Integral link resonance early warning method and early warning device

Abstract

The application discloses a kind of integral link resonance early warning method and early warning device, it is related to integral transaction behavior risk assessment technical field.In the method, by dividing the time axis of each integral transfer link into equal length observation window to extract integral net inflow sequence, integral flow volume sequence and account correlation matrix.Again according to the integral net inflow sequence, integral flow volume sequence and account correlation matrix of any two integral transfer links, the synergy coefficient is calculated.The connection edge between the link pair with the synergy coefficient greater than the first preset threshold is constructed link relationship diagram and is divided into multiple connected components, each connected component corresponds a resonance link group.When the number of link in resonance link group is greater than the second preset threshold and the average synergy coefficient in group is greater than the third preset threshold, early warning device will mark resonance link group as abnormal resonance link group and send early warning notice to the management device where administrator is located, improve the risk early warning accuracy of multiple account integral transaction process.

Description

Technical Field

[0001] This application relates to the field of risk assessment technology for points-based transaction behavior, and in particular to a points-based link resonance early warning method and early warning device. Background Technology

[0002] With the rapid development of e-commerce, major e-commerce platforms have launched points reward systems to enhance user stickiness. As part of internet advertising, points reward systems allow users to earn points through purchases, watching advertising videos, participating in brand surveys, or sharing advertising content on social media. These points can be redeemed for goods or services. Because points have equivalent value, the security and standardization of points transactions have a significant impact on the healthy operation of the platform's points reward system.

[0003] Currently, e-commerce platforms primarily employ statistical data analysis to assess the risk of points transactions. By setting fixed observation windows, the system calculates the account's redemption balance index within each window to determine the risk level of the points accumulation process. Specifically, the redemption balance index is the sum of the absolute difference between points withdrawn and withdrawn, multiplied by the increase or decrease in points. When the redemption balance index exceeds a preset threshold, the system will closely monitor the account. This single-time-window-based statistical method performs well in handling simple anomalies.

[0004] However, as transaction volume increases, fixed-window data statistics methods face new challenges. Because the system needs to re-collect data in each time window, continuous transaction behavior is fragmented into multiple independent segments, weakening the correlation between behaviors between consecutive windows. Furthermore, when multiple accounts trade simultaneously, the interaction patterns between accounts are difficult to accurately describe because each account's data is processed independently. Summary of the Invention

[0005] This application provides a points link resonance early warning method and early warning device, which improves the accuracy of risk early warning for the points transaction process of multiple accounts by analyzing the transaction correlation between accounts and the continuity of their behavior.

[0006] Firstly, this application provides a method for early warning of resonance in integral transfer links, comprising: an early warning device dividing the time axis of each integral transfer link into an observation window of equal length; the early warning device determining the net inflow sequence, the flow sequence, and the account correlation matrix of each integral transfer link based on the net inflow of integrals, the flow of integrals, and the total amount of integral transactions of different accounts within each observation window, wherein the net inflow of integrals is the difference between the total inflow of integrals and the total outflow of integrals within the observation window, and the flow of integrals is the sum of the total inflow of integrals and the total outflow of integrals within the observation window; the early warning device calculating the correlation coefficient of the net inflow sequence and the flow sequence of integrals based on any two integral transfer links' net inflow sequence, flow sequence, and account correlation matrix. The system calculates correlation coefficients for the net inflow of points, the flow of points, and the account correlation matrix. For any two points transfer links, the system calculates a coordination coefficient, which is a weighted sum of the correlation coefficients of the net inflow of points sequence, the flow of points sequence, and the account correlation matrix, based on preset weight coefficients. The system connects links with coordination coefficients greater than a first preset threshold, constructs a link relationship graph, and divides the graph into multiple connected components, each corresponding to a resonant link group. When the number of links in a resonant link group exceeds a second preset threshold and the average coordination coefficient within the group exceeds a third preset threshold, the system marks the resonant link group as an abnormal resonant link group and sends an early warning notification to the administrator's management device.

[0007] By adopting the above technical solution, the early warning device first divides the time axis of each points transfer link into observation windows of equal length, facilitating continuous monitoring of points transfer behavior. Based on the two key indicators of net points inflow and outflow, combined with the account correlation matrix, the early warning device can more comprehensively depict the dynamic characteristics of the points transfer links. By calculating the coordination coefficient between points transfer links and constructing a link relationship diagram, links with similar behavioral patterns can be identified, and early warnings can be issued in a timely manner when the group size and internal coordination degree exceed a threshold. This group identification method based on the transaction correlation between accounts and the continuity of their behavior improves the accuracy of risk warnings for multiple account points transaction processes.

[0008] In conjunction with some embodiments of the first aspect, in some embodiments, after the step of the early warning device dividing the time axis of each integral transfer link into an observation window of equal length, the method further includes: the early warning device obtaining a sequence of adjacent transaction time intervals for each integral transfer link by calculating the time difference between two adjacent transactions of each integral transfer link; the early warning device calculating the mean and variance of the time intervals based on the sequence of adjacent transaction time intervals for each integral transfer link, wherein the mean is obtained by adding all time intervals and dividing by the number of intervals, and the variance is the average of the sum of squares of the differences between each time interval and the mean; when the variance of each integral transfer link is less than the mean, the early warning device adjusts the observation window of equal length for each integral transfer link to a first preset observation window; when the variance of each integral transfer link is greater than or equal to the mean, the early warning device adjusts the observation window of equal length for each integral transfer link to a second preset observation window.

