Method and system for detecting brush-up behavior based on multi-modal data fusion

Abstract

This invention discloses a method and system for detecting fraudulent order behavior based on multimodal data fusion. The system includes a data parsing module, a feature fusion calculation module, an automatic training module, a real-time recognition module, and an evidence chain output module. The data parsing module can receive multi-source heterogeneous raw data from the business platform system in real time through a predefined data channel, and perform standardized parsing and cleaning on the received data to generate a data stream. The feature fusion calculation module calculates numerical features in five dimensions—order density, capacity load, spatiotemporal trajectory, behavioral time series, and cost mileage—in parallel based on a calculation model and the data stream. This invention significantly reduces the false positive and false negative rates by automatically optimizing the judgment thresholds for features such as order density and capacity load, achieving accurate and adaptive recognition of fraudulent order patterns. Simultaneously, it can record the item-by-item verification logic and results from order density to cost mileage, forming an evidence chain.

Description

Technical Field

[0001] This invention relates to the field of economic security technology, specifically to a method and system for detecting fraudulent order behavior based on multimodal data fusion. Background Technology

[0002] In the current rapid development of platform economy models, represented by the sharing economy, many sectors, especially the ride-hailing service industry, face business and security risks caused by fraudulent transactions. Some participants use technical means, such as fabricating order information or simulating non-compliant service routes, to attempt to obtain platform incentives they are not entitled to or artificially boost their credit ratings. Such behavior not only disrupts the normal market operation order but also forms a systematic chain of improper profiteering, thus necessitating the use of a method and system for detecting fraudulent transactions.

[0003] For example, Chinese publication CN 107872767 A discloses a method and system for identifying ride-hailing order-brushing behavior, which can accurately identify whether a ride-hailing vehicle is engaging in order-brushing behavior, thereby helping to eliminate such behavior.

[0004] However, most current methods and systems for detecting fraudulent order practices have the following drawbacks:

[0005] 1. Static rules: Manually preset threshold parameter rules, such as the daily order limit or the service order limit for a single driver, cannot accurately locate all orders, and there is a high probability of missing or falsely excluding orders.

[0006] 2. Judicial Dilemma: The identification results are mostly probability scores, which cannot form a logical and structured chain of evidence that meets the requirements of judicial evidence collection, leading to difficulties in handling the case.

[0007] 3. Limited Feature Dimensions: Key feature data such as order data, equipment information, and cash flow are scattered, and existing detection methods lack effective feature dimensions, making it impossible to effectively identify abnormal orders.

[0008] 4. Inefficiency: Manual review is inefficient and cannot effectively meet the business needs of a large number of orders. Summary of the Invention

[0009] To address this issue, the present invention provides a method and system for detecting fraudulent order behavior based on multimodal data fusion, thereby resolving the problems in the prior art.

[0010] To achieve the above objectives, the present invention provides the following technical solution:

[0011] Firstly, a system for detecting fraudulent order behavior based on multimodal data fusion includes a data parsing module, a feature fusion calculation module, an automatic training module, a real-time recognition module, and an evidence chain output module.

[0012] The data parsing module can receive multi-source heterogeneous raw data from the business platform system in real time through a predefined data channel, and perform standardized parsing and cleaning on the received data to generate a data stream;

[0013] The feature fusion calculation module performs parallel calculations of five dimensions of numerical features: order density features, capacity load features, spatiotemporal trajectory features, behavioral time series features, and cost mileage features based on the calculation model and data flow, and then merges the five numerical features into a unified feature matrix.

[0014] The automatic training module can calculate the feature matrix based on historical data and output the anomaly probability score for each order. and historical threshold parameters Compare the results and output the corresponding final risk labels;

[0015] Anomaly Probability Score The calculation formula is as follows:

[0016]

[0017] in, , as well as These represent the numerical characteristics of five dimensions: normalized order density, capacity load, spatiotemporal trajectory, behavioral timing, and cost mileage, respectively. , , as well as All are feature fusion weights, and b is the model bias term obtained from the preset tuning parameters. This represents the Sigmoid activation function, which maps the result of a linearly weighted sum to the (0,1) interval.

[0018] Furthermore, the multi-source heterogeneous raw data includes order information, GPS trajectory, device fingerprints, and payment transaction data.

