Anti-fraud method, device and equipment based on hotel reservation and storage medium

Abstract

The invention relates to an anti-fraud method and device based on hotel reservation, equipment and a storage medium. The method comprises the following steps: constructing a reservation-cancel time sequence sub-graph of a user to which a target order belongs in a preset time period, extracting a static behavior baseline vector and a dynamic time sequence adjacency matrix based on the reservation-cancel time sequence sub-graph, coupling the dynamic time sequence adjacency matrix with a market price difference index, generating an environment perception embedding vector, and embedding the environment perception embedding vector into the target order. And inputting the static behavior baseline vector and the environment perception embedded vector into a fraud intention identification model to obtain a fraud probability score of the target order, and executing a corresponding anti-fraud strategy based on the fraud probability score. According to the method, the fraud behavior identification accuracy can be improved.

Description

Technical Field

[0001] This application relates to the field of fraud detection technology, and in particular to an anti-fraud method, apparatus, device and storage medium based on hotel booking. Background Technology

[0002] A type of room-splitting fraud exists in the online hotel distribution industry. Fraudsters use illegitimate credit cards to book hotel rooms with free cancellation, then resell them to legitimate customers at slightly below market price. After the customers check in and cancel the original booking, the fraudsters cash out, leading to the hotel having to pay back room fees, customer complaints, and damage to the platform's reputation. Current technologies primarily rely on credit card verification, time-limited cancellation rules, and manual spot checks for prevention. However, these methods have certain shortcomings: relying solely on payment verification cannot characterize the temporal behavior of fraudsters; secondly, risk detection is often delayed, frequently revealing problems only after customers check in and complain, at which point the losses are irreversible; and thirdly, existing general anti-fraud models cannot effectively correlate abnormal user behavior with external market price differences, resulting in low accuracy in identifying fraudulent behavior in high-price-difference scenarios.

[0003] Therefore, how to improve the accuracy of fraud detection has become a technical problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0004] In view of the above, this application provides a method, apparatus, device and storage medium for anti-fraud based on hotel booking, the purpose of which is to solve the above-mentioned technical problems.

[0005] In a first aspect, this application provides an anti-fraud method based on hotel bookings, the method comprising:

[0006] Construct a booking-cancellation time-series subgraph for the user to which the target order belongs within a preset time period, and extract static behavior baseline vectors and dynamic time-series adjacency matrices based on the booking-cancellation time-series subgraph;

[0007] The dynamic temporal adjacency matrix is ​​coupled with the market price difference index to generate an environment-aware embedding vector;

[0008] The static behavior baseline vector and the environmental perception embedding vector are input into the fraud intent recognition model to obtain the fraud probability score of the target order;

[0009] Based on the fraud probability score, the corresponding anti-fraud strategy is executed.

[0010] Secondly, this application provides an anti-fraud device based on hotel bookings, which includes:

[0011] Extraction module: used to construct a booking-cancellation time series subgraph of the user to which the target order belongs within a preset time period, and extract static behavior baseline vectors and dynamic time series adjacency matrices based on the booking-cancellation time series subgraph;

[0012] Generation module: used to couple the dynamic temporal adjacency matrix with the market price difference index to generate an environment-aware embedding vector;

[0013] Identification module: used to input the static behavior baseline vector and the environmental perception embedding vector into the fraud intent identification model to obtain the fraud probability score of the target order;

[0014] Execution module: Used to execute corresponding anti-fraud strategies based on the fraud probability score.

[0015] Thirdly, this application provides an electronic device, including a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus;

[0016] Memory, used to store computer programs;

[0017] When a processor executes a program stored in memory, it implements the steps of the anti-fraud method based on hotel booking as described in any embodiment of the first aspect.

[0018] Fourthly, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the steps of the anti-fraud method based on hotel booking as described in any embodiment of the first aspect.

[0019] The technical solutions provided in this application have the following advantages compared with the prior art:

[0020] By constructing a booking-cancellation time-series subgraph and extracting static behavioral baseline vectors and dynamic time-series adjacency matrices, the temporal rhythm characteristics of users' "intensive booking-concentrated cancellation" are characterized. The dynamic time-series adjacency matrix is ​​coupled with the market price difference index to generate an environment-aware embedding vector, realizing the dynamic fusion of external arbitrage incentives and internal behavioral anomalies. This can improve the early warning sensitivity in high price difference scenarios. The input data processed by the fraud intent recognition model integrates users' historical stability and current market sensitivity. The output fraud probability score has both high discrimination accuracy and interpretability, improving the accuracy of fraud behavior recognition and reducing the risk of platform financial losses. Attached Figure Description

[0021] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0022] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0023] Figure 1 This is a flowchart illustrating a preferred embodiment of the anti-fraud method based on hotel booking in this application;

[0024] Figure 2 This is a schematic diagram of a preferred embodiment of the anti-fraud device based on hotel booking in this application;

[0025] Figure 3 This is a schematic diagram of a preferred embodiment of the electronic device of this application;

[0026] The realization of the purpose, functional features and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0027] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application. All other embodiments obtained by those skilled in the art based on the embodiments in this application without inventive effort are within the scope of protection of this application.

