An e-commerce platform real-time transaction anti-fraud system fusing artificial intelligence and behavior analysis

Abstract

This invention belongs to the field of e-commerce transaction security and network security technology, specifically relating to a real-time anti-fraud system for e-commerce platforms that integrates artificial intelligence and behavioral analysis. The system includes a real-time behavioral data acquisition module, a multi-dimensional feature fusion processing module, an intelligent risk scoring module, a real-time decision-making and intervention module, and a model dynamic optimization module, connected sequentially. By collecting user interaction behavior, transaction, and environmental data across the entire user journey, a multi-dimensional feature vector is constructed that integrates static profiles, temporal dynamic features, and real-time risk factors. A neural network model based on a combination of temporal convolutional networks and attention mechanisms is used for real-time risk scoring. A dynamic policy engine generates tiered handling instructions based on the score and adjustable thresholds. The model is continuously and incrementally optimized based on feedback data.

Description

Technical Field

[0001] This invention relates to the field of e-commerce transaction security and network security, and in particular to a real-time anti-fraud system for e-commerce platforms that integrates artificial intelligence and behavioral analysis. Background Technology

[0002] With the rapid development of e-commerce and the continuous expansion of online transaction volume, various transaction fraud activities are increasingly showing a trend of professionalization, concealment, and dynamism. Currently, e-commerce platforms generally face multiple fraud risks, including fake transactions, account theft, malicious cash-out, and fake reviews / reputation manipulation. These behaviors not only directly infringe upon the property security of consumers and merchants but also seriously disrupt the platform's transaction order and damage its reputation. Traditional anti-fraud methods mainly rely on rule-based filtering systems and static blacklist mechanisms. These systems are slow to respond and update rules, making them difficult to adapt to constantly evolving fraud methods. Furthermore, they have significant shortcomings in real-time performance and accuracy, often resulting in high false positive and false negative rates, and are no longer able to meet the real-time risk control needs of large-scale, high-concurrency e-commerce scenarios.

[0003] In recent years, although artificial intelligence technology has been applied to some extent in the field of risk identification, most existing systems are still limited to offline analysis of single-dimensional transaction data, lacking real-time dynamic modeling of the entire user behavior sequence. Meanwhile, behavioral analysis often focuses on explicit operation logs, failing to effectively integrate implicit interaction timing, environmental context, and other multimodal information, resulting in insufficient accuracy in identifying complex and organized fraudulent behaviors. Furthermore, traditional methods often struggle to balance real-time performance with model generalization ability, unable to complete high-dimensional feature extraction and fraud probability assessment within seconds. Summary of the Invention

[0004] This invention specifically relates to a real-time anti-fraud system for e-commerce platforms that integrates artificial intelligence and behavioral analysis. It aims to achieve real-time, accurate identification and adaptive defense against e-commerce transaction fraud through a sequentially connected module comprising a real-time behavioral data acquisition module, a multi-dimensional feature fusion processing module, an intelligent risk scoring module, a real-time decision-making and intervention module, and a dynamic model optimization module. This also improves the detection accuracy and overall risk mitigation capabilities of the system in complex fraud scenarios. To achieve the above objectives, the specific technical solution of this invention's real-time anti-fraud system for e-commerce platforms integrating artificial intelligence and behavioral analysis is as follows: A real-time transaction anti-fraud system for e-commerce platforms that integrates artificial intelligence and behavioral analysis includes: a real-time behavioral data acquisition module, a multi-dimensional feature fusion processing module, an intelligent risk scoring module, a real-time decision-making and intervention module, and a model dynamic optimization module; The real-time behavior data acquisition module is used to capture the user's full sequence of interactive behavior events in the current transaction chain in real time, and simultaneously acquire the corresponding transaction data, account attribute data and environmental context data to form a raw behavior log stream with time-series markers; The multi-dimensional feature fusion processing module is connected to the real-time behavior data acquisition module and is used to receive the raw behavior log stream and perform real-time cleaning and standardization. The multi-dimensional feature fusion processing module also includes a behavior sequence construction unit, a static feature extraction unit, and a dynamic feature calculation unit. The behavior sequence construction unit is used to construct a time-series behavior sequence based on user sessions. The static feature extraction unit is used to extract historical static profile features of users. The dynamic feature calculation unit is used to calculate, in real-time, time-series dynamic features, including operation frequency, behavior entropy, page jump anomaly degree, and transaction interval dispersion, based on the time-series behavior sequence, and concatenates the static profile features with the time-series dynamic features to generate a multi-dimensional fusion feature vector. The multi-dimensional fusion feature vector incorporates real-time risk factor features extracted from environmental context data. The intelligent risk scoring module is connected to the multi-dimensional feature fusion processing module, and includes an online inference engine and a fraud assessment model. The online inference engine is used to load the fraud assessment model and perform real-time calculation on the multi-dimensional fused feature vector. The fraud assessment model is a neural network model based on a combination of temporal convolutional networks and attention mechanisms, which is trained to output a real-time probability score representing the fraud risk of the current transaction behavior. The real-time decision-making and intervention module is connected to the intelligent risk scoring module and includes a dynamic strategy engine. The real-time decision-making and intervention module is used to receive the real-time probability score, compare it with the risk control rule database and the graded threshold, generate a handling instruction including release, enhanced verification, manual review or automatic interception, and send it to the transaction gateway for execution. The model dynamic optimization module is connected to the intelligent risk scoring module and the real-time behavior data acquisition module for feedback. It is used to perform periodic or triggered incremental learning and parameter optimization on the fraud assessment model based on the result data confirmed by manual review as incremental samples.