[0019] Furthermore, the data parsing module is equipped with parsers corresponding to each subsystem to decouple, extract, standardize, clean, and validate the incoming raw data.

[0020] Furthermore, the specific details of the computational model are as follows:

[0021] 1) Calculate order density characteristics;

[0022] 2) Calculate the capacity load characteristics;

[0023] 3) Calculate the spatiotemporal trajectory characteristics;

[0024] 4) Calculate the temporal characteristics of the behavior;

[0025] 5) After all the features in all dimensions have been calculated, each numerical feature is subjected to min-max normalization to form a feature matrix.

[0026] Furthermore, the order density feature calculation uses a sliding time window to count the number of driver orders, and calculates the deviation between the total number of orders in the current window and the total number of orders in the same historical period. Deviation The calculation formula is as follows:

[0027]

[0028] in, This represents the total number of orders within the current time window. This represents the average order volume for the same period in history. This represents the standard deviation of historical order volume.

[0029] Furthermore, the calculation of the capacity load characteristics is combined with the theoretical shortest total time. The capacity load factor is calculated based on the actual duration from the start of the first order to the end of the last order within the current time period. Capacity load factor The calculation formula is as follows:

[0030] in, This represents the actual duration from the start of the first order to the end of the last order within the current time period.

[0031] Furthermore, the spatiotemporal trajectory feature calculation reads all valid latitude and longitude coordinates in the order in chronological order, and calculates the great circle distance between two adjacent coordinate points sequentially. Based on the actual total distance traveled and the theoretical shortest path distance, the trajectory deviation value is calculated. ;

[0032] Trajectory deviation value The calculation formula is as follows:

[0033]

[0034] in, This represents the driver's actual total driving distance. The theoretical shortest path distance .

[0035] Furthermore, the calculation of the behavioral time-series features requires breaking down the entire order data process into stages to obtain the time consumption duration. Next, in the comparative analysis phase, the actual processing time of each order is compared with the average pickup time of normal orders in the corresponding region and time period, as well as a reasonable time range comprised of preset abnormal threshold parameters, to determine whether the current order is in an abnormal state. The determination formula is as follows:

[0036]

[0037] in, The preset abnormal threshold parameter, The coefficients of the abnormal threshold parameter.

[0038] Furthermore, the automatic training module includes a historical data storage submodule and a real-time training data storage submodule; the historical data storage submodule is used to receive, store and manage various types of data that have undergone complete calculation; the real-time training data storage submodule can persistently store the feature matrix, parameter version, calculation results and timestamps used in the calculation as training data samples in chronological order.

[0039] Secondly, the method for detecting fraudulent order behavior based on multimodal data fusion includes the following steps: S1: Real-time reception of raw data streams from order transactions, location trajectories, payment settlement and account management subsystems;

[0040] S2: Based on parallel computation of data stream, the features of order density, capacity load, spatiotemporal trajectory, behavioral time series, and cost mileage are calculated, and all features are normalized and then concatenated to form a unified feature matrix;

[0041] S3: Calculate the feature matrix, output the anomaly probability score S and compare it with the historical threshold parameter to generate the final risk label;

[0042] S4: Perform chain verification on high-risk orders according to a preset order and five-dimensional numerical feature values, and automatically generate an electronic evidence report that integrates verification logs, risk scores and handling suggestions.

[0043] S5: Execute the corresponding instructions in the graded disposal rule base according to the risk label. At the same time, the real-time training data storage submodule triggers the timed training task, starts the automatic training module to optimize the adjustment parameters and update them to the historical data storage submodule.

[0044] This invention has the following advantages: By introducing dynamically updated adjustment parameters and a five-dimensional feature fusion matrix, it effectively overcomes the lag problem of static rules. The system can automatically optimize the judgment thresholds of features such as order density and capacity load, significantly reducing the false positive and false negative rates, and achieving accurate and adaptive identification of order-brushing patterns.

[0045] Meanwhile, the chain-verification process can automatically generate a structured electronic evidence report based on five-dimensional numerical feature values. This report fully records the verification logic and results item by item, from order density to cost mileage, forming an evidence chain that meets judicial requirements and solving the dilemma of insufficient basis for punishment in the original probability scoring model.