[0009] By adopting the above technical solution, the early warning device adjusts the observation window length based on the time interval characteristics of adjacent transactions on each link. When the variance of the transaction time interval is less than the mean, it indicates that the transaction behavior is relatively stable, and a shorter first preset observation window is used. When the variance is greater than the mean, it indicates that the transaction time distribution is uneven, and a longer second preset observation window is used. Through an adaptive window adjustment mechanism, different transaction patterns are observed more reasonably, thereby improving the sensitivity and accuracy of abnormal behavior detection.

[0010] In conjunction with some embodiments of the first aspect, in some embodiments, the early warning device calculates the correlation coefficients of the net inflow sequence, the flow sequence, and the account correlation matrix based on the net inflow sequence, the flow volume sequence, and the account correlation matrix of any two integral transfer links. Specifically, this includes: the early warning device calculating the Pearson correlation coefficient based on the net inflow sequence of any two integral transfer links and taking its negative value to obtain the correlation coefficient of the net inflow sequence; and the early warning device calculating the Pearson correlation coefficient of the rate of change sequence based on the rate of change sequence of the flow volume sequence of any two integral transfer links. The absolute value of the integral flow rate sequence is used to obtain the correlation coefficient of the integral flow rate sequence. The rate of change sequence is the rate of change sequence of each integral flow rate relative to the previous integral flow rate, starting from the second integral flow rate. The early warning device flattens the account correlation degree matrix of any two integral transfer links into one-dimensional vectors column by column. The early warning device calculates the absolute value of the Pearson correlation coefficient between the two flattened vectors in each observation window of the two integral transfer links, and sums the absolute values ​​of the Pearson correlation coefficients of all observation windows and divides them by the number of observation windows to obtain the correlation coefficient of the account correlation degree matrix.

[0011] By employing the above technical solutions, the early warning device calculates the negative correlation coefficient of the net inflow sequences of two points transfer links, reflecting the complementary relationship between the net inflows of points in the two links. For example, when the net inflow of points in link A is positive (inflow increases) and the net inflow of points in link B is negative (outflow increases), the Pearson correlation coefficient of the net inflow sequences between link A and link B is negative, reflecting the complementary flow of points between link A and link B. By calculating the correlation of the change rate sequences of the turnover of two points transfer links, the synchronicity of the changes in the trading activity of the two links can be reflected. An excessively high correlation coefficient of the turnover sequence between two points transfer links indicates that there is a coordinated adjustment of the trading rhythm between the two links. By calculating the correlation coefficient of the account correlation matrix, the correlation relationship between the account groups participating in the trading of the two links can be reflected. The correlation coefficient of the net inflow sequence, the correlation coefficient of the turnover sequence, and the correlation coefficient of the account correlation matrix capture the characteristics of the resonance link from three dimensions: point flow relationship, trading rhythm, and account correlation, respectively. This provides multi-dimensional and clearly fraud-indicating feature parameters for the calculation of the coordination coefficient, making the subsequent identification of resonance links more targeted.

[0012] In conjunction with some embodiments of the first aspect, in some embodiments, before the step of the early warning device calculating the Pearson correlation coefficient based on the net inflow sequence of any two integral transfer links and taking a negative value to obtain the correlation coefficient of the net inflow sequence, the method further includes: the early warning device identifying outliers in the net inflow sequence and integral turnover sequence of each integral transfer link based on the box plot method, and replacing the outliers with the median of the nearest normal value; the early warning device performing standardization processing on the account correlation matrix of each integral transfer link, wherein the standardization processing is to divide the total transaction amount of each account in each column of the account correlation matrix by the sum of the total transaction amounts of all accounts in the same column.

[0013] By adopting the above technical solutions, the early warning equipment first preprocesses the data before conducting correlation analysis. Box plots are used to identify and handle outliers, reducing the interference of extreme data on the analysis results. The account correlation matrix is ​​standardized to reduce the impact of accounts of different sizes. This, in turn, improves the accuracy and reliability of subsequent correlation analysis.

[0014] In conjunction with some embodiments of the first aspect, in some embodiments, the early warning device calculates a coordination coefficient for any two integral transfer links, specifically including: the early warning device maps the correlation coefficient of the integral net inflow sequence of any two integral transfer links to the interval [0, 1] to obtain a normalized integral net inflow sequence correlation coefficient; the early warning device performs a weighted summation of the normalized integral net inflow sequence correlation coefficient, the integral flow sequence correlation coefficient, and the account correlation matrix correlation coefficient of any two integral transfer links based on a preset weight coefficient to obtain a coordination coefficient.

[0015] By adopting the above technical solution, the early warning device maps the correlation coefficient of the net inflow sequence to a unified interval and performs a weighted summation based on preset weights to obtain a synergy coefficient that comprehensively reflects the degree of link correlation. This method based on multi-dimensional feature weighted fusion not only retains the important information of each dimension, but also flexibly adjusts the weights of each dimension according to the actual situation, thereby improving the adaptability and accuracy of abnormal resonance behavior identification.

[0016] In conjunction with some embodiments of the first aspect, in some embodiments, the early warning device connects the links between the link pairs with a coordination coefficient greater than a first preset threshold to construct a link relationship graph, and divides the link relationship graph into multiple connected components, wherein each connected component corresponds to a resonant link group. Specifically, the early warning device connects the links between the link pairs with a coordination coefficient greater than the first preset threshold to construct a link relationship graph, and starting from any node in the link relationship graph, uses a depth-first search to traverse the graph, marking all traversed nodes as first connected components; after the first connected components are constructed, the early warning device selects any node from the unmarked nodes to continue constructing a second connected component based on a depth-first search to traverse the graph, until all nodes are marked, wherein each connected component corresponds to a resonant link group.

[0017] By employing the above technical solution, the early warning device uses a depth-first search algorithm to divide links with significant cooperative relationships into different connected components. This graph theory-based group partitioning method can discover sets of closely related links and mark them as independent resonance groups. Compared to traditional fixed-rule partitioning methods, this dynamic partitioning mechanism more accurately reflects the actual link relationship structure.

