Data transaction risk control method and device, medium and product

Abstract

The application discloses a data transaction risk control method and device, medium and product. The method comprises the following steps: collecting key behaviors of a target user in a data transaction platform, generating a behavior event record corresponding to each behavior, arranging all the records in chronological order, generating a behavior chain, analyzing the behaviors in the chain, and if there is a preset abnormal behavior mode, marking the data assets in the data transaction platform corresponding to the abnormal behavior as target assets; performing directional watermark inspection on the target user and the target assets, obtaining candidate data hit by the inspection; extracting a receiver fingerprint from the candidate data, and respectively analyzing the receiver fingerprint with all delivered data watermarks of the target user and all delivered data watermarks of the target assets to determine user correlation and asset correlation; and if any of the user correlation and the asset correlation satisfies a leakage condition, automatically freezing the corresponding transaction of the target user. The method can comprehensively guarantee the data asset safety and transaction compliance of the data transaction platform.

Description

Technical Field

[0001] This disclosure relates to the field of data transaction management and control technology, and in particular to a data transaction risk control and management method, device, medium, and product. Background Technology

[0002] The data trading industry is currently experiencing rapid development, with a large trading volume. However, the proportion of compliant transactions on the exchange is low. There are frequent instances of supply and demand sides bypassing the platform to complete transactions privately after connecting resources through the trading platform, which seriously squeezes the space of the on-exchange trading market.

[0003] Currently, the industry has widely adopted a number of mature security protection technologies to curb data transaction bypassing and prevent unauthorized data leakage and transfer. These technologies mainly include transaction data sandboxes for isolating and previewing data, digital watermarking technology for tracing data flow, blockchain behavior evidence storage technology for retaining user operation traces, and platform credit scoring systems for constraining user transaction behavior.

[0004] However, these protective technologies are all deployed independently to achieve risk prevention and control in single scenarios, lacking unified data interaction and linkage control logic, and failing to form a systematic risk control closed loop. Existing platforms rely solely on passive methods such as manual reporting and offline investigations to identify order-skipping behavior, and cannot proactively analyze and warn of abnormal behavior based on user transaction behavior data throughout the entire process; digital watermarking traceability results cannot be automatically integrated with the platform governance mechanism, and the handling of violations highly depends on manual operation, resulting in low efficiency and strong control lag. At the same time, the core links of user behavior detection, targeted watermark verification, credit rating adjustment, and platform access control are isolated from each other, making it impossible to achieve automated linkage control of risk identification, traceability verification, violation punishment, and access control. It is difficult to block order-skipping behavior vulnerabilities at the whole process level, and it cannot meet the actual application requirements of full-link, adaptive, and intelligent anti-order-skipping risk control management in the current data transaction scenario. Summary of the Invention

[0005] In view of this, the present disclosure provides a data transaction risk control method, device, medium, and product that can solve the problems of low accuracy in identifying data transaction risks, reliance on human manipulation, and poor risk control effect in the prior art.

[0006] In a first aspect, embodiments of this disclosure provide a data transaction risk control and management method, including: Collect key behaviors of target users in the data trading platform and generate structured behavior event records corresponding to each key behavior in real time; Arrange all the recorded behavioral events in chronological order to generate the behavioral chain of the target user; Analyze all behaviors in the behavior chain. If there is a preset abnormal behavior pattern in the behavior chain, record the data assets in the data trading platform corresponding to the abnormal behavior as the target assets. Perform targeted watermark inspections on the target users and target assets to obtain candidate data that has been hit by the inspection. Extract the recipient fingerprint from the candidate data, and perform correlation analysis between the recipient fingerprint and all delivered data watermarks of the target user to determine user correlation. The correlation analysis is performed between the recipient's fingerprint and all delivered data watermarks of the target asset to determine the asset correlation. If either the user correlation or the asset correlation meets the disclosure condition, the corresponding transaction of the target user will be automatically frozen.

[0007] Secondly, this disclosure also provides a data transaction risk control method, including: Collect key behaviors of target users in the data trading platform and generate structured behavior event records corresponding to each key behavior in real time; Arrange all the recorded behavioral events in chronological order to generate the behavioral chain of the target user; Analyze all behaviors in the behavior chain. If there is a preset abnormal behavior pattern in the behavior chain, record the data assets in the data trading platform corresponding to the abnormal behavior as the target assets. Perform targeted watermark inspections on the target users and target assets to obtain candidate data that has been hit by the inspection. If the recipient's fingerprint cannot be extracted from the candidate data, perform a data feature-level comparison analysis between the candidate data and the target asset to obtain the comparison result. Based on the risk level corresponding to the comparison results, the corresponding control strategy is invoked and executed.

[0008] Thirdly, this disclosure also provides a computer device, which adopts the following technical solution: The computer device includes: At least one processor; and, A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor; the instructions are executed by the at least one processor to enable the at least one processor to perform any of the data transaction risk control methods described above.

[0009] Fourthly, embodiments of this disclosure also provide a computer-readable storage medium storing computer instructions; the computer instructions are used to cause a computer to execute any of the data transaction risk control methods described above.

[0010] Fifthly, embodiments of this disclosure also provide a computer program product, including a computer program / instructions that, when executed by a processor, implement the steps of any of the methods described above.

