Recharge request processing method and device and related equipment

Abstract

The invention provides a recharge request processing method and device and related equipment, and belongs to the technical field of security, and the method comprises the steps: determining a matching score according to the matching degree of a unified feature vector and a plurality of rules in a preset rule vector fingerprint database; under the condition that the matching score is greater than a first threshold value and less than or equal to a second threshold value, generating an entropy etching sample by utilizing a target entropy wave generator based on the unified feature vector and request information in the recharging request; based on the entropy corrosion sample and a preset behavior phase field engine, identifying whether the recharge request is abnormal or not, and obtaining identification information; and under the condition that the identification information indicates that the recharging request is abnormal, generating a first memory rule according to the identification information, and updating the rule vector fingerprint database according to the first memory rule. According to the method, the processing accuracy of the recharge request can be improved.

Description

Technical Field

[0001] This application relates to the field of security technology, and in particular to a method, apparatus and related equipment for processing recharge requests. Background Technology

[0002] In recent years, black and gray market activities in various recharge request services, exemplified by mobile phone top-ups, have become increasingly complex and covert. They often employ malware, fake accounts, and automated tools to commit fraud, causing significant social harm and socioeconomic losses. Currently, big data analytics and machine learning are widely used in identifying anomalies in recharge requests. However, these methods heavily rely on historical data for training. When attack methods iterate rapidly and new, unseen attack patterns emerge, these methods struggle to detect and adapt in a timely manner, resulting in low accuracy in processing recharge requests. Summary of the Invention

[0003] This application provides a recharge request processing method, apparatus, and related equipment, which can solve the technical problem of low accuracy in recharge request processing.

[0004] In a first aspect, embodiments of this application provide a recharge request processing method, applied to a first edge node in a risk control network, the method comprising:

[0005] Obtain the user's recharge request;

[0006] Generate a unified feature vector based on the features in the recharge request;

[0007] The matching score is determined based on the degree of matching between the unified feature vector and multiple rules in the preset rule vector fingerprint database;

[0008] If the matching score is less than or equal to a first threshold, the recharge request is allowed to recharge the user's corresponding account; or,

[0009] If the matching score is greater than a first threshold and less than or equal to a second threshold, an entropy erosion sample is generated using a target entropy wave generator based on the unified feature vector and the request information in the recharge request; based on the entropy erosion sample and a preset behavior phase field engine, an identification information is obtained to determine whether the recharge request is abnormal; if the identification information indicates that the recharge request is abnormal, a first memory rule is generated according to the identification information, and the rule vector fingerprint database is updated according to the first memory rule; or...

[0010] If the matching score is greater than the second threshold, the recharge request is frozen; a second memory rule is generated based on the unified feature vector; and the rule vector fingerprint database is updated according to the second memory rule.

[0011] Optionally, generating a unified feature vector based on the features in the recharge request includes:

[0012] Within a preset time window, the features in the recharge request are matched with the rule vector fingerprint database to obtain the fingerprint matching frequency within the preset time window;

[0013] The length of the preset time window is updated based on the fingerprint matching frequency to obtain the target time window;

[0014] Dynamic time-series slicing is performed on the recharge request according to the target time window to obtain multi-scale time-series slices;

[0015] The recharge variation coefficient and amount distribution entropy are determined based on multi-scale time series slices.

[0016] The multi-scale time series slice is decomposed into multiple sub-bands, and multiple energy percentages corresponding to the multiple sub-bands are obtained;

[0017] The unified feature vector is generated based on the recharge variation coefficient, the amount distribution entropy, and the multiple energy proportions.

[0018] Optionally, based on the unified feature vector and the request information in the recharge request, an entropy erosion sample is generated using a target entropy wave generator. The method further includes:

[0019] Based on the pre-added noise and the preset denoising network model, determine the diffusion reconstruction loss of the initial entropy wave generator;

[0020] Based on the diffusion reconstruction loss and the tensor reaction acceleration kernel set in the initial entropy wave generator, the loss function of the initial entropy wave generator is determined;

[0021] Based on historical recharge requests, the hidden state vector of the user behavior corresponding to the historical recharge requests is extracted using the behavior phase field engine.

[0022] Based on the hidden state vector and the loss function, the parameters of the initial entropy wave generator are updated to obtain the target entropy wave generator.

[0023] Optionally, before determining the diffusion reconstruction loss of the initial entropy wave generator based on pre-added noise and a preset denoising network model, the method further includes:

[0024] Based on the preset acceleration weights that follow a normal distribution, the preset scheduling coefficients in the initial entropy wave generator are updated to obtain the updated scheduling coefficients.

[0025] The initial denoising network is updated based on the updated scheduling coefficients to obtain the target denoising network.

[0026] Optionally, the step of identifying whether the recharge request is abnormal based on the entropy erosion sample and the preset behavior phase field engine includes:

[0027] The entropy erosion sample is mixed with a sample randomly selected from a preset seed library to obtain a mixed entropy erosion sample.

[0028] Based on the hybrid entropy erosion sample, the endpoint of the hidden state evolution trajectory is determined using the preset behavior phase field engine;

[0029] If the distance between the endpoint of the hidden state evolution trajectory and the preset reference baseline is less than or equal to a third threshold, it is determined that the recharge request is abnormal.

[0030] If the distance between the endpoint of the hidden state evolution trajectory and the preset reference baseline is greater than a third threshold, it is determined that the recharge request is not abnormal.

[0031] Optionally, after obtaining the identification information based on the entropy erosion sample and the preset behavior phase field engine to determine whether the recharge request is abnormal, the method further includes:

[0032] If the identification information indicates that the recharge request is not abnormal, the parameters of the tensor reaction acceleration kernel are adjusted along the loss gradient direction, and the user's recharge request is allowed to recharge the user's corresponding account.

[0033] If the identification information indicates that the recharge request is abnormal, a first memory rule is generated based on the identification information, the rule vector fingerprint database is updated according to the first memory rule, and the user's recharge request is frozen.

[0034] Optionally, the risk control network includes multiple edge nodes, and after updating the rule vector fingerprint database, the method further includes:

[0035] A two-dimensional dynamic gradient field is constructed based on the pattern innovation index and topological potential energy index corresponding to the multiple edge nodes.

[0036] If the matching score is greater than a first threshold and less than or equal to a second threshold, the feature information of the first memory rule is extracted; a first signal packet is formed based on the feature information of the first memory rule and the spatiotemporal context corresponding to the first memory rule; the first signal packet is propagated in the risk control network according to a preset propagation strategy and the two-dimensional dynamic gradient field to update the preset rule vector fingerprint database corresponding to the multiple edge nodes; or,

[0037] If the matching score is greater than the second threshold, the feature information of the second memory rule is extracted; a second signal packet is formed according to the feature information of the second memory rule and the spatiotemporal context corresponding to the second memory rule; the second signal packet is propagated in the risk control network according to the preset propagation strategy and the two-dimensional dynamic gradient field to update the preset rule vector fingerprint library corresponding to the multiple edge nodes.

[0038] Secondly, embodiments of this application provide a recharge request processing apparatus, the apparatus comprising:

[0039] The acquisition module is used to acquire users' recharge requests;

[0040] The first processing module is used to generate a unified feature vector based on the features in the recharge request;

[0041] The second processing module is used to determine the matching score based on the degree of matching between the unified feature vector and multiple rules in the preset rule vector fingerprint database.

[0042] The third processing module is configured to allow the recharge request to be processed and the corresponding user account recharged if the matching score is less than or equal to a first threshold; or,

[0043] If the matching score is greater than a first threshold and less than or equal to a second threshold, an entropy erosion sample is generated using a target entropy wave generator based on the unified feature vector and the request information in the recharge request; based on the entropy erosion sample and a preset behavior phase field engine, an identification information is obtained to determine whether the recharge request is abnormal; if the identification information indicates that the recharge request is abnormal, a first memory rule is generated according to the identification information, and the rule vector fingerprint database is updated according to the first memory rule; or...

[0044] If the matching score is greater than the second threshold, the recharge request is frozen; a second memory rule is generated based on the unified feature vector; and the rule vector fingerprint database is updated according to the second memory rule.

