Risk data control method and system and server

Abstract

The invention provides a risk data control method, a risk data control system and a server, and relates to the field of information security processing.The method comprises the steps that user behavior data are collected in a global mode, multi-dimensional portrait construction and behavior baseline modeling are conducted on the user behavior data, comprehensive understanding and real-time monitoring of user behaviors are achieved, and the behavior monitoring coverage range is widened; besides, according to the method, multi-layer detection logic is constructed through risk scoring and auditing processing, so that the risk control detection accuracy and response speed are greatly improved, and the risk prevention and control capability, the operation efficiency, the user experience and the business value are comprehensively improved; the problems of poor risk prevention and control capability and low business safety level of enterprises and platforms are fundamentally solved.

Description

Technical Field

[0001] This invention relates to the field of information security processing, and in particular to a risk data control method, system, and server. Background Technology

[0002] With the rapid development of the digital economy, the risk control challenges posed by malicious user behavior in many fields, such as e-commerce platforms, enterprise services, and fintech, are becoming increasingly severe. In real-world scenarios, issues such as account security risks (e.g., account theft, credential stuffing attacks), transaction fraud risks (e.g., fake transactions, money laundering, credit card fraud), marketing fraud risks (e.g., malicious coupon abuse, fake reviews, false promotions), and credit default risks (e.g., malicious returns, delayed payments) caused by user behavior occur frequently, resulting in serious losses for platforms and enterprises.

[0003] Existing risk control methods mainly rely on rule engines and manual review, which have obvious limitations. For example, rules require manual maintenance and are difficult to cover complex and ever-changing attack methods; rules are easily figured out by black market operators and can be bypassed in a targeted manner; manual review is costly and difficult to handle massive transactions; and the response is delayed, often only discovering problems after losses have occurred.

[0004] In recent years, with the maturity of AI technologies (machine learning, deep learning, graph neural networks) and the improvement of business digitalization (full-link behavioral data collection and enhanced real-time computing capabilities), intelligent risk control has become an industry standard. However, existing solutions mostly focus on single-point capabilities (such as anomaly detection and risk scoring), lacking an end-to-end risk control system that covers behavioral data collection, profile building, real-time detection, intelligent decision-making, gang identification, and continuous optimization, especially in areas such as adversarial evolution, graph analysis, and human-machine collaboration. Summary of the Invention

[0005] In view of this, the purpose of this invention is to provide a risk data control method, system, and server. This method collects user behavior data across the entire domain, constructs multi-dimensional profiles and models behavioral baselines, thereby achieving a comprehensive understanding and real-time monitoring of user behavior and improving the coverage of behavior monitoring. In addition, this method significantly improves the accuracy and response speed of risk control detection through a multi-layered detection logic constructed by risk scoring and review processing, resulting in a comprehensive improvement in risk prevention and control capabilities, operational efficiency, user experience, and business value. This fundamentally solves the problems of poor risk prevention and control capabilities and low business security levels existing in enterprises and platforms.

[0006] In a first aspect, embodiments of the present invention provide a risk data control method, the method comprising: Based on user interaction events, obtain corresponding user behavior data, and obtain corresponding user profile data and risk behavior baseline data; Risk score results corresponding to behavioral data are determined by baseline data of risky behavior. Obtain the business rule parameters corresponding to the behavioral data, and use the business rule parameters and risk scoring results to determine the risk level corresponding to the behavioral data; After reviewing and processing behavioral data using the review and processing strategies corresponding to risk levels, the review decision results corresponding to the behavioral data are determined through the review result data and review action data corresponding to the behavioral data. The risk behavior control results for users are determined based on user profile data and review decision results.

[0007] Optionally, user behavior data can be obtained based on user interaction events, including: Get the user's corresponding interaction events by using the user's page access events, element click events, form operation events, and scroll / zoom events; Based on the network front-end corresponding to the user, obtain one or more of the above-mentioned identification data, such as device identification data, network identification data, and browser identification data, corresponding to the interaction event, and use the identification data to determine the first collection data corresponding to the network front-end; Based on the user's corresponding server, one or more of the above-mentioned business data are obtained from the operation data, information data, logistics data and payment data corresponding to the interaction event, and the business data is used to determine the second collection data corresponding to the server. The user's corresponding behavior data is determined by the first and second collected data, and the user's corresponding data cleaning strategy, data desensitization strategy and data standardization processing strategy are obtained. After processing the collected behavioral data using data cleaning, data anonymization, and data standardization strategies, the user's corresponding behavioral data is obtained.

[0008] Optionally, obtain user profile data and risk behavior baseline data, including: Obtain the user's corresponding preset offline data warehouse, and obtain one or more of the following offline feature data from the user's corresponding demographic feature data, geographic feature data, consumption feature data, behavioral feature data, credit feature data, and social feature data through the offline data warehouse, and determine the user's corresponding offline profile data through the offline feature data; Obtain one or more offline baseline data, including time baseline, spatial baseline, and device baseline, corresponding to the offline profile data through an offline data warehouse; Use a preset statistical duration to obtain one or more of the above-mentioned real-time feature data from the user's login count data, transaction amount data, and active duration data in the behavioral data, and determine the user's real-time profile data through the real-time feature data. By pre-setting the statistical duration, the demographic characteristics of the user are obtained, and the demographic characteristics are used to determine the real-time baseline data corresponding to the real-time profile data. The user's profile data is determined based on offline profile data and real-time profile data, and the user's risk behavior baseline data is determined based on offline baseline data and real-time baseline data.

[0009] Optionally, before the step of determining the risk score result corresponding to the behavioral data through profile data and baseline risk behavior data, the method further includes: Using profile data, determine one or more frequency parameters among the above, such as registration frequency, operation frequency, login frequency, order frequency, and refund frequency, corresponding to the behavioral data, and determine the rule detection results corresponding to the behavioral data through the frequency parameters; Obtain the data deviation characteristics between the baseline data of risky behavior and the corresponding behavioral data, and determine the statistical detection results corresponding to the behavioral data through the data deviation characteristics; Obtain hidden feature detection results corresponding to behavioral data through a pre-trained machine learning model; Utilize a pre-deployed graph neural network to obtain abnormal relationship detection results corresponding to behavioral data; Based on the results of rule detection, statistical detection, hidden feature detection, and abnormal relationship detection, abnormal result data corresponding to users is determined, and behavioral data is updated using abnormal result data.

[0010] Optionally, the step of determining the risk score result corresponding to the behavioral data through baseline risk behavior data includes: Obtain the account risk baseline data corresponding to the risk behavior baseline data, and determine the corresponding account security risk score by comparing the user's login data, device data, and account data in the behavior data with the account risk baseline data. Obtain the transaction risk baseline data corresponding to the risk behavior baseline data, and determine the user's transaction fraud risk score by comparing the user's transaction amount data, transaction frequency data, product type data, delivery information data, payment behavior data, device environment data, and transaction time sequence data in the behavior data with the transaction risk baseline data; Obtain marketing risk baseline data corresponding to risk behavior baseline data, and determine the user's marketing fraud risk score by comparing the user's corresponding discount amount data, activity participation data, promotion behavior data, and order fraud characteristic data in the behavior data with the marketing risk baseline data. Obtain the credit risk baseline data corresponding to the risk behavior baseline data, and determine the user's credit default risk score by comparing the user's return rate data, return reason data, payment overdue data, and credit history data with the credit risk baseline data in the behavior data. The risk score results corresponding to behavioral data are determined by the account security risk score results, transaction fraud risk score results, marketing fraud risk score results, and credit default risk score results.

[0011] Optionally, the steps of obtaining the business rule parameters corresponding to the behavioral data and determining the risk level corresponding to the behavioral data using the business rule parameters and risk scoring results include: Multiple threshold ranges are determined based on the risk values ​​corresponding to the risk scoring results; The business rule parameters corresponding to the behavior data are determined by using the monitoring rules, verification rules, restriction rules, blocking rules, and banning rules corresponding to the behavior data; Obtain the business processing strategy corresponding to the threshold range through business rule parameters; The risk level corresponding to behavioral data is determined based on business processing strategies.

