Data protection method and system for cross-border e-commerce platform

Abstract

The invention provides a data protection method and system for a cross-border e-commerce platform, and the method comprises the steps: collecting page front-end data and network communication data in a current session process of a user before a page is completely loaded, obtaining a session embedding vector of the session through a feature extraction mode, carrying out the exception classification based on the session embedding vector, and carrying out the data protection of the cross-border e-commerce platform. Obtaining an abnormal classification result of the current session, obtaining related sessions of the current session when the abnormal classification result of the current session shows abnormality, and integrating the current session and the related sessions thereof to form a dynamic behavior graph for community detection to obtain a group tag and association degree corresponding to the current session; therefore, whether the current session is the crawler behavior is determined, and the recognition precision of the crawler behavior is improved. And if the behavior is the crawler behavior, confusing the commodity prices of all commodities accessed by the current session, and returning a page containing the confused commodity prices to the user, thereby realizing active protection of platform privacy data.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to a data protection method and system for cross-border e-commerce platforms. Background Technology

[0002] With the rapid development of the cross-border e-commerce industry, the real-time performance and accuracy of publicly available platform information, such as product data, price information, inventory status, logistics timeliness, and review content, have become crucial for ensuring user experience and stable platform operation. Product price information and its trends are particularly important data for cross-border e-commerce platforms. However, because platform front-end pages and API interfaces are usually publicly accessible, numerous automated programs (web crawlers, data collection bots, etc.) use web scraping technology to periodically crawl platform data. While these automated access behaviors do not directly damage the system structure, they pose significant security and management risks.

[0003] Traditional data protection mechanisms primarily focus on server-side traffic management and access control. Common methods include rate limiting based on request frequency, blocking based on IP or proxy pools, CAPTCHA verification, and device fingerprinting. The core idea behind these measures is to reduce unauthorized data scraping by identifying "abnormal access" and blocking its continued requests. However, in the cross-border e-commerce environment, access requests originate from different regions and network nodes globally, and the boundaries between legitimate users and web crawlers are often blurred. Distributed proxy networks, low-frequency access strategies, and browser emulation techniques limit the accuracy and sustainability of traditional protection methods. Furthermore, even if a platform can identify some web crawlers, it cannot completely prevent data leaks. Once a data leak occurs, competitors can continuously monitor the platform's price trends, causing irreparable losses. Summary of the Invention

[0004] This invention provides a data protection method and system for cross-border e-commerce platforms to address the shortcomings of existing technologies that make it difficult to prevent data leakage.

[0005] This invention provides a data protection method for cross-border e-commerce platforms, comprising: Before the page is fully loaded, collect the front-end data and network communication data of the user's current session. Based on the front-end data, construct dynamic temporal features, and based on the network communication data, construct static feature vectors. The dynamic temporal features and the static feature vectors are respectively input into the temporal encoder and the static encoder. A deep model with a dual-tower structure is used to fuse the temporal codes and static codes output by the temporal encoder and the static encoder into a session embedding vector. Anomaly classification is then performed based on the session embedding vector to obtain the anomaly classification result of the current session. If the anomaly classification result of the current session shows an anomaly, obtain the relevant sessions of the current session, integrate the current session and its relevant sessions to form a dynamic behavior graph, perform community detection on the dynamic behavior graph, and obtain the group label and correlation degree corresponding to the current session; Based on the group tags and relevance of the current session, determine whether the current session is a web crawler activity; if it is a web crawler activity, obfuscate the prices of all products accessed in the current session and return a page containing the obfuscated prices to the user.

[0006] According to a data protection method for a cross-border e-commerce platform provided by the present invention, the step of obfuscating the prices of all goods accessed in the current session and returning a page containing the obfuscated prices to the user includes: The actual prices of all products accessed in the current session are obfuscated based on a preset perturbation coefficient to obtain the obfuscated prices of the corresponding products, and a page containing the obfuscated prices of the corresponding products is returned to the user. The user's IP address, proxy fingerprint, and account are marked and the marking time is recorded. When other sessions initiated by users with the same IP address, proxy fingerprint, or account as the user are detected, and the time difference between the session initiation time and the marking time is less than a preset time difference, the prices of all goods accessed by the other sessions are obfuscated based on a long-term perturbation model, and a page containing the obfuscated prices is returned to the corresponding user. The KL divergence between the obfuscated price distribution of the same type of goods generated by the long-term perturbation model and the actual distribution is within a preset range.

[0007] According to a data protection method for a cross-border e-commerce platform provided by the present invention, the step of obfuscating the product prices of all goods accessed by other sessions based on a long-term perturbation model includes: Obtain the historical price sequences of all products accessed by the other sessions at different historical time points, as well as the current price sequences of all products; Based on the historical price sequence of all products accessed in the other sessions for any historical time point, statistical features including average price, variance, kurtosis, skewness, transaction volume index and access traffic density are extracted to construct the price representation vector for any historical time point. The price representation vectors of all products accessed in the other sessions corresponding to each historical time point are combined into a dynamic price representation vector, and the price change trend is predicted based on the dynamic price representation vector using an autoregressive generator to obtain the predicted price distribution. The predicted price distribution is obfuscated based on an adjustable noise term and its weight term to obtain the obfuscated prices of all goods accessed by other sessions; wherein the adjustable noise term follows a normal distribution with a mean of 0, and the variance of the normal distribution with a mean of 0 decays over time; when the divergence between the obfuscated price distribution of all goods and the price distribution of the current price exceeds a preset interval, the weight term of the adjustable noise term is adjusted until the divergence between the obfuscated price distribution of all goods and the price distribution of the current price is within the preset interval.

[0008] According to a data protection method for a cross-border e-commerce platform provided by the present invention, when the divergence between the price distribution of all products' confusion prices and the price distribution of the current price exceeds a preset interval, the weight term of the adjustable noise term is adjusted until the divergence between the price distribution of all products' confusion prices and the price distribution of the current price is within the preset interval, including: If the divergence between the price distribution of all products obtained based on the current adjustable noise term and the price distribution of the current price is lower than the lower limit of the preset interval, then the weight term of the adjustable noise term and the variance of the normal distribution followed by the adjustable noise term are increased until the divergence between the price distribution of all products and the price distribution of the current price is within the preset interval. If the divergence between the price distribution of all products obtained based on the current adjustable noise term and the price distribution of the current price is higher than the upper limit of the preset interval, then the variance of the normal distribution followed by the adjustable noise term is attenuated and the weight of the adjustable noise term is reduced based on the difference between the divergence and the upper limit of the preset interval, until the divergence between the price distribution of all products obtained based on the current price and the price distribution of the current price is within the preset interval; wherein, the greater the difference between the divergence and the upper limit of the preset interval, the greater the degree of attenuation of the variance of the normal distribution followed by the adjustable noise term.