[0018] In conjunction with some embodiments of the first aspect, in some embodiments, the method further includes: the early warning device calculating the true positive rate and the false positive rate based on historical abnormal resonance link groups within a preset time period, wherein the true positive rate is the number of correctly identified cheating groups divided by the total number of actual cheating groups, and the false positive rate is the number of incorrectly identified cheating groups divided by the total number of actual normal groups; the early warning device plotting the points corresponding to each candidate preset weight coefficient on a coordinate system with the false positive rate on the horizontal axis and the true positive rate on the vertical axis; the early warning device constructing a receiver operation characteristic curve by connecting the points in the coordinate system; and the early warning device determining the point with the largest difference between the true positive rate and the false positive rate in the receiver operation characteristic curve as the optimal preset weight coefficient.

[0019] By adopting the above technical solution, the early warning equipment determines the weighting coefficients by constructing receiver operating characteristic curves and finding the optimal point, thereby improving the accuracy of early warning parameters. Based on historical data, the true positive rate and false positive rate are calculated, intuitively demonstrating the early warning effect under different parameter settings. The optimal parameter configuration is obtained by maximizing the difference between the true and false positive rates. This data-driven parameter optimization method enhances the accuracy of the early warning model.

[0020] In a second aspect, embodiments of this application provide an early warning device, which includes: one or more processors and a memory; the memory is coupled to the one or more processors, and the memory is used to store computer program code, which includes computer instructions, and the one or more processors call the computer instructions to cause the early warning device to perform the method described in the first aspect and any possible implementation thereof.

[0021] Thirdly, embodiments of this application provide a computer program product containing instructions that, when the computer program product is run on an early warning device, cause the early warning device to perform the method described in the first aspect and any possible implementation thereof.

[0022] Fourthly, embodiments of this application provide a computer-readable storage medium including instructions that, when executed on a warning device, cause the warning device to perform the method described in the first aspect and any possible implementation thereof.

[0023] Understandably, the early warning device provided in the second aspect, the computer program product provided in the third aspect, and the computer storage medium provided in the fourth aspect are all used to execute the methods provided in the embodiments of this application. Therefore, the beneficial effects they can achieve can be referred to the beneficial effects in the corresponding methods, and will not be repeated here.

[0024] One or more technical solutions provided in the embodiments of this application have at least the following technical effects or advantages: 1. By adopting a group identification technology based on collaborative coefficients, a group division mechanism based on depth-first search, and a method for fusing behavioral features of three key dimensions—points flow relationship, transaction rhythm, and account association—this technology solves the technical problem in existing technologies where the interaction patterns between accounts are difficult to accurately describe when multiple accounts are trading simultaneously because each account's data is processed independently. This improves the accuracy of risk warnings for the points trading process of multiple accounts.

[0025] 2. By analyzing the time interval characteristics of adjacent transactions across different links, the system intelligently adjusts the observation window length. When the variance of the transaction time interval is less than the mean, it indicates relatively stable transaction behavior, and a shorter first preset observation window is used. When the variance is greater than the mean, it indicates uneven distribution of transaction time, and a longer second preset observation window is used. This adaptive window adjustment mechanism allows for reasonable observation of different transaction patterns, thereby improving the sensitivity and accuracy of abnormal behavior detection.

[0026] 3. Since the early warning equipment calculates the negative correlation coefficient of the net inflow sequence of two points transfer links, it can reflect the complementary relationship of the net inflow of points between the two links. For example, when the net inflow of points in link A is positive (inflow increases) and the net inflow of points in link B is negative (outflow increases), the Pearson correlation coefficient of the net inflow sequence between link A and link B is negative, reflecting the complementary flow of points between link A and link B. By calculating the correlation of the change rate sequence of the turnover of two points transfer links, the synchronicity of the changes in the trading activity of the two links can be reflected. An excessively high correlation coefficient of the turnover sequence between two points transfer links indicates that there is a coordinated and consistent adjustment of the trading rhythm between the links. By calculating the correlation coefficient of the account correlation matrix, the correlation relationship between the account groups participating in the trading of the two links can be reflected. The correlation coefficient of the net inflow sequence of points, the correlation coefficient of the turnover sequence of points, and the correlation coefficient of the account correlation matrix capture the characteristics of the resonance link from three dimensions: point flow relationship, trading rhythm, and account correlation, respectively. This provides multi-dimensional and clearly fraud-indicating feature parameters for the calculation of the coordination coefficient, making the subsequent identification of resonance links more targeted. Attached Figure Description

[0027] Figure 1 This is a flowchart illustrating an integral link resonance early warning method in an embodiment of this application.

[0028] Figure 2 This is another flowchart illustrating an integral link resonance early warning method in an embodiment of this application.

[0029] Figure 3This is a schematic diagram of the physical device structure of the early warning equipment in the embodiments of this application. Detailed Implementation

[0030] The terminology used in the following embodiments of this application is for the purpose of describing particular embodiments only and is not intended to be limiting of this application. As used in the specification and appended claims of this application, the singular expressions “a,” “an,” “the,” “the,” “the,” and “this” are intended to include the plural expressions as well, unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used in this application refers to and includes any or all possible combinations of one or more of the listed items.

[0031] Hereinafter, the terms "first" and "second" are used for descriptive purposes only and should not be construed as implying or suggesting relative importance or implicitly indicating the number of indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature, and in the description of the embodiments of this application, unless otherwise stated, "multiple" means two or more.

[0032] Since the embodiments of this application involve the application of risk assessment technology for points transaction behavior, for ease of understanding, the relevant terms and concepts involved in the embodiments of this application will be introduced below.