[0028] It should be noted that the use of terms such as "first" and "second" in this application is for descriptive purposes only and should not be construed as indicating or implying their relative importance or implicitly specifying the number of technical features indicated. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include at least one of those features. Furthermore, the technical solutions of the various embodiments can be combined with each other, but this must be based on the ability of those skilled in the art to implement them. If the combination of technical solutions is contradictory or impossible to implement, such a combination of technical solutions should be considered non-existent and not within the scope of protection claimed in this application.

[0029] Reference Figure 1 The diagram shown is a flowchart illustrating an embodiment of the anti-fraud method based on hotel bookings according to this application. The method is executed by an electronic device, which can be implemented by a software system and / or a hardware system. The anti-fraud method based on hotel bookings includes:

[0030] Step S10: Construct a booking-cancellation time series subgraph for the user to which the target order belongs within a preset time period, and extract the static behavior baseline vector and dynamic time series adjacency matrix based on the booking-cancellation time series subgraph;

[0031] Step S20: Couple the dynamic temporal adjacency matrix with the market price difference index to generate an environment-aware embedding vector;

[0032] Step S30: Input the static behavior baseline vector and the environment perception embedding vector into the fraud intent recognition model to obtain the fraud probability score of the target order;

[0033] Step S40: Based on the fraud probability score, execute the corresponding anti-fraud strategy.

[0034] The main phenomenon of room-splitting fraud is that fraudsters use illegal credit cards to book hotel rooms that can be cancelled for free in a short period of time, and then sell the rooms to real customers at a price lower than the market price. Subsequently, the fraudsters cancel the rooms in bulk to cash out, and the hotel asks the customer to pay the room fee because the original order was cancelled, resulting in customer complaints and damage to the platform's reputation.

[0035] Traditional anti-fraud methods primarily rely on statistical indicators of users' historical orders (such as average cancellation rate), which cannot characterize the unique temporal rhythm and property association patterns of room-switching fraud. This temporal topological structure of behavior is more identifiable than simple statistical values. Therefore, this example constructs users' historical order events as a graph structure to explicitly model the temporal relationships between events and property associations, providing a structured behavioral graph foundation for subsequent analysis.

[0036] Extract all order records of the user to which the target order belongs within the 72 hours prior to the current time from the order database. Each record includes an order number, operation type (booking or cancellation), timestamp, room identifier (hotel ID + room type ID), and order status. Map these records to graph nodes, with node attribute vectors consisting of operation type, normalized timestamp value, and room price. Construct directed edges based on timestamp order and room identifier: if the time difference between two nodes is less than a preset window (e.g., 2 hours) and involves the same or related rooms (e.g., different room types from the same hotel), establish a directed edge, thus constructing a booking-cancellation temporal subgraph. Input this subgraph into a two-layer graph convolutional network: the first layer aggregates the second-order neighbor information of each node, and the second layer performs pooling operations on the global topology of the subgraph, outputting a static behavior baseline vector and a dynamic temporal adjacency matrix. The static behavior baseline vector is used to represent the stable pattern of user historical behavior (e.g., average cancellation rate, dispersion of cancellation time distribution), and the dynamic temporal adjacency matrix is ​​used to capture the temporal rhythm of user behavior and room navigation paths.

[0037] The probability of fraudulent behavior is related to the market price difference of the target hotel. If only user behavior is analyzed while ignoring external arbitrage incentives, the accuracy of fraud analysis will be low in scenarios with high price differences. Therefore, this embodiment calculates the price deviation between the target hotel and its competitors in the same business district as a market price difference index, and couples it with a dynamic temporal adjacency matrix as a global adjustment factor to generate a price difference-aware adjacency matrix. This matrix is ​​input into a feature fusion layer, which integrates temporal topological features and price difference fluctuation features to output an environment-aware embedding vector. By injecting market arbitrage environment signals into the temporal structure of user behavior, the model can dynamically perceive the impact of external incentives on fraudulent motives. The generated embedding vector integrates behavioral anomalies and market sensitivity, providing more discriminative dynamic features for subsequent intent recognition.

[0038] The static behavioral baseline vector reflects users' historical habits, while the environmental awareness embedding vector reflects current market triggers. These two vectors characterize risk from the perspectives of internal stability and external sensitivity, respectively. Therefore, by inputting these two vectors in parallel into the fraudulent intent recognition model, and deeply fusing behavioral inertia and market conditions through nonlinear transformation and feature cross-validation mechanisms, a joint risk signal can be extracted. This signal is then mapped to a fraud probability score in the 0-1 range via the output layer. By combining user historical stability with current market sensitivity, the output probability score exhibits high discrimination accuracy and interpretability.

