A user data analysis method based on big data

Abstract

The application discloses a user data analysis method based on big data, comprising: acquiring behavior data and environment data related to user account related business, aligning and unifying all data, and calculating data credibility score; generating user business event sequence based on a preset business event model, associating the user business event sequence with business entities, and forming a user business entity structure; extracting risk control features from the user business event sequence and the user business entity structure, and calculating a user business risk score in combination with the data credibility score; constructing a mapping rule from the risk score to the operation disposal measure, optimizing the risk threshold parameter with the minimum overall operation disposal cost as the target under the condition of meeting the preset operation constraint condition, and outputting the disposal measure for the user.

Description

Technical Field

[0001] This invention relates to the field of abnormal user data analysis technology, and in particular to a user data analysis method based on big data. Background Technology

[0002] As the user base of online games expands and gameplay becomes more complex, abnormal user behavior negatively impacts game fairness, economic system stability, player experience, and operational costs. To mitigate these impacts, existing technologies typically collect user behavior event data and environmental data through client-side and server-side tracking, including but not limited to login and registration information, game and level records, task and reward collection, item / currency production and consumption and transaction flow, payments and refunds, social interactions and feedback, device and environmental information, network quality, client crashes and performance metrics, etc. This data is then aggregated to a central data platform for cleaning, noise reduction, correlation, feature construction, and model analysis, thereby enabling the identification, alerting, and handling of abnormal users.

[0003] Abnormal behaviors are often characterized by adversarial nature and rapid mutation. New versions, new gameplay, or new activities can also introduce new abnormal paths. Existing technologies rely on predefined rule sets, fixed abnormal category labels, or existing feature templates. When new abnormal patterns appear, it is usually necessary to manually summarize, supplement data points, reconstruct features, and retrain and validate the model. This results in a long response cycle and is prone to missed detection windows.

[0004] Furthermore, significant differences exist in the ecosystems, user structures, payment habits, activity rhythms, and network environments across different regions and channels. The same threshold or model may perform inconsistently across different nodes, leading to fluctuations in false positive and false negative rates. This increases the burden of manual review and reduces the reliability and consistency of handling. Additionally, client-side data may be lost, delayed, or tampered with, while server-side logs may be out of order, duplicated, or difficult to correlate across systems. At the same time, abnormal users may evade detection by changing devices, using proxy networks, simulating operational rhythms, or exhibiting dispersed behavior, making identification methods based on single criteria or static features unstable and lacking in repeatability.

[0005] The purpose of this invention is to design a user data analysis method based on big data to address the problems existing in the prior art. Summary of the Invention

[0006] In view of this, the purpose of this invention is to propose a user data analysis method based on big data, which can solve the above-mentioned problems.

[0007] This invention provides a user data analysis method based on big data, comprising:

[0008] S1 acquires behavioral and environmental data related to user accounts, aligns and unifies all data, and calculates data credibility scores.

[0009] S2 generates a user business event sequence based on a preset business event model, and associates the user business event sequence with business entities to form a user business entity structure;

[0010] S3 extracts risk control features from user business event sequences and user business entity structures, and calculates user business risk scores by combining data credibility scores.

[0011] S4 constructs a mapping rule from risk scores to operational response measures. Under the premise of meeting preset operational constraints, it optimizes risk threshold parameters with the goal of minimizing the overall operational response cost and outputs response measures for users.

[0012] The beneficial effects of this invention are:

[0013] First, by collecting behavioral / environmental data from both the client and server sides and using timestamps, game IDs, order IDs, or session IDs for consistency alignment, the data is divided into matching pairs and unmatched sets on both sides. Then, a credibility score is calculated based on the total matching rate and the client / server unmatching rate. This solves the problem of evidence being uncorrelated and data quality being unquantifiable due to loss, delay, duplication, or alignment failure of multi-source data. It provides a measurable basis for data reliability for subsequent risk identification and handling, and reduces the risk of misjudging collected anomalies as real anomalies.

[0014] Secondly, by using a pre-defined business event model, normalized data is deduplicated, corrected, and uniformly sorted, and matching events are merged at the field level to generate a continuous and consistent sequence of user business events. Furthermore, entity IDs are extracted from the events, and entity relationships are constructed according to behavior type and entity role mapping rules to form a user business entity structure. This solves the problems of inconsistent granularity, duplicate conflicts, disordered time order, and difficulty in explicitly expressing relationships such as "user-item-order-trading counterparty" in the original logs, providing structured and computable input for subsequent abnormal pattern recognition and source tracing analysis.

