An e-commerce order behavior risk assessment system based on internet of things coding

Abstract

This invention discloses an e-commerce order behavior risk assessment system based on IoT coding, comprising: a data acquisition module for collecting and preprocessing data to construct an order data sequence; a unified coding module for performing entity identification and unified coding processing to generate an object coding sequence; an association mapping module for performing association propagation analysis and relationship mapping processing to construct an order association graph; a risk propagation module for performing risk impact analysis and risk diffusion identification processing on the order association graph to generate a risk association sequence; an anomaly analysis module for performing abnormal behavior analysis on the risk association sequence to construct a risk feature sequence; and a risk assessment module for generating an order risk assessment result based on the risk feature sequence. This invention utilizes IoT unified coding and other technologies, possessing advantages such as strong association tracking capabilities, high accuracy in risk identification, high efficiency in anomaly detection, and high stability in risk assessment.

Description

Technical Field

[0001] This invention relates to the field of transaction risk control technology, and in particular to an e-commerce order behavior risk assessment system based on Internet of Things (IoT) coding. Background Technology

[0002] As the transaction volume of e-commerce platforms continues to expand, a large amount of order behavior data is generated during order generation, payment, logistics, and terminal interaction. To reduce the risks posed by abnormal transactions, malicious refunds, and fraudulent order-brushing activities, existing e-commerce platforms typically employ order risk assessment technology to identify and issue early warnings for order behavior.

[0003] Currently, existing technologies primarily construct risk rules based on order information, payment information, device information, and user historical behavior, identifying abnormal orders through rule matching, statistical analysis, and risk scoring. Some technologies employ graph association analysis and machine learning methods to analyze the relationships between orders, thereby improving risk identification capabilities.

[0004] However, most existing technologies perform independent analyses based on order data, payment data, and user behavior data, lacking a unified coding mechanism for order objects, device objects, and logistics objects. This makes it difficult to form a unified relational structure for data from different sources. When abnormal behavior is carried out in a distributed manner through multiple accounts, devices, and logistics nodes, traditional methods struggle to identify hidden relationships between different orders, easily leading to insufficient correlation tracking capabilities.

[0005] In addition, existing risk assessment methods mainly rely on static risk scoring based on the characteristics of a single order, lacking the ability to perform dynamic propagation analysis on the order-related network. This makes it difficult to accurately identify risk propagation paths and risk diffusion areas, and is prone to problems such as missed detection of abnormal behavior and low accuracy of risk assessment.

[0006] Therefore, how to provide an e-commerce order behavior risk assessment system based on IoT coding is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0007] One objective of this invention is to propose an e-commerce order behavior risk assessment system based on Internet of Things (IoT) coding. This invention fully utilizes IoT unified coding technology, graph association propagation technology, risk propagation analysis technology, and abnormal behavior identification technology to perform unified association modeling of order objects, device objects, logistics objects, and user objects in e-commerce orders. Based on the association relationship, it performs risk propagation analysis and abnormal behavior identification processing, which has the advantages of strong association tracking capability, high accuracy of risk identification, high efficiency of abnormal behavior detection, and high stability of risk assessment.

[0008] An e-commerce order behavior risk assessment system based on Internet of Things (IoT) coding, according to an embodiment of the present invention, includes: The data acquisition module is used to collect and preprocess e-commerce order data to construct an order data sequence; The unified encoding module is used to perform entity recognition operations on order data sequences. It uses the Struc2Vec algorithm to perform hierarchical structure similarity modeling operations on each entity, extracts the corresponding structural role features, and performs unified encoding on the structural role features according to the preset IoT encoding rules to generate object encoding sequences. The association mapping module is used to construct a candidate association node set based on the object encoding sequence, use the SimRank algorithm to perform association node similarity propagation calculation on the candidate association node set, and perform association relationship filtering and relationship edge mapping operations based on the propagation calculation results to construct the order association graph; The risk propagation module is used to perform risk impact analysis in the order association graph using a personalized PageRank algorithm. It calculates the risk impact value corresponding to each node in the graph, and performs risk propagation node screening and risk diffusion area identification based on the risk impact value, extracts risk propagation features, and generates risk association sequences. The anomaly analysis module is used to perform local anomaly density analysis on risk-related sequences using the local outlier factor algorithm, perform anomaly neighborhood deviation identification and outlier judgment operations based on the analysis results, generate anomaly distribution results, and construct risk feature sequences based on the anomaly distribution results; The risk assessment module is used to calculate the risk score of each e-commerce order based on the risk feature sequence, perform interval mapping and risk level classification operations on the risk score, and generate the order risk assessment result.

[0009] Optionally, the order data includes order number data, product transaction data, payment status data, logistics flow data, user historical behavior data, and device interaction behavior data from the e-commerce platform. The customer historical behavior data represents the customer's login behavior data, order placement behavior data, payment behavior data, and receipt behavior data in historical orders. The device interaction behavior data represents the device access record, device switching record, and operation interaction record corresponding to the terminal device. The preprocessing includes order field standardization processing, time alignment processing, and duplicate order filtering processing.

[0010] Optionally, the unified encoding module includes: Perform entity extraction operations on the data of each dimension in the order data sequence to generate the entity set corresponding to each dimension. The dimensions include order dimension, transaction dimension, payment dimension, logistics dimension, user dimension and device dimension. Based on each entity set, extract the order association, transaction association, payment association, access association, device connection association, and logistics flow relationship between the entities to construct the entity association structure; An improved Struc2Vec algorithm is used to perform multi-level neighborhood traversal operations on each entity in the entity association structure, calculate the structural similarity relationship of each entity in different hierarchical structures, and generate the corresponding hierarchical structure sequence. Based on the hierarchical structure sequence, structural role mapping is performed on each entity to extract the structural connection features, hierarchical distribution features and neighborhood structure features corresponding to each entity, and a structural role feature set is generated. Based on the preset IoT coding rules, the structural role feature set is processed by node identifier mapping and hierarchical coding combination to generate a unified coding identifier for each entity. Perform association sorting and object mapping operations on the unified encoding identifier to construct the object encoding sequence.

[0011] Optionally, the multi-layer neighborhood traversal operation and structural role mapping processing specifically include: Based on the entity association structure, extract the neighborhood node set, node connection path set, node association frequency set and node behavior time set corresponding to each entity to construct the neighborhood structure set; Based on the neighborhood structure set, perform multi-level neighborhood traversal operation on each entity, extract the node connection relationship, path propagation relationship, hierarchical association relationship and behavior time association relationship of each entity in different neighborhood levels, and generate a multi-level neighborhood structure set; An improved Struc2Vec algorithm, which incorporates association frequency influence factors, behavior time decay factors, and path propagation influence factors, is used to perform structural similarity calculation operations on each entity in a multi-layer neighborhood structure set. Based on the traditional Struc2Vec algorithm, which calculates structural similarity based on static neighborhood structural distance, the improved Struc2Vec algorithm performs a dynamic weighted update operation on the structural distance between entities according to the set of node association frequency, the set of node behavior time, and the set of node connection paths, and generates a structural distance matrix. Based on the structural distance matrix, structural role clustering is performed on each entity to extract target entities whose structural distances meet the preset distance conditions and generate a set of structural role nodes. Based on the set of structural role nodes, perform structural role mapping operation on each entity, extract the structural connection features, hierarchical distribution features and neighborhood structural features corresponding to each entity, and generate a set of structural role features.