[0039] The fraud probability score is a continuous value, with significant differences in risk levels across different intervals. Therefore, multiple risk thresholds are preset, and differentiated handling measures are automatically triggered based on the fraud probability score interval: low-risk intervals allow direct access, medium-risk intervals trigger enhanced identity verification, and high-risk intervals execute order freezing, credit card pre-authorization freezing, and push for manual review. The handling results and the final order status can be fed back into the training dataset for continuous model iteration. This tiered handling achieves a balance between risk interception and user experience; pre-authorization freezing directly cuts off the cash-out process, enabling rapid response to new types of fraud.

[0040] In one embodiment, constructing a booking-cancellation time-series subgraph of the user to which the target order belongs within a preset time period, and extracting a static behavior baseline vector and a dynamic time-series adjacency matrix based on the booking-cancellation time-series subgraph, includes:

[0041] Extract the set of valid events corresponding to the target order from the order database;

[0042] The time-series subgraph is constructed based on the set of valid events, wherein the nodes of the time-series subgraph represent individual events, and the edges represent the temporal sequence relationship between events and the association relationship with housing resources;

[0043] Calculate the time decay weight of each edge to generate a dynamic temporal adjacency matrix;

[0044] The dynamic temporal adjacency matrix and node feature vectors are input into a graph convolutional network to extract a static behavior baseline vector that characterizes the stability of user behavior.

[0045] The original order database contains a large amount of noisy data unrelated to the risk of room-switching fraud, such as completed check-in orders and user information modification records. Directly using all the data would interfere with behavioral pattern capture. Therefore, a multi-condition filtering query can be performed in the order database to extract all booking and cancellation records of the user ID to which the target order belongs within 72 hours before the target order's creation timestamp. The filtering conditions include operation type as booking or cancellation, order status as successful or cancelled, and room type as a room type with free cancellation. Each record is mapped to an event object containing an event ID, operation type, timestamp, and room identifier to construct an effective event set, thereby eliminating irrelevant noise and providing an accurate data foundation for subsequent graph structure construction.

[0046] The core of room-splitting fraud lies in the temporal rhythm of concentrated bookings and cancellations within a short period and the association with available properties. Traditional methods treat orders as independent events and cannot explicitly model this dependency. Therefore, for each event object in the valid event set, a corresponding node is created. The initial feature vector of the node is composed of the operation type encoding, the normalized value of the hourly difference from the current time, and the normalized value of the property price. Then, all node pairs are traversed. If the timestamp difference between two nodes is less than a preset time window and involves the same or related properties, a directed edge is established between them from the earlier node to the later node. This transforms discrete behavioral events into a topological structure that explicitly expresses temporal dependencies and property associations, allowing the rhythmic characteristics of room-splitting fraud to be presented in a structured way.

[0047] In the analysis of room-splitting fraud, events occurring at different times have varying degrees of impact on a user's current intent. Events closer to the current time contain more information, and assigning the same weight to all edges weakens the signal strength of recent key events. Therefore, for each directed edge in the time-series subgraph, the time difference Δt between the two nodes it connects is calculated, and the time decay weight of the edge is calculated using the exponential decay function w = exp(-Δt / τ), where τ is a preset decay time constant. The weights of all edges are organized into a matrix according to the node order to generate a dynamic temporal adjacency matrix, which strengthens the correlation of recent events and thus accurately portrays the short-term outbreak characteristics of room-splitting fraud.

[0048] While dynamic temporal adjacency matrices preserve the temporal structure of behavior, they lack an abstract representation of the stability of long-term user behavior patterns. Identifying room-booking fraud requires determining whether current behavior deviates from historical habits. To address this, the dynamic temporal adjacency matrix and node feature vector matrices are input into a two-layer graph convolutional network. The first layer aggregates the first-order neighbor features of each node, and the second layer further aggregates second-order neighbor information and expands the receptive field. After the second layer, global average pooling is performed on the hidden representations of all nodes, and the feature vectors of all nodes are averaged to output a 1×64-dimensional static behavioral baseline vector, encoding the stability pattern of user booking-cancellation behavior within a preset time period. This vector preserves both the statistical characteristics of behavior and incorporates the topological semantic relationships between events, providing a stable and information-rich user profile foundation for subsequent intent recognition.

[0049] The step of extracting the set of valid events corresponding to the target order from the order database includes:

[0050] Extract all booking and cancellation events of the user to which the target order belongs within a preset time period from the order database, and construct an original event sequence containing timestamps, property identifiers, and operation types;

[0051] The original event sequence is preprocessed to obtain a valid set of events containing the target hotel and its associated rooms.