[0011] The data transaction risk control method provided in this disclosure first collects key behaviors of target users in the data transaction platform, generates behavior event records corresponding to each behavior, arranges all records in chronological order to generate a behavior chain, analyzes the behaviors in the chain, and if a preset abnormal behavior pattern exists, records the data assets in the data transaction platform corresponding to the abnormal behavior as target assets; then, it performs targeted watermark inspection on target users and target assets to obtain candidate data that has been hit by the inspection; it extracts the recipient fingerprint from the candidate data and compares it with all delivered data watermarks of the target user and all delivered data watermarks of the target asset to determine user correlation and asset correlation. If any of the user or asset correlation conditions are met, the corresponding transaction of the target user will be automatically frozen. This application focuses on the key operational behaviors of users throughout the entire process, from front-end behavior collection, time-series link restoration, and abnormal risk identification, to mid-end targeted inspection, fingerprint extraction and correlation analysis, and then to back-end automatic risk handling. It covers the entire life cycle of data transactions before, during, and after the transaction, and can not only intercept immediate illegal transactions, but also uncover hidden existing risks. It comprehensively protects the data asset security and transaction compliance of the data trading platform, while regulating user transaction behavior, maintaining the order of the data trading market, and reducing platform operation risks, compliance risks, and data security leakage risks. Attached Figure Description

[0012] To more clearly illustrate the technical solutions of the embodiments of this disclosure, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this disclosure. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0013] Figure 1 This is a flowchart illustrating the data transaction risk control method provided in this embodiment of the disclosure.

[0014] Figure 2 A flowchart illustrating the method for obtaining candidate data provided in this embodiment of the disclosure.

[0015] Figure 3 A flowchart illustrating another embodiment of the data transaction risk control and management method provided in this application.

[0016] Figure 4 This is a schematic diagram of the structure of a computer device provided in an embodiment of the present disclosure. Detailed Implementation

[0017] The embodiments of this disclosure will now be described in detail with reference to the accompanying drawings.

[0018] It should be understood that the following specific examples illustrate the implementation of this disclosure, and those skilled in the art can easily understand other advantages and effects of this disclosure from the content disclosed in this specification. Obviously, the described embodiments are only a part of the embodiments of this disclosure, and not all of them. This disclosure can also be implemented or applied through other different specific implementation methods, and the details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of this disclosure. It should be noted that, in the absence of conflict, the following embodiments and features in the embodiments can be combined with each other. Based on the embodiments in this disclosure, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this disclosure.

[0019] It should be noted that various aspects of embodiments within the scope of the appended claims are described below. It will be apparent that the aspects described herein can be embodied in a wide variety of forms, and any particular structure and / or function described herein is merely illustrative. Based on this disclosure, those skilled in the art will understand that one aspect described herein can be implemented independently of any other aspect, and two or more of these aspects can be combined in various ways. For example, any number of aspects set forth herein can be used to implement the device and / or practice the method. Additionally, this device and / or method can be implemented using structures and / or functionalities other than one or more of the aspects set forth herein.

[0020] It should also be noted that the illustrations provided in the following embodiments are only schematic representations of the basic concept of this disclosure. The drawings only show the components related to this disclosure and are not drawn according to the number, shape and size of the components in actual implementation. In actual implementation, the form, quantity and proportion of each component can be arbitrarily changed, and the layout of the components may also be more complex.

[0021] Furthermore, specific details are provided in the following description to facilitate a thorough understanding of the examples. However, those skilled in the art will understand that the described aspects can be practiced without these specific details.

[0022] Reference Figure 1 This application discloses a data transaction risk control method, including: S100 collects key behaviors of target users in the data trading platform and generates structured behavioral event records corresponding to each key behavior.

[0023] S200 arranges all behavioral event records of the same target user in chronological order to generate the target user's behavioral chain.

[0024] S300 analyzes all behaviors in the behavior chain. If a preset abnormal behavior pattern exists in the behavior chain, the data assets in the data trading platform corresponding to the abnormal behavior are recorded as target assets.

[0025] S400 performs targeted watermark inspections on target users and target assets to obtain candidate data that has been hit by the inspection. S500 extracts the recipient's fingerprint from candidate data; S600 performs correlation analysis between the recipient's fingerprint and all delivered data watermarks of the target user to determine user correlation. S700 performs correlation analysis between the recipient's fingerprint and all delivered data watermarks of the target asset to determine asset relevance.

[0026] The order of steps in S600 and S700 can be flexibly set according to actual needs, and all are within the protection scope of this application.

[0027] S800: If either user correlation or asset correlation meets the leakage conditions, the corresponding transactions of the target user will be automatically frozen.

[0028] The data transaction risk control method disclosed in this application, in terms of risk control accuracy, effectively avoids misjudgment and omission by cross-verifying user behavior and data assets from two dimensions, combined with structured data analysis and fingerprint traceability technology, and accurately distinguishes between compliant operations and malicious risk behaviors. In terms of risk control efficiency, it abandons the inefficient model of full-scale screening, and relies on targeted locking, automated analysis, and intelligent handling to adapt to the platform's high-frequency trading and massive data operation scenarios, balancing risk control security and transaction efficiency. In terms of risk prevention and control effectiveness, it can achieve early warning of risks, accurate verification during the process, and immediate stop loss after the event. It can not only intercept immediate illegal transactions, but also uncover hidden existing risks, comprehensively protect the data asset security and transaction compliance of the data trading platform, while regulating user trading behavior, maintaining the order of the data trading market, and reducing platform operation risks, compliance risks, and data security leakage risks. It can provide solid technical risk control support for the compliant, secure, and orderly flow of data elements and achieve closed-loop control to prevent data transactions from being circumvented.

[0029] The S100 collects key behaviors of target users in the data trading platform and generates structured behavior event records for each key behavior. Specifically, it monitors key behaviors of each user in the data trading platform in real time, such as browsing data asset metadata, querying data statistical features, using the data sandbox, signing letters of intent, withdrawing letters of intent, completing transaction signing, data delivery, buyers publishing data products on the platform, and buyers publishing events outside the platform, and generates structured behavior event records in real time.

