Method, device and storage medium for stratifying e-commerce users

Abstract

The application discloses an e-commerce user layering method, device and storage medium, and relates to the technical field. The e-commerce user layering method comprises the following steps: in response to a user level confirmation request, obtaining a homogeneous association graph corresponding to a to-be-confirmed user, wherein the homogeneous association graph takes the user as a node and takes the medium commonly used between the users as an edge; determining a final risk score of the to-be-confirmed user according to a first basic risk score of a target graph node corresponding to the to-be-confirmed user and a second basic risk score of an n-degree neighbor node of the target graph node; and determining the user level corresponding to the to-be-confirmed user according to the final risk score. The application can achieve the technical effect of improving the cold start capability.

Description

Technical Field

[0001] This application relates to the field of logistics timeliness, and in particular to a method, device and storage medium for stratifying e-commerce users. Background Technology

[0002] In the context of risk control in e-commerce scenarios, with increased countermeasures, malicious users are gradually evolving towards crowdsourcing, AI-based simulation attack models, while normal users are becoming increasingly sophisticated. This has led to a blurring of the lines between malicious users, not entirely malicious users, and normal users. Previously, prevention and control methods based on fixed rules or tags were insufficient to quickly identify first-time visitors due to a lack of historical behavioral information. Summary of the Invention

[0003] The main purpose of this application is to provide a method, device and storage medium for tiering e-commerce users, aiming to solve the technical problem of poor cold start capability.

[0004] To achieve the above objectives, this application provides a method for segmenting e-commerce users, which includes: In response to a user-level confirmation request, obtain the isomorphic association graph corresponding to the user to be confirmed, where the isomorphic association graph has users as nodes and the mediums used by users as edges; Based on the first basic risk score of the target graph node corresponding to the user to be confirmed, and the second basic risk score of the n-degree neighbor node of the target graph node, the final risk score of the user to be confirmed is determined. The user level corresponding to the user to be confirmed is determined based on the final risk score.

[0005] In one embodiment, the shared medium includes at least one of the following: the same device ID, the same IP address, the same mobile phone number, and the same Wi-Fi router.

[0006] In one embodiment, the step of determining the final risk score of the user to be confirmed based on the first basic risk score of the target graph node corresponding to the user to be confirmed and the second basic risk score of the n-degree neighboring nodes of the target graph node includes: Based on the first basic risk score and the node attributes of the target graph nodes, construct the first initial feature vector; Based on the order from near to far, after multiple iterations, the second initial feature vectors corresponding to the n-degree neighbor nodes are successively fused into the first initial feature vector to generate the expression vectors corresponding to the target graph nodes. The second initial feature vectors include the second basic risk scores and attribute features of the corresponding neighbor nodes. The final risk score for the user to be confirmed is determined based on the expression vector.

[0007] In one embodiment, before determining the final risk score of the user to be confirmed based on the first basic risk score of the target graph node corresponding to the user to be confirmed and the second basic risk score of the n-degree neighboring nodes of the target graph node, the e-commerce user segmentation method further includes: In response to a prediction job request, the Spark cluster loads the model file from the HDFS database and distributes the model file as a broadcast variable to all Executor nodes in the cluster. After the Executor node obtains the model file based on the broadcast variable, it constructs a model object based on the model file; Upon receiving the data to be processed from the Spark cluster, a basic risk score is generated for each user based on the model object, and the basic risk score is written to the HDFS database.

[0008] In one embodiment, prior to the steps of loading a model file from an HDFS database and distributing the model file as a broadcast variable to all Executor nodes in the cluster in response to a prediction job request, the tiering method for e-commerce users further includes: The PU-Learning algorithm is used to train an initial classifier by treating labeled black samples as positive examples and unlabeled samples as negative examples. Based on the initial classifier, white samples are separated from the biased unlabeled samples. A training set is constructed based on the white and black samples; The LightGBM model is trained based on the training set, and the trained LightGBM model is serialized into a model file.

[0009] In one embodiment, after determining the user level corresponding to the user to be confirmed based on the final risk score, the e-commerce user segmentation method further includes: Determine target business lines based on user tiers; Push the user hierarchy to the target business line so that the target business line can perform corresponding business actions based on the user hierarchy.

[0010] In one embodiment, the step of determining the final risk score of the user to be confirmed based on the first basic risk score of the target graph node corresponding to the user to be confirmed and the second basic risk score of the n-degree neighboring nodes of the target graph node includes: Determine the dynamic weight values ​​corresponding to the target graph nodes and their n-degree neighbor nodes; The weighted sum of the first and second basic risk scores is determined based on the dynamic weight values, and the weighted sum is used as the final risk score.

[0011] In one embodiment, the step of determining the dynamic weight values ​​corresponding to the target graph node and its n-degree neighbor nodes includes: Preliminary dynamic weight values ​​are determined based on the amount of behavioral data associated with the target graph nodes, user lifecycle, and information completeness. Among them, the amount of behavioral data, user lifecycle, and information completeness are all positively correlated with the weight values ​​of the target graph nodes and negatively correlated with the weight values ​​of the n-degree neighbor nodes. Based on the edge relationships between the target graph nodes and their n-degree neighboring nodes, the initial dynamic weight values ​​are corrected to obtain the dynamic weight values.

[0012] In addition, to achieve the above objectives, this application also provides a layering device for e-commerce users, which includes: a memory, a processor, and a computer program stored on the memory and executable on the processor, the computer program being configured to implement the steps of the e-commerce user layering method described above.

[0013] In addition, to achieve the above objectives, this application also provides a storage medium, which is a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, it implements the steps of the e-commerce user tiering method described above.

[0014] This application provides a method for stratifying e-commerce users. In response to a user stratification confirmation request, it obtains a homogeneous association graph corresponding to the user to be confirmed. This graph uses users as nodes and shared media as edges. Based on the first basic risk score of the target graph node corresponding to the user to be confirmed, and the second basic risk scores of the n-degree neighbors of the target graph node, the final risk score of the user to be confirmed is determined. The user stratification corresponding to the user to be confirmed is determined based on the final risk score. The method replaces the binary decision of rules with continuous probability scores from a machine learning model, and uses the association reasoning of the graph model to compensate for the lack of individual information. That is, the risk score diffuses to users who have accessed the media through graph association, thereby improving their final risk score. The graph model greatly enhances the ability to identify mass fraud and new user cheating, effectively solving the cold start problem. It achieves the technical effect of improving cold start capability. Attached Figure Description

[0015] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0016] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1A flowchart illustrating the first embodiment of the method for segmenting e-commerce users in this application; Figure 2 A flowchart illustrating the fourth embodiment of the method for segmenting e-commerce users in this application; Figure 3 A flowchart illustrating the fifth embodiment of the method for segmenting e-commerce users in this application; Figure 4 A flowchart illustrating the method for segmenting e-commerce users in this application, as provided in Implementation Example Six; Figure 5 This is a schematic diagram of the hardware operating environment involved in the layering method for e-commerce users in this application embodiment.

[0018] The purpose, features, and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0019] It should be understood that the specific embodiments described herein are only used to explain the technical solutions of this application and are not intended to limit this application.

[0020] To better understand the technical solution of this application, a detailed description will be provided below in conjunction with the accompanying drawings and specific implementation methods.

[0021] Currently, in the context of modern risk control, with increased adversarial efforts, malicious users are increasingly employing crowdsourcing and AI-based simulation attack models, while normal users are becoming more sophisticated. The distinction between malicious users, partially malicious users, and normal users is becoming increasingly blurred. Traditional control methods based on fixed rules or tags often fail to differentiate between degrees of malice and cannot be flexibly adjusted according to business scenarios. Identification results are black-and-white, leading to a single, brute-force approach. Most rules are set based on a single scenario, requiring adjustments when scenarios change, resulting in a lack of versatility. Various combinations of tags and features lead to an exponential increase in the number of rules, making maintenance difficult as business grows. For first-time users, the lack of sufficient historical behavioral information makes rapid identification challenging.