[0052] The original order database stores all user operation records. Directly using it for analysis would introduce a large amount of irrelevant information. Therefore, it is necessary to focus on the target user and the target time window. Specifically, a query operation is performed in the order database using the user ID of the target order as an index to extract all operation records of that user within 72 hours before the creation timestamp of the target order. Order events with operation types of "booking" or "cancellation" are filtered out. Each event is mapped to a data structure containing three elements: timestamp, room identifier (a combination of hotel ID and room type ID), and operation type. The data is then sorted in ascending order by timestamp to construct the original event sequence. By accurately locating the target user and the target time period, core events strongly related to the "room switching" behavior are quickly gathered, avoiding the computational redundancy caused by scanning the entire data set.

[0053] The original event sequence may still contain noise, such as user operation records for other non-target hotels or events with abnormal status. This irrelevant information can interfere with the assessment of the risk of the target order. Therefore, it is necessary to filter and clean the original event sequence. Specifically, each event in the original event sequence is traversed, and only events with the same room identifier as the target hotel of the target order or with a strong correlation (such as different room types under the same hotel group, or frequently associated upgrade room types in historical orders) are retained. Events with abnormal status (such as payment failure or system cancellation) are removed. Finally, a valid event set consisting of the target hotel and its associated rooms is obtained, where each event is a valid booking or cancellation operation. Through correlation filtering and anomaly removal, it can be ensured that the construction of the time series subgraph revolves only around the core events directly related to the risk of the target order.

[0054] In one embodiment, coupling the dynamic temporal adjacency matrix with the market price spread index to generate an environment-aware embedding vector includes:

[0055] Identify the target hotel corresponding to the target order and obtain competitor price data for the business district where the target hotel is located;

[0056] Calculate the deviation between the real-time price of the target hotel and the price data of the competitors, and generate a standardized market price difference index;

[0057] The dynamic temporal adjacency matrix is ​​normalized row by row to obtain the outgoing edge weight matrix representing the transition probability of each node.

[0058] The market price difference index is used as a global adjustment factor and multiplied element by element with the outbound weight matrix to generate a price difference-aware adjacency matrix.

[0059] The price difference-aware adjacency matrix is ​​input into a two-sided bilinear pooling layer, which integrates temporal topological features and market price fluctuation features to output an environment-aware embedding vector.

[0060] The essence of room-splitting fraud is to profit from price differences. Analyzing only user behavior while ignoring external market arbitrage opportunities fails to detect the heightened fraudulent motivation under high price discrepancies. Therefore, this study analyzes the room identifiers of target orders to identify the target hotel. Based on the hotel's geographical location (latitude and longitude), a 3-kilometer radius business district is defined. The study then uses the platform's internal competitor price caching interface or third-party OTA price API to obtain transaction price data for hotels of the same star rating and room type within the business district over the past 24 hours, creating a competitor price dataset. By accurately locating the target hotel and its competitive environment, a market data foundation is provided for quantifying arbitrage incentives, enabling the model to perceive external price difference risks.

[0061] Because the absolute prices of different hotels vary significantly, the price difference needs to be standardized into a unified dimension to be effectively incorporated into the model. Specifically, the dynamic real-time price currently displayed for the target hotel is obtained, and the difference between this price and the lowest transaction price in the competitor price dataset is calculated. This difference is then divided by the lowest competitor price to obtain the relative deviation, which is normalized to the [0,1] interval to generate a market price difference index. The closer this index value is to 1, the more significantly the target hotel price is higher than the competitors, and the greater the arbitrage opportunity. By transforming the absolute price difference into a standardized arbitrage opportunity index, the model can easily quantify and evaluate the strength of external incentives.

[0062] The time decay weights in the dynamic temporal adjacency matrix are absolute values, which are difficult to use directly to reflect the relative importance of outgoing edges from different nodes. To ensure the stability of subsequent coupled calculations, the weights need to be converted into probability distributions. Specifically, a softmax normalization operation is performed on each row of the dynamic temporal adjacency matrix, making the sum of the elements in each row equal to 1. This transforms the original time decay weights into the probability of jumping from a node to another node, resulting in the outgoing edge weight matrix. By converting absolute weights into transition probabilities, a standardized input structure is provided for global factor adjustment.

[0063] The market spread index is a global risk signal and needs to be deeply integrated with the temporal structure of user behavior to be effective. Therefore, the market spread index is used as a scalar adjustment factor, multiplied element-wise with each element of the outgoing edge weight matrix. This allows the spread index to directly affect the transition probability of all edges. When the spread is large, the probability of abnormal user behavior jumps is proportionally amplified, generating a spread-aware adjacency matrix. This achieves explicit coupling between external market signals and internal behavioral temporal sequences, enabling the model to perceive the dynamic adjustment effect of the spread on the degree of abnormal user behavior.