[0005] Furthermore, the full sequence of interactive behavior events includes: page browsing trajectory, mouse movement and click sequence, keyboard input rhythm, page dwell time, page scrolling mode, and order information modification history.

[0006] Furthermore, the behavioral entropy refers to the information entropy calculated based on the probability distribution of various user operation events within a preset time window, which is used to quantify the randomness and abnormality of user behavior.

[0007] Furthermore, the fraud assessment model adopts an encoder-decoder architecture, wherein the encoder is composed of a temporal convolutional network and a bidirectional long short-term memory network connected in series, used to extract temporal features of the behavior sequence; the decoder adopts a multi-head self-attention mechanism, used to weight and aggregate the temporal features and output the real-time probability score.

[0008] Furthermore, the decision logic of the dynamic strategy engine is configured as follows: if the real-time probability score is lower than the first threshold, a release instruction is output; if the score is between the first threshold and the second threshold, an enhanced verification instruction is output; if the score is between the second threshold and the third threshold, a transfer to manual review instruction is output; if the score is higher than the third threshold, a real-time interception and account freezing instruction is output.

[0009] Furthermore, the first threshold, the second threshold, and the third threshold can be dynamically matched and adjusted by the dynamic strategy engine from the risk control rule database based on user level, transaction product category, transaction time period, and marketing activity status.

[0010] Furthermore, the model dynamic optimization module employs an elastic weight consolidation algorithm for incremental learning to balance the knowledge of new and old fraud patterns.

[0011] Furthermore, it also includes a visual analysis interface to display real-time risk status, details of fraud cases, model performance indicators, and statistics on handling results to operations personnel.

[0012] Furthermore, the real-time risk factor features include the anomaly score of the device logging in this time, the geographical location risk score of the network access IP this time, and the risk baseline coefficient of the current trading period.

[0013] Furthermore, the system is deployed with a microservice architecture, where each module is an independently scalable microservice, and communicates asynchronously with the stream processing platform through a message middleware.

[0014] Compared with existing technologies, the advantages of this invention are as follows: This invention captures user's full-sequence interactive behavior events and multi-dimensional data through a real-time behavior data acquisition module, forming a raw behavior log stream with time-series tags, providing a panoramic data foundation for risk identification; then, a multi-dimensional feature fusion processing module combines behavior sequence construction, static profile extraction, and dynamic feature calculation, and incorporates real-time risk factor features to generate a multi-dimensional fusion feature vector that comprehensively reflects the user's historical patterns, real-time behavior, and current environmental risks; after this feature vector is input into the intelligent risk scoring module, it undergoes high-order temporal pattern mining and key feature focusing through a fraud assessment model based on a combination of temporal convolutional networks and attention mechanisms, providing a real-time probability score; this score is then used by the dynamic strategy engine of the real-time decision-making and intervention module to generate differentiated handling instructions based on dynamically adjustable grading thresholds and risk control rules; simultaneously, the model dynamic optimization module performs incremental learning on the model based on feedback data to ensure that the system can continuously adapt to new fraud patterns; finally, all modules work collaboratively in a microservice architecture, ensuring the system's high concurrency processing capability and scalability through asynchronous communication. Attached Figure Description

[0015] Figure 1 This is a flowchart illustrating the overall system workflow of the present invention. Figure 2 This is a flowchart of the intelligent scoring module of the present invention; Figure 3 This is a flowchart illustrating the dynamic strategy decision-making process of the present invention. Figure 4 This is a flowchart of the incremental learning process of the model in this invention. Detailed Implementation

[0016] To make the objectives, technical solutions, and advantages of the present invention clearer, the following description, in conjunction with preferred embodiments and appendices, provides further details. Figure 1-4 This invention will be described in detail. This embodiment is only for explaining the invention and is not intended to limit the scope of protection of the invention.

