Coupon benefit online marketing fraud prevention and risk control decision method based on knowledge graph fusion

Abstract

This invention belongs to the field of knowledge fusion technology in big data processing, specifically heterogeneous data integration and graph database logical consistency maintenance. It discloses a method for anti-fraud and risk control decision-making in online marketing of coupon benefits using a knowledge graph. The method includes: extracting device identifiers and interaction attribute data from heterogeneous data streams and constructing a transient feature subgraph within a sliding time window; calculating the basic topological isomorphism between the transient feature subgraph and the persistent baseline subgraph; determining a temporal penalty parameter using the timestamp difference of associated edges, and then adjusting the isomorphism to determine the fusion admission weight; and, based on the weight and the structural convergence threshold, merging the transient feature subgraph into the underlying graph database or migrating it to an isolated domain. This invention utilizes a dual-constraint admission mechanism of temporal features and topological structure to avoid alignment deviations in high-concurrency environments, resolve entity conflicts, maintain the logical consistency of the graph database, and improve computational convergence stability.

Description

Technical Field

[0001] This invention relates to a method for anti-fraud and risk control decision-making in online marketing of coupon benefits that integrates knowledge graphs, belonging to the field of knowledge fusion technology in big data processing, which focuses on heterogeneous data integration and the maintenance of logical consistency of graph databases. Background Technology

[0002] Currently, the online marketing risk control field utilizes knowledge graph technology to integrate heterogeneous data such as device identification, account status, and behavioral trajectories. In a distributed concurrent environment, due to the temporal anchor offset when the underlying graph database processes asynchronously ingested heterogeneous features, this technology constructs a topological structure reflecting the correspondence between physical objects through the association features between entities. In the existing technical path, the system extracts entity attributes from multi-source data streams and uses similarity comparison logic to merge newly entered transient nodes into the persistent architecture of the underlying graph database. As the complexity of marketing scenarios increases, the physical form of the front-end acquisition device has limitations, and the back-end control method also faces the challenge of insufficient temporal consistency. Especially in the process of graph data fusion, the topological conflicts and logical distortions generated by concurrent data streams seriously affect the retrieval efficiency and accuracy of knowledge representation of the graph database, causing large-scale graph traversal calculations to fail to converge within a limited time limit. For example, Chinese invention patent application with publication number CN120235623A discloses a fraud gang identification method based on knowledge graphs, which relies on capturing incremental business data for regular graph incremental updates and gang identification.

[0003] Objective engineering practice shows that when processing high-frequency interactive data, network transmission jitter and interference from distributed concurrent scripts cause micro-deviations in the arrival time of related data from different sources. Existing mechanisms rely on the assumption that the arrival time of data is synchronized with the physical state of entities. When concurrency surges, such uncertain deviations cause a large amount of data containing conflicting attributes to flood into the underlying storage. If such time-displaced data nodes are directly merged, false association edges are generated in the underlying knowledge graph. These false association edges destroy the rigor and logical coherence of the graph structure, causing subsequent graph query paths to fail to converge, resulting in ineffective waste of computing resources. Conventional improvement solutions usually involve increasing the feature comparison dimension or setting up a post-conflict resolution stage. However, increasing the comparison dimension leads to a significant increase in memory computation overhead. Post-processing mode, due to physical response lag, cannot block the spread of topological distortion at the moment of data injection. This creates a fundamental conflict between the topological fidelity of the underlying graph database and the high-concurrency processing performance.

[0004] Therefore, the technical problem to be solved by this invention is how to achieve high-fidelity fusion of subgraph topologies and maintain the logical consistency of graph database under the constraints of high-frequency heterogeneous data influx and temporal misalignment. Summary of the Invention

[0005] To address the problems in the background technology, the technical solution of this invention is as follows: A method for anti-fraud and risk control decision-making in online marketing of coupon benefits integrating knowledge graphs, comprising the following steps: Step S101: Obtain a concurrent heterogeneous data stream containing the source device identifier field and interaction attribute data; Step S102: Within a preset sliding time window, the source device identification field and interaction attribute data are constructed into a directed acyclic transient feature subgraph, wherein the nodes in the transient feature subgraph contain interaction attribute data and the edges contain timing relationships determined by the arrival time of the data packets. Step S103: Read the persistent reference subgraph corresponding to the source device identifier field in the underlying graph database, calculate the adjacency matrix similarity between the transient feature subgraph and the persistent reference subgraph to obtain the basic topological isomorphism, extract the absolute timestamp difference of adjacent associated edges in the transient feature subgraph, divide the preset penalty convergence constant by the absolute timestamp difference to obtain the temporal penalty parameter, and subtract the temporal penalty parameter from the basic topological isomorphism to obtain the fusion admission weight; Step S104: Determine whether the fusion admission weight is greater than the preset structural convergence threshold; In step S105, if the fusion admission weight is not lower than the preset structural convergence threshold, the nodes and edges of the transient feature subgraph are merged into the underlying graph database to complete knowledge fusion; if the fusion admission weight is lower than the preset structural convergence threshold, the transient feature subgraph is migrated to the isolation domain to generate a decision instruction representing the abnormal request initiated by the terminal corresponding to the source device identifier field.