[0033] (1) Box plot A box plot is a statistical chart used to display the distribution of data and identify outliers. It graphically presents the dispersion and distribution of data by plotting key statistics such as the median, quartiles, and outliers of a set of data.

[0034] A box plot mainly consists of boxes, whiskers, and outliers. The upper and lower boundaries of the boxes represent the first quartile (Q1) and the third quartile (Q3), respectively, and the horizontal line in the middle of the box represents the median (Q2). The whiskers typically extend from the upper and lower boundaries of the boxes to the furthest data point within a range of 1.5 times the interquartile range (IQR = Q3 - Q1). Data points outside the whisker range are considered outliers and are marked with separate dots. This type of chart can visually display the central location, dispersion, and skewness of the data, helping to quickly identify outliers in the data.

[0035] In the early warning method of this application, the early warning device can use box plots to identify outliers in the integral net inflow sequence and integral flow sequence of each integral transfer link. For example, for the integral net inflow sequence of a certain integral transfer link, the early warning device first calculates Q1, Q2, Q3, and IQR of the sequence to determine the beard range. If the integral net inflow of a certain observation window exceeds Q3+1.5×IQR or is lower than Q1-1.5×IQR, it is determined to be an outlier. Assuming a sequence Q1=20, Q3=80, IQR=60, the beard range is 20-1.5×60=-70 to 80+1.5×60=170. If the net inflow of a certain window is 200, it is considered an outlier. After identification, the outlier is replaced with the median of the nearest normal value, such as taking the median of the nearest normal data corresponding to the maximum value of 170 within the beard range for replacement, to purify the data and ensure the accuracy of subsequent coherence coefficient calculation and outlier link identification.

[0036] (2) Receiver operating characteristic curve The Receiver Operating Characteristic Curve (ROC curve) is a visualization tool used in integral transfer link anomaly warning scenarios to evaluate the ability of different preset weight coefficients to identify cheating groups. It provides a quantitative basis for selecting the optimal weight coefficients by plotting the relationship between the true positive rate (the proportion of correctly identified cheating groups) and the false positive rate (the proportion of correctly identified normal groups as cheating groups) under different weight combinations.

[0037] In the early warning method of this application, the horizontal axis of the ROC curve represents the false positive rate (FPR), which is the proportion of the actual normal group that is mistakenly identified as cheating; the vertical axis represents the true positive rate (TPR), which is the proportion of the actual cheating group that is correctly identified. Different candidate preset weight coefficients will affect the calculation result of the coordination coefficient, thereby changing the identification threshold of the abnormal group. The closer the curve is to the upper left corner (the true positive rate approaches 1 and the false positive rate approaches 0), the higher the identification accuracy of the corresponding weight coefficient combination. By constructing the ROC curve and finding the point with the largest difference between the true positive rate and the false positive rate, the optimal weight configuration that can reduce both missed detections and false alarms can be determined.

[0038] This application provides a points link resonance early warning method and early warning device, which improves the accuracy of risk early warning for the points transaction process of multiple accounts by analyzing the transaction correlation between accounts and the continuity of their behavior.

[0039] The following describes an integral link resonance early warning method according to an embodiment of this application: Please see Figure 1 This is a flowchart illustrating an integral link resonance early warning method in an embodiment of this application.

[0040] S101, the early warning equipment divides the time axis of each integral transfer link into observation windows of equal length.

[0041] In this context, the early warning equipment refers to the hardware or software used to provide early warnings of anomalies in the points transfer link, and it is the main entity responsible for executing each step. The points transfer link refers to the path through which points are transferred between different accounts. The timeline represents the temporal sequence of points transfer events. An observation window is an equal-length interval formed by dividing the timeline, used for segmented observation of points transfer link data. For example, if the timeline is in days and divided into hourly observation windows, then each observation window is one hour long.

[0042] Specifically, the early warning equipment first determines the range of the time axis, and then divides the time axis into multiple observation windows of equal length according to the same duration, so that the integral transfer data in each window can be analyzed later.

[0043] In some embodiments, the observation window can be dynamically adjusted based on the time difference between two adjacent transactions in each integration transfer link. Specifically, the early warning device first obtains the sequence of adjacent transaction time intervals for each integration transfer link by calculating the time difference between two adjacent transactions in each integration transfer link. Then, the early warning device calculates the mean and variance of the time intervals based on the sequence of adjacent transaction time intervals for each integration transfer link. The mean is obtained by adding all time intervals and dividing by the number of intervals, and the variance is the average of the sum of squares of the differences between each time interval and the mean. When the variance of each integration transfer link is less than the mean, the early warning device adjusts the observation window of each integration transfer link to a first preset observation window of equal length. When the variance of each integration transfer link is greater than or equal to the mean, the early warning device adjusts the observation window of each integration transfer link to a second preset observation window of equal length.

[0044] It is understandable that other methods can be used to divide the observation window of each integral transfer link, and no limitation is made here.

[0045] S102, the early warning device determines the net inflow sequence of points, the flow sequence of points, and the account correlation matrix of each points transfer link based on the net inflow of points, the flow of points, and the total amount of points transactions of different accounts within each observation window.