[0064] Simple feature concatenation is insufficient to capture the interaction between temporal topology and price spread fluctuations, necessitating a more robust fusion mechanism. A bilateral bilinear pooling layer performs bilinear transformations on the row and column vectors of the price spread-aware adjacency matrix through two independent channels, calculating the pairwise interactive responses of temporal connectivity patterns and price spread adjustment patterns across all dimensions. This generates high-dimensional coupled features, which are then compressed into a 1×128-dimensional environment-aware embedding vector through global pooling. This approach uncovers the nonlinear synergistic effect between behavioral temporality and the market environment, and the output embedding vector combines behavioral anomalies with market sensitivity, providing highly discriminative fusion features for subsequent intent recognition.

[0065] Further, the step of inputting the price difference-aware adjacency matrix into a two-sided bilinear pooling layer, fusing temporal topological features and market price fluctuation features, and outputting an environment-aware embedding vector includes:

[0066] Singular value decomposition is performed on the price difference-aware adjacency matrix to obtain a topological feature matrix representing the temporal connection pattern and a weight feature matrix representing the influence of price difference.

[0067] The topological feature matrix and the weight feature matrix are input into two independent channels of a bilateral bilinear pooling layer, and element-wise outer product operations are performed to generate a high-dimensional coupled feature tensor.

[0068] The high-dimensional coupled feature tensor is aggregated along the feature dimension by global max pooling and average pooling to generate a compressed environment-aware embedding vector.

[0069] The price difference-aware adjacency matrix contains two heterogeneous types of information: the temporal structure of user behavior and external price difference adjustment. Simple processing methods are insufficient for separating and extracting targeted features from this information. Therefore, singular value decomposition is performed on the price difference-aware adjacency matrix, decomposing it into U, Σ, and V. T The three components are: the U matrix, which serves as the topological feature matrix, representing the inherent pattern of user subscription-cancellation temporal connections; and Σ and V. T Matrix multiplication yields a weighted feature matrix, representing the differentiated influence of market price spreads on each time series connection. This decouples the time series topology from the price spread signal, providing semantically clear dual-path feature inputs for subsequent explicit fusion.

[0070] Simple feature concatenation or addition cannot fully capture the complex nonlinear interaction between temporal topology and the influence of price spreads; explicit modeling of their paired synergistic effects is necessary. Specifically, the topological feature matrix is ​​input into the left channel of the pooling layer, and the weight feature matrix is ​​input into the right channel. The two channels perform element-wise outer product operations at the same spatial location, i.e., calculating the product of corresponding elements of the two matrices in each feature dimension, generating a high-dimensional coupled feature tensor. This tensor explicitly encodes the interaction response strength between behavioral temporal patterns and market price spreads across all dimensions, enabling the discovery of deep synergistic signals such as abnormally active temporal paths in high-price-spread environments.

[0071] High-dimensional coupled feature tensors have high dimensionality, and directly inputting them into subsequent models incurs significant computational costs and may introduce overfitting risks, necessitating efficient compression. Therefore, this paper performs global max pooling (extracting the strongest interaction signal) and global average pooling (preserving overall distribution information) along the feature dimensions of the high-dimensional coupled feature tensor. The two pooling results are then concatenated and fused to generate a 1×128-dimensional compressed environment-aware embedding vector. This significantly reduces the feature dimensionality while retaining the most significant risk signals and maintaining a global overview of the features, achieving a balance between compression and key information preservation.

[0072] In one embodiment, inputting the static behavioral baseline vector and the environmental awareness embedding vector into a fraud intent recognition model to obtain a fraud probability score for the target order includes:

[0073] The static behavior baseline vector is nonlinearly activated to generate a behavior pattern enhancement vector;

[0074] Adaptive channel attention weighting is applied to the environmental perception embedding vector to generate an environmental risk enhancement vector;

[0075] The behavior pattern enhancement vector and the environmental risk enhancement vector are bilinearly cross-referenced to generate a fused feature vector.

[0076] The fused feature vector is input into a fully connected network to obtain the fraud probability score of the target order.

[0077] The static behavior baseline vector is directly derived from the pooling output of the graph convolutional network. Its feature distribution is relatively linear and may contain redundant dimensions. Directly using it for subsequent fusion would limit the model's ability to express complex behavior patterns. Therefore, the static behavior baseline vector is input into a fully connected layer and a ReLU nonlinear activation function is applied. By introducing a nonlinear transformation, the deep semantic structure of user behavior patterns is mined, low-response features are filtered out, and high-activation dimensions are enhanced, generating more discriminative behavior pattern enhancement vectors. By transforming the original linear behavior representation into a higher-order semantic space, the model can capture complex behavior patterns such as high-frequency, short-cycle cancellation.

