Digital rights-based data processing and anomaly identification method and device, equipment, storage medium and program product

Abstract

This application relates to a method, apparatus, device, storage medium, and program product for data processing and anomaly identification based on digital rights. The method includes: in response to a registration request initiated by a first terminal based on an invitation identifier, establishing an association between the first terminal and a second terminal that generated the invitation identifier; and, if the identity authentication information of the first account passes security verification, triggering a preset digital rights smart contract to issue corresponding digital rights to the second account and the first account. The settlement of digital rights uses digital vouchers pegged 1:1 to fiat currency and is executed through a smart contract. In response to a processing request for digital rights, multi-dimensional behavioral characteristic data of the requester is extracted, a risk score is obtained through a trained risk assessment model, and a target processing strategy is determined based on the risk score to execute corresponding control operations. This method can significantly improve the security of the digital rights transfer process.

Description

Technical Field

[0001] This application relates to the fields of blockchain and digital rights processing technology, and in particular to a method, apparatus, computer equipment, computer-readable storage medium and computer program product for data processing and anomaly identification based on digital rights. Background Technology

[0002] Against the backdrop of rapid development of the digital economy, various industries such as banking, telecommunications, shopping malls and supermarkets, and aviation have widely adopted membership points systems to enhance user stickiness.

[0003] Current points systems are mostly isolated, forming closed ecosystems that limit the circulation value of points and user participation. Meanwhile, when using points for user growth, companies generally rely on platforms unilaterally distributing subsidies. This extensive operational approach not only leads to continuously rising customer acquisition costs but also makes them highly vulnerable to attacks from third parties using virtual devices for bulk registration and automated scripts to fraudulently obtain rewards, severely diluting marketing budgets and impacting the experience of genuine users. Furthermore, existing anti-fraud solutions primarily rely on rule-based engines, which struggle to effectively identify complex group cheating and abnormal transactions.

[0004] Therefore, a more secure solution for points transfer and user growth is needed. Summary of the Invention

[0005] Therefore, it is necessary to provide a more secure method, apparatus, computer equipment, computer-readable storage medium, and computer program product for data processing and anomaly identification based on digital rights, addressing the aforementioned technical issues.

[0006] Firstly, this application provides a data processing and anomaly identification method based on digital rights, the method comprising:

[0007] In response to the registration request initiated by the first terminal based on the invitation identifier, an association is established between the first account corresponding to the first terminal and the second account logged in by the second terminal that generated the invitation identifier;

[0008] Obtain the identity authentication information and runtime environment characteristics of the first account, and verify the identity authentication information based on the identity authentication information and runtime environment characteristics;

[0009] Once the identity authentication information passes the security verification, the preset digital rights smart contract is triggered to issue the corresponding digital rights to the second account and the first account. The settlement of digital rights uses digital vouchers pegged 1:1 to fiat currency and is executed through the smart contract.

[0010] In response to a processing request for digital rights, multidimensional behavioral feature data of the sender of the processing request is extracted, and the multidimensional behavioral feature data is input into a trained risk assessment model for risk assessment to obtain a risk score.

[0011] The target treatment strategy is determined based on the risk score, and the corresponding control operations are executed based on the target treatment strategy.

[0012] In some exemplary embodiments, the identity authentication information and runtime environment characteristics of the first account are obtained, and the identity authentication information is verified based on the identity authentication information and runtime environment characteristics, including:

[0013] Parse the identity authentication information, extract the identity identifier from the identity authentication information, and check whether the identity identifier matches the preset restriction database;

[0014] If the identity identifier does not match the restricted database, the preset identity verification interface is called to verify the identity authentication information, extract the device fingerprint and network address from the operating environment characteristics, and count the registration frequency of the device fingerprint and network address within the preset time window.

[0015] If the number of registrations exceeds a preset threshold, the identity authentication information is deemed to have failed verification, and the digital rights rewards corresponding to the association are frozen.

[0016] In some exemplary embodiments, a preset digital rights smart contract is triggered to issue corresponding digital rights to the second account and the first account. The settlement of the digital rights uses digital certificates pegged 1:1 to fiat currency. After execution through the smart contract, the method further includes:

[0017] Periodically traverse the established relationships and construct a relationship graph containing multiple account nodes and hierarchical depth based on a preset graph database;

[0018] Based on the connection topology of each account node in the relationship chain graph, determine the influence score of each account node;

[0019] Ranking rewards are distributed to accounts and nodes that meet preset conditions based on their influence scores.

[0020] In some exemplary embodiments, multidimensional behavioral feature data of the sender of the processing request is extracted, and the multidimensional behavioral feature data is input into a trained risk assessment model for risk assessment to obtain a risk score, including:

[0021] The data includes the historical processing data, equipment environment data, and correlation graph data of the sender of the processing request. The multidimensional behavioral feature data includes historical processing data, equipment environment data, and correlation graph data.

[0022] Vectorization is performed on historical processing data, equipment environment data, and related map data to obtain feature vectors;

[0023] The feature vector is input into the trained risk assessment model to perform risk assessment and obtain a risk score. The risk assessment model is trained based on a graph neural network.

[0024] In some exemplary embodiments, a target processing strategy is determined based on a risk score, and corresponding control operations are performed based on the target processing strategy, including:

[0025] If the risk score is less than or equal to the preset first threshold, the target processing strategy is determined to be automatic release of the processing request, and the execution log for the processing request is recorded.

[0026] If the risk score is greater than the preset first threshold and less than or equal to the preset second threshold, the target processing strategy is determined to be secondary verification, and a biometric verification instruction is sent to the sender who initiated the processing request.

[0027] If the risk score is greater than the preset second threshold, the target processing strategy is determined to be interception and freezing, and the account that initiated the processing request is marked as being in a risky state.

[0028] In some exemplary embodiments, after sending the biometric verification instruction to the sender initiating the processing request, the method further includes:

[0029] Receive the biometric verification results returned by the sender;

[0030] If the biometric verification result is successful, the request will be allowed to proceed, and the historical risk weight factor corresponding to the account that initiated the request will be lowered.

[0031] If the biometric verification result is that the verification fails, the processing request will be frozen and the account will be prohibited from initiating a new processing request within a preset time period.

[0032] Secondly, this application also provides a data processing and anomaly detection device based on digital rights, comprising:

[0033] The request and response module is used to respond to the registration request initiated by the first terminal based on the invitation identifier and establish the association between the first account corresponding to the first terminal and the second account logged in by the second terminal that generated the invitation identifier.

[0034] The verification module is used to obtain the identity authentication information and runtime environment characteristics of the first account, and to verify the identity authentication information based on the identity authentication information and runtime environment characteristics.