[0046] Among them, net inflow of points represents the difference between the total inflow and outflow of points within the observation window, reflecting the net flow of points within that window. Point turnover is the sum of the total inflow and outflow of points within the observation window, representing the overall scale of point turnover within that window. Total points transactions for different accounts refers to the total amount of points transactions recorded for each account within each observation window in each points transfer link. The net inflow sequence is a sequence composed of the net inflow of points across different observation windows for each points transfer link, arranged in chronological order. The point turnover sequence is a sequence formed by arranging the point turnover of points across different observation windows for each points transfer link in chronological order. The account correlation matrix is ​​an N×M matrix formed by taking the N accounts included in each points transfer link as columns and the M observation windows as rows, and filling the M total points transactions of each account in the M observation windows into the intersection of the rows and columns of the matrix. Each row of the matrix represents the change of the total points transaction volume of an account in different observation windows, and each column represents the distribution of the total points transaction volume of different accounts in the same observation window. This matrix structure can intuitively present the transaction activity and transaction patterns of each account in the points transfer link over time.

[0047] Specifically, the early warning equipment calculates the total inflow and outflow of points within each observation window of each points transfer link. The difference between the total inflow and outflow is the net inflow of points within each observation window of each points transfer link, and the sum of the total inflow and outflow is the total circulation of points within each observation window of each points transfer link. Simultaneously, this represents the total points transaction volume of different accounts within each observation window of each points transfer link. Then, the net inflow of points across the V points transfer links in each observation window is arranged chronologically to form V net inflow sequences, and the circulation of points across the V points transfer links in each observation window is arranged chronologically to form V circulation sequences. Finally, V account correlation matrices are constructed based on the total points transaction volume of different accounts across the V points transfer links in each observation window.

[0048] S103. The early warning device calculates the correlation coefficient of the net inflow sequence, the correlation coefficient of the flow sequence, and the correlation coefficient of the account correlation matrix based on the net inflow sequence, the flow sequence, and the account correlation matrix of any two integral transfer links.

[0049] The correlation coefficient of the net inflow sequence is obtained by calculating the Pearson correlation coefficient of the net inflow sequences of two integral transfer links and taking the negative value. It represents the complementary relationship of the net inflow of integrals between the two integral transfer links. For example, when the net inflow of integrals in link A is positive (inflow increases) and the net inflow of integrals in link B is negative (outflow increases), the Pearson correlation coefficient of the net inflow sequence between link A and link B is negative, reflecting the complementary flow of integrals between link A and link B. The correlation coefficient of the integral turnover sequence is the absolute value of the Pearson correlation coefficient of the rate of change of integral turnover sequence of two links. It reflects the synchronicity of the changes in trading activity of the two links. An excessively high correlation coefficient of the integral turnover sequence between two integral transfer links indicates that there is a coordinated adjustment of trading rhythm between the links. The correlation coefficient of the account correlation matrix is ​​calculated by calculating the correlation of the account correlation matrix of the two links in each observation window. It reflects the correlation between the groups of accounts participating in trading on the two links.

[0050] Specifically, for any two integral transfer links, the early warning equipment first acquires their net integral inflow sequences, calculates the Pearson correlation coefficient between these two sequences, and then takes the negative value to obtain the correlation coefficient of the net integral inflow sequence. Next, it acquires the integral flow sequence of the two integral transfer links. Using the rate of change sequence of each integral flow relative to the previous integral flow, starting from the second integral flow, it calculates the Pearson correlation coefficient of the rate of change sequence and takes its absolute value to obtain the correlation coefficient of the integral flow sequence. For the correlation coefficient of the account correlation matrix, the two account correlation matrices of the two links are flattened column-wise into one-dimensional vectors, maintaining consistent account correspondence. The absolute value of the Pearson correlation coefficient between the two flattened vectors within each observation window is calculated to obtain the correlation coefficient for that window. The correlation coefficients of all observation windows are summed and divided by the number of observation windows to obtain the correlation coefficient of the account correlation matrix between the link pairs.

[0051] In some embodiments, a specialized mathematical computation library can be used to calculate the correlation coefficients of the net inflow sequences, the integral turnover sequences, and the account correlation matrix of any two integral transfer links. First, the net inflow sequences of the two integral transfer links are input into the library function to calculate the Pearson correlation coefficient and take its negative value. Then, the integral turnover sequences of the two integral transfer links are converted into rate of change sequences and input into the library function to calculate the Pearson correlation coefficient and take its absolute value. Next, for the two account correlation matrices of the two integral transfer links, the vectors are first flattened, and then the absolute value of the correlation coefficient for each window is calculated using the library function. The correlation coefficients of all observation windows are summed and divided by the number of observation windows to obtain the correlation coefficient of the account correlation matrix between the link pair.

[0052] It is understandable that other methods can also be used to calculate the correlation coefficient of net inflow sequence of integrals, correlation coefficient of integral turnover sequence, and correlation coefficient of account correlation matrix for any two integral transfer links, and no limitation is made here.

[0053] S104. The early warning device calculates the coordination coefficient based on the correlation coefficient of the net inflow sequence of any two integral transfer links, the correlation coefficient of the integral flow sequence, and the correlation coefficient of the account correlation matrix.

[0054] The synergy coefficient is a weighted sum of the correlation coefficients of the net inflow of points sequence, the flow of points sequence, and the account correlation matrix, based on preset weight coefficients. It is used to comprehensively reflect the resonance strength between the two points transfer links. For example, if the preset weight coefficients are 0.4, 0.3, and 0.3, and the three correlation coefficients are 0.5, 0.6, and 0.7, then the synergy coefficient is 0.4×0.5+0.3×0.6+0.3×0.7=0.59.

[0055] Specifically, the early warning device obtains the correlation coefficients of the net inflow sequence, the flow sequence, and the account correlation matrix of any two points transfer links, and at the same time obtains the preset weight coefficients. The correlation coefficients of the net inflow sequence, the flow sequence, and the account correlation matrix of the link pair are multiplied by the corresponding weight coefficients, and then the products are added together to obtain the coordination coefficient.