[0078] The environment-aware embedding vector contains 128 features, each reflecting the risk contribution under different market price spread scenarios. However, static feature weights cannot adapt to dynamically changing market environments. Therefore, an adaptive channel attention mechanism can be adopted. This involves first performing global average pooling on the environment-aware embedding vector to obtain initial weights for each channel, then generating an attention score vector through a fully connected layer. This score vector is then multiplied element-wise with the original embedding vector to dynamically adjust the importance weights of each feature dimension, generating an environment risk enhancement vector. This allows the model to automatically focus on key risk features based on the current price spread size, improving the sensitivity of environmental trigger perception.

[0079] The behavioral pattern enhancement vector and the environmental risk enhancement vector are input into a bilinear cross layer. By calculating the outer product of the two vectors across all dimensions, a high-dimensional coupled feature containing paired interactive responses is generated. This feature is then compressed into a fused feature vector through a fully connected layer. This vector explicitly encodes joint risk signals such as the aggravation of abnormal user cancellation behavior in a high-price-spread environment, achieving deep semantic fusion of behavior and environment.

[0080] The fused feature vector is input into a two-layer fully connected network. The first layer's dimension is reduced from 128 to 64 and ReLU activation is applied. The second layer outputs a 1-dimensional logit value, which is mapped to the 0-1 range using a Sigmoid activation function to generate a fraud probability score. This score quantifies the likelihood of fraud in a current order under existing behavioral patterns and market conditions, providing a reliable basis for implementing differentiated anti-fraud strategies.

[0081] In one embodiment, executing the corresponding anti-fraud strategy based on the fraud probability score includes:

[0082] If the fraud probability score is in the first interval, verify the identity of the user to whom the target order belongs;

[0083] If the fraud probability score is in the second range, the target order is frozen and sent to the pre-review terminal for manual review.

[0084] When the fraud probability score is at a medium-risk level, directly blocking orders may inadvertently harm legitimate users, while allowing them risks underreporting. Therefore, enhanced verification measures are needed to identify genuine intent. Specifically, the first range can be set to [0.3, 0.7]. When the fraud probability score falls within this range, an SMS verification code process is automatically triggered, sending a 6-digit verification code to the user's registered mobile phone number with a 3-minute validity period. The user is required to enter the correct verification code on the order page to continue. Simultaneously, the user's risk control sensitivity coefficient is temporarily increased by 30% as a monitoring marker for future orders. This low-cost identity verification effectively blocks automated scripts and identity theft, striking a balance between risk control and user experience, and avoiding the loss of legitimate transactions due to excessive conservatism.

[0085] When the fraud probability score reaches a high-risk level, it indicates that the order has significant "room-switching" fraud characteristics, and strong interception measures must be taken to prevent immediate losses. Specifically, the second interval can be set to (0.7, 1.0]. When the fraud probability score falls into this interval, the order status and funds are immediately frozen, the order is locked in a pending review state, and the user is prohibited from actively canceling or modifying it. The payment channel interface is called to pre-authorize the freeze on the credit card for this order, with the frozen amount set to 120% of the order amount to cover potential losses. At the same time, the order information and user behavior snapshot are pushed to the manual review queue of the pre-review terminal, the abnormal characteristics are highlighted, and a 30-minute processing time limit is set. If the risk control specialist confirms fraud after review, the account is permanently banned; if it is a misjudgment, the freeze is lifted and a coupon is provided as compensation. The handling results are fed back to the training set. Through the combination of strong interception and manual review, the platform's financial losses and reputational risks are minimized, and the pre-authorization freeze directly cuts off the core link of room-switching for cash.

[0086] Reference Figure 2 The diagram shown is a functional module schematic of the anti-fraud device 100 based on hotel booking in this application.

[0087] The hotel booking-based anti-fraud device 100 described in this application is installed in an electronic device. Depending on its functions, the hotel booking-based anti-fraud device 100 includes an extraction module 110, a generation module 120, an identification module 130, and an execution module 140. These modules, also referred to as units, are a series of computer program segments that can be executed by the processor of an electronic device and perform a fixed function, stored in the memory of the electronic device.

[0088] In this embodiment, the functions of each module / unit are as follows:

[0089] Extraction module 110: used to construct a booking-cancellation time series subgraph of the user to which the target order belongs within a preset time period, and extract static behavior baseline vectors and dynamic time series adjacency matrices based on the booking-cancellation time series subgraph;

[0090] Generation module 120: used to couple the dynamic temporal adjacency matrix with the market price difference index to generate an environment-aware embedding vector;

[0091] Identification module 130: used to input the static behavior baseline vector and the environmental perception embedding vector into the fraud intent identification model to obtain the fraud probability score of the target order;

[0092] Execution module 140: Used to execute corresponding anti-fraud strategies based on the fraud probability score.

[0093] The specific implementation of the anti-fraud device based on hotel booking in this application is largely the same as the specific implementation of the anti-fraud method based on hotel booking described above, and will not be repeated here.

[0094] Reference Figure 3 The diagram shown is a schematic representation of a preferred embodiment of the electronic device of this application.