[0035] The reward distribution module is used to trigger a preset digital rights smart contract when the identity authentication information passes the security verification, and distribute the corresponding digital rights to the second account and the first account. The settlement of digital rights adopts digital vouchers pegged 1:1 to fiat currency and is executed through smart contracts.

[0036] The risk assessment module is used to respond to processing requests for digital rights, extract multi-dimensional behavioral feature data of the sender of the processing request, and input the multi-dimensional behavioral feature data into the trained risk assessment model to conduct risk assessment and obtain a risk score.

[0037] The execution module is used to determine the target processing strategy based on the risk score and to execute the corresponding control operations based on the target processing strategy.

[0038] Thirdly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in any of the above embodiments of the data processing and anomaly identification method based on digital rights.

[0039] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps in any of the above embodiments of the data processing and anomaly identification method based on digital rights.

[0040] Fifthly, this application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps in any of the above embodiments of the data processing and anomaly identification method based on digital rights.

[0041] The aforementioned data processing and anomaly detection methods, devices, computer equipment, computer-readable storage media, and computer program products based on digital rights establish account associations through invitation identifiers and further combine identity authentication information and operating environment characteristics for dual security verification. This effectively overcomes the limitations of traditional single-dimensional identity verification, accurately identifying and intercepting mass fraudulent registrations using virtual devices and automated scripts. It also significantly reduces resource consumption and marketing costs associated with deliberate fraudulent activity while protecting the rights of genuine users. Secondly, after successful security verification, a pre-set digital rights smart contract is triggered to distribute rewards in both directions. This ensures the transparency and immutability of the incentive process and improves the efficiency and credibility of reward settlement through the automatic execution of smart contracts, thereby significantly enhancing the growth and referral power of existing users. Finally, multi-dimensional behavioral feature extraction and a trained risk assessment model are introduced for digital rights processing requests. This allows for dynamic determination of target handling strategies and execution of corresponding control operations based on the output risk score. The entire solution can identify and differentiate complex abnormal transactions or potential fraudulent behaviors in real time without affecting the normal user experience, thereby significantly improving the security and business compliance in the process of digital rights transfer. Attached Figure Description

[0042] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0043] Figure 1 This is an application environment diagram of a data processing and anomaly detection method based on digital rights in one embodiment.

[0044] Figure 2 This is a flowchart illustrating a data processing and anomaly detection method based on digital rights in one embodiment;

[0045] Figure 3 This is a flowchart illustrating the identity authentication steps in one embodiment;

[0046] Figure 4 This is a flowchart illustrating the reward distribution steps in another embodiment;

[0047] Figure 5 This is a flowchart illustrating the execution of control operation steps in another embodiment;

[0048] Figure 6This is a structural block diagram of a data processing and anomaly detection device based on digital rights in one embodiment;

[0049] Figure 7 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0050] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0051] It should be noted that the terms "first," "second," etc., used in this application can be used to describe various elements, but these elements are not limited by these terms. These terms are only used to distinguish the first element from the second element. The terms "comprising" and "having," and any variations thereof, used in this application, are intended to cover non-exclusive inclusion. The term "multiple" used in this application refers to two or more. The term "and / or" used in this application refers to one of the embodiments, or any combination of multiple embodiments.

[0052] The data processing and anomaly identification method based on digital rights provided in this application can be applied to, for example... Figure 1 In the application environment shown, the first terminal 102 and the second terminal 104 communicate with the cloud server cluster 106 (which includes application servers, digital RMB clearing and settlement nodes, and consortium blockchain consensus nodes, not shown in the figure) via a network. The data storage server can store the data that the cloud server cluster 106 needs to process. The data storage server can be integrated into the cloud server cluster 106, or it can be located in the cloud or on other network servers.

[0053] Specifically, in practical applications, when a consumer uses their mobile terminal (first terminal) to scan an existing user's QR code or clicks on a unique invitation link, a registration request with an invitation identifier is sent to the application server in the cloud server cluster. Upon receiving the request, the application server automatically establishes a binding relationship between the consumer's newly registered account (first account) and the existing user's account (second account) in the background database. Next, the system activates a security access mechanism, obtaining the user's submitted real-name authentication information and the current mobile phone's operating environment characteristics (such as device fingerprint, IP address, etc.), and performs cross-verification using preset risk control rules to identify fraudulent registrations. Once the identity authentication information passes the security verification, the application server calls the digital rights smart contract deployed on the consortium blockchain consensus node, triggering automated distribution logic to accurately distribute preset rewards (such as digital RMB red envelopes or points) to the digital wallets of both existing and new users. Subsequently, when a new or existing user attempts to use these digital rights to initiate a withdrawal or consumption request, the application server extracts their multi-dimensional behavioral characteristic data in real time and inputs it into a trained risk assessment model for deep calculation to derive a risk score. Finally, the target processing strategy is dynamically determined based on the score, and the corresponding control operations are executed based on the target processing strategy.

[0054] The first terminal 102 and the second terminal 104 can be, but are not limited to, various personal computers, laptops, smartphones, tablets, drones, low-altitude aircraft, IoT devices, and portable wearable devices. IoT devices can include smart speakers, smart TVs, smart air conditioners, smart in-vehicle devices, projection devices, etc. Portable wearable devices can include smartwatches, smart bracelets, head-mounted displays, etc. Head-mounted displays can be virtual reality (VR) devices, augmented reality (AR) devices, smart glasses, etc. The cloud server cluster 106 can also contain other types of nodes.

[0055] In one exemplary embodiment, such as Figure 2 As shown, a data processing and anomaly identification method based on digital rights is provided, which can be applied to... Figure 1 Taking cloud server cluster 106 as an example, the explanation includes steps 100 to 500. Among them:

[0056] Step 100: In response to the registration request initiated by the first terminal based on the invitation identifier, establish the association between the first account corresponding to the first terminal and the second account corresponding to the second terminal that generated the invitation identifier.

[0057] An invitation identifier is a unique data credential used to identify a specific inviter and initiate user acquisition or registration. It is typically composed of letters, numbers, or specific characters, and can be recognized by the system and associated with a specific invitation source. In this step, it is used to trigger the new user's registration process and establish a relationship link between new and existing users. The first terminal refers to the user device that initiates the registration request. It can be a smartphone, tablet, personal computer, or other computing device with network communication capabilities. In this embodiment, the first terminal specifically refers to the client device logged into by the new user. The second terminal refers to the user device that generates the invitation identifier and acts as the inviter. It can also be various network-connected terminal devices. In this embodiment, the second terminal represents existing users (i.e., old users) who generate an invitation link or code through their device to guide new users to complete registration. The first account refers to the user account that will be created and logged into on the first terminal in response to the registration request, used to identify the new user. The second account refers to the user account already logged into on the second terminal, acting as the initiator of the invitation behavior, and is associated with the first account. The relationship refers to the logical connection between two accounts, used to record the topology of invitations and being invited, and recommendations and being recommended between users. This relationship will serve as the data foundation for subsequent rights distribution, reward calculation and behavior tracking.