[0022] The main solution of this application is as follows: In response to a user level confirmation request, a homogeneous association graph corresponding to the user to be confirmed is obtained, wherein the homogeneous association graph has users as nodes and the medium shared by users as edges. Based on the first basic risk score of the target graph node corresponding to the user to be confirmed, and the second basic risk score of the n-degree neighboring nodes of the target graph node, the final risk score corresponding to the user to be confirmed is determined. The user level corresponding to the user to be confirmed is determined based on the final risk score. The binary decision of the rules is replaced by the continuous probability score of the machine learning model, and the association reasoning of the graph model is used to compensate for the lack of individual information; that is, the risk score will diffuse to users who have been exposed to the medium through graph association, thereby improving their final risk score. The graph model greatly enhances the ability to identify mass crimes and new user cheating, effectively solving the cold start problem. It achieves the technical effect of improving cold start capability.

[0023] It should be noted that the executing entity in this embodiment can be a tiered device of an e-commerce user, or a computing service device with data processing, network communication, and program execution functions, such as a personal computer, server, virtual machine, etc., or a tiered device of an e-commerce user capable of performing the above functions, etc. This embodiment does not specifically limit it in this way. The following uses a tiered device of an e-commerce user as an example to describe this embodiment and the following embodiments.

[0024] Embodiment 1 of this application proposes a method for segmenting e-commerce users. Please refer to... Figure 1 , Figure 1 This is a flowchart illustrating an embodiment of the e-commerce user segmentation method of this application. The e-commerce user segmentation method includes steps S10 to S30: Step S10: In response to the user-level confirmation request, obtain the isomorphic association graph corresponding to the user to be confirmed.

[0025] A user-level confirmation request refers to an instruction received by the system that requires hierarchical confirmation of the user. The isomorphic association graph is the core data structure of the graph model module in this method. It uses users as nodes and shared media as edges, forming associations between users and media, thus constructing a user-media network graph structure.

[0026] In this embodiment, a user-level confirmation request is triggered when a risk level assessment of a specific user is required. The request is essentially a query instruction, containing at least one key parameter, such as the unique identifier of the user to be confirmed. Upon receiving the user ID, a query is initiated into the graph database to find the user node, all media nodes directly connected to that user, and further, all other user nodes connected through these media nodes. The graph database returns this local subgraph, i.e., the isomorphic associations corresponding to the user to be confirmed. Through a pre-built graph database, user relationships can be quickly queried.

[0027] In a first feasible implementation, step S10 may include: receiving and parsing the request. Based on the configuration, the risk level or business scenario of the user is determined, and a graph computation strategy is chosen. For ordinary risk scenarios, a real-time lightweight query is used to quickly obtain a homogeneous association graph from the graph database. For high-risk or highly suspicious users, a triggered deep computation is used to trigger a more complex graph computation task, submitting the user's ID to a distributed graph computation engine, such as Spark GraphX. The latest full user-association graph snapshot is loaded from distributed storage. In the graph computation engine, starting with the user, graph algorithms, such as label propagation or PageRank variants, are run to perform multi-degree (e.g., second-degree, third-degree) risk diffusion calculations. A subgraph of associations after deep diffusion calculation and its node scores are returned. The homogeneous association graphs obtained according to different strategies are returned. Through a hybrid strategy of real-time graph query and batch graph computation, both real-time risk control for ordinary transactions and in-depth mining of high-risk events are ensured.

[0028] For example, in order to convert requests from different sources into a unified data format that can be processed, a user-level confirmation request is received through an API gateway or message queue. This request contains at least one core parameter, userId, and may optionally contain sceneId, i.e., the business scenario, such as transaction, coupon redemption, initial risk score and other contextual information.

[0029] Furthermore, the system queries a pre-configured dynamic configuration center. Configuration rules are based on initial risk scores, sceneId (e.g., large transfers are directly classified as high-risk), and user attributes. For example, an initial risk score < 0.3 is classified as moderate risk and routed to a real-time lightweight query pipeline. An initial risk score ≥ 0.7 or sceneId = HIGH_VALUE_PROMOTION is classified as high risk and routed to a triggered deep analysis pipeline. An initial risk score ≤ 0.3 < 0.7 is classified as medium risk and can be configured for deep analysis at a certain sampling rate or directly using lightweight queries. Risk control personnel can flexibly control traffic allocation and computing resource allocation without modifying code, simply by adjusting configuration rules, to cope with constantly changing malicious user attack patterns. For example, during promotional periods, the high-risk threshold can be temporarily lowered to allow more users to enter the deep analysis pipeline.

[0030] Furthermore, to explore the user's directly associated network, for requests routed to the real-time lightweight query pipeline, a predefined query is initiated using the userId to a graph database such as Neo4j. This retrieves a one-degree isomorphic association graph of the target user. The exploration of the user's directly associated network is completed with millisecond-level latency. It also queries whether the user has a direct relationship with known faulty devices, IPs, or accounts.

[0031] Furthermore, to uncover hidden risks, Spark GraphX ​​jobs load a full, pre-built snapshot of the user relationship graph from distributed storage, such as HDFS or S3. This snapshot is generated periodically and contains the latest relationship networks. Starting with the submitted userId, a specified graph algorithm is run. Taking the label propagation algorithm as an example, known high-risk user labels are diffused along the association edges to multi-degree neighbors. The starting user absorbs risk labels from its associated high-risk neighbors. First-degree associations can only discover direct associates, while multi-degree propagation can reveal the entire fraudulent network in which a user is located. Even if a user's behavior is concealed, as long as they are at the edge, they can be detected by the algorithm.

[0032] In a second feasible implementation, step S10 may include: receiving and parsing a user-level confirmation request, extracting the unique identifier of the user to be confirmed, such as a User ID; generating a graph query language, such as a query statement in Cypher for Neo4j, using the User ID as a parameter according to a predefined graph pattern; sending the query statement to the graph database and executing the query; finding the target user node, all its first-degree associated media nodes, and all first-degree neighbor user nodes associated through these media nodes; and retrieving the query results from the graph database, which are a homogeneous association graph centered on the user to be confirmed and limited in depth, returned as a list of nodes and edges. This approach can easily handle complex many-to-many association queries. For example, querying a user's neighbors associated through all dimensions such as device, IP, and phone number is a natively efficient operation in the graph database.

[0033] In a third feasible implementation, step S10 may include: receiving and parsing the request, and extracting the User ID of the user to be confirmed. Based on the User ID, querying relevant tables in the business database, such as login logs and device binding tables, to obtain a list of all important media IDs historically used by the user, such as device IDs and IP addresses. For each media ID obtained in the previous step, querying the database to find a list of all other users who have historically used the same media. Assembling all query results into a graph structure in memory, with nodes including the user to be confirmed, all queried media, and all associated users, and connecting user nodes and media nodes according to usage relationships. Returning the graph data constructed in memory to the subsequent processing module. This approach eliminates the need to introduce a new graph database, allowing development directly using existing relational databases such as MySQL. In the early stages of a project or when resources are limited, this approach enables the fastest possible implementation of basic association discovery functionality.

[0034] The above are only three feasible implementation methods of step S10 provided in this embodiment. This embodiment does not specifically limit the specific implementation method of step S10.

[0035] Step S20: Determine the final risk score of the user to be confirmed based on the first basic risk score of the target graph node corresponding to the user to be confirmed and the second basic risk score of the n-degree neighboring nodes of the target graph node.

[0036] The first basic risk score is the risk score of the user to be confirmed, excluding graph association information. The second basic risk score is the basic risk score of the user's n-degree neighbors, i.e., other users associated through devices, IP addresses, etc. The final risk score is a comprehensive risk score calculated by taking into account the user's own risk (the first basic risk score) and the risks of its associated network (the second basic risk score).