[0015] Third, by constructing evidence fragments from user business event sequences and business entity structures, and performing vectorized semantic retrieval matching with continuously expandable open-vocabulary anomaly patterns, then extracting and fusing features based on the hit terms to obtain the original risk score, and finally introducing data credibility scores to weightedly calibrate the risk score, this solves the problems of slow response to new anomalies and long missed detection windows caused by existing technologies relying on fixed rules / fixed labels. It also solves the problems of difficulty in focusing evidence due to the mixed nature of all events and the mismatch of features of different anomaly types leading to false positives and false negatives. Furthermore, it reduces misjudgments caused by data loss, alignment failures, and other data quality fluctuations, making the risk score more scalable, accurate, and interpretable.

[0016] Fourth, by parameterizing risk handling rules into threshold vectors and constructing segmented action mapping functions, and then constructing an overall objective with user action costs including the costs of false blocking, missed releases, operational costs, and asset risks, a penalty term for the upper limit of blocking / freezing / review capacity is introduced to form a fitness function. A gradient-free population optimization algorithm is used to search for the optimal threshold vector with the minimum cost within the feasible region. Finally, the executable handling action is output to the user using this threshold. This solves the technical problems such as the imbalance of handling ratio caused by fixed thresholds under risk score distribution drift, the difficulty in uniformly measuring multiple objectives (loss prevention and false blocking), the inability to implement strategies under capacity constraints, and the difficulty in stable optimization of non-smooth and non-differentiable objectives. It achieves automated handling strategy optimization that balances executability and minimizes overall cost. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the accompanying drawings required in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 This is a flowchart of the method in this embodiment. Detailed Implementation

[0019] To facilitate understanding by those skilled in the art, the structure of the present invention will now be described in further detail with reference to the accompanying drawings. It should be understood that, unless otherwise specified, the order of the steps mentioned in this embodiment can be adjusted according to actual needs, and they can even be executed simultaneously or partially simultaneously.

[0020] like Figure 1 As shown, this embodiment of the invention provides a user data analysis method based on big data, including:

[0021] S1 acquires behavioral and environmental data related to user accounts, aligns and unifies all data, and calculates data credibility scores.

[0022] S101 acquires client behavior data and environment data. The client behavior data includes one or more of the following: operation sequence, interaction frequency, and key actions in the game process. The client environment data includes one or more of the following: device identifier, system version, network quality indicators, and client abnormal information, to obtain a client behavior set.

[0023] S102 Obtains server-side behavioral data of the game, which includes one or more of the following: login and registration, game and level records, tasks and rewards, item / currency production and consumption, transaction flow, payment and refund, social interaction and feedback, to obtain a set of server-side behaviors;

[0024] S103 performs consistency alignment of the client behavior set and the server behavior set based on the timestamp, game ID, order ID, or session ID, resulting in a set of matching pairs and a set of unmatched pairs.

[0025] S104 calculates a credibility score based on the overall match rate, client-side non-match rate, and server-side non-match rate, using the following formula:

[0026] ,

[0027] ,

[0028] ,

[0029] ,

[0030] in, Indicates the number of matching pairs. This indicates the number of unmatched pairs in the client's set. This indicates the number of unmatched pairs in the server's set. Indicates the overall matching rate. This indicates the client's non-match rate. This indicates the server-side non-match rate. Indicates credibility score. This indicates the corresponding weight.

[0031] In this step, the client side provides more granular operational patterns and environmental states (operation sequence, interaction frequency, key actions, device / system, network quality, client anomalies, etc.), which helps identify script / automation and client-side anomalies. The server side provides factual results such as transaction settlement and resource changes (login / registration, game settlement, production / consumption, transactions, payment / refund, feedback, etc.), and even if the client side is tampered with, it is difficult to change the server-side facts. Common avoidance methods for abnormal users include blocking reporting, changing devices and networks, etc. Even if they pretend to be normal on one end, it is easy to show after the two ends are aligned and matched. However, unmatched data cannot be directly equated with abnormal user data. These mismatched data may be caused by normal reasons (network packet loss / latency, client crash, difference in instrumentation version, asynchronous server-side data storage, clock drift, retry leading to duplication, etc.). Through reliability scoring, the data is transformed into a usable numerical signal for subsequent anomaly judgment.

[0032] S2 generates a user business event sequence based on a preset business event model, and associates the user business event sequence with business entities to form a user business entity structure;

[0033] S201 performs deduplication on data with normalized caliber based on a preset business event model, corrects errors based on alignment results and verification rules, sorts data by unified timestamp and sequence number, and merges matching events at the field level to generate a user business event sequence.

[0034] S202 extracts entity IDs from each unified business event in the user business event sequence to form an entity set, and constructs entity relationship edges according to the preset mapping rules of behavior type and entity role to obtain the user business entity structure.

