E-commerce anomaly detection method and system fusing multi-dimensional difference and gating mechanism
By constructing an e-commerce anomaly detection method based on multidimensional differences and gating mechanisms, explicitly quantifying local anomaly patterns, and combining an adaptive attention aggregation mechanism, the method solves the feature smoothing and complexity problems of graph neural networks in anomaly behavior detection, achieving high-precision and interpretable anomaly detection and enhancing the application value of the model in e-commerce.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- SHANDONG ZHENGZHONG COMP NETWORK TECH CONSULTING
- Filing Date
- 2025-12-29
- Publication Date
- 2026-04-17
AI Technical Summary
Existing graph neural networks suffer from problems such as feature smoothing and dilution, high model complexity, high training costs, and lack of business interpretability in abnormal behavior detection, leading to decreased model performance and difficulty in practical application.
We construct an e-commerce anomaly detection method based on multidimensional differences and gating mechanisms. By calculating the feature space, structure space, and business logic difference vectors, and combining them with an adaptive attention aggregation mechanism, we can explicitly quantify local anomaly patterns and filter key neighbor information to achieve high-precision and interpretable anomaly behavior detection.
It improves the accuracy and interpretability of anomaly detection, enables the model to maintain high detection accuracy in complex scenarios, simplifies the training process, enhances business credibility and usability, and aligns with the business intuition of risk control experts.
Smart Images
Figure CN121883124A_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the fields of machine learning and e-commerce technology, and particularly relates to an e-commerce anomaly detection method and system that integrates multidimensional differences and gating mechanisms, and an e-commerce abnormal behavior detection method and system that integrates multidimensional differences and gating adaptive attention networks. Background Technology
[0002] The statements in this section are merely background information related to the present invention and do not necessarily constitute prior art.
[0003] As network anomalies become increasingly complex and organized, mining anomaly patterns using graph-structured data has become a mainstream technical approach. Graph Neural Networks (GNNs) such as GAT update node representations by aggregating neighbor node information, demonstrating excellent performance in various graph tasks. However, in the typical scenario of abnormal behavior detection, existing GNN models face the following challenges: First, the core operations of mainstream graph neural networks (such as GAT) are feature smoothing and propagation, which are generally based on the homogeneity assumption that "connected nodes tend to be similar." However, the core paradigm of anomaly detection is to discover "anomalies," that is, the "differences" of target nodes in their local environment. The smoothing operation of traditional GNNs directly dilutes this crucial anomalous signal, leading to a decline in model performance.
[0004] Secondly, existing improvement schemes each have significant limitations. For example, the CARE-GNN model uses reinforcement learning to dynamically select similar neighbors, which is effective but the model is complex, has high training costs, and heavily relies on labeled data. The GDFGAT model calculates attention by introducing feature differences, but its innovation is limited to the model itself, failing to explicitly generate interpretable anomalous signals and making it difficult to incorporate domain prior knowledge. Finally, most methods lack sufficient business interpretability. Risk control operations personnel struggle to understand why the model identifies a node as abnormal behavior, making model decisions difficult to trust and adopt. This lack of transparency in the decision-making process makes model results unreliable, unacceptable, and unsuitable for subsequent case investigations and strategy optimization, significantly limiting their practical value in real-world business applications. Summary of the Invention
[0005] To overcome the shortcomings of the prior art, this invention provides an e-commerce anomaly detection method and system that integrates multidimensional differences and gating mechanisms. It is a GNN anomaly behavior detection scheme that can explicitly quantify local anomaly patterns, has interpretable key indicators, is compatible with domain knowledge, and is easy to implement.
[0006] To achieve the above objectives, one or more embodiments of the present invention provide the following technical solutions: Firstly, a method for detecting e-commerce anomalies that integrates multidimensional differences and gating mechanisms is disclosed, including: Raw data is extracted and preprocessed from multiple e-commerce-related data sources; For the preprocessed raw data, calculate the feature space difference vector, the structure space difference vector, and the business logic difference vector respectively. The three-dimensional difference vectors are concatenated to form a complete multidimensional difference vector for each node. For multidimensional difference vectors, perform relation information aggregation, gating score calculation, and relation-aware feature transformation sequentially; The transformed features are preprocessed, core neighbor sampling is performed, and final attention calculation is performed. Finally, information aggregation is performed to obtain aggregated differential information. Based on the aggregated differential information, the probability of a node exhibiting abnormal behavior is obtained.