[0037] In this embodiment, the isomorphic association graph of the user to be confirmed is read from the output of step S10. This graph contains the target node and its n-degree neighbor nodes. Simultaneously, the basic risk scores of all user nodes in the graph are obtained from the storage system. An influence weight is calculated for each neighbor node in the graph. Weight calculation is typically based on association strength, i.e., the more times and for longer periods the target user shares devices with neighboring users, the higher the neighbor's weight. The importance of the association medium is also considered, i.e., different mediums have different association strengths. The degree of association is also considered, i.e., a first-degree neighbor has a higher weight than a second-degree neighbor, and a second-degree neighbor has a higher weight than a third-degree neighbor. Risk decreases as the number of association hops increases. The first basic risk score of the target node and the second basic risk scores of all neighbor nodes are combined. If a weighted summation method is used, the calculated result is taken as the final risk score of the user to be confirmed. By integrating user behavior with network association risk, a more comprehensive and accurate integrated assessment of individual risk is achieved, significantly reducing misjudgments. This effectively solves the problem of new users lacking historical data, reliably predicts their risk using the association network, and greatly enhances the defense capabilities against malicious user accounts. By leveraging risk diffusion to uncover potential large-scale operations, we can achieve in-depth investigation and large-scale crackdown on organized fraud.

[0038] In a first feasible implementation, step S20 may include: calculating dynamic weights based on the user node's own attributes, where the weights are not constants but functions that dynamically change with the evaluation object or evaluation environment. That is, the final risk score = α(user, context) × basic risk score + β(user, context) × associated risk score. α is the user's own weight, positively correlated with the richness and credibility of user behavior. β is the associated weight, positively correlated with the sparsity and uncertainty of user behavior. The larger the amount of behavioral data, i.e., the more historical behavioral events of the user, such as the number of logins and transactions, the higher α and the lower β. For user lifecycle, i.e., the user's registration duration, older users have higher α, and new users have higher β. For information completeness, i.e., whether the user has verified their identity, bound a bank card, etc., the more complete the information, the higher α. For example, α = min(1, log(user login count + 1) / 10), β = 1 - α. In other words, a long-time user who has logged in 100 times will have the majority (α≈1) weighted by their own behavior, while a new user logging in for the first time will have the majority (β≈1) weighted by their associated risks. This perfectly solves the cold start problem. For new users and low-activity users, the system automatically relies on their association graph for judgment, while for mature users, it relies on their long-term accumulated behavioral data for more accurate judgment.

[0039] For example, to transform the abstract concept of a user into a series of quantifiable metrics, upon receiving a user risk confirmation request, key metrics are first queried or calculated in real-time from the user profiling system and behavioral data warehouse. These metrics include: behavioral data volume (e.g., total historical logins, transaction counts, active days); user lifecycle (e.g., the length of time since registration); information completeness (e.g., whether real-name authentication, bank card binding, and mobile phone number verification have been completed and their completeness levels); and the current context (e.g., the business scenario of this request, such as large-amount transfers, small-amount payments, device trustworthiness). This process quickly outlines the user's trustworthiness profile and obtains inputs that determine the weighting bias.

[0040] Furthermore, to personalize the assessment strategy, the base credibility score is mapped to a final dynamic weight. The self-weight α is positively correlated with the base credibility, i.e., α = f(base credibility), where f is a monotonically increasing function. The association weight β is negatively correlated with the base credibility, i.e., β = 1 - α. This ensures a weight balance between self-risk and associated risk. For a returning user who has logged in 100 times, the system calculates α≈1 and β≈0, meaning the final risk score is almost entirely determined by their own behavior, reflecting fairness. For a new user logging in for the first time, the system calculates α≈0 and β≈1, meaning the final risk score is almost entirely determined by their associated network, reflecting security.

[0041] Furthermore, for marketing activities such as coupon distribution, flash sales, and exclusive benefits for new users, malicious users may register numerous fake accounts to claim coupons and snatch up flash sale items, exhausting the campaign budget and preventing genuine users from participating. For new accounts, due to the lack of historical behavior, their weight is heavily biased towards association risk. If the device, IP address, or phone number used by the account is detected to be associated with other known malicious user accounts or inactive accounts that claim coupons but never use them, its final risk score will be immediately increased, automatically blocking its coupon claiming or participation eligibility. For established accounts, even if a reputable user occasionally uses public networks, their weight is heavily biased towards their historical reputation, minimizing the impact of association risk and preventing accidental disqualification from participating in activities. This approach accurately protects the marketing budget, ensuring that discounts reach genuine users and improving marketing ROI.

[0042] In a second feasible implementation, step S20 may include: assigning different basic weights to different types of associated edges, such as ranking the weights as Device ID > Phone Number > Home IP > Company IP > Public IP > Weak Association. When calculating the association risk score, instead of a simple average of neighbor scores, a weighted average is calculated, where the weight represents the edge strength. That is, Association Risk Score = Σ(Basic Risk Score of Neighbor n * Edge Weight with Neighbor n) / Σ(Edge Weight). Ultimately, if a user shares a device with a high-risk user, their association risk score will be much higher than if they only share a public IP with multiple high-risk users. This greatly improves the accuracy of association risk assessment, reduces noisy associations such as interference from coincidental IP sharing, and makes risk assessment more refined with fewer false alarms. It is particularly suitable for highly adversarial scenarios, such as combating professional malicious users in bulk. Malicious users can easily change their IPs, but changing devices is costly. This solution can effectively identify deep associations that are disguised by changing IPs but cannot be changed devices.

[0043] Step S30: Determine the user level corresponding to the user to be confirmed based on the final risk score.

[0044] The user tier is a risk level system based on the final risk score. It discretizes the continuous risk score into several levels with clear business significance, and each level corresponds to different risk control strategies and handling methods.

[0045] In this embodiment, based on the user's final risk score, multiple threshold ranges are set to divide users into different levels. For example, users are divided into the following levels: L0 (trustworthy user), score < 0.2, meaning unimpeded access; L1 (low-risk user), 0.2 ≤ score < 0.5, meaning normal business processes with occasional spot checks; L2 (medium-risk user), 0.5 ≤ score < 0.8, meaning enhanced verification is triggered, such as SMS verification codes; L3 (high-risk user), score ≥ 0.8, meaning direct interception or manual review. Mapping continuous risk scores to a limited number of risk levels allows the system to adopt tiered and differentiated handling strategies for users with different risk levels.

[0046] In a first feasible implementation, step S30 may include: obtaining the decision context, which includes not only receiving the final risk score but also simultaneously obtaining the context information of this request, such as the business scenario (e.g., whether it's ordinary shopping, a large transfer, or claiming a high-value coupon) and user value (e.g., whether the user is an ordinary user or a high-value VIP). Based on different contexts, the corresponding dynamic grading strategy is queried from the strategy library. The strategy is not a fixed threshold but a variable function or rule set. For example, in scenario A (ordinary shopping), the threshold is consistent with the default strategy: low risk < 0.2. In scenario B (claiming a 100-yuan coupon), the risk control standard is tightened, and the threshold is adjusted to low risk < 0.1, medium risk 0.1~0.5, and high risk > 0.5. That is, a user with a score of 0.15 is low risk when shopping normally, but will be classified as medium risk when claiming a coupon. For example, user A is an ordinary user, classified according to the standard strategy. User B, a VIP user, is subject to a more lenient strategy, with the lower limit of the threshold for each level appropriately increased to reduce false negatives. Using the acquired final risk score and dynamic strategies, the system calculates the user's unique risk level within the current context and outputs the result. By combining the final risk score with the relative importance of the business, it recognizes that the same risk level can have different consequences in different business scenarios, allowing for differentiated processing and finding the optimal balance between security and user experience. This protects high-value user experiences, avoids unnecessary risk control interventions for core user groups, and enhances user loyalty and lifetime value.