[0012] Optionally, the association mapping module includes: Based on the object encoding sequence, the order object, transaction object, payment object, logistics object, user object and device object corresponding to each unified code identifier are extracted, and a candidate association node set is constructed according to the association relationship between each object; Among them, the relationships represent order relationships, transaction relationships, payment relationships, access relationships, device connection relationships, and logistics flow relationships; Based on the candidate associated node set, count the order objects, payment objects, logistics objects, user objects and device objects that are commonly associated among the associated nodes, and construct a node association relationship set; An improved SimRank algorithm is used to perform similarity propagation calculation on the set of node associations, calculate the corresponding node propagation similarity value, and generate the node similarity propagation result. Based on the node similarity propagation results, multiple rounds of similarity propagation iterative update operations are performed on each associated node. Based on the updated node propagation similarity value, target associated nodes that meet the preset propagation conditions are extracted, and an associated propagation node set is generated. Based on the set of associated propagation nodes, the relationships between the associated nodes are filtered to generate the target set of relationships; Based on the target association set and node propagation similarity value, perform relationship edge mapping operation on each target association node to establish the corresponding association relationship edges between each target association node and construct the order association graph.

[0013] Optionally, the similarity propagation calculation of associated nodes specifically includes: Based on the node association set, extract the various association relationships corresponding to each associated node and construct a multi-relationship propagation set; Based on the multi-relation propagation set, the number of order-related nodes, transaction-related nodes, payment-related nodes, access-related nodes, device connection nodes, and logistics flow nodes corresponding to any two related nodes are counted respectively to generate multi-relation association results; An improved SimRank algorithm is used to perform similarity propagation calculation on the association results of multiple relationships, and the node propagation similarity value between each association node is calculated. In contrast to the traditional SimRank algorithm which performs node similarity propagation calculation based on a single relationship, the improved SimRank algorithm performs similarity propagation calculation based on multiple relationships. Based on the node propagation similarity value corresponding to each association, a classification propagation calculation operation is performed on each associated node to generate the node similarity propagation result corresponding to each association.

[0014] Optionally, the multi-round similarity propagation iterative update operation specifically includes: Based on the node similarity propagation results, the node propagation similarity values ​​and association relationships between each associated node are extracted to construct a node propagation matrix; Based on the node propagation matrix, the number of order-related nodes, transaction-related nodes, payment-related nodes, access-related nodes, device connection nodes, and logistics flow nodes corresponding to each related node are counted, and the node connectivity of each related node is calculated based on the statistical results. An improved label propagation algorithm is used to perform node propagation iterative update operations on each associated node in the node propagation matrix; Compared with the traditional label propagation algorithm which performs label propagation and update operations based on fixed neighboring nodes, the improved label propagation algorithm introduces a random walk mechanism. It determines the direction of random walk propagation based on the node connectivity and node propagation similarity value, and calculates the propagation update value between each associated node based on the product of the node propagation similarity value and the node connectivity. Based on the propagation update value, perform an incremental update operation on the similarity value propagated to the nodes corresponding to each associated node to generate the propagation update result; The maximum and minimum values ​​in the propagation update results are normalized by interval, and the propagation offset between each associated node is calculated based on the normalization results. Based on the propagation offset value, multiple rounds of propagation convergence determination operations are performed on each associated node. When the difference between the propagation offset values ​​of two adjacent rounds is less than the preset convergence threshold, the corresponding associated node is extracted as the target associated node, and an associated propagation node set is generated.

[0015] Optionally, the risk propagation module includes: Extract the corresponding relationship edges, node propagation similarity values, and node connectivity degrees between each associated node in the order association graph to construct a risk propagation relationship set; Based on the risk propagation relationship set, count the number of various types of relationships corresponding to each associated node, and generate node association statistics results; Based on the node association statistics, a personalized PageRank algorithm is used to analyze the risk impact of each associated node. The risk impact value of each associated node is calculated based on the node propagation similarity value, node connectivity and association relationship edge. Perform a propagation update operation on the risk impact values ​​between each associated node. Based on the association relationship edges, perform propagation accumulation processing on the risk impact values ​​corresponding to each associated node to generate risk propagation results. Based on the risk propagation results, a risk propagation node screening operation is performed on each associated node to extract associated nodes whose risk impact values ​​meet the preset propagation conditions, and a risk propagation node set is generated. For the corresponding relationships between each associated node in the risk propagation node set, perform an association range identification operation to generate a risk diffusion area set; Based on the risk diffusion region set, perform risk propagation feature extraction operation on each associated node to generate corresponding risk propagation features; Based on the characteristics of risk propagation, association mapping and propagation ranking are performed on each associated node to construct a risk association sequence.

[0016] Optionally, the anomaly analysis module includes: Extract the risk propagation characteristics, node propagation similarity values, node connectivity, and risk impact values ​​corresponding to each associated node in the risk association sequence, and construct an anomaly analysis dataset; Based on the anomaly analysis dataset, the corresponding relationships between each associated node are statistically analyzed, and a node neighborhood set is constructed. The local outlier factor algorithm is used to perform local anomaly density analysis on each associated node in the node neighborhood set and calculate the outlier value of each associated node. Perform an abnormal neighborhood deviation identification operation on each associated node, extract associated nodes whose abnormal outlier values ​​meet the preset deviation conditions, and generate an abnormal neighborhood node set; Based on the abnormal neighborhood node set, correlation analysis is performed on the risk propagation characteristics, node propagation similarity values, node connectivity and risk impact values ​​of each associated node to generate an abnormal behavior feature set. Based on the abnormal behavior feature set, an abnormal behavior outlier determination operation is performed on each associated node to filter and obtain abnormal distribution results; Perform association mapping and risk ranking operations on the abnormal distribution results to construct a risk feature sequence.

[0017] Optionally, the risk assessment module includes: Based on the risk characteristic sequence, the frequency of risk propagation, frequency of abnormal behavior, and frequency of association diffusion corresponding to each associated node are statistically analyzed to generate risk statistics results; Based on the risk statistics results, risk association mapping and node risk aggregation processing are performed on each associated node to extract the propagation risk characteristics, outlier risk characteristics, connection risk characteristics and diffusion risk characteristics corresponding to each associated node. According to the preset set of weight coefficients, the risk characteristics corresponding to each associated node are weighted and aggregated, and then normalized to obtain the risk score corresponding to each e-commerce order. According to the preset level classification rules, the risk score is subjected to interval mapping and risk level classification operations to generate the order risk assessment result.