[0017] Example 1 This embodiment details a real-time transaction anti-fraud system for e-commerce platforms integrating artificial intelligence and behavioral analysis, including: a real-time behavior data acquisition module, a multi-dimensional feature fusion processing module, an intelligent risk scoring module, a real-time decision-making and intervention module, and a model dynamic optimization module. The real-time behavior data acquisition module is used to capture the user's full-sequence interactive behavior events in the current transaction chain in real time, and simultaneously acquire corresponding transaction data, account attribute data, and environmental context data to form a raw behavior log stream with time-series tags. The multi-dimensional feature fusion processing module is connected to the real-time behavior data acquisition module and is used to receive the raw behavior log stream and perform real-time cleaning and standardization. The multi-dimensional feature fusion processing module also includes a behavior sequence construction unit, a static feature extraction unit, and a dynamic feature calculation unit. The behavior sequence construction unit is used to construct a time-series behavior sequence according to user sessions. The static feature extraction unit is used to extract historical static profile features of the user. The dynamic feature calculation unit is used to calculate time-series dynamic features, including operation frequency, behavior entropy, page jump anomaly degree, and transaction interval dispersion, based on the time-series behavior sequence, and integrates the static profile features with the time-series dynamic features. A multi-dimensional fused feature vector is generated by dynamic feature concatenation; the multi-dimensional fused feature vector incorporates real-time risk factor features extracted from environmental context data; the intelligent risk scoring module, connected to the multi-dimensional feature fusion processing module, includes an online inference engine and a fraud assessment model; the online inference engine loads the fraud assessment model and performs real-time calculation on the multi-dimensional fused feature vector; the fraud assessment model is a neural network model based on a combination of temporal convolutional networks and attention mechanisms, trained to output a real-time probability score representing the fraud risk of the current transaction behavior; the real-time decision-making and intervention module, connected to the intelligent risk scoring module, includes a dynamic strategy engine; the real-time decision-making and intervention module receives the real-time probability score, compares it with the risk control rule database and tiered thresholds, generates a handling instruction including release, enhanced verification, manual review, or automatic interception, and sends it to the transaction gateway for execution; the model dynamic optimization module, connected to the intelligent risk scoring module and the real-time behavior data acquisition module, is used to perform periodic or triggered incremental learning and parameter optimization on the fraud assessment model based on the manually verified result data as incremental samples. In this embodiment, the system is deployed in the transaction risk control backend of a large e-commerce platform. When a user initiates a transaction, the real-time behavior data collection module automatically captures fine-grained behavioral events such as mouse clicks, keyboard input rhythm, and page dwell time throughout the entire process from browsing products, adding items to the cart, modifying orders, to payment confirmation, using front-end probes embedded in web and mobile applications. Simultaneously, this module obtains data such as the transaction amount, payee, user's historical credit history, login device fingerprint, and IP address from the order, user, and risk control data centers via backend interfaces.All these logs with millisecond-level timestamps are pushed in real-time to the multi-dimensional feature fusion processing module. This module first cleans the data (e.g., deduplication, format standardization), and then the behavior sequence construction unit sorts the behaviors within the same session by time, forming a coherent behavior sequence. The static feature extraction unit extracts long-term features such as the user's credit rating and historical transaction frequency from the user profile database. The dynamic feature calculation unit performs real-time calculations on the newly generated time-series behavior sequence, deriving dynamic indicators such as "a surge in operation frequency in the past 5 minutes" and "page jump paths do not conform to common patterns." These features, along with real-time risk factors extracted from the login device and IP information, are concatenated into a high-dimensional feature vector. This vector is immediately sent to the online inference engine of the intelligent risk scoring module. The engine loads the pre-trained TCN-Attention neural network model, calculates the vector within milliseconds, and outputs a fraud risk score of 0.85. This score is then sent to the real-time decision-making and intervention module. The module's dynamic strategy engine automatically matched a stricter risk threshold based on the fact that the current product was a high-value digital item. Since the score of 0.85 exceeded the "automatic interception" threshold, the engine immediately generated an interception command and terminated the transaction through the transaction gateway. Simultaneously, all data, characteristics, scores, and handling results of this transaction were recorded in the case database. One day later, the model's dynamic optimization module was activated. It used cases confirmed by manual review as misjudgments or omissions within the past 24 hours as new training samples to incrementally train the fraud assessment model, fine-tuning its parameters to make it more sensitive to new fraud methods.