[0009] According to a data protection method for a cross-border e-commerce platform provided by the present invention, the step of integrating the current session and its related sessions to form a dynamic behavior graph, performing community detection on the dynamic behavior graph to obtain the group tags and relevance corresponding to the current session includes: The current session and its related sessions are represented as a set of nodes. The node attributes of each node in the set of nodes include the session ID, IP address, proxy fingerprint, device information and account identifier of the corresponding session. The correlation between any two nodes is calculated based on IP similarity, device similarity, behavioral similarity, and proxy fingerprint similarity. When the correlation is higher than a preset threshold, an edge is constructed between the two nodes to obtain a dynamic behavior graph. The behavioral similarity between any two nodes is calculated by time-series encoding based on the dynamic temporal features of the front-end data of the corresponding session of the node through the time encoder. Community detection is performed on the dynamic behavior graph to obtain the group label corresponding to the current session; Based on the group label corresponding to the current session, obtain the group members of the group to which the current session belongs, and calculate the correlation between the current session and its group based on the sum of the correlation between the current session and its group members and the sum of the correlation between the current session and all nodes in the dynamic behavior graph.

[0010] According to a data protection method for a cross-border e-commerce platform provided by the present invention, determining whether the current session is a web crawler activity based on the group tags and relevance corresponding to the current session includes: Determine the group members to which the current session belongs based on the group tag corresponding to the current session; Calculate the group density based on the number of edges between group members of the group to which the current session belongs and the number of group members; The average behavioral similarity of the group is calculated based on the behavioral similarity among the group members. The proxy duplication rate of the group is calculated based on the number of members in the group who use the same proxy fingerprint. Calculate the access time dispersion of the group based on the session initiation time of the group members; The crawler behavior classification result of the current session is determined based on the correlation between the current session and its group, the group density, the average behavior similarity, the proxy repetition rate, and the access time dispersion.

[0011] This invention also provides a data protection system for a cross-border e-commerce platform, comprising: The session data acquisition unit is used to collect page front-end data and network communication data during the user's current session before the page is fully loaded, construct dynamic temporal features based on the page front-end data, and construct static feature vectors based on the network communication data. The session anomaly classification unit is used to input the dynamic temporal features and the static feature vectors into the temporal encoder and the static encoder, respectively. After fusing the temporal codes and static codes output by the temporal encoder and the static encoder into a session embedding vector using a dual-tower deep model, anomaly classification is performed based on the session embedding vector to obtain the anomaly classification result of the current session. The group analysis unit is used to obtain the relevant sessions of the current session when the abnormal classification result of the current session shows an abnormality, and integrate the current session and its relevant sessions to form a dynamic behavior graph. Community detection is performed on the dynamic behavior graph to obtain the group label and correlation degree corresponding to the current session. The data obfuscation unit is used to determine whether the current session is a web crawler activity based on the group tags and relevance of the current session. If it is a web crawler activity, the unit obfuscates the prices of all products accessed in the current session and returns a page containing the obfuscated prices to the user.

[0012] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the data protection method for cross-border e-commerce platforms as described above.

[0013] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the data protection method for cross-border e-commerce platforms as described above.

[0014] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the data protection method for cross-border e-commerce platforms as described above.

[0015] The data protection method and system for cross-border e-commerce platforms provided by this invention collects front-end data and network communication data during the user's current session before the page is fully loaded. After obtaining the session embedding vector through feature extraction, anomaly classification is performed based on the session embedding vector to obtain the anomaly classification result of the current session. When the anomaly classification result of the current session shows an anomaly, related sessions of the current session are obtained, and the current session and its related sessions are integrated to form a dynamic behavior graph. Community detection is performed on the dynamic behavior graph to obtain the group tags and correlation degree corresponding to the current session. Based on the group tags and correlation degree corresponding to the current session, it is determined whether the current session is a web crawler behavior, which improves the accuracy of web crawler behavior identification. If it is a web crawler behavior, the prices of all products accessed in the current session are obfuscated, and a page containing the obfuscated product prices is returned to the user, realizing proactive protection of the platform's privacy data. Attached Figure Description

[0016] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0017] Figure 1 This is a flowchart illustrating the data protection method for cross-border e-commerce platforms provided by the present invention; Figure 2 This is a flowchart illustrating the privacy data protection method provided by the present invention; Figure 3 This is a schematic diagram of the data protection system for a cross-border e-commerce platform provided by the present invention; Figure 4 This is a schematic diagram of the structure of the electronic device provided by the present invention. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0019] Figure 1 This is a flowchart illustrating the data protection method for cross-border e-commerce platforms provided by the present invention, as shown below. Figure 1 As shown, the method includes: Step 110: Before the page is fully loaded, collect the page front-end data and network communication data during the user's current session. Based on the page front-end data, construct dynamic temporal features, and based on the network communication data, construct static feature vectors. Step 120: Input the dynamic temporal features and the static feature vectors into the temporal encoder and the static encoder respectively. Use a dual-tower deep model to fuse the temporal codes and static codes output by the temporal encoder and the static encoder into a session embedding vector. Then, perform anomaly classification based on the session embedding vector to obtain the anomaly classification result of the current session. Step 130: If the anomaly classification result of the current session shows an anomaly, obtain the relevant sessions of the current session, integrate the current session and its relevant sessions to form a dynamic behavior graph, perform community detection on the dynamic behavior graph, and obtain the group label and correlation degree corresponding to the current session; Step 140: Based on the group tags and relevance of the current session, determine whether the current session is a web crawler behavior; if it is a web crawler behavior, obfuscate the prices of all products accessed in the current session and return a page containing the obfuscated prices to the user.