[0030] The key fields for browsing data asset metadata include: Buyer ID, Data Asset ID, browsing duration, and browsing frequency. Key fields for querying data statistical characteristics include: Buyer ID, Data Asset ID, query operator, and privacy budget consumption. Key fields for data sandbox trial activities include: Buyer ID, Data Asset ID, submitted code hash, execution duration, output review results, and number of REJECTs. Key fields for signing an intent agreement include: Buyer ID, Data Asset ID, and agreement signing time. Key fields for withdrawing an intent agreement include: Buyer ID, Data Asset ID, withdrawal time, and the interval between signing and withdrawal. Key fields for completing a transaction agreement include: Transaction ID, both parties' IDs, Data Asset ID, and transaction price. Key fields for data delivery activities include: Transaction ID, Watermark ID, and data volume. These can be directly collected within the platform.

[0031] Key fields for a buyer's actions of publishing data products on this platform include: Buyer ID, published data product ID, and data domain tag. Key fields for a buyer's actions of publishing events outside the platform include: Buyer ID, external platform name, external data product URL, data domain tag, and discovery time.

[0032] Among them, the behavior of buyers publishing events outside the platform can be obtained by detecting target channels. The target channels are preferably one or more of the following: public dataset repositories, academic data platforms, government data open platforms, and industry data trading competitor platforms. Among them, public dataset repositories include one or more of the following: Hugging Face Datasets, Kaggle, Whale Community, and Tianchi.

[0033] Compared to traditional risk control models that only collect transaction result data, this step focuses on key user actions throughout the entire process. This overcomes the lag inherent in outcome-based risk control, capturing various pre-emptive risk behaviors such as browsing, downloading, previewing, sharing, and requesting delivery, enabling early risk detection and warning. Simultaneously, transforming fragmented and unstructured user behavior into standardized and structured behavioral event records unifies data format and statistical dimensions, avoiding the problems of messy, difficult-to-analyze, and easily overlooked risk details associated with unstructured data.

[0034] For S200, each buyer's behavioral events on the platform constitute a behavioral chain in chronological order. Furthermore, each behavioral event record in the behavioral chain is written into an immutable storage, such as a Merkle leaf node of a blockchain or consortium blockchain, to ensure that the behavioral chain cannot be forged or deleted afterward. This step is to build an immutable user access behavioral chain at the perception layer, and can also establish a relationship between the behavioral chain and data assets in the data trading platform.

[0035] This step enables a full-link, scenario-based reconstruction of user behavior, eliminating biases from isolated risk assessments. A single user action cannot fully reflect the true intent behind an action, and a single abnormal action may lead to misjudgment. However, the chronologically sequenced behavior chain can completely replicate the user's operational trajectory and behavioral logic on the platform, clearly presenting the sequential relationship, operational habits, and behavioral intent of user actions. Through a coherent behavior chain, normal and compliant operations can be accurately distinguished from abnormal operations such as malicious probing, illegal theft, and secret leaks. This effectively avoids the one-sidedness of traditional risk control methods that determine risk based on a single point of behavior, significantly reducing the probability of misjudgments and omissions in risk control. It allows subsequent abnormal behavior identification to be combined with a complete scenario analysis, improving the rationality and accuracy of risk identification.

[0036] The methods for acquiring S300 target assets specifically include: S310: Analyze all behaviors in the behavior chain. If there is a first type of abnormal behavior pattern (i.e., P1) in the behavior chain, obtain the data assets in the data trading platform corresponding to the abnormal behavior and record them as the target assets.

[0037] Specifically, if there are pre-set high-risk intention to skip orders in the behavior chain, the transaction interval period from the last time the target user used the sandbox function to the time when the data transaction was completed can be obtained.

[0038] Among them, the pre-set high-risk intention to skip orders includes: multiple browsing and viewing behaviors, multiple data statistics query behaviors, and at least one sandbox test operation, and the entire process is carried out in the sandbox to complete the in-depth experience.

[0039] If the transaction interval is longer than the preset time limit, it means that no formal data transaction has been completed. The data assets in the data trading platform corresponding to the abnormal behavior are then obtained and recorded as the target assets.

[0040] S320. If there is no first type of abnormal behavior pattern (i.e., P1) in the behavior chain, analyze all behaviors in the behavior chain and the target external data assets. If the second type of abnormal behavior pattern is met, obtain the data assets in the data trading platform corresponding to the abnormal behavior and record them as the target assets.

[0041] Specifically, all behaviors in the behavior chain are analyzed. If a user completes a sandbox trial of a data asset and actively revokes the corresponding data asset's usage rights, the permission revocation period is determined. The domain label of the data asset corresponding to the data trading platform is determined. Data products published by the target user outside the data trading platform that overlap with the data asset's domain label are obtained and recorded as target external data assets. The similarity between the target external data asset and the data asset whose usage rights have been revoked is obtained. If the similarity is greater than a preset threshold and the publication time of the target external data asset is within the permission revocation period, it is determined that the second type of abnormal behavior pattern (i.e., P2) is met. The data asset in the data trading platform corresponding to the abnormal behavior is obtained and recorded as the target asset.

[0042] Mode P2 is a high-risk identification mode where the buyer first completes a sandbox trial of a designated data asset, then proactively revokes the relevant usage rights to that data asset, and within 90 days of the permission revocation, the buyer publishes other data content internally or through external channels. Furthermore, the similarity between this newly published data and the previously revoked data in the relevant business domain tag reaches 70% or more. This behavior pattern is classified as high-risk. Once the system identifies an object matching this behavioral characteristic, it immediately initiates the third step of the targeted watermark verification and inspection process, and simultaneously notifies the corresponding data supplier of the relevant anomalies.

[0043] This step, relying on standardized behavioral chains and mature pre-set abnormal behavior rules, can quickly filter out malicious and non-compliant abnormal behavior patterns from massive amounts of normal behavior, accurately pinpoint the specific stage at which the risk occurs, and directly link and locate the core data assets corresponding to the risk. This overcomes the shortcomings of traditional risk control, which only detects risks but cannot identify the risk carriers. By accurately tagging target assets, the scope of risk control is narrowed from a general screening of the entire platform to specific risk assets and specific abnormal behaviors, significantly reducing the workload of subsequent risk control verification, improving the targeting of risk control measures, and avoiding problems such as reduced platform transaction efficiency and restricted operations for compliant users caused by indiscriminate risk control. This achieves refined identification and targeted locking of risks.