[0018] In this embodiment, the page browsing trajectory records the complete URL jump sequence from the homepage to the product details page, and then to the shopping cart page, as well as the entry and exit times on each page. Mouse movement and click sequences record the cursor's trajectory near the "Buy Now" button (e.g., repeated movement, hesitation), the precise coordinates of the button clicks, and the force applied (if supported). Keyboard input rhythm records the keystroke intervals when the user enters their name, phone number, and address while filling in shipping information, identifying any abnormally rapid "copy-paste" input. Page dwell time precisely records the dwell time on the payment password input box (abnormally short dwell times may be due to automated scripting). Page scrolling pattern records whether the user scrolls quickly and steadily on the product details page (similar to machine behavior). Order information modification history records whether the user changed their shipping address multiple times in a short period before payment. By collecting this detailed, low-level interactive behavior data, the system can construct a deeper user behavior profile that goes far beyond traditional "transaction amount, location, and frequency" data. These data can effectively reveal the micro-behavioral differences between manual operations and automated machine script operations, as well as between real users and account thieves. They provide key and direct judgment criteria for subsequent models to identify hidden frauds such as "accounts being stolen and then traded by operators other than the account holder" or "machine order brushing," greatly enriching the feature dimensions of risk identification.

[0019] In this embodiment, the specific calculation process of behavioral entropy is as follows: For a user on the checkout page, the dynamic feature calculation unit extracts all front-end interaction events within the last 2 minutes and categorizes them into several types such as "click," "input," "scroll," and "move." The number of occurrences of each type of event is counted, and its probability distribution within that time period is calculated. Subsequently, the entropy value is calculated according to the information entropy formula H(X)=-ΣP(x_i)logP(x_i). For example, a normal shopping user's behavior might involve "clicking" a few times, "inputting" an address, and occasionally "scrolling" to view the content; the entropy value would be within a moderately stable range. However, a program-controlled order-brushing script's behavior might be extremely regular (e.g., only repetitive, fixed-interval "click" events), with a concentrated probability distribution, resulting in an abnormally low calculated entropy value. Conversely, a hacker exhibiting extreme anxiety and confusion on the page (impurely clicking, repeatedly inputting and deleting, and irregular scrolling) might have an abnormally high behavioral entropy value. Behavioral entropy provides an objective indicator for quantifying the "orderliness" or "chaos" of user behavior. This metric does not rely on any pre-set business rules, but rather describes behavioral patterns purely from an information theory perspective. Using it as a key dynamic feature input model can very effectively help the system identify sessions with overly regular (e.g., bots) or overly random and anomalous (e.g., unfamiliar operators) behavioral patterns. This allows it to capture fraudulent behaviors that may appear normal in their specific actions but reveal anomalies in their behavioral rhythm and statistical distribution, thus enhancing the system's ability to identify atypical and highly deceptive fraud.

[0020] In this embodiment, the specific structure of the fraud assessment model is as follows: The encoder first receives a feature vector derived from the behavioral sequence. A Temporal Convolutional Network (TCN) layer operates first, utilizing dilated causal convolutions to quickly scan the entire sequence with a larger receptive field, capturing long-term patterns such as "short browsing time followed by rapid payment." The TCN output is then fed into a Bidirectional Long Short-Term Memory (BiLSTM) layer, which processes the sequence again from front to back and back to front, finely capturing the contextual dependencies between behaviors, such as the risk pattern that might arise from "changing the address" immediately followed by "changing the payment method." The encoder ultimately outputs a feature representation containing overall sequence information. Subsequently, the decoder's multi-head self-attention mechanism begins operation, allowing the model to automatically "focus" on the parts of the encoder output most relevant to fraud. For example, it might assign a very high attention weight to the short behavioral feature of "repeatedly changing bank card numbers on the payment page," while assigning a lower weight to the behavior of "normal browsing on the product page." By pooling these weighted key features, the model finally outputs a fraud probability score through a fully connected layer. This "TCN+BiLSTM+Attention" encoder-decoder architecture combines the advantages of different neural network structures. TCN excels at efficiently capturing long-term dependencies, BiLSTM is adept at modeling local temporal context, and the attention mechanism can dynamically focus on the most critical risk segments. This combination enables the model to not only understand the global flow of user behavior sequences but also to deeply analyze the details of local suspicious segments and their significance in the overall sequence. This allows for more accurate and robust risk assessment of complex, lengthy, and interfering fraud sequences (such as account thieves imitating some of the original user's habits to pass simple rule checks).