[0020] Here, when a user triggers a page request (such as a product search request or a product details viewing request), the system retrieves the corresponding page and collects front-end data and network communication data of the user during the current session in real time before the page is fully loaded. Through an "early collection" mechanism, meaning that the system begins to model the user's interactive behavior in real time before the user has fully seen the price or product details information, it achieves behavioral-level risk assessment before information is exposed. Specifically, front-end data includes, but is not limited to, mouse movement trajectory, scroll bar offset sequence, viewport focus change, click coordinate distribution, input box focus switching duration, touch event rhythm, and window size adjustment. This data reflects the user's actual interaction patterns on the page. Because real user interaction behavior has non-linear and non-periodic characteristics, while automated crawler behavior often exhibits templated or time-staggered characteristics, front-end behavioral data is an important signal source for distinguishing between human and script behavior. Network communication data includes HTTP request header information, TLS handshake parameters, IP geolocation, request packet length distribution, TCP initial window size, connection hold duration, and proxy type identification results. These features reflect the "network fingerprint" of a session, which is closely related to the user's device, browser kernel, and proxy environment. They can be used to identify long-term fixed proxies, disguised browser environments, or abnormal connection behavior.

[0021] After collecting the aforementioned data, dynamic temporal features can be constructed using a multi-dimensional time series encoding module for the front-end page data. This module employs a sliding window and sequence segmentation algorithm to divide the original behavioral sequence into time segments, extract low-level statistical features (such as average speed, trajectory variance, average pause time, etc.), and encode them into feature vectors to obtain dynamic temporal features, thus preserving the temporal correlation and local dynamic changes of events. Simultaneously, static feature vectors are also constructed based on network communication data. These discrete fields can be encoded into numerical vectors using feature hashing and multi-dimensional aggregation to form static feature vectors.

[0022] In step 120, the aforementioned dynamic temporal features and static feature vectors are input into two independent deep encoders: a temporal encoder and a static encoder. This structure is called a "dual-tower architecture," designed to model time-dependent behavioral sequences and structured static data separately to avoid mutual interference. The temporal encoder typically employs a self-attention model based on a gated recurrent unit (GRU) or Transformer to capture the dynamic evolution features of interactive behavior; the static encoder can use a multilayer perceptron (MLP) structure to learn the embedding patterns of the network environment. After the two encoders output temporal and static encoded vectors respectively, a unified session embedding vector is generated through vector concatenation or weighted fusion. This session embedding vector can be considered a high-dimensional feature point, which condenses the overall features of the current user session at the behavioral and network layers.

[0023] After fusion, the resulting session embedding vector is input into an anomaly classifier for judgment. This classifier, built on a deep neural network, takes the session embedding vector as input and outputs a probability score representing the degree of anomaly in the session. During training, the anomaly classifier undergoes supervised learning using a large amount of labeled data, enabling it to learn the distinction boundary between normal user and crawler behavior samples. Because the session embedding vector contains both temporal behavior and static fingerprint information, the model still possesses high recognition capabilities even when facing low-frequency, disguised crawlers. The final anomaly classification results are divided into two levels: "normal" and "abnormal." Sessions classified as "abnormal" will proceed to the subsequent group-level analysis stage.

[0024] When an anomaly classification result for the current session is detected as "abnormal," a process of retrieving related sessions and constructing a dynamic behavior graph will be executed. This involves extracting other sessions related to the current session from the database as relevant sessions to jointly construct the dynamic behavior graph. This relevance can be determined through shared IP addresses, identical proxy fingerprints, identical accounts, or similar user agent identifiers. For the current session and its related sessions, each session is treated as a node, with session ID, IP address, proxy fingerprint, and account information used as node features. Edge connections are established between nodes, and edge weights reflect the degree of similarity between nodes.

[0025] In some embodiments, the current session and its related sessions can be represented as a set of nodes. Each node in the set has node attributes including the session ID, IP address, proxy fingerprint, device information, and account identifier for the corresponding session. The session ID serves as a unique identifier to distinguish different session entities; the IP address reflects the network origin and access routing information; the proxy fingerprint describes whether the session accesses the network through an intermediate proxy or network exit, including proxy type, port, and link latency characteristics; device information includes browser kernel version, operating system type, screen resolution, language settings, and User-Agent string parsing results; and the account identifier indicates whether the session is bound to a specific registered user or guest identity. Through these feature combinations, the network and environmental characteristics of session entities can be characterized from multiple dimensions. When constructing a dynamic behavior graph, the correlation between any two nodes needs to be calculated to construct edges between nodes. This correlation is a weighted combination of multi-dimensional feature similarities, reflecting the degree of similarity between two sessions in space, time, and behavior.

[0026] Specifically, the relevance calculation includes four core components: IP similarity, device similarity, behavioral similarity, and proxy fingerprint similarity. IP similarity is obtained by calculating the CIDR prefix matching degree or geographic distance of IP addresses. For example, when the IP addresses of two sessions are in the same / 24 subnet or the geographical difference is less than a certain distance, the IP similarity score is high. Device similarity is obtained by calculating the cosine similarity of device fingerprint vectors. If two sessions are highly consistent in terms of browser version, font set, resolution, hardware acceleration features, etc., the device similarity approaches 1. Proxy fingerprint similarity is obtained by hashing and comparing the proxy server link fingerprint (including TLS handshake parameters, HTTP header features, latency distribution patterns, etc.), used to detect the existence of identical proxy nodes or same-origin proxy pools. Behavioral similarity reflects the dynamic consistency of two sessions at the user operation level, used to reveal potential automated control or scripted behavior. Therefore, when calculating the behavioral similarity between any two nodes, the dynamic temporal features of the front-end data of the corresponding session for each node can be extracted and encoded using the aforementioned temporal encoder to obtain a temporal code. Next, by calculating the similarity between the temporal codes corresponding to the front-end data of the two sessions, the similarity of the operation modes of the two sessions in the embedding space is measured and used as their behavioral similarity.