[0035] In this step, many anomalies cannot be identified by "inconsistencies in a single event," but rather by structural patterns across events and entities. For example, multiple accounts / devices per person require examining the many-to-many relationships between accounts, devices, and IPs (shared devices, shared IP ranges, frequent account switching); transfer chains require examining the transaction / gift / email networks between accounts (star, chain, ring, concentration); refund arbitrage requires examining the causal chain of payment orders, shipments, resource transfers, and refunds (a single mismatch does not reveal the entire chain). Therefore, it is necessary to extract the entities and their relationships in the event flow for subsequent anomaly detection.

[0036] S3 extracts risk control features from user business event sequences and user business entity structures, and calculates user business risk scores by combining data credibility scores.

[0037] S301, based on user business event sequences and entity relationship structures, introduces an open vocabulary anomaly pattern set, constructs evidence fragments and matches open vocabulary with user behavior and association structures within a preset time window, and obtains an open vocabulary hit set.

[0038] In this step, new versions, new gameplay, or new activities may introduce new anomaly paths. Existing technologies rely on predefined rule sets, fixed anomaly category labels, or existing feature templates. When new anomaly patterns emerge, manual summarization, supplementary data entry points, feature reconstruction, and model retraining and validation are usually required, resulting in long response cycles and a high risk of missed detection windows. Open vocabularies allow for the continuous expansion of anomaly patterns using natural language.

[0039] S3011 slices the user business event sequence according to a preset time window to obtain the user window event sequence, and extracts the user subgraph from the entity relationship structure;

[0040] In this step, the user business event sequence generated in step S201 is sliced ​​according to a preset time window to obtain the user window event sequence; and a user subgraph is extracted from the entity relationship structure generated in step S202 to limit the analysis scope and retain cross-entity relationships, thereby solving the technical problem of evidence not being focused and relationships being missing due to the mixing of all events.

[0041] For example, taking user U1 as an example, by selecting the most recent 30-minute time window, the event sequence of the window includes events such as the start of continuous games, the triggering of key actions, and the settlement of levels. At the same time, the user subgraph is extracted from the entity relationship structure, which includes relationship edges such as "user U1 - use → device D9" and "user U1 - transaction → user U7". Thus, the game behavior and transaction / device association are retained at the same time window, providing a data foundation for distinguishing different anomalies such as "script level farming, money laundering chain, and group control multi-account".

[0042] S3012 acquires and incrementally maintains the set of abnormal patterns in open vocabulary, vectorizes the names and descriptions of terms and establishes a retrieval index to obtain the open vocabulary index library;

[0043] In this step, anomaly types and attack strategies continuously evolve, making it difficult for fixed rules or fixed labeling systems to cover new anomalies in a timely manner. Through a maintenance mechanism of "candidate term generation—review and inclusion—vectorization—incremental index update," anomaly patterns can be continuously expanded using natural language and quickly incorporated into semantic retrieval matching without modifying feature engineering code or retraining the model. Term names and descriptions are unstructured text, and direct exact matching is susceptible to the influence of synonyms, resulting in low recall. Vectorization maps semantics to a unified vector space, and indexing enables efficient nearest-neighbor retrieval for large-scale term sets, thereby achieving semantic-level matching and scalable recall.

[0044] For example, the set of open lexical anomaly patterns may include, but is not limited to, the following terms:

[0045] "Script-based level completion / fixed rhythm operation": This describes a behavioral pattern where level completion time is unusually stable, key action time intervals are approximately constant, and operation sequences have high repetition.

[0046] "Money laundering link / fast two-hop transfer": This describes a link pattern where rewards are transferred out with short delays after being credited to the account, spread through two or more hops, and where the counterparty is concentrated and new accounts account for a high proportion.

[0047] "Group control multiple accounts / multiple accounts on the same device": This describes a clustering mode where multiple accounts are logged in using fingerprints on the same device, login switching is frequent, and the network environment is highly consistent.

[0048] By vectorizing and indexing the aforementioned terms and descriptions, semantic matching of evidence fragments can be performed subsequently without relying on manually hard-coded threshold rules.

[0049] S3013 generates a set of candidate evidence fragments based on the user window event sequence and user subgraph, structures and quantifies the evidence fragments, and retrieves them from the open vocabulary index to obtain the open vocabulary hit set.

[0050] In this step, the original event sequences are fine-grained and numerous, making it difficult to locate key anomalies directly using term matching or manual auditing. Generating "referenceable fragments" (e.g., continuous game fragments, transaction link fragments, device aggregation fragments) by combining event sequences and relational structures according to preset templates or aggregation logic significantly improves anomaly localization and subsequent interpretation capabilities. Evidence fragments contain both time-series fields (event type, time, sequence number) and relational fields (nodes and edges), and structuring unifies field representation; vectorization is used for semantic retrieval with open vocabulary indexes, resolving matching difficulties caused by differences in fragment representations.