[0021] In this embodiment, the decision-making logic of the dynamic policy engine is specifically configured. The system presets three risk thresholds: T1 (low risk threshold, e.g., 0.3), T2 (medium risk threshold, e.g., 0.6), and T3 (high risk threshold, e.g., 0.85). When a transaction is scored 0.25 by the model, since 0.25 < T1, the engine immediately generates a "release" instruction and the transaction proceeds normally. When the score is 0.45, since T1(0.3) < 0.45 < T2(0.6), the engine generates an "enhanced verification" instruction, and the system pops up an additional slider verification code or knowledge quiz verification before the payment link. When the score is 0.75, since T2(0.6) < 0.75 < T3(0.85), the engine generates a "transfer to manual review" instruction, and the transaction order is suspended and pushed to the review queue of the risk control operation personnel. At the same time, the user is notified via SMS that the order is being processed. When the score is 0.90, since 0.90 > T3(0.85), the engine immediately generates a "real-time interception and account freeze" instruction, the transaction is blocked in real time, and the user account is temporarily frozen, requiring identity verification. This hierarchical decision-making mechanism transforms the single and rigid "intercept / release" judgment into a multi-level and progressive risk response system. It treats transactions with different degrees of suspicion differently: it releases low-risk transactions without feeling, ensuring the user experience; it applies lightweight verification to medium-risk transactions to complete the secondary confirmation with a very small increase in friction; it transfers high-risk transactions to manual in-depth review, taking into account both the rigor and flexibility of risk control; and it immediately automatically blocks extremely high-risk transactions to prevent losses.

[0022] In this embodiment, the hierarchical thresholds (T1, T2, T3) are not fixed. When making a decision, the dynamic policy engine dynamically matches the thresholds from the risk control rule database according to the multi-dimensional attributes of the current transaction. For example, for a "diamond member" user, the T3 threshold may be increased to 0.9 (more lenient) to reduce the misinterference to high-quality users. For the transaction commodity category of "virtual vouchers", since it is easily used for laundering stolen goods, the T2 and T3 thresholds for this category may be lowered to 0.5 and 0.8 (more stringent). During the high-risk period from 2 am to 5 am, all thresholds may be uniformly lowered by 0.05. During the "Double Eleven Promotion" on the platform, to ensure smooth transactions, the thresholds may be temporarily and moderately increased. The dynamic threshold mechanism greatly enhances the adaptability and accuracy of the system. By allowing the thresholds to be flexibly adjusted according to key variables such as user value, commodity attributes, time, and activity status, the system can achieve differentiated risk tolerances. For example, it gives more trust to high-value users and normal periods, and adopts a more cautious attitude towards high-risk commodities and high-risk periods. This makes the system's risk control strategy no longer rigid, but able to intelligently adapt to the needs of different stages and different scenarios of the platform business, maximizing business benefits and user experience under the premise of overall risk controllability.

[0023] In this embodiment, the model dynamic optimization module performs incremental learning once a week. To prevent the model from forgetting previously learned "credit card fraud" patterns when learning new "fake logistics tracking number fraud" patterns, the module employs the Elastic Weight Consolidation (EWC) algorithm. Before training, the algorithm calculates the importance weight of each parameter in the existing model for the learned task (identifying historical fraud patterns). When training with new samples, EWC adds a regularization term to the loss function, which "penalizes" parameters that are crucial to the historical task for large changes. In this way, while optimizing the model to better fit new fraud samples, the connection weights that are essential for memorizing old patterns are preserved to the greatest extent. Using the EWC algorithm for incremental learning allows the system to smoothly and continuously absorb new fraud knowledge without losing its original core defense capabilities, ensuring that the system's anti-fraud capabilities continuously improve over time.

[0024] In this embodiment, the system provides a visual analysis interface for the risk control operations team. This interface includes a real-time updated panoramic monitoring dashboard displaying key indicators such as the overall transaction risk score distribution, real-time interception rate, and backlog of manual review queues. A filterable and searchable list of fraud cases displays each intercepted or flagged transaction, along with its behavioral sequence replay, a heatmap of the model scoring criteria (showing which behavioral characteristics led to high scores), and the final handling result. A model performance monitoring panel displays the accuracy and recall curves of the model across different demographics and product categories. Finally, a handling effect statistics dashboard analyzes the false positive and false negative rates under different handling strategies (such as different thresholds).