[0027] Subsequently, community detection is performed on the dynamic behavior graph to identify whether the current session belongs to a potential crawler cluster, thereby further confirming whether the current session constitutes crawler behavior. Specifically, a graph partitioning algorithm based on modularity optimization (such as the Louvain algorithm) or an embedding-based graph neural network method is used to perform cluster analysis on the connection relationships between nodes. In this way, it is possible to discover which sessions exhibit significant consistency in behavioral patterns, proxy sources, or access rhythms. After clustering, a group label is assigned to each cluster result, and the correlation between the current session and its group is calculated. Specifically, the ratio of the sum of correlations between the current session and its group members to the sum of correlations between the current session and all nodes in the dynamic behavior graph is determined as the correlation between the current session and its group. This correlation reflects the centrality of the current session within the group: sessions with high correlation are often core nodes initiated by the automation control center, while sessions with low correlation may be noise nodes.

[0028] In step 140, the group labels and correlation obtained in the above steps can be used to determine whether the current session is a web crawler. The determination at this stage is no longer limited to the abnormal score of a single session, but comprehensively considers the overall characteristics of the group to more accurately identify web crawler behavior and reduce the false positive rate.

[0029] In some embodiments, the group members to which the current session belongs can be determined based on the group tag corresponding to the current session. Based on the connectivity relationships between the current group members, the group density can be calculated. Group density is a structural metric used to measure the connectivity between nodes within a group, and its calculation method is as follows:

[0030] Among them, E g N represents the number of edges within the group. g This represents the number of members in the group. Group density ranges from [0,1]. When the density is close to 1, it indicates that the nodes within the group are almost always paired, meaning there is a high degree of correlation between members. For normal users, even if they access the same product at the same time, it is difficult to form such a high density of interaction relationships; however, automated crawlers, controlled by the same script or agent cluster, often exhibit strong consistency in access patterns and times, thus forming a high-density community structure. Therefore, group density is an important indicator for identifying "batch-controlled" crawler networks.

[0031] Based on the behavioral similarity among group members, the average behavioral similarity of the group is calculated. This average behavioral similarity reflects the overall consistency of group members at the page operation level. Normal user behavior exhibits significant individual differences; for example, scrolling speed, mouse trajectory paths, and dwell time distribution vary according to user habits, thus their average behavioral similarity is usually low. However, crawler groups, using the same or similar crawling scripts, show a high degree of similarity because their behavioral time series tend to overlap in the embedding space. By calculating the average behavioral similarity of groups, the system can effectively identify visitor groups with highly templated and repetitive behaviors.

[0032] The proxy duplication rate of a group is calculated based on the number of members using the same proxy fingerprint. A proxy fingerprint is a set of characteristics that characterize a proxy in a network request, such as the egress IP, TLS handshake parameters, HTTP header feature combinations, and response latency distribution. The system performs clustering statistics on the proxy fingerprints of all nodes in the group to determine the number of members that reuse the same proxy fingerprint and calculates the proxy duplication rate.

[0033] Among them, F k Let f be the set of proxy fingerprints within the group, nf be the number of members using the proxy fingerprint f, and m be the total number of members in the group.

[0034] Proxy duplication rate measures the independence of access sources for group members. For normal user groups, due to the wide distribution of access sources and significant differences in device environments, the proxy duplication rate is usually close to 0. However, for crawler clusters, to save costs or maintain connection consistency, the same proxy IP or the same proxy pool exit is often reused, resulting in a significantly higher proxy duplication rate. A higher proxy duplication rate indicates that the group may be initiated by a centrally controlled proxy network, and its behavior is more likely to be automated crawling activity.

[0035] Furthermore, time-related characteristics can be considered. Based on the session initiation time of group members, the access time dispersion of the group can be calculated. Access time dispersion reflects the synchronicity of group members in terms of time distribution. It can be calculated using the standard deviation, i.e., calculating the standard deviation of the session initiation time of each group member as the access time dispersion. If the group's access time dispersion is low, it indicates that the initiation times of member sessions are highly concentrated, possibly triggered in batches by the same control script; while the access times of normal users are often more randomly distributed, with higher time dispersion. Therefore, access time dispersion provides an effective means of detecting "time-synchronized" crawler behavior.

[0036] Based on the correlation between the current session and its group, the group density, average behavior similarity, proxy repetition rate, and access time dispersion, a binary classification model can be used to classify the current session's crawling behavior, thereby determining the classification result. The binary classification model can employ a multilayer perceptron, support vector machine, or an XGBoost model based on ensemble learning. The model's training data comes from the platform's historical access logs, and normal users are distinguished from confirmed crawler samples through manual or semi-automatic annotation, ensuring that the classifier learns the discrimination boundary between normal user groups and crawler groups. The model output is the crawling probability value of the current session; when this value exceeds the system-set confidence threshold, the session is determined to be crawling behavior.

[0037] Once the system confirms that the current session is a web crawler activity, it will enter the data obfuscation stage. That is, instead of traditional blocking or CAPTCHA challenges, data obfuscation is used to protect the platform's privacy data and prevent real data leakage. Specifically, a set of noisy, fake price sequences is generated for all product prices accessed by the crawler session. These obfuscated prices replace the real product prices on the page before being returned to the user.

[0038] In some embodiments, such as Figure 2 As shown, privacy data protection can be achieved in the following ways: Step 210: Obfuscate the actual prices of all products accessed in the current session based on a preset perturbation coefficient to obtain the obfuscated prices of the corresponding products, and return a page containing the obfuscated prices of the corresponding products to the user; Step 220: Mark the user's IP, proxy fingerprint, and account, and record the marking time. When other sessions initiated by users with the same IP, proxy fingerprint, or account as the user are detected, and the time difference between the session initiation time and the marking time is less than a preset time difference, obfuscate the prices of all goods accessed by the other sessions based on the long-term perturbation model, and return a page containing the obfuscated prices to the corresponding user; wherein, the KL divergence between the obfuscated price distribution of the same type of goods generated by the long-term perturbation model and the true distribution is within a preset range.

[0039] The core idea of ​​this approach is to combine an adjustable perturbation coefficient with a long-term perturbation model to probabilistically shift the product price data obtained by the crawler, thus creating a controllable deviation between the collected data distribution and the actual price distribution. On one hand, based on a preset perturbation coefficient, the actual prices of all products accessed in the current session can be obfuscated using additive or multiplicative methods to obtain obfuscated prices for the corresponding products, and a page containing these obfuscated prices is returned to the user. The perturbation coefficient can be dynamically adjusted according to the pricing sensitivity of the products; for example, for high-value products or highly competitive product categories, the perturbation coefficient can be increased to enhance data security. The perturbed price will replace the original price field during the page rendering stage, thus returning a page containing obfuscated prices to the user (the crawler agent).