[0058] In practical applications, the server might receive a registration request from a first terminal, which carries an invitation identifier (such as a UUID as an invitation code) generated by a second terminal. The server parses the request, extracts the invitation identifier field, and queries the database for the second account information corresponding to that invitation identifier. Next, the server verifies the validity of the invitation code. After confirming the validity, the server creates a new record in the user relationship table of the database, binding the first account (which could be an ID generated during registration) to the second account, establishing a connection. This connection not only records the invitation chain between users but also provides data support for subsequent referral incentives and the transfer of benefits.

[0059] In other embodiments, a second terminal may generate a QR code image containing an invitation identifier. The first terminal scans the QR code with its camera, parses the invitation identifier, and sends it to the server along with the registration request. After verifying the validity of the QR code, the server establishes a link between the two accounts. This method is applicable to offline promotion or instant messaging scenarios, enhancing the flexibility and security of the invitation method.

[0060] Step 200: Obtain the identity authentication information and operating environment characteristics of the first account, and verify the identity authentication information based on the identity authentication information and operating environment characteristics.

[0061] Identity authentication information refers to the data set used to prove and verify a user's true identity, typically including but not limited to user nicknames, mobile phone numbers, and other data that can uniquely identify an identity. Operating environment characteristics refer to attribute parameters reflecting the current hardware and software status and network environment of the first terminal device, mainly including but not limited to device model, operating system version, screen resolution, browser fingerprint, network IP address, and carrier type. In this implementation, the verification of identity authentication information may include the server-side review of the legality, authenticity, and security of the received data. Specifically, the verification may combine identity authentication information and operating environment characteristics to comprehensively determine whether the registration request was initiated by a genuine user on a trusted device, in order to identify and block fraudulent or intentional registration behavior.

[0062] In practical applications, the server can receive identity authentication information reported by the first terminal (such as the user's entered name and ID number) and runtime environment characteristics (such as device fingerprint, IP address, MAC address, etc.) collected through the SDK. Next, the server initiates security verification logic. On one hand, it compares the extracted identity identifier (such as ID number) with the system's preset restriction database (i.e., blacklist) in real time to detect whether the identity has participated in intentional fraudulent activity or has been banned, i.e., whether the identity identifier matches the blacklist. If it does not match the blacklist, the server will further call an authoritative identity verification interface (such as the CTID interface of an authoritative platform) to verify the authenticity of the real-name information submitted by the user. On the other hand, the server will count the registration frequency of the device fingerprint and network IP address in the runtime environment characteristics within a preset time window (such as 1 hour). If the number of registrations under the same device or IP exceeds the preset frequency threshold, the server will determine that the batch of requests is suspected of being machine-generated bulk registration, thus directly determining that the identity authentication information verification fails and freezing the digital rights rewards associated with the account to reduce the possibility of resources being exploited by "wool party" members.

[0063] Step 300: If the identity authentication information passes the security verification, the preset digital rights smart contract is triggered to issue the corresponding digital rights to the second account and the first account. The settlement of digital rights adopts digital vouchers pegged 1:1 to fiat currency and is executed through smart contracts.

[0064] A digital rights smart contract is a piece of automatically executed computer code deployed on a blockchain or distributed ledger. It contains preset reward distribution rules, triggering conditions, and fund flow logic. When specific preconditions are met (such as identity authentication information passing security verification), the contract executes automatically without human intervention, ensuring the transparency, immutability, and security of rights distribution. Digital rights rewards refer to virtual assets with specific value circulating within the platform ecosystem, which can take the form of points, miles, tokens, digital RMB, or various membership rights certificates. In this embodiment, digital rights rewards specifically refer to the incentive resources automatically distributed by the system to new users (first account) who have completed valid registration and their inviters (second account) according to the fission incentive rules.

[0065] Following the previous step, once the server confirms that the identity authentication information and operating environment characteristics of the first account have passed the anti-fraud screening and security verification, it will immediately generate a "verification passed" instruction and call the preset digital rights smart contract interface. Next, the server passes the necessary parameters to the smart contract, including the unique identifier of the first account, the unique identifier of the second account, and the reward amount corresponding to this referral activity. After the smart contract is triggered on-chain or in a trusted execution environment, it will automatically generate two transfer transactions according to the preset business logic: one transfers the corresponding amount of digital rights reward to the asset account of the first account (new user), and the other transfers the corresponding referral incentive to the asset account of the second account (inviter). Specifically, the digital rights reward is settled in digital vouchers (such as digital RMB red envelopes) pegged 1:1 to fiat currency, possessing extremely high value stability and liquidity.

[0066] After the on-chain asset transfer and ledger update are completed, the smart contract will trigger the corresponding state change event and write a record containing key information such as the transacting parties, amount, and timestamp into the blockchain for notarization, forming an immutable transaction certificate. Finally, after the application server detects the successful event on the chain, it will synchronously update the user asset data in the local business database and push a notification of the credited rights to both terminals, thus completing the entire process from command triggering to asset settlement.

[0067] In other embodiments, to address on-chain congestion in high-concurrency scenarios, servers can employ state channel technology to execute reward distribution. In this approach, a bidirectional state channel is pre-established between the server and the smart contract, and a portion of the digital rewards is pre-stored in the channel. When a large number of new users pass security verification, the server does not directly trigger the contract on the main chain for each transaction. Instead, it directly updates the balance status of the first and second accounts within the state channel and generates the latest balance certificate with both parties' signatures. Only at the end of the settlement cycle or when the channel is closed is the final balance snapshot packaged and submitted to the smart contract for a one-time settlement. This method significantly improves the throughput and response speed of reward distribution while reducing the interaction costs of the blockchain network.

[0068] In other embodiments, considering the differences in viral value across different time periods or user groups, smart contracts can be designed to support dynamic parameter configuration. When the server triggers the contract, in addition to passing in the account identifier, it also calculates a dynamic benefit coefficient based on the current marketing campaign strategy (e.g., "double points on weekends," "double rewards for new users in specific industries") and passes it into the contract. The smart contract contains a basic reward algorithm that combines the passed-in dynamic coefficient with the basic reward value to determine in real time the specific amount of digital benefits ultimately distributed to the first and second accounts.

[0069] Step 400: In response to a processing request for digital rights, extract multidimensional behavioral feature data of the sender of the processing request, and input the multidimensional behavioral feature data into a trained risk assessment model for risk assessment to obtain a risk score.