[0044] Reference Figure 2The methods for obtaining S400 candidate data specifically include: S410, Identify target channels.

[0045] In this embodiment, the target channels preferably include one or more of the following: public dataset repositories, academic data platforms, government data open platforms, and industry data trading competitor platforms; wherein, public dataset repositories include one or more of the following: Hugging FaceDatasets, Kaggle, Whale Community, and Tianchi.

[0046] S420 refers to acquiring all data products published by target users in the target channel, which are denoted as raw data assets.

[0047] The search window for searching within the target channel is limited to the time period after the target user first comes into contact with the target asset, that is, starting from the timestamp of the first behavioral event record of the target user related to the target asset.

[0048] S430: Identify data assets from all raw data assets that have domain labels consistent with the target asset, and denote them as similar data assets.

[0049] S440: Extract the field structure features from the target asset and similar data assets respectively, and obtain the field structure feature similarity.

[0050] The field structure features include the set of field names, the range of the number of fields, and the data volume.

[0051] This step specifically includes: extracting the set of field names, the number of fields, and the data volume range of the target asset and the candidate similar assets respectively; calculating the field name similarity using the Jaccard coefficient, converting the field number similarity based on the relative deviation of the number of fields, calculating the data volume similarity based on the overlap ratio of the intervals, and obtaining the comprehensive similarity of the field structure by weighting according to the preset weights.

[0052] Furthermore, extracting the set of field names, the number of fields, and the data volume range for the target asset and candidate similar assets respectively includes: parsing the metadata of the target asset and candidate similar assets, traversing all data fields of the asset, and obtaining all original field names; standardizing the original field names, such as removing special characters, unifying capitalization, and filtering meaningless prefixes and suffixes, and summarizing all the processed valid field names to form a deduplicated ordered set, thus obtaining the set of field names for the target asset and the set of field names for candidate similar assets respectively.

[0053] The number of elements in the set of field names is counted to obtain the number of fields for the corresponding asset; the total amount of asset data is obtained and normalized to obtain the data volume range for the corresponding asset.

[0054] S450 selects similar data assets whose field structure feature similarity is greater than a preset similarity threshold as candidate data for inspection.

[0055] The method disclosed in this embodiment targets the specific target users, namely buyers and target assets, rather than performing an indiscriminate scan across the entire platform. The search is performed from the following dimensions: buyer, data asset, and time. It avoids scanning the entire dataset, resulting in faster queries, less server resource consumption, and less likelihood of system lag. It focuses only on authorized usage behavior and is not affected by logs from irrelevant personnel or data, making it easier to identify issues of data misuse and reducing false alarms. The fewer records filtered out, the less time is spent sifting through large amounts of invalid information.

[0056] This step performs targeted watermark inspections on target users and assets, and obtains candidate data that is matched by the inspection, effectively improving the efficiency and accuracy of risk verification and achieving closed-loop risk tracing. Unlike the inefficient model of blindly inspecting all data, this step conducts targeted inspections based on pre-identified risk users and assets, precisely defining the inspection scope. This greatly reduces the workload of invalid data verification, significantly improves the efficiency of risk control inspections, and is well-suited to the massive data and high-frequency trading characteristics of data trading platforms.

[0057] Meanwhile, by relying on data watermarking technology for inspection, we can accurately capture data content that is leaked or has abnormal flow, screen out candidate data with potential risks, and provide direct and effective risk samples for subsequent correlation analysis and risk characterization. This ensures that risk verification is not just superficial and achieves a seamless connection from predicting abnormal behavior to verifying the risks of physical data.

[0058] The method for S500 to extract the recipient's fingerprint from candidate data specifically includes: analyzing the candidate data based on a watermark extraction algorithm to extract the recipient's fingerprint, that is, loading a preset watermark extraction algorithm onto the candidate data and calling the watermark parsing interface to strip the implicitly embedded digital watermark information in the candidate data; separating the preset recipient fingerprint feature data from the parsed digital watermark information to complete the restoration and extraction of the recipient's fingerprint.

[0059] The fingerprint of the data recipient has the core characteristics of uniqueness, immutability, and traceability. By accurately extracting this feature information from the risk candidate data, it is possible to overcome the interference of covert means such as format tampering, file name modification, and channel disguise during the data flow process, and accurately locate the actual recipient of the data.

[0060] Compared to traditional methods of tracing through transaction accounts and records, recipient fingerprint tracing is unaffected by changes in transaction channels, operating accounts, or transmission methods. It can penetrate various forms of deception to pinpoint the data transfer terminal and the receiving entity, providing core comparison identifiers for subsequent user and asset correlation analysis. This addresses industry pain points such as difficulty in locating the subject and tracing the transfer chain after data leakage.

[0061] The method for determining the relevance of S600 users specifically includes: extracting the fingerprint feature vector of the receiver and the watermark feature vector corresponding to each delivered data of the target user; calculating the correlation coefficient between the receiver fingerprint and each individual watermark based on the Pearson normalized correlation coefficient formula; pre-configuring a relevance judgment threshold and filtering strongly correlated watermarks based on the individual correlation coefficients; obtaining the comprehensive user relevance coefficient through the maximum value or weighted aggregation method, comparing the comprehensive relevance coefficient with the preset threshold, and outputting the user relevance result of the receiver relative to the target user.

[0062] This step focuses on the user entity dimension. By comparing fingerprints with historical delivery watermarks across the entire domain, it can accurately determine whether the recipient of the current risk data is related to the target user's past data delivery behavior, and clearly identify whether the target user has engaged in unauthorized transfer, illegal delivery, or private leakage of platform data.