[0051] For example, for user U1, the following candidate evidence fragments can be generated: the game rhythm fragment matches "script-based level clearing / fixed rhythm operation"; the transaction link fragment (such as short-delayed transfer after reward arrival with two-hop link) matches "money laundering link / fast two-hop transfer"; the device aggregation fragment (multiple accounts on the same device with regular switching) matches "group control multi-account / multiple accounts on the same device". This yields an open term hit set, which can include the hit term identifier, similarity score, and corresponding evidence fragment index.

[0052] S302 routes and extracts user features based on the open vocabulary hit set, calculates feature risk scores and open vocabulary risk scores and fuses them to obtain the user's original risk score, and introduces a credibility score to weight and calibrate the user's original risk score to obtain the user risk score.

[0053] S3021 performs feature routing based on the entity roles and event types of terms in the open vocabulary hit set, extracts user features from the user window event sequence and user subgraph, and calculates the feature risk score based on the user features. The calculation formula is as follows:

[0054] ,

[0055] in, Indicates to the user u The feature set selected based on feature routing express A specific feature item, Representation of features For users u The normalized anomaly intensity; the larger the value, the more abnormal the anomaly. Represents feature weights, used to characterize features. Contribution under abnormal types, Indicates the characteristic risk score;

[0056] In this step, the discriminative information for different anomaly types is distributed across different data subspaces. Using a single, fixed feature set could lead to either underreporting due to insensitivity to the target anomaly or false positives due to oversensitivity to normal behavior. Feature routing, through the mapping of "hit terms → feature set," ensures that feature extraction aligns with the anomaly semantics.

[0057] For example, when identifying "script-based level completion," features such as rhythmic jitter, sequence repetition, and stable execution time are extracted; when identifying "money laundering chains," features such as the proportion of two-hop transactions, short-latency transfers, opponent concentration, and diffusion patterns are extracted; when identifying "multi-account control," features such as the number of accounts on the same device, switching frequency, and fingerprint similarity clustering are extracted. Furthermore, this avoids misjudging high-level, normal players as script users solely based on general features such as "high operation frequency / high click count."

[0058] S3022 calculates the open vocabulary risk score based on the number of matched terms in the open vocabulary set and their corresponding semantic similarity. The calculation formula is as follows:

[0059] ,

[0060] Where u represents the user to be evaluated, and the open hit set of user u is... , Indicates the number of matched terms. This indicates the identifier of the i-th hit open vocabulary entry. ∈[0,1] represents the user evidence fragment vector and the term. The semantic similarity of vectors; a higher value indicates a better match. Indicates the weight of an entry, used to characterize the entry. The intensity or importance of the risk contribution. Indicates the risk score for open vocabulary;

[0061] S3023 combines the feature risk score with the open vocabulary hit set to calculate the open vocabulary risk score, and then merges them to obtain the user's original risk score. The calculation formula is as follows:

[0062] ,

[0063] in, This represents user u's original risk score. ∈[0,1] represents the fusion weight, used to balance the contributions of feature risk scores and open vocabulary risk scores. The larger the value, the more it relies on structured features. The smaller the vocabulary, the more it relies on open vocabulary for hits.

[0064] In this step, open-vocabulary hits provide "semantic category and evidence direction," which is beneficial for covering novel anomalies and weakly supervised scenarios; feature risk scores provide "numerical strength and statistical significance," which is beneficial for suppressing misjudgments caused by semantic similarity alone. The fusion of the two can simultaneously take into account recall and accuracy.

[0065] For example, user U1, who was found to be involved in "script-based level clearing," received a high feature score due to low jitter and high repetition, and also received an open vocabulary score based on similarity. User U2, who was found to be involved in "money laundering," received a high feature score due to the proportion of two-hop transactions and short-latency transfers, and also received an open vocabulary score based on similarity. Device D9, which was found to be involved in "multi-account group control," received a high feature score due to the number of accounts on the same device and the switching frequency, and also received an open vocabulary score based on similarity. After merging these features, the user's original risk score was obtained.

[0066] S3024 calculates the user risk score by weighting and calibrating the reliability score against the user's original risk score.

[0067] In this step, risk control data is usually collected from multiple sources (client, server, gateway, anti-fraud SDK, etc.), and may be lost, delayed, tampered with, or fail to align. If data reliability is not considered, "abnormal statistics caused by missing data collection" may be misjudged as real anomalies, or "abnormal fragments caused by suspicious tampering" may be confused with normal missing data.

[0068] For example, if user U1 hits the "script-based level-clearing" and has a high initial risk score, but the client-server alignment and matching rate is low, resulting in a low consistency and reliability score, then the user's risk score will decrease after calibration. Conversely, if the consistency and reliability score is high, then the user's risk score will remain high after calibration to support strong handling.