[0056] S105. The early warning device connects the links with a coordination coefficient greater than a first preset threshold to construct a link relationship graph, and divides the link relationship graph into multiple connected components, wherein each connected component corresponds to a resonant link group.

[0057] The coordination coefficient, as described in S104, is a value that comprehensively reflects the resonance strength of the links. The first preset threshold is a pre-set critical value used to determine whether a link pair needs a connecting edge. A link pair refers to any pair consisting of two integral transfer links. A connecting edge is used to indicate that there is an association between link pairs. The link relationship graph is a graph structure composed of links and connecting edges, used to represent the relationships between links. A connected component is a subgraph in the graph where there is at least one path connecting any two nodes. A resonant link group is a group composed of links corresponding to connected components, where there is a strong resonance relationship between these links.

[0058] Specifically, the early warning device first creates an empty graph structure, where the nodes represent the integral transfer links. Then, it traverses all link pairs, obtaining their coordination coefficients. If a coordination coefficient is greater than a first preset threshold, an edge is added between the corresponding two nodes in the graph. After processing all link pairs, a graph connectivity search algorithm, such as a depth-first search algorithm, is used to process the graph and find all connected components. Each connected component corresponds to a resonant link group.

[0059] In some embodiments, a graph database can be used to construct a link relationship graph. First, each link is imported into the database as a node. Then, based on the comparison results of the coordination coefficient and the threshold, edges are added to link pairs that meet the conditions. Finally, the connected component query function provided by the database is used to obtain each connected component and determine the resonant link group.

[0060] It is understandable that other methods can be used to construct resonant link groups, such as using an adjacency matrix to represent the graph structure and then calculating the connected components; this is not limited here.

[0061] S106. When the number of links in the resonant link group is greater than the second preset threshold and the average coordination coefficient within the group is greater than the third preset threshold, the early warning device marks the resonant link group as an abnormal resonant link group and sends an early warning notification to the management device where the administrator is located.

[0062] The resonant link group is as described in S105. The number of links refers to the number of points transfer links included in the resonant link group. The second preset threshold is a pre-set critical value used to determine if the number of links is excessive. The average coordination coefficient within the group is the average of the coordination coefficients of all link pairs within the resonant link group. The third preset threshold is a pre-set critical value used to determine if the average coordination coefficient within the group is too high. An abnormal resonant link group refers to a resonant link group whose number of links and average coordination coefficient both exceed the preset thresholds, indicating that the resonant link group may have abnormal behavior such as organized cheating. The warning notification is a message sent to the administrator's management device to alert them to abnormal situations during the points transaction process.

[0063] Specifically, the early warning device first establishes an information record table for each resonant link group, recording information such as the number of links and the coordination coefficient within the group. The record table is periodically scanned to obtain the number of links in each group and calculate the average coordination coefficient within the group. The obtained values ​​are compared with corresponding preset thresholds. For resonant link groups that meet the conditions for abnormal resonant link groups, they are marked as abnormal in the record table, and an early warning notification containing group information is generated and sent to the management device via the network.

[0064] It is understandable that other methods can also be used to mark the resonant link group as an abnormal resonant link group and send an early warning notification to the management device where the administrator is located. For example, a trigger mechanism can be set up to automatically judge and handle the situation when the number of links or the coordination coefficient of the resonant link group changes. This is not limited here.

[0065] The above embodiments employ a group identification technology based on the coordination coefficient, a group division mechanism based on depth-first search, and a method for fusing behavioral features of three key dimensions: points flow relationship, transaction rhythm, and account association. Therefore, it effectively solves the technical problem in the prior art that when multiple accounts conduct transactions at the same time, the interaction patterns between accounts are difficult to accurately describe because the data of each account is processed independently. This improves the accuracy of risk warning for the points transaction process of multiple accounts.

[0066] However, the net inflow and turnover data of points in the above embodiments were not preprocessed and may be affected by outliers. Furthermore, differences in transaction volume between accounts of different sizes may affect the analysis results, and the preset weighting coefficients may affect the accuracy of risk warnings for the point transaction processes of multiple accounts in the face of constantly changing point transactions.

[0067] Please refer to the following: Figure 2 This is another flowchart illustrating an integral link resonance early warning method in an embodiment of this application.

[0068] S201, the early warning equipment divides the time axis of each integral transfer link into observation windows of equal length.

[0069] S202, the early warning device determines the net inflow sequence of points, the flow sequence of points, and the account correlation matrix of each points transfer link based on the net inflow of points, the flow of points, and the total amount of points transactions of different accounts within each observation window.

[0070] Step S201 is similar to step S101, and step S202 is similar to step S102, so they will not be described again here.

[0071] S203. The early warning device identifies outliers in the net inflow sequence and the flow sequence of each integral transfer link based on the box plot method, and replaces the outliers with the median of the nearest normal value.

[0072] Box plots are a statistical analysis method based on quartiles, which uses boxes, whiskers, and outlier points to illustrate the distribution characteristics of data. Outliers are extreme values ​​that deviate significantly from other values. Nearest normal values ​​are the normal data points within the whisker range that are closest to the outliers. The median is the middle value in a set of data arranged in ascending or descending order. For example, in the data sequence [1, 3, 5, 7, 9, 100], 100 is an outlier, the nearest normal value is 9, and the median is 5.

[0073] Specifically, the early warning equipment calculates the first quartile (Q1), third quartile (Q3), and interquartile range (IQR) for the net inflow sequence and inflow sequence of each integral transfer link; determines the bead range (Q1-1.5×IQR to Q3+1.5×IQR) based on Q1, Q3, and IQR; identifies outliers that exceed the bead range; and for each outlier, finds its nearest normal value, calculates the median of these nearest normal values, and replaces the outlier with the median.