[0045] Thirdly, embodiments of this application provide an electronic device, including: a processor, a memory, and a program stored in the memory and executable on the processor, wherein when the program is executed by the processor, it implements the steps of the recharge request processing method as described in the first aspect.

[0046] Fourthly, embodiments of this application provide a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the recharge request processing method as described in the first aspect.

[0047] Fifthly, embodiments of this application provide a computer program product, including computer instructions that, when executed by a processor, implement the steps of the recharge request processing method as described in the first aspect.

[0048] In this embodiment, a matching score is determined based on the degree of matching between a unified feature vector and multiple rules in a preset rule vector fingerprint database. The user's recharge request is then processed in a tiered manner based on the matching score, improving the overall accuracy of recharge request processing. Furthermore, an entropy erosion sample covering various potential anomaly forms is generated from the recharge request using a target entropy wave generator and a preset behavior phase field engine to identify new attack patterns. This allows for accurate identification of whether anomalies exist in the recharge request, effectively recognizing novel attack patterns not yet covered in the rule vector fingerprint database, thereby further improving the accuracy of recharge request processing. Attached Figure Description

[0049] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0050] Figure 1 This is one of the flowcharts of a recharge request processing method provided in the embodiments of this application;

[0051] Figure 2 This is a second flowchart of a recharge request processing method provided in an embodiment of this application;

[0052] Figure 3 This is a schematic diagram of the structure of a recharge request processing device provided in an embodiment of this application;

[0053] Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0054] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0055] The terms "first," "second," etc., used in this application are used to distinguish similar objects and not to describe a specific order or sequence. It should be understood that such terms can be used interchangeably where appropriate so that embodiments of this application can be implemented in orders other than those illustrated or described herein, and the objects distinguished by "first" and "second" are generally of the same class, not limited in number; for example, the first object can be one or more. Furthermore, "and / or" in this application indicates at least one of the connected objects. For example, the scope of protection of "A and / or B" covers at least three scenarios: Scenario 1: including A but not B; Scenario 2: including B but not A; Scenario 3: including both A and B. Additionally, the character " / " generally indicates that the preceding and following objects are in an "or" relationship.

[0056] See Figure 1 , Figure 1 This is one of the flowcharts of a recharge request processing method provided in the embodiments of this application, such as... Figure 1 As shown, the recharge request processing method, applied to the first edge node in the risk control network, includes the following steps:

[0057] Step 101: Obtain the user's recharge request;

[0058] The risk control network can be a security control network jointly controlled by multiple edge nodes (including multiple edge nodes such as the first edge node, the second edge node, and the third edge node), which can be used to perform risk control processing on users' recharge requests;

[0059] The first edge node can be one of multiple edge nodes in the risk control network;

[0060] The recharge request can be a mobile phone bill recharge request, a recharge request for other virtual goods or virtual services, or other types of online recharge requests; this application only uses a mobile phone bill recharge request as an example for illustration.

[0061] In this step, the user's recharge request is obtained, providing a data foundation for processing the recharge request.

[0062] Step 102: Generate a unified feature vector based on the features in the recharge request;

[0063] The features in the recharge request can be obtained by listening to the real-time call detail record (CDR) stream of the billing gateway and capturing fields such as the International Mobile Subscriber Identity (IMSI), recharge timestamp (milliseconds), recharge amount, payment channel, and geographical location in the user's recharge request.

[0064] In this step, a unified feature vector is generated based on the features in the recharge request, providing a data foundation for matching the unified feature vector with the preset rule vector fingerprint database.

[0065] Step 103: Determine the matching score based on the degree of matching between the unified feature vector and multiple rules in the preset rule vector fingerprint database;

[0066] The rule vector fingerprint database can be a rule vector fingerprint database pre-constructed based on historical recharge requests and / or labeled historical black market attack logs, by extracting rule vector fingerprints; the rule vector fingerprint database can be used for similarity matching of unified feature vectors.

[0067] Specifically, the rule vector fingerprint database may include multiple rules; each rule corresponds to a rule vector fingerprint; the multiple rule vector fingerprints may be in the form of triples, for example, rule vector fingerprints ;

[0068] in, The feature vector describes the detection dimension, which can be recharge frequency, time period distribution, amount dispersion, etc. The specific dimension is determined according to business needs; d is used to characterize the dimension of F.

[0069] The threshold value represents the critical value that triggers the rule.

[0070] The weights represent the importance of the rule in comprehensive decision-making.

[0071] More specifically, the rule vector fingerprint database may include a basic rule database and a memory rule database;

[0072] When initializing the rule vector fingerprint database for each edge node:

[0073] For the basic rule base, high-frequency attack patterns (e.g., the top 100 high-frequency patterns) within a preset frequency range can be extracted from historical black market attack logs and / or historical recharge requests. The corresponding F and T parameters can be manually defined for each pattern, and the initial weight W can be set to 0.7.

[0074] For the memory rule base, rules can be filtered based on successfully intercepted records within a preset time range (e.g., the past thirty days) under the premise of meeting preset recall conditions (e.g., meeting the condition of recall greater than 95%). The memory rule base is updated by incremental addition, and its initial weight can be set to 1.0.

[0075] More specifically, when storing the rule vector fingerprint, a prefix tree index can be used to index the rule feature vector to accelerate matching; for example, F can be discretized into binary code to construct multi-level tree nodes; leaf nodes store the corresponding rule set, and candidate rules can be quickly located along the tree path during subsequent matching.

[0076] In this step, a matching score is determined based on the degree of matching between the unified feature vector and multiple rules in the preset rule vector fingerprint database. This provides an accurate data basis for identifying whether the recharge request is abnormal, thereby improving the accuracy of abnormal recharge request identification.

[0077] Step 104: If the matching score is less than or equal to the first threshold, allow the recharge request to be processed to recharge the user's corresponding account; or,

[0078] If the matching score is greater than a first threshold and less than or equal to a second threshold, an entropy erosion sample is generated using a target entropy wave generator based on the unified feature vector and the request information in the recharge request; based on the entropy erosion sample and a preset behavior phase field engine, an identification information is obtained to determine whether the recharge request is abnormal; if the identification information indicates that the recharge request is abnormal, a first memory rule is generated according to the identification information, and the rule vector fingerprint database is updated according to the first memory rule; or...

[0079] If the matching score is greater than the second threshold, the recharge request is frozen; a second memory rule is generated based on the unified feature vector; and the rule vector fingerprint database is updated according to the second memory rule.

[0080] The first threshold, the second threshold, and the third threshold described below can all be set by those skilled in the art as needed;

[0081] The entropy wave generator can specifically be a type of diffusion model, which involves progressively adding noise to a preset sample (such as the request information in the recharge request) for diffusion, and generating entropy erosion samples through a denoising process. This allows the entropy erosion samples to fuse and explicitly expose multiple potential anomaly patterns (the anomaly patterns can include various novel attack patterns).

[0082] More specifically, the entropy wave generator can employ... The t-model is a diffusion model implementation for the backbone network.

[0083] The behavior phase field engine can be a large language model in the field of behavior pattern recognition. It is used to construct a multidimensional behavior phase field in a high-dimensional feature space based on preset samples (such as the entropy erosion samples mentioned above), perform trajectory evolution analysis on the preset samples or their corresponding hidden state vectors, and determine the endpoint state of the evolution trajectory, thereby identifying whether the preset samples contain abnormal patterns.

[0084] The first memory rule and the second memory rule can be stored as corresponding rules in the rule vector fingerprint library.

[0085] More specifically, the corresponding rule vector fingerprint can be generated by extracting the feature information, trigger threshold (trigger condition) and preset weight of the first memory rule and the second memory rule, and the rule vector fingerprint database can be updated by adding to it.

[0086] In this step, for recharge requests with a matching score less than or equal to the first threshold, the recharge requests are directly allowed, and the recharge operation is performed on the corresponding user account. By adopting a fast-through strategy for these obviously normal recharge requests, the impact of risk control intervention on normal users can be minimized while ensuring security, thus improving the accuracy of processing normal recharge requests.