[0018] The beneficial effects of this invention are: First, this invention performs unified coding processing on order objects, device objects, logistics objects, and user objects, and constructs an order association graph based on the unified coding results. This enables unified association analysis capabilities between order behavior data from different sources. Compared with the traditional method of performing independent analysis based on single order data, it can more accurately identify hidden associations between multiple accounts, multiple devices, and multiple logistics nodes, and improve the ability to track and identify the associations of complex and abnormal order behaviors.

[0019] Secondly, this invention employs a similarity propagation analysis and risk propagation analysis method for associated nodes to perform multiple rounds of propagation calculations on the node relationships in the order association graph. It also combines node propagation similarity value, node connectivity, and risk impact value to identify risk diffusion. Compared with the traditional static risk scoring method, it can more accurately identify risk propagation paths and risk diffusion areas, thereby improving the accuracy of order risk assessment results and risk warning capabilities.

[0020] Finally, this invention achieves comprehensive identification of hidden abnormal order behaviors by performing local anomaly density analysis, anomaly neighborhood deviation identification, and outlier determination on risk-related sequences. Compared with traditional methods that perform anomaly detection based on single-dimensional behavioral features, this invention can effectively reduce the missed detection of abnormal behaviors and improve the stability of order risk assessment and the efficiency of anomaly detection. Attached Figure Description

[0021] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings: Figure 1 This is a module structure diagram of an e-commerce order behavior risk assessment system based on Internet of Things coding proposed in this invention; Figure 2 This is a flowchart illustrating the construction of a unified coding and order association graph for an e-commerce order behavior risk assessment system based on Internet of Things coding, as proposed in this invention. Figure 3 This is a flowchart illustrating the anomaly analysis and risk assessment process of an e-commerce order behavior risk assessment system based on Internet of Things (IoT) coding proposed in this invention. Detailed Implementation

[0022] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, illustrating only the basic structure of the invention, and therefore only show the components relevant to the invention.

[0023] refer to Figures 1-3 An e-commerce order behavior risk assessment system based on Internet of Things (IoT) coding includes: The data acquisition module is used to collect and preprocess e-commerce order data to construct an order data sequence; The unified encoding module is used to perform entity recognition operations on order data sequences. It uses the Struc2Vec algorithm to perform hierarchical structure similarity modeling operations on each entity, extracts the corresponding structural role features, and performs unified encoding on the structural role features according to the preset IoT encoding rules to generate object encoding sequences. The association mapping module is used to construct a candidate association node set based on the object encoding sequence, use the SimRank algorithm to perform association node similarity propagation calculation on the candidate association node set, and perform association relationship filtering and relationship edge mapping operations based on the propagation calculation results to construct the order association graph; The risk propagation module is used to perform risk impact analysis in the order association graph using a personalized PageRank algorithm. It calculates the risk impact value corresponding to each node in the graph, and performs risk propagation node screening and risk diffusion area identification based on the risk impact value, extracts risk propagation features, and generates risk association sequences. The anomaly analysis module is used to perform local anomaly density analysis on risk-related sequences using the local outlier factor algorithm, perform anomaly neighborhood deviation identification and outlier judgment operations based on the analysis results, generate anomaly distribution results, and construct risk feature sequences based on the anomaly distribution results; The risk assessment module is used to calculate the risk score of each e-commerce order based on the risk feature sequence, perform interval mapping and risk level classification operations on the risk score, and generate the order risk assessment result.

[0024] In this embodiment, the order data includes order number data, product transaction data, payment status data, logistics flow data, user historical behavior data, and device interaction behavior data from the e-commerce platform. Customer historical behavior data represents the customer's login behavior data, order placement behavior data, payment behavior data, and receipt behavior data in historical orders. Device interaction behavior data represents the device access record, device switching record, and operation interaction record corresponding to the terminal device. Preprocessing includes order field standardization processing, time alignment processing (controlling the time error within 0.5 seconds), and duplicate order filtering processing. Order number data includes order number, order generation time, order amount, and order product category information; product transaction data includes product browsing history, product purchase history, product return history, and order transaction status information; payment status data includes payment account information, payment time information, payment result information, and payment frequency information; and logistics flow data includes logistics node number, logistics receipt status, logistics route information, and logistics update time information. Login behavior data includes the number of login terminals, login time interval, and number of login location switches; order behavior data includes order frequency, number of product category changes, and number of order cancellations; payment behavior data includes the number of payment failures, number of payment account switches, and payment time distribution; and delivery behavior data includes the number of delivery address changes, number of abnormal signatures, and number of duplicate delivery contacts. Device access records include device number, device access time, and device online duration; device switching records include account switching count, number of accounts logged into the device, and device switching time interval; operation interaction records include page click frequency, operation dwell time, and order submission interval.

[0025] In this embodiment, the unified encoding module includes: Entity extraction was performed on the data of each dimension in the order data sequence. From 4.82 million order data, 5.01 million transaction data, 4.97 million payment data, 3.54 million logistics data, 9.13 million user behavior data, and 2.67 million device interaction data, a total of 4.82 million order entities, 5.01 million transaction entities, 4.97 million payment entities, 3.54 million logistics entities, 3.28 million user entities, and 1.96 million device entities were extracted, generating entity sets corresponding to each dimension. The dimensions include order dimension, transaction dimension, payment dimension, logistics dimension, user dimension, and device dimension. Order entities include order number entity, order status entity, and order amount entity. Logistics entities include logistics node entity, receipt node entity, and delivery route entity. Device entities include mobile terminal entity, web login terminal entity, and QR code scanning terminal entity. Based on each entity set, extract the order association, transaction association, payment association, access association, device connection association, and logistics flow relationship between the entities to construct the entity association structure; An improved Struc2Vec algorithm is used to perform multi-level neighborhood traversal operations on each entity in the entity association structure, calculate the structural similarity relationship of each entity in different hierarchical structures, and generate the corresponding hierarchical structure sequence. Specifically, a three-level neighborhood structure is established for each entity. The first level neighborhood is used to extract directly associated nodes, the second level neighborhood is used to extract indirectly propagated nodes, and the third level neighborhood is used to extract cross-relationship diffusion nodes. In the process of calculating structural similarity, the improved Struc2Vec algorithm combines the node association frequency, node behavior time and node propagation path to dynamically update the structural distance, so that associated nodes with high-frequency equipment switching behavior and high-frequency logistics aggregation behavior can form higher structural similarity values. Based on the hierarchical structure sequence, structural role mapping is performed on each entity, and structural connection features, hierarchical distribution features, and neighborhood structure features corresponding to each entity are extracted. Among them, structural connection features include the number of node connections, connection path length, and node propagation depth; hierarchical distribution features include the hierarchical position of the node, hierarchical association frequency, and hierarchical diffusion range; and neighborhood structure features include neighborhood node density, neighborhood propagation frequency, and neighborhood association strength, generating a structural role feature set. Based on the preset IoT coding rules, the structural role feature set is processed by node identification mapping and hierarchical coding combination. During the coding process, the object category information is mapped to the object category code, the node's hierarchical position is mapped to the hierarchical structure code, the node propagation relationship is mapped to the propagation relationship code, and the node connection attribute is mapped to the node attribute code, thereby generating a unified coding identifier for each entity. For associated nodes that share the same propagation path and structural role characteristics, the same level of encoding segment is automatically assigned, thereby establishing a unified mapping relationship between hidden associated objects; Perform association sorting and object mapping operations on the unified encoding identifier to construct the object encoding sequence.