[0040] On the other hand, after the system performs price obfuscation on a session, it immediately records and marks the user's key identification information. This identification information includes the user's IP address, proxy fingerprint, and account identifier. The marking process records not only the identifier value but also the marking time. In subsequent operations, if any user matching the marked information initiates a new session, and the time difference between the session initiation time and the marking time is less than a preset time difference, the newly initiated session may belong to a continuation of the same crawler task chain. Therefore, price obfuscation can be performed based on a long-term perturbation model. The goal of the long-term perturbation model is to ensure that the KL divergence between the obfuscated price distribution of the same type of product and the true distribution is within a preset range, thereby increasing local offsets while maintaining the stability and reasonableness of the overall price distribution statistical characteristics.

[0041] Through the aforementioned two-layer mechanism of preset perturbation coefficients and long-term perturbation models, the preset perturbation coefficients provide immediate protection, handling price obfuscation during the initial visit. The long-term perturbation model, through probability drift over time, prevents crawlers from reconstructing the true price structure through multiple rounds of sampling. This effectively resists the continuous tracking of price change trends by high-frequency, low-latency crawlers. The two mechanisms work together to ensure effective protection for the platform at different stages of an attack. Furthermore, compared to traditional random perturbation methods, the obfuscation method in this embodiment maintains stable KL divergence control at the statistical level, avoiding identifiability issues caused by excessively strong or weak perturbations, thus achieving stronger data protection.

[0042] In other embodiments, when using a long-term perturbation model to obfuscate the prices of all goods accessed in any session, the price change information of all goods accessed in that session over a historical time dimension is first obtained. To do this, the historical price sequences of the corresponding goods at multiple historical time points (e.g., the past 1 hour, 6 hours, 24 hours, 3 days, etc.) can be retrieved from the database, and the current price sequence of all goods at the current moment can be read simultaneously.

[0043] After obtaining historical price series, for any given historical point in time, statistical analysis is performed on the price series of all commodities at that point in time to extract statistical features that reflect the price distribution pattern and market volatility. These features include average price, price variance, price kurtosis, price skewness, trading volume index, and website traffic density. The average price reflects the overall market level, variance reflects the dispersion of the price distribution, kurtosis and skewness characterize the asymmetry and sharpness of the distribution pattern, while the trading volume index and website traffic density are used to quantify the market activity and user attention at that point in time. These features are then standardized and combined into a price representation vector to represent the global price state at that point in time.

[0044] Subsequently, the price representation vectors corresponding to multiple historical time points are combined in chronological order to form a multidimensional dynamic price representation vector. This vector can be viewed as a time-series feature matrix of price changes, containing trend information about the evolution of commodity prices over time. An Autoregressive Generator (AR-Gen) is then used to predict price change trends from this dynamic price representation vector. This generator can employ a deep time-series model based on a GRU (Gated Recurrent Unit) or Transformer structure, recursively learning the evolution of price features over time to output the predicted price distribution within future time windows. The prediction result can be a continuous probability distribution, reflecting the possible fluctuation range and probability density of commodity prices under the current market conditions.

[0045] After obtaining the predicted price distribution, it is obfuscated. The key to obfuscation is to introduce an adjustable noise term and a corresponding weight term to statistically perturb the predicted price distribution, making it appear "seemingly reasonable but actually biased." Specifically, the adjustable noise term follows a normal distribution with a mean of 0, and its variance decays over time. This is used to control the perturbation intensity to gradually weaken with increasing access time, thus maintaining the smoothness and consistency of long-term obfuscation.

[0046] When obfuscating the predicted price distribution based on the adjustable noise term and its weight term, the following approach can be used:

[0047] in, To confuse prices, To predict the sampled prices in the price distribution, with w t This refers to the adjustable noise term and its weighting term.

[0048] To ensure that the confusion results do not deviate excessively from the true price distribution in the long-term statistical sense, the divergence between the confused price distribution and the current price distribution is calculated in real time after confusion. This divergence is measured by Kullback–Leibler (KL) divergence.

[0049] When the divergence between the price distribution of all products' confusion prices and the price distribution of the current price exceeds a preset interval, it indicates that the disturbance is too strong or too weak. Therefore, the weight of the adjustable noise term can be adjusted until the divergence between the price distribution of all products' confusion prices and the price distribution of the current price is within the preset interval. Specifically, if the divergence between the price distribution of confusion prices and the price distribution of the current price is lower than the lower limit of the preset interval, it indicates that the disturbance is too weak. In this case, the weight of the adjustable noise term and the variance of the normal distribution followed by the adjustable noise term are gradually increased until the divergence between the price distribution of confusion prices and the price distribution of the current price is within the preset interval. If the divergence between the price distribution of confusion prices and the price distribution of the current price is higher than the upper limit of the preset interval, it indicates that the disturbance is too strong. In this case, the variance of the normal distribution followed by the adjustable noise term is attenuated based on the difference between the corresponding divergence and the upper limit of the preset interval, and the weight of the adjustable noise term is reduced until the divergence between the price distribution of confusion prices and the price distribution of the current price is within the preset interval. The greater the difference between the corresponding divergence and the upper limit of the preset interval, the greater the attenuation of the variance of the normal distribution followed by the adjustable noise term.

[0050] In summary, the method provided by this invention collects front-end data and network communication data during the user's current session before the page is fully loaded. After obtaining the session embedding vector of the session through feature extraction, anomaly classification is performed based on the session embedding vector to obtain the anomaly classification result of the current session. When the anomaly classification result of the current session shows an anomaly, related sessions of the current session are obtained, and the current session and its related sessions are integrated to form a dynamic behavior graph. Community detection is performed on the dynamic behavior graph to obtain the group label and correlation degree corresponding to the current session. Based on the group label and correlation degree corresponding to the current session, it is determined whether the current session is a crawler behavior, which improves the recognition accuracy of crawler behavior. If it is a crawler behavior, the prices of all products accessed in the current session are obfuscated, and a page containing the obfuscated product prices is returned to the user, realizing the proactive protection of platform privacy data.