[0087] For recharge requests with a matching score greater than the first threshold and less than or equal to the second threshold, instead of simply allowing them or directly blocking them, the combined action of the entropy wave generator and the behavior phase field engine can discover and characterize abnormal patterns in the recharge requests that have not yet appeared in the rule vector fingerprint database without the need for pre-defined rules.

[0088] Specifically, the entropy wave generator generates entropy erosion samples covering various potential abnormal forms by adding noise, spreading, and denoising preset samples; the behavior phase field engine analyzes the evolution trajectory and final state of the entropy erosion samples to identify abnormal patterns that deviate from reference behavior (such as predefined normal behavior), which enables identification even in the face of previously unseen attack methods; and generates abnormal patterns as memory rules and writes them into the rule vector fingerprint library (such as writing them into the aforementioned memory rule library), thereby significantly reducing the false positive and false negative rates in the risk range while continuously expanding the rule coverage, and improving the accuracy of recharge request processing;

[0089] For recharge requests with a matching score greater than the second threshold, the recharge requests are directly frozen to prevent financial losses or the spread of mass attacks caused by the continued execution of abnormal recharge requests. Simultaneously, a second memory rule is generated based on the unified feature vector and added to the rule vector fingerprint database for subsequent rapid identification and interception of identical or similar abnormal recharge requests, improving the accuracy of recharge request processing.

[0090] It is understandable that the above attack pattern is one of the above abnormal patterns; various network attacks launched by hackers or others are one of the abnormal behaviors.

[0091] In this embodiment, a matching score is determined based on the degree of matching between a unified feature vector and multiple rules in a preset rule vector fingerprint database. The user's recharge requests are then processed in a tiered manner based on the matching score, improving the overall accuracy of recharge request processing. Furthermore, an entropy erosion sample covering various potential anomaly forms is generated from the recharge requests using a target entropy wave generator and a preset behavior phase field engine to identify new attack patterns (as a type of anomaly). This allows for accurate identification of whether a recharge request is abnormal, effectively recognizing novel attack patterns not yet covered in the rule vector fingerprint database, thereby further improving the accuracy of recharge request processing.

[0092] In this application, the case where the matching score is less than or equal to the first threshold is also referred to as a low-risk case;

[0093] The case where the matching score is greater than the first threshold and less than or equal to the second threshold is also referred to as a medium-risk case.

[0094] The situation where the matching score is greater than the second threshold is also referred to as a high-risk situation.

[0095] In some implementations, generating a unified feature vector based on the features in the recharge request includes:

[0096] Within a preset time window, the features in the recharge request are matched with the rule vector fingerprint database to obtain the fingerprint matching frequency within the preset time window;

[0097] The length of the preset time window is updated based on the fingerprint matching frequency to obtain the target time window;

[0098] Dynamic time-series slicing is performed on the recharge request according to the target time window to obtain multi-scale time-series slices;

[0099] The recharge variation coefficient and amount distribution entropy are determined based on multi-scale time series slices.

[0100] The multi-scale time series slice is decomposed into multiple sub-bands, and multiple energy percentages corresponding to the multiple sub-bands are obtained;

[0101] The unified feature vector is generated based on the recharge variation coefficient, the amount distribution entropy, and the multiple energy proportions.

[0102] In this embodiment, the recharge request features are matched with the rule vector fingerprint database within a preset time window to obtain the fingerprint matching frequency within that time window. The length of the time window is then dynamically adjusted accordingly to obtain the target time window. This allows the target time window to dynamically adjust with the fingerprint matching frequency, solving the problem that a single time window is insufficient to capture complex attack patterns. Based on the target time window, the recharge requests are dynamically sliced ​​in time series to obtain multi-scale time series slices. The recharge variation coefficient and amount distribution entropy are calculated to characterize the fluctuations and abnormal concentrations of recharge frequency and amount distribution in different time periods. Simultaneously, the multi-scale time series slices are decomposed into multiple sub-frequency bands and their corresponding energy proportions are obtained to characterize periodic or sudden abnormal patterns from the frequency domain dimension.

[0103] A unified feature vector is generated based on the recharge variation coefficient, amount distribution entropy, and energy proportion of each sub-band. This unified feature vector can comprehensively reflect the characteristics of recharge behavior in the time, statistical, and spectral dimensions, improve the distinguishability of abnormal recharge behavior (including new attack patterns), and thus improve the accuracy of recharge request processing.

[0104] For example, taking the user's recharge request as a mobile phone top-up as an example, please refer to [link to relevant documentation]. Figure 2 , Figure 2 This is a second flowchart of a recharge request processing method provided in an embodiment of this application, as shown below. Figure 2 As shown:

[0105] The recharge request is dynamically sliced ​​to obtain the coefficient of variation of the recharge interval, the entropy of the amount distribution, and the energy ratio of the sub-band. A feature vector is generated based on the coefficient of variation of the recharge interval, the entropy of the amount distribution, and the energy ratio of the sub-band. The matching score is determined based on the degree of matching between the unified feature vector and multiple rules in the preset rule vector fingerprint library. Different matching scores are divided into low-risk, high-risk, and medium-risk situations. In the medium-risk situation, the adversarial melting optimization is triggered. The entropy wave generator and the behavior phase field engine are used to identify new attack patterns, realizing the dynamic simulation of unknown attack variants and the adaptive correction of defense rules.

[0106] For example, when a user initiates a phone bill recharge request, a sliding time window τ is triggered; initially 5 minutes, the frequency of rule fingerprint matching within the current window is calculated in real time, as shown in the first formula below:

[0107]

[0108] In the first formula, Used to indicate the frequency of fingerprint matching; Used to represent multiple rules in the rule vector fingerprint database; Used to represent The Rules; Used to represent The corresponding feature vector; Features used to indicate recharge requests within a preset time window; Used to represent and The degree of matching; Used for debugging triggers The threshold; Used to indicate an indicator function, when When true, The frequency increases by 1, When it is false, The frequency does not increase;

[0109] For example, if If the time window is reduced to half of the original time window, the detection granularity will be improved.

[0110] If three consecutive time windows If so, the time window is expanded to 1.5 times the original time window.

[0111] Optionally, three time windows of varying lengths can be preset to simultaneously generate time series slices at three scales, specifically including:

[0112] Coarse-grained time series slices (time window of 60 minutes) are used to detect long-period patterns, such as low-frequency large-amount recharges spanning hours.

[0113] Medium-granularity time series slices, such as the time window adjusted according to the fingerprint matching frequency as described above, and the initial time window length can be 5 minutes;

[0114] Fine-grained time series slices (time window of 1 second) are used to capture instantaneous pulse attacks, such as 10 small recharges within 0.5 seconds.

[0115] For example, the coefficient of variation of recharge intervals (i.e., recharge coefficient of variation) can be determined based on multi-scale time series slices, as shown in the second formula below:

[0116]

[0117] In the second formula, The '&' represents the coefficient of variation of the phone bill recharge interval; This represents the standard deviation of the time interval between adjacent recharges; It is used to represent the average recharge time interval, which can reflect the uniformity of the recharge rhythm.

[0118] For example, the entropy of monetary distribution can be determined based on multi-scale time series slices using the following third formula:

[0119]

[0120] In the third formula, Used to represent the entropy of monetary distribution; It represents several (e.g., 10) discrete intervals of monetary amount, such as 0-10 yuan and 10-20 yuan, etc. Used to represent The probability under the given circumstances; Used to indicate the number of intervals into which the amount is divided.

[0121] Understandably, a high entropy value indicates a dispersed distribution of funds, which may be normal behavior; a low entropy value may be a characteristic of black market activities.

[0122] For example, multi-scale time series slices The decomposition yields 16 sub-bands. The energy percentage of each sub-band can be calculated using the following formula (fourth formula):

[0123]

[0124] in, Used to indicate the first Individual frequency band energy percentage For the first The coefficients of each sub-band (e.g., obtained by wavelet packet decomposition of multi-scale time series slices) (Sub-band coefficient vector). The decomposition of multi-scale time series slices can be achieved by wavelet packet decomposition or other methods. The number of sub-bands can be set by those skilled in the art according to actual needs and is not limited to a specific value.