[0070] A processing request refers to various consumption or transfer instructions initiated by a user regarding their acquired digital rights, including but not limited to actions that change the account's status such as points redemption, cash withdrawals and transfers, and virtual asset transfers. Multidimensional behavioral characteristic data refers to a set of parameters collected in real-time when a processing request occurs, comprehensively characterizing the attributes of that operation. This includes indicators across multiple dimensions such as the user's historical transaction frequency, device environment information, network IP attributes, and relational graphs extracted from graph databases.

[0071] Risk assessment models refer to machine learning algorithm models (such as GNN models based on graph neural networks) that are pre-trained using massive amounts of historical sample data. They have the ability to perform in-depth analysis and reasoning on complex input data and can accurately identify abnormal or fraudulent patterns hidden under normal appearances.

[0072] In practical applications, when a first terminal initiates a request to process digital rights (e.g., a user clicks "withdraw points" or "redeem goods"), the server captures the request event in real time. Then, it retrieves data related to the request from multiple dimensions in parallel: At the basic level, it extracts historical behavioral data such as the user's transaction frequency and average amount over the past hour and 24 hours; at the environmental level, it obtains the device fingerprint, IP address location, and carrier information of the current terminal; at the association level, it queries the backend graph database to check if the account has any "partner" nodes that share devices, have clustered IPs, or frequently interact. Subsequently, the server performs unified vectorization processing on these heterogeneous feature data, concatenating them into a high-dimensional feature vector. Finally, this feature vector is input in real time into a pre-trained risk assessment model (such as a GNN model) for forward inference calculation. The model outputs a risk score between 0 and 1 within milliseconds, serving as the core basis for subsequent decision-making.

[0073] Step 500: Determine the target treatment strategy based on the risk score, and execute the corresponding control operations based on the target treatment strategy.

[0074] The target handling strategy refers to the specific response plan dynamically matched based on risk scores and pre-defined business security rules. Control operations may include, but are not limited to, modifying order status in the database, freezing related account assets, issuing specific interactive instructions to clients, or recording audit logs.

[0075] In practical applications, the server can call the risk assessment model to output a risk score for the current processing request and then compare this score with a pre-configured multi-level threshold range. If the risk score is in the extremely low-risk range (e.g., less than or equal to the first preset threshold), the decision engine will determine the target processing strategy as "direct release" and trigger corresponding control operations, allowing the digital rights exchange or transfer transaction to continue, while generating a normal business execution log in the background database. If the risk score falls into the medium-risk gray range (e.g., greater than the first preset threshold but less than or equal to the second preset threshold), the decision engine will determine that an additional security verification step is needed, thus determining the target processing strategy as "secondary verification." At this time, the server will pause the current transaction process and send a biometric verification instruction (such as requiring the user to perform facial recognition or fingerprint verification) to the first terminal that initiated the request. If the risk score exceeds the high-risk warning line (e.g., greater than the second preset threshold), the decision engine will immediately determine the target processing strategy as "interception and freeze," triggering control operations including directly blocking the transaction, marking the account as a high-risk abnormal state, and possibly simultaneously freezing its associated digital rights assets to reduce potential losses.

[0076] In other embodiments, to prevent special scenarios where the model score is low but the transaction objectively possesses high-risk attributes (such as a large single withdrawal amount or involving modification of core passwords), the server can add a layer of static rule pre-screening before executing the risk score-based strategy judgment. The system extracts key parameters (such as transaction amount and operation type) from the processing request and determines whether they meet the preset "mandatory verification conditions." Once the conditions are met, regardless of the subsequent risk score given by the model, the server will directly ignore the score, forcibly lock the target processing strategy to "secondary verification," and immediately issue a biometric verification command to the terminal. This dual verification mechanism can effectively compensate for the potential risk of missed judgments in pure algorithmic models when facing extremely large transactions.

[0077] The aforementioned data processing and anomaly identification method based on digital rights establishes connections between accounts by responding to invitation identifiers and further combines identity authentication information and operational environment characteristics for dual security verification. This effectively overcomes the limitations of traditional single-dimensional identity verification, accurately identifying and intercepting mass fraudulent registrations using virtual devices and automated scripts. It also significantly reduces resource consumption and marketing costs associated with deliberate fraudulent activity while protecting the rights of genuine users. Secondly, after successful security verification, a pre-set digital rights smart contract is triggered to distribute rewards in both directions. This ensures the transparency and immutability of the incentive process and improves the efficiency and credibility of reward settlement through the automatic execution of smart contracts, thereby significantly enhancing the growth and referral power of existing users. Finally, multi-dimensional behavioral feature extraction and a trained risk assessment model are introduced for digital rights processing requests. This allows for dynamic determination of target handling strategies and execution of corresponding control operations based on the output risk score. The entire solution can identify and differentiate complex abnormal transactions or potential fraudulent behaviors in real time without affecting the normal user experience, thus significantly improving the security and business compliance of the digital rights circulation process.

[0078] like Figure 3 As shown, in some exemplary embodiments, step 200 includes:

[0079] Step 220: Parse the identity authentication information, extract the identity identifier from the identity authentication information, and check whether the identity identifier matches the preset restriction database.

[0080] Step 240: If the identity identifier does not match the restriction database, call the preset identity verification interface to verify the identity authentication information, extract the device fingerprint and network address from the operating environment characteristics, and count the registration frequency of the device fingerprint and network address within the preset time window.

[0081] Step 260: If the registration frequency exceeds a preset frequency threshold, it is determined that the identity authentication information has failed the verification, and the digital rights rewards corresponding to the association are frozen.

[0082] A restriction database refers to a pre-defined data set used to store known violations, restricted, or blacklisted identities, for quickly determining whether an identity belongs to a restricted entity. A device fingerprint is a unique identifier generated by collecting hardware characteristics, software configurations, operating system information, etc., from the operating environment, used to identify a specific device. In this embodiment, the device fingerprint is generated based on the following features: Canvas fingerprint, WebGL fingerprint, audio device fingerprint, font list, screen resolution, time zone, operating system version, etc., and a unique device ID is generated using a hash function.

[0083] A network address typically refers to an IP address, used to identify a device's location within a network. A preset time window is the time range used to statistically analyze registration behavior, such as within one hour or 24 hours. A frequency threshold is the system-set upper limit on the number of registrations, used to determine if a device or network exhibits abnormally high-frequency registration behavior. An identity verification interface is a service interface provided by a third party or internally to verify the authenticity of identity authentication information, such as a real-name authentication interface.