[0026] In this embodiment, the multi-layer neighborhood traversal operation and structural role mapping processing specifically include: Based on the entity association structure, extract the neighborhood node set, node connection path set, node association frequency set and node behavior time set corresponding to each entity to construct the neighborhood structure set; Based on the neighborhood structure set, perform multi-level neighborhood traversal operations on each entity to establish a three-level neighborhood traversal structure. The first level of neighborhood is used to extract directly related nodes, the second level of neighborhood is used to extract indirectly propagated nodes, and the third level of neighborhood is used to extract cross-relationship diffusion nodes. The node connection relationship, path propagation relationship, hierarchical relationship and behavior time relationship of each entity in different neighborhood levels are extracted layer by layer to generate a multi-level neighborhood structure set. An improved Struc2Vec algorithm, which incorporates an association frequency impact factor, a behavior time decay factor, and a path propagation impact factor, is used to perform structural similarity calculations on entities in a multi-layer neighborhood structure set. During the calculation, the association frequency impact factor is used to represent the number of historical associations between nodes, the behavior time decay factor is used to represent the degree of influence of the node behavior time interval on the propagation relationship, and the path propagation impact factor is used to represent the degree of influence of the node propagation path length on the structural similarity relationship. Building upon the traditional Struc2Vec algorithm's calculation of structural similarity based on static neighborhood structural distance, the improved Struc2Vec algorithm performs a dynamic weighted update operation on the structural distance between entities based on the set of node association frequencies, the set of node behavior times, and the set of node connection paths. For nodes that experience more than 3 device switching events within 24 hours, increase the weight of the correlation frequency impact factor. For nodes with a propagation path length exceeding 5 layers, reduce the weight of the path propagation impact factor. For nodes with a behavior time interval exceeding 72 hours, a behavior time decay coefficient is added to achieve dynamic adjustment of the structural distance and generate a structural distance matrix. Based on the structural distance matrix, structural role clustering is performed on each entity, and entities with a structural distance of less than 0.25 are divided into structural role nodes of the same type, generating a set of structural role nodes; Based on the set of structural role nodes, perform structural role mapping operation on each entity, extract the structural connection features, hierarchical distribution features and neighborhood structural features corresponding to each entity, and generate a set of structural role features.

[0027] In this embodiment, the association mapping module includes: Based on the object encoding sequence, the order object, transaction object, payment object, logistics object, user object and device object corresponding to each unified code identifier are extracted, and a candidate association node set is constructed according to the association relationship between each object; Among them, the relationships represent order relationships, transaction relationships, payment relationships, access relationships, device connection relationships, and logistics flow relationships; Based on the candidate associated node set, the order objects, payment objects, logistics objects, user objects, and device objects commonly associated with each associated node are counted to construct a node association relationship set. During the count, when the number of device objects commonly associated between any two associated nodes is greater than 2 and the number of logistics objects commonly associated is greater than 3, the corresponding associated node is identified as a high-association node; when the number of payment objects commonly associated between two associated nodes reaches 5 or more, the propagation priority of the corresponding association relationship is increased, thereby enhancing the ability to identify abnormal association behavior. An improved SimRank algorithm is used to perform similarity propagation calculation on the set of node associations, calculate the corresponding node propagation similarity value, and generate the node similarity propagation result. During the propagation calculation process, order association, payment association, device connection, and logistics flow relationship are assigned propagation weights of 0.35, 0.25, 0.25, and 0.15 respectively, and propagation attenuation processing is performed based on the propagation path length between nodes. When the propagation path length exceeds 4 layers, the corresponding propagation weight will be reduced by 20%. When the node propagation similarity value between two related nodes is greater than 0.75, the corresponding related node is identified as a high propagation node; When the similarity value of a node propagation is lower than 0.3, the propagation update process between the corresponding nodes is stopped. Based on the node similarity propagation results, perform multiple rounds of similarity propagation iterative update operations on each associated node: During the propagation update process, the propagation update value is calculated based on the product of the node propagation similarity value and the node connectivity. When the propagation update value is greater than 0.6, propagation enhancement processing is performed on the corresponding node. When the propagation update value is less than 0.2, propagation suppression processing is performed on the corresponding node. At the same time, convergence judgment is performed on the propagation offset value between two adjacent propagation results. When the propagation offset value is less than 0.03 for three consecutive rounds, the corresponding propagation result is determined to meet the convergence condition, and the corresponding associated node is extracted as the target associated node, generating an associated propagation node set. Based on the set of associated propagation nodes, the relationships between each associated node are filtered. When the node propagation similarity value is greater than 0.65 and the node connectivity is greater than 12, the corresponding relationship is retained. When the node propagation similarity value is less than 0.4 and the node connectivity is less than 5, the corresponding relationship is deleted. This reduces the impact of low-value propagation relationships on the order association graph and generates the target association relationship set. Based on the target association set and the node propagation similarity value, a relationship edge mapping operation is performed on each target association node to establish the corresponding association relationship edges between each target association node. When the node propagation similarity value is greater than 0.8, a high-strength propagation relationship edge is established; when the node propagation similarity value is between 0.6 and 0.8, a medium-strength propagation relationship edge is established; and when the node propagation similarity value is less than 0.6, a low-strength propagation relationship edge is established, thereby forming an order association graph with a propagation hierarchy.