[0125] For example, the unified feature vector can be generated from the recharge variation coefficient, the amount distribution entropy, and the multiple energy proportions. ,specific It can normalize each feature dimension and calculate a unified feature vector and rules. The matching score can be referenced from the fifth formula below:

[0126]

[0127] in, This is used to represent the matching score corresponding to the j-th rule in the rule vector fingerprint database. Used to represent the normalized value of the i-th feature in the unified feature vector; This is used to represent the value of the i-th feature corresponding to the j-th rule in the rule vector fingerprint database. The historical standard deviation of feature i is used to normalize the differences; Used to represent the weight corresponding to the j-th rule; This is a distance reduction coefficient used to control matching sensitivity;

[0128] Understandably, the higher the matching score, the closer the current feature is to the rule, and the greater the likelihood of an anomaly.

[0129] Furthermore, you can select rules whose scores fall within a preset range to determine the overall risk value; taking the five rules with the highest matching scores as an example, the overall risk value can be calculated using the following formula (number six):

[0130]

[0131] in, For indicator functions, only when Exceeding the threshold Contribute risk at the time; Used to represent the matching score corresponding to the j-th rule in the rule vector fingerprint database; This indicates the number of rules within a preset range, for example... , ;

[0132] Specifically, using 0.9 as the second threshold, In cases where a recharge request is determined to be high-risk, the recharge request is immediately frozen, and a second memory rule is generated.

[0133] Using 0.6 as the second threshold, when In this case, the recharge request is determined to be a medium-risk situation, triggering the anti-melting optimization verification;

[0134] when In cases where the recharge request is determined to be low-risk, the user's reference baseline can be updated, and the recharge request can be allowed to recharge the user's corresponding account.

[0135] Specifically, the process of generating memory rules can be as follows: When an exception is successfully intercepted, extract the current feature vector. Generate memory rules And satisfy:

[0136]

[0137] in, Used to represent The threshold; Used to represent The weight.

[0138] In some implementations, based on the unified feature vector and the request information in the recharge request, an entropy erosion sample is generated using a target entropy wave generator. The method further includes:

[0139] Based on the pre-added noise and the preset denoising network model, determine the diffusion reconstruction loss of the initial entropy wave generator;

[0140] Based on the diffusion reconstruction loss and the tensor reaction acceleration kernel set in the initial entropy wave generator, the loss function of the initial entropy wave generator is determined;

[0141] Based on historical recharge requests, the hidden state vector of the user behavior corresponding to the historical recharge requests is extracted using the behavior phase field engine.

[0142] Based on the hidden state vector and the loss function, the parameters of the initial entropy wave generator are updated to obtain the target entropy wave generator.

[0143] In this embodiment, the diffusion reconstruction loss is calculated based on pre-added noise and a preset denoising network model, enabling the entropy wave generator to accurately reconstruct recharge behavior samples even under noise perturbation. Subsequently, the diffusion reconstruction loss and tensor reaction acceleration kernel are combined to construct the loss function, and tensor parallel computation is used to accelerate the backpropagation process, improving the training convergence speed and stability of the entropy wave generator. Based on historical recharge requests, the hidden state vector of user behavior is extracted using the behavior phase field engine, and the parameters of the entropy wave generator are updated accordingly, enabling the generation model to generate more realistic and diverse entropy erosion samples for different user behavior patterns, further improving the accuracy of recharge request processing.

[0144] In some implementations, before determining the diffusion reconstruction loss of the initial entropy wave generator based on pre-added noise and a preset denoising network model, the method further includes:

[0145] Based on the preset acceleration weights that follow a normal distribution, the preset scheduling coefficients in the initial entropy wave generator are updated to obtain the updated scheduling coefficients.

[0146] The initial denoising network is updated based on the updated scheduling coefficients to obtain the target denoising network.

[0147] In this embodiment, the scheduling coefficients in the entropy wave generator are updated based on preset acceleration weights that follow a normal distribution, and the initial denoising network is updated accordingly, so that the denoising network adaptively matches the diffusion scheduling strategy. This adjustment allows the entropy wave generator to autonomously determine the noise intensity at certain time steps, skipping redundant noise-adding stages and accelerating convergence.

[0148] In some implementations, after the edge node completes the initialization of the rule vector fingerprint library, it can preheat the behavior phase field engine and the entropy wave generator. The behavior phase field engine can be used to provide basic user behavior patterns, which the entropy wave generator uses to generate entropy erosion samples. Considering the redundant noise added by the entropy wave generator, a learnable tensor reaction acceleration kernel can be injected into the entropy wave generator to accelerate parameters and optimize the generation process.

[0149] Specifically, hidden states of user behavior can be defined. The evolution follows the seventh formula:

[0150]

[0151] This can include the initial embedding of the user's recharge request sequence. Input behavior phase field engine, in progress For users who recharged at time t=0, the recharge characteristics include recharge amount and recharge timestamp. (Function) It consists of a 3-layer fully connected network, with each layer having a dimension of 128→256→128; the activation function is the sigmoid linear unit (SiLU) activation function, which outputs the rate of change of the hidden state of user behavior.

[0152] During the training of the behavioral phase field engine, the training data can be historical recharge request sequences (which may include labeled normal user recharge request sequences and abnormal user recharge request sequences), or subsequences sliced ​​by time windows. Loss function. For reference, see the eighth formula below:

[0153]

[0154] in, Used to represent a normal user recharge request sequence; Used to represent a sequence of abnormal user recharge requests; Functions are used to represent mathematical expectation operators; Used to represent the hidden state vector; The hidden state mean of the normal user recharge sequence (in this application) Also known as the reference baseline, normal baseline, baseline, or baseline of user behavior. The boundary hyperparameter forces the hidden state of abnormal samples to be far away from the normal cluster center, and can be set as needed by those skilled in the art; The balance coefficient between normal and abnormal loss items can be set as needed by those skilled in the art.

[0155] For example, the entropy wave generator includes a forward module and a backward module; the forward module is used to add noise during the forward process, and the backward module is used to denoise the backward process to obtain the entropy erosion sample.

[0156] Specifically, a noise addition process of T=1000 steps can be defined in the forward process, where the noise intensity at each step is determined by the scheduling coefficient. The scheduling coefficient is used to balance the rapid noise addition at the beginning and the smooth transition at the end, and satisfies the following formula:

[0157]

[0158] in, Used to indicate from Step to The formula for the noise addition process; The function is used to represent the probability density function of a Gaussian distribution or other functions that add noise; Used to represent an identity matrix of a preset dimension;

[0159] You can also define a denoising network. The denoising network structure is as follows The denoising network consists of four downsampling and upsampling layers, with the number of channels in the intermediate layers increasing from 64 to 128 to 256 to 512.

[0160] In entropy wave generator Learnable tensor reaction acceleration kernels are inserted after each residual block of t. c is the number of channels in the current layer. Adjust the feature propagation path:

[0161] Specifically, the feature propagation path can be represented by the following formula:

[0162]

[0163] in, It can be initialized to an identity matrix to ensure that the behavior is consistent with the original model in the early stages of training. The loss function gradient of the entropy wave generator can be used for updating. This enables it to learn the most effective feature transformation patterns for generating entropy-eroded samples; It can be used to represent input. It can be used to represent a pair Perform convolution operations; Used for representation layer normalization operations; Used to indicate output;

[0164] For example, acceleration weights can also be introduced. The original scheduling coefficients Updated to:

[0165]

[0166] By updating the scheduling coefficients This allows the entropy wave generator to autonomously determine the noise intensity at certain time steps, skipping the redundant noise-adding stage and accelerating convergence.

[0167] During the aforementioned preheating process, the original charging sequence is mapped into low-dimensional hidden states using a behavior phase field engine. This represents the essential pattern of user behavior. As a condition, entropy erosion samples highly correlated with the current behavioral pattern are generated using an entropy wave generator to simulate potential mutation attacks launched by malicious actors. The tensor reaction acceleration kernel designed in this step has two functions: first, in the behavioral phase field engine, it can accelerate the fitting of the hidden state evolution process; second, in the entropy wave generator, it accelerates the tensor reaction acceleration kernel... With dynamics Shorten the generation path of entropy erosion samples.