[0007] As a further technical solution, the process of preprocessing the raw data is as follows: The system uses the customer's unique identifier and the merchant's ID as the primary key, and implements multi-table joins through a distributed hash join algorithm. Based on the extracted data, a user-merchant bipartite graph is constructed, including a set of nodes and a set of edges. The set of nodes includes user node characteristics, specifically including registration duration, number of historical orders, average order value, shipping address entropy, device switching frequency, and return rate. The edge set includes edge features, which represent transaction relationships, including order time, order amount, whether a coupon was used, payment method, and IP address.
[0008] As a further technical solution, when calculating the feature space difference consistency vector, a statistical profile of the neighbor group of the relationship is calculated, including the mean vector and standard deviation vector of the feature vectors of the neighboring nodes of the node. The statistical profiling based on computation extracts differential indicators, including node-node differences, node-neighbor group mean differences, node-neighbor group directional differences, and neighbor group cohesion. The above indicators are combined into a feature space difference vector.
[0009] As a further technical solution, when calculating the structural space difference vector, the following is included: calculating the characteristic mean of the edges associated with the computing node and its neighboring nodes; Extract the differential indicators, including: degree difference, edge feature mean difference, and edge feature variance difference; The above structural dissimilarity indices are input into a multilayer perceptron and mapped to a unified dimensional space to obtain a structural space dissimilarity vector.
[0010] As a further technical solution, when calculating the business logic difference feature vector, the following are included: First, calculate the business metrics: order amount anomaly score, geographic location anomaly score, behavior time entropy, and cross-border transaction index; By combining the above business metrics, we obtain the business logic difference feature vector.
[0011] As a further technical solution, core neighbor sampling and final attention calculation include: Calculate the unnormalized preliminary attention score between the node and all its neighbors; Collect the preliminary scores of all neighbors of the node to form a set. Based on the set, select the set of neighbors with the highest scores from all neighbors of the node to form a core neighbor subset. Normalization is performed only on the core subset to compute the final attention weights; The value vector of neighboring nodes is obtained based on the final attention weights and gating scores.
[0012] Secondly, an e-commerce anomaly detection system integrating multi-dimensional differences and gating mechanisms was disclosed, including: The raw data extraction module is configured to extract and preprocess raw data from multiple e-commerce related data sources. The multidimensional difference vector construction module is configured to calculate the feature space difference consistency vector, the structure space difference vector, and the business logic difference feature vector for the preprocessed raw data respectively. The three-dimensional difference vectors are concatenated to form a complete multidimensional difference vector for each node. The feature processing module is configured to perform relation information aggregation, gating score calculation, and relation-aware feature transformation sequentially on the multidimensional dissimilarity vector; The abnormal behavior judgment module is configured to: perform information preprocessing, core neighbor sampling and final attention calculation on the transformed features, and finally perform information aggregation to obtain aggregated difference information, and obtain the probability that a node exhibits abnormal behavior based on the aggregated difference information.
[0013] The above one or more technical solutions have the following beneficial effects: This invention's technical solution constructs a multidimensional difference vector, transforming implicit local anomaly patterns, which are difficult to capture in traditional models, into explicit and quantifiable features. Combined with the core neighbor sampling strategy of an adaptive attention aggregation mechanism, the model can actively ignore the "smoothing" effect caused by a large number of normal neighbors, focusing computational resources on a few neighbors that transmit key anomaly signals. This allows the invention to maintain extremely high detection accuracy even in highly disguised scenarios where anomaly nodes are surrounded by a large number of normal users. Furthermore, compared to methods relying on complex reinforcement learning parameter tuning, this solution is simpler in design and more stable in performance.
[0014] Advantages of additional aspects of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. Attached Figure Description
[0015] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an improper limitation of the invention.
[0016] Figure 1 This is a flowchart illustrating the e-commerce anomaly detection process that integrates multidimensional differences and gating mechanisms, as described in this invention. Figure 2 This is a flowchart of the three-dimensional feature calculation and vector synthesis process of the multidimensional difference module in an embodiment of the present invention; Figure 3 This is a flowchart of the adaptive attention aggregation mechanism in an embodiment of the present invention. Detailed Implementation
[0017] It should be noted that the following detailed descriptions are exemplary and intended to provide further illustration of the invention. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.
[0018] It should be noted that the terminology used herein is for the purpose of describing particular implementations only and is not intended to limit the exemplary implementations of the present invention.