[0046] Other features and advantages of the invention will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the invention. Attached Figure Description

[0047] To more intuitively illustrate the prior art and this application, exemplary drawings are provided below. It should be understood that the specific shapes and structures shown in the drawings should not generally be regarded as limiting conditions for implementing this application; for example, based on the technical concept disclosed in this application and the exemplary drawings, those skilled in the art are able to easily make conventional adjustments or further optimizations to the addition / reduction / classification, specific shapes, positional relationships, connection methods, size ratios, etc. of certain units (components).

[0048] Figure 1 This is a flowchart illustrating the implementation of the multimodal data fusion-based method for detecting fraudulent order behavior according to the present invention. Detailed Implementation

[0049] The following specific embodiments illustrate the implementation of the present invention. Those skilled in the art can easily understand other advantages and effects of the present invention from the content disclosed in this specification. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. It should be understood that these embodiments are merely for further explanation of the present invention and should not be construed as limiting the scope of protection of the present invention. Technical engineers in the field can make some non-essential improvements and adjustments to the present invention based on the above-described content. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0050] Please see Figure 1 The system for detecting fraudulent order behavior based on multimodal data fusion includes: a data parsing module, a feature fusion calculation module, an automatic training module, a real-time recognition module, and an evidence chain output module.

[0051] The data parsing module can receive multi-source heterogeneous raw data from the business platform system in real time through predefined high-throughput data channels (such as message queues or stream processing interfaces), including order information, GPS trajectory, device fingerprints, and payment transaction data; and perform standardized parsing and cleaning processing on the received data to generate a data stream.

[0052] The business platform system includes an order transaction subsystem, a location and trajectory service subsystem, a payment and settlement subsystem, and a user and account management system; the order transaction subsystem is used to generate and record all order information data created between passengers and drivers.

[0053] The location and trajectory service subsystem can collect and report real-time GPS trajectory data such as driver's location, speed, and direction during the service process through APP SDK or vehicle equipment.

[0054] The payment and settlement subsystem is used to process payment transaction data such as order fee payments, platform subsidy distribution, and driver income settlement.

[0055] The User and Account Management Subsystem is used to manage driver entity account information, authentication data, and device fingerprint (such as mobile phone IMEI, device ID) data.

[0056] The data parsing module has internal parsers corresponding to each subsystem. Each parser decouples and extracts fields from the incoming raw data using a pre-defined data contract or schema. The extracted fields are then standardized according to a unified data dictionary, thereby eliminating differences in format and representation between the source data.

[0057] For example, convert all timestamps to the UTC standard format, unify all amounts to a base currency unit, and unify the coordinate system to a specific geographic coordinate system.

[0058] After parsing and standardization, the multi-source heterogeneous raw data enters the cleaning and verification process. First, all data records are verified according to predefined key fields to ensure that they contain valid values. Key fields with missing values ​​(such as order ID, timestamp, and geographic location) are marked. For fields that can be repaired, attempts are made to fill them in by associating data. Records that cannot be repaired are considered invalid.

[0059] Then calculate the speed of movement between consecutive GPS coordinate points. It identifies and removes abnormal trajectory points whose speed exceeds a preset physical limit; it compares business timestamps within the same order to check for inconsistencies such as start time being later than end time or service duration being too short, which violate basic logic. (Movement speed) The calculation formula is as follows:

[0060]

[0061] in, The distance between two consecutive GPS coordinate points. For time difference.

[0062] After the above verification, the data is divided into two categories: valid and invalid. Data records judged to be invalid or containing irreparable errors are transferred to a separate, isolated storage area, and a detailed log containing the record identifier, error type, verification rules, and timestamp is generated for subsequent auditing and data quality analysis. Valid data is marked as cleaned and allowed to enter subsequent data processing, resulting in a data stream. This mechanism ensures the basic quality of data flowing into downstream computing stages while guaranteeing the traceability of all data processing actions.

[0063] The feature fusion calculation module can perform parallel calculations of numerical features across five dimensions—order density, capacity load, spatiotemporal trajectory, behavioral time series, and cost mileage—based on a computational model and data flow. It then fuses these five numerical features into a unified feature matrix, facilitating the transformation of raw data into computable mathematical features and providing an input foundation for model recognition. The specific content of the computational model is as follows:

[0064] 1) Calculate order density characteristics

[0065] A sliding time window (e.g., 1 hour, 3 hours) is used to count the number of orders for drivers. The deviation between the total number of orders within the current window and the total number of orders in the same historical period is calculated. To identify abnormal clustering, deviation This reflects the degree of deviation of the current order volume from historical threshold parameters. If the deviation... A value higher than the historical threshold indicates an abnormally dense distribution of orders within the current window over time, potentially suggesting fraudulent activities such as order manipulation. Deviation The calculation formula is as follows:

[0066]

[0067] in, This represents the total number of orders within the current time window. This represents the average order volume for the same period in history. The standard deviation of historical order volume, and the standard deviation of The calculation formula is as follows:

[0068]

[0069] in, For the first Historical order volume data This represents the number of historical data points.