[0074] In some embodiments, box plot parameters of the sequence can be directly calculated using statistical analysis library functions to obtain outlier indices. For each outlier index, its nearest normal value is extracted, and the median is calculated and used as a replacement.

[0075] It is understandable that other methods can be used to identify outliers in the net inflow sequence and the flow sequence of each integral transfer link, such as using sliding window technology to dynamically identify outliers, which is not limited here.

[0076] In step S203, the early warning device identifies outliers in the net inflow sequence and the flow sequence of each integral transfer link based on the box plot method, and replaces the outliers with the median of the nearest normal value before proceeding to step S204.

[0077] S204. The early warning device performs standardized processing on the account correlation matrix of each points transfer link.

[0078] The standardization process involves dividing the total transaction volume of each account in each column of the account correlation matrix by the sum of the total transaction volumes of all accounts in the same column.

[0079] After steps S203 and S204 are completed, step S205 is executed.

[0080] S205. The early warning device calculates the correlation coefficient of the net inflow sequence, the correlation coefficient of the flow sequence, and the correlation coefficient of the account correlation matrix based on the net inflow sequence, the flow sequence, and the account correlation matrix of any two integral transfer links.

[0081] Step S205 is similar to step S103, and will not be described again here.

[0082] S206. The early warning device calculates the coordination coefficient by weighting and summing the correlation coefficients of the net inflow sequence, the flow sequence, and the account correlation matrix of any two integral transfer links based on the optimal preset weight coefficient.

[0083] Among them, the optimal preset weight coefficient refers to a set of weight values ​​that maximize the difference between the true positive rate and the false positive rate, determined by analyzing the receiver operating characteristic (ROC) curve, and is used to calculate the synergy coefficient.

[0084] Specifically, the early warning device first presets multiple sets of different weight coefficients as candidate sets, such as [0.3, 0.3, 0.4], [0.4, 0.4, 0.2], etc. Then, for each set of candidate weights, it uses the annotation information of actual cheating groups and normal groups in historical data to calculate the true positive rate (number of correctly identified cheating groups / total number of actual cheating groups) and the false positive rate (number of incorrectly identified normal groups / total number of actual normal groups). Next, it plots points on the coordinate system and draws an ROC curve, traverses the points on the curve, calculates the difference between the true positive rate and the false positive rate, and finds the weight coefficient corresponding to the point with the largest difference as the optimal value.

[0085] In some embodiments, a grid search method can be used to generate candidate weight coefficients, and the true positive rate and false positive rate of each weight group can be calculated through cross-validation. The ROC curve can be automatically plotted and the optimal weight can be solved. The ROC curve plotting function in the machine learning library can be used to input the classification results under different weights, generate the curve, and find the point of maximum difference through mathematical calculation.

[0086] It is understandable that other methods can be used to generate the optimal preset weight coefficients, such as optimizing the weight coefficients through a genetic algorithm and evaluating fitness using an ROC curve; this is not limited here.

[0087] S207. The early warning device connects the links with a coordination coefficient greater than a first preset threshold to construct a link relationship graph, and divides the link relationship graph into multiple connected components, wherein each connected component corresponds to a resonant link group.

[0088] S208. When the number of links in the resonant link group is greater than the second preset threshold and the average coordination coefficient within the group is greater than the third preset threshold, the early warning device marks the resonant link group as an abnormal resonant link group and sends an early warning notification to the management device where the administrator is located.

[0089] Step S207 is similar to step S105, and step S208 is similar to step S106, so they will not be described again here.

[0090] In this embodiment, the early warning device preprocesses the data before performing correlation analysis. A box plot method is used to identify and handle outliers, avoiding interference from extreme data on the analysis results. Standardization of the account correlation matrix eliminates the influence of accounts of different sizes. Furthermore, by constructing receiver operating characteristic curves and finding the optimal point to determine weighting coefficients, self-optimization of the early warning parameters is achieved, thereby improving the accuracy of risk warnings for multiple account point transactions.

[0091] The above describes an integral link resonance early warning method in the embodiments of this application. The following describes an exemplary early warning device 300 provided in the embodiments of this application.

[0092] Figure 3 This is a schematic diagram of an exemplary hardware structure of the early warning device 300 provided in an embodiment of this application. In some embodiments, the early warning device 300 is a computer device, which includes a processor, a memory, and a network interface connected via a system bus. The processor of the computer device provides computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The database of the computer device is used to store data. The network interface of the computer device is used to communicate with other external terminals or servers via a network connection. In some embodiments, the network interface can be a wired network interface; in some embodiments, the network interface can also be a wireless network interface. When the computer program is executed by the processor, it implements an integral link resonance early warning method according to an embodiment of this application.

[0093] Those skilled in the art will understand that Figure 3 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0094] In some embodiments of this application, a computer-readable storage medium is also provided, including instructions that, when executed on the early warning device 300, cause the early warning device 300 to execute an integral link resonance early warning method according to an embodiment of this application.

[0095] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit it. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

[0096] As used in the above embodiments, depending on the context, the term "when..." can be interpreted as meaning "if...", "after...", "in response to determining...", or "in response to detecting...". Similarly, depending on the context, the phrase "when determining..." or "if (the stated condition or event) is interpreted as meaning "if determining...", "in response to determining...", "when (the stated condition or event) is detected", or "in response to detecting (the stated condition or event)".

[0097] In the above embodiments, implementation can be achieved entirely or partially through software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented entirely or partially in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid-state drive), etc.

[0098] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. This program can be stored in a computer-readable storage medium, and when executed, it can include the processes described in the above method embodiments. The aforementioned storage medium includes various media capable of storing program code, such as ROM or random access memory (RAM), magnetic disks, or optical disks.