[0012] Optionally, the step of determining the audit decision result corresponding to the behavioral data based on the audit result data and audit action data after auditing the behavioral data using the audit processing strategy corresponding to the risk level includes: Obtain the risk value corresponding to the risk score result and determine whether the risk value is greater than the preset risk threshold; If yes, the profile data and behavioral data will be reviewed using the review and processing strategy corresponding to the risk level; if no, the behavioral data will be reviewed using the review and processing strategy corresponding to the risk level. Obtain the audit decision results corresponding to the behavioral data, and use the risk assessment results, risk type results, disposal decision results, disposal reason results, and risk amount results contained in the audit decision results to determine the audit result data corresponding to the behavioral data; Use the audit decision results to determine the audit action data corresponding to the audit result data.

[0013] Optionally, the steps for determining the risk behavior control results for users based on profile data and review decision results include: Construct a user relationship graph based on user profile data and review decision results; After associating the relational data of a user’s device tag, IP address, shipping address, payment account and behavioral pattern based on the relational graph, the relational network corresponding to the user is obtained. Use relationship networks to obtain group behavior data corresponding to users, and then use the group behavior data to obtain risk behavior data corresponding to users. Determine the risk behavior control results for users based on risk behavior data.

[0014] Secondly, the present invention provides a risk data control system, the system comprising: The data acquisition module is used to acquire user behavior data based on user interaction events, as well as user profile data and risk behavior baseline data. The risk scoring calculation module is used to determine the risk score results corresponding to the behavioral data based on the risk behavior baseline data. The risk level determination module is used to obtain the business rule parameters corresponding to the behavioral data, and use the business rule parameters and risk scoring results to determine the risk level corresponding to the behavioral data. The review and processing control module is used to review and process behavioral data using the review and processing strategies corresponding to the risk level, and then determine the review decision result corresponding to the behavioral data through the review result data and review action data corresponding to the behavioral data. The control result acquisition module is used to determine the risk behavior control results for users based on profile data and review decision results.

[0015] Thirdly, embodiments of the present invention also provide a server, the server including a processor and a memory, the memory storing computer-executable instructions executable by the processor, the processor executing the computer-executable instructions to implement the steps of the risk data control method provided in the first aspect.

[0016] This invention provides a risk data control method, system, and server. In the process of risk control management of user behavior, the method first acquires user behavior data based on user interaction events, and then acquires user profile data and risk behavior baseline data. Next, it determines the risk score result corresponding to the behavior data using the risk behavior baseline data. Subsequently, it acquires the business rule parameters corresponding to the behavior data, and uses the business rule parameters and risk score result to determine the risk level corresponding to the behavior data. Then, it uses the review processing strategy corresponding to the risk level to review the behavior data, and determines the review decision result corresponding to the behavior data using the review result data and review action data. Finally, it determines the risk behavior control result corresponding to the user based on the profile data and the review decision result. This method collects user behavior data across the entire domain, constructs multi-dimensional profiles, and models behavior baselines, achieving a comprehensive understanding and real-time monitoring of user behavior, thus improving the coverage of behavior monitoring. Furthermore, the multi-layered detection logic constructed through risk scoring and review processing significantly improves the accuracy and response speed of risk control detection, comprehensively enhancing risk prevention capabilities, operational efficiency, user experience, and business value, fundamentally solving the problems of poor risk prevention capabilities and low business security levels existing in enterprises and platforms.

[0017] Other features and advantages of the invention will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the invention. The objects and other advantages of the invention are realized and obtained in accordance with the structures particularly pointed out in the description, claims and drawings.

[0018] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0019] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0020] Figure 1 A flowchart of a risk data control method provided in an embodiment of the present invention; Figure 2 In step S101 of the risk data control method provided in this embodiment of the invention, there is a flowchart of obtaining user behavior data based on user interaction events; Figure 3 In step S101 of a risk data control method provided in an embodiment of the present invention, a flowchart is provided for obtaining user profile data and risk behavior baseline data. Figure 4 This is a flowchart preceding step S102 in a risk data control method provided by an embodiment of the present invention; Figure 5 A flowchart of step S102 in a risk data control method provided in an embodiment of the present invention; Figure 6 A flowchart of step S103 in a risk data control method provided in an embodiment of the present invention; Figure 7 A flowchart of step S104 in a risk data control method provided in an embodiment of the present invention; Figure 8 A flowchart of step S105 in a risk data control method provided in an embodiment of the present invention; Figure 9 A flowchart of another risk data control method provided in an embodiment of the present invention; Figure 10 This is a schematic diagram of the structure of a risk data control system provided in an embodiment of the present invention; Figure 11This is a schematic diagram of the structure of a server provided in an embodiment of the present invention.

[0021] icon: 1010 - Data Acquisition Module; 1020 - Risk Score Calculation Module; 1030 - Risk Level Determination Module; 1040 - Review and Processing Control Module; 1050 - Control Result Acquisition Module; 101 - Processor; 102 - Memory; 103 - Bus; 104 - Communication interface. Detailed Implementation

[0022] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the present invention will be clearly and completely described below in conjunction with the embodiments. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0023] To facilitate understanding of this embodiment, a risk data control method disclosed in this embodiment of the invention will first be introduced, such as... Figure 1 As shown, the method includes: Step S101: Obtain user behavior data based on user interaction events, and obtain user profile data and risk behavior baseline data.

[0024] This step leverages user interaction events across various platform touchpoints (covering all scenarios including registration, login, browsing, transactions, marketing participation, and customer service inquiries) to collect behavioral data across the entire platform through methods such as event tracking SDKs, log collection, and API integration. It also integrates unique identifiers such as device fingerprints (generated using technologies like Canvas and WebGL), network fingerprints, and browser fingerprints. After collection, the data undergoes cleaning (duplicate removal and filtering of invalid data), anonymization (encrypting sensitive fields), and standardization (unifying time formats and geocoding) before being written into the behavioral data lake. Simultaneously, it retrieves multi-dimensional user profile data (including hundreds of tags such as basic attributes, consumption characteristics, credit records, and social characteristics, updated using a hybrid offline + real-time architecture) and risk behavior baseline data built based on users' historical normal behavior (including multi-dimensional baselines such as time, space, transactions, and devices; new users are adapted to the group baseline and gradually transition to personalized baselines), laying a comprehensive data foundation for risk assessment.

[0025] Step S102: Determine the risk score results corresponding to the behavioral data through the baseline data of risky behavior.

[0026] By accurately comparing real-time user behavior data with baseline risk behavior data, and quantifying the magnitude of behavioral deviation through statistical tests (Z-score, Mahalanobis distance), and combining this with machine learning models (such as Isolation Forest, LSTM) to analyze behavioral sequence patterns, a comprehensive risk score (0-100 points) is derived. The scoring process integrates rule features, statistical features, and behavioral sequence features, clearly marking risk-related evidence (such as triggered abnormal rules, key indicators of deviation from the baseline), and providing interpretable analysis (such as feature importance ranking) to intuitively reflect the degree of risk of behavioral deviation from the user's normal behavior.

[0027] Step S103: Obtain the business rule parameters corresponding to the behavioral data, and use the business rule parameters and risk scoring results to determine the risk level corresponding to the behavioral data.

[0028] The platform's preset business rule parameters (including security thresholds, violation judgment standards, and operational restrictions under different scenarios) are retrieved and comprehensively analyzed together with the risk score obtained in step S102 to ultimately determine the risk level (such as low risk, medium risk, high risk, or severe risk) corresponding to the user behavior data.

[0029] Step S104: After processing the behavioral data using the audit processing strategy corresponding to the risk level, determine the audit decision result corresponding to the behavioral data through the audit result data and audit action data corresponding to the behavioral data.

[0030] Based on the risk level, the corresponding review and processing strategy is matched (automatic release for low risk, enhanced verification for medium risk, manual review for high risk, and direct blocking for severe risk, etc.), and corresponding review operations are performed on the behavioral data. Then, the final review decision result is formed by combining the result data generated during the review process (such as verification pass / fail, manual judgment conclusion, etc.) and the review action data (such as operation records such as secondary authentication, account freezing, etc.).

[0031] Step S105: Determine the risk behavior control results for users based on profile data and review decision results.

[0032] By combining multi-dimensional user profile data (such as user value, membership level, credit history, etc.) with the review decision results, differentiated risk behavior control measures are formulated and implemented, and the control results are ultimately determined (such as normal release, restriction of some operation permissions, freezing of accounts, banning of accounts, etc.), so as to balance the user experience of normal users while accurately preventing and controlling risks.