[0070] 2) Calculate capacity load characteristics

[0071] First, a path planning algorithm is used to determine the theoretical shortest travel time by combining the origin and destination location information of the order. Simultaneously, considering that each order inevitably requires a certain service time on-site, a minimum on-site service time is preset. Adding the theoretical shortest travel time to the minimum on-site service time yields the theoretical shortest time for a single order. ;

[0072] Starting from the actual start time of each order, we attempt to arrange all orders in a compact, non-overlapping sequence on the timeline to determine the theoretical shortest possible time interval. Taking into account potential waiting intervals during actual operation, we then determine the theoretical shortest total time required to complete the current order sequence. Theoretical shortest total time The calculation formula is as follows:

[0073]

[0074] in, This is the waiting interval.

[0075] Combining the theoretical shortest total time The capacity load factor is calculated based on the actual time from the start of the first order to the end of the last order within the current time period. This capacity load factor reflects the relationship between the driver's actual service efficiency and theoretical physical probability. If K > 1, it indicates that the required time exceeds the actual available time, meaning the driver cannot complete these orders within the given time, suggesting abnormal behavior such as fraudulent orders or concurrent order manipulation. Capacity Load Factor The calculation formula is as follows:

[0076] in, This represents the actual duration from the start of the first order to the end of the last order within the current time period.

[0077] The aforementioned path planning algorithms broadly refer to a class of algorithms used to find the optimal path between two points. Their core objective is to find the best travel route from the starting point to the destination under given road network constraints (such as distance, time, and cost). This is used in conjunction with electronic map road network data to calculate the theoretical shortest travel distance or time between the order's origin and destination, providing crucial benchmark values ​​for subsequent calculations of trajectory deviation and capacity load coefficients. In specific implementations, these can also include Dijkstra's algorithm (for finding the single-source shortest path), the A* (A-Star) search algorithm, and time-dependent shortest path algorithms integrating real-time traffic conditions.

[0078] 3) Calculate spatiotemporal trajectory features

[0079] First, all valid latitude and longitude coordinates in the order are read in chronological order, reflecting the location information of the service driver during the journey. Then, the Havesing formula is used to calculate the great circle distance between adjacent coordinate points. The distances are then summed to obtain the driver's actual total distance traveled. Simultaneously, the system submits the origin and destination coordinates of the order to the map service API to obtain the theoretical shortest path distance based on the actual road network. .

[0080] The technology then calculates the trajectory deviation value based on the actual total driving distance and the theoretical shortest path distance. The trajectory deviation value directly reflects the degree of deviation between the service provider's actual driving path and the theoretically reasonable path. If the trajectory deviation value... A value greater than the preset threshold parameter indicates a significant difference between the actual driving path and the theoretical path, potentially indicating abnormalities such as detours. (Track deviation value) The calculation formula is as follows:

[0081]

[0082]

[0083] in, These are the latitude and longitude coordinates of two adjacent points in the order.

[0084] Great circle distance between two adjacent coordinate points The calculation formula is as follows:

[0085] in, For the Earth's radius, and Given the latitude values ​​of two latitude and longitude coordinates, the degrees need to be converted to radians during calculation. The conversion formula is as follows: . The difference in longitude between two coordinate points. This represents the difference in latitude between two coordinate points.

[0086] 4) Calculate behavioral temporal features

[0087] The entire order data process is broken down into stages to determine the time taken. (For example, it can be broken down into pick-up time, driving time and service time).

[0088] The next step is comparative analysis. The actual processing time of each order is compared with the average processing time of normal orders in the corresponding region and time period, and a reasonable time range defined by a preset anomaly threshold parameter, to determine if the current order is in an abnormal state. If the processing time of an order at a certain stage is less than the reasonable time range, it indicates that the progress at that stage is too fast, potentially indicating unreasonable operations or data errors. The judgment formula is as follows:

[0089]

[0090] in, The preset abnormal threshold parameter, The coefficients of the abnormal threshold parameter.

