the blockchain ledger, and manually review high-risk paths.

2. The trusted auditing method for the operation and maintenance of an points mall based on a blockchain distributed ledger as described in claim 1, characterized in that, Step one specifically includes: The points management operations include points issuance, points redemption, points refund, points invalidation, points freezing, and account adjustment operations. The event type parsing process for the operation event stream includes the following steps: Extract information from each field of the captured operation event. The information from each field includes operation subject identifier, operation object identifier, operation type, operation timestamp, operation points amount, operation terminal type, and network identifier information. The operation subject identifier is a unique identity code, the operation object identifier is the target points account or product number, the operation type is the type of operation behavior identified by the standard operation code, including issuance, redemption, return and freezing, the operation points amount represents the points value involved in this operation, and is stored using a floating-point field, the operation terminal type includes three categories: Web, App and API interface, and the network identification information includes public IP, device MAC address and fingerprint recognition code; The extracted field information is encapsulated into structured operation transaction units according to a preset field order and structural standard. The structured operation transaction units are labeled with field types and field values ​​in key-value pairs and have a unique transaction number and generation timestamp.

3. The trusted auditing method for the operation and maintenance of an points mall based on a blockchain distributed ledger as described in claim 1, characterized in that, The improved SHA_256 hash algorithm is as follows: The improved SHA_256 hash algorithm performs hash processing on each structured operation transaction unit to construct a hash list of operation behaviors. The specific steps of the hash processing include: The content of each field in the structured operation transaction unit is sorted according to the field name and connected in key-value pair format to form a standardized text representation; The standardized text is converted into binary byte data according to UTF_8 encoding, and a continuous bit stream is generated as input information. A bit with a binary value of 1 is added to the end of the bit stream to mark the end of the message, and a 0 bit is added to the end of the bit stream until the overall length meets the requirement of being 64 bits less than an integer multiple of 512. Append 64 bits of binary data to the end of the bitstream to record the bit length of the original normalized text, resulting in the final output. A fixed-length sequence of data blocks; The data block sequence is divided into 8 independent data blocks, with each data block serving as a processing unit. Before processing each data block, eight variables are set for intermediate storage, with initial values ​​of fixed integers defined by the system. For each data block, the first 32 bits are extracted as the initial data segment, and 64 data segments are expanded based on the initial data segment, each data segment being 32 bits in length; The system is designed for 64 loops. In each loop, based on the current value of the intermediate variables, the system performs a bitwise AND operation on the 64 expanded data segments in sequence, gradually updating the values ​​of the 8 intermediate variables. After 64 iterations, each current intermediate variable value is added to the initial data segment as the output value after the corresponding data block has been processed. Once all data blocks have been processed in sequence, the eight 32-bit output values ​​are concatenated in order to obtain a final digest value of 256 bits in length. The final digest value is converted into a hexadecimal representation and used as a unique hash identifier for the corresponding structured operation transaction unit; Sort all hash identifiers in ascending order of operation timestamp to construct a list of operation behavior hashes; Constructing a Merkle tree structure based on an operation behavior hash list, the steps of constructing the Merkle tree structure specifically include: using each hash digest value in the operation behavior hash list as the original input of the Merkle tree leaf node; The hash digest values ​​of two adjacent leaf nodes are concatenated to obtain the hash digest value of the parent node; Repeat the pairwise concatenation and hash calculation operations to build the upper-level nodes layer by layer until a unique root node hash digest value is finally generated. The root node hash digest value is the Merkle tree root node of the corresponding batch of structured operation transaction unit. The on-chain data structure is constructed based on the Merkle tree root node. The fields of the on-chain data structure include the Merkle tree root hash digest value, the start and end times of the time range of the covered operation transactions, the total number of structured operation transaction units contained therein, and the on-chain evidence storage timestamp. Call the blockchain write interface accessed by the points mall system to submit the on-chain data structure to the blockchain system's write module; The data structure is written and the block is packaged in the blockchain system. The corresponding Merkle tree evidence information is written into the designated block of the ledger on the blockchain, forming a queryable and tamper-proof record of the points operation behavior.

4. The trusted auditing method for the operation and maintenance of an points mall based on a blockchain distributed ledger as described in claim 1, characterized in that, Step three specifically involves: Based on the evidence records of points-based operation behavior, a set of nodes and edges is constructed to form an operation behavior graph. The set of nodes includes user nodes, administrator nodes, product nodes, and points account nodes. The user node represents the initiator of the points-based operation, the administrator node represents the executor of the points-based operation, the product node represents the object to which points are redeemed, and the points account node represents the account to which the points balance belongs. Based on the operation subject identifier and operation object identifier in the structured operation transaction unit, and according to the semantic relationship of operation types such as issuance, exchange, return and freeze, directed connection edges between nodes are constructed. The starting node and target node of the connection edge correspond to the initiator and receiver in the operation behavior, respectively, forming different types of directed behavior edges including user-product, administrator-account, and user-account. Each directed action edge is assigned an edge attribute, which includes operation type, operation integral amount, operation time offset, operation terminal type and network identification information. The operation time offset is the difference between the current operation time and the time of the previous operation of the same type, calculated in minutes. A complete operational behavior graph is constructed based on the set of nodes and the set of edges. The operational behavior graph is a multi-type heterogeneous graph structure with heterogeneous node types, multiple edge types with attributes, and the ability to represent behavioral links in the time dimension.