[0028] In this embodiment, the similarity propagation calculation of associated nodes specifically includes: Based on the node association set, extract various types of associations corresponding to each associated node, and construct a multi-relationship propagation set: During the construction process, when two associated nodes correspond to the same order number, an order association relationship is established; when two associated nodes correspond to the same payment account and the payment time difference is less than 10 minutes, a payment association relationship is established; when two associated nodes correspond to the same device object and the device switching time interval is less than 15 minutes, a device connection relationship is established; and when two associated nodes correspond to the same logistics node and the logistics update time interval is less than 30 minutes, a logistics flow relationship is established. Based on the multi-relation propagation set, the number of order-related nodes, transaction-related nodes, payment-related nodes, access-related nodes, device connection nodes, and logistics flow nodes corresponding to any two related nodes are counted respectively, generating multi-relation association results: When the number of order association nodes between two related nodes is greater than 4, the propagation priority of the corresponding order association relationship is increased; When the number of connected nodes reaches 3 or more, it is determined that there is high-frequency device propagation behavior between the corresponding associated nodes; When the number of logistics flow nodes reaches 5 or more, it is determined that there is abnormal logistics aggregation behavior among the corresponding related nodes; For any associated node that simultaneously meets the criteria of having more than 3 connected device nodes and more than 4 payment associated nodes, the corresponding node will be identified as a high-risk propagation node. An improved SimRank algorithm is used to perform similarity propagation calculation on the association results of multiple relationships, and the node propagation similarity value between each association node is calculated. In contrast to the traditional SimRank algorithm which performs node similarity propagation calculation based on a single relationship, the improved SimRank algorithm performs similarity propagation calculation based on multiple relationships. During the propagation calculation process, propagation weights of 0.3, 0.25, 0.25, and 0.2 are assigned to order association, payment association, device connection, and logistics flow relationship, respectively, and propagation attenuation processing is performed based on the propagation path length corresponding to the association. When the propagation path length exceeds 4 layers, the propagation weight of the corresponding relationship is reduced by 15%. When the number of device connection nodes between two associated nodes exceeds 5, an additional propagation weight of 0.1 is added; Based on the node propagation similarity value corresponding to each association, a classification propagation calculation operation is performed on each associated node to generate the node similarity propagation result corresponding to each association.

[0029] In this embodiment, the multi-round similarity propagation iterative update operation specifically includes: Based on the node similarity propagation results, the node propagation similarity value and association relationship between each associated node are extracted. The order association relationship, payment association relationship, device connection relationship and logistics flow relationship are mapped to the corresponding matrix positions respectively, and the node propagation similarity value is used as the matrix weight value. When there is both device connection relationship and payment association relationship between two associated nodes, the corresponding matrix weights are superimposed. When the node propagation similarity value is greater than 0.75, the corresponding matrix cell is marked as a high propagation area, thus forming a node propagation matrix that includes propagation direction and propagation intensity. Based on the node propagation matrix, the number of order-related nodes, transaction-related nodes, payment-related nodes, access-related nodes, device connection nodes, and logistics flow nodes corresponding to each related node are counted, and the node connectivity of each related node is calculated based on the statistical results. An improved label propagation algorithm is used to perform node propagation iterative update operations on each associated node in the node propagation matrix; Compared with the traditional label propagation algorithm which performs label propagation and update operations based on fixed neighboring nodes, the improved label propagation algorithm introduces a random walk mechanism. It determines the direction of random walk propagation based on the node connectivity and node propagation similarity value, and calculates the propagation update value between each associated node based on the product of the node propagation similarity value and the node connectivity. Based on the propagation update value, perform an incremental update operation on the similarity value propagated to the nodes corresponding to each associated node to generate the propagation update result; During the update process, the similarity value of the current node propagation is accumulated with the similarity value of the previous node propagation, and a dynamic correction operation is performed based on the propagation update value. When the propagation update value increases by more than 0.15 for two consecutive rounds, the propagation priority of the corresponding node is increased. When the propagation update value decreases by more than 0.1 for three consecutive rounds, the propagation influence range of the corresponding node is reduced, thereby avoiding the continuous spread of low-value propagation relationships. The maximum and minimum values ​​in the propagation update results are normalized by interval, and the propagation offset values ​​between each associated node are calculated based on the normalization results. During the normalization process, the node propagation similarity values ​​are uniformly mapped to the interval between 0 and 1, and the propagation offset values ​​between two adjacent rounds of propagation results are calculated based on the normalization results. When the propagation offset value is greater than 0.2, the current propagation result is determined to be unstable; when the propagation offset value is less than 0.05, the current propagation result is determined to be stable. Based on the propagation offset value, perform multiple rounds of propagation convergence determination operation on each associated node. When the difference between the propagation offset values ​​of two adjacent rounds is less than 0.03 and the convergence condition is met for three consecutive rounds, the corresponding associated node is extracted as the target associated node, and an associated propagation node set is generated.

[0030] In this embodiment, the risk propagation module includes: Extract the corresponding relationship edges, node propagation similarity values, and node connectivity degrees between each associated node in the order association graph to construct a risk propagation relationship set; Based on the risk propagation relationship set, count the number of various types of relationships corresponding to each associated node, and generate node association statistics results; Based on the node association statistics, a personalized PageRank algorithm is used to analyze the risk impact of each associated node. The risk impact value of each associated node is calculated based on the node propagation similarity value, node connectivity and association relationship edge. In the process of calculating the risk impact value, the similarity value of node propagation, the degree of node connectivity, and the edge of association are assigned impact weights of 0.4, 0.35, and 0.25, respectively, and 6 rounds of risk propagation iteration calculation are performed. When the similarity value of node propagation is greater than 0.8 and the degree of node connectivity is greater than 0.75, an additional risk enhancement coefficient of 0.1 is added. When the propagation path length corresponding to the edge of association exceeds 5 layers, the propagation impact weight of the corresponding propagation relationship is reduced by 15%. After risk impact analysis, when the risk impact value of the associated node is greater than 0.7, the corresponding associated node is identified as a high-risk propagation node. Perform a propagation update operation on the risk impact values ​​between each associated node. Based on the association relationship edges, perform propagation accumulation processing on the risk impact values ​​corresponding to each associated node to generate risk propagation results. During the propagation and update process, risk impact value diffusion is performed according to the propagation direction corresponding to the associated edge. When the difference in risk impact value between adjacent nodes in the propagation path is less than 0.1, risk impact value superposition and update are performed. When the propagation path length exceeds 4 layers, the propagation result is attenuated and the risk propagation gain is reduced by 20%. For associated nodes that simultaneously exhibit high node propagation similarity and high node connectivity, an additional risk propagation enhancement coefficient of 0.08 is added to improve the ability to identify hidden propagation relationships. Based on the risk propagation results, a risk propagation node screening operation is performed on each associated node. When the risk impact value corresponding to the associated node is greater than 0.72 and the increase of the propagation results in two consecutive rounds exceeds 0.12, the corresponding associated node is extracted to generate a risk propagation node set. For the corresponding relationships between each associated node in the risk propagation node set, perform an association range identification operation to generate a risk diffusion area set; Based on the risk diffusion region set, perform risk propagation feature extraction operation on each associated node to generate corresponding risk propagation features; Based on the characteristics of risk propagation, association mapping and propagation ranking are performed on each associated node to construct a risk association sequence.