[0047] For example, to make accurate judgments, upon receiving the final risk score, the following three types of key contextual information are simultaneously obtained through internal service calls or queries to the real-time data platform: Business scenario information, i.e., parsing request parameters to clarify the current event type, such as scene_id: "HIGH_VALUE_COUPON", indicating a 100-yuan coupon redemption, or transaction_amount: 50000, indicating a large-amount transfer. User value information, obtained by querying the user's tags from the user profile system, such as user_tier: "VIP", indicating a high-value user, or is_new_user: false, indicating a non-new user. Global risk situation, obtained from the risk control situation awareness platform, such as coupon_abuse_rate_in_last_hour: 15%, indicating the coupon's abuse rate in the past hour. Constructing a decision-making context, placing an isolated score within a rich business environment for evaluation provides comprehensive information input for making accurate judgments.

[0048] Furthermore, to perceive business scenarios and user importance, standardized context parameters are used as input to query a dynamic strategy library. This library contains pre-configured rule sets or weight models configured by risk control experts. For example, if the business scenario is "receiving a 100 yuan coupon" and the overall risk level is "high," then a "strict threshold set" is used. If the user's value level is "VIP" and the business scenario is "ordinary shopping," then a "relaxed threshold set" is used. Another example is a basic threshold set of [0, 0.2, 0.7, 1.0], but it is linearly adjusted based on the transaction amount; that is, the lower limit of the high-risk threshold = 0.7 - (transaction amount / 100000) * 0.2, meaning the larger the amount, the more likely it is to be labeled as high-risk. This transforms business knowledge into machine-executable instructions, making risk control strategies no longer rigid dogmas, but flexible intelligent agents capable of perceiving business scenarios and user value.

[0049] In a second feasible implementation, step S30 may include: In the risk control strategy configuration center, pre-define the final risk score threshold corresponding to each user level. For example, for low-risk users, 0 ≤ final risk score < 0.2; for medium-risk users, 0.2 ≤ final risk score < 0.7; and for high-risk users, 0.7 ≤ final risk score ≤ 1.0. After obtaining the final risk score of the user to be confirmed, compare it with the predefined threshold range, and determine the range to which it belongs through simple conditional judgment. The matched user level is then output as a clear label to the downstream risk control decision engine. The entire process does not involve complex calculations or external queries; it is only a single numerical comparison in memory, resulting in extremely low latency and the ability to handle tens of thousands of decision requests per second. Risk control strategy personnel can intuitively understand and adjust the thresholds, resulting in low operational costs.

[0050] In this embodiment, in response to a user level confirmation request, a homogeneous association graph corresponding to the user to be confirmed is obtained. This graph uses users as nodes and shared media as edges. Based on the first basic risk score of the target graph node corresponding to the user to be confirmed, and the second basic risk scores of the n-degree neighboring nodes of the target graph node, the final risk score of the user to be confirmed is determined. The user level corresponding to the user to be confirmed is determined based on the final risk score. The continuous probability scores of a machine learning model replace the binary decision of rules, and the association reasoning of the graph model compensates for the lack of individual information. That is, the risk score diffuses to users who have been exposed to the media through graph association, thereby improving their final risk score. The graph model greatly enhances the ability to identify mass crimes and new user cheating, effectively solving the cold start problem. This achieves the technical effect of improving cold start capability.

[0051] Based on Embodiment 1, in Embodiment 2 of this application, the same or similar content as in Embodiment 1 can be referred to the above description, and will not be repeated hereafter. Furthermore, the commonly used media include at least one of the following: the same device ID, the same IP address, the same mobile phone number, and the same Wi-Fi router.

[0052] In this embodiment, user behavior logs are collected from business servers, such as login, transaction, and registration servers. Each log entry should contain at least the following key fields: user_id: unique identifier of the user; timestamp: time of the event; device_id: device ID; ip_address: IP address; phone_number: mobile phone number used for registration or verification; wifi_ssid or wifi_bssid: Wi-Fi name or more precise physical address. Invalid values ​​are handled by filtering or filling in null values ​​and obviously incorrect device IDs, such as 000000, and internal network IP addresses, such as 192.168.xx. The media is standardized. For example, IPv6 addresses are converted to a unified format, mobile phone numbers are standardized to country code format, and device IDs are standardized to lowercase. A distributed data processing framework is used to process massive amounts of logs, generating graph node and edge data, and importing it into a graph database. All unique user_ids are extracted from the logs to generate User nodes. All unique device_ids, ip_addresses, etc., are extracted to generate corresponding device, IP, and other media nodes. For each log entry, an edge is created for the user_id and every existing media ID. For example, a login log entry containing user_id:U1, device_id:D1, and ip_address:IP1 will generate two edges: (U1) --> (D1) and (U1) --> (IP1). The generated node and edge files are then imported into a graph database in batches. By mining the resource connections behind users, such as devices and IPs, accurate profiles are created for new users who are otherwise difficult to assess, fundamentally improving the ability to prevent and control complex and emerging risks.

[0053] Based on any of the above embodiments of this application, Embodiment 3 of this application proposes a method for segmenting e-commerce users, which can be referred to the above description and will not be repeated hereafter. Based on this, the steps for determining the final risk score corresponding to the user to be confirmed, according to the first basic risk score of the target graph node corresponding to the user to be confirmed and the second basic risk score of the n-degree neighboring nodes of the target graph node, include: Step S201: Construct a first initial feature vector based on the first basic risk score and the node attributes of the target graph nodes.

[0054] Node attributes are static or dynamic data describing the characteristics of a graph node itself. Different types of nodes have different attribute sets. User node attributes describe the characteristics of a user's own state. These include static attributes such as registration duration, age, gender, real-name authentication level, and membership level; dynamic attributes such as the last login time, number of logins in the last 7 days, total transaction amount in the last 30 days, and average order value; and risk attributes such as the first basic risk score calculated by the model, the number of historical complaints, and historical violation records. Media node attributes describe the characteristics of the medium itself, such as devices and IP addresses. These include device node attributes such as device type (iOS / Android), operating system version, device first appearance time, total number of users who have used the device historically, and the percentage of high-risk users; and IP node attributes such as the IP's geographical location, ISP provider, IP type, total number of users who have used the IP historically, and the percentage of high-risk users. The first initial feature vector is a mathematical representation that transforms all relevant node attributes of the target graph node (i.e., the user to be confirmed) into a fixed-length numeric array through a series of technical processing steps.

[0055] In this embodiment, all node attributes related to the target graph node (i.e., the user to be confirmed) are extracted from data sources such as the user profiling system and business database. These attributes include core risk attributes (i.e., the first basic risk score), identity attributes (such as user registration duration, age, whether real-name authentication is required, and membership level), and behavioral attributes (such as total historical transaction amount, login frequency in the past 30 days, average order value, and complaint history). The obtained raw attributes are cleaned and formatted. For missing attributes, default values, mean values, medians, etc., are used to fill in the missing values. Obviously unreasonable values ​​are identified, corrected, or removed, such as age being 200 years old. The format of dates, category text, etc., is ensured to be consistent. The cleaned attributes are converted into numerical values ​​and scaled to a similar scale. This is the core operation for constructing feature vectors. Numerical attributes, such as the first basic risk score and transaction amount, are normalized, while categorical attributes, such as user level and device type, are encoded using one-hot encoding. For example, if user levels are [Normal, Silver, Gold], then "Normal" is encoded as [1,0,0], "Silver" as [0,1,0], and so on. The values ​​of all selected features are concatenated into a one-dimensional array in a predefined, fixed order. This array is the first initial feature vector. Transforming the user's multi-dimensional and heterogeneous attributes into a unified, fixed-dimensional numerical vector solves the problem that raw data cannot be directly processed by machine learning models. Incorporating the first basic risk score as a core attribute ensures that the user's risk level is not ignored or diluted in subsequent graph aggregation operations, laying the foundation for integrating individual and group risks.