[0084] In practice, after obtaining user authorization, the server first acquires the identity authentication information and operating environment characteristics of the first account. The identity authentication information includes user-submitted nicknames, ID numbers, and mobile phone numbers for verification. Operating environment characteristics include contextual information such as the client device model, operating system version, browser type, and network connection method. Upon receiving this data, the server first parses the identity authentication information, extracting key identity identifiers, such as the user's unique ID or ID number, and checks whether this identifier matches a preset restricted database, such as a blacklist. This blacklist stores ID numbers (hash-stored), mobile phone numbers, and device fingerprints (irreversibly encrypted). The blacklist has a query interface open to all partner merchants on the platform. If the identity identifier does not match the blacklist, the subsequent verification process continues. The server calls a preset identity verification interface, sending the extracted identity authentication information to verify its authenticity and validity, ensuring the legality and reliability of the user-provided identity information. Simultaneously, the server extracts the device fingerprint and network address from the operating environment characteristics. The device fingerprint is generated by hashing the device's hardware and software configuration using an algorithm, ensuring high uniqueness and accurate identification of the terminal device. The server further analyzes the registration frequency of the device's fingerprint and network address within a preset time window. For example, it tracks whether the device has been frequently used to register multiple different accounts in the past 24 hours. If this frequency exceeds a preset threshold, it is determined that there is abnormal bulk registration or "account farming" behavior, thus indicating that the identity authentication information has failed the overall verification. The network address is typically a public IP address, reflecting the user's network access location. In this case, the server will freeze the digital rewards associated with the primary account to prevent potential users suspected of fraudulent activity from illegally obtaining platform resources, ensuring server security and fairness.

[0085] In this embodiment, by combining blacklist detection of identity identifiers, verification of the authenticity of identity information, and dynamic monitoring of the registration frequency of device fingerprints and network addresses within a preset time window, abnormal registration behavior can be effectively identified and intercepted during the identity authentication stage, and the associated digital rights rewards can be frozen in a timely manner, thereby improving the security and risk prevention capabilities of the account management system.

[0086] like Figure 4 As shown, in some exemplary embodiments, after step 300, the method further includes:

[0087] Step 320: Periodically traverse the established relationships and construct a relationship chain graph containing multiple account nodes and hierarchical depth based on the preset graph database.

[0088] Step 340: Determine the influence score of each account node based on the connection topology of each account node in the relationship chain graph.

[0089] Step 360: Ranked rewards are distributed to account nodes that meet the preset conditions based on their influence scores.

[0090] In this embodiment, the relationship graph refers to a data structure built on a graph database. It abstracts each account as a node and forms a hierarchical network topology through relationships such as invitations, bindings, or transactions between nodes. The influence score is a quantitative indicator calculated using a specific algorithm (such as PageRank or a custom weighting formula) based on the account node's position, number of connections, and hierarchical relationship within the relationship graph. It measures the node's propagation ability or importance within the community network. Specifically, the influence score can be calculated hourly, and rankings are determined every Monday morning based on the cumulative influence score from the previous week. The top 10 users receive additional rewards: 1st place receives 5000 points, 2nd and 3rd place each receive 2000 points, and 4th to 10th place each receive 500 points. These rewards are covered by the platform's marketing budget.

[0091] Ranking rewards refer to honorary or material rewards that the server issues to core dissemination users based on their influence scores, and to account nodes that meet preset conditions (such as ranking in the top N or having a score exceeding a threshold).

[0092] In practical applications, after the server distributes the corresponding digital rights to the second and first accounts, the settlement of these digital rights uses digital vouchers pegged 1:1 to fiat currency. Following execution via smart contracts, the server can further execute subsequent incentive mining processes: First, the server periodically initiates a graph construction task, traversing all established account relationships in the database (such as invitation relationships, binding relationships, etc.), and imports this discrete relationship data into a pre-defined graph database (such as Neo4j) for processing. In the graph database, the server maps each account participating in the viral activity to an account node and establishes directed or undirected edges between nodes based on the directionality of the relationships, thereby constructing a complex relationship chain graph with multiple levels of depth (such as first-level friends, second-level friends, etc.).

[0093] After constructing a complex relationship chain graph, the server can activate a graph algorithm engine to perform in-depth analysis of the connection topology of each account node in the graph. Specific calculation logic may include counting the number of direct connections (degree centrality) of nodes, the shortest path coverage of nodes in the network, and the depth-weighted value of the node's level. These dimensions are then combined to calculate the influence score for each account node. Subsequently, the server filters the calculation results according to preset reward rules, identifying high-value account nodes whose influence scores meet preset conditions (e.g., ranking in the top 10% or exceeding a specific threshold). For these selected high-quality nodes, the server generates a corresponding ranking reward distribution list and triggers the reward distribution interface to automatically distribute ranking rewards (such as exclusive badges, extra points, or large coupons) to the corresponding accounts, thereby achieving precise incentives for core disseminators and further stimulating their activity in the viral marketing chain.

[0094] In this embodiment, by periodically traversing the relationships and constructing a relationship chain graph, the influence score of account nodes is calculated based on the topology of the graph database, and ranking rewards are issued to high-score nodes that meet preset conditions. This achieves accurate identification and incentives for core propagators in the fission network, effectively enhancing users' enthusiasm for participating in fission activities and the stability of the network topology.

[0095] In some exemplary embodiments, multidimensional behavioral feature data of the sender of the processing request is extracted, and the multidimensional behavioral feature data is input into a trained risk assessment model for risk assessment to obtain a risk score, including:

[0096] The system collects and processes historical processing data, equipment environment data, and related graph data corresponding to the request. Multidimensional behavioral feature data includes historical processing data, equipment environment data, and related graph data. The system performs vectorization processing on the historical processing data, equipment environment data, and related graph data to obtain feature vectors. The feature vectors are then input into a trained risk assessment model to perform risk assessment and obtain a risk score. The risk assessment model is trained based on a graph neural network.

[0097] In this embodiment, the multidimensional behavioral feature data includes historical processing data, device environment data, and correlation graph data. Historical processing data records the account's past business operation trajectory, such as historical transaction frequency and reward claim records. Device environment data reflects the technical parameters and network status of the terminal device currently initiating the request, such as device model, operating server version, and IP address. Correlation graph data describes the account's connection relationships and hierarchical position with other accounts in the network topology. Vectorization processing refers to the process of converting the collected non-numerical or discrete raw data into fixed-length numerical feature vectors using a specific algorithm, enabling the computer to perform mathematical operations and model input. The risk assessment model is an algorithmic model trained on a graph neural network to determine the security of business requests. It can comprehensively analyze the input feature vectors and output a quantified risk score. A graph neural network is a deep learning network architecture specifically designed for processing graph-structured data, effectively capturing complex relationships and topological features between nodes.

[0098] In practical applications, in order to accurately assess the risk of processing requests, the server first activates the data collection module to comprehensively collect multi-dimensional behavioral feature data related to the request. Specifically, the multi-dimensional behavioral feature data can be 128-dimensional features, including but not limited to the number of transactions in the past hour, the number of transactions in the past 24 hours, the average amount of a single transaction in the past 30 days, the frequency of transactions with counterparties, device fingerprint anomaly score (0-1), IP geographical consistency score, etc.