[0006] Preferably, the sub-steps of calculating the fusion admission weights in step S103 include: step S1031, calculating the node attribute similarity between the transient feature subgraph and the persistent baseline subgraph; step S1032, obtaining the temporal asynchronous deviation of each edge during the generation and arrival processes; and step S1033, adjusting the basic topological isomorphism using the weight calculation model based on the temporal asynchronous deviation correction to obtain the fusion admission weights.

[0007] Preferably, after migrating the transient feature subgraph to the isolation domain, the method further includes the following steps: Step S301, extracting the global information entropy index of the disputed subgraph in the isolation domain; Step S302, comparing the matching degree between the global information entropy index and the risk feature index, and marking the disputed subgraph as a fraud gang node when the matching degree exceeds the risk threshold; Step S303, when the matching degree is not greater than the risk threshold, using the local edge connectivity of the persistent baseline subgraph to perform topological density compensation on the disputed subgraph, and completing feature alignment based on the obtained compensation result.

[0008] Preferably, the sub-steps of constructing the transient feature subgraph in step S102 include: step S1021, parsing the device fingerprint information and account status data in the source device identifier field; step S1022, based on the semantic heterogeneity of the account status data, using an entity alignment mechanism to map the interaction attribute data to a preset business ontology framework; and step S1023, constructing directed edges according to the arrival time sequence of each interaction attribute data within a preset sliding time window to form a transient feature subgraph.

[0009] Preferably, the sub-steps of step S103, which reads the persistent state reference subgraph, include: step S1034, retrieving local association features associated with the source device identifier field in the underlying graph database; and step S1035, extracting multi-hop association paths within a preset stable period and filtering out nodes whose in-degree volatility exceeds the steady-state threshold to construct the persistent state reference subgraph.

[0010] Preferably, after incorporating the transient feature subgraph into the underlying graph database, the following steps are also included: Step S601, real-time monitoring of the topology consistency index of the underlying graph database; Step S602, when the topology consistency index decreases monotonically, shortening the step size of the preset sliding time window and increasing the structure convergence threshold to complete the dynamic adaptation of high-frequency heterogeneous data influx.

[0011] Preferably, after migrating the transient feature subgraph to the isolation domain, the following steps are also included: Step S701, generating a risk control decision instruction to restrict terminals with source device identifier fields from initiating coupon benefit requests; Step S702, statistically analyzing the topology evolution rate of conflicting subgraphs within the isolation domain, and when the topology evolution rate exhibits exponential growth, initiating logical coherence self-verification of the underlying graph database.

[0012] Preferably, the interactive attribute data includes geographic location coordinates, network access path, coupon redemption time and account behavior fingerprint, and the temporal correlation represents the feature drift pattern of the interactive attribute data within the scale of 10μs to 100ms.

[0013] Preferably, the underlying graph database uses a local topology density dynamic compensation strategy to resolve feature matching attenuation caused by concurrent ingestion, ensuring that multi-hop association paths converge within a closed topology space.

[0014] Compared with the prior art, the beneficial effects of the present invention are: 1. In the anti-fraud of online marketing of coupons and vouchers, a dual-constraint admission mechanism based on temporal features and topological structure is constructed at the data fusion entry layer to avoid knowledge alignment deviations caused by heterogeneous data streams under high concurrency, ensuring the logical consistency of the underlying graph database. Traditional fusion methods rely excessively on the similarity matching of static attributes. When faced with massive transient interactive data generated concurrently, due to the lack of capture of dynamic evolution patterns, conflicting edges carrying forged attributes are easily injected into the graph, leading to topological distortion. This invention utilizes the memory computing layer to instantiate dynamic initial state subgraphs in real time and introduces a temporal decay penalty parameter based on timestamp difference. By transforming nondeterministic latency into topological constraint factors, the race-state conflict under high-concurrency write operations is resolved, thereby significantly reducing invalid path traversal in large-scale graph computation, improving the computational convergence speed and system throughput in the knowledge fusion process, and ensuring the data truth attributes and logical self-consistency of large-scale graph databases under extreme conditions.