[0056] Step S202: Based on the order from near to far, after multiple iterations, the second initial feature vectors corresponding to the n-degree neighbor nodes are successively fused into the first initial feature vector to generate the expression vectors corresponding to the target graph nodes.

[0057] The second initial feature vector is a digital representation of the neighboring nodes of the target graph node, including the second basic risk score and attribute features of the corresponding neighboring nodes. The expression vector is the final comprehensive vector representation of the target graph node generated after the iterative fusion process. The vector deeply integrates the target node's own information, i.e., the first initial feature vector, its local network structural information, and the attribute information of its neighboring nodes, i.e., the second initial feature vector.

[0058] In this embodiment, firstly, all first-degree neighbors of the target node are found. Then, an aggregation function, such as averaging, weighted summing, or taking the maximum value, is used to aggregate their second initial feature vectors to generate a neighbor summary vector. The target node's own vector, i.e., the first initial feature vector, is then combined with this neighbor summary vector using a combination function and passed through a neural network to generate the first-round updated vector of the target node. Based on the first-round updated node vector, the process continues. Now each first-degree neighbor node has an updated vector containing information about itself and its first-degree neighbors, i.e., the target node's second-degree neighbors. The aggregation and combination operations are performed again, but this time based on the updated first-degree neighbor vectors, to generate a second-round updated vector for the target node. This process is repeated n times. After k iterations, the target node's vector can capture the information of its k-degree neighbors. When the iteration reaches a preset depth n, the iteration stops. At this point, the final vector possessed by the target node is its expression vector. Through multi-level iteration, multi-hop, hidden connections between users can be revealed, thereby identifying organized fraudulent batches that deliberately avoid direct connections. The resulting expression vector is a highly condensed representation that is more representative of a user's true risk profile within the risk control network than any single base score or attribute.

[0059] Step S203: Determine the final risk score corresponding to the user to be confirmed based on the expression vector.

[0060] In this embodiment, the expression vector is input into a pre-trained final risk classifier, such as a neural network layer or a linear model, to obtain the final risk score corresponding to the user to be confirmed. The complex association patterns captured by the graph model are ultimately quantified into a scalar that can be directly used for comparison and decision-making, facilitating unified processing by the subsequent rule engine.

[0061] In this embodiment, by deeply integrating individual user characteristics with the complex relationship network they belong to, risks can be perceived more proactively, accurately, and comprehensively. In particular, it effectively solves the two fatal weaknesses of traditional risk control: cold start and mass fraud, thereby building a smarter and more robust security defense.

[0062] Based on any of the above embodiments of this application, Embodiment 3 of this application proposes a method for segmenting e-commerce users, which can be referred to the above description and will not be repeated hereafter. Based on this, please refer to... Figure 2 , Figure 2 This is a flowchart illustrating the fourth embodiment of the e-commerce user segmentation method in this application. Before the step of determining the final risk score corresponding to the user to be confirmed based on the first basic risk score of the target graph node corresponding to the user to be confirmed and the second basic risk score of the n-degree neighboring nodes of the target graph node, the e-commerce user segmentation method further includes: In step S21, in response to the prediction job request, the Spark cluster loads the model file from the HDFS database and distributes the model file as a broadcast variable to all Executor nodes in the cluster.

[0063] A prediction job request is an instruction or command, typically triggered by a scheduling system, API, or command-line tool, that requires the use of a specified model to perform risk prediction on data. Apache Spark is a fast, general-purpose distributed computing engine; a Spark cluster consists of one master node and multiple worker nodes. HDFS (Hadoop Distributed File System) is a distributed file system used to store extremely large datasets. Broadcast variables are a mechanism provided by Spark for efficiently distributing a large, read-only variable to all Executor nodes in the cluster. Broadcast variables are distributed only once, each Executor keeps a copy, and all Tasks share it. Executor nodes are the units of computation on worker nodes in a Spark cluster. Each worker node can run one or more Executors. An Executor is the process that actually performs the specific computational tasks.

[0064] In this embodiment, the Spark cluster's Driver program, i.e., the master node, receives prediction job requests from clients. The Driver parses the request, extracting key parameters, including the model file path (the storage location of the LightGBM model file to be loaded on HDFS) and the data path (the storage location of the user feature data for risk scoring on HDFS). Based on the parsed model file path, the Driver reads the model file from the HDFS distributed file system into the Driver node's local memory via the HDFS client interface. The Driver uses the Spark context's `broadcast` method to wrap the model object loaded into memory in the previous step into a broadcast variable. The Spark cluster's underlying mechanism automatically performs the distribution. After serializing the broadcast variable, the Driver distributes it over the network to all started Executor processes in the cluster. This deploys the core prediction capability from the central node to every front-line computing unit, ensuring that each Executor has all the necessary conditions to independently complete the prediction task, thus preparing for parallel computing.

[0065] Step S22: After the Executor node obtains the model file based on the broadcast variable, it constructs a model object based on the model file.

[0066] In this embodiment, the Executor node reads the raw data of the LightGBM model file from a locally cached broadcast variable. The Executor node uses the interface provided by the Booster class in the LightGBM library, which corresponds to the model type, to deserialize these byte streams. That is, it reconstructs the model structure and loads parameters in memory based on the file content. Once completed, an instance of the model object is created in the memory space of the Executor process. Each Executor node independently builds its own copy of the model object. When each node processes its assigned portion of the data, it does not need to communicate with the Driver or other nodes; it directly calls the model object for computation in its local memory. This significantly reduces network overhead.

[0067] Step S23: Upon receiving the data to be processed allocated by the Spark cluster, generate a basic risk score for each user based on the model object and write the basic risk score to the HDFS database.

[0068] In this embodiment, the Spark cluster's Driver reads massive amounts of user feature data from HDFS according to the data path. Spark's scheduler automatically divides the data into multiple data partitions and assigns each partition to an Executor node. Each Executor node, upon receiving its assigned data partition, loads it into its local memory. On each Executor node, multiple tasks are launched, with each Task processing a portion of the data in its partition. Each Task calls the prediction method of a pre-built local model object. The Task iterates through each user record it is responsible for, inputting the user's feature vector into the model object, which quickly calculates and returns a base risk score. The model object calculates a base risk score for each user, which is associated with the user's unique identifier, such as the User ID, forming a temporary set of user ID-base risk score key-value pairs in the Executor's memory. After processing its own data partition, each Task aggregates its result sets. The Executor nodes write these result data in parallel to HDFS. Spark manages this process, ensuring that the results from all partitions are correctly merged into the final output directory, forming a complete result file containing the risk scores of all users. By employing data parallelism and in-memory computing, massive prediction tasks are broken down and executed in parallel across the cluster, achieving processing efficiency unmatched by single-machine deployments. Raw user characteristics stored in HDFS are batch-transformed into risk scores with direct business value.

[0069] In this embodiment, data is processed in data shards and the model is broadcast in parallel, perfectly distributing the computational task across dozens or hundreds of computing nodes for simultaneous execution. This improves parallel prediction capabilities, saving 90% of the time compared to single-machine prediction, and achieving near real-time risk scoring for hundreds of millions of users. This makes large-scale, high-frequency risk scanning possible, enabling the response to rapid attacks from high-frequency services and malicious users.