[0025] In this embodiment, real-time risk factor features are specifically calculated and incorporated into the feature vector. The anomaly score of the currently logged-in device: The system checks the device ID, browser fingerprint, and installed font list of the currently logged-in device and compares them with the user's historically frequently used devices to calculate a similarity score (0-1). The lower the similarity, the higher the anomaly score. The geographical location risk score of the currently accessing IP: The system queries the geographical location of the IP and compares it with the user's frequently used location and delivery address to determine if there is a login from a different location; it also checks whether the IP is in the blacklist proxy IP database, and comprehensively derives a risk score. The risk baseline coefficient for the current transaction period: Based on historical data, the system calculates that the probability of fraudulent transactions occurring at "3 AM" is 2.5 times the daily average, so the baseline risk coefficient for this period is 2.5. These three real-time factors are input into the model along with behavioral features. A behavioral sequence may appear normal, but if it occurs on a device never seen before, from an IP in a high-risk area, and during an abnormal time period late at night, its overall risk will be significantly amplified. Conversely, a slightly unusual behavior, if it occurs on a frequently used device, in a frequently used location, and at a frequently used time, may be a random, unconventional operation by the user. By incorporating these environmental factors, it can more effectively identify fraud scenarios that are strongly correlated with the environment and are difficult to detect by simply analyzing behavioral sequences (such as logging in from a different location after account theft, device fingerprint forgery, etc.).

[0026] In this embodiment, the entire system is deployed on a cloud computing platform using a microservice architecture. The five core modules—real-time behavioral data collection, multi-dimensional feature fusion processing, intelligent risk scoring, real-time decision-making and intervention, and dynamic model optimization—are broken down into five independent, deployable, and scalable microservices. These microservices do not directly call each other but communicate asynchronously through a highly available message broker (such as Kafka). For example, the collection module sends logs to the "Behavioral Data" topic, the feature processing module subscribes to this topic for processing, and then sends the feature vectors to the "Feature Vector" topic, the scoring module subscribes and performs calculations, and so on. Each microservice runs in a container with independent computing and storage resources. During peak sales events like "Double Eleven," multiple instances can be quickly scaled up for computationally intensive microservices like "Intelligent Risk Scoring" to handle peak traffic, while other modules remain unchanged. Even if the "Dynamic Model Optimization" module temporarily stalls due to heavy training tasks, it will not affect the normal operation of other core microservices on the front-end transaction chain; messages will be temporarily stored in a queue. The algorithm of the "Feature Processing" module can be upgraded and deployed independently without causing the entire system to shut down. Different microservices can choose the most suitable programming language and technology stack based on their characteristics.

[0027] Example 2 This embodiment describes a specific implementation of the system in a cloud-based SaaS (Software as a Service) deployment model. Unlike the self-built model of a single large platform in Embodiment 1, the system in this embodiment serves as a third-party risk control service, providing real-time anti-fraud capabilities to multiple small and medium-sized e-commerce platforms.

[0028] The service provider deploys the system on a public cloud. The real-time behavioral data acquisition module is packaged into a lightweight SDK (Software Development Kit). Each e-commerce platform (i.e., tenant) integrating the service embeds its SDK into its own website and mobile application. The SDK is responsible for collecting user behavior data, encrypting it according to a unified protocol, and sending it to the cloud-based multi-dimensional feature fusion processing module via API. This module features a multi-tenant architecture with a built-in tenant isolation mechanism to ensure complete data independence across different platforms. Based on the tenant ID, it calls the corresponding static feature extraction unit (whose data comes from the tenant's historical database or is periodically updated by the tenant) and tenant-specific dynamic feature calculation rules. The generated feature vectors are then fed into a shared pool of intelligent risk scoring modules, whose model parameters can be individually fine-tuned for each tenant. The TCN-Attention base model used by the scoring module is pre-trained by the service provider based on massive amounts of multi-industry data. Each tenant can fine-tune the last layer of the model using their own limited labeled data to achieve a combination of general capabilities and personalized needs. Upon receiving the score, the real-time decision-making and intervention module invokes the risk control rule database configured independently for the corresponding tenant. This database stores the tiered thresholds and handling strategies customized by the tenant administrators via the web console. The generated handling instructions (such as "intercept") are returned in real-time to the tenant's e-commerce platform transaction system for execution via a callback interface. The model dynamic optimization module runs centrally in the cloud, but training data is isolated by tenant. It can independently launch incremental learning tasks based on each tenant's feedback data, or utilize an anonymized cross-tenant mode for federated learning to improve the generalization ability of the base model while strictly protecting the data privacy of each tenant. The visual analysis interface is provided as a multi-tenant SaaS management backend, allowing risk control administrators on each platform to log in independently and view their platform's risk reports, case details, and model performance.