Claims

1. An integral link resonance early warning method applied to an early warning device, characterized in that, The method includes: The early warning equipment divides the time axis of each integral transfer link into observation windows of equal length; The early warning device determines the net inflow sequence, flow sequence, and account correlation matrix of each points transfer link based on the net inflow and flow of points in each observation window and the total transaction volume of points for different accounts. The net inflow of points is the difference between the total inflow and outflow of points in the observation window, and the flow of points is the sum of the total inflow and outflow of points in the observation window. The early warning device identifies outliers in the net inflow sequence and inflow sequence of each integral transfer link based on the box plot method, and replaces the outliers with the median of the nearest normal value. The early warning device performs a standardization process on the account correlation matrix of each points transfer link. The standardization process is to divide the total transaction amount of each account in each column of the account correlation matrix by the sum of the total transaction amounts of all accounts in the same column. The early warning device calculates the Pearson correlation coefficient based on the net inflow sequence of any two integral transfer links and takes the negative value to obtain the correlation coefficient of the net inflow sequence. The early warning device calculates the absolute value of the Pearson correlation coefficient of the rate of change sequence based on the rate of change sequence of the integral flow quantity sequence of any two integral transfer links, and obtains the correlation coefficient of the integral flow quantity sequence. The rate of change sequence is the rate of change sequence of each integral flow quantity relative to the previous integral flow quantity, starting from the second integral flow quantity in the integral flow quantity sequence. The early warning device flattens the account correlation matrix of any two points transfer links into a one-dimensional vector column by column; The early warning device calculates the absolute value of the Pearson correlation coefficient between the two flattened vectors within each observation window of the two integral transfer links, and sums the absolute values ​​of the Pearson correlation coefficients of all observation windows and divides them by the number of observation windows to obtain the correlation coefficient of the account correlation matrix. The early warning device calculates a coordination coefficient for any two points transfer links. The coordination coefficient is a weighted sum of the correlation coefficients of the net points inflow sequence, the points transfer volume sequence, and the account correlation matrix based on preset weight coefficients. The early warning device connects the links with a coordination coefficient greater than a first preset threshold to construct a link relationship graph, and divides the link relationship graph into multiple connected components, wherein each connected component corresponds to a resonant link group. When the number of links in a resonant link group exceeds a second preset threshold and the average coordination coefficient within the group exceeds a third preset threshold, the early warning device marks the resonant link group as an abnormal resonant link group and sends an early warning notification to the management device where the administrator is located.

2. The method of claim 1, wherein, After the step of dividing the time axis of each integral transfer link into an observation window of equal length, the method further includes: The early warning device obtains the sequence of adjacent transaction time intervals for each integral transfer link by calculating the time difference between two adjacent transactions for each integral transfer link. The early warning device calculates the mean and variance of the time intervals based on the adjacent transaction time interval sequence of each integral transfer link. The mean is obtained by adding all time intervals together and dividing by the number of intervals. The variance is the average of the sum of squares of the differences between each time interval and the mean. When the variance of each integral transfer link is less than the mean, the early warning device adjusts the observation window of each integral transfer link to a first preset observation window of equal length. When the variance of each integral transfer link is greater than or equal to the mean, the early warning device adjusts the observation window of each integral transfer link to a second preset observation window of equal length.

3. The method of claim 1, wherein, The early warning device calculates the coordination coefficient for any two integral transfer links, specifically including: The early warning device maps the correlation coefficient of the net inflow sequence of any two integral transfer links to the interval [0, 1] to obtain the normalized correlation coefficient of the net inflow sequence of integrals. The early warning device calculates a synergy coefficient by weighting and summing the correlation coefficients of the normalized net inflow sequence, the inflow sequence, and the account correlation matrix of any two inflow transfer links based on preset weighting coefficients.

4. The method of claim 1, wherein, The early warning device connects the links with a coordination coefficient greater than a first preset threshold to construct a link relationship graph, and divides the link relationship graph into multiple connected components, wherein each connected component corresponds to a resonant link group, specifically including: The early warning device connects links with a coordination coefficient greater than a first preset threshold to construct a link relationship graph. Starting from any node in the link relationship graph, it uses a depth-first search to traverse the graph and marks all traversed nodes as the first connected component. After the first connected component is constructed, the early warning device selects any node from the unmarked nodes and continues to construct the second connected component based on a depth-first search traversal of the graph until all nodes are marked, where each connected component corresponds to a resonant link group.

5. The method of claim 1, wherein, The method further includes: The early warning device calculates the true positive rate and false positive rate based on historical abnormal resonance link groups within a preset time period, wherein the true positive rate is the number of correctly identified cheating groups divided by the total number of actual cheating groups, and the false positive rate is the number of incorrectly identified cheating groups divided by the total number of actual normal groups. The early warning device plots the points corresponding to each candidate preset weight coefficient on a coordinate system with the false positive rate on the horizontal axis and the true positive rate on the vertical axis. The early warning device forms a receiver operation characteristic curve by connecting points in the coordinate system; The early warning device determines the point in the receiver's operational characteristic curve where the difference between the true positive rate and the false positive rate is the largest as the optimal preset weight coefficient.

6. A warning device, characterized in that The early warning device includes: one or more processors and a memory; the memory is coupled to the one or more processors, the memory is used to store computer program code, the computer program code including computer instructions, and the one or more processors call the computer instructions to cause the early warning device to perform the method as described in any one of claims 1-5.

7. A computer program product comprising instructions, characterized in that, When the computer program product is run on a warning device, the warning device is caused to perform the method according to any one of claims 1-5.

8. A computer-readable storage medium comprising instructions, characterized in that, When the instructions are run on a warning device, the warning device is caused to perform the method according to any one of claims 1-5.

Images