[0069] S4 constructs a mapping rule from risk scores to operational response measures. Under the premise of meeting preset operational constraints, it optimizes risk threshold parameters with the goal of minimizing the overall operational response cost and outputs response measures for users.

[0070] S401 parameterizes the risk user handling rules, constructs an action mapping function given a threshold vector, and outputs the handling action for any user according to the following rules:

[0071] ，

[0072] in, Represents the threshold vector. , , These represent the threshold vectors for unblocked, reviewed, and frozen status, respectively. This represents the action mapping function. Indicates the user's risk score;

[0073] In this step, the risk score is derived from multi-source feature fusion and model output, and different business periods (events, version updates, plug-in iterations) can cause score distribution drift. If a fixed threshold or non-parametric rules are directly used, it is easy to cause an imbalance in the proportion of handling actions (such as reviewing excessive volume or overly strict bans), resulting in congestion of operational resources or an increase in false bans. Therefore, this embodiment parameterizes the handling rules into a threshold vector and constructs an action mapping function, so that the handling strategy can be automatically adjusted through subsequent optimization, thereby maintaining the interpretability and controllability of the handling actions.

[0074] For example, user U1's original risk score Located in the interval [0.90, 0.95), when =0.90, =0.95 is mapped as "frozen"; when subsequent optimizations will When the value is increased to 0.91, user U1 may be mapped as "reviewer", thus allowing boundary samples to be manually verified without expanding the freeze queue, thereby reducing mishandling.

[0075] S402 constructs a fitness function to evaluate the merits of the threshold vector, and optimizes the objective by considering the costs of mis-sealing, missed release, disposal and operation costs, and asset risk costs.

[0076] S4021 constructs a user action cost function by considering the costs of accidental sealing, missed release, disposal and operation costs, and asset risk costs.

[0077] In this step, allowing abnormal users to proceed results in the direct loss of virtual assets, trading items, or event rewards; while freezing or banning normal users leads to user churn, compensation claims, appeals, and customer service pressure. Without quantitative modeling of the consequences of different actions, threshold optimization lacks comparable evaluation criteria, leading to uncontrollable strategy adjustments. Therefore, this embodiment defines action costs for users under each action, comprehensively considering residual losses from abnormal actions, execution / review costs, and losses from mishandling, thus enabling comparison of different threshold schemes under a unified cost framework.

[0078] For example, if user U1 is flagged for "script-based level farming," allowing the process to continue farming rewards could lead to significant asset losses; allowing it to undergo review incurs audit costs but reduces the risk of false bans; freezing or banning the user can quickly stop the losses but is more costly for misjudged samples. By setting a user action cost function, optimization can automatically balance the "loss-stopping benefits" and the "misjudgment costs."

[0079] The cost of wrongful bans is used to characterize the losses incurred by normal users who are banned / frozen / reviewed. Without this factor, strategies might be overly aggressive in order to increase interception rates, leading to a surge in appeals and user churn. Therefore, the losses from wrongful bans are statistically analyzed using historical appeal tickets, compensation records, and changes in retention / payment before and after the action. A table of wrongful ban cost constants can be generated based on action type (e.g., wrongful ban-ban, wrongful ban-freeze, and wrongful ban-review each correspond to different average losses).

[0080] In this embodiment, the cost of missed release is used to characterize the losses caused by the insufficient release or handling of abnormal users. If this item is not included, the strategy may relax the threshold to reduce false bans, leading to the continued profit and spread of cheating / freezing. Therefore, by retrospectively analyzing indicators such as virtual currency / item losses, abnormal transaction amounts, and spillover of activity rewards caused by abnormal accounts during the release period through the economic and transaction systems, residual loss estimates corresponding to different actions of "release / review / freeze / ban" are statistically formed.

[0081] Operational costs are used to characterize the resource costs consumed by the action itself. Without this, the policy might push a large number of users into the review process, causing congestion in the review queue. Therefore, the unit cost of review is calculated by accounting for the average time spent on manual review and personnel costs, and the operational processing costs resulting from blocking / freezing are estimated by combining this with the incremental increase in customer service work orders, thus obtaining the operational cost parameters for each action.

[0082] Asset risk cost is used to characterize the risks at the platform economy system and asset security level; if this item is not included, the strategy may underestimate the impact of abnormal accounts on the trading ecosystem and inflation. Therefore, the scale of abnormal profits is estimated based on economic balance sheet monitoring data, and the asset risk loss parameter is formed by combining the ability of each action to block asset transfer (e.g., freezing can improve the recovery / blocking ratio).