[0033] Optionally, in step S101, the user's corresponding behavioral data is obtained based on the user's interaction events, such as... Figure 2 As shown, it includes: Step S201: Obtain the user's corresponding interaction events using the user's page access events, element click events, form operation events, and scroll / zoom events.

[0034] Specifically, the event tracking SDK (Web JavaScript SDK, Mobile Native SDK) can non-intrusively capture all user interaction events on the platform, including page access events (including URL, referrer, dwell time, etc.), element click events (such as clicking on buttons, links, and products), form operation events (input, modification, submission, etc.), and scrolling and zooming events. The SDK uses an asynchronous reporting mechanism to send event data to the log server in batches to avoid affecting the user experience.

[0035] Step S202: Based on the network front-end corresponding to the user, obtain one or more of the above-mentioned identification data, such as device identification data, network identification data, and browser identification data, corresponding to the interaction event, and use the identification data to determine the first collection data corresponding to the network front-end.

[0036] Based on the network front-end collection of interactive events, multiple types of identification data are collected, including device identification data (generated through technologies such as Canvas fingerprinting, WebGL fingerprinting, font fingerprinting, and audio fingerprinting, which can still be identified even after clearing cookies), network identification data (IP address, network type, operator, proxy detection results), and browser identification data (User-Agent, language, time zone, plugin list, and screen resolution). One or more of the above identification data are integrated into the first collection data corresponding to the network front-end.

[0037] Step S203: Based on the user's corresponding server, obtain one or more of the above-mentioned business data from the operation data, information data, logistics data, and payment data corresponding to the interaction event, and use the business data to determine the second collection data corresponding to the server.

[0038] Based on the server-side API gateway and microservice event tracking, various business data corresponding to interactive events are captured, including operation data (timestamps, user IDs, execution results, etc. of key operations such as registration, login, order placement, payment, refund, and information modification), information data (state changes and audit trails before and after sensitive operations), and logistics data (delivery address, delivery record), payment data (payment account, transaction history, risk tags), etc., obtained from third-party systems. One or more of the above business data are integrated into the second collection data corresponding to the server.

[0039] Step S204: Determine the user's corresponding behavior data through the first and second collected data, and obtain the user's corresponding data cleaning strategy, data desensitization strategy and data standardization processing strategy.

[0040] The first collected data (front-end identification data) and the second collected data (server-side business data) are aggregated to form user-specific behavior data. At the same time, three core data processing strategies are defined: data cleaning strategy (rules for processing duplicate, invalid, and erroneous data), data desensitization strategy (encryption or hashing schemes for sensitive information), and data standardization strategy (rules such as format unification and coding standards).

[0041] Step S205: After processing the collected behavior data in sequence using data cleaning, data anonymization, and data standardization strategies, the user's corresponding behavior data is obtained.

[0042] The collected behavioral data is processed sequentially according to the established strategy: First, a data cleaning strategy is used to remove duplicate events, filter invalid data such as crawler traffic and test accounts, and correct erroneous data such as abnormal timestamps and missing required fields; then, a data anonymization strategy is used to hash or encrypt sensitive fields such as ID card numbers, mobile phone numbers, and bank card numbers, retaining only necessary risk control features such as mobile phone number location and ID card age range; finally, a data standardization strategy is used to unify the time format (convert to Unix timestamp), geocoding (IP to latitude and longitude, address to administrative division code), and enumeration values ​​(standardize operation type and device type), ultimately obtaining the user's corresponding behavioral data.

[0043] Optionally, in step S101, the user's profile data and risk behavior baseline data are obtained, such as... Figure 3 As shown, it includes: Step S301: Obtain the user's corresponding preset offline data warehouse, and obtain one or more offline feature data from the user's corresponding demographic feature data, geographic feature data, consumption feature data, behavioral feature data, credit feature data and social feature data through the offline data warehouse, and determine the user's corresponding offline profile data through the offline feature data.

[0044] First, a pre-defined offline data warehouse corresponding to each user is acquired. This data warehouse stores all historical user data and is updated daily / weekly (T+1) on a daily basis. One or more offline characteristic data points of the user are extracted from this warehouse, including demographic data (age, gender, education, occupation, income level, inferred from registration information, consumption behavior, and third-party data), geographic data (resident city, activity range, city tier), consumption data (cumulative spending amount, average order value distribution, purchase frequency, category preference vector, price sensitivity, etc.), behavioral data (number of active days, login frequency, browsing depth, repurchase rate, number of social sharing sessions, etc.), credit data (order fulfillment rate, return rate, complaint rate, violation history, credit score), and social data (number of invitees, source of invitees, social influence, circle affiliation). These offline characteristic data points are then integrated and processed to generate offline user profile data covering hundreds of dimensions.

[0045] Step S302: Obtain one or more offline baseline data, including the time baseline, spatial baseline, and device baseline, corresponding to the offline profile data through the offline data warehouse.

[0046] Based on historical behavioral data in the offline data warehouse, one or more offline baseline data corresponding to the offline profile data are extracted, including time baselines (common login times, operation frequency distribution, session duration), spatial baselines (common login locations, activity radius, location switching frequency), and device baselines (common device list, device switching frequency, browser type). These baselines are constructed using statistical models (mean, standard deviation, quantiles) or time series models (moving average, exponential smoothing) to quantify the core statistical characteristics of users' historical "normal behavior".

[0047] Step S303: Use a preset statistical duration to obtain one or more of the above-mentioned real-time feature data from the user's login count data, transaction amount data, and active duration data in the behavioral data, and determine the user's real-time profile data through the real-time feature data.

[0048] Set a preset statistical period (e.g., the last 1 hour, the last 24 hours, the last 7 days), and extract one or more real-time feature data of users from the real-time collected behavioral data, including login frequency data, transaction amount data, active duration data, and can also be extended to short-term behavioral features such as browsing path, add-to-cart frequency, and marketing activity participation records in the recent period; quickly process these real-time feature data through a streaming computing engine to generate real-time profile data reflecting the user's recent behavioral status. This data is updated in real time and associated with offline profile data and stored in feature storage (e.g., Feast, Tecton), supporting millisecond-level query and retrieval.

[0049] Step S304: Obtain the demographic characteristics of the user by setting a preset statistical duration, and use the demographic characteristics to determine the real-time baseline data corresponding to the real-time profile data.

[0050] By extracting users' demographic characteristics (such as age group, occupation type, and membership level) over a preset statistical period and combining this with information such as user registration channels, user groups with similar characteristics are matched. For new users (cold start scenario) or users with insufficient real-time behavioral data, the baseline of the similar group is directly used as the real-time baseline data; as real-time behavioral data of users continues to accumulate, the group baseline is gradually iterated and optimized into personalized real-time baseline data that fits the individual user's behavior pattern.

[0051] Step S305: Determine the user's profile data based on offline profile data and real-time profile data, and determine the user's risk behavior baseline data based on offline baseline data and real-time baseline data.

[0052] By fusing offline and real-time user profile data, a comprehensive user profile is created, encompassing both long-term characteristics and short-term states. This data comprehensively depicts multi-dimensional features such as basic user attributes, consumption habits, behavioral patterns, and credit levels, providing a holistic view of the user for risk assessment. Simultaneously, by integrating offline and real-time baseline data, a dynamically updated risk behavior baseline is formed. This baseline adapts to the natural evolution of user behavior (such as increased average order value due to increased income, or changes in geographical location due to relocation), accurately quantifying the standard of "normal behavior" at the current stage and providing a reliable benchmark for subsequent anomaly detection.

[0053] Optionally, before step S102, which determines the risk score result corresponding to the behavioral data using profile data and baseline risk behavior data, such as... Figure 4 As shown, the method also includes: Step S401: Use the profile data to determine one or more frequency parameters among the registration frequency, operation frequency, login frequency, order frequency, and refund frequency corresponding to the behavior data, and determine the rule detection result corresponding to the behavior data through the frequency parameters.