[0063] By conducting comprehensive correlation analysis, we can avoid the problem of one-sided judgment based on a single transaction or behavior. By combining users' historical transactions and delivery behavior to comprehensively assess risks, we can accurately distinguish between unintentional user errors, platform system anomalies, and users' subjective malicious disclosure behaviors, thereby improving the rigor and accuracy of risk assessment from the user perspective.

[0064] The method for determining the relevance of S700 assets specifically includes: extracting the recipient's fingerprint feature vector and the watermark feature vectors corresponding to all delivered data of the target asset, and unifying the feature dimensions; calculating the correlation coefficient between the recipient's fingerprint and each asset watermark using the Pearson normalized correlation coefficient formula; assigning weights according to the asset value of each asset data, and calculating the comprehensive asset correlation coefficient by weighting all correlation coefficients; comparing the comprehensive asset correlation coefficient with a preset correlation threshold to determine the asset relevance between the recipient and the target asset.

[0065] This step targets abnormal data assets by comprehensively comparing the watermarks of all historical delivery records with the fingerprints of risk data recipients. It can accurately investigate whether the asset has been transferred illegally multiple times, leaked across entities, or delivered beyond its scope. It can not only verify the authenticity of the current abnormal risk, but also uncover hidden and undiscovered transfer risks in the past. It can achieve a comprehensive investigation of single risks, related risks, and existing risks, which can make up for the shortcomings of traditional risk control that only checks immediate risks and ignores the potential risks in the history of assets, and realize risk management throughout the entire life cycle of data assets.

[0066] For S800, if either user correlation or asset correlation meets the leakage condition, the corresponding transaction of the target user will be automatically frozen. This includes: if either user correlation or asset correlation is not less than a preset correlation threshold, and a data leakage is confirmed, the corresponding transaction of the target user will be automatically frozen immediately, that is, all ongoing transactions of the buyer will be frozen.

[0067] In this application, if suspicious leaked data is obtained, the built-in watermark parsing program will be activated, automatically running the watermark extraction algorithm to analyze and restore the buyer's exclusive identity fingerprint pre-embedded in the data. Then, two layers of verification will be performed: First, targeted comparison with the person involved will be conducted by retrieving all the purchase records of the current buyer on the platform and verifying the exclusive watermark files reserved in the same data and merchant data that he has purchased before, to see if the analyzed fingerprint matches the watermark under his name, and to determine whether it is he who leaked the data; Second, a full-database batch comparison and source tracing will be conducted: retrieving all the buyer watermark ledgers that have been delivered to external parties for this data asset, and performing fingerprint comparison one by one to investigate whether this batch of leaked data was leaked by other buyers and then passed to the current buyer, clarifying the circulation link.

[0068] In this step, transactions are automatically frozen once either user-related or asset-related leakage conditions are met, achieving immediate risk prevention and loss control. Compared to the traditional manual review and post-event handling model, this significantly shortens the risk response time, freezing risky transactions before data leakage spreads or illegal transactions are completed, effectively preventing further risk escalation and minimizing information security, compliance, and financial losses caused by data leakage and misuse. Simultaneously, a dual-dimensional judgment mechanism based on users and assets is adopted; once leakage risk is verified in either dimension, action is initiated, effectively eliminating loopholes in single-dimensional judgment and preventing risks from being missed due to dimensional limitations, ensuring the comprehensiveness, timeliness, and reliability of risk handling.

[0069] In this application, the sandbox is the only way to obtain raw data information. Furthermore, the application also includes the following: if the purchaser's sandbox operation records are rejected or blocked by the review mechanism five or more times during the trial of the designated data asset, this behavior is classified as medium-to-high risk. Once this behavior condition is met, the platform will immediately deduct a fixed preset point from the buyer, such as 50 credit points, and simultaneously restrict the buyer from subsequently performing Level 3 access operations on this data asset.

[0070] This application also includes: obtaining the browsing-to-transaction ratio at the data asset level, with the statistical period set to ninety days by default; specifically, first calculating the browsing-to-transaction conversion rate of the target data asset, calculated by dividing the number of orders that resulted in a formal transaction for that data asset by the total number of independent buyers who viewed that data asset. When this conversion rate is less than 30% of the average conversion rate of all similar data assets in the same category, it is considered an anomaly. This risk level is between low and medium risk, and this risk applies to the data asset itself, not to the purchasing buyer. After the platform identifies the anomaly, it will push a message to notify the platform operations personnel to intervene and handle the matter. At the same time, it will automatically perform risk screening and judgment on all buyers who have had in-depth contact with the data but ultimately did not complete the transaction, uniformly and in batches, using the P1 behavior mode described above.

[0071] Reference Figure 3 Secondly, this application discloses a data transaction risk control method, including: S10 collects key behaviors of target users in the data trading platform and generates structured behavior event records corresponding to each key behavior in real time. S20: Arrange all behavioral event records in chronological order to generate the target user's behavioral chain; S30: Analyze all behaviors in the behavior chain. If there is a preset abnormal behavior pattern in the behavior chain, record the data assets in the data trading platform corresponding to the abnormal behavior as the target assets. S40 performs targeted watermark inspections on target users and target assets to obtain candidate data that has been hit by the inspection.

[0072] The specific implementation methods of S10-S40 are consistent with the corresponding steps in the data transaction risk control and management method disclosed in the first aspect of this application, so they will not be described in detail here.

[0073] S50, if the recipient's fingerprint cannot be extracted from the candidate data, perform a data feature-level comparison analysis between the candidate data and the target asset to obtain the comparison results; S60: Based on the risk level corresponding to the comparison results, invoke and execute the corresponding control strategy.

[0074] The methods for obtaining S50 alignment results specifically include: A field structure similarity analysis is performed between the field name set of candidate data and the field name set of target assets to obtain the consistency of field structure.