[0015] 2. This invention achieves precise resolution of heterogeneous entity conflicts through dynamic coupling of topological isomorphic mapping and temporal decay factors, improving the topological fidelity of the underlying knowledge graph under non-ideal conditions. This mechanism combines the structured features of local subgraphs with the transient physical characteristics of data arrival to form fusion admission weights, enabling the system to complete precise filtering during the data ingestion stage without performing highly complex global association analysis. This processing method, which sinks the discrimination logic to the underlying data fusion layer, effectively offsets feature drift caused by network latency or deliberate spoofing, ensuring that subsequent multi-hop graph queries and association path extraction operations are always carried out within a strict topological space, improving the convergence stability of graph calculation results, and avoiding the ineffective dissipation of computing resources on redundant or erroneous paths.

[0016] 3. This invention establishes an extreme value transformation path for heterogeneous conflict data by constructing an isolation and verification mechanism for conflict subgraphs. While ensuring the security of the main graph, it also takes into account the value of mining abnormal features. When the dynamic fusion weight is lower than the preset convergence threshold, the system triggers a fusion conflict isolation command, migrates the disputed subgraph to an independent storage domain, and outputs an abnormal blocking signal. This processing method, which directly maps the bottom-level data merging rejection state to a business risk control signal, simplifies the decision-making link of the upper-level system. By establishing a verification sandbox in the isolation area and arranging the downgraded fusion sequence according to the confidence priority, it is possible to further verify the conflict edges one by one based on the global information entropy index, realize the retention and solidification of high-value abnormal data, and enhance the system's defensive resilience in the face of complex adversarial environments. Attached Figure Description

[0017] Figure 1 This is a flowchart illustrating the admission decision process for temporal penalties and topological isomorphism constraints in this invention. Figure 2 This is a state evolution diagram of the abnormal conflict isolation and logic feedback mechanism of the present invention.

[0018] The objectives, features, and advantages of this invention will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0019] The technical solutions of the embodiments of this application will be clearly described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of this application are within the scope of protection of this application.

[0020] A knowledge graph-based approach to anti-fraud and risk control decision-making in online marketing of coupon benefits includes the following steps: Step S101: Obtain a concurrent heterogeneous data stream containing the source device identifier field and interaction attribute data; Step S102: Within a preset sliding time window, the source device identification field and interaction attribute data are constructed into a directed acyclic transient feature subgraph, wherein the nodes in the transient feature subgraph contain interaction attribute data and the edges contain timing relationships determined by the arrival time of the data packets. Step S103: Read the persistent reference subgraph corresponding to the source device identifier field in the underlying graph database, calculate the adjacency matrix similarity between the transient feature subgraph and the persistent reference subgraph to obtain the basic topological isomorphism, extract the absolute timestamp difference of adjacent associated edges in the transient feature subgraph, divide the preset penalty convergence constant by the absolute timestamp difference to obtain the temporal penalty parameter, and subtract the temporal penalty parameter from the basic topological isomorphism to obtain the fusion admission weight; Step S104: Determine whether the fusion admission weight is greater than the preset structural convergence threshold; In step S105, if the fusion admission weight is not lower than the preset structural convergence threshold, the nodes and edges of the transient feature subgraph are merged into the underlying graph database to complete knowledge fusion; if the fusion admission weight is lower than the preset structural convergence threshold, the transient feature subgraph is migrated to the isolation domain to generate a decision instruction representing the abnormal request initiated by the terminal corresponding to the source device identifier field.

[0021] Preferably, the sub-steps of calculating the fusion admission weights in step S103 include: step S1031, calculating the node attribute similarity between the transient feature subgraph and the persistent baseline subgraph; step S1032, obtaining the temporal asynchronous deviation of each edge during the generation and arrival processes; and step S1033, adjusting the basic topological isomorphism using the weight calculation model based on the temporal asynchronous deviation correction to obtain the fusion admission weights.

[0022] Preferably, after migrating the transient feature subgraph to the isolation domain, the method further includes the following steps: Step S301, extracting the global information entropy index of the disputed subgraph in the isolation domain; Step S302, comparing the matching degree between the global information entropy index and the risk feature index, and marking the disputed subgraph as a fraud gang node when the matching degree exceeds the risk threshold; Step S303, when the matching degree is not greater than the risk threshold, using the local edge connectivity of the persistent baseline subgraph to perform topological density compensation on the disputed subgraph, and completing feature alignment based on the obtained compensation result.