[0019] Where there is no conflict, the embodiments and features in the embodiments of the present invention can be combined with each other.
[0020] Regarding the theoretical formula: The integrated multidimensional difference and gated adaptive attention network model includes a multidimensional difference module, an enhanced relational gating unit, and an adaptive attention aggregation mechanism. The multidimensional difference module includes: a. Feature Space Differences: This dimension captures node differences. The degree of deviation in behavioral patterns from its neighboring groups. Let the node... The feature vector is , The dimension of the feature vector is represented by the relation The set of connected neighbors is A single-neighbor node is represented as .
[0021] First, regarding relationships Neighborhood Calculate statistical profiling, that is Adjacent nodes The mean vector of the eigenvectors and standard deviation vector .
[0022]
[0023]
[0024] Secondly, extract the difference indicators, node-to-node differences: Node-neighbor group mean difference: ; Node-neighbor group directional differences: Neighborhood cohesion: .
[0025] Finally, vector synthesis is performed to combine the above indicators into a feature space difference vector. .
[0026]
[0027] b. Structural Spatial Disparity: This dimension captures the mismatch between nodes and their "roles" and "status" within the graph topology. Let's consider nodes... The set of associated edges is , with nodes The set of neighboring nodes .
[0028] First, compute nodes Its neighboring nodes Eigenmean of associated edges and .
[0029]
[0030]
[0031] Secondly, extract the difference index, degree difference: Difference in mean values of edge features: Variance of edge features: .
[0032] Finally, vector synthesis is performed using a multilayer perceptron (MLP). Mapping to the same dimensional space yields a structural space difference vector. .
[0033]
[0034] c. Business Logic Differences: This dimension combines this solution with specific application scenarios, defining metrics with clear business significance, such as: (1) Volatility of trading volume:
[0035] in, Indicates the most recent 24-hour time window; Indicates the first Volatility indicators for individual objects; Indicates the time set within, no. The maximum amount of each object; Indicates the time set within, no. The average amount of each object; This is a regularization term.
[0036] (2) Geographical location anomaly score:
[0037] in, This indicates the number of transactions from the three most frequent locations. This represents the total number of transactions; a higher value indicates a more geographically dispersed geographical distribution.
[0038] (3) Behavioral temporal entropy: Calculate the entropy value of the time when the user's behavior occurs. If the entropy value is too low (the behavior is too regular) or too high (the behavior is completely random), it may be abnormal behavior.
[0039]
[0040] in, Indicates the first The number of transactions per hour; an entropy value that is too low indicates that the behavior is too regular, while an entropy value that is too high indicates that the behavior is completely random. This is a regularization term.
[0041] (4) Cross-border transaction index:
[0042] in, Indicates the number of cross-border transactions. The total number of all related behaviors.
[0043] Finally, vector synthesis is performed to obtain the business logic difference feature vector. .
[0044]
[0045] By concatenating the three-dimensional difference vectors, a complete multidimensional difference vector is formed. .
[0046]
[0047] Regarding Enhanced Relationship Gating Units (E-RGUs) a. Relationship information aggregation: For nodes Through relationships Dissimilarity vectors of all connected neighbors Perform aggregation to obtain relationships Comprehensive Differences Profile .
[0048]
[0049] b. Gating score calculation: [The node is then used for the calculation.] The current representation Relationship profiling The data is concatenated, input to a fully connected layer, and then... The function obtains the gated score .
[0050]
[0051] in, These are learnable parameters. yes function, This represents the vector concatenation operation.
[0052] c. Relation-aware feature transformation: For each relation type Learning an independent transformation matrix d is the feature dimension, using gated scores. Directly drives feature transformation.
[0053]
[0054] in, express product.
[0055] Regarding adaptive attention aggregation mechanism a. Information preprocessing: Query generation uses gating scores We use weighted fusion of all the features after relational transformation to obtain a comprehensive contextual representation. ,Then The key is still based on the most basic difference vector. Generate
[0056] b. Preliminary attention score: Calculate the score before... Normalized attention score , Scaling factor This represents the dimension of the key vector.
[0057] c. Sampling factor: Collection node The initial scores of all neighbors constitute a set. Calculate the sampling factor , It is the smallest positive number.
[0058] d. Core Neighbor Sampling: Based on Preliminary Attention Score From node Choose the highest score from all neighbors Each neighbor constitutes a subset of the core neighbors. .