[0075] Determine the numerical fields of the target asset, obtain the KL divergence between the target asset and the candidate data for each numerical field, and use the average KL divergence of all fields as the statistical distribution similarity.

[0076] The edit distance between the classification label system of the candidate data and the classification label system of the target asset is denoted as classification system consistency; wherein, the classification label system includes at least the label category naming and hierarchical structure.

[0077] The degree of overlap between the time range, geographical range, and thematic range covered by the candidate data and the time range, geographical range, and thematic range corresponding to the target asset is recorded as the range overlap degree.

[0078] The comparison results are obtained based on the consistency of field structure, similarity of statistical distribution, consistency of classification system, and overlap of range.

[0079] This embodiment achieves a three-dimensional feature comparison from multiple dimensions, including field structure, numerical statistical distribution, classification label system, and data coverage. It overcomes the shortcomings of traditional single-dimensional data comparison, which is one-sided and has large judgment errors. It not only covers the surface structure features of the data, but also takes into account the deep numerical distribution, business classification, and spatial and temporal attributes. It comprehensively portrays the feature relationship between candidate data and target assets, which can significantly improve the completeness and accuracy of data source comparison.

[0080] For different feature dimensions, a dedicated quantification algorithm is used. At the structural level, Jaccard similarity is used to accurately match the overlap of field sets. At the numerical distribution level, KL divergence is used to quantify the differences in data probability distribution. At the classification system level, edit distance is used to adapt the differences in label naming and hierarchical structure. At the range dimension, the overlap of multi-dimensional coverage is accurately calculated. The entire process is completed with a standardized mathematical model to avoid the subjective bias of manual comparison. The comparison results are objective, quantifiable, reproducible and traceable.

[0081] The S60 method of "calling and executing the corresponding control strategy based on the risk level corresponding to the comparison result" specifically includes: If the comparison results show that at least three of the following criteria reach the preset threshold: consistency of field structure, similarity of statistical distribution, consistency of classification system, and overlap of scope, the corresponding risk level is determined to be high risk, and the first-level control strategy is invoked and executed.

[0082] In this embodiment, manual arbitration can be initiated, and the credit score of the buyer involved can be deducted, and transactions related to the data assets involved can be frozen.

[0083] If the comparison results show that fewer than three of the following meet the preset thresholds: field structure consistency, statistical distribution similarity, classification system consistency, and range overlap, the corresponding risk level is determined to be medium risk, and the secondary control strategy is invoked and executed.

[0084] In this embodiment, the item can be marked as "watched" to deduct credit scores from the buyer involved and increase the frequency of subsequent monitoring.

[0085] If the comparison results show that the consistency of field structure, similarity of statistical distribution, consistency of classification system, and overlap of range all fail to reach the preset threshold, the corresponding risk level is determined to be low risk, and the three-level control strategy is invoked and executed. In this embodiment, it is indicated that there is no data leakage, no credit score is deducted, and no transaction is frozen.

[0086] Furthermore, this application also includes: obtaining the updated credit score of the target user; automatically adjusting the target user's platform access permissions based on the updated credit score. When the updated credit score is lower than a preset credit score threshold, all access of the target user is suspended.

[0087] The data transaction risk control method disclosed in the second aspect of this application connects user transaction data throughout the entire process using a time-series behavior chain. It proactively identifies and warns of order skipping risks based on preset abnormal behavior patterns, abandoning the passive risk control model of manual reporting and offline investigation. It can lock in at-risk users and target data assets in advance throughout the entire transaction chain, solving the shortcomings of existing risk control in post-event handling and lagging management. Through a two-layer traceability mechanism of targeted watermark inspection supplemented by data feature comparison, when the watermark fails and the recipient's fingerprint cannot be extracted, the asset same-source verification is completed by using data feature comparison, improving the evidence collection link for order skipping behavior and making up for the shortcomings of single digital watermarks being easy to remove and difficult to trace and collect evidence.

[0088] Based on the comparison results, risk levels are classified and corresponding control strategies are automatically applied. This connects the isolated links of behavior detection, watermark verification, credit adjustment, and access control, achieving automated linkage of risk identification, source tracing, tiered punishment, and access control. It overcomes the drawbacks of independent deployment and inability to coordinate control of various security technologies, significantly reducing manual processing costs. The intelligent closed-loop control throughout the entire process effectively curbs data transaction bypassing and unauthorized data leakage, increases the proportion of compliant transactions on the exchange, optimizes the risk control capabilities of the data trading platform, and adapts to the actual control needs of intelligent anti-skipping measures across the entire chain in the context of data element marketization.

[0089] A computer device according to embodiments of the present disclosure includes a memory and a processor. The memory is used to store non-transitory computer-readable instructions. Specifically, the memory may include one or more computer program products, which may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory may, for example, include random access memory (RAM) and / or cache memory. The non-volatile memory may, for example, include read-only memory (ROM), hard disk, flash memory, etc.

[0090] The processor may be a central processing unit (CPU) or other form of processing unit with data processing capabilities and / or instruction execution capabilities, and may control other components in the computer device to perform desired functions. In one embodiment of this disclosure, the processor is used to execute computer-readable instructions stored in the memory, causing the computer device to perform all or part of the steps of the data transaction risk control and management methods of the foregoing embodiments of this disclosure.

[0091] Those skilled in the art will understand that, in order to solve the technical problem of how to achieve a good user experience, this embodiment may also include well-known structures such as communication buses and interfaces, and these well-known structures should also be included within the protection scope of this disclosure.

[0092] like Figure 4 This is a schematic diagram of a computer device provided for an embodiment of the present disclosure. It illustrates a structural schematic diagram suitable for implementing the computer device in the embodiments of the present disclosure. Figure 4 The computer device shown is merely an example and should not be construed as limiting the functionality and scope of the embodiments disclosed herein.