[0051] The data protection system for cross-border e-commerce platforms provided by this invention is described below. The data protection system for cross-border e-commerce platforms described below can be referred to in correspondence with the data protection method for cross-border e-commerce platforms described above.

[0052] Based on any of the above embodiments Figure 3This is a schematic diagram of the data protection system for a cross-border e-commerce platform provided by the present invention, as shown below. Figure 3 As shown, the system includes: The session data acquisition unit 310 is used to collect page front-end data and network communication data during the user's current session before the page is fully loaded, construct dynamic temporal features based on the page front-end data, and construct static feature vectors based on the network communication data. The session anomaly classification unit 320 is used to input the dynamic temporal features and the static feature vectors into the temporal encoder and the static encoder respectively, and then use a dual-tower deep model to fuse the temporal codes and static codes output by the temporal encoder and the static encoder into a session embedding vector. Based on the session embedding vector, anomaly classification is performed to obtain the anomaly classification result of the current session. The group analysis unit 330 is used to obtain the relevant sessions of the current session when the abnormal classification result of the current session shows an abnormality, and integrate the current session and its relevant sessions to form a dynamic behavior graph, perform community detection on the dynamic behavior graph, and obtain the group label and correlation degree corresponding to the current session; The data obfuscation unit 340 is used to determine whether the current session is a web crawler behavior based on the group tags and relevance of the current session; if it is a web crawler behavior, the prices of all products accessed in the current session are obfuscated, and a page containing the obfuscated prices is returned to the user.

[0053] The system provided in this invention collects front-end data and network communication data during the user's current session before the page is fully loaded. After obtaining the session embedding vector through feature extraction, it performs anomaly classification based on the session embedding vector to obtain the anomaly classification result of the current session. When the anomaly classification result of the current session shows an anomaly, it obtains related sessions of the current session and integrates the current session and its related sessions to form a dynamic behavior graph. Community detection is performed on the dynamic behavior graph to obtain the group label and correlation degree corresponding to the current session. Based on the group label and correlation degree corresponding to the current session, it determines whether the current session is a web crawler behavior, thereby improving the accuracy of web crawler behavior identification. If it is a web crawler behavior, the prices of all products accessed in the current session are obfuscated, and a page containing the obfuscated product prices is returned to the user, thereby achieving proactive protection of platform privacy data.

[0054] Based on any of the above embodiments, the step of obfuscating the prices of all products accessed in the current session and returning a page containing the obfuscated prices to the user includes: The actual prices of all products accessed in the current session are obfuscated based on a preset perturbation coefficient to obtain the obfuscated prices of the corresponding products, and a page containing the obfuscated prices of the corresponding products is returned to the user. The user's IP address, proxy fingerprint, and account are marked and the marking time is recorded. When other sessions initiated by users with the same IP address, proxy fingerprint, or account as the user are detected, and the time difference between the session initiation time and the marking time is less than a preset time difference, the prices of all goods accessed by the other sessions are obfuscated based on a long-term perturbation model, and a page containing the obfuscated prices is returned to the corresponding user. The KL divergence between the obfuscated price distribution of the same type of goods generated by the long-term perturbation model and the actual distribution is within a preset range.

[0055] Based on any of the above embodiments, the obfuscation of product prices for all products accessed by the other sessions based on the long-term perturbation model includes: Obtain the historical price sequences of all products accessed by the other sessions at different historical time points, as well as the current price sequences of all products; Based on the historical price sequence of all products accessed in the other sessions for any historical time point, statistical features including average price, variance, kurtosis, skewness, transaction volume index and access traffic density are extracted to construct the price representation vector for any historical time point. The price representation vectors of all products accessed in the other sessions corresponding to each historical time point are combined into a dynamic price representation vector, and the price change trend is predicted based on the dynamic price representation vector using an autoregressive generator to obtain the predicted price distribution. The predicted price distribution is obfuscated based on an adjustable noise term and its weight term to obtain the obfuscated prices of all goods accessed by other sessions; wherein the adjustable noise term follows a normal distribution with a mean of 0, and the variance of the normal distribution with a mean of 0 decays over time; when the divergence between the obfuscated price distribution of all goods and the price distribution of the current price exceeds a preset interval, the weight term of the adjustable noise term is adjusted until the divergence between the obfuscated price distribution of all goods and the price distribution of the current price is within the preset interval.

[0056] Based on any of the above embodiments, the step of adjusting the weight term of the adjustable noise term when the divergence between the price distribution of all products' confusion prices and the price distribution of the current price exceeds a preset interval, until the divergence between the price distribution of all products' confusion prices and the price distribution of the current price is within the preset interval, includes: If the divergence between the price distribution of all products obtained based on the current adjustable noise term and the price distribution of the current price is lower than the lower limit of the preset interval, then the weight term of the adjustable noise term and the variance of the normal distribution followed by the adjustable noise term are increased until the divergence between the price distribution of all products and the price distribution of the current price is within the preset interval. If the divergence between the price distribution of all products obtained based on the current adjustable noise term and the price distribution of the current price is higher than the upper limit of the preset interval, then the variance of the normal distribution followed by the adjustable noise term is attenuated and the weight of the adjustable noise term is reduced based on the difference between the divergence and the upper limit of the preset interval, until the divergence between the price distribution of all products obtained based on the current price and the price distribution of the current price is within the preset interval; wherein, the greater the difference between the divergence and the upper limit of the preset interval, the greater the degree of attenuation of the variance of the normal distribution followed by the adjustable noise term.

[0057] Based on any of the above embodiments, the step of integrating the current session and its related sessions to form a dynamic behavior graph, and performing community detection on the dynamic behavior graph to obtain the group label and relevance corresponding to the current session includes: The current session and its related sessions are represented as a set of nodes. The node attributes of each node in the set of nodes include the session ID, IP address, proxy fingerprint, device information and account identifier of the corresponding session. The correlation between any two nodes is calculated based on IP similarity, device similarity, behavioral similarity, and proxy fingerprint similarity. When the correlation is higher than a preset threshold, an edge is constructed between the two nodes to obtain a dynamic behavior graph. The behavioral similarity between any two nodes is calculated by time-series encoding based on the dynamic temporal features of the front-end data of the corresponding session of the node through the time encoder. Community detection is performed on the dynamic behavior graph to obtain the group label corresponding to the current session; Based on the group label corresponding to the current session, obtain the group members of the group to which the current session belongs, and calculate the correlation between the current session and its group based on the sum of the correlation between the current session and its group members and the sum of the correlation between the current session and all nodes in the dynamic behavior graph.