[0059] e. Final attention calculation: only on the core subset Up Normalization, then calculate the final attention weights. .
[0060]
[0061] f. Value Channel Adjustment: Adjusting the channel through attention weights When performing a weighted summation on Value, the gated score is used again. Adjust the "channel" to obtain .
[0062] g. Information Aggregation: The value vectors of core neighbors are weighted and summed using the final weights to obtain the aggregated dissimilarity information. .
[0063] Regarding node status updates a. Node Update: This involves updating the aggregated differences. With nodes old representation A new node representation is generated by fusing residual connections and layer normalization. , Indicates the current floor number.
[0064]
[0065] b. Model training: Stack the GNN layers composed of the above three modules. This process yields the final node representation. The data is fed into a classifier to obtain the probability that a node exhibits abnormal behavior. The model is trained end-to-end by minimizing the cross-entropy loss function on the labeled nodes.
[0066] Through the above scheme, this invention extends the paradigm of traditional graph neural networks, which relies on the homogeneity assumption and directly aggregates the original features of neighbors, to the scope of explicit modeling and aggregating multidimensional difference information between nodes. It constructs an e-commerce abnormal behavior detection system with explicit multidimensional difference quantification as its core, which has both high detection accuracy and strong business interpretability.
[0067] Example 1 See appendix Figure 1 As shown, this embodiment discloses an e-commerce anomaly detection method that integrates multidimensional differences and gating mechanisms, including: The following section uses the detection of abnormal order-brushing behavior by merchants on e-commerce platforms as a typical application scenario to explain the specific implementation process step by step.
[0068] The implementation of this invention first requires the construction of a complete data processing and computation pipeline. The system consists of two subsystems: offline training and online detection. The offline training system is responsible for model building and parameter learning, while the online detection system is responsible for real-time abnormal behavior risk prediction.
[0069] Step 1: Data Preparation Phase. Raw data is extracted from multiple data sources, including the e-commerce platform's order system, user behavior logs, merchant backend data, and product information database. This includes user node characteristic data, such as registration duration, historical order count, average order value, shipping address entropy, device switching frequency, and return rate; and transaction relationship characteristics, such as order placement time, order amount, whether coupons were used, payment method, and IP address. A time-window-based incremental data extraction strategy is employed, with data synchronization performed hourly.
[0070] The data fusion process uses the customer's unique identifier (Cust_ID) and merchant's ID (Merchant_ID) as primary keys. A distributed hash join algorithm is used to achieve multi-table associations. These tables originate from various data sources, including the e-commerce platform's order system, user behavior logs, merchant backend data, and product information databases. Specifically, these include a user information table storing user node characteristics such as registration duration and historical order count; a merchant information table storing basic and operational characteristics such as merchant registration time and business scope; an order transaction table recording transaction relationship edge characteristics such as order placement time and order amount; and a product information table linking merchants and products. The integration of multi-source data is achieved through cross-table associations using dual primary keys.
[0071] Based on the extracted data, construct a user-merchant bipartite graph. .in, The user node is a set of nodes, and its characteristics include: registration duration, number of historical orders, average order value, delivery address entropy, device switching frequency, return rate, etc. Let be a set of edges, representing transaction relationships. Edge features may include order time, order amount, whether a coupon was used, payment method, IP address, etc.
[0072] Select a subset of labeled abnormal and normal users as the training set.
[0073] Step 2: Implementation of the local difference quantization engine.
[0074] Step 2-1: Feature Space Difference Consistency Calculation. This dimension captures the deviation of a node (user) from its neighboring group (merchants who have transacted with the user) in terms of behavioral patterns. Let the node... The feature vector is , The dimension of the feature vector. The set representing relation types is the universal set of all relation types, which is accessed through relations. The set of connected neighbors is A single-neighbor node is represented as .
[0075] (2-1-1) Neighbor Group Profile: First, regarding relationships Neighborhood Calculate statistical profiling, that is Adjacent nodes The mean vector of the eigenvectors and standard deviation vector .
[0076]
[0077]
[0078] (2-1-2) Extraction of differential indicators: Node-to-node differences: This directly quantifies the differences between nodes; Node-neighbor group mean difference: Quantify the deviation of node characteristics from the average level of its neighbors; Node-neighbor group directional differences: The difference between a node's feature vector and the direction of its neighbor's group center is measured. A multilayer perceptron representing feature perception.