[0054] Based on behavioral characteristics in user profile data, one or more frequency parameters corresponding to the behavioral data are extracted, including registration frequency, operation frequency (such as element clicks and form submission frequency within a short period of time), login frequency, order frequency, and refund frequency. These frequency parameters can be quickly matched and detected using the CEP (Complex Event Processing) rule engine. The rule base covers preset explicit violation patterns (such as more than N accounts registered from the same IP / device within 1 hour, more than M high-frequency orders within 1 minute, and immediate refund requests after placing an order). If any frequency parameter triggers a violation rule, the rule detection result is "Violation Hit," and the specific rule triggered and its confidence level are recorded; if no rule is triggered, it is "Violation Not Hit."

[0055] Step S402: Obtain the data deviation characteristics corresponding to the baseline data of risky behavior and the behavior data, and determine the statistical detection results corresponding to the behavior data through the data deviation characteristics.

[0056] Retrieve baseline data on risk behavior (including baselines across multiple dimensions such as time, space, transactions, and devices), and calculate the data deviation characteristics between the behavioral data and the corresponding baselines, including the magnitude of deviation and distribution differences. Use statistical testing methods (such as Z-score and chi-square test) or distance measures (such as Mahalanobis distance and KL divergence) to quantify the degree of deviation, for example, transaction amounts exceeding the baseline mean plus three standard deviations, or abnormal drift between login locations and frequently used locations. If the deviation characteristics exceed a preset threshold, the statistical detection result is determined to be statistically abnormal, and the type of baseline deviation and its quantified value are clearly marked; otherwise, it is considered statistically normal.

[0057] Step S403: Obtain the hidden feature detection results corresponding to the behavioral data through a pre-trained machine learning model.

[0058] This approach utilizes pre-trained machine learning models (including unsupervised and supervised models) to perform deep analysis on behavioral data to uncover hidden anomaly patterns. For unsupervised models, anomalies are quickly isolated using Isolation Forest, and the reconstruction error of normal behavior is calculated using an autoencoder to identify hidden anomalies in unlabeled data. For supervised models, an LSTM model is used to learn temporal patterns of behavior, and an XGBoost / LightGBM model is used to train a classifier based on historical fraud samples to predict the fraud probability of a behavior. Adversarial example detection technology is also introduced to identify deliberately disguised advanced fraudulent behaviors. The final output is either "Hidden anomaly present" or "No hidden anomaly present," along with a feature importance ranking and a fraud probability score.

[0059] Step S404: Use a pre-deployed graph neural network to obtain the abnormal relationship detection results corresponding to the behavioral data.

[0060] Based on pre-deployed graph neural networks (such as GCN and GAT), and combined with the associated information such as devices, IPs, and addresses in user profiles, a multi-dimensional relationship graph of members, devices, IPs, and payment accounts is constructed. Graph analysis is used to uncover abnormal relationships corresponding to behavioral data, including abnormal subgraph detection (e.g., closely linked accounts synchronizing high-frequency operations), abnormal edge detection (e.g., normal users being associated with known black market accounts), and community anomaly detection (e.g., highly consistent behavior among community members deviating from normal patterns). If any of the above abnormal relationships are identified, the abnormal relationship detection result indicates a risk of association, and the associated entities, relationship type, and risk level are labeled; if no such anomalies are identified, there is no risk of association.

[0061] Step S405: Based on the rule detection results, statistical detection results, hidden feature detection results, and abnormal relationship detection results, determine the abnormal result data corresponding to the user, and update the behavior data using the abnormal result data.

[0062] By employing weighted voting or a stacking model fusion strategy, the results of rule detection, statistical detection, hidden feature detection, and abnormal relationship detection are comprehensively evaluated to generate abnormal result data corresponding to each user. This data includes a comprehensive abnormal score (0-100 points), anomaly type labels (such as account theft, marketing fraud, group association, etc.), core evidence features of each detection layer, and confidence assessments. Subsequently, the abnormal result data is added as a new feature and synchronously updated to the original behavioral data, providing more comprehensive anomaly dimension support for the risk scoring in the subsequent step S102.

[0063] Optionally, step S102, which determines the risk score result corresponding to the behavioral data through baseline risk behavior data, such as... Figure 5 As shown, it includes: Step S501: Obtain the account risk baseline data corresponding to the risk behavior baseline data, and determine the corresponding account security risk score by comparing the user's login data, device data, and account data in the behavior data with the account risk baseline data.

[0064] Obtain the corresponding account risk baseline data from the risk behavior baseline data, covering benchmark features such as common login locations, device list, login time periods, and account activity cycles. Extract user login data (including login location, login frequency, login time periods, password attempt counts, whether a proxy / VPN is used, etc.), device data (including device fingerprint consistency, whether it is a new device, operating system / browser compatibility, etc.), and account data (including sudden activity after a long period of inactivity, sensitive information modification records, etc.) from the behavioral data. Accurately compare these data with the account risk baseline data, quantify the deviation risk using algorithms such as logistic regression and random forest, and finally output an account security risk score of 0-100, clearly marking high-risk triggers (such as sudden changes in login location, device fingerprint mismatch, etc.).

[0065] Step S502: Obtain the transaction risk baseline data corresponding to the risk behavior baseline data, and determine the user's transaction fraud risk score by comparing the user's transaction amount data, transaction frequency data, product type data, delivery information data, payment behavior data, device environment data, and transaction time sequence data in the behavior data with the transaction risk baseline data.

[0066] The system retrieves transaction risk baseline data from the risk behavior baseline data, including statistical benchmarks such as average daily transaction amount, frequently purchased categories, payment method preferences, and delivery address stability. It extracts user transaction amount data (whether it significantly exceeds historical average order value, whether there are concentrated large transactions), transaction frequency data (frequency of frequent orders within a short period), product type data (whether virtual goods inconsistent with historical preferences are purchased), delivery information data (whether it is a new address, freight forwarding point, or other abnormal address), payment behavior data (whether multiple credit cards are used, whether payment is repeatedly attempted after failure), device environment data (whether it is an emulator, rooted / jailbroken device), and transaction time series data (whether the time from browsing to placing an order is abnormally fast, suspected of being automated script operation). This data is compared with the transaction risk baseline data, and the risk probability is calculated using a deep neural network or GBDT model to generate a transaction fraud risk score. External features such as device risk, IP risk, and blacklist hit status are integrated to improve the accuracy of the score.

[0067] Step S503: Obtain the marketing risk baseline data corresponding to the risk behavior baseline data, and determine the user's marketing fraud risk score by comparing the user's corresponding discount amount data, activity participation data, promotion behavior data, and fraudulent order feature data with the marketing risk baseline data.

[0068] The marketing risk baseline data is extracted from the risk behavior baseline data, covering benchmark values ​​such as the frequency of coupon redemption and usage by normal users, the number of times they participate in activities, and the reasonable scope of promotion and new user acquisition. User discount amount data (whether coupons are redeemed in bulk and used immediately), activity participation data (whether they participate in the same activity repeatedly, or register multiple accounts in bulk), promotion behavior data (acquiring a large number of new users in a short period with similar behavior among the promoted users), and fraudulent order characteristics data (whether there are frequent purchases of the same merchant / product, fake positive reviews after purchase, or coordinated operations by linked accounts) are obtained. This data is compared with the marketing risk baseline data, focusing on analyzing the similarity of behavioral patterns and the profit chain. A specialized model is used to output a marketing fraud risk score, clarifying whether risk characteristics such as "coupon hunters" and fraudulent order manipulation exist.

[0069] Step S504: Obtain the credit risk baseline data corresponding to the risk behavior baseline data, and determine the user's credit default risk score by comparing the user's return rate data, return reason data, payment delay data, and credit history data with the credit risk baseline data in the behavior data.

[0070] Obtain credit risk baseline data from the risk behavior baseline data, including benchmark parameters such as normal return rate range, fulfillment rate standard, and payment cycle. Extract user return rate data (whether it is significantly higher than the platform average), return reason data (whether returns are frequently due to product quality issues), payment delay data (whether there are multiple overdue payment records), and credit history data (whether there are historical default records and external credit scores). Compare this data with the credit risk baseline data, quantify the probability of credit default using a specialized scoring model, and generate a credit default risk score. This score is directly linked to risk control strategies such as user credit limit, payment cycle length, and transaction limit.

[0071] Step S505: Determine the risk score results corresponding to the behavioral data based on the account security risk score results, transaction fraud risk score results, marketing fraud risk score results, and credit default risk score results.