[0093] like Figure 4 As shown, a computer device may include a processor (such as a central processing unit, graphics processing unit, etc.), which can perform various appropriate actions and processes based on programs stored in read-only memory (ROM) or programs loaded from storage devices into random access memory (RAM). The RAM also stores various programs and data required for the operation of the computer device. The processor, ROM, and RAM are interconnected via a bus. Input / output (I / O) interfaces are also connected to the bus.

[0094] Typically, the following devices can be connected to the I / O interface: input devices, such as sensors or visual information acquisition devices; output devices, such as displays; storage devices, such as magnetic tapes or hard drives; and communication devices. Communication devices allow the computer device to communicate wirelessly or wiredly with other devices (such as edge computing devices) to exchange data. Although Figure 4 A computer apparatus with various devices is shown, but it should be understood that it is not required to implement or have all of the devices shown. More or fewer devices may be implemented or included alternatively.

[0095] In particular, according to embodiments of this disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this disclosure include a computer program product comprising a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device, or installed from a storage device, or installed from a ROM. When the computer program is executed by a processor, all or part of the steps of the data transaction risk control method of embodiments of this disclosure are performed.

[0096] For a detailed description of this embodiment, please refer to the corresponding descriptions in the foregoing embodiments, which will not be repeated here.

[0097] A computer-readable storage medium according to embodiments of the present disclosure stores non-transitory computer-readable instructions. When the non-transitory computer-readable instructions are executed by a processor, all or part of the steps of the data transaction risk control and management methods described in the foregoing embodiments of the present disclosure are performed.

[0098] The aforementioned computer-readable storage media include, but are not limited to: optical storage media (e.g., CD-ROM and DVD), magneto-optical storage media (e.g., MO), magnetic storage media (e.g., magnetic tape or portable hard drive), media with built-in rewritable non-volatile memory (e.g., memory card), and media with built-in ROM (e.g., ROM cartridge).

[0099] For a detailed description of this embodiment, please refer to the corresponding descriptions in the foregoing embodiments, which will not be repeated here.

[0100] The basic principles of this disclosure have been described above with reference to specific embodiments. However, it should be noted that the advantages, benefits, and effects mentioned in this disclosure are merely examples and not limitations, and should not be considered as essential features of each embodiment of this disclosure. Furthermore, the specific details disclosed above are for illustrative and facilitative purposes only, and are not limitations. These details do not limit the scope of this disclosure to the necessity of employing the aforementioned specific details for implementation.

[0101] In this disclosure, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. The block diagrams of devices, apparatuses, devices, and systems involved in this disclosure are merely illustrative examples and are not intended to require or imply that they must be connected, arranged, or configured in the manner shown in the block diagrams. As those skilled in the art will recognize, these devices, apparatuses, devices, and systems can be connected, arranged, and configured in any manner. Words such as "comprising," "including," "having," etc., are open-ended terms meaning "including but not limited to," and are used interchangeably with them. The terms "or" and "and" as used herein refer to the terms "and / or," and are used interchangeably with them unless the context clearly indicates otherwise. The term "such as" as used herein refers to the phrase "such as but not limited to," and is used interchangeably with it.

[0102] Additionally, as used herein, the "or" used in a list of items beginning with "at least one" indicates a separate list, such that a list of, for example, "at least one of A, B, or C" means A or B or C, or AB or AC or BC, or ABC (i.e., A and B and C). Furthermore, the word "exemplary" does not imply that the described example is preferred or better than other examples.

[0103] It should also be noted that in the systems and methods of this disclosure, the components or steps can be decomposed and / or recombined. These decompositions and / or recombinations should be considered as equivalent solutions to this disclosure.

[0104] Various changes, substitutions, and modifications can be made to the technology described herein without departing from the teachings defined by the appended claims. Furthermore, the scope of the claims of this disclosure is not limited to the specific aspects of the processes, machines, manufactures, events, means, methods, and actions described above. Currently existing or later-developed processes, machines, manufactures, events, means, methods, or actions that perform substantially the same function or achieve substantially the same result as the corresponding aspects described herein can be utilized. Therefore, the appended claims include such processes, machines, manufactures, events, means, methods, or actions within their scope.

[0105] The above description of the disclosed aspects is provided to enable any person skilled in the art to make or use this disclosure. Various modifications to these aspects will be readily apparent to those skilled in the art, and the general principles defined herein may be applied to other aspects without departing from the scope of this disclosure. Therefore, this disclosure is not intended to be limited to the aspects shown herein, but rather to be carried out within the widest scope consistent with the principles and novel features disclosed herein.

[0106] The above description has been given for purposes of illustration and description. Furthermore, this description is not intended to limit the embodiments of this disclosure to the forms disclosed herein. Although numerous exemplary aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, alterations, additions, and sub-combinations thereof.

Claims

1. A data transaction risk control and management method, characterized in that, include: Collect key behaviors of target users in the data trading platform and generate structured behavior event records corresponding to each key behavior in real time; Arrange all the recorded behavioral events in chronological order to generate the behavioral chain of the target user; Analyze all behaviors in the behavior chain. If there is a preset abnormal behavior pattern in the behavior chain, record the data assets in the data trading platform corresponding to the abnormal behavior as the target assets. Perform targeted watermark inspections on the target users and target assets to obtain candidate data that has been hit by the inspection. Extract the recipient fingerprint from the candidate data, and perform correlation analysis between the recipient fingerprint and all delivered data watermarks of the target user to determine user correlation. The correlation analysis is performed between the recipient's fingerprint and all delivered data watermarks of the target asset to determine the asset correlation. If either the user correlation or the asset correlation meets the disclosure condition, the corresponding transaction of the target user will be automatically frozen.