[0091] 5) After all dimensions of features have been calculated, each numerical feature is subjected to min-max normalization to eliminate the influence of dimensions. Then, all normalized numerical features belonging to the same order are concatenated in a fixed order to form a multi-dimensional numerical vector, which is a row in the feature matrix, thus forming the feature matrix.

[0092] For each numerical feature, the minimum (Min) and maximum (Max) of the feature in all samples are determined in real time. Then, the formula is applied to each original value (X) to determine the normalized value: Normalized value = (X - Min) / (Max - Min). This can transform all feature values ​​to the same scale range, eliminate the bias caused by different units and value ranges, and ensure that each feature has comparable and balanced weight contribution in subsequent model calculations.

[0093] The automatic training module can calculate the feature matrix based on historical data and output the anomaly probability score for each order. and historical threshold parameters Compare the results and output the corresponding final risk label; if ≥ If the current order is deemed "suspicious", the final risk label and anomaly probability score will be output. Otherwise, mark it as "normal".

[0094] The preset adjustment parameters include the weight parameters of the machine learning model, the historical threshold parameters of each numerical feature, and the feature fusion weights.

[0095] Anomaly Probability Score The calculation formula is as follows:

[0096]

[0097] in, , as well as These represent the numerical characteristics of five dimensions: normalized order density, capacity load, spatiotemporal trajectory, behavioral timing, and cost mileage, respectively. , , as well as All are feature fusion weights, and b is the model bias term obtained from the preset tuning parameters. This represents the Sigmoid activation function, which maps the result of a linearly weighted sum to the (0,1) interval.

[0098] The automatic training module can also incorporate the entire context of the computation, including the input feature vector F, the preset tuning parameters used, the computation timestamp, and the output anomaly probability score. The data is encapsulated into a structured training data sample. This sample is immediately and persistently stored in the real-time training data storage submodule. This ensures that every decision in the business platform system and its rationale are fully recorded, providing a data source with real-time business feedback labels for subsequent model retraining, thereby driving the entire system to achieve continuous adaptive iteration of detection capabilities.

[0099] When the automatic training module starts a training task, it loads the current historical threshold parameters and their corresponding historical performance error data (such as false positive rate and false negative rate) from the historical data storage submodule. Then, it executes a preset threshold optimization algorithm that iteratively adjusts the threshold parameters with the goal of minimizing overall business loss. After optimization, the system outputs the updated, higher-performing dynamic threshold parameters and writes them back to the historical data storage submodule, replacing the original version, thus completing the closed-loop update of the threshold parameters.

[0100] The aforementioned threshold optimization algorithms refer to a class of computational methods aimed at optimizing the decision boundary of a classification model. They are mainly used to minimize overall risk control losses by adjusting historical threshold parameters so that the model reaches the optimal balance between the false positive rate and the business-acceptable level. In specific implementations, these algorithms can also be the Youden index method based on the ROC curve to determine the optimal operating point, or a grid search method that traverses a specified parameter space.

[0101] The automatic training module includes a historical data storage submodule and a real-time training data storage submodule. The historical data storage submodule is used to receive, store, and manage various types of fully computed data. This submodule operates on a data version basis, with each version's data package containing at least the model weights, feature fusion coefficients, historical threshold parameters, and the anomaly probability score of the current order.

[0102] The real-time training data storage submodule can persistently store the feature matrix, parameter versions, calculation results, and timestamps used in the correct calculation as training data samples in chronological order. Simultaneously, the real-time training data storage submodule is configured with a timed trigger (e.g., set during the daily off-peak business hours in the early morning). When the preset time point is reached or the stored data volume reaches a threshold, this submodule automatically sends a signal to the automatic training module, triggering a new full or incremental model training task, thereby driving the system to perform periodic iterative learning.

[0103] The evidence chain output module can map anomaly probability scores and final risk labels to specific preliminary handling suggestions based on a pre-configured hierarchical handling rule base. Simultaneously, it initiates a sequential chain verification process for high-risk orders to build traceable judgment logic, facilitating the timeliness and consistency of risk handling.

[0104] For example, high-risk orders are automatically blocked and accounts are frozen, while medium- to high-risk orders are marked for mandatory manual review.