[0079] Neighborhood cohesion: This reflects the consistency of the neighborhood group itself; the lower the cohesion, the more dispersed the group.
[0080] (2-1-3) Vector synthesis: The above indicators are synthesized into a feature space difference vector. .
[0081]
[0082] Step 2-2: Calculate the structural space difference. This dimension captures the mismatch between the "role" and "status" of nodes in the graph topology.
[0083] (2-2-1) Calculate the characteristic mean: First, calculate the node mean. Its neighboring nodes Eigenmean of associated edges and .
[0084]
[0085]
[0086] (2-2-2) Extraction of difference indicators: Degree difference: Calculate the difference in degree between the node and its neighbors, reflecting anomalies in the connection pattern;
[0087] Where log is the logarithm; deg is the degree of the node. That is, node j is an element in the neighbor set of node i.
[0088] Mean difference of edge features: Calculate the connection nodes The difference between the characteristic mean of an edge and the characteristic mean of the edges connecting its neighbors;
[0089] Variance of edge features: Similarly, calculate the variance of edge features.
[0090] .
[0091] (2-2-3) Vector synthesis: The above structural dissimilarity indexes are input into a multilayer perceptron (MLP) and mapped to a unified dimensional space to obtain structural space dissimilarity vectors. .
[0092] .
[0093] Steps 2-3: Calculate business logic differences. This dimension is closely integrated with specific application scenarios, defining metrics with clear business significance. In a credit card anti-fraud scenario, the following metrics can be designed: (2-3-1) Order Amount Anomaly: Reflects the drastic fluctuations in the order amount of merchants in a short period of time.
[0094]
[0095] Where T represents the most recent 24-hour time window; Indicates the first Volatility indicators for individual objects; Indicates the time set within, no. The maximum amount of each object; Indicates the time set within, no. The average amount of each object; This is a regularization term.
[0096] (2-3-2) Geographical location anomaly score: This is an indicator used to assess whether there are any anomalies in the geographic location information of an object (such as a user, device, or transaction) by quantitatively analyzing the degree of deviation between its actual geographic location and its historical commonly used location and associated location (such as a bound address).
[0097]
[0098] in, This indicates the number of transactions from the three most frequent locations. This represents the total number of transactions; a higher value indicates a more geographically dispersed geographical distribution.
[0099] (2-3-3) Behavior time entropy: Calculate the entropy value of the time when the user's behavior occurs. If the entropy value is too low (the behavior is too regular) or too high (the behavior is completely random), it may be abnormal behavior.
[0100]
[0101] in, Indicates the first The number of transactions per hour; an entropy value that is too low indicates that the behavior is too regular, while an entropy value that is too high indicates that the behavior is completely random. This is a regularization term.
[0102] (2-3-4) Cross-border transaction index: An indicator that measures the level of cross-border transaction activity or the intensity of related behaviors by quantifying the core characteristics of objects (such as users and accounts) such as the number, amount, or frequency of cross-border transactions.
[0103]
[0104] in, Indicates the number of cross-border transactions. The total number of all related behaviors.
[0105] (2-3-5) Vector synthesis: Combine the above business indicators to obtain the business logic difference feature vector. .
[0106]
[0107] Finally, the dissimilarity vectors of the three dimensions are concatenated to form nodes. Complete multidimensional difference vector This vector will serve as the initial input to the proposed graph neural network model.
[0108]
[0109] Step 3: In order to effectively handle different types of relationships in the graph, this invention designs an E-RGU module to dynamically and adaptively control the information transmission of different relationships.
[0110] Step 3-1: Relationship information aggregation, for the central node and a specific type of relationship First, aggregate all of them. r The vector representation of the multidimensional dissimilarity module of type neighbors is obtained by means aggregation to obtain a comprehensive dissimilarity profile of the relationship. .
[0111]
[0112] Step 3-2: Gating score calculation, set the node The current representation Relationship profiling The data is concatenated and input into a fully connected layer, through... The function yields a gated score between 0 and 1. .
[0113]
[0114] in, These are learnable parameters. Represents a relationship For updating nodes The importance or relevance of the state yes function, This represents the vector concatenation operation.
[0115] Step 3-3: Relation-aware feature transformation for each relation type. Learning an independent transformation matrix d is the feature dimension. Using the above gated scores... Instead of weighting after aggregation, the feature transformation is driven directly. This allows the model to dynamically "turn on" or "turn off" the information flow of specific relationship channels based on context. This step is for nodes. Generate for each relationship And the intermediate representation after gating adjustment .