[0083] S4022 counts the number of users corresponding to each action based on a given threshold vector, and constructs a constraint penalty term based on the number of users corresponding to each action. The calculation formula is as follows:

[0084] ，

[0085] in, Indicates a constraint or penalty item. Indicates the number of users banned. This indicates the maximum capacity for blocking actions. Indicates the number of users who have been reviewed. This indicates the maximum capacity for review actions. Indicates the number of users frozen. This indicates the maximum capacity for the freeze action. This represents the truncation function;

[0086] In this step, blocking, freezing, and review are all limited by operational capacity and system load capacity. Without constraints on the number of actions, optimization may result in threshold combinations that are theoretically cheaper but operationally unfeasible. For example, the number of users requiring review might far exceed manual review capacity, leading to a large number of users remaining in a pending state for extended periods and creating secondary risks. For instance, if... The excessively low risk level led to a large number of medium-risk users being placed under review, thus... > The penalty will increase and drive optimization upwards. Or adjust and The interval allocation is used to compress the amount of verification to a capacity range.

[0087] S4023 constructs a fitness function by combining constraint penalty terms with the user action cost function, and the calculation formula is as follows:

[0088] ，

[0089] in, Represents the fitness function. >0 indicates a penalty coefficient. Represents the current set of users. Indicates the user sample index. Indicates at the threshold Below, user The assigned actions.

[0090] In this step, considering only the action cost may cause the policy to exceed the capacity constraint, while considering only the capacity may make the policy too conservative and lead to missed releases. If the two cannot be unified into the same objective function, a stable and iterative automatic optimization process cannot be formed.

[0091] For example, when manual review resources are scarce during an event, efficiency can be improved. This approach emphasizes capacity constraints in optimization to avoid excessive throughput during verification; when resources are sufficient and increased interception strength is required, the capacity can be appropriately reduced. To obtain a more aggressive but still executable strategy.

[0092] S403 uses a population optimization algorithm to search for the threshold vector that minimizes the fitness function within the threshold feasible region.

[0093] In this step, because the action mapping function is a piecewise function and the penalty term includes a truncation function, the fitness function often exhibits non-smoothness, non-differentiability, and multiple local optima. If gradient-based methods or simple local searches are used, they are prone to oscillations or getting trapped in local optima due to step-like jumps, and it is difficult to simultaneously satisfy the threshold order constraint. Therefore, this embodiment adopts a gradient-free swarm optimization algorithm—the Grey Wolf Optimization Algorithm—to perform a global search within the feasible region, and after each round of updates, it ensures the validity of the threshold through projection and order constraint, thereby obtaining an executable threshold vector with low overall cost within a finite number of evaluations.

[0094] S4031 initializes the population size, generates several candidate threshold vectors, and performs feasible region projection on each candidate threshold vector;

[0095] S4032 calculates the fitness value for each candidate threshold vector, sorts the candidate threshold vectors according to the fitness value from smallest to largest, selects the three solutions with the best fitness as the best individuals in the population optimization algorithm, and marks their position vectors.

[0096] Guided by the optimal individual, S4033 performs position updates on the remaining candidate individuals, obtaining the updated candidate threshold vector. The updated result is then subjected to feasible region projection processing. The process is iterated until the termination condition is met, and the optimal threshold vector is output.

[0097] S40331 Given the current iteration number and the maximum iteration number, calculate the convergence control parameters;

[0098] For any solution to be updated, S40332 generates random computational quantities and calculates its coefficient vectors A and C;

[0099] S40333 calculates the distance vector between the updated solution and each optimal solution based on the coefficient vectors A and C, calculates the candidate positions guided by each optimal solution respectively, and aggregates the three to obtain the updated position;

[0100] S40334 performs feasible region projection on the updated position vector and applies order constraints to each component of the projected threshold vector to satisfy the preset threshold order relationship, thereby obtaining the candidate optimal threshold vector.

[0101] In this step, the threshold search space is a continuous and constrained space. If the update strategy lacks global guidance, it may lead to low search efficiency or frequent generation of infeasible solutions. Therefore, this embodiment updates the position vectors of the remaining candidate individuals under the guidance of the optimal individual, and performs feasible region projection and order constraint processing after each update, iterating until the termination condition is met, and outputting the optimal threshold vector.

[0102] S404 uses the optimal threshold vector to assign actions to users and outputs the final user risk score.

[0103] In this step, if the optimization results cannot be stably mapped to executable actions and the basis for handling cannot be retained, it will be difficult to use them for online collaborative handling, appeal review, and strategy retrospective. Therefore, this embodiment uses the optimal threshold vector to map actions to each user set, outputs user handling measures, and simultaneously outputs the corresponding risk score and threshold version information for auditing and review.