[0095] The electronic device includes a processor 111, a communication interface 112, a memory 113, and a communication bus 114, wherein the processor 111, the communication interface 112, and the memory 113 communicate with each other through the communication bus 114.

[0096] Memory 113 is used to store computer programs, such as anti-fraud programs based on hotel bookings;

[0097] In some embodiments, the processor 111 may be a central processing unit (CPU), controller, microcontroller, microprocessor, or other data processing chip. The processor 111 is typically used to control the overall operation of the electronic device, such as performing data interaction or communication-related control and processing. In this embodiment, the processor 111 is used to run program code stored in the memory 113 or process data.

[0098] The communication interface 112 may optionally include a standard wired interface or a wireless interface (such as a Wi-Fi interface). The communication interface 112 may also be used to establish a communication connection between the electronic device and other electronic devices.

[0099] The memory 113 includes at least one type of readable storage medium, including flash memory, hard disk, multimedia card, card-type memory (e.g., SD or DX memory), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, magnetic disk, optical disk, etc. In some embodiments, the memory 113 may be an internal storage unit of the electronic device, such as the hard disk or memory of the electronic device. In other embodiments, the memory 113 may also be an external storage device of the electronic device, such as a plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, etc. of the electronic device. Of course, the memory 113 may include both internal storage units and external storage devices of the electronic device. In this embodiment, the memory 113 is typically used to store the operating system and various computer programs installed on the electronic device, such as program code for an anti-fraud program based on hotel reservations. In addition, the memory 113 may also be used to temporarily store various types of data that have been output or will be output.

[0100] Figure 3 Only an electronic device with components 111-114 is shown; however, it should be understood that it is not required to implement all of the components shown, and more or fewer components may be implemented instead.

[0101] In one embodiment of this application, when the processor 111 executes the program stored in the memory 113, it implements the anti-fraud method based on hotel booking provided in any of the foregoing method embodiments, including:

[0102] Construct a booking-cancellation time-series subgraph for the user to which the target order belongs within a preset time period, and extract static behavior baseline vectors and dynamic time-series adjacency matrices based on the booking-cancellation time-series subgraph;

[0103] The dynamic temporal adjacency matrix is ​​coupled with the market price difference index to generate an environment-aware embedding vector;

[0104] The static behavior baseline vector and the environmental perception embedding vector are input into the fraud intent recognition model to obtain the fraud probability score of the target order;

[0105] Based on the fraud probability score, the corresponding anti-fraud strategy is executed.

[0106] For a detailed explanation of the above steps, please refer to the above. Figure 1 A flowchart illustrating an embodiment of an anti-fraud method based on hotel bookings.

[0107] Furthermore, this application also proposes a computer-readable storage medium that is both non-volatile and volatile. This computer-readable storage medium is any one or any combination of several of the following: hard disk, multimedia card, SD card, flash memory card, SMC, read-only memory (ROM), erasable programmable read-only memory (EPROM), portable compact disc read-only memory (CD-ROM), USB memory, etc. The computer-readable storage medium includes a data storage area and a program storage area. The program storage area stores an anti-fraud program based on hotel bookings. When executed by a processor, the anti-fraud program based on hotel bookings performs the following operations:

[0108] Construct a booking-cancellation time-series subgraph for the user to which the target order belongs within a preset time period, and extract static behavior baseline vectors and dynamic time-series adjacency matrices based on the booking-cancellation time-series subgraph;

[0109] The dynamic temporal adjacency matrix is ​​coupled with the market price difference index to generate an environment-aware embedding vector;

[0110] The static behavior baseline vector and the environmental perception embedding vector are input into the fraud intent recognition model to obtain the fraud probability score of the target order;

[0111] Based on the fraud probability score, the corresponding anti-fraud strategy is executed.

[0112] The specific implementation of the computer-readable storage medium in this application is largely the same as the specific implementation of the anti-fraud method based on hotel booking described above, and will not be repeated here.

[0113] It should be noted that the sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, apparatus, article, or method that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, apparatus, article, or method. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, apparatus, article, or method that includes that element.

[0114] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware simulation platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) as described above, and includes several instructions to cause a terminal device to execute the methods described in the various embodiments of this application.

[0115] The above are merely preferred embodiments of this application and do not limit the patent scope of this application. Any equivalent structural or procedural transformations made using the content of this application's specification and drawings, or direct or indirect applications in other related technical fields, are similarly included within the patent protection scope of this application.

Claims

1. A method for preventing fraud based on hotel bookings, characterized in that, The method includes: Construct a booking-cancellation time-series subgraph for the user to which the target order belongs within a preset time period, and extract static behavior baseline vectors and dynamic time-series adjacency matrices based on the booking-cancellation time-series subgraph; The dynamic temporal adjacency matrix is ​​coupled with the market price difference index to generate an environment-aware embedding vector; The static behavior baseline vector and the environmental perception embedding vector are input into the fraud intent recognition model to obtain the fraud probability score of the target order; Based on the fraud probability score, the corresponding anti-fraud strategy is executed.