[0116]
[0117] in, express product.
[0118] Step four: When aggregating neighbor information, traditional attention mechanisms calculate weights for all neighbors, which is inefficient and prone to introducing noise when the number of neighbors is large. The adaptive attention aggregation mechanism solves this problem through a core sampling strategy.
[0119] Step 4-1: Information preprocessing, Q and K generation.
[0120] Query(Q): Gating score calculated using E-RGU To weightedly fuse all features after relational transformation This yields a query vector that integrates all relational contexts. .
[0121]
[0122] in, .
[0123] Key(K): Neighboring nodes The key vector is based on its most original differential cluster. Generate signals that retain their inherent inconsistencies. .
[0124]
[0125] Step 4-2: Core Neighbor Sampling and Final Attention Calculation.
[0126] (4-2-1) Preliminary Attention Score: Calculate Node With all its neighbors between Normalized Preliminary Attention Score .
[0127]
[0128] in, Scaling factor This represents the dimension of the key vector.
[0129] (4-2-2) Core Neighbor Sampling: Collecting Nodes The initial scores of all neighbors constitute a set. According to the set From node Choose the highest score from all neighbors Each neighbor constitutes a subset of the core neighbors. .
[0130]
[0131] in, It is the smallest positive number.
[0132] (4-2-3) Final attention calculation: only on the core subset Up Normalization, then calculate the final attention weights. .
[0133]
[0134] (4-2-4) Value (V) generation: neighbor nodes value vector It is its representation after relation-aware feature transformation, and then it utilizes gated scores again. Perform "channel" adjustments to enhance connectivity with the central node. The correlation.
[0135]
[0136] Step 4-3: Information aggregation. The value vectors of the core neighbors are weighted and summed using the final attention weights to obtain the aggregated difference information. .
[0137]
[0138] Step 5: Node state update and model training.
[0139] Step 5-1: Node update, updating the aggregated inconsistencies. With the old representation of the node A new node representation is generated by fusing residual connections and layer normalization. .
[0140]
[0141] in, Indicates the current floor number.
[0142] Step 5-2: Model training, stacking the GNN layers composed of the above four modules. L This process yields the final representation of the node. The data is then fed into a fully connected classifier (MLP) to obtain the probability that a node represents abnormal behavior. The model is trained end-to-end by minimizing the cross-entropy loss function on the labeled nodes. This cross-entropy loss function is designed for binary classification scenarios in e-commerce anomaly detection and takes the following form:
[0143] in, This represents the total number of labeled nodes participating in the training (i.e., the number of known normal or abnormal user / merchant nodes). For the first i Each tagged node has a real label, where a value of 1 indicates abnormal behavior and a value of 0 indicates normal behavior. The first output of the model The abnormal behavior prediction probability of each node, with a value range between [0,1], directly corresponds to the output of the fully connected classifier; To quantify the deviation between the predicted probability and the true label, the logarithmic terms are summed and averaged to obtain the overall loss value. The model iteratively optimizes the network parameters through the gradient descent algorithm, continuously reducing this loss value, and finally achieving accurate identification of abnormal behavior.
[0144] The core idea of this embodiment's sub-technical solution lies in improving the traditional paradigm of graph neural networks that directly aggregates the original features of neighbors, instead explicitly modeling, filtering, and aggregating the "difference" information between nodes. This method aims to construct an enhanced node representation specifically for abnormal behavior detection by explicitly quantifying the statistical differences between the target node and its local neighborhood in multidimensional space. It then utilizes a novel gated adaptive attention mechanism for information aggregation, thereby focusing on abnormal signals at the source of information transmission, achieving efficient, accurate, and interpretable abnormal behavior detection.
[0145] This implementation method is based on graph representation learning and anomaly detection theory. The core of it is to first explicitly quantify the statistical differences between the target node and its local neighborhood by constructing a multidimensional difference module, specifically generating difference vectors from three dimensions: feature space, structure space, and business logic. Then, it relies on the Enhanced-Gated Recurrent Unit (E-RGU) to aggregate relationship information and transform features, and combines an adaptive attention aggregation mechanism to select core neighbors and accurately calculate attention weights to achieve efficient information aggregation. In this way, enhanced node features are constructed to achieve efficient, accurate, and interpretable anomaly behavior detection. Its technical solution includes three modules: multidimensional difference module, enhanced relationship gating unit, and adaptive attention aggregation mechanism.