[0105] The chain-based verification process generates structured logs sequentially, following a fixed order sequence from order density, capacity load, spatiotemporal trajectory, behavioral timing to cost mileage. It automatically integrates all logs, anomaly probability scores, basic order information, and preliminary handling instructions into a standardized electronic evidence report. This report constitutes a complete chain of evidence. Simultaneously, the corresponding final handling instructions are sent to the business platform system for enforcement, thus completing the entire process from risk identification to closed-loop handling.

[0106] The method for detecting fraudulent order behavior based on multimodal data fusion includes the following steps:

[0107] S1: Receives raw data streams in real-time from order transactions, location tracking, payment settlement, and account management subsystems. Then, using parsers corresponding to each data source, it decouples and extracts fields from the raw data streams according to a pre-defined data contract, and standardizes all fields using a unified dictionary. Next, it performs rigorous data cleaning and validation, including non-empty checks on key fields and verification of physical and logical contradictions, thereby generating a data stream. This provides a clean, multimodal data foundation for subsequent operations, ensuring that all calculations and analyses are based on accurate and complete information, and eliminating the negative impact of source data noise and ambiguity on model performance.

[0108] S2: Based on parallel computation of data streams, it calculates order density features, capacity load features, spatiotemporal trajectory features, behavioral time series features, and cost mileage features, and then normalizes all features and concatenates them to form a unified feature matrix. This transforms raw business data into quantifiable and computable mathematical features, achieving multimodal data fusion.

[0109] S3: Calculates the feature matrix, outputs the anomaly probability score S, compares it with the historical threshold parameter θ, generates the final risk label, and stores the entire calculation process as training data samples in the real-time training data storage submodule for model iteration.

[0110] S4: High-risk orders are chain-verified according to a preset order and five-dimensional numerical characteristic values, and an electronic evidence report integrating verification logs, risk scores, and disposal suggestions is automatically generated. This facilitates the transformation of high-risk orders into a traceable and interpretable chain of judicial evidence to support disposal decisions.

[0111] S5: Based on the risk label, execute the corresponding instructions in the tiered handling rule base. Simultaneously, the real-time training data storage submodule triggers a scheduled training task, starts the automatic training module to optimize adjustment parameters, and updates them to the historical data storage submodule. This facilitates a closed loop from risk identification to business handling and drives continuous adaptive optimization of the overall detection capability through regular training.

[0112] This invention effectively overcomes the lag problem of static rules by introducing dynamically updated adjustment parameters and a five-dimensional feature fusion matrix. The system can automatically optimize the judgment thresholds of features such as order density and capacity load, significantly reducing the false positive and false negative rates, and achieving accurate and adaptive identification of order-brushing patterns.

[0113] Meanwhile, the chain-verification process can automatically generate a structured electronic evidence report based on five-dimensional numerical feature values. This report fully records the verification logic and results item by item, from order density to cost mileage, forming an evidence chain that meets judicial requirements and solving the dilemma of insufficient basis for punishment in the original probability scoring model.

[0114] This invention automates the entire process from multi-source heterogeneous data parsing and feature fusion calculation to real-time identification and processing. Through a closed-loop design of a real-time training data storage submodule and an automatic training module, the system continuously optimizes the model, significantly reducing manual review costs and improving platform risk control efficiency when handling massive orders.

[0115] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A system for detecting fraudulent order behavior based on multimodal data fusion, characterized in that, It includes a data parsing module, a feature fusion calculation module, an automatic training module, a real-time recognition module, and an evidence chain output module; The data parsing module can receive multi-source heterogeneous raw data from the business platform system in real time through a predefined data channel, and perform standardized parsing and cleaning on the received data to generate a data stream; The feature fusion calculation module performs parallel calculations of five dimensions of numerical features: order density features, capacity load features, spatiotemporal trajectory features, behavioral time series features, and cost mileage features based on the calculation model and data flow, and then merges the five numerical features into a unified feature matrix. The automatic training module can calculate the feature matrix based on historical data and output the anomaly probability score for each order. and historical threshold parameters Compare the results and output the corresponding final risk labels; Anomaly Probability Score The calculation formula is as follows: ； in, , as well as These represent the numerical characteristics of five dimensions: normalized order density, capacity load, spatiotemporal trajectory, behavioral timing, and cost mileage, respectively. , , as well as All are feature fusion weights, and b is the model bias term obtained from the preset tuning parameters. This represents the Sigmoid activation function, which maps the result of a linearly weighted sum to the (0,1) interval.