[0023] Preferably, the sub-steps of constructing the transient feature subgraph in step S102 include: step S1021, parsing the device fingerprint information and account status data in the source device identifier field; step S1022, based on the semantic heterogeneity of the account status data, using an entity alignment mechanism to map the interaction attribute data to a preset business ontology framework; and step S1023, constructing directed edges according to the arrival time sequence of each interaction attribute data within a preset sliding time window to form a transient feature subgraph.

[0024] Preferably, the sub-steps of step S103, which reads the persistent state reference subgraph, include: step S1034, retrieving local association features associated with the source device identifier field in the underlying graph database; and step S1035, extracting multi-hop association paths within a preset stable period and filtering out nodes whose in-degree volatility exceeds the steady-state threshold to construct the persistent state reference subgraph.

[0025] Preferably, after incorporating the transient feature subgraph into the underlying graph database, the following steps are also included: Step S601, real-time monitoring of the topology consistency index of the underlying graph database; Step S602, when the topology consistency index decreases monotonically, shortening the step size of the preset sliding time window and increasing the structure convergence threshold to complete the dynamic adaptation of high-frequency heterogeneous data influx.

[0026] Preferably, after migrating the transient feature subgraph to the isolation domain, the following steps are also included: Step S701, generating a risk control decision instruction to restrict terminals with source device identifier fields from initiating coupon benefit requests; Step S702, statistically analyzing the topology evolution rate of conflicting subgraphs within the isolation domain, and when the topology evolution rate exhibits exponential growth, initiating logical coherence self-verification of the underlying graph database.

[0027] Preferably, the interactive attribute data includes geographic location coordinates, network access path, coupon redemption time and account behavior fingerprint, and the temporal correlation represents the feature drift pattern of the interactive attribute data within the scale of 10μs to 100ms.

[0028] Preferably, the underlying graph database uses a local topology density dynamic compensation strategy to resolve feature matching attenuation caused by concurrent ingestion, ensuring that multi-hop association paths converge within a closed topology space.

[0029] Example 1: In a high-concurrency coupon distribution scenario, the data processing system receives device identification fields and interaction attribute data from multiple channels. Due to network transmission jitter and interference from abnormal concurrent requests, the arrival times of interaction records of the same physical entity deviate, causing the associated data from different data sources to exhibit asynchronous characteristics in the time dimension. The system extracts heterogeneous data streams within a preset sliding time window and uses the processor to construct a directed acyclic transient feature subgraph from the device identification fields and interaction attribute data. The construction process follows the principle of graph theory topological sorting. The processor sorts the arrival timestamps of each data packet in the extracted heterogeneous data stream in ascending order. When a retransmission of a data packet with the same source device identification field causes a timestamp rollback, the directed edges corresponding to the out-of-order data packets are deleted to eliminate network loops. Based on the basic rules of semantic vector space projection, the processor extracts the string sequence contained in the interaction attribute data and calculates the cosine similarity between the string sequence and the standard entity words in the preset business ontology framework. In specific implementation, considering that account status data often has structural deficiencies and synonym generalization, the system pre-mounts a large-scale industry... A static word embedding distribution dictionary is generated through training on a secure corpus. The processor calls this dictionary to map each received discrete interaction attribute string sequence into a uniform, fixed-dimensional dense real-valued vector. This mapping mechanism is based on the geometric spatial attributes of isolated literal information that can be measured in a Cartesian coordinate system, providing a dimensionality-reducible comparison base for calculating the vector dot product and cosine similarity. Interaction attribute data with a cosine similarity value greater than 0.85 are selected to establish node mapping associations to complete entity alignment. Nodes in the transient feature subgraph carry interaction attribute data, and edges... The system carries the timing correlation determined by the arrival time of data packets. To ensure accurate capture of microsecond-level arrival delays under high-concurrency conditions in wide area networks, the system directly extracts the original packet header carrying the hardware timestamp at the data link layer of the physical network card, bypassing the kernel processing and process scheduling overhead of the operating system's network protocol stack. This mechanism uses a high-precision clock protocol to synchronize clocks across multiple nodes, enabling the timing correlation to accurately characterize the underlying transient drift of data packets at the physical transmission layer. This achieves microscopic time domain measurement on the scale of 10μs to 100ms in engineering applications.