[0146] Implementation effect Compared to traditional models like GAT, the method described in this invention significantly improves both accuracy and recall on the test set. Furthermore, when a user is identified as exhibiting abnormal behavior, the source can be traced by analyzing their multidimensional variance modules. If a certain dimension of their feature space variance vector has an abnormally high value, it can be interpreted as "the user's single transaction amount is far higher than the average customer level of their trading merchants." If the gating score for "login from a different location" is much higher than that for "local transactions," it indicates that the model is focusing on this abnormal behavior signal. The core neighbors focused on by the adaptive attention aggregation mechanism also reveal the key basis for the model's judgment, demonstrating excellent interpretability of the model's decisions. This model, which combines underlying data anomalies, topological structure anomalies, and high-level business logic anomalies, and uses gating and core sampling mechanisms for intelligent information filtering, aligns with the business intuition of risk control experts, enhancing the model's credibility, robustness, and usability in actual business operations.
[0147] This invention provides a clear decision-making path for "black box" models, with interpretability reflected in the following aspects: Strong decision interpretability enhances the model's practical value. By analyzing the contribution of each dimension in the multidimensional difference module, the specific reason why a node is identified as an anomaly can be clearly determined. The core neighbor set output by the adaptive attention aggregation mechanism can directly locate which key neighbor nodes transmitted decisive anomaly signals. The E-RGU gating score can quantify the importance of different relationship types in anomaly behavior judgment. Multi-layered interpretability allows risk control personnel to intuitively understand the decision-making basis, improving the model's credibility and practical value. It achieves high-precision, highly interpretable detection of disguised anomaly behavior, effectively solving the problem of weakened anomaly features caused by excessive smoothing and homogeneity assumptions in existing graph neural networks.
[0148] The multidimensional differentiation module proposed in this invention is relatively decoupled from the subsequent GNN aggregation layer, featuring a modular design that allows for flexible integration with various graph neural network base models such as GAT, improving its performance in heterogeneous scenarios. Furthermore, the business logic differentiation units within the multidimensional differentiation module are designed as configurable modules, allowing developers to easily define and incorporate domain knowledge according to specific scenarios, enhancing the solution's scenario adaptability.
[0149] Example 2 The purpose of this embodiment is to provide a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of the above-described method.
[0150] Example 3 The purpose of this embodiment is to provide a computer-readable storage medium.
[0151] A computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, performs the steps of the above method.
[0152] Example 4 The purpose of this embodiment is to provide an e-commerce anomaly detection system that integrates multidimensional differences and gating mechanisms, including: The raw data extraction module is configured to extract and preprocess raw data from multiple e-commerce related data sources. The multidimensional difference vector construction module is configured to calculate the feature space difference consistency vector, the structure space difference vector, and the business logic difference feature vector for the preprocessed raw data respectively. The three-dimensional difference vectors are concatenated to form a complete multidimensional difference vector for each node. The feature processing module is configured to perform relation information aggregation, gating score calculation, and relation-aware feature transformation sequentially on the multidimensional dissimilarity vector; The abnormal behavior judgment module is configured to: perform information preprocessing, core neighbor sampling and final attention calculation on the transformed features, and finally perform information aggregation to obtain aggregated difference information, and obtain the probability that a node exhibits abnormal behavior based on the aggregated difference information.
[0153] Example 5 The purpose of this embodiment is to provide a computer program product containing instructions that, when run on a computer, cause the computer to perform the methods and functions involved in any of the above embodiments. The steps and methods involved in the apparatus of the above embodiments correspond to those in Embodiment 1. For specific implementation details, please refer to the relevant description section of Embodiment 1. The term "computer-readable storage medium" should be understood as a single medium or multiple media including one or more instruction sets; it should also be understood as including any medium capable of storing, encoding, or carrying an instruction set for execution by a processor and enabling the processor to perform any of the methods in this invention.
[0154] Those skilled in the art will understand that the modules or steps of the present invention described above can be implemented using general-purpose computer devices. Optionally, they can be implemented using computer-executable program code, thereby allowing them to be stored in a storage device for execution by a computer device, or they can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. The present invention is not limited to any particular combination of hardware and software.
[0155] While the specific embodiments of the present invention have been described above in conjunction with the accompanying drawings, this is not intended to limit the scope of protection of the present invention. Those skilled in the art should understand that various modifications or variations that can be made by those skilled in the art without creative effort based on the technical solutions of the present invention are still within the scope of protection of the present invention.