[0072] Specifically, a weighted fusion or model fusion strategy (such as Stacking) can be adopted, combining the business importance weights of the four scenarios—account security, transaction fraud, marketing fraud, and credit default—to comprehensively calculate the specific scores obtained in the first four steps. During the fusion process, the confidence level and strength of risk evidence of each scenario's score are taken into account, ultimately generating a unified risk score result of 0-100. At the same time, the core risk contribution factors of each scenario are marked (such as the proportion of transaction fraud risk and high-risk items in account security), and interpretable analysis (such as feature importance ranking) is provided to provide accurate data support for subsequent risk level determination.

[0073] Optionally, step S103 involves obtaining the business rule parameters corresponding to the behavioral data and determining the risk level corresponding to the behavioral data using the business rule parameters and risk scoring results, such as... Figure 6 As shown, it includes: Step S601: Determine multiple threshold intervals corresponding to the behavioral data based on the risk value corresponding to the risk score results.

[0074] Based on the risk score results, a risk value of 0-100 is quantified, and multiple continuous and non-overlapping threshold ranges are preset, clearly defining the score boundaries of each range. Combined with the risk control strategy in the disclosure document, the specific ranges are: 0-30 points (low risk), 30-50 points (low-to-medium risk), 50-70 points (medium risk), 70-85 points (medium-to-high risk), 85-95 points (high risk), and 95-100 points (severe risk). The range division balances the accuracy of risk identification with the efficiency of handling, and supports dynamic adjustment of boundary parameters according to business scenarios.

[0075] Step S602: Determine the business rule parameters corresponding to the behavior data using the monitoring rules, verification rules, restriction rules, interception rules, and blocking rules corresponding to the behavior data.

[0076] From the platform's risk control rule system, we extract all business rule parameters corresponding to behavioral data, covering five core rule types: Monitoring rule parameters include the triggering conditions for silent monitoring (such as data collection frequency and feature monitoring dimensions), risk escalation warning thresholds, etc. Verification rule parameters cover the triggering scenarios for enhanced verification, the logic for selecting verification methods (such as the adaptation conditions for SMS verification codes, face recognition, and slider verification), and the limit on the number of retries for verification failures. The restriction rules parameters include the upper limit of a single transaction amount, the threshold for the number of transactions per day, restrictions on participation in marketing activities, and constraints on withdrawal and transfer amounts; The interception rule parameters involve the triggering conditions for order interception and account freezing (such as risk score thresholds and abnormal behavior combination judgment criteria), and the scope of freezing (account balance / order operations), etc. The blocking rules parameters include the criteria for permanent bans (such as being hit by a blacklist, multiple accumulated violations, or association with gang members) and rules for blocking related information (linking bans based on device fingerprints, phone numbers, and ID cards). All rule parameters support parameterized configuration and hot updates, and can be adjusted without restarting the service.

[0077] Step S603: Obtain the business processing strategy corresponding to the threshold range through business rule parameters.

[0078] Associate each threshold range with its corresponding business rule parameters to define the specific business processing strategy for each range: Low-risk range (0-30 points): Match the "normal release" strategy, and set the business rule parameters to "do not trigger additional verification / restriction, only record behavior logs"; Medium-low risk range (30-50 points): Match the "silent monitoring" strategy, and set the rule parameters to "increase the frequency and dimensions of data collection, continuously track subsequent behaviors, and trigger upgraded handling when the risk increases"; Medium-risk range (50-70 points): Match the "enhanced verification" strategy, with rule parameters specifying dynamic verification methods (such as selecting SMS verification code or facial recognition based on the user's credit history) and verification timeout handling mechanisms; Medium-to-high risk range (70-85 points): Match the "restricted operation + manual review" strategy, with clear rules and parameters specifying the scope of restrictions (such as transaction limits, prohibition of participation in marketing activities) and the priority allocation standards for manual review (such as prioritizing the handling of amounts ≥ X yuan). High-risk range (85-95 points): Match the "automatic interception + freezing" strategy, and set the interception operation type (such as payment rejection, order cancellation), freezing range (account balance / transaction permissions), and alarm triggering mechanism (real-time notification to the risk control team) in the rule parameters. Severe risk zone (95-100 points): Match the "permanent ban + transfer for disposal" strategy. The rule parameters clearly define the ban scope (account login / registration permissions), the rules for blacklisting related information, and the triggering conditions for legal transfer (such as the amount involved ≥ Y yuan).

[0079] Step S604: Determine the risk level corresponding to the behavioral data based on the business processing strategy.

[0080] By combining the threshold range of the risk score results with the corresponding business processing strategies, the risk level of the behavioral data is ultimately determined. During the determination process, a business loss function is introduced to balance risk and cost: strictly adhering to the constraints of business rule parameters (e.g., false positive rate ≤ 2%) while also considering differences in user value (e.g., appropriately increasing risk tolerance for VIP members and highly loyal users to avoid false positives). The final output is a clear risk level (low / low-medium / medium / medium-high / high / severe), providing a direct basis for subsequent tiered handling. Simultaneously, key rule parameters and scoring criteria for level determination are recorded to support decision-making retrospective.

[0081] Optionally, step S104, after processing the behavioral data using the audit processing strategy corresponding to the risk level, determines the audit decision result corresponding to the behavioral data based on the audit result data and audit action data corresponding to the behavioral data, such as... Figure 7 As shown, it includes: Step S701: Obtain the risk value corresponding to the risk score result and determine whether the risk value is greater than the preset risk threshold.

[0082] Obtain the quantitative risk value of 0-100 points corresponding to the risk score result, retrieve the platform's preset risk threshold (this threshold is directly related to the risk level classification, i.e., 30 points, 50 points, 70 points, 85 points, and 95 points, which correspond to the boundaries of low / low-medium / medium / high-medium / high / severe risk, respectively), and determine whether the current risk value is greater than the target preset risk threshold, thereby distinguishing the scope and depth of the review.

[0083] Step S702: If yes, then review the profile data and behavioral data using the review and processing strategy corresponding to the risk level; if no, then review the behavioral data using the review and processing strategy corresponding to the risk level.

[0084] If the risk value exceeds the preset risk threshold (corresponding to medium-high risk level or above, 70 points or above): the "restricted operation + manual review" or "interception and freezing + in-depth investigation" strategy corresponding to the risk level will be adopted. During the review, the user's complete profile data (including basic attributes, consumption characteristics, credit history, membership level, historical penalty records, etc.) and full behavioral data (including behavioral trajectory, operation sequence, related entity information, etc.) will be retrieved simultaneously. Combined with external data (public security anti-fraud database, blacklist database, device risk score, etc.) and visualization tools (time axis, relationship graph, behavior heatmap) to assist in in-depth analysis. Cases will be matched with professional risk control specialists through intelligent allocation algorithm, and urgent cases will be given priority and real-time reminders will be provided.

[0085] If the risk value is not greater than the preset risk threshold (corresponding to low, medium-low, and medium risk levels, below 70 points): the corresponding review and processing strategy is adopted to simplify the review process, and only the behavioral data is reviewed; for low risk (0-30 points), the behavior log is directly checked without additional verification; for medium-low risk (30-50 points), silent monitoring is started and behavioral data is continuously collected; for medium risk (50-70 points), the focus is on abnormal trigger points in the behavioral data (such as abnormal login device, transaction amount deviating from the baseline, etc.), and the enhanced verification process is triggered.

[0086] Step S703: Obtain the audit decision results corresponding to the behavioral data, and use the risk assessment results, risk type results, disposal decision results, disposal reason results and risk amount results contained in the audit decision results to determine the audit result data corresponding to the behavioral data.

[0087] After the review is completed, the complete review decision results corresponding to the behavioral data are extracted and structured to generate review result data, which specifically includes: Risk assessment results: Clearly label "real risk" or "false alarm"; for real risks, the risk confidence level must be confirmed simultaneously. Risk type results: Subdivided by business scenario (such as account theft, transaction fraud, marketing fraud, credit default, etc.), and the core risk characteristics are noted (such as gang association, device fingerprint mismatch, etc.). The decision to handle the situation will be determined based on the risk level and the review conclusion (e.g., normal release, enhanced verification passed, operation restricted, interception and freezing, account banning, transfer to legal department, etc.). Reasons for and results of the action: Provide a detailed explanation of the basis for the judgment, including the triggered risk control rules / models, the degree of deviation of the behavior from the baseline, and key abnormal evidence characteristics, etc. Risk Amount Results: Statistics on the amount involved, potential losses, or illegal profits (if no relevant amount is available, mark it as 0).