[0070] Based on any of the above embodiments of this application, Embodiment 3 of this application proposes a method for segmenting e-commerce users, which can be referred to the above description and will not be repeated hereafter. Based on this, please refer to... Figure 3 , Figure 3 This is a flowchart illustrating Embodiment 5 of the tiering method for e-commerce users in this application. Prior to the steps of loading the model file from the HDFS database and distributing the model file as a broadcast variable to all Executor nodes in the cluster in response to a prediction job request, the tiering method for e-commerce users further includes: Step S24: Using the PU-Learning algorithm, the labeled black samples are used as positive examples and the unlabeled samples are used as negative examples to train an initial classifier. Based on the initial classifier, white samples are separated from the biased unlabeled samples.

[0071] Black samples are user or behavioral data that have been explicitly identified as malicious or high-risk. They are labeled based on historical risk control data, such as fraudulent transactions confirmed by manual review and banned accounts. White samples are normal, low-risk user or behavioral data. PU-Learning (Positive-Unlabeled Learning) is a special branch of machine learning used to solve classification problems with only some positive examples and a large number of unlabeled samples, but no negative examples. It does not rely on traditional positive-negative data, but instead assumes that unlabeled samples contain both hidden positive examples and true negative examples, aiming to identify these negative examples as accurately as possible from the unlabeled samples. The initial classifier is a preliminary, imperfect model trained using labeled black samples and all unlabeled samples.

[0072] In this embodiment, black samples are treated as positive examples, and all unlabeled samples are temporarily considered as negative examples. A binary classification model, such as LightGBM, is trained, which serves as the initial classifier. The trained initial classifier is used to predict all unlabeled samples, and the probability score of each sample belonging to the positive example (i.e., black sample) is obtained. Samples that are determined to be negative by the classifier with extremely high confidence, i.e., samples with predicted probability values ​​very close to 0, are considered white samples. In risk control scenarios, there are very few white samples that can be determined with 100% certainty, while PU-Learning does not rely on pure negative examples and directly extracts usable samples from noisy data.

[0073] Step S25: Construct a training set based on the white samples and black samples.

[0074] In this embodiment, the original black samples and the purified white samples are aggregated together. Since black samples are usually far fewer than white samples, directly training the model will bias it towards predicting white samples. The aggregated sample set is examined to address common class imbalance issues. For example, undersampling is used, randomly deleting a portion of the large number of white samples to bring their quantity closer to that of black samples. Oversampling methods, such as SMOTE, are used to synthesize new black samples, increasing their quantity. Class weighting is also employed, assigning higher weights to black samples during model training to encourage the model to correctly classify them. The aggregated and balanced complete sample set is then randomly shuffled and divided into three mutually exclusive subsets according to a certain ratio, resulting in a training set, a validation set, and a test set. The results of PU-Learning are solidified into a standard supervised learning dataset with reliable labels and a balanced distribution. The quality of this dataset is far superior to datasets trained directly with biased unlabeled samples. Through sample balancing and dataset partitioning, a solid foundation is laid for training a fair, stable, and highly generalizable final risk control model.

[0075] Step S26: Train the LightGBM model based on the training set, and serialize the trained LightGBM model into a model file.

[0076] The LightGBM (Light Gradient Boosting Machine) model is a gradient boosting framework that builds a powerful predictive model by combining a large number of weak decision trees. By learning the behavioral patterns of historical users (both good and bad), it automatically generates a complex set of risk assessment rules, enabling rapid and accurate risk assessment of new users.

[0077] In this embodiment, before training begins, numerous hyperparameters of the LightGBM model are set, such as learning rate, number of trees, maximum tree depth, minimum data size for leaf nodes, feature sampling ratio, and task type. Training set data is read, and LightGBM library functions, such as `lgb.train`, are called, passing in the training data and configured parameters to start the model training process. During training, evaluation metrics of the model on the training and validation sets are calculated in real time, and the trends of these metrics are monitored. The training process ends when the preset number of trees is reached or an early stopping condition is triggered. At this point, a complete LightGBM model object containing all tree structures and parameters is formed in memory. The `save_model` method of the LightGBM model object is called to convert the model object in memory into a specific file format and save the file to disk or directly write it to HDFS. This transforms high-quality training data into a predictive model with powerful risk identification capabilities. The generated model file is the foundation for all subsequent distributed, high-performance prediction services.

[0078] In this embodiment, the PU-Learning algorithm is used to cleverly extract high-quality white samples from massive unlabeled data using a small number of reliable black samples, thus constructing a training set with less noise and higher quality. This allows for the training of a LightGBM risk control model with better performance and greater robustness. This successfully solves the core contradiction of the difficulty in labeling negative samples and the inherent bias in data in risk control scenarios, achieving the goal of building a powerful risk control capability at a lower cost and higher efficiency.

[0079] Based on any of the above embodiments of this application, Embodiment Six of this application proposes a method for segmenting e-commerce users, which can be referred to the above description and will not be repeated hereafter. Based on this, please refer to... Figure 4 , Figure 4 This is a flowchart illustrating Embodiment Six of the e-commerce user segmentation method in this application. After determining the user segmentation level corresponding to the user to be confirmed based on the final risk score, the e-commerce user segmentation method further includes: Step S31: Determine the target business line based on the user level.

[0080] The target business line refers to the specific business process or system module to which the user request needs to be directed after the user level is determined, in order to perform specific risk control actions.

[0081] In this embodiment, the system receives user level labels for users to be confirmed, such as low risk, medium risk, and high risk. Based on the received user level, a predefined risk control strategy mapping table is queried. For example, if the user level is low risk, the target business line is determined to be the rapid processing line. If the user level is medium risk, the target business line is determined to be the standard verification line. If the user level is high risk, the target business line is determined to be the manual review line. Based on the query results, a unique target business line is determined. This maps abstract risk levels to specific, executable business processes, thereby generating actual prevention and control effects.

[0082] Step S32: Push the user hierarchy to the target business line so that the target business line can execute the corresponding business action based on the user hierarchy.

[0083] In this embodiment, based on the technical architecture and real-time requirements of the target business line, one or more push strategies are used to send out risk control decision event messages. The server of the target business line receives the risk control decision events through API interfaces or message subscriptions. The message content is parsed, core information is extracted, and the target business line triggers its internally predefined business logic based on the parsed user level. For example, if the user level is low risk, the target business line is designated as the express processing line, the transaction is directly approved, and the user enjoys password-free payment and coupons with no threshold. If the user level is medium risk, the target business line is designated as the standard verification line, requiring SMS verification code verification, triggering a slider verification code, and answering simple knowledge questions to confirm the delivery address. If the user level is high risk, the target business line is designated as the manual review line, the order is suspended, enters the manual review queue, triggers real-time outbound phone verification, and requires strong authentication such as facial recognition. This ensures that risk control decisions ultimately affect the business system, directly triggering business logic changes that are perceptible to the user, and is a direct means for risk control to impact user experience and business security.

[0084] In this embodiment, risk levels are accurately and automatically transformed into differentiated business actions through configurable strategy mapping and reliable message delivery, thereby achieving seamless integration of risk control and business, achieving the best balance between risk control and user experience, and providing a solid foundation for continuous optimization of risk control strategies.

[0085] Based on any of the above embodiments of this application, Embodiment Seven of this application proposes a method for segmenting e-commerce users, which can be referred to the above description and will not be repeated hereafter. Based on this, the steps for determining the final risk score corresponding to the user to be confirmed, according to the first basic risk score of the target graph node corresponding to the user to be confirmed and the second basic risk score of the n-degree neighboring nodes of the target graph node, include: Step S204: Determine the dynamic weight values ​​corresponding to the target graph nodes and their n-degree neighbor nodes.