2. The data transaction risk control and management method according to claim 1, characterized in that, The analysis of all behaviors in the behavior chain, and if a preset abnormal behavior pattern exists in the behavior chain, the data assets in the data trading platform corresponding to the abnormal behavior are recorded as target assets, including: Analyze all behaviors in the behavior chain. If a first type of abnormal behavior pattern exists in the behavior chain, obtain the data assets in the data trading platform corresponding to the abnormal behavior and record them as the target assets. If no first type of abnormal behavior pattern exists in the behavior chain, all behaviors in the behavior chain and the target external data assets are analyzed. If the second type of abnormal behavior pattern is met, the data assets in the data trading platform corresponding to the abnormal behavior are obtained and recorded as the target assets.

3. The data transaction risk control and management method according to claim 2, characterized in that, If a first type of abnormal behavior pattern exists in the behavior chain, the data assets in the data trading platform corresponding to the abnormal behavior are obtained and recorded as the target assets, including: If there is a pre-set high-risk intention to skip orders in the behavior chain, obtain the transaction interval period from the last time the target user used the sandbox function to the time when the data transaction was completed. If the transaction interval period is longer than the preset time limit, the data assets in the data trading platform corresponding to the abnormal behavior are obtained and recorded as the target assets.

4. The data transaction risk control and management method according to claim 2, characterized in that, The analysis of all behaviors in the behavior chain and the target external data assets, if satisfying the second type of abnormal behavior pattern, involves acquiring the data assets in the data trading platform corresponding to the abnormal behavior and recording them as the target assets, including: Analyze all behaviors in the behavior chain, and if there is a sandbox trial operation for a data asset and the user actively revokes the access permission for the corresponding data asset, determine the permission revocation period; Determine the data asset domain label corresponding to the data trading platform, and obtain the data products published by the target user outside the data trading platform that overlap with the data asset domain label, and denot them as target external data assets; Obtain the similarity between the target external data asset and the data asset whose usage rights have been revoked; If the similarity is greater than a preset threshold and the release time of the target external data asset is within the permission revocation period, it is determined that the second type of abnormal behavior pattern is met, the data asset in the data trading platform corresponding to the abnormal behavior is obtained, and recorded as the target asset.

5. The data transaction risk control and management method according to claim 1, characterized in that, The targeted watermark inspection of the target user and the target asset to obtain candidate data that has been detected includes: All data products published by the target user in the target channel are recorded as the original data assets. Identify data assets from all the original data assets that have the same domain label as the target asset, and denot them as similar data assets; Extract the field structure features from the target asset and the similar data assets respectively, and obtain the field structure feature similarity. Similar data assets whose field structure feature similarity is greater than a preset similarity threshold are selected as candidate data for inspection.

6. A data transaction risk control and management method, characterized in that, include: Collect key behaviors of target users in the data trading platform and generate structured behavior event records corresponding to each key behavior in real time; Arrange all the recorded behavioral events in chronological order to generate the behavioral chain of the target user; Analyze all behaviors in the behavior chain. If there is a preset abnormal behavior pattern in the behavior chain, record the data assets in the data trading platform corresponding to the abnormal behavior as the target assets. Perform targeted watermark inspections on the target users and target assets to obtain candidate data that has been hit by the inspection. If the recipient's fingerprint cannot be extracted from the candidate data, perform a data feature-level comparison analysis between the candidate data and the target asset to obtain the comparison result. Based on the risk level corresponding to the comparison results, the corresponding control strategy is invoked and executed.

7. The data transaction risk control and management method according to claim 6, characterized in that, If the recipient's fingerprint cannot be extracted from the candidate data, a data feature-level comparison analysis is performed between the candidate data and the target asset to obtain the comparison result, including: A field structure similarity analysis is performed on the field name set of the candidate data and the field name set of the target asset to obtain the consistency of the field structure; Determine the numerical fields of the target asset, obtain the KL divergence between the target asset and the candidate data for each numerical field, and use the average of the KL divergences of all fields as the statistical distribution similarity. The edit distance between the classification label system of the candidate data and the classification label system of the target asset is recorded as the classification system consistency. The degree of overlap between the time range, geographical range, and thematic range covered by the candidate data and the time range, geographical range, and thematic range corresponding to the target asset is obtained and denoted as the range overlap degree. The comparison results are obtained based on the consistency of the field structure, the similarity of the statistical distribution, the consistency of the classification system, and the overlap of the range.

8. The data transaction risk control and management method according to claim 7, characterized in that, The step of invoking and executing the corresponding control strategy based on the risk level corresponding to the comparison result includes: If the comparison results show that at least three of the following criteria reach a preset threshold: consistency of field structure, similarity of statistical distribution, consistency of classification system, and overlap of range, the corresponding risk level is determined to be high risk, and a level-one control strategy is invoked and executed. If the comparison results show that fewer than three of the following reach the preset threshold: field structure consistency, statistical distribution similarity, classification system consistency, and range overlap, the corresponding risk level is determined to be medium risk, and the secondary control strategy is invoked and executed. If the comparison results show that the consistency of the field structure, the similarity of the statistical distribution, the consistency of the classification system, and the overlap of the range all fail to reach the preset threshold, the corresponding risk level is determined to be low risk, and the three-level control strategy is invoked and executed.

9. A computer device, characterized in that, The computer device includes: At least one processor; and, A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor; the instructions are executed by the at least one processor to enable the at least one processor to perform the data transaction risk control method according to any one of claims 1-5 or the data transaction risk control method according to any one of claims 6-8.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions; the computer instructions are used to cause the computer to execute the data transaction risk control method according to any one of claims 1-5 or the data transaction risk control method according to any one of claims 6-8.

11. A computer program product comprising computer instructions, characterized in that, When the computer instruction is executed by the processor, it implements the steps of the data transaction risk control method according to any one of claims 1-5 or the data transaction risk control method according to any one of claims 6-8.

Images