[0029] Example 3 This embodiment describes an optimized implementation of the system in a specific business scenario—cross-border e-commerce transactions—focusing on addressing unique risks in cross-border transactions, such as currency arbitrage, cross-border fraud, and logistics fraud.

[0030] In the cross-border e-commerce environment, the real-time behavioral data acquisition module additionally captures cross-border related behavioral events, such as frequent switching of delivery countries / regions, repeated comparison of prices in different currencies, and input of delivery information in non-native languages. The feature engineering in the multi-dimensional feature fusion processing module provides targeted enhancements. The static feature extraction unit extracts features such as the user's historical cross-border transaction records, customs risk levels of frequently used delivery locations, and the issuing country of the payment card. The dynamic feature calculation unit calculates dynamic features specific to cross-border scenarios, such as "number of exchange rate queries in this session," "difference between the target delivery address and the country where the IP is located," and "fluency of inputting non-native language addresses (assessed through input intervals and modification counts)." The real-time risk factor feature strengthens the geographical risk dimension, including not only the IP's geographical location but also the overall online fraud index of the country where the IP is located, the postal risk score of the delivery address's region, and whether the current exchange rate fluctuation is within a historical anomaly window. The fraud assessment model in the intelligent risk scoring module was trained using a large number of labeled cross-border e-commerce fraud samples, enabling it to learn unique patterns such as "exploiting exchange rate differences to snag limited-edition items and resell them" and "using stolen overseas credit cards to purchase and ship to high-risk regions." The real-time decision-making and intervention module's strategies are also more targeted, with its risk control rule database pre-setting differentiated thresholds for different countries, logistics routes, and product categories (such as high-tariff goods). For example, for electronic products shipped to certain high-fraud-rate regions, the T2 (manual review threshold) is automatically lowered. Handling instructions, in addition to routine operations, may include "triggering customs declaration information review" and "requiring additional identity verification (such as a passport)." The model dynamic optimization module pays special attention to false positives and false negatives from cross-border transaction scenarios, ensuring the model's ability to discriminate in this area continuously evolves. By introducing unique behaviors, static attributes, dynamic indicators, and environmental factors strongly correlated with cross-border e-commerce risks, the system constructs a multi-dimensional perception system specifically for cross-border transaction risks. The specialized model trained on this basis can more accurately identify fraud patterns that are uncommon or have different weights in traditional domestic e-commerce models. With highly scenario-based risk control strategies, the system can achieve more refined risk management, such as effectively combating fraudulent activities that exploit international information gaps, payment loopholes, and logistical complexities while promoting normal cross-border trade.

[0031] It is understood that the present invention has been described through some embodiments, and those skilled in the art will recognize that various changes or equivalent substitutions can be made to these features and embodiments without departing from the spirit and scope of the invention. Furthermore, under the teachings of the present invention, these features and embodiments can be modified to adapt to specific situations and materials without departing from the spirit and scope of the invention. Therefore, the present invention is not limited to the specific embodiments disclosed herein, and all embodiments falling within the scope of the claims of this application are within the protection scope of the present invention.