[0088] Step S704: Use the audit decision results to determine the audit action data corresponding to the audit result data.

[0089] Based on the handling decisions in the review decision-making results, corresponding specific review action data is generated to ensure that the handling actions are executable and traceable. If the decision is "allow": the action data is "record behavior log, allow normal business processes to continue"; If the decision to take action is "silent monitoring": the action data is "increase the frequency and dimensions of data collection, continuously track subsequent behaviors, and set risk escalation warning thresholds"; If the decision is "enhanced verification": the action data is "dynamically select verification methods (SMS verification code, facial recognition, slider verification, etc.) and clarify the verification timeout handling mechanism"; If the decision is "restricted operation": the action data will be "specific restrictions on single transaction amount, number of transactions per day, and participation in marketing activities, etc." If the decision is "interception and freezing": the action data is "reject payment / cancel order, freeze account balance, display risk warning information, and simultaneously alert the risk control team"; If the decision is "ban / transfer": the action data is "permanently ban the account, block the registration of new accounts with related information, or transfer to the legal department for processing".

[0090] All audit action data are recorded in detailed logs (including execution time, operation parameters, and execution results), forming a complete audit trail.

[0091] Optionally, step S105, which determines the risk behavior control result corresponding to the user based on the profile data and the review decision results, such as... Figure 8 As shown, it includes: Step S801: Construct a relationship graph corresponding to the user based on the profile data and the review decision results.

[0092] By combining user profile data (including basic attributes, device fingerprints, IP addresses, shipping addresses, payment accounts, credit characteristics, etc.) with review decision results (including risk types, handling conclusions, risk evidence, etc.), a multi-dimensional relationship graph with the user as the core node is constructed. Graph nodes cover entities such as users, devices, IP addresses, shipping addresses, payment accounts, and mobile phone numbers. Node attributes are simultaneously labeled with feature tags from the profile data and risk indicators from the review decision. Edge relationships include account-device (login association), account-IP (access association), account-address (shipping association), account-payment account (binding association), and account-account (promotion / transfer / mutual rating association), clearly defining the types and logic of relationships between entities.

[0093] Step S802: Based on the relationship graph, the relationship data corresponding to the user's device tag, IP address, delivery address, payment account and behavior pattern are associated to obtain the user's relationship network.

[0094] Based on the constructed relationship graph, deep association processing is performed on the relationship data corresponding to user device tags (device fingerprints, frequently used device lists), IP addresses (login IP, network type, proxy detection results), shipping addresses (resident addresses, historical shipping records), payment accounts (linked bank cards / third-party payment accounts), and behavioral patterns (operation sequence, product preferences, marketing participation habits). Edge relationships are assigned values ​​by calculating association strength (e.g., number of times shared devices are used, frequency of logins from the same IP, similarity of behavioral patterns), while entity resolution technology is used to identify multiple accounts controlled by the same entity (accounts registered with the same ID card, logged in from the same device, and exhibiting highly similar behavior). Ultimately, a dense relationship network containing core users, related entities, and multi-level relationships is formed.

[0095] Step S803: Use the relationship network to obtain the group behavior data corresponding to the user, and obtain the risk behavior data corresponding to the user based on the group behavior data.

[0096] Community discovery algorithms (such as the Louvain algorithm and Label Propagation algorithm) can be used to perform cluster analysis on relationship networks to identify abnormal groups closely associated with core users and obtain group behavior data, including characteristics such as temporal synchronization (e.g., collective registration, simultaneous ordering), spatial clustering (e.g., proximity of IP addresses, concentration of delivery addresses), behavioral consistency (e.g., purchasing the same goods, bulk collection of coupons), and resource sharing (e.g., shared devices, transfer of payment accounts). Combined with risk assessments (e.g., real risk / suspected risk) in the review decision-making process, risk behavior data related to fraud and cheating can be filtered from the group behavior data, including group-based collaborative order-brushing, collective coupon exploitation, and account theft industry chain operations, clarifying the type, scope, and impact of risky behaviors.

[0097] Step S804: Determine the risk behavior control results for the user based on the risk behavior data.

[0098] By combining individual user review decisions with group risk behavior data, differentiated risk behavior control outcomes are formulated: If a user is identified as a member of a group with confirmed risks (e.g., matching the characteristics of a fraud group or participating in coordinated cheating), batch actions will be taken, including permanently banning the account, freezing related payment accounts, recovering illegal gains, adding relevant entities (devices, IPs, addresses) to the blacklist, and coordinating with the legal department to handle cases involving large sums of money. If a user is a suspected member of a high-risk group (e.g., associated with a risky account but directly participating without confirmation), implement enhanced monitoring strategies, restrict high-risk operations (e.g., large transactions, participation in marketing activities), increase verification frequency, push for manual review, and continuously track subsequent behavior; If a user does not pose a group risk but has a single individual risk (such as a single account theft or a single transaction fraud), tiered control will be implemented based on the review decision (such as freezing the account, restricting withdrawals, or releasing the user after passing two-factor authentication). At the same time, early warnings are issued for potentially risky accounts associated with the relationship network (such as N-hop neighbor accounts), and prevention and control measures are deployed in advance to prevent the spread of risks, ultimately forming a complete control result that covers individuals and groups and takes into account both risk prevention and user experience.

[0099] The risk data control method in the above embodiments will be described from an end-to-end perspective below, specifically as follows: Figure 9 As shown, this method is an AI-driven end-to-end intelligent risk control closed-loop system, covering the entire chain of "data collection - profile building - multi-layer detection - risk scoring - intelligent decision-making - manual review - feedback optimization". The specific process is as follows: 1. Collection and preprocessing of behavior data across the entire domain.

[0100] Starting with "global behavioral data collection," the system captures user behavior data across all touchpoints (registration / login / browsing / transactions / marketing / customer service interactions) through various methods, including event tracking SDKs (Web-side JavaScript SDK, Mobile-side Native SDK), server-side API gateways / microservice event tracking, and integration with third-party systems (logistics / payment / customer service). It also collects unique identifiers such as device fingerprints (generated using Canvas / WebGL, etc.), network fingerprints (IP / carrier / proxy detection), and browser fingerprints (User-Agent / plugin list, etc.). The collected data then undergoes "data cleaning and standardization": deduplication (filtering duplicate events), invalid data filtering (excluding crawlers / test accounts), and error correction (fixing abnormal timestamps / missing fields); hashing / encrypting sensitive fields such as ID cards / phone numbers; and standardizing processes such as unifying time formats (converting to Unix timestamps) and geocoding (IP to latitude and longitude). Finally, the data is synchronized to both the real-time data stream and the offline data warehouse.

[0101] 2. Multidimensional profiling and behavioral baseline construction.

[0102] Based on the historical full data of the "offline data warehouse," offline profile data is generated (including hundreds of dimensions of labels such as demographic characteristics, geographical characteristics, consumption characteristics, and credit characteristics, updated on a T+1 cycle). Combined with streaming behavioral data from "real-time data reading," real-time profile data is updated (such as the number of logins in the past hour and the transaction amount in the past 24 hours). The two are merged into a complete multi-dimensional user profile. At the same time, through the "profile building" stage, behavioral baseline data is established for each user, including time baseline (frequent login times), spatial baseline (frequent locations), transaction baseline (average daily order amount), and device baseline (list of frequently used devices). New users are first matched with the "group baseline," and then transitioned to a personalized baseline after behavioral data is accumulated.

[0103] 3. Multi-source feature multi-layer detection.

[0104] In the "multi-source feature detection" stage, the streaming computing engine performs millisecond-level monitoring of real-time behavioral data and simultaneously initiates three-layer detection: Rule-based detection: Use the CEP complex event engine to match explicit violation patterns (e.g., more than N accounts registered on the same device within 1 hour). Statistical layer detection: Calculate the deviation of behavioral data from the "behavioral baseline" (e.g., Z-score / Mahavior distance); Multi-model full detection: Calls models such as Isolation Forest / LSTM / Graph Neural Network to identify hidden anomalies and associated risks.