[0086] In this embodiment, a set of nodes requiring weight allocation is identified from the isomorphic association graph, including target graph nodes and n-degree neighbor nodes. The attributes of each association edge are analyzed, such as the type of association medium and the association strength. Based on the risk control objective, a set of weight calculation rules is predefined, including association strength (e.g., shared devices have higher weights than shared IPs, and the more times they are shared, the higher the weight); association degree (e.g., directly associated nodes have the highest weight, and the weight decreases with increasing degree according to a decay factor); and node attributes (e.g., neighboring nodes may have higher weights if they are high-risk users, and lower weights if they are new users). For each edge between the target node and its neighboring nodes, an edge weight is calculated according to the weight calculation rules. For a given neighboring node, it may be associated with the target node through multiple media or paths. The weights of all associated edges of the neighboring node are aggregated to obtain a comprehensive dynamic weight for that neighboring node. The aggregation method can be taking the maximum value, average value, or weighted sum. Meanwhile, the target node's own weight is usually set to a fixed value or dynamically adjusted according to its credibility to balance its own risk and associated risk. The calculated target node weight and the dynamic weights of all n-degree neighboring nodes are output and passed to the next calculation module. The dynamic weights differentiate the influence of different neighboring nodes, making the risk calculation more consistent with real-world logic.

[0087] Step S205: Determine the weighted sum of the first basic risk score and the second basic risk score based on the dynamic weight value, and use the weighted sum as the final risk score.

[0088] In this embodiment, a weighted average of the risk scores of all neighboring nodes is calculated. For example, the second basic risk score = (β1 * neighbor 1 risk score + β2 * neighbor 2 risk score + ... + β_n * neighbor n risk score) / (β1 + β2 + ... + β_n). The target node's own risk is then weighted and summed with the network association risk obtained in the previous step. For example, the final risk score = α * first basic risk score + (1-α) * association risk score. By combining the two dimensions of self-risk and association risk, a more comprehensive risk assessment is generated. Through weighted summation, the effect of risk diffusion in the associated network is intuitively reflected.

[0089] In this embodiment, by using a dynamic weighting mechanism and weighted fusion, users are evaluated within their complex relationship network, enabling the risk control system to possess collective intelligence. This achieves a more accurate perception of hidden risks and a fairer assessment of individual risks, ultimately significantly improving the overall effectiveness and interpretability of the risk control system.

[0090] Based on any of the above embodiments of this application, Embodiment Eight of this application proposes a method for segmenting e-commerce users, which can be referred to the above description and will not be repeated hereafter. Based on this, the steps for determining the dynamic weight values ​​corresponding to the target graph node and its n-degree neighbor nodes include: Step S206: Determine the initial dynamic weight values ​​based on the amount of behavioral data associated with the target graph nodes, user lifecycle, and information completeness.

[0091] In this embodiment, key credibility indicators for target graph nodes are extracted and calculated from user profiles or behavioral databases. These include: behavioral data volume, which is the total number of historical user behavior events, such as total logins, total transactions, and number of viewed products; a larger volume indicates a richer and more stable user behavior pattern; user lifecycle, which is the length of time a user has been registered; a longer lifecycle indicates a longer history of interaction with the platform and potentially greater credibility accumulation; and information completeness, which assesses the completeness of the user's submitted personal information, such as whether real-name authentication is performed, whether a bank card is linked, and whether mobile phone and email are verified. A scoring card can be designed, with points added for each completed authentication. Normalization is performed to scale the data to a uniform range, and a weighted average function is used to merge the normalized indicators into a comprehensive credibility score, such as: Credibility Score = w1 * Normalized (Behavioral Data Volume) + w2 * Normalized (User Lifecycle) + w3 * Normalized (Information Completeness). Based on the calculated overall credibility score, two key initial dynamic weight values ​​are determined according to predefined rules: the target node's own weight α, which is positively correlated with the credibility score (i.e., the more trustworthy the user, the higher the weight of the first basic risk score in the final decision); and the overall weight β of n-degree neighboring nodes, which is negatively correlated with the credibility score (i.e., the more trustworthy the user, the lower the weight of the second basic risk score set in the final decision). For example, α = credibility score, β = 1 - credibility score. Alternatively, a sigmoid function or piecewise function can be used to map the weights, making them more sensitive to changes within a specific range. Not all users use the same set of weighting standards; instead, risk decision-making strategies are determined based on each user's history and behavior. For experienced users with rich behavioral data and complete information, their own behavior is trusted more, thus avoiding easy misjudgment due to accidental associations. For new users or low-activity users with sparse behavioral data and incomplete information, due to the lack of reliable personal history, their association networks are relied upon more for judgment, thus more strictly preventing potential risks.

[0092] Step S207: Based on the edge relationships between the target graph nodes and their n-degree neighboring nodes, correct the initial dynamic weight values ​​to obtain the dynamic weight values.

[0093] In this embodiment, attribute information of the edges connecting the target node and each of its n-degree neighboring nodes is extracted from the isomorphic association graph. This includes the associated medium type (the type of medium represented by the edge, such as device, IP address, phone number, Wi-Fi, etc.), association strength (the weight attribute of the edge, such as the number of times it is used, the duration of use, and the most recent usage time), and association degree (the shortest path hop count between the neighboring node and the target node). Based on risk control experience, a set of predefined correction rules or functions based on edge relationships are used to adjust the initial weights. Correction dimensions include: medium type correction, which sets a base weight multiplier for each medium type. For example, device multiplier = 1.2, indicating the highest strength; phone number multiplier = 1.1; IP address multiplier = 1.0, indicating a baseline multiplier; and public Wi-Fi multiplier = 0.7, indicating a lower strength. Association strength correction involves fine-tuning based on the edge strength attribute. For example, if the number of uses exceeds 10, the weight multiplier is increased by 1.1. Degree decay correction applies decay based on the association degree. For example, for second-degree neighbors, their initial weights are multiplied by a decay factor, such as 0.5. For each neighbor node, its initial weight value is multiplied by the correction multipliers of all relevant edge relationships to obtain the final dynamic weight value of that neighbor node. Through edge relationship correction, this difference can be quantified, allowing strongly associated, high-risk neighbors to have a greater impact on the final score, thus more accurately simulating risk diffusion. This enables the model to distinguish between risks arising from strong associations such as shared devices and weak associations such as shared public IPs, improving the granularity and accuracy of risk assessment.

[0094] In this embodiment, a two-level weighting mechanism is used to first determine the overall risk assessment strategy based on the user's own credibility, and then make local adjustments based on the nature of the specific relationship. This achieves deep personalization and context adaptation of the risk fusion strategy, thereby making more accurate, fair and interpretable risk judgments.

[0095] It should be noted that the above examples are only for understanding this application and do not constitute a limitation on the e-commerce user layering method of this application. Any simple modifications based on this technical concept are within the protection scope of this application.

[0096] This application provides a tiered e-commerce user device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, which are executed by the at least one processor to enable the at least one processor to perform the tiered e-commerce user method in Embodiment 1 above.

[0097] The following is for reference. Figure 5The diagram illustrates a structural schematic of a tiered device suitable for implementing the embodiments of this application for e-commerce users. The tiered device for e-commerce users in the embodiments of this application may include, but is not limited to, mobile terminals such as laptops, servers, and virtual machines, as well as fixed terminals such as desktop computers. Figure 5 The tiered devices for e-commerce users shown are merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0098] like Figure 5 As shown, the tiered device for e-commerce users may include a processing unit 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in read-only memory (ROM) 1002 or a program loaded from storage device 1003 into random access memory (RAM) 1004. The random access memory 1004 also stores various programs and data required for the operation of the e-commerce user's tiered device. The processing unit 1001, ROM 1002, and RAM 1004 are interconnected via a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Typically, the following systems can be connected to I / O interface 1006: input devices 1007 including, for example, touchscreens, touchpads, keyboards, mice, image sensors, microphones, accelerometers, gyroscopes, etc.; output devices 1008 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 1003 including, for example, magnetic tapes, hard disks, etc.; and communication devices 1009. Communication device 1009 allows the tiered device of an e-commerce user to communicate wirelessly or wiredly with other devices to exchange data. Although the figure shows tiered devices for e-commerce users with various systems, it should be understood that it is not required to implement or possess all the systems shown. More or fewer systems can be implemented or possessed alternatively.