5. A trusted auditing method for the operation and maintenance of an points mall based on a blockchain distributed ledger, as described in claim 1, is characterized in that... Step four specifically involves: Traverse the path number of each complete operation path in the operation behavior graph and add the path number of each operation path. The complete operation path consists of multiple nodes and connecting edges. For each complete operation path, the attribute information of the constituent units is extracted, and the attribute information of the constituent units includes node attributes and edge attributes. The node attributes are the basic type code and additional attribute values ​​of each node in the operation path. The basic type code includes user, administrator, product and account. The additional attribute values ​​include account points balance, user credit score, administrator operation permission level and product risk control level. The attribute information of all constituent units is numerically processed to generate various behavioral features, and behavioral representation vectors are constructed. The numerical processing steps include: Calculate the frequency percentage of each type of operation in each operation path; Calculate the mean, maximum, and standard deviation of the integral amounts of all operations in each operation path; Calculate the mean, variance, and minimum interval between consecutive operation paths; Count the number of operation terminal types and their distribution entropy values ​​involved in each operation path; Count the number and variety of combination patterns of different role nodes in each operation path; Calculate the number of operating devices in each operation path based on the device fingerprint identifier; Each behavioral feature is combined in a preset order to form a set of numerical vectors, which are the behavioral representation vectors of the corresponding operation paths.

6. A trusted auditing method for the operation and maintenance of an points mall based on a blockchain distributed ledger, as described in claim 1, is characterized in that... Step five specifically involves: Feature analysis is performed on the behavior representation vector of each operation path to extract four types of explicit risk factors; Based on a preset risk rule base, the four types of explicit risk factors are conditionally assessed and labeled. The specific steps for conditional assessment and labeling are as follows: If the time interval between consecutive operations in an operation path is less than a set threshold, and the total amount of operation points accounts for a proportion of the user's total points greater than a set threshold, then it is marked as a high-frequency, high-value operation. If the operation density index of an operation type in an operation path is greater than a preset threshold, it is marked as having a single behavior structure; if the number of device fingerprints in an operation path exceeds a preset value, and the number of times the terminal type is switched within a preset time exceeds a preset threshold, it is marked as having an abnormal operation environment. A fixed risk score is assigned to each type of marker in an operation path, and the risk scores of all markers are summed to form the risk score of the corresponding operation path.

7. A trusted auditing method for the operation and maintenance of an points mall based on a blockchain distributed ledger, as described in claim 1, is characterized in that... Step six specifically includes: The audit record generation process specifically includes: A unique audit marker is generated for high-risk paths, and the audit marker includes the risk score, score timestamp and path number of the corresponding operation path; By binding audit markers with behavioral representation vectors of corresponding operational paths and details of explicit risk factors, a structured and interpretable audit record is formed. The audit records are compressed to generate a behavior path summary fingerprint. The compression step includes formatting the structured and interpretable audit records by field and sorting them by time, concatenating them to form a standard description string, and performing an improved SHA_256 hash algorithm on the standard description string to obtain a unique path summary fingerprint, which is used as the identity confirmation information for the corresponding operation path.

8. A trusted auditing method for the operation and maintenance of an points mall based on a blockchain distributed ledger, as described in claim 1, is characterized in that... Step seven specifically includes: Extract interpretable audit log and path summary fingerprints to form structured audit evidence data; Call the blockchain write interface to write structured audit evidence data into the blockchain ledger; Record the block number and on-chain timestamp of each audit and evidence storage data entry; Provide an on-chain audit verification interface based on path digest fingerprints for e-commerce users and third-party audit nodes. The specific steps of the on-chain audit verification interface include: Mall users can submit verification requests to the audit verification interface using the path summary fingerprint corresponding to their transaction behavior; The points mall system queries the corresponding audit record in the blockchain based on the submitted path digest fingerprint and returns the risk score and score timestamp; Third-party audit nodes can gain access through the points mall system to query audit records and path summary fingerprint lists for specified areas in batches according to the audit cycle, and perform structural consistency and quantity integrity checks. Freeze the points accounts of users associated with high-risk paths; if a high-risk path involves specific products or redemption channels, temporarily remove the relevant products from the shelves. Send a notification of risk behavior details to human auditors to initiate a human review process, which includes reviewing operation logs, contacting users for verification, or re-scoring and analyzing the data.

Images