[0104] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0105] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0106] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0107] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0108] It should be noted that any reference signs placed between parentheses in the claims should not be construed as limiting the claims. The word "comprising" does not exclude the presence of components or steps not listed in the claims. The word "a" or "an" preceding a component does not exclude the presence of a plurality of such components. The invention can be implemented by means of hardware comprising several different components and by means of a suitably programmed computer. In a unit claim enumerating several means, several of these means may be embodied by the same item of hardware. The words first, second, and third, etc., do not indicate any order. These words can be interpreted as names.

[0109] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of the invention.

[0110] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

[0111] In this invention, unless otherwise explicitly specified and limited, the terms "installation," "connection," "linking," and "fixing," etc., should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral part; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; they can refer to the internal communication of two components or the interaction between two components. Those skilled in the art can understand the specific meaning of the above terms in this invention according to the specific circumstances.

[0112] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms should not be construed as necessarily referring to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

Claims

1. A user data analysis method based on big data, characterized in that, include: S1. Obtain behavioral and environmental data related to user accounts, align and unify all data, and calculate data credibility scores. S2. Generate a user business event sequence based on a preset business event model, and associate the user business event sequence with business entities to form a user business entity structure, including: S201. Based on the preset business event model, the data with the normalized caliber is deduplicated, the error is corrected based on the alignment results and verification rules, the data is sorted by unified timestamp and sequence number, and the matching events are merged at the field level to generate a user business event sequence. S202. Extract entity IDs from each unified business event in the user business event sequence to form an entity set. Construct entity relationship edges according to the preset mapping rules of behavior type and entity role to obtain the user business entity structure. S3. Extract risk control features from user business event sequences and user business entity structures, and calculate user business risk scores by combining them with data credibility scores, including: S301. Based on the user business event sequence and entity relationship structure, an open vocabulary anomaly pattern set is introduced to construct evidence fragments and match open vocabulary with the user's behavior and association structure within a preset time window to obtain an open vocabulary hit set. S302. Based on the open vocabulary hit set, the user features are routed and extracted, the feature risk score and the open vocabulary risk score are calculated and fused to obtain the user's original risk score, and the credibility score is introduced to weight and calibrate the user's original risk score to obtain the user risk score. S4. Construct a mapping rule from risk scores to operational response measures. Under the premise of meeting preset operational constraints, optimize the risk threshold parameters with the goal of minimizing the overall operational response cost, and output response measures for users, including: S401. Parameterize the abnormal user handling rules. Given a threshold vector, construct an action mapping function and output the handling action for any user according to the following rules: ， in, Represents the threshold vector. , , These represent the threshold vectors for unblocked, reviewed, and frozen status, respectively. This represents the action mapping function. Indicates the user's risk score; S402. Construct a fitness function to evaluate the merits of the threshold vector, and optimize the objective by considering the costs of mis-sealing, missed release, disposal and operation costs, and asset risk costs. S403. Use a population optimization algorithm to search for the threshold vector that minimizes the fitness function within the threshold feasible region. S404. Use the optimal threshold vector to assign actions to users and output the final user risk score.

2. The user data analysis method based on big data according to claim 1, characterized in that, The process of acquiring behavioral and environmental data related to user accounts, aligning and unifying all data, and calculating data credibility scores includes: S101. Obtain client behavior data and environment data. The client behavior data includes one or more of the following: operation sequence, interaction frequency, and key actions in the game process. The client environment data includes one or more of the following: device identifier, system version, network quality indicators, and client abnormal information. A client behavior set is obtained. S102. Obtain the server-side behavior data of the game, wherein the server-side behavior data includes one or more of the following: login and registration, game and level records, tasks and rewards, item / currency production and consumption, transaction flow, payment and refund, social interaction and feedback, to obtain the server-side behavior set; S103. Align the client behavior set with the server behavior set according to the timestamp, game ID, order ID, or session ID to obtain a set of matching pairs and a set of unmatched pairs. S104. Calculate the credibility score based on the total matching rate, client-side non-match rate, and server-side non-match rate. The calculation formula is as follows: ， ， ， ， in, Indicates the number of matching pairs. This indicates the number of unmatched pairs in the client's set. This indicates the number of unmatched pairs in the server's set. Indicates the overall matching rate. This indicates the client's non-match rate. This indicates the server-side non-match rate. Indicates credibility score. This indicates the corresponding weight.

3. The user data analysis method based on big data according to claim 1, characterized in that, Based on user business event sequences and entity relationship structures, an open-word anomaly pattern set is introduced. Evidence fragments are constructed and open-words are matched against user behavior and association structures within a preset time window to obtain an open-word hit set, including: S3011. Slice the user business event sequence according to a preset time window to obtain the user window event sequence, and extract the user subgraph from the entity relationship structure. S3012. Obtain and incrementally maintain the set of open vocabulary abnormal patterns, vectorize the term names and their descriptions and establish a retrieval index to obtain the open vocabulary index library; S3013. Generate a set of candidate evidence fragments based on the user window event sequence and user subgraph, structure and quantify the evidence fragments, and retrieve them from the open vocabulary index to obtain the open vocabulary hit set.