2. The system for detecting fraudulent order behavior based on multimodal data fusion according to claim 1, characterized in that, The multi-source heterogeneous raw data includes order information, GPS trajectory, device fingerprints, and payment transaction data.

3. The system for detecting fraudulent order behavior based on multimodal data fusion according to claim 1, characterized in that, The data parsing module is equipped with parsers corresponding to each subsystem to decouple, extract, standardize, clean, and validate the incoming raw data.

4. The system for detecting fraudulent order behavior based on multimodal data fusion according to claim 1, characterized in that, The specific details of the computational model are as follows: 1) Calculate order density characteristics; 2) Calculate the capacity load characteristics; 3) Calculate the spatiotemporal trajectory characteristics; 4) Calculate the temporal characteristics of the behavior; 5) After all the features in all dimensions have been calculated, each numerical feature is subjected to min-max normalization to form a feature matrix.

5. The order-brushing behavior detection system based on multimodal data fusion according to claim 4, characterized in that, The order density feature is calculated by using a sliding time window to count the number of orders placed by drivers, and by calculating the deviation between the total number of orders in the current window and the total number of orders in the same period in history. Deviation The calculation formula is as follows: ； in, This represents the total number of orders within the current time window. This represents the average order volume for the same period in history. This represents the standard deviation of historical order volume.

6. The system for detecting fraudulent order behavior based on multimodal data fusion according to claim 4, characterized in that, The capacity load characteristic calculation is combined with the theoretical shortest total time. The capacity load factor is calculated based on the actual duration from the start of the first order to the end of the last order within the current time period. Capacity load factor The calculation formula is as follows: ; in, This represents the actual duration from the start of the first order to the end of the last order within the current time period.

7. The system for detecting fraudulent order behavior based on multimodal data fusion according to claim 4, characterized in that, The spatiotemporal trajectory feature calculation reads all valid latitude and longitude coordinates in the order in chronological order, and calculates the great circle distance between two adjacent coordinates in turn. Based on the actual total distance traveled and the theoretical shortest path distance, the trajectory deviation value is calculated. ; Trajectory deviation value The calculation formula is as follows: ； in, This represents the driver's actual total driving distance. The theoretical shortest path distance .

8. The order-brushing behavior detection system based on multimodal data fusion according to claim 4, characterized in that, The calculation of the behavioral time-series features requires breaking down the entire order data process into stages to obtain the time consumption duration. ; Next, in the comparative analysis phase, the actual processing time of each order is compared with the average pickup time of normal orders in the corresponding region and time period, as well as a reasonable time range comprised of preset abnormal threshold parameters, to determine whether the current order is in an abnormal state. The determination formula is as follows: ； in, The preset abnormal threshold parameter, The coefficients of the abnormal threshold parameter.

9. The system for detecting fraudulent order behavior based on multimodal data fusion according to claim 1, characterized in that, The automatic training module includes a historical data storage submodule and a real-time training data storage submodule; the historical data storage submodule is used to receive, store and manage various types of data that have undergone complete calculation; The real-time training data storage submodule can persistently store the feature matrix, parameter version, calculation results and timestamp used in the correct calculation as training data samples in chronological order.

10. A method for detecting fraudulent order behavior based on multimodal data fusion, characterized in that, Includes the following steps: S1: Receives raw data streams from the order transaction, location tracking, payment settlement and account management subsystems in real time; S2: Based on parallel computation of data stream, the features of order density, capacity load, spatiotemporal trajectory, behavioral time series, and cost mileage are calculated, and all features are normalized and then concatenated to form a unified feature matrix; S3: Calculate the feature matrix, output the anomaly probability score S and compare it with the historical threshold parameter to generate the final risk label; S4: Perform chain verification on high-risk orders according to a preset order and five-dimensional numerical feature values, and automatically generate an electronic evidence report that integrates verification logs, risk scores and handling suggestions. S5: Execute the corresponding instructions in the graded disposal rule base according to the risk label. At the same time, the real-time training data storage submodule triggers the timed training task, starts the automatic training module to optimize the adjustment parameters and update them to the historical data storage submodule.

Images