2. The anti-fraud method based on hotel booking as described in claim 1, characterized in that, The process of constructing a booking-cancellation time-series subgraph for the user to which the target order belongs within a preset time period, and extracting a static behavior baseline vector and a dynamic time-series adjacency matrix based on the booking-cancellation time-series subgraph, includes: Extract the set of valid events corresponding to the target order from the order database; The time-series subgraph is constructed based on the set of valid events, wherein the nodes of the time-series subgraph represent individual events, and the edges represent the temporal sequence relationship between events and the association relationship with housing resources; Calculate the time decay weight of each edge to generate a dynamic temporal adjacency matrix; The dynamic temporal adjacency matrix and node feature vectors are input into a graph convolutional network to extract a static behavior baseline vector that characterizes the stability of user behavior.

3. The anti-fraud method based on hotel booking as described in claim 2, characterized in that, The step of extracting the set of valid events corresponding to the target order from the order database includes: Extract all booking and cancellation events of the user to which the target order belongs within a preset time period from the order database, and construct an original event sequence containing timestamps, property identifiers, and operation types; The original event sequence is preprocessed to obtain a valid set of events containing the target hotel and its associated rooms.

4. The anti-fraud method based on hotel booking as described in claim 2, characterized in that, The step of coupling the dynamic temporal adjacency matrix with the market price spread index to generate an environment-aware embedding vector includes: Identify the target hotel corresponding to the target order and obtain competitor price data for the business district where the target hotel is located; Calculate the deviation between the real-time price of the target hotel and the price data of the competitors, and generate a standardized market price difference index; The dynamic temporal adjacency matrix is ​​normalized row by row to obtain the outgoing edge weight matrix representing the transition probability of each node. The market price difference index is used as a global adjustment factor and multiplied element by element with the outbound weight matrix to generate a price difference-aware adjacency matrix. The price difference-aware adjacency matrix is ​​input into a two-sided bilinear pooling layer, which integrates temporal topological features and market price fluctuation features to output an environment-aware embedding vector.

5. The anti-fraud method based on hotel booking as described in claim 4, characterized in that, The step involves inputting the price difference-aware adjacency matrix into a two-sided bilinear pooling layer, fusing temporal topological features and market price fluctuation features, and outputting an environment-aware embedding vector, including: Singular value decomposition is performed on the price difference-aware adjacency matrix to obtain a topological feature matrix representing the temporal connection pattern and a weight feature matrix representing the influence of price difference. The topological feature matrix and the weight feature matrix are input into two independent channels of a bilateral bilinear pooling layer, and element-wise outer product operations are performed to generate a high-dimensional coupled feature tensor. The high-dimensional coupled feature tensor is aggregated along the feature dimension by global max pooling and average pooling to generate a compressed environment-aware embedding vector.

6. The anti-fraud method based on hotel booking as described in claim 1, characterized in that, The step of inputting the static behavior baseline vector and the environment-aware embedding vector into the fraud intent recognition model to obtain the fraud probability score of the target order includes: The static behavior baseline vector is nonlinearly activated to generate a behavior pattern enhancement vector; Adaptive channel attention weighting is applied to the environmental perception embedding vector to generate an environmental risk enhancement vector; The behavior pattern enhancement vector and the environmental risk enhancement vector are bilinearly cross-referenced to generate a fused feature vector. The fused feature vector is input into a fully connected network to obtain the fraud probability score of the target order.

7. The anti-fraud method based on hotel booking as described in claim 1, characterized in that, The execution of corresponding anti-fraud strategies based on the fraud probability score includes: If the fraud probability score is in the first interval, verify the identity of the user to whom the target order belongs; If the fraud probability score is in the second range, the target order is frozen and sent to the pre-review terminal for manual review.

8. An anti-fraud device based on hotel bookings, characterized in that, The device includes: Extraction module: used to construct a booking-cancellation time series subgraph of the user to which the target order belongs within a preset time period, and extract static behavior baseline vectors and dynamic time series adjacency matrices based on the booking-cancellation time series subgraph; Generation module: used to couple the dynamic temporal adjacency matrix with the market price difference index to generate an environment-aware embedding vector; Identification module: used to input the static behavior baseline vector and the environmental perception embedding vector into the fraud intent identification model to obtain the fraud probability score of the target order; Execution module: Used to execute corresponding anti-fraud strategies based on the fraud probability score.

9. An electronic device, characterized in that, It includes a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus; Memory, used to store computer programs; A processor, when executing a program stored in memory, implements the anti-fraud method based on hotel booking as described in any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the anti-fraud method based on hotel booking as described in any one of claims 1 to 7.

Images