[0168] For example, during the training of the entropy wave generator, the hidden states output by the behavioral phase field engine can also be used. As an additional conditional input to the entropy wave generator, it is injected through a cross-attention mechanism:

[0169]

[0170] in, The learnable projection matrix is ​​specifically... d=64 represents the attention dimension; Used to represent the normalization function, through the hidden state vector Adjustment middle The value; Used to represent the scaling factor; middle, Used to represent the query vector corresponding to the current layer inside the entropy wave generator. Used to represent the key vector corresponding to the current layer. Used to represent the value vector corresponding to the current layer;

[0171] Specifically, the loss function of the entropy wave generator This can be expressed by the following ninth formula:

[0172]

[0173] in, Used to indicate at time step Added noise (e.g., Gaussian noise). A denoising network used to represent an entropy wave generator; Used to indicate that the prediction at time step t is added to The amount of noise in; Functions are used to represent mathematical expectation operators; Used to represent the tensor reaction accelerating nucleus; Part 1 The diffusion reconstruction loss of the entropy wave generator is used to represent the mean square error between the predicted noise and the actual noise. This error is used to constrain the denoising network of the entropy wave generator, thereby accurately predicting the noise added at each step and ensuring that the generated entropy erosion sample approximates the actual attack pattern. (Part Two) Used to represent the tensor acceleration kernel regularization term. Used to indicate the number of network layers. For hyperparameters, Used to balance the proportions of the first and second parts. It can be configured as needed by those skilled in the art.

[0174] In some implementations, identifying whether the recharge request is abnormal based on the entropy erosion sample and the preset behavior phase field engine includes:

[0175] The entropy erosion sample is mixed with a sample randomly selected from a preset seed library to obtain a mixed entropy erosion sample.

[0176] Based on the hybrid entropy erosion sample, the endpoint of the hidden state evolution trajectory is determined using the preset behavior phase field engine;

[0177] If the distance between the endpoint of the hidden state evolution trajectory and the preset reference baseline is less than or equal to a third threshold, it is determined that the recharge request is abnormal.

[0178] If the distance between the endpoint of the hidden state evolution trajectory and the preset reference baseline is greater than a third threshold, it is determined that the recharge request is not abnormal.

[0179] The preset seed library can be constructed from a number of pre-acquired marked recharge request samples; the marked recharge request samples include a number of marked normal recharge request samples and a number of marked abnormal recharge request samples.

[0180] Specifically, based on 1000 pre-acquired tagged recharge request samples (including 500 tagged normal recharge request samples and 500 tagged abnormal recharge request samples), these tagged recharge request samples cover known abnormal types (e.g., known black market types, specifically including high-frequency small-amount and late-night concentrated recharges, etc.). For each tagged recharge request sample, the user's latent state is extracted using a behavioral phase field engine. ;

[0181] Based on the sample recharge request and the corresponding user hidden state Construct a seed feature library ;

[0182] More specifically, an initial center can be randomly selected. ;

[0183] Iterative selection of the next center Until 100 centers are selected; The function is used to represent in In this case, Take the maximum value; the distance metric d is defined as the hidden state Euclidean distance: Ensure maximum coverage of the seed library in the feature space; enhance generation diversity. Training is seed-guided, with each batch of training data containing 50% seed samples and 50% generated samples, forcing the entropy wave generator to learn the real attack distribution.

[0184] In this embodiment, entropy erosion samples are mixed with randomly selected labeled samples from a preset seed library, so that the data input to the behavior phase field engine simultaneously contains the perturbation pattern of the current recharge request under test and multiple known normal / abnormal behavior patterns; the mixed entropy erosion samples are evolved based on the preset behavior phase field engine to obtain the corresponding hidden state evolution trajectory endpoint; and the endpoint of the hidden state evolution trajectory is compared with a preset reference baseline (which may be the above-mentioned...). The distance between the two points is used to determine whether the recharge request is abnormal, which effectively improves the accuracy of identification.

[0185] In some implementations, after identifying whether the recharge request is abnormal based on the entropy erosion sample and a preset behavior phase field engine, and obtaining the identification information, the method further includes:

[0186] If the identification information indicates that the recharge request is not abnormal, adjust the parameters of the tensor reaction acceleration kernel along the loss gradient direction;

[0187] If the identification information indicates that the recharge request is abnormal, a first memory rule is generated based on the identification information, and the rule vector fingerprint database is updated according to the first memory rule.

[0188] In this embodiment, when the identification information indicates that the recharge request is not abnormal, the parameters of the tensor reaction acceleration kernel are adjusted along the loss gradient direction to accelerate the propagation path of effective features; when the identification information indicates that the recharge request is abnormal, a first memory rule is generated according to the abnormal pattern for subsequent rapid identification and interception of the same or similar abnormal recharge behaviors.

[0189] For example, the charging sequence corresponding to the mixed entropy erosion sample is input into the behavioral phase field engine to solve its hidden state evolution trajectory over continuous time. The endpoint of the hidden state evolution trajectory is then calculated. Compared with the preset reference baseline ( Distance between You can refer to the following formula number ten:

[0190]

[0191] In the tenth formula, It is the covariance matrix of the preset hidden state vector of normal users.

[0192] With the third threshold set to 0.3:

[0193] If D≤3.0, the recharge request is determined to be abnormal;

[0194] If D > 3.0, it is determined that the recharge request is not abnormal.

[0195] For example, please see Figure 2 If the identification information indicates that the recharge request is not abnormal, the tensor reaction acceleration kernel is adjusted along the loss gradient direction. Accelerate the propagation path of effective features; adjust the tensor response along the loss gradient direction to accelerate the kernel. After obtaining the updated tensor reaction acceleration core You can refer to the following eleventh formula:

[0196]

[0197] In the eleventh formula, Used to represent the tensor reaction acceleration nucleus before the update; Used to represent nuclear variables that accelerate tensor reactions; Used to represent bi-objective loss, Including diffusion reconstruction loss term ( ), and abnormal alignment penalties ; The value is used to represent the learning rate; λ is used to represent the corresponding weight coefficient. λ can be set as needed by those skilled in the art;

[0198] For example, when the identification information indicates that the recharge request is abnormal, the feature vector of the entropy erosion sample is extracted. First memory generation rules ;calculate You can refer to the following formula:

[0199]

[0200] in, Used to represent The threshold can be set to 0.9 times; for The weight can be set to 0.8;

[0201] like Successfully intercepted more than 3 attacks within 24 hours Incremental. If the rule is triggered but verification results in a false alarm, Decreasing.

[0202] Please refer to Figure 2 The risk control network includes multiple edge nodes, and after updating the rule vector fingerprint database, the method further includes:

[0203] A two-dimensional dynamic gradient field is constructed based on the pattern innovation index and topological potential energy index corresponding to the multiple edge nodes.

[0204] If the matching score is greater than a first threshold and less than or equal to a second threshold, the feature information of the first memory rule is extracted; a first signal packet is formed based on the feature information of the first memory rule and the spatiotemporal context corresponding to the first memory rule; the first signal packet is propagated in the risk control network according to a preset propagation strategy and the two-dimensional dynamic gradient field to update the preset rule vector fingerprint database corresponding to the multiple edge nodes; or,

[0205] If the matching score is greater than the second threshold, the feature information of the second memory rule is extracted; a second signal packet is formed according to the feature information of the second memory rule and the spatiotemporal context corresponding to the second memory rule; the second signal packet is propagated in the risk control network according to the preset propagation strategy and the two-dimensional dynamic gradient field to update the preset rule vector fingerprint library corresponding to the multiple edge nodes.

[0206] The risk control network can be a hierarchical network architecture, and the multiple edge nodes can be hierarchically managed and scheduled by multiple upper-level nodes (for example, provincial nodes can be the first-level upper-level nodes, city-level nodes can be the second-level upper-level nodes, and edge nodes are below the city-level node level).

[0207] The pattern innovation index can be an index used to measure the novelty of abnormal patterns detected by target edge nodes within a preset time range relative to the existing set of rules.