[0031] In this embodiment, the anomaly analysis module includes: Extract the risk propagation characteristics, node propagation similarity values, node connectivity, and risk impact values ​​corresponding to each associated node in the risk association sequence, and construct an anomaly analysis dataset; Based on the anomaly analysis dataset, the corresponding relationships between each associated node are statistically analyzed. When the number of device connection relationships between two associated nodes reaches 4 or more, the corresponding associated nodes are assigned to the same device propagation neighborhood. When the number of logistics flow relationships reaches 6 or more, the corresponding associated nodes are assigned to the same logistics propagation neighborhood. When the propagation path length between associated nodes is less than 3 layers, the corresponding associated nodes are determined as nearest neighbor propagation nodes, thus forming a multi-level node neighborhood set. The local outlier factor algorithm is used to perform local anomaly density analysis on each associated node in the node neighborhood set and calculate the outlier value of each associated node. In the analysis process, the node propagation similarity value, node connectivity and risk impact value are used as local anomaly density analysis parameters and the outlier values ​​are calculated with weights of 0.4, 0.3 and 0.3. Perform an abnormal neighborhood deviation identification operation on each associated node, extract associated nodes with abnormal outlier values ​​greater than 1.6, and generate an abnormal neighborhood node set; Based on the abnormal neighborhood node set, correlation analysis is performed on the risk propagation characteristics, node propagation similarity values, node connectivity and risk impact values ​​of each associated node to generate an abnormal behavior feature set. Based on the abnormal behavior feature set, an abnormal behavior outlier determination operation is performed on each associated node to filter and obtain abnormal distribution results; Perform association mapping and risk ranking operations on the abnormal distribution results to construct a risk feature sequence.

[0032] In this embodiment, the risk assessment module includes: Based on the risk characteristic sequence, the frequency of risk propagation, frequency of abnormal behavior, and frequency of association diffusion corresponding to each associated node are statistically analyzed to generate risk statistics results; Based on the risk statistics results, risk association mapping and node risk aggregation processing are performed on each associated node to extract the propagation risk characteristics, outlier risk characteristics, connection risk characteristics and diffusion risk characteristics corresponding to each associated node. According to the preset set of weight coefficients, the risk characteristics corresponding to each associated node are weighted and aggregated, and then normalized to obtain the risk score corresponding to each e-commerce order. According to the preset level classification rules, the risk score is subjected to interval mapping and risk level classification operations to generate the order risk assessment result.

[0033] Example 1: To verify the feasibility of this invention in practice, it was applied to an order risk identification scenario on a large e-commerce platform. This platform generated 4.82 million order data entries in a single period, involving 9.13 million user behavior data entries, 2.67 million device access data entries, 3.54 million logistics flow data entries, and 5.01 million payment status data entries. As the platform's business scale continues to expand, order sources are increasingly characterized by cross-linking across multiple terminals, accounts, and logistics nodes. In actual business operations, some abnormal orders frequently switch login devices using multiple accounts and execute order flow operations through different logistics nodes, while simultaneously forming complex association structures through multiple payment behaviors. Traditional rule-based risk identification methods primarily rely on order amount, login frequency, and payment status to perform single-order risk assessments, lacking a unified analysis mechanism for hidden relationships between order objects, device objects, and logistics objects. Therefore, in practical applications, there are problems such as insufficient ability to identify associations, inability to trace risk propagation paths, and low efficiency in detecting abnormal behavior.

[0034] In the operation of traditional risk control methods, the platform needs to manually review a large number of abnormal orders every day, with the number of high-risk orders consistently exceeding 120,000. However, some abnormal orders still cannot be accurately identified. Statistical analysis revealed that traditional risk control methods are prone to delays in risk identification and missed detection of abnormal orders when faced with multi-device switching, multi-account association, and abnormal logistics aggregation. In particular, when black market activities carry out decentralized operations through multiple logistics nodes and multiple device nodes, traditional rules struggle to establish complete order correlations, resulting in some abnormal orders being judged as normal orders despite having obvious propagation relationships.

[0035] To address the aforementioned issues, this embodiment first uses a data acquisition module to uniformly collect order number data, product transaction data, payment status data, logistics flow data, user historical behavior data, and device interaction behavior data from the platform. Order field standardization, time alignment, and duplicate order filtering are then performed. In this implementation, a total of 4.82 million order data entries were cleaned, 176,000 duplicate orders were filtered, and 432,000 missing field entries were repaired. Furthermore, 9.13 million user behavior data entries underwent unified time alignment to form a complete order data sequence. After preprocessing, data from different sources are correlated under a unified time dimension, providing foundational data support for subsequent unified coding and risk propagation analysis.

[0036] Subsequently, the unified coding module performs entity extraction operations on order objects, transaction objects, payment objects, logistics objects, user objects, and device objects in the order data sequence, and performs unified coding mapping processing according to preset IoT coding rules. In this implementation, a total of 4.82 million order objects, 1.96 million device objects, 840,000 logistics objects, 5.01 million payment objects, and 3.28 million user objects were identified, generating a total of 12.68 million unified coding identifiers. Through unified coding processing, order behavior data that was originally scattered across different business links establishes a unified association structure, forming a stable mapping relationship between order objects, device objects, and logistics objects. Some orders that could not be directly identified in terms of association were found to have the same device access path and the same logistics flow node after unified coding, thus forming a hidden association structure.

[0037] After completing the unified encoding, the association mapping module constructs a candidate association node set based on the object encoding sequence and uses an improved SimRank algorithm to perform similarity propagation calculations for association nodes. During the propagation analysis, a total of 8.74 million association nodes were identified, forming 42.13 million association edges, of which device connection edges accounted for 31.4% and logistics flow relationship edges accounted for 24.7%. Through multiple rounds of propagation iteration and updates, the system identified a large number of abnormal association behaviors, including multiple accounts sharing the same device, multiple orders corresponding to the same logistics node, and multiple payment behaviors corresponding to the same access path. After propagation convergence analysis, a total of 1.28 million association propagation nodes were selected, and a complete order association graph was established.

[0038] After the order association graph is constructed, the risk propagation module uses a personalized PageRank algorithm to perform risk impact analysis on each associated node. The system calculates the risk impact value corresponding to each associated node based on the node propagation similarity value, node connectivity, and association edge, and performs propagation accumulation processing on the risk impact value. In this implementation, a total of 137,000 risk propagation nodes were identified, forming 21,000 risk diffusion areas, and 13,756 risk propagation paths were identified. Some orders that did not originally trigger traditional risk rules were identified as risk diffusion nodes because of the multi-layered propagation relationship with high-risk device nodes. Compared with the traditional single-order risk assessment method, this invention can identify more complex risk propagation relationships and improve the ability to discover hidden abnormal orders.