[0099] The server extracts historical processing data for the account from the backend database to analyze its past business operation patterns. Simultaneously, it obtains device environment data from client-reported information to understand the current hardware and network infrastructure. Furthermore, the server extracts association graph data for the account from a pre-built relationship chain graph to understand its position within social or business networks. After cleaning and preprocessing the historical processing data, device environment data, and association graph data from different sources, the server then performs vectorization processing on the processed historical processing data, device environment data, and association graph data. This transforms the complex, unstructured raw information into unified, structured feature vectors, ensuring that the data can be effectively identified and calculated by the mathematical model.

[0100] After vectorization, the server uses the generated feature vectors as input parameters to call the trained risk assessment model for inference and analysis. This risk assessment model is built on a graph neural network architecture, pre-trained with approximately 100,000 historical fraud samples, and incrementally updated weekly. The trained risk assessment module can deeply mine the information contained in the feature vectors, especially the complex relationships between nodes reflected in the correlation graph data. After forward propagation calculations, the model comprehensively considers the interaction of various risk factors and finally outputs a quantitative risk score. This score intuitively reflects the potential risk level of the current processing request, providing a core decision-making basis for subsequent risk handling strategies. Specifically, the graph neural network structure is a two-layer graph convolutional network, outputting a risk score s∈ [0,1], where a score closer to 1 indicates a more suspicious transaction.

[0101] In this embodiment, by collecting multi-dimensional behavioral features including historical processing data, equipment environment data, and related graph data, and then vectorizing them and inputting them into a risk assessment model based on graph neural networks, it is possible to generate accurate risk scores by comprehensively considering multi-dimensional information, which effectively improves the ability to identify and assess potential risks in complex business scenarios.

[0102] like Figure 5 As shown, in some exemplary embodiments, step 500 includes:

[0103] Step 520: If the risk score is less than or equal to a preset first threshold, the target processing strategy is determined to be to automatically allow the processing request, and an execution log for the processing request is recorded.

[0104] Step 540: If the risk score is greater than the preset first threshold and less than or equal to the preset second threshold, then the target processing strategy is determined to be secondary verification, and a biometric verification instruction is sent to the sender who initiated the processing request.

[0105] Step 560: If the risk score is greater than the preset second threshold, the target processing strategy is determined to be interception and freezing, and the account that initiated the processing request is marked as being in a risky state.

[0106] In this embodiment, the first threshold and the second threshold are preset risk assessment boundary values ​​of the server, used to divide different risk level intervals. The first threshold corresponds to the upper limit of the low-risk interval, and the second threshold corresponds to the upper limit of the medium-risk interval. Together, they constitute the decision basis for the three-level processing strategy. In this embodiment, the target processing strategy refers to the response mechanism that the server automatically matches and executes based on the threshold interval into which the risk score falls, including operations such as automatic release, secondary verification, or interception and freezing. The biometric verification command refers to the control signal issued by the server to the user terminal to trigger identity verification processes such as fingerprint recognition, facial recognition, or voiceprint recognition.

[0107] In practical applications, after receiving a processing request from a user, the server first performs real-time analysis of the request context information, including but not limited to multi-dimensional data such as user behavior characteristics, operation time, geographical location, device fingerprint, and historical operation frequency. Based on a preset risk assessment model, it calculates a corresponding risk score. Subsequently, the server compares this risk score with preset first thresholds (e.g., 0.6) and second thresholds (e.g., 0.8). If the risk score is less than or equal to 0.6, the request is deemed low-risk, and the server automatically determines the target processing strategy as "automatic release." While allowing the processing request to continue, it generates and persists an execution log containing the request ID, user identifier, risk score, and processing result for later use. Continued auditing and behavioral analysis: If the risk score is greater than 0.6 and less than or equal to 0.8, it is determined to be a medium-risk situation. The server determines the target processing strategy as "secondary verification" and immediately issues a biometric verification command to the first terminal that initiated the request, triggering the terminal to activate a biometric module such as fingerprint or face recognition. It waits for the user to complete identity re-authentication and only allows the original processing request to continue after receiving feedback that the verification has passed. At the same time, the verification process log is recorded. If the risk score is greater than 0.8, it is determined to be a high-risk behavior. The server immediately determines the target processing strategy as "interception and freezing," blocking the execution flow of the current processing request and marking the account that initiated the request as "in a risky state," prohibiting it from performing any sensitive operations before completing manual review or security verification. It is understood that in other embodiments, the first threshold and the second threshold can be set according to the actual situation and are not limited to one here.

[0108] In this embodiment, the target processing strategy is dynamically determined based on the comparison result of risk score and preset threshold, and differentiated control operations such as automatic release, secondary verification or interception and freezing are executed. Combined with execution log recording and account risk status marking, the security classification and control of processing requests is realized, which improves the accuracy and automation level of server risk response.

[0109] In some exemplary embodiments, after sending the biometric verification instruction to the sender initiating the processing request, the method further includes:

[0110] The system receives the biometric verification result returned by the sender. If the biometric verification result is successful, the processing request is allowed and the historical risk weight factor corresponding to the account that initiated the processing request is lowered. If the biometric verification result is unsuccessful, the processing request is frozen and the account is prohibited from initiating new processing requests within a preset time.

[0111] Biometric verification result refers to the final judgment made by the sender after receiving the biometric verification command, by collecting the user's physiological features such as fingerprints, facial features, or voiceprints and comparing them with the pre-registered information. Historical risk weighting factor is a parameter used in risk assessment models to quantify the credibility of an account's past behavior. Lowering this factor value means the server's trust in the account increases, thereby reducing the probability of it triggering future risk control interception. Preset duration refers to the time span during which the server pre-sets a restriction on accounts that have violated regulations or failed verification from initiating new requests, serving as a temporary restriction measure for abnormal operations.

[0112] Taking face detection as an example of biometric verification, after the server successfully issues a biometric verification command to the sender initiating the processing request, the sending terminal can randomly require the user to complete 3-4 combinations of actions such as blinking, shaking their head, opening their mouth, and nodding, thereby determining whether the user has passed the face verification. The server will maintain an uninterrupted communication link, listening in real time and waiting for the face verification result returned by the receiving terminal. When the server receives the verification result data packet returned by the sender, it will first verify the integrity and source of the data packet. After confirming that it is correct, it will proceed to the branch decision process. If the parsed verification result is "verification passed", it means that the current operator has been confirmed as the account holder, eliminating the previous potential risk concerns. At this time, the server will immediately release the suspension of the processing request, allowing the transaction (such as allowing the normal exchange or transfer of digital rights) to proceed to the subsequent execution stage. Furthermore, the server can write the verification record (user ID, timestamp, device fingerprint, verification result, verification type) into the consortium blockchain through a smart contract, and associate the transaction hash with the order ID for subsequent auditing and dispute evidence collection. Understandably, biometric detection can also include iris detection, palm print detection, and voiceprint detection, among others.