[0208] Example, indicators of pattern innovation The calculation method can be referenced from the following formula:

[0209]

[0210] in, The smoothing factor can be set as needed by those skilled in the art;

[0211] The topological potential energy index can be used to measure the importance of the target edge node in the entire risk control network;

[0212] Example, topological potential index The calculation method can be referenced from the following formula:

[0213]

[0214] Wherein, out-degree represents the number of connections initiated by the target node to other nodes in the risk control network; in-degree represents the number of connections initiated by other nodes to the target node in the risk control network; the total number of connections can be used to represent the sum of out-degree and in-degree. Used to represent the angle between the target edge node and the upper-level node (such as the provincial node) in the risk control network topology.

[0215] The two-dimensional dynamic gradient field can be a decision model used to guide the propagation of new memory rule information packets in the risk control network;

[0216] Based on the pattern innovation index and topological potential index corresponding to the multiple edge nodes, a two-dimensional dynamic gradient field is constructed; the two-dimensional dynamic gradient field drives the propagation direction of the first memory rule and / or the second memory rule. You can refer to the following formula:

[0217]

[0218] in, Used to represent the innovative indicators of the above-mentioned models; Used to represent the above-mentioned topological potential energy index; and They can be respectively and The weights can be set as needed by those skilled in the art;

[0219] The preset propagation strategy can be that the signal packets (including the first signal packet and the second signal packet) are distributed with probability. Select the next hop node;

[0220] The pre-defined propagation strategy can also explore multiple high-gradient paths simultaneously;

[0221] Specifically, when the gradient difference between adjacent edge nodes is greater than a preset threshold (which can be set as needed by those skilled in the art), it can trigger cross-layer access to the upper-layer node (e.g., from the first edge node to the provincial node), thus shortening the upload latency of key rules.

[0222] More specifically, each packet carries a preset Time To Live (TTL).

[0223] For example, the TTL value can be set to 5. The hop count of the packet is automatically decremented by 1 each time it passes through a network node. When the hop count reaches zero, the packet immediately terminates its propagation process.

[0224] The feature information (including the feature information of the first memory rule and the feature information of the second memory rule) may include feature fingerprints and the spatiotemporal context of the corresponding memory rule;

[0225] The feature fingerprint can be a 64-bit unique identifier generated by hashing the feature vector according to the corresponding memory rule. ;

[0226] The spatiotemporal context refers to the spatiotemporal association features that trigger the corresponding memory rules, which may specifically include core dimensions such as the attack period and the triggering geographical location.

[0227] Furthermore, the spatiotemporal context can be further refined into key information such as the hour, longitude, latitude, and network type at the time of rule triggering; based on the above feature dimensions, the spatiotemporal context is encoded in the form of a four-dimensional vector, denoted as [vector name missing]. .

[0228] In this embodiment, a two-dimensional dynamic gradient field propagation network is constructed based on the pattern innovation index and the topological potential energy index. The gradient difference accurately guides the propagation direction of the first memory rule and / or the second memory rule, realizing the on-demand diffusion of rules in the risk control network. This not only avoids the network bandwidth redundancy caused by traditional broadcast propagation, but also allows high-value memory rules to flow preferentially to core nodes with high topological potential energy, greatly improving the timeliness and targeting of the preset rule vector fingerprint database, and further improving the accuracy of the recharge request processing.

[0229] In some implementations, please refer to Figure 2 For the target edge node, calculate the spatiotemporal context carried by the incoming signal packet. ), and the spatiotemporal context of the edge node's local preset rule vector fingerprint library ( The matching degree between () can be determined by the following formula:

[0230]

[0231] in, Used to represent and The matching value; The adjustment factor can be set as needed by those skilled in the art.

[0232] Furthermore, if External memory rules can Add it to the local verification pool and assign it an initial weight W=0.6. Add similar local rules... external rules Fusion (such as weighted summation) generates hybrid rules with stronger generalization. and utilize Update the preset rule vector fingerprint library; it can also propagate the hybrid rule in the risk control network according to the preset propagation strategy;

[0233] like If it is not a "non-relevant rule", it will be marked as an "irrelevant rule", triggering a reverse broadcast of the suppression signal to notify the source node to stop the relevant propagation;

[0234] like Following the pre-set propagation strategy, the foreign rule continues to spread within the risk control network.

[0235] It should be noted that the above-described recharge request processing method can be executed by an electronic device, that is, all the steps included in the above method are executed by the electronic device, which can be an electronic device such as a server, computer or cloud service computing node.

[0236] See Figure 3 , Figure 3 This is a schematic diagram of the structure of a recharge request processing device provided in an embodiment of this application, as shown below. Figure 3 As shown, the recharge request processing device 300 is applied to the first edge node in the risk control network. The recharge request processing device 300 includes:

[0237] Module 301 is used to obtain the user's recharge request;

[0238] The first processing module 302 is used to generate a unified feature vector based on the features in the recharge request;

[0239] The second processing module 303 is used to determine the matching score based on the degree of matching between the unified feature vector and multiple rules in the preset rule vector fingerprint database.

[0240] The third processing module 303 is configured to, if the matching score is less than or equal to a first threshold, allow the recharge request to be processed so as to recharge the user's corresponding account; or,

[0241] If the matching score is greater than a first threshold and less than or equal to a second threshold, an entropy erosion sample is generated using a target entropy wave generator based on the unified feature vector and the request information in the recharge request; based on the entropy erosion sample and a preset behavior phase field engine, an identification information is obtained to determine whether the recharge request is abnormal; if the identification information indicates that the recharge request is abnormal, a first memory rule is generated according to the identification information, and the rule vector fingerprint database is updated according to the first memory rule; or...

[0242] If the matching score is greater than the second threshold, the recharge request is frozen; a second memory rule is generated based on the unified feature vector; and the rule vector fingerprint database is updated according to the second memory rule.

[0243] Optionally, generating a unified feature vector based on the features in the recharge request includes:

[0244] Within a preset time window, the features in the recharge request are matched with the rule vector fingerprint database to obtain the fingerprint matching frequency within the preset time window;

[0245] The length of the preset time window is updated based on the fingerprint matching frequency to obtain the target time window;

[0246] Dynamic time-series slicing is performed on the recharge request according to the target time window to obtain multi-scale time-series slices;

[0247] The recharge variation coefficient and amount distribution entropy are determined based on multi-scale time series slices.

[0248] The multi-scale time series slice is decomposed into multiple sub-bands, and multiple energy percentages corresponding to the multiple sub-bands are obtained;

[0249] The unified feature vector is generated based on the recharge variation coefficient, the amount distribution entropy, and the multiple energy proportions.

[0250] Optionally, the recharge request processing device 300 may also include a fourth processing module 305;

[0251] Based on the unified feature vector and the request information in the recharge request, an entropy erosion sample is generated using the target entropy wave generator. The fourth processing module 305 is used to determine the diffusion reconstruction loss of the initial entropy wave generator according to the pre-added noise and the preset denoising network model.

[0252] Based on the diffusion reconstruction loss and the tensor reaction acceleration kernel set in the initial entropy wave generator, the loss function of the initial entropy wave generator is determined;

[0253] Based on historical recharge requests, the hidden state vector of the user behavior corresponding to the historical recharge requests is extracted using the behavior phase field engine.

[0254] Based on the hidden state vector and the loss function, the parameters of the initial entropy wave generator are updated to obtain the target entropy wave generator.

[0255] Optionally, the recharge request processing device 300 may also include a fifth processing module 306;

[0256] Before determining the diffusion reconstruction loss of the initial entropy wave generator based on the pre-added noise and the preset denoising network model, the fifth processing module 306 is used to update the preset scheduling coefficient in the initial entropy wave generator based on the preset acceleration weights that follow a normal distribution, so as to obtain the updated scheduling coefficient.

[0257] The initial denoising network is updated based on the updated scheduling coefficients to obtain the target denoising network.

[0258] Optionally, the step of identifying whether the recharge request is abnormal based on the entropy erosion sample and the preset behavior phase field engine includes:

[0259] The entropy erosion sample is mixed with a sample randomly selected from a preset seed library to obtain a mixed entropy erosion sample.

[0260] Based on the hybrid entropy erosion sample, the endpoint of the hidden state evolution trajectory is determined using the preset behavior phase field engine;

[0261] If the distance between the endpoint of the hidden state evolution trajectory and the preset reference baseline is less than or equal to a third threshold, it is determined that the recharge request is abnormal.