[0099] Specifically, according to the embodiments disclosed in this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device, or installed from storage device 1003, or installed from ROM 1002. When the computer program is executed by processing device 1001, it performs the functions defined in the methods of the embodiments disclosed in this application.

[0100] The e-commerce user stratification device provided in this application, employing the e-commerce user stratification method in the above embodiments, can solve the technical problem of poor cold start capability. Compared with the prior art, the beneficial effects of the e-commerce user stratification device provided in this application are the same as those of the e-commerce user stratification device provided in the above embodiments, and other technical features in this e-commerce user stratification device are the same as those disclosed in the method of the previous embodiment, and will not be repeated here.

[0101] It should be understood that the various parts disclosed in this application can be implemented using hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics can be combined in any suitable manner in one or more embodiments or examples.

[0102] The above are merely specific embodiments of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0103] This application provides a computer-readable storage medium having computer-readable program instructions (i.e., a computer program) stored thereon, the computer-readable program instructions being used to execute the e-commerce user layering method in the above embodiments.

[0104] The computer-readable storage medium provided in this application may be, for example, a USB flash drive, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), flash memory, optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, system, or device. The program code contained on the computer-readable storage medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, radio frequency (RF), or any suitable combination thereof.

[0105] The aforementioned computer-readable storage medium may be included in the e-commerce user's tiered device; or it may exist independently and not be assembled into the e-commerce user's tiered device.

[0106] The aforementioned computer-readable storage medium carries one or more programs. When these programs are executed by the e-commerce user's hierarchical device, the e-commerce user's hierarchical device: in response to a user hierarchical confirmation request, obtains a homogeneous association graph corresponding to the user to be confirmed, wherein the homogeneous association graph has users as nodes and shared media among users as edges. Based on the first basic risk score of the target graph node corresponding to the user to be confirmed, and the second basic risk score of the n-degree neighboring nodes of the target graph node, the final risk score corresponding to the user to be confirmed is determined. Based on the final risk score, the user hierarchical level corresponding to the user to be confirmed is determined.

[0107] Computer program code for performing the operations of this application can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, as well as conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0108] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0109] The modules involved in the embodiments of this application can be implemented in software or hardware. The name of the module does not, in some cases, constitute a limitation on the unit itself.

[0110] The readable storage medium provided in this application is a computer-readable storage medium that stores computer-readable program instructions (i.e., a computer program) for executing the aforementioned e-commerce user tiering method, thereby solving the technical problem of poor cold start capability. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided in this application are the same as those of the e-commerce user tiering method provided in the above embodiments, and will not be repeated here.

[0111] This application provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the e-commerce user segmentation method described above.

[0112] The computer program product provided in this application can solve the technical problem of poor cold start capability. Compared with the prior art, the beneficial effects of the computer program product provided in this application are the same as the beneficial effects of the e-commerce user stratification method provided in the above embodiments, and will not be repeated here.

[0113] The above are merely preferred embodiments of this application and do not limit the patent scope of this application. Any equivalent structural or procedural transformations made using the content of this application's specification and drawings, or direct or indirect applications in other related technical fields, are similarly included within the patent scope of this application.

Claims

1. A method for segmenting e-commerce users, characterized in that, The method for segmenting e-commerce users includes: In response to a user-level confirmation request, obtain the isomorphic association graph corresponding to the user to be confirmed, wherein the isomorphic association graph has users as nodes and the medium used by the users as edges; The final risk score of the user to be confirmed is determined based on the first basic risk score of the target graph node corresponding to the user to be confirmed and the second basic risk score of the n-degree neighboring nodes of the target graph node. The user level corresponding to the user to be confirmed is determined based on the final risk score.

2. The e-commerce user segmentation method as described in claim 1, characterized in that, The shared medium includes at least one of the following: the same device ID, the same IP address, the same mobile phone number, and the same Wi-Fi router.

3. The e-commerce user segmentation method as described in claim 1, characterized in that, The step of determining the final risk score of the user to be confirmed based on the first basic risk score of the target graph node corresponding to the user to be confirmed and the second basic risk score of the n-degree neighboring nodes of the target graph node includes: Based on the first basic risk score and the node attributes of the target graph nodes, a first initial feature vector is constructed; Based on the order from near to far, through multiple iterations, the second initial feature vector corresponding to the n-degree neighbor node is successively fused to the first initial feature vector to generate the expression vector corresponding to the target graph node. The second initial feature vector includes the second basic risk score and attribute features of the corresponding neighbor node. The final risk score corresponding to the user to be confirmed is determined based on the expression vector.

4. The e-commerce user segmentation method as described in claim 1, characterized in that, Before the step of determining the final risk score of the user to be confirmed based on the first basic risk score of the target graph node corresponding to the user to be confirmed and the second basic risk score of the n-degree neighboring nodes of the target graph node, the e-commerce user segmentation method further includes: In response to a prediction job request, the Spark cluster loads the model file from the HDFS database and distributes the model file as a broadcast variable to all Executor nodes in the cluster. After the Executor node obtains the model file based on the broadcast variable, it constructs a model object based on the model file; Upon receiving the pending data allocated by the Spark cluster, a basic risk score is generated for each user based on the model object, and the basic risk score is written to the HDFS database.

5. The e-commerce user segmentation method as described in claim 4, characterized in that, Prior to the step of loading a model file from the HDFS database and distributing the model file as a broadcast variable to all Executor nodes of the cluster in response to a prediction job request, the tiered method for e-commerce users further includes: The PU-Learning algorithm is used to train an initial classifier by taking labeled black samples as positive examples and unlabeled samples as negative examples. Based on the initial classifier, white samples are separated from the biased unlabeled samples. A training set is constructed based on the white samples and the black samples; The LightGBM model is trained based on the training set, and the trained LightGBM model is serialized into the model file.

6. The e-commerce user segmentation method as described in claim 1, characterized in that, After the step of determining the user level corresponding to the user to be confirmed based on the final risk score, the e-commerce user segmentation method further includes: Determine the target business line based on the user hierarchy; The user hierarchy is pushed to the target business line so that the target business line can perform corresponding business actions based on the user hierarchy.

7. The e-commerce user segmentation method as described in claim 1, characterized in that, The step of determining the final risk score of the user to be confirmed based on the first basic risk score of the target graph node corresponding to the user to be confirmed and the second basic risk score of the n-degree neighboring nodes of the target graph node includes: Determine the dynamic weight values ​​corresponding to the target graph node and the n-degree neighbor node; The weighted sum of the first basic risk score and the second basic risk score is determined based on the dynamic weight value, and the weighted sum is used as the final risk score.

8. The e-commerce user segmentation method as described in claim 7, characterized in that, The step of determining the dynamic weight values ​​corresponding to the target graph node and the n-degree neighbor node includes: Preliminary dynamic weight values ​​are determined based on the amount of behavioral data associated with the target graph node, the user lifecycle, and the information completeness. The amount of behavioral data, the user lifecycle, and the information completeness are all positively correlated with the weight values ​​of the target graph node and negatively correlated with the weight values ​​of the n-degree neighbor nodes. Based on the edge relationships between the target graph nodes and their n-degree neighboring nodes, the initial dynamic weight values ​​are corrected to obtain the dynamic weight values.

9. A tiered device for e-commerce users, characterized in that, The e-commerce user tiering device includes: a memory, a processor, and a computer program stored on the memory and executable on the processor, the computer program being configured to implement the steps of the e-commerce user tiering method as described in any one of claims 1 to 8.

10. A storage medium, characterized in that, The storage medium is a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, it implements the steps of the e-commerce user tiering method as described in any one of claims 1 to 8.

Images