Claims
1. An e-commerce anomaly detection method integrating multidimensional differences and gating mechanisms, characterized by: include: Raw data is extracted and preprocessed from multiple e-commerce-related data sources; For the preprocessed raw data, calculate the feature space difference vector, the structure space difference vector, and the business logic difference vector respectively. The three-dimensional difference vectors are concatenated to form a complete multidimensional difference vector for each node. For multidimensional difference vectors, perform relation information aggregation, gating score calculation, and relation-aware feature transformation sequentially; The transformed features are preprocessed, core neighbor sampling is performed, and final attention calculation is performed. Finally, information aggregation is performed to obtain aggregated differential information. Based on the aggregated differential information, the probability of a node exhibiting abnormal behavior is obtained.
2. The e-commerce anomaly detection method integrating multidimensional differences and gating mechanisms as described in claim 1, characterized in that, The process of preprocessing raw data is as follows: The system uses the customer's unique identifier and the merchant's ID as the primary key, and implements multi-table joins through a distributed hash join algorithm. Based on the extracted data, a user-merchant bipartite graph is constructed, including a set of nodes and a set of edges. The set of nodes includes user node characteristics, specifically including registration duration, number of historical orders, average order value, shipping address entropy, device switching frequency, and return rate. The edge set includes edge features, which represent transaction relationships, including order time, order amount, whether a coupon was used, payment method, and IP address.
3. The e-commerce anomaly detection method integrating multidimensional differences and gating mechanisms as described in claim 1, characterized in that, When calculating the feature space consistency vector, a statistical profile is calculated for the neighbor group of the relationship, including the mean vector and standard deviation vector of the feature vectors of the neighboring nodes of the node; The statistical profiling based on computation extracts differential indicators, including node-node differences, node-neighbor group mean differences, node-neighbor group directional differences, and neighbor group cohesion. The above indicators are combined into a feature space difference vector.
4. The e-commerce anomaly detection method integrating multidimensional differences and gating mechanisms as described in claim 1, characterized in that, When calculating the structural space dissimilarity vector, the following steps are included: calculating the characteristic mean of the edges associated with a node and its neighboring nodes; Extract the differential indicators, including: degree difference, edge feature mean difference, and edge feature variance difference; The above structural dissimilarity indices are input into a multilayer perceptron and mapped to a unified dimensional space to obtain a structural space dissimilarity vector.
5. The e-commerce anomaly detection method integrating multidimensional differences and gating mechanisms as described in claim 1, characterized in that, When calculating the feature vector of business logic differences, the following are included: First, calculate the business metrics: order amount anomaly score, geographic location anomaly score, behavior time entropy, and cross-border transaction index; By combining the above business metrics, we obtain the business logic difference feature vector.
6. The e-commerce anomaly detection method integrating multidimensional differences and gating mechanisms as described in claim 1, characterized in that, Core neighbor sampling and final attention calculation include: Calculate the unnormalized preliminary attention score between the node and all its neighbors; Collect the preliminary scores of all neighbors of the node to form a set. Based on the set, select the set of neighbors with the highest scores from all neighbors of the node to form a core neighbor subset. Normalization is performed only on the core subset to compute the final attention weights; The value vector of neighboring nodes is obtained based on the final attention weights and gating scores.
7. An e-commerce anomaly detection system integrating multidimensional differences and gating mechanisms, characterized by: include: The raw data extraction module is configured to extract and preprocess raw data from multiple e-commerce related data sources. The multidimensional difference vector construction module is configured to calculate the feature space difference consistency vector, the structure space difference vector, and the business logic difference feature vector for the preprocessed raw data respectively. The three-dimensional difference vectors are concatenated to form a complete multidimensional difference vector for each node. The feature processing module is configured to perform relation information aggregation, gating score calculation, and relation-aware feature transformation sequentially on the multidimensional dissimilarity vector; The abnormal behavior judgment module is configured to: perform information preprocessing, core neighbor sampling and final attention calculation on the transformed features, and finally perform information aggregation to obtain aggregated difference information, and obtain the probability that a node exhibits abnormal behavior based on the aggregated difference information.
8. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the method of any one of claims 1 to 6.
9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps of the method described in any one of claims 1-6.
10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it performs the steps of the method described in any one of claims 1-6 above.