4. The user data analysis method based on big data according to claim 1, characterized in that, The process involves routing and extracting user features based on the open vocabulary hit set, calculating feature risk scores and open vocabulary risk scores, and fusing them to obtain the user's original risk score. A credibility score is then introduced to weight and calibrate the original user risk score, resulting in a user risk score that includes: S3021. Perform feature routing based on the entity roles and event types of terms in the open vocabulary hit set, extract user features from the user window event sequence and user subgraph, and calculate the feature risk score based on the user features. The calculation formula is as follows: ， in, Indicates to the user u The feature set selected based on feature routing express A specific feature item, Representation of features For users u The normalized anomaly intensity; the larger the value, the more abnormal the anomaly. Represents feature weights, Indicates the characteristic risk score; S3022. Calculate the open vocabulary risk score based on the number of matched terms in the open vocabulary set and their corresponding semantic similarity. The calculation formula is as follows: ， Where u represents the user to be evaluated, and the open hit set of user u is... , Indicates the number of matched terms. This indicates the identifier of the i-th hit open vocabulary entry. ∈[0,1] represents the user evidence fragment vector and the term. The semantic similarity of vectors; a higher value indicates a better match. Indicates the weight of an entry, used to characterize the entry. The intensity or importance of the risk contribution. Indicates the risk score for open vocabulary; S3023. Combine the feature risk score with the open vocabulary hit set to calculate the open vocabulary risk score, and then fuse them to obtain the user's original risk score. The calculation formula is as follows: ， in, This represents user u's original risk score. ∈[0,1] represents the fusion weight, used to balance the contributions of feature risk scores and open vocabulary risk scores. The larger the value, the more it relies on structured features. The smaller the vocabulary, the more it relies on hitting open words; S3024. The user risk score is obtained by weighting and calibrating the reliability score with the user's original risk score.

5. The user data analysis method based on big data according to claim 1, characterized in that, The fitness function constructed to evaluate the quality of the threshold vector includes target optimization based on factors such as the cost of mis-sealing, the cost of missed release, the disposal and operation costs, and the asset risk cost. S4021. Construct a user action cost function by considering the costs of accidental sealing, missed release, disposal and operation costs, and asset risk costs. S4022. Based on a given threshold vector, count the number of users corresponding to each action, and construct a constraint penalty term according to the number of users corresponding to each action. The calculation formula is as follows: ， in, Indicates a constraint or penalty item. Indicates the number of users banned. This indicates the maximum capacity for blocking actions. Indicates the number of users who have been reviewed. This indicates the maximum capacity for review actions. Indicates the number of users frozen. This indicates the maximum capacity for the freeze action. This represents the truncation function; S4023. Construct a fitness function by combining the constraint penalty term with the user action cost function. The calculation formula is as follows: ， in, Represents the fitness function. >0 indicates a penalty coefficient. Represents the current set of users. Indicates the user sample index. Indicates at the threshold Below, user The assigned actions.

6. The user data analysis method based on big data according to claim 1, characterized in that, The threshold vector that minimizes the fitness function within the threshold feasible region using a population optimization algorithm includes: S4031. Initialize the population size, generate several candidate threshold vectors, and perform feasible region projection on each candidate threshold vector. S4032. Calculate the fitness value for each candidate threshold vector, sort the candidate threshold vectors according to the fitness value from smallest to largest, select the three solutions with the best fitness as the best individuals in the population optimization algorithm, and mark their position vectors. S4033. Guided by the optimal individual, perform position updates on the remaining candidate individuals other than the optimal individual to obtain the updated candidate threshold vector, and perform feasible region projection processing on the update result. Iterate until the termination condition is met, and output the optimal threshold vector.

7. The user data analysis method based on big data according to claim 6, characterized in that, Guided by the optimal individual, the position of the remaining candidate individuals is updated to obtain the updated candidate threshold vector. The updated result is then subjected to feasible region projection processing. This process is iterated until the termination condition is met, and the optimal threshold vector is output, including: S40331. Given the current iteration number and the maximum iteration number, calculate the convergence control parameters; S40332. For any solution to be updated, generate random computational quantities and calculate its coefficient vectors A and C; S40333. Calculate the distance vector between the updated solution and each optimal solution based on the coefficient vectors A and C, calculate the candidate positions guided by each optimal solution respectively, and aggregate the three to obtain the updated position. S40334. Perform feasible region projection on the updated position vector and apply order constraints to each component of the projected threshold vector to satisfy the preset threshold order relationship, thereby obtaining the candidate optimal threshold vector.

Images