[0113] To dynamically optimize the accuracy of the risk control model, the server can also call the user profiling and credit management module to automatically lower the historical risk weight factor corresponding to the account. This operation is equivalent to improving the account's credit score on the server, making it less likely to be misjudged as a high-risk user in future routine operations, thereby reducing disturbance to normal users. Conversely, if the server receives a biometric verification result of "verification failed" (e.g., the user's multiple attempts at fingerprint or facial recognition failed, or a non-liveness attack was detected), it indicates that the operation has a very high suspicion of theft or fraud. At this time, the server will immediately execute the forced freeze logic, completely terminating and freezing the current processing request to ensure that the relevant assets are not transferred. Next, the server will activate the account penalty mechanism, read the preset duration parameter in the server configuration (e.g., 24 hours or 7 days), and write a time-locked ban record to the account's permission control list, strictly prohibiting the account from initiating any new processing requests within this preset duration, thereby blocking potential deliberate probing behavior and ensuring the overall business security of the platform.

[0114] In this embodiment, by performing actions such as allowing access and lowering the historical risk weight factor, or freezing requests and prohibiting accounts from initiating new requests within a preset time period based on biometric verification results, dynamic trust adjustment and risk blocking based on secondary verification feedback are achieved, effectively balancing the user experience of real users with the overall security of the server.

[0115] To provide a clearer explanation of the data processing and anomaly identification method based on digital rights provided in this application, a specific embodiment is described below, which includes the following:

[0116] Merchants select highly active existing users and design a tiered "referral" reward mechanism (such as both users receiving coupons, points, or cash rewards for referring friends), generating referral posters and activity links with unique invitation codes or QR codes. When an existing user shares the activity with a new user, and the new user clicks the link or scans the QR code on their terminal (first terminal), a registration request is initiated to the cloud server cluster. The application server then establishes a link between the new user's account (first account) and the existing user's account (second account), incorporating them into a private traffic pool. Next, the server activates a security access control mechanism, extracting the first account's identity authentication information and operating environment characteristics (such as device fingerprints and IP addresses), and cross-validating them using a preset restriction database and frequency thresholds to intercept bot registration fraud. Once the identity authentication information passes security verification, the digital rights smart contract deployed on the consortium blockchain consensus node is automatically triggered, distributing preset digital rights rewards (such as cash rewards, points, or coupons) to both the existing and new users, and simultaneously recording the execution log.

[0117] During subsequent periods of business growth and stabilization, when users initiate requests to withdraw or consume digital rights, the application server extracts their multi-dimensional behavioral characteristic data in real time and inputs it into a risk assessment model trained on a graph neural network for deep calculation to obtain a risk score. Ultimately, a tiered handling strategy is implemented based on the score: if the score is below 0.6, the transaction is automatically allowed; if it falls within the medium-risk range (0.6 < s ≤ 0.8), an instruction is issued requiring the user to undergo secondary biometric verification; upon successful verification, the historical risk weight factor can be dynamically lowered to improve the subsequent experience; if the score exceeds 0.8, the request is directly blocked and frozen, and the account is marked as risky. Furthermore, the system periodically constructs a user relationship chain graph based on the graph database, calculates the influence score of each node, and distributes ranking rewards to core disseminators, thereby achieving a complete closed loop from precise user acquisition and compliant reward distribution to continuous exponential growth while ensuring the security of funds and business operations.

[0118] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages in other steps. It is understood that the steps in different embodiments can be freely combined as needed, and all non-contradictory solutions formed by such combinations are within the scope of protection of this application.

[0119] Based on the same inventive concept, this application also provides a data processing and anomaly identification device for implementing the aforementioned data processing and anomaly identification method based on digital rights. The solution provided by this device is similar to the implementation scheme described in the above method. Therefore, the specific limitations of one or more embodiments of the data processing and anomaly identification device based on digital rights provided below can be found in the limitations of the data processing and anomaly identification method based on digital rights described above, and will not be repeated here.

[0120] In one exemplary embodiment, such as Figure 6 As shown, a data processing and anomaly detection device 600 based on digital rights is provided, including: a request response module 610, a verification module 620, a reward distribution module 630, a risk assessment module 640, and an execution module 650, wherein:

[0121] The request-response module 610 is used to respond to the registration request initiated by the first terminal based on the invitation identifier and establish the association between the first account corresponding to the first terminal and the second account logged in by the second terminal that generated the invitation identifier.

[0122] The verification module 620 is used to obtain the identity authentication information and operating environment characteristics of the first account, and to verify the identity authentication information based on the identity authentication information and operating environment characteristics.

[0123] The reward distribution module 630 is used to trigger a preset digital rights smart contract when the identity authentication information passes the security verification, and distribute the corresponding digital rights to the second account and the first account. The settlement of digital rights adopts digital vouchers pegged 1:1 to fiat currency and is executed through smart contracts.

[0124] The risk assessment module 640 is used to respond to processing requests for digital rights by extracting multi-dimensional behavioral feature data of the sender of the processing request and inputting the multi-dimensional behavioral feature data into a trained risk assessment model to conduct risk assessment and obtain a risk score.

[0125] The execution module 650 is used to determine the target processing strategy based on the risk score and to execute the corresponding control operations based on the target processing strategy.

[0126] In some exemplary embodiments, the verification module 620 is further configured to parse the identity authentication information, extract the identity identifier from the identity authentication information, and detect whether the identity identifier matches a preset restriction database. If the identity identifier does not match the restriction database, a preset identity verification interface is called to verify the identity authentication information, extract the device fingerprint and network address from the operating environment characteristics, and count the registration frequency of the device fingerprint and network address within a preset time window. If the registration frequency exceeds a preset frequency threshold, it is determined that the identity authentication information has failed verification, and the digital rights reward corresponding to the association is frozen.

[0127] In some exemplary embodiments, the reward distribution module 630 is also used to periodically traverse the established relationships, construct a relationship chain graph containing multiple account nodes and hierarchical depth based on a preset graph database, determine the influence score of each account node according to the connection topology of each account node in the relationship chain graph, and distribute ranking rewards to account nodes that meet preset conditions according to the influence score.

[0128] In some exemplary embodiments, the risk assessment module 640 is further used to collect the corresponding historical processing data, equipment environment data, and correlation graph data of the sender of the processing request. The multidimensional behavioral feature data includes historical processing data, equipment environment data, and correlation graph data. The historical processing data, equipment environment data, and correlation graph data are vectorized to obtain feature vectors. The feature vectors are input into the trained risk assessment model to perform risk assessment and obtain a risk score. The risk assessment model is trained based on a graph neural network.