[0058] Based on any of the above embodiments, determining whether the current session is a web crawler activity based on the group tag and relevance corresponding to the current session includes: Determine the group members to which the current session belongs based on the group tag corresponding to the current session; Calculate the group density based on the number of edges between group members of the group to which the current session belongs and the number of group members; The average behavioral similarity of the group is calculated based on the behavioral similarity among the group members. The proxy duplication rate of the group is calculated based on the number of members in the group who use the same proxy fingerprint. Calculate the access time dispersion of the group based on the session initiation time of the group members; The crawler behavior classification result of the current session is determined based on the correlation between the current session and its group, the group density, the average behavior similarity, the proxy repetition rate, and the access time dispersion.

[0059] Figure 4 This is a schematic diagram of the structure of the electronic device provided by the present invention, such as... Figure 4 As shown, the electronic device may include: a processor 410, a memory 420, a communication interface 430, and a communication bus 440, wherein the processor 410, the memory 420, and the communication interface 430 communicate with each other through the communication bus 440. The processor 410 can call logical instructions in the memory 420 to execute a data protection method for a cross-border e-commerce platform. This method includes: collecting front-end page data and network communication data during the user's current session before the page is fully loaded; constructing dynamic temporal features based on the front-end page data and constructing a static feature vector based on the network communication data; inputting the dynamic temporal features and the static feature vector into a time encoder and a static encoder respectively; using a dual-tower deep learning model to fuse the temporal and static codes output by the time encoder and the static encoder into a session embedding vector; performing anomaly classification based on the session embedding vector to obtain the anomaly classification result for the current session; if the anomaly classification result for the current session shows an anomaly, acquiring related sessions of the current session and integrating the current session and its related sessions to form a dynamic behavior graph; performing community detection on the dynamic behavior graph to obtain the group tags and correlations corresponding to the current session; determining whether the current session is a crawler based on the group tags and correlations corresponding to the current session; if it is a crawler, obfuscating the prices of all products accessed in the current session and returning a page containing the obfuscated product prices to the user.

[0060] Furthermore, the logical instructions in the aforementioned memory 420 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, essentially, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0061] On the other hand, the present invention also provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium. The computer program includes program instructions, and when the program instructions are executed by a computer, the computer can execute the data protection method for cross-border e-commerce platforms provided by the above methods. This method includes: collecting page front-end data and network communication data during the user's current session before the page is fully loaded; constructing dynamic temporal features based on the page front-end data; and constructing a static feature vector based on the network communication data; inputting the dynamic temporal features and the static feature vector into a time encoder and a static encoder respectively; and using a dual-tower deep model to process the data. After fusing the temporal and static codes output by the time encoder and the static encoder into a session embedding vector, anomaly classification is performed based on the session embedding vector to obtain the anomaly classification result for the current session. If the anomaly classification result for the current session shows an anomaly, the relevant sessions of the current session are obtained, and the current session and its relevant sessions are integrated to form a dynamic behavior graph. Community detection is performed on the dynamic behavior graph to obtain the group tags and relevance corresponding to the current session. Based on the group tags and relevance corresponding to the current session, it is determined whether the current session is a crawler behavior. If it is a crawler behavior, the prices of all products accessed by the current session are obfuscated, and a page containing the obfuscated product prices is returned to the user.

[0062] Furthermore, the present invention also provides a non-transitory computer-readable storage medium storing a computer program thereon. When executed by a processor, this computer program implements the data protection methods for cross-border e-commerce platforms provided above. The method includes: collecting page front-end data and network communication data during the user's current session before the page is fully loaded; constructing dynamic temporal features based on the page front-end data and constructing a static feature vector based on the network communication data; inputting the dynamic temporal features and the static feature vector into a time encoder and a static encoder, respectively; and using a dual-tower deep model to process the temporal data output by the time encoder and the static encoder. After the encoding and static encoding are fused into a session embedding vector, anomaly classification is performed based on the session embedding vector to obtain the anomaly classification result of the current session. If the anomaly classification result of the current session shows an anomaly, the relevant sessions of the current session are obtained, and the current session and its relevant sessions are integrated to form a dynamic behavior graph. Community detection is performed on the dynamic behavior graph to obtain the group tags and relevance of the current session. Based on the group tags and relevance of the current session, it is determined whether the current session is a crawler behavior. If it is a crawler behavior, the prices of all products accessed by the current session are obfuscated, and a page containing the obfuscated product prices is returned to the user.

[0063] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0064] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0065] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A data protection method for a cross-border e-commerce platform, characterized in that, include: Before the page is fully loaded, collect the front-end data and network communication data of the user's current session. Based on the front-end data, construct dynamic temporal features, and based on the network communication data, construct static feature vectors. The dynamic temporal features and the static feature vectors are respectively input into the temporal encoder and the static encoder. A deep model with a dual-tower structure is used to fuse the temporal codes and static codes output by the temporal encoder and the static encoder into a session embedding vector. Anomaly classification is then performed based on the session embedding vector to obtain the anomaly classification result of the current session. If the anomaly classification result of the current session shows an anomaly, obtain the relevant sessions of the current session, integrate the current session and its relevant sessions to form a dynamic behavior graph, perform community detection on the dynamic behavior graph, and obtain the group label and correlation degree corresponding to the current session; Based on the group tags and relevance of the current session, determine whether the current session is a web crawler activity; If the activity is a web crawler, the prices of all products accessed in the current session will be obfuscated, and a page containing the obfuscated prices will be returned to the user.