[0262] If the distance between the endpoint of the hidden state evolution trajectory and the preset reference baseline is greater than a third threshold, it is determined that the recharge request is not abnormal.

[0263] Optionally, the recharge request processing device 300 may also include a sixth processing module 307;

[0264] After the sixth processing module 307 obtains the identification information based on the entropy erosion sample and the preset behavior phase field engine to identify whether the recharge request is abnormal, it adjusts the parameters of the tensor reaction acceleration kernel along the loss gradient direction and allows the user's recharge request to be processed to recharge the user's corresponding account when the identification information indicates that the recharge request is not abnormal.

[0265] If the identification information indicates that the recharge request is abnormal, a first memory rule is generated based on the identification information, the rule vector fingerprint database is updated according to the first memory rule, and the user's recharge request is frozen.

[0266] Optionally, the recharge request processing device 300 may also include a seventh processing module 308;

[0267] The risk control network includes multiple edge nodes. After updating the rule vector fingerprint database, the seventh processing module 308 is used to construct a two-dimensional dynamic gradient field propagation network based on the pattern innovation index and topological potential energy index corresponding to the multiple edge nodes.

[0268] If the matching score is greater than a first threshold and less than or equal to a second threshold, the feature information of the first memory rule is extracted; a first signal packet is formed based on the feature information of the first memory rule and the spatiotemporal context corresponding to the first memory rule; the first signal packet is propagated in the risk control network according to a preset propagation strategy and the two-dimensional dynamic gradient field to update the preset rule vector fingerprint database corresponding to the multiple edge nodes; or,

[0269] If the matching score is greater than the second threshold, the feature information of the second memory rule is extracted; a second signal packet is formed according to the feature information of the second memory rule and the spatiotemporal context corresponding to the second memory rule; the second signal packet is propagated in the risk control network according to the preset propagation strategy and the two-dimensional dynamic gradient field to update the preset rule vector fingerprint library corresponding to the multiple edge nodes.

[0270] The recharge request processing device 300 is capable of implementing the various processes applied to the recharge request processing method described above. The technical features correspond one-to-one and can achieve the same technical effect. To avoid repetition, it will not be described again here.

[0271] This application also provides an electronic device applied to a first edge node in a risk control network. The electronic device includes a processor, a memory, and a program stored in the memory and executable on the processor. When the program is executed by the processor, it implements the various processes of the above-described recharge request processing method embodiments and achieves the same technical effect. To avoid repetition, it will not be described again here.

[0272] For details, see Figure 4 This application also provides an electronic device applied to a first edge node in a risk control network, including a bus 401, a transceiver 402, an antenna 403, a bus interface 404, a processor 405, and a memory 406.

[0273] The transceiver 402 is used to acquire the user's recharge request;

[0274] The processor 405 is configured to generate a unified feature vector based on the features in the recharge request.

[0275] The matching score is determined based on the degree of matching between the unified feature vector and multiple rules in the preset rule vector fingerprint database;

[0276] If the matching score is less than or equal to a first threshold, the recharge request is allowed to recharge the user's corresponding account; or,

[0277] If the matching score is greater than a first threshold and less than or equal to a second threshold, an entropy erosion sample is generated using a target entropy wave generator based on the unified feature vector and the request information in the recharge request; based on the entropy erosion sample and a preset behavior phase field engine, an identification information is obtained to determine whether the recharge request is abnormal; if the identification information indicates that the recharge request is abnormal, a first memory rule is generated according to the identification information, and the rule vector fingerprint database is updated according to the first memory rule; or...

[0278] If the matching score is greater than the second threshold, the recharge request is frozen; a second memory rule is generated based on the unified feature vector; and the rule vector fingerprint database is updated according to the second memory rule.

[0279] Optionally, generating a unified feature vector based on the features in the recharge request includes:

[0280] Within a preset time window, the features in the recharge request are matched with the rule vector fingerprint database to obtain the fingerprint matching frequency within the preset time window;

[0281] The length of the preset time window is updated based on the fingerprint matching frequency to obtain the target time window;

[0282] Dynamic time-series slicing is performed on the recharge request according to the target time window to obtain multi-scale time-series slices;

[0283] The recharge variation coefficient and amount distribution entropy are determined based on multi-scale time series slices.

[0284] The multi-scale time series slice is decomposed into multiple sub-bands, and multiple energy percentages corresponding to the multiple sub-bands are obtained;

[0285] The unified feature vector is generated based on the recharge variation coefficient, the amount distribution entropy, and the multiple energy proportions.

[0286] Optionally, based on the unified feature vector and the request information in the recharge request, an entropy erosion sample is generated using a target entropy wave generator. The processor 405 is also used to determine the diffusion reconstruction loss of the initial entropy wave generator according to the pre-added noise and the preset denoising network model.

[0287] Based on the diffusion reconstruction loss and the tensor reaction acceleration kernel set in the initial entropy wave generator, the loss function of the initial entropy wave generator is determined;

[0288] Based on historical recharge requests, the hidden state vector of the user behavior corresponding to the historical recharge requests is extracted using the behavior phase field engine.

[0289] Based on the hidden state vector and the loss function, the parameters of the initial entropy wave generator are updated to obtain the target entropy wave generator.

[0290] Optionally, before determining the diffusion reconstruction loss of the initial entropy wave generator based on the pre-added noise and the preset denoising network model, the processor 405 is further configured to update the preset scheduling coefficient in the initial entropy wave generator based on the preset acceleration weights that follow a normal distribution, so as to obtain the updated scheduling coefficient.

[0291] The initial denoising network is updated based on the updated scheduling coefficients to obtain the target denoising network.

[0292] Optionally, the step of identifying whether the recharge request is abnormal based on the entropy erosion sample and the preset behavior phase field engine includes:

[0293] The entropy erosion sample is mixed with a sample randomly selected from a preset seed library to obtain a mixed entropy erosion sample.

[0294] Based on the hybrid entropy erosion sample, the endpoint of the hidden state evolution trajectory is determined using the preset behavior phase field engine;

[0295] If the distance between the endpoint of the hidden state evolution trajectory and the preset reference baseline is less than or equal to a third threshold, it is determined that the recharge request is abnormal.

[0296] If the distance between the endpoint of the hidden state evolution trajectory and the preset reference baseline is greater than a third threshold, it is determined that the recharge request is not abnormal.

[0297] Optionally, after identifying whether the recharge request is abnormal based on the entropy erosion sample and the preset behavior phase field engine, and obtaining the identification information, the processor 405 is further configured to adjust the parameters of the tensor reaction acceleration kernel along the loss gradient direction and allow the user's recharge request to recharge the user's corresponding account when the identification information indicates that the recharge request is not abnormal.

[0298] If the identification information indicates that the recharge request is abnormal, a first memory rule is generated based on the identification information, the rule vector fingerprint database is updated according to the first memory rule, and the user's recharge request is frozen.

[0299] Optionally, the risk control network includes multiple edge nodes. After updating the rule vector fingerprint database, the processor 405 is further configured to construct a two-dimensional dynamic gradient field based on the pattern innovation index and topological potential energy index corresponding to the multiple edge nodes.

[0300] If the matching score is greater than a first threshold and less than or equal to a second threshold, the feature information of the first memory rule is extracted; a first signal packet is formed based on the feature information of the first memory rule and the spatiotemporal context corresponding to the first memory rule; the first signal packet is propagated in the risk control network according to a preset propagation strategy and the two-dimensional dynamic gradient field to update the preset rule vector fingerprint database corresponding to the multiple edge nodes; or,

[0301] If the matching score is greater than the second threshold, the feature information of the second memory rule is extracted; a second signal packet is formed according to the feature information of the second memory rule and the spatiotemporal context corresponding to the second memory rule; the second signal packet is propagated in the risk control network according to the preset propagation strategy and the two-dimensional dynamic gradient field to update the preset rule vector fingerprint library corresponding to the multiple edge nodes.