[0105] The three types of test results are integrated into a comprehensive abnormal feature through "source fusion" to provide a basis for risk scoring.

[0106] Specifically, anomaly detection can be implemented using a behavior sequence anomaly detection architecture based on Transformer-Encoder, as follows: Behavior sequence identification: User behavior sequences are modeled as token sequences. Each behavior token contains {behavior type (login / browse / add to cart / place order, etc., 128-dimensional embedding), timestamp (relative time encoding, 64-dimensional), and contextual features (device / geographic location / amount, etc., 128-dimensional)}, which are concatenated into a 320-dimensional vector.

[0107] Location coding and time awareness: Learnable time-location coding is used to capture the time interval pattern of behavior (e.g., normal user browsing interval is 5-30 seconds, robot is <1 second).

[0108] Transformer Encoder: Stacks 6 layers of Transformer Encoder (8-head attention, 1024-dimensional FFN hidden layer), and captures long-distance dependencies between behaviors (such as cross-step associations of "browse A → add to cart A → browse B → place order A") through the Self-Attention mechanism.

[0109] Anomaly detection in reconstruction loss: Employing the Masked Language Model approach, 15% of behavior tokens are randomly masked, and the model is trained to predict the masked behaviors. Normal user behavior is highly predictable (small reconstruction error), while abnormal behavior does not conform to the pattern (large reconstruction error). A threshold τ is set (selected through a validation set to ensure a false positive rate <2%); if the reconstruction error > τ, it is considered an anomaly.

[0110] Contrastive learning enhancement: Introducing learning loss L_contrastive and reconstruction loss L_reconstruction, normal behavior sequences of the same user at different time periods are used as positive sample pairs, while different users or abnormal behaviors are used as negative sample pairs, learning discriminative representations. The joint training loss value L_total = L_reconstruction + 0.3 × L_contrastive. Implemented using PyTorch, trained on an 8-GPU V100, with a batch size of 256, a learning rate of 2e-4, and 20 epochs. On the test set, the AUC reaches 0.973, outperforming LSTM-Autoencoder (0.921) and Isolation Forest (0.887).

[0111] 4. Multi-scenario risk scoring.

[0112] Based on the fused anomaly characteristics, the process proceeds to the "multi-scenario risk scoring" stage, where scores are given for each of the four risk scenarios: Account security score: Compare login / device / account data with the account risk baseline to quantify the risk of theft / credential stuffing; Transaction fraud scoring: Analyzes transaction amount / frequency / product / delivery information, etc., to identify fraudulent transactions / cash-out schemes; Marketing fraud scoring: Detects coupon / promotion / promotion behavior and determines malicious coupon exploitation / brushing; Credit default score: Assessing default risk by combining return rate, payment terms, and credit history.

[0113] Finally, the "intelligent decision engine" integrates the scores from four scenarios to output a comprehensive risk value of 0-100.

[0114] 5. Risk level classification decision-making.

[0115] Based on the comprehensive risk value, a "risk level assessment" is conducted, and corresponding differentiated handling strategies are implemented: Severe / High Risk: Triggers "Automatic Interception" (freezes account / order), directly pushed to "Review Workbench"; Medium risk: Triggering enhanced verification (SMS verification / facial recognition / two-factor authentication); Low risk: Directly "release normally".

[0116] 6. Manual review and collaborative investigation.

[0117] Once a high-risk case enters the "Review Workbench," the risk control specialist can access the following: Comprehensive profile feature: View user's basic attributes, spending habits, credit, and other full-dimensional tags; External data query: Connecting to external databases / blacklists / device risk scores; Collaborative investigation tools: Invite teams for consultations, mark clues, and generate case reports.

[0118] After review, the "Review Conclusion" will be determined as follows: If it is a genuine risk, "direct blocking + device blacklisting" will be implemented; if it is a false alarm, the block will be lifted and the device will be "allowed to pass normally".

[0119] 7. Feedback loop and continuous optimization.

[0120] Data such as audit results, user complaints, and business losses enter the "feedback data collection" stage, and samples labeled as "true positive / false positive / true negative / false negative" are stored in the "labeled sample library"; finally, risk control strategies are iterated through "deep continuous optimization" and "model training optimization". Use incremental learning to update the detection model and adapt to new attack methods; Enhance model robustness through adversarial training; By dynamically adjusting rule thresholds and scoring weights, the accuracy of risk control is continuously improved, forming a closed-loop iteration of "risk control".

[0121] As can be seen from the above risk data control method, this method collects user behavior data across the entire domain and constructs multi-dimensional profiles and behavioral baseline models to achieve a comprehensive understanding and real-time monitoring of user behavior, thereby improving the coverage of behavior monitoring. In addition, the method significantly improves the accuracy and response speed of risk control detection through multi-layer detection logic constructed by risk scoring and review processing, and comprehensively enhances risk prevention and control capabilities, operational efficiency, user experience and business value, fundamentally solving the problems of poor risk prevention and control capabilities and low business security levels of enterprises and platforms.

[0122] Corresponding to the above-described risk data control method embodiments, this invention also provides a risk data control system, such as... Figure 10 As shown, the system includes: The data acquisition module 1010 is used to acquire user behavior data based on user interaction events, and to acquire user profile data and risk behavior baseline data. The risk scoring calculation module 1020 is used to determine the risk scoring results corresponding to the behavioral data based on the risk behavior baseline data. The risk level determination module 1030 is used to obtain the business rule parameters corresponding to the behavioral data, and to determine the risk level corresponding to the behavioral data using the business rule parameters and risk scoring results. The audit processing control module 1040 is used to audit and process behavioral data using the audit processing strategy corresponding to the risk level, and then determine the audit decision result corresponding to the behavioral data through the audit result data and audit action data corresponding to the behavioral data. The control result acquisition module 1050 is used to determine the risk behavior control results corresponding to users based on profile data and review decision results.

[0123] As can be seen from the aforementioned risk data control system, this system collects user behavior data across the entire domain and constructs multi-dimensional profiles and behavioral baseline models to achieve a comprehensive understanding and real-time monitoring of user behavior, thereby improving the coverage of behavior monitoring. In addition, the system significantly improves the accuracy and response speed of risk control detection through multi-layered detection logic constructed by risk scoring and review processing, resulting in a comprehensive improvement in risk prevention and control capabilities, operational efficiency, user experience, and business value. This fundamentally solves the problems of poor risk prevention and control capabilities and low business security levels existing in enterprises and platforms.

[0124] The risk data control system provided in this embodiment of the invention has the same implementation principle and technical effects as the aforementioned risk data control method embodiment. For the sake of brevity, any parts not mentioned in the system embodiment can be referred to the corresponding content in the aforementioned risk data control method embodiment.

[0125] This embodiment also provides a server, the structural diagram of which is shown below. Figure 11 As shown, the device includes a processor 101 and a memory 102; wherein the memory 102 is used to store one or more computer instructions, which are executed by the processor to implement the steps of the risk data control method described above.

[0126] Figure 11 The server shown also includes a bus 103 and a communication interface 104. The processor 101, the communication interface 104, and the memory 102 are connected via the bus 103.

[0127] The memory 102 may include high-speed random access memory (RAM) and may also include non-volatile memory, such as at least one disk storage device. The bus 103 may be an ISA bus, PCI bus, or EISA bus, etc. The bus can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 11 The symbol is represented by a single double-headed arrow, but this does not mean that there is only one bus or one type of bus.

[0128] The communication interface 104 is used to connect to at least one user terminal and other network units through a network interface, and to send encapsulated IPv4 packets or IPv4 packets to the user terminal through the network interface.

[0129] Processor 101 may be an integrated circuit chip with signal processing capabilities. In implementation, each step of the above method can be completed by the integrated logic circuitry in the hardware of processor 101 or by instructions in software form. The processor 101 can be a general-purpose processor, including a Central Processing Unit (CPU), a Network Processor (NP), etc.; it can also be a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field-Programmable Gate Array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this disclosure. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this disclosure can be directly manifested as execution by a hardware decoding processor, or execution by a combination of hardware and software modules in the decoding processor. The software module can reside in a mature storage medium in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, or registers. This storage medium is located in memory 102. The processor 101 reads the information in memory 102 and, in conjunction with its hardware, completes the steps of the method described in the foregoing embodiments.