[0129] In some exemplary embodiments, the execution module 650 is further configured to determine the target processing strategy as automatically allowing the processing request if the risk score is less than or equal to a preset first threshold, and record the execution log for the processing request; if the risk score is greater than the preset first threshold and less than or equal to a preset second threshold, determine the target processing strategy as secondary verification, and send a biometric verification instruction to the sender who initiated the processing request; if the risk score is greater than the preset second threshold, determine the target processing strategy as interception and freezing, and mark the account that initiated the processing request as being in a risky state.

[0130] In some exemplary embodiments, the device further includes a verification result processing module for receiving biometric verification results returned by the sender. If the biometric verification result is successful, the processing request is allowed and the historical risk weight factor corresponding to the account that initiated the processing request is lowered. If the biometric verification result is unsuccessful, the processing request is frozen and the account is prohibited from initiating new processing requests within a preset time period.

[0131] Each module in the aforementioned data processing and anomaly detection device based on digital rights can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the operations corresponding to each module.

[0132] In one exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 7As shown, this computer device includes a processor, memory, input / output (I / O) interfaces, and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides the environment for the operating system and computer programs stored in the non-volatile storage media. The database stores authentication information, operating environment characteristics, and risk assessment data. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communication with external terminals via a network connection. When executed by the processor, the computer program implements a data processing and anomaly detection method based on digital rights.

[0133] Those skilled in the art will understand that Figure 7 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0134] In one exemplary embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in any of the above embodiments of the data processing and anomaly identification method based on digital rights.

[0135] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored, which, when executed by a processor, implements the steps in any of the above embodiments of the data processing and anomaly identification method based on digital rights.

[0136] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in any of the above embodiments of the data processing and anomaly identification method based on digital rights.

[0137] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0138] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0139] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0140] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A digital rights-based data processing and anomaly identification method, characterized in that, The method includes: In response to a registration request initiated by a first terminal based on an invitation identifier, an association is established between the first account corresponding to the first terminal and the second account logged in by the second terminal that generated the invitation identifier; Obtain the identity authentication information and operating environment characteristics of the first account, and verify the identity authentication information based on the identity authentication information and the operating environment characteristics; If the identity authentication information passes the security verification, a preset digital rights smart contract is triggered to issue corresponding digital rights to the second account and the first account. The settlement of the digital rights adopts a digital certificate pegged 1:1 to the legal tender and is executed through the smart contract. In response to a processing request for the digital rights, multidimensional behavioral feature data of the sender of the processing request is extracted, and the multidimensional behavioral feature data is input into a trained risk assessment model for risk assessment to obtain a risk score. The target processing strategy is determined based on the risk score, and the corresponding control operations are executed based on the target processing strategy.

2. The method of claim 1, wherein, The step of obtaining the identity authentication information and operating environment characteristics of the first account, and verifying the identity authentication information based on the identity authentication information and the operating environment characteristics, includes: The identity authentication information is parsed, the identity identifier in the identity authentication information is extracted, and it is detected whether the identity identifier matches the preset restriction database; If the identity identifier does not match the restricted database, a preset identity verification interface is invoked to verify the identity authentication information, extract the device fingerprint and network address from the operating environment characteristics, and count the registration frequency of the device fingerprint and the network address within a preset time window. If the number of registrations exceeds a preset frequency threshold, the identity authentication information is determined to have failed verification, and the digital rights and rewards corresponding to the association are frozen.

3. The method of claim 1, wherein, The method triggers a preset digital rights smart contract to issue corresponding digital rights to the second account and the first account. The settlement of these digital rights uses digital vouchers pegged 1:1 to fiat currency. After execution through the smart contract, the method further includes: Periodically traverse the established relationships and construct a relationship graph containing multiple account nodes and hierarchical depth based on a preset graph database; Based on the connection topology of each account node in the relationship chain graph, determine the influence score of each account node; Ranking rewards will be distributed to account nodes that meet the preset conditions based on the influence score.

4. The method of claim 1, wherein, The process involves extracting multidimensional behavioral feature data from the sender of the processing request and inputting this data into a trained risk assessment model to perform a risk assessment and obtain a risk score. This includes: Collect historical processing data, device environment data, and correlation graph data corresponding to the sender of the processing request. The multidimensional behavioral feature data includes the historical processing data, the device environment data, and the correlation graph data. The historical processing data, the equipment environment data, and the associated map data are vectorized to obtain feature vectors; The feature vector is input into a trained risk assessment model to perform risk assessment and obtain the risk score. The risk assessment model is trained based on a graph neural network.

5. The method according to any one of claims 1 to 4, characterized in that, The step of determining a target treatment strategy based on the risk score and executing corresponding control operations based on the target treatment strategy includes: If the risk score is less than or equal to a preset first threshold, the target processing strategy is determined to be to automatically allow the processing request, and an execution log for the processing request is recorded. If the risk score is greater than the preset first threshold and less than or equal to the preset second threshold, then the target processing strategy is determined to be secondary verification, and a biometric verification instruction is sent to the sender who initiated the processing request. If the risk score is greater than the preset second threshold, the target processing strategy is determined to be interception and freezing, and the account that initiated the processing request is marked as being in a risky state.

6. The method of claim 5, wherein, After sending the biometric verification instruction to the sender who initiated the processing request, the method further includes: Receive the biometric verification result returned by the sender; If the biometric verification result is successful, the processing request is allowed, and the historical risk weight factor corresponding to the account that initiated the processing request is reduced. If the biometric verification result is that the verification fails, the processing request is frozen, and the account is prohibited from initiating a new processing request within a preset time period.

7. A digital rights-based data processing and anomaly identification apparatus, characterized by, The device includes: The request-response module is used to respond to a registration request initiated by the first terminal based on the invitation identifier and establish an association between the first account corresponding to the first terminal and the second account logged in by the second terminal that generated the invitation identifier. The verification module is used to obtain the identity authentication information and operating environment characteristics of the first account, and to verify the identity authentication information based on the identity authentication information and the operating environment characteristics. The reward distribution module is used to trigger a preset digital rights smart contract when the identity authentication information passes the security verification, and distribute corresponding digital rights to the second account and the first account. The settlement of the digital rights adopts a digital certificate pegged to fiat currency at a 1:1 ratio and is executed through the smart contract. The risk assessment module is used to respond to a processing request for the digital rights, extract multi-dimensional behavioral feature data of the sender of the processing request, and input the multi-dimensional behavioral feature data into a trained risk assessment model to conduct risk assessment and obtain a risk score. The execution module is used to determine the target processing strategy based on the risk score and to execute corresponding control operations based on the target processing strategy. 8.A computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the computer device is configured to perform the method according to any one of claims 1-7. When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 6.

9. A computer readable storage medium having stored thereon a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

10. A computer program product comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

Images