2. The data protection method for cross-border e-commerce platforms according to claim 1, characterized in that, The process of obfuscating the prices of all products accessed in the current session and returning a page containing the obfuscated prices to the user includes: The actual prices of all products accessed in the current session are obfuscated based on a preset perturbation coefficient to obtain the obfuscated prices of the corresponding products, and a page containing the obfuscated prices of the corresponding products is returned to the user. The user's IP address, proxy fingerprint, and account are marked and the marking time is recorded. When other sessions initiated by users with the same IP address, proxy fingerprint, or account as the user are detected, and the time difference between the session initiation time and the marking time is less than a preset time difference, the prices of all goods accessed by the other sessions are obfuscated based on a long-term perturbation model, and a page containing the obfuscated prices is returned to the corresponding user. The KL divergence between the obfuscated price distribution of the same type of goods generated by the long-term perturbation model and the actual distribution is within a preset range.

3. The data protection method for cross-border e-commerce platforms according to claim 2, characterized in that, The obfuscation of product prices for all goods accessed by other sessions based on the long-term perturbation model includes: Obtain the historical price sequences of all products accessed by the other sessions at different historical time points, as well as the current price sequences of all products; Based on the historical price sequence of all products accessed in the other sessions for any historical time point, statistical features including average price, variance, kurtosis, skewness, transaction volume index and access traffic density are extracted to construct the price representation vector for any historical time point. The price representation vectors of all products accessed in the other sessions corresponding to each historical time point are combined into a dynamic price representation vector, and the price change trend is predicted based on the dynamic price representation vector using an autoregressive generator to obtain the predicted price distribution. The predicted price distribution is obfuscated based on an adjustable noise term and its weight term to obtain the obfuscated prices of all goods accessed by other sessions; wherein the adjustable noise term follows a normal distribution with a mean of 0, and the variance of the normal distribution with a mean of 0 decays over time; when the divergence between the obfuscated price distribution of all goods and the price distribution of the current price exceeds a preset interval, the weight term of the adjustable noise term is adjusted until the divergence between the obfuscated price distribution of all goods and the price distribution of the current price is within the preset interval.

4. The data protection method for cross-border e-commerce platforms according to claim 3, characterized in that, When the divergence between the price distribution of all products' confusion prices and the price distribution of the current price exceeds a preset interval, the weight term of the adjustable noise term is adjusted until the divergence between the price distribution of all products' confusion prices and the price distribution of the current price is within the preset interval, including: If the divergence between the price distribution of all products obtained based on the current adjustable noise term and the price distribution of the current price is lower than the lower limit of the preset interval, then the weight term of the adjustable noise term and the variance of the normal distribution followed by the adjustable noise term are increased until the divergence between the price distribution of all products and the price distribution of the current price is within the preset interval. If the divergence between the price distribution of all products obtained based on the current adjustable noise term and the price distribution of the current price is higher than the upper limit of the preset interval, then the variance of the normal distribution followed by the adjustable noise term is attenuated and the weight of the adjustable noise term is reduced based on the difference between the divergence and the upper limit of the preset interval, until the divergence between the price distribution of all products obtained based on the current price and the price distribution of the current price is within the preset interval; wherein, the greater the difference between the divergence and the upper limit of the preset interval, the greater the degree of attenuation of the variance of the normal distribution followed by the adjustable noise term.

5. The data protection method for cross-border e-commerce platforms according to claim 1, characterized in that, The process of integrating the current session and its related sessions to form a dynamic behavior graph, and performing community detection on the dynamic behavior graph to obtain the group tags and relevance corresponding to the current session includes: The current session and its related sessions are represented as a set of nodes. The node attributes of each node in the set of nodes include the session ID, IP address, proxy fingerprint, device information and account identifier of the corresponding session. The correlation between any two nodes is calculated based on IP similarity, device similarity, behavioral similarity, and proxy fingerprint similarity. When the correlation is higher than a preset threshold, an edge is constructed between the two nodes to obtain a dynamic behavior graph. The behavioral similarity between any two nodes is calculated by time-series encoding based on the dynamic temporal features of the front-end data of the corresponding session of the node through the time encoder. Community detection is performed on the dynamic behavior graph to obtain the group label corresponding to the current session; Based on the group label corresponding to the current session, obtain the group members of the group to which the current session belongs, and calculate the correlation between the current session and its group based on the sum of the correlation between the current session and its group members and the sum of the correlation between the current session and all nodes in the dynamic behavior graph.

6. The data protection method for cross-border e-commerce platforms according to claim 1, characterized in that, The step of determining whether the current session is a web crawler activity based on the group tags and relevance corresponding to the current session includes: Determine the group members to which the current session belongs based on the group tag corresponding to the current session; Calculate the group density based on the number of edges between group members of the group to which the current session belongs and the number of group members; The average behavioral similarity of the group is calculated based on the behavioral similarity among the group members. The proxy duplication rate of the group is calculated based on the number of members in the group who use the same proxy fingerprint. Calculate the access time dispersion of the group based on the session initiation time of the group members; The crawler behavior classification result of the current session is determined based on the correlation between the current session and its group, the group density, the average behavior similarity, the proxy repetition rate, and the access time dispersion.

7. A data protection system for a cross-border e-commerce platform, characterized in that, include: The session data acquisition unit is used to collect page front-end data and network communication data during the user's current session before the page is fully loaded, construct dynamic temporal features based on the page front-end data, and construct static feature vectors based on the network communication data. The session anomaly classification unit is used to input the dynamic temporal features and the static feature vectors into the temporal encoder and the static encoder, respectively. After fusing the temporal codes and static codes output by the temporal encoder and the static encoder into a session embedding vector using a dual-tower deep model, anomaly classification is performed based on the session embedding vector to obtain the anomaly classification result of the current session. The group analysis unit is used to obtain the relevant sessions of the current session when the abnormal classification result of the current session shows an abnormality, and integrate the current session and its relevant sessions to form a dynamic behavior graph. Community detection is performed on the dynamic behavior graph to obtain the group label and correlation degree corresponding to the current session. The data obfuscation unit is used to determine whether the current session is a web crawler activity based on the group tags and relevance of the current session. If the activity is a web crawler, the prices of all products accessed in the current session will be obfuscated, and a page containing the obfuscated prices will be returned to the user.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the data protection method for the cross-border e-commerce platform as described in any one of claims 1 to 6.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the data protection method for the cross-border e-commerce platform as described in any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the data protection method for the cross-border e-commerce platform as described in any one of claims 1 to 6.

Images