Claims

1. A real-time transaction anti-fraud system for e-commerce platforms that integrates artificial intelligence and behavioral analysis, characterized in that: include: The system includes a real-time behavioral data acquisition module, a multi-dimensional feature fusion processing module, an intelligent risk scoring module, a real-time decision-making and intervention module, and a model dynamic optimization module. The real-time behavior data acquisition module is used to capture the user's full sequence of interactive behavior events in the current transaction chain in real time, and simultaneously acquire the corresponding transaction data, account attribute data and environmental context data to form a raw behavior log stream with time-series markers; The multi-dimensional feature fusion processing module is connected to the real-time behavior data acquisition module and is used to receive the original behavior log stream and perform real-time cleaning and standardization. The multi-dimensional feature fusion processing module further includes a behavior sequence construction unit, a static feature extraction unit, and a dynamic feature calculation unit. The behavior sequence construction unit is used to construct a time-series behavior sequence based on user sessions. The static feature extraction unit is used to extract historical static profile features of users. The dynamic feature calculation unit is used to calculate time-series dynamic features, including operation frequency, behavior entropy, page jump anomaly degree, and transaction interval dispersion, based on the time-series behavior sequence in real time, and concatenate the static profile features with the time-series dynamic features to generate a multi-dimensional fusion feature vector. The multi-dimensional fusion feature vector incorporates real-time risk factor features extracted from environmental context data. The intelligent risk scoring module is connected to the multi-dimensional feature fusion processing module, and includes an online inference engine and a fraud assessment model. The online inference engine is used to load the fraud assessment model and perform real-time calculation on the multi-dimensional fused feature vector. The fraud assessment model is a neural network model based on a combination of temporal convolutional networks and attention mechanisms, which is trained to output a real-time probability score representing the fraud risk of the current transaction behavior. The real-time decision-making and intervention module is connected to the intelligent risk scoring module and includes a dynamic strategy engine. The real-time decision-making and intervention module is used to receive the real-time probability score, compare it with the risk control rule database and the graded threshold, generate a handling instruction including release, enhanced verification, manual review or automatic interception, and send it to the transaction gateway for execution. The model dynamic optimization module is connected to the intelligent risk scoring module and the real-time behavior data acquisition module for feedback. It is used to perform periodic or triggered incremental learning and parameter optimization on the fraud assessment model based on the result data confirmed by manual review as incremental samples.

2. The real-time transaction anti-fraud system for e-commerce platforms integrating artificial intelligence and behavioral analysis as described in claim 1, characterized in that, The full sequence of interactive events includes: page browsing trajectory, mouse movement and click sequence, keyboard input rhythm, page dwell time, page scrolling mode, and order information modification history.

3. The real-time transaction anti-fraud system for e-commerce platforms integrating artificial intelligence and behavioral analysis as described in claim 1, characterized in that, The behavioral entropy refers to the information entropy calculated based on the probability distribution of various user operation events within a preset time window, and is used to quantify the randomness and abnormality of user behavior.

4. The real-time transaction anti-fraud system for e-commerce platforms integrating artificial intelligence and behavioral analysis as described in claim 1, characterized in that, The fraud assessment model adopts an encoder-decoder architecture, wherein the encoder is composed of a temporal convolutional network and a bidirectional long short-term memory network connected in series, used to extract temporal features of the behavior sequence; the decoder adopts a multi-head self-attention mechanism, used to weight and aggregate the temporal features and output the real-time probability score.

5. The real-time transaction anti-fraud system for e-commerce platforms integrating artificial intelligence and behavioral analysis as described in claim 1, characterized in that, The decision logic of the dynamic strategy engine is configured as follows: if the real-time probability score is lower than the first threshold, a release command is output; if the score is between the first threshold and the second threshold, an enhanced verification command is output. If the score is between the second and third thresholds, an instruction to transfer the application to manual review will be output; if the score is higher than the third threshold, an instruction to block the application in real time and freeze the account will be output.

6. The real-time transaction anti-fraud system for e-commerce platforms integrating artificial intelligence and behavioral analysis as described in claim 5, characterized in that, The first threshold, the second threshold, and the third threshold can be dynamically matched and adjusted by the dynamic strategy engine from the risk control rule database based on user level, transaction product category, transaction time period, and marketing activity status.

7. The real-time transaction anti-fraud system for e-commerce platforms integrating artificial intelligence and behavioral analysis as described in claim 1, characterized in that, The model dynamic optimization module employs an elastic weight consolidation algorithm for incremental learning to balance knowledge of new and old fraud patterns.

8. The real-time transaction anti-fraud system for e-commerce platforms integrating artificial intelligence and behavioral analysis as described in claim 1, characterized in that, It also includes a visual analysis interface to show operations personnel real-time risk status, details of fraud cases, model performance indicators, and statistics on handling results.

9. The real-time transaction anti-fraud system for e-commerce platforms integrating artificial intelligence and behavioral analysis as described in claim 1, characterized in that, The real-time risk factor features include the anomaly score of the device logging in this time, the geographical location risk score of the network access IP this time, and the risk baseline coefficient of the current trading session.

10. The real-time transaction anti-fraud system for e-commerce platforms integrating artificial intelligence and behavioral analysis according to claim 1, characterized in that, The system is deployed in a microservice architecture, with each module being an independently scalable microservice, and communicating asynchronously with the stream processing platform through a message middleware.

Images