[0039] Subsequently, the anomaly analysis module employs the local outlier factor algorithm to perform local anomaly density analysis on the risk-related sequences. The system identifies neighborhood deviations by analyzing the correlation between node propagation similarity values, node connectivity, and risk impact values, identifying a total of 46,000 abnormal neighboring nodes and extracting 124,000 sets of abnormal behavioral features. During the analysis, it was found that some abnormal orders, although exhibiting weak behavioral features when analyzed individually, were identified as abnormal outliers due to high-frequency anomaly propagation relationships between their corresponding device nodes and logistics nodes. By combining local anomaly density analysis with propagation correlation analysis, this invention can effectively identify hidden abnormal behaviors that are difficult to detect using traditional rule-based risk control methods.

[0040] Finally, the risk assessment module calculates risk scores and classifies risk levels for each order based on the risk characteristic sequence, and outputs the order risk assessment results. During this implementation, a total of 28,000 high-risk orders, 96,000 medium-risk orders, and 4.38 million low-risk orders were generated. Based on the risk assessment results, the platform performs manual review for high-risk orders, action tracking for medium-risk orders, and normal release for low-risk orders, thereby effectively reducing the workload of manual review and improving the overall efficiency of order risk management.

[0041] Table 1 Comparison and Analysis of Risk Assessment Effectiveness

[0042] As shown in Table 1, this invention significantly outperforms traditional rule-based risk control methods in terms of the number of hidden associated orders identified, the number of multi-device associations identified, and the number of risk propagation paths identified. Specifically, the number of hidden associated orders identified increased from 3185 to 9624, and the number of multi-device associations identified increased from 2741 to 8873. This demonstrates that this invention, through a unified coding mechanism and association propagation analysis mechanism, can more accurately identify hidden associations between order objects, device objects, and logistics objects. Furthermore, this invention newly identified 13756 risk propagation paths, indicating that it can effectively identify the propagation process of risks in the order association network and improve the ability to identify risk diffusion areas.

[0043] In addition, the present invention shows higher results in terms of risk assessment accuracy, high-risk order identification rate and abnormal behavior detection rate. The risk assessment accuracy reaches 94.8%, the abnormal behavior detection rate reaches 95.4%, and the number of missed abnormal behavior detections decreases to 913. This indicates that the present invention can effectively reduce the missed detection of hidden abnormal orders and improve the overall order risk identification capability.

[0044] Furthermore, the workload of manual review decreased from 100% to 61.4%, indicating that the present invention can reduce the pressure of a large amount of manual screening and improve the efficiency of order risk management and the stability of risk assessment.

[0045] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A risk assessment system for e-commerce order behavior based on Internet of Things (IoT) coding, characterized in that, include: The data acquisition module is used to collect and preprocess e-commerce order data to construct an order data sequence; The unified encoding module is used to perform entity recognition operations on order data sequences. It uses the Struc2Vec algorithm to perform hierarchical structure similarity modeling operations on each entity, extracts the corresponding structural role features, and performs unified encoding on the structural role features according to the preset IoT encoding rules to generate object encoding sequences. The association mapping module is used to construct a candidate association node set based on the object encoding sequence, use the SimRank algorithm to perform association node similarity propagation calculation on the candidate association node set, and perform association relationship filtering and relationship edge mapping operations based on the propagation calculation results to construct the order association graph; The risk propagation module is used to perform risk impact analysis in the order association graph using a personalized PageRank algorithm. It calculates the risk impact value corresponding to each node in the graph, and performs risk propagation node screening and risk diffusion area identification based on the risk impact value, extracts risk propagation features, and generates risk association sequences. The anomaly analysis module is used to perform local anomaly density analysis on risk-related sequences using the local outlier factor algorithm, perform anomaly neighborhood deviation identification and outlier judgment operations based on the analysis results, generate anomaly distribution results, and construct risk feature sequences based on the anomaly distribution results; The risk assessment module is used to calculate the risk score of each e-commerce order based on the risk feature sequence, perform interval mapping and risk level classification operations on the risk score, and generate the order risk assessment result.

2. The e-commerce order behavior risk assessment system based on IoT coding according to claim 1, characterized in that, The order data includes order number data, product transaction data, payment status data, logistics flow data, user historical behavior data, and device interaction behavior data from the e-commerce platform. The customer historical behavior data represents the customer's login behavior data, order placement behavior data, payment behavior data, and receipt behavior data in historical orders. The device interaction behavior data represents the device access records, device switching records, and operation interaction records corresponding to the terminal device. The preprocessing includes order field standardization processing, time alignment processing, and duplicate order filtering processing.

3. The e-commerce order behavior risk assessment system based on IoT coding according to claim 1, characterized in that, The unified coding module includes: Perform entity extraction operations on the data of each dimension in the order data sequence to generate the entity set corresponding to each dimension. The dimensions include order dimension, transaction dimension, payment dimension, logistics dimension, user dimension and device dimension. Based on each entity set, extract the order association, transaction association, payment association, access association, device connection association, and logistics flow relationship between the entities to construct the entity association structure; An improved Struc2Vec algorithm is used to perform multi-level neighborhood traversal operations on each entity in the entity association structure, calculate the structural similarity relationship of each entity in different hierarchical structures, and generate the corresponding hierarchical structure sequence. Based on the hierarchical structure sequence, structural role mapping is performed on each entity to extract the structural connection features, hierarchical distribution features and neighborhood structure features corresponding to each entity, and a structural role feature set is generated. Based on the preset IoT coding rules, the structural role feature set is processed by node identifier mapping and hierarchical coding combination to generate a unified coding identifier for each entity. Perform association sorting and object mapping operations on the unified encoding identifier to construct the object encoding sequence.

4. The e-commerce order behavior risk assessment system based on IoT coding according to claim 3, characterized in that, The multi-layer neighborhood traversal operation and structural role mapping process specifically include: Based on the entity association structure, extract the neighborhood node set, node connection path set, node association frequency set and node behavior time set corresponding to each entity to construct the neighborhood structure set; Based on the neighborhood structure set, perform multi-level neighborhood traversal operation on each entity, extract the node connection relationship, path propagation relationship, hierarchical association relationship and behavior time association relationship of each entity in different neighborhood levels, and generate a multi-level neighborhood structure set; An improved Struc2Vec algorithm, which incorporates association frequency influence factors, behavior time decay factors, and path propagation influence factors, is used to perform structural similarity calculation operations on each entity in a multi-layer neighborhood structure set. Based on the traditional Struc2Vec algorithm, which calculates structural similarity based on static neighborhood structural distance, the improved Struc2Vec algorithm performs a dynamic weighted update operation on the structural distance between entities according to the set of node association frequency, the set of node behavior time, and the set of node connection paths, and generates a structural distance matrix. Based on the structural distance matrix, structural role clustering is performed on each entity to extract target entities whose structural distances meet the preset distance conditions and generate a set of structural role nodes. Based on the set of structural role nodes, perform structural role mapping operation on each entity, extract the structural connection features, hierarchical distribution features and neighborhood structural features corresponding to each entity, and generate a set of structural role features.