[0302] exist Figure 4 In this context, a bus architecture (represented by bus 401) is used. Bus 401 can include any number of interconnected buses and bridges, linking various circuits including one or more processors represented by processor 405 and memory represented by memory 406. Bus 401 can also link various other circuits such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and therefore will not be described further herein. Bus interface 404 provides an interface between bus 401 and transceiver 402. Transceiver 402 can be a single element or multiple elements, such as multiple receivers and transmitters, providing a unit for communicating with various other devices over a transmission medium. Data processed by processor 405 is transmitted over a wireless medium via antenna 403, which further receives data and transmits data to processor 405.

[0303] Processor 405 is responsible for managing bus 401 and general processing, and can also provide various functions, including timing, peripheral interface, voltage regulation, power management, and other control functions. Memory 406 can be used to store data used by processor 405 during operation.

[0304] Optionally, the processor 405 may be a central processing unit (CPU), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or a complex programmable logic device (CPLD).

[0305] This application also provides a computer-readable storage medium storing a computer program. When executed by a processor, this computer program implements the various processes of the above-described recharge request processing method embodiments and achieves the same technical effects. To avoid repetition, it will not be described again here. The computer-readable storage medium may be a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, etc.

[0306] This application also provides a computer program product, including computer instructions. When executed by a processor, the computer instructions implement the various processes of the above-described recharge request processing method embodiment and achieve the same technical effect. To avoid repetition, they will not be described again here.

[0307] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element. Furthermore, it should be noted that the scope of the methods and apparatuses in the embodiments of this application is not limited to performing functions in the order discussed, but may also include performing functions substantially simultaneously or in the reverse order, depending on the functions involved. For example, the described methods may be performed in a different order than described, and various steps may be added, omitted, or combined. Additionally, features described with reference to certain examples may be combined in other examples.

[0308] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0309] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of this application.

Claims

1. A method for processing recharge requests, characterized in that, The method, applied to the first edge node in a risk control network, includes: Obtain the user's recharge request; Generate a unified feature vector based on the features in the recharge request; The matching score is determined based on the degree of matching between the unified feature vector and multiple rules in the preset rule vector fingerprint database; If the matching score is less than or equal to a first threshold, the recharge request is allowed to recharge the user's corresponding account; or, If the matching score is greater than a first threshold and less than or equal to a second threshold, an entropy erosion sample is generated using a target entropy wave generator based on the unified feature vector and the request information in the recharge request; based on the entropy erosion sample and a preset behavior phase field engine, an identification information is obtained to determine whether the recharge request is abnormal; if the identification information indicates that the recharge request is abnormal, a first memory rule is generated according to the identification information, and the rule vector fingerprint database is updated according to the first memory rule; or... If the matching score is greater than the second threshold, the recharge request is frozen; a second memory rule is generated based on the unified feature vector; and the rule vector fingerprint database is updated according to the second memory rule.

2. The method according to claim 1, characterized in that, Generate a unified feature vector based on the features in the recharge request, including: Within a preset time window, the features in the recharge request are matched with the rule vector fingerprint database to obtain the fingerprint matching frequency within the preset time window; The length of the preset time window is updated based on the fingerprint matching frequency to obtain the target time window; Dynamic time-series slicing is performed on the recharge request according to the target time window to obtain multi-scale time-series slices; The recharge variation coefficient and amount distribution entropy are determined based on multi-scale time series slices. The multi-scale time series slice is decomposed into multiple sub-bands, and multiple energy percentages corresponding to the multiple sub-bands are obtained; The unified feature vector is generated based on the recharge variation coefficient, the amount distribution entropy, and the multiple energy proportions.

3. The method according to claim 2, characterized in that, Based on the unified feature vector and the request information in the recharge request, an entropy erosion sample is generated using a target entropy wave generator. The method further includes: Based on the pre-added noise and the preset denoising network model, determine the diffusion reconstruction loss of the initial entropy wave generator; Based on the diffusion reconstruction loss and the tensor reaction acceleration kernel set in the initial entropy wave generator, the loss function of the initial entropy wave generator is determined; Based on historical recharge requests, the hidden state vector of the user behavior corresponding to the historical recharge requests is extracted using the behavior phase field engine. Based on the hidden state vector and the loss function, the parameters of the initial entropy wave generator are updated to obtain the target entropy wave generator.

4. The method according to claim 3, characterized in that, Before determining the diffusion reconstruction loss of the initial entropy wave generator based on pre-added noise and a preset denoising network model, the method further includes: Based on the preset acceleration weights that follow a normal distribution, the preset scheduling coefficients in the initial entropy wave generator are updated to obtain the updated scheduling coefficients. The initial denoising network is updated based on the updated scheduling coefficients to obtain the target denoising network.

5. The method according to claim 3, characterized in that, The step of identifying whether the recharge request is abnormal based on the entropy erosion sample and the preset behavior phase field engine includes: The entropy erosion sample is mixed with a sample randomly selected from a preset seed library to obtain a mixed entropy erosion sample. Based on the hybrid entropy erosion sample, the endpoint of the hidden state evolution trajectory is determined using the preset behavior phase field engine; If the distance between the endpoint of the hidden state evolution trajectory and the preset reference baseline is less than or equal to a third threshold, it is determined that the recharge request is abnormal. If the distance between the endpoint of the hidden state evolution trajectory and the preset reference baseline is greater than a third threshold, it is determined that the recharge request is not abnormal.

6. The method according to claim 3, characterized in that, After obtaining the identification information by identifying whether the recharge request is abnormal based on the entropy erosion sample and the preset behavior phase field engine, the method further includes: If the identification information indicates that the recharge request is not abnormal, the parameters of the tensor reaction acceleration kernel are adjusted along the loss gradient direction, and the user's recharge request is allowed to recharge the user's corresponding account. If the identification information indicates that the recharge request is abnormal, a first memory rule is generated based on the identification information, the rule vector fingerprint database is updated according to the first memory rule, and the user's recharge request is frozen.

7. The method according to any one of claims 1 to 6, characterized in that, The risk control network includes multiple edge nodes, and after updating the rule vector fingerprint database, the method further includes: A two-dimensional dynamic gradient field is constructed based on the pattern innovation index and topological potential energy index corresponding to the multiple edge nodes. If the matching score is greater than a first threshold and less than or equal to a second threshold, the feature information of the first memory rule is extracted; a first signal packet is formed based on the feature information of the first memory rule and the spatiotemporal context corresponding to the first memory rule; the first signal packet is propagated in the risk control network according to a preset propagation strategy and the two-dimensional dynamic gradient field to update the preset rule vector fingerprint database corresponding to the multiple edge nodes; or, If the matching score is greater than the second threshold, the feature information of the second memory rule is extracted; a second signal packet is formed according to the feature information of the second memory rule and the spatiotemporal context corresponding to the second memory rule; the second signal packet is propagated in the risk control network according to the preset propagation strategy and the two-dimensional dynamic gradient field to update the preset rule vector fingerprint library corresponding to the multiple edge nodes.

8. A recharge request processing device, characterized in that, The device includes: The acquisition module is used to acquire users' recharge requests; The first processing module is used to generate a unified feature vector based on the features in the recharge request; The second processing module is used to determine the matching score based on the degree of matching between the unified feature vector and multiple rules in the preset rule vector fingerprint database. The third processing module is configured to allow the recharge request to be processed and the corresponding user account recharged if the matching score is less than or equal to a first threshold; or, If the matching score is greater than a first threshold and less than or equal to a second threshold, an entropy erosion sample is generated using a target entropy wave generator based on the unified feature vector and the request information in the recharge request; based on the entropy erosion sample and a preset behavior phase field engine, an identification information is obtained to determine whether the recharge request is abnormal; if the identification information indicates that the recharge request is abnormal, a first memory rule is generated according to the identification information, and the rule vector fingerprint database is updated according to the first memory rule; or... If the matching score is greater than the second threshold, the recharge request is frozen; a second memory rule is generated based on the unified feature vector; and the rule vector fingerprint database is updated according to the second memory rule.

9. An electronic device, characterized in that, include: A processor, a memory, and a program stored in the memory and executable on the processor, wherein the program, when executed by the processor, implements the steps of the method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the method as described in any one of claims 1 to 7.

11. A computer program product, characterized in that, Includes computer instructions that, when executed by a processor, implement the steps of the method as described in any one of claims 1 to 7.

Images