[0130] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0131] In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0132] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a processor-executable, non-volatile, computer-readable storage medium. Based on this understanding, the technical solution of this invention, essentially, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0133] Finally, it should be noted that the above-described embodiments are merely specific implementations of the present invention, used to illustrate the technical solutions of the present invention, and not to limit it. The scope of protection of the present invention is not limited thereto. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments within the technical scope disclosed in the present invention, or make equivalent substitutions for some of the technical features; and these modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A risk data control method, characterized in that, The method includes: Based on the user's interaction events, obtain the user's corresponding behavioral data, and obtain the user's corresponding profile data and risk behavior baseline data; The risk score result corresponding to the risk behavior baseline data is determined by the risk behavior baseline data; Obtain the business rule parameters corresponding to the behavioral data, and use the business rule parameters and the risk scoring result to determine the risk level corresponding to the behavioral data; After reviewing and processing the behavioral data using the review and processing strategy corresponding to the risk level, the review decision result corresponding to the behavioral data is determined by the review result data and review action data corresponding to the behavioral data. The risk behavior control result for the user is determined based on the profile data and the review decision result.

2. The risk data control method according to claim 1, characterized in that, Obtaining user-related behavioral data based on user interaction events includes: The user's corresponding interaction events are obtained using the page access events, element click events, form operation events, and scroll / zoom events. Based on the network front-end corresponding to the user, obtain one or more of the above-mentioned identification data, such as device identification data, network identification data, and browser identification data, corresponding to the interaction event, and use the identification data to determine the first collection data corresponding to the network front-end; Based on the server corresponding to the user, one or more of the above-mentioned business data, such as operation data, information data, logistics data, and payment data, corresponding to the interaction event are obtained, and the second collection data corresponding to the server is determined using the business data; The behavior data corresponding to the user is determined by the first collected data and the second collected data, and the data cleaning strategy, data desensitization strategy and data standardization processing strategy corresponding to the user are obtained. After processing the collected behavior data sequentially using the data cleaning strategy, the data desensitization strategy, and the data standardization strategy, the user's corresponding behavior data is obtained.

3. The risk data control method according to claim 1, characterized in that, Obtain the user's profile data and risk behavior baseline data, including: Obtain a preset offline data warehouse corresponding to the user, and obtain one or more offline feature data from the above-mentioned demographic feature data, geographic feature data, consumption feature data, behavioral feature data, credit feature data and social feature data corresponding to the user through the offline data warehouse, and determine the offline profile data corresponding to the user through the offline feature data; The offline data warehouse is used to obtain one or more offline baseline data, including the time baseline, spatial baseline, and device baseline, corresponding to the offline profile data. Using a preset statistical duration, one or more of the above-mentioned real-time feature data from the user's login count data, transaction amount data, and active duration data in the behavioral data are obtained, and the real-time profile data corresponding to the user is determined through the real-time feature data. The user's demographic characteristics are obtained through the preset statistical duration, and the real-time baseline data corresponding to the real-time profile data is determined using the demographic characteristics. The user's profile data is determined based on the offline profile data and the real-time profile data, and the user's risk behavior baseline data is determined based on the offline baseline data and the real-time baseline data.

4. The risk data control method according to claim 1, characterized in that, Before the step of determining the risk score result corresponding to the behavioral data through the profile data and the risk behavior baseline data, the method further includes: The profile data is used to determine one or more frequency parameters among the registration frequency, operation frequency, login frequency, order frequency, and refund frequency corresponding to the behavior data, and the rule detection result corresponding to the behavior data is determined by the frequency parameters. Obtain the data deviation characteristics between the risk behavior baseline data and the behavior data, and determine the statistical detection results corresponding to the behavior data through the data deviation characteristics; The hidden feature detection results corresponding to the behavioral data are obtained through a pre-trained machine learning model; The abnormal relationship detection results corresponding to the behavioral data are obtained by using a pre-deployed graph neural network; Based on the rule detection results, the statistical detection results, the hidden feature detection results, and the abnormal relationship detection results, the abnormal result data corresponding to the user is determined, and the behavioral data is updated using the abnormal result data.

5. The risk data control method according to claim 1, characterized in that, The steps for determining the risk score result corresponding to the behavioral data based on the baseline risk behavior data include: Obtain the account risk baseline data corresponding to the risk behavior baseline data, and determine the corresponding account security risk score by comparing the login data, device data and account data of the user in the behavior data with the account risk baseline data. Obtain the transaction risk baseline data corresponding to the risk behavior baseline data, and determine the user's transaction fraud risk score by comparing the transaction amount data, transaction frequency data, product type data, delivery information data, payment behavior data, device environment data, and transaction time sequence data corresponding to the user in the behavior data with the transaction risk baseline data; Obtain the marketing risk baseline data corresponding to the risk behavior baseline data, and determine the marketing fraud risk score of the user by comparing the user's discount amount data, activity participation data, promotion behavior data and order-brushing feature data in the behavior data with the marketing risk baseline data. Obtain the credit risk baseline data corresponding to the risk behavior baseline data, and determine the user's credit default risk score by comparing the user's return rate data, return reason data, payment arrears data, and credit history data in the behavior data with the credit risk baseline data. The risk score corresponding to the behavioral data is determined by the account security risk score, the transaction fraud risk score, the marketing fraud risk score, and the credit default risk score.

6. The risk data control method according to claim 1, characterized in that, The steps of obtaining the business rule parameters corresponding to the behavioral data and determining the risk level corresponding to the behavioral data using the business rule parameters and the risk scoring result include: Based on the risk value corresponding to the risk scoring result, determine multiple threshold intervals corresponding to the behavioral data; The business rule parameters corresponding to the behavior data are determined using the monitoring rules, verification rules, restriction rules, blocking rules, and banning rules corresponding to the behavior data; The business processing strategy corresponding to the threshold range is obtained through the business rule parameters; The risk level corresponding to the behavioral data is determined based on the business processing strategy.

7. The risk data control method according to claim 1, characterized in that, The step of reviewing and processing the behavioral data using the review and processing strategy corresponding to the risk level, and then determining the review decision result corresponding to the behavioral data using the review result data and review action data corresponding to the behavioral data, includes: Obtain the risk value corresponding to the risk score result, and determine whether the risk value is greater than a preset risk threshold; If yes, the profile data and the behavioral data are reviewed using the review and processing strategy corresponding to the risk level; if no, the behavioral data is reviewed using the review and processing strategy corresponding to the risk level. Obtain the audit decision results corresponding to the behavioral data, and use the risk assessment results, risk type results, disposal decision results, disposal reason results and risk amount results contained in the audit decision results to determine the audit result data corresponding to the behavioral data; The audit decision results are used to determine the audit action data corresponding to the audit result data.

8. The risk data control method according to claim 1, characterized in that, The steps for determining the risk behavior control result corresponding to the user based on the profile data and the review decision result include: The user's relationship graph is constructed using the profile data and the review decision results. Based on the relationship graph, the relationship network corresponding to the user's device tag, IP address, shipping address, payment account and behavior pattern is obtained by associating the relationship data. The group behavior data corresponding to the user is obtained using the relationship network, and the risk behavior data corresponding to the user is obtained based on the group behavior data. The risk behavior control results for the user are determined based on the risk behavior data.

9. A risk data control system, characterized in that, The system includes: The data acquisition module is used to acquire the user's behavioral data based on the user's interaction events, and to acquire the user's profile data and risk behavior baseline data. The risk scoring calculation module is used to determine the risk score result corresponding to the behavior data based on the risk behavior baseline data. The risk level determination module is used to obtain the business rule parameters corresponding to the behavioral data, and use the business rule parameters and the risk scoring result to determine the risk level corresponding to the behavioral data. The review and processing control module is used to review and process the behavioral data using the review and processing strategy corresponding to the risk level, and then determine the review decision result corresponding to the behavioral data through the review result data and review action data corresponding to the behavioral data. The control result acquisition module is used to determine the risk behavior control result corresponding to the user based on the profile data and the review decision result.

10. A server, characterized in that, The server includes a processor and a memory, the memory storing computer-executable instructions that can be executed by the processor, the processor executing the computer-executable instructions to implement the steps of the risk data control method according to any one of claims 1 to 8.

Images