5. The e-commerce order behavior risk assessment system based on IoT coding according to claim 1, characterized in that, The association mapping module includes: Based on the object encoding sequence, the order object, transaction object, payment object, logistics object, user object and device object corresponding to each unified code identifier are extracted, and a candidate association node set is constructed according to the association relationship between each object; Among them, the relationships represent order relationships, transaction relationships, payment relationships, access relationships, device connection relationships, and logistics flow relationships; Based on the candidate associated node set, count the order objects, payment objects, logistics objects, user objects and device objects that are commonly associated among the associated nodes, and construct a node association relationship set; An improved SimRank algorithm is used to perform similarity propagation calculation on the set of node associations, calculate the corresponding node propagation similarity value, and generate the node similarity propagation result. Based on the node similarity propagation results, multiple rounds of similarity propagation iterative update operations are performed on each associated node. Based on the updated node propagation similarity value, target associated nodes that meet the preset propagation conditions are extracted, and an associated propagation node set is generated. Based on the set of associated propagation nodes, the relationships between the associated nodes are filtered to generate the target set of relationships; Based on the target association set and node propagation similarity value, perform relationship edge mapping operation on each target association node to establish the corresponding association relationship edges between each target association node and construct the order association graph.

6. The e-commerce order behavior risk assessment system based on IoT coding according to claim 5, characterized in that, The similarity propagation calculation of associated nodes specifically includes: Based on the node association set, extract the various association relationships corresponding to each associated node and construct a multi-relationship propagation set; Based on the multi-relation propagation set, the number of order-related nodes, transaction-related nodes, payment-related nodes, access-related nodes, device connection nodes, and logistics flow nodes corresponding to any two related nodes are counted respectively to generate multi-relation association results; An improved SimRank algorithm is used to perform similarity propagation calculation on the association results of multiple relationships, and the node propagation similarity value between each association node is calculated. In contrast to the traditional SimRank algorithm which performs node similarity propagation calculation based on a single relationship, the improved SimRank algorithm performs similarity propagation calculation based on multiple relationships. Based on the node similarity value corresponding to each association, a classification propagation calculation operation is performed on each associated node to generate the node similarity propagation result corresponding to each association.

7. The e-commerce order behavior risk assessment system based on IoT coding according to claim 5, characterized in that, The multi-round similarity propagation iterative update operation specifically includes: Based on the node similarity propagation results, the node propagation similarity values ​​and association relationships between each associated node are extracted to construct a node propagation matrix; Based on the node propagation matrix, the number of order-related nodes, transaction-related nodes, payment-related nodes, access-related nodes, device connection nodes, and logistics flow nodes corresponding to each related node are counted, and the node connectivity of each related node is calculated based on the statistical results. An improved label propagation algorithm is used to perform node propagation iterative update operations on each associated node in the node propagation matrix; Compared with the traditional label propagation algorithm which performs label propagation and update operations based on fixed neighboring nodes, the improved label propagation algorithm introduces a random walk mechanism. It determines the direction of random walk propagation based on the node connectivity and node propagation similarity value, and calculates the propagation update value between each associated node based on the product of the node propagation similarity value and the node connectivity. Based on the propagation update value, the similarity value of each associated node is propagated and an incremental update operation is performed to generate the propagation update result. The maximum and minimum values ​​in the propagation update results are normalized by interval, and the propagation offset between each associated node is calculated based on the normalization results. Based on the propagation offset value, multiple rounds of propagation convergence determination operations are performed on each associated node. When the difference between the propagation offset values ​​of two adjacent rounds is less than the preset convergence threshold, the corresponding associated node is extracted as the target associated node, and an associated propagation node set is generated.

8. The e-commerce order behavior risk assessment system based on IoT coding according to claim 1, characterized in that, The risk propagation module includes: Extract the corresponding relationship edges, node propagation similarity values, and node connectivity degrees between each associated node in the order association graph to construct a risk propagation relationship set; Based on the risk propagation relationship set, count the number of various types of relationships corresponding to each associated node, and generate node association statistics results; Based on the node association statistics, a personalized PageRank algorithm is used to analyze the risk impact of each associated node. The risk impact value of each associated node is calculated based on the node propagation similarity value, node connectivity and association relationship edge. Perform a propagation update operation on the risk impact values ​​between each associated node. Based on the association relationship edges, perform propagation accumulation processing on the risk impact values ​​corresponding to each associated node to generate risk propagation results. Based on the risk propagation results, a risk propagation node screening operation is performed on each associated node to extract associated nodes whose risk impact values ​​meet the preset propagation conditions, and a risk propagation node set is generated. For the corresponding relationships between each associated node in the risk propagation node set, perform an association range identification operation to generate a risk diffusion area set; Based on the risk diffusion region set, perform risk propagation feature extraction operation on each associated node to generate corresponding risk propagation features; Based on the characteristics of risk propagation, association mapping and propagation ranking are performed on each associated node to construct a risk association sequence.

9. The e-commerce order behavior risk assessment system based on IoT coding according to claim 1, characterized in that, The anomaly analysis module includes: Extract the risk propagation characteristics, node propagation similarity values, node connectivity, and risk impact values ​​corresponding to each associated node in the risk association sequence, and construct an anomaly analysis dataset; Based on the anomaly analysis dataset, the corresponding relationships between each associated node are statistically analyzed, and a node neighborhood set is constructed. The local outlier factor algorithm is used to perform local anomaly density analysis on each associated node in the node neighborhood set and calculate the outlier value of each associated node. Perform an abnormal neighborhood deviation identification operation on each associated node, extract associated nodes whose abnormal outlier values ​​meet the preset deviation conditions, and generate an abnormal neighborhood node set; Based on the abnormal neighborhood node set, correlation analysis is performed on the risk propagation characteristics, node propagation similarity values, node connectivity and risk impact values ​​of each associated node to generate an abnormal behavior feature set. Based on the abnormal behavior feature set, an abnormal behavior outlier determination operation is performed on each associated node to filter and obtain abnormal distribution results; Perform association mapping and risk ranking operations on the abnormal distribution results to construct a risk feature sequence.

10. The e-commerce order behavior risk assessment system based on IoT coding according to claim 1, characterized in that, The risk assessment module includes: Based on the risk characteristic sequence, the frequency of risk propagation, frequency of abnormal behavior, and frequency of association diffusion corresponding to each associated node are statistically analyzed to generate risk statistics results; Based on the risk statistics results, risk association mapping and node risk aggregation processing are performed on each associated node to extract the propagation risk characteristics, outlier risk characteristics, connection risk characteristics and diffusion risk characteristics corresponding to each associated node. According to the preset set of weight coefficients, the risk characteristics corresponding to each associated node are weighted and aggregated, and then normalized to obtain the risk score corresponding to each e-commerce order. According to the preset level classification rules, the risk score is subjected to interval mapping and risk level classification operations to generate the order risk assessment result.

Images