[0030] The system reads the persistent reference subgraph corresponding to the device identifier field from the underlying graph database, and uses the topological isomorphism mapping unit to calculate the adjacency matrix similarity between the transient feature subgraph and the persistent reference subgraph to determine the basic topological isomorphism. Simultaneously, the system extracts the absolute timestamp difference between adjacent related edges in the transient feature subgraph. And using a preset penalty convergence constant Divide by absolute timestamp difference To determine the timing decay penalty parameters The processor is based on the formula Determine the fusion admission weight ,in, To integrate access weights, Based on the fundamental topological isomorphism, This is the timing decay penalty parameter. As the first constant adjustment factor, The second constant adjustment factor, where the time-series decay penalty parameter The calculation method is as follows: ,in, This is the timing decay penalty parameter. To penalize the convergence constant, The weight calculation framework described above, which uses the absolute timestamp difference between adjacent edges, is essentially a circuit breaker penalty mechanism based on a physical baseline, rather than a smooth normalization model. Because the basic topological isomorphism has an upper limit, when extreme concurrent scripts cause the timestamp difference between adjacent data to approach a minimum of zero, the attenuation penalty parameter increases inversely. This formula design is precisely to intentionally induce an extremely negative abrupt change in the fusion admission weight by making the penalty term cross the positive gain boundary of isomorphism at the moment the temporal regularity is broken. The negative result is then directly used as a hard circuit breaker control signal without requiring multiple decision steps. When the fusion admission weight... When the structure convergence threshold is greater than the preset threshold, the system will incorporate the transient feature subgraph into the underlying graph database, and when the fusion admission weights are used... When the threshold for structural convergence is less than or equal to the threshold, the system migrates the transient feature subgraph to the isolated storage domain and generates a risk warning signal. By using the transient physical characteristics of the arriving data packets as constraints for topology fusion, the system reduces topology distortion caused by abnormal associated edges in high-concurrency environments and maintains the logical consistency of the underlying graph database under non-ideal conditions.

[0031] Example 2: To verify the stability of the dual-constraint admission mechanism based on temporal features and topology in combating high-frequency script attacks, the test platform was built on a distributed stream processing cluster. The core computing nodes used multi-core processors with a main frequency of no less than 2.4GHz and allocated no less than 64GB of random access memory to support the real-time instantiation of transient feature subgraphs. The test data came from the de-identified behavior logs of an online marketing platform. Based on this, Gaussian white noise with a signal-to-noise ratio of 20dB was superimposed using a signal generation unit. By changing the request sending frequency, concurrent impacts of different intensities were simulated to test the anti-interference boundary of the system in a non-ideal environment. During parameter setting, the sliding time window was selected as 500ms. This value is based on the balance between the upper limit of network transmission jitter and memory usage cycle in the marketing scenario. If the window is less than 200ms, the causal relationship across links will be cut off, while if it exceeds 1000ms, outdated redundant entities will be introduced. Penalty convergence constant. Calibrated to 100, first constant adjustment factor The value is 0.6, the second constant adjustment factor. A value of 0.4 is used to determine the basic topological isomorphism. Even within a high similarity range of 0.85 or higher, if the difference in the arrival timestamps of the data... Reduced to below the network jitter threshold, time-decay penalty parameter The resulting negative correction can also offset the gain from structural similarity, thus reducing the fusion admission weights. It is suppressed below the structural convergence threshold.

[0032] In the normal interaction test, the sample group of this invention inputs the absolute timestamp difference between adjacent related edges. The latency is 155.6 ms and the basic topological isomorphism is 155.6 ms. For a data stream of 0.882, determine the timing decay penalty parameter. The final determined fusion admission weight is 0.643. The value was 0.272, which is above the preset structural convergence threshold of 0.200. The system determined that the data possessed physical authenticity and allowed it to be included in the underlying graph database. In the control group, during the test introducing high-frequency concurrent interference, [the following was observed]: Reduced to 1.18ms, at which point the basic topological isomorphism degree... The timing decay penalty parameter is 0.854. The weighting increased to 84.746, resulting in a higher fusion admission weight. A negative mutation is generated and drops below a preset threshold, thereby triggering memory isolation instructions and generating a risk blocking signal; performance metrics are observed under different concurrency gradients, when... During the period from 50ms to 5ms, the admission weights were merged. It shows a downward trend, once Crossing the 5ms physical boundary, the weight value drops sharply, and this performance inflection point provides experimental evidence for determining the boundary of the numerical range. Under the dual constraint architecture provided by the sample group of this invention, the topological distortion rate of the underlying graph database decreases from 12.4% in the control group to below 0.8%, proving that by extracting the transient physical characteristics of the data to assist in the determination of topological isomorphism, it is possible to suppress feature drift loss caused by deliberate masquerading and maintain the logical consistency and data truth attributes in the knowledge fusion process.

[0033] Example 3: This example combines Figures 1 to 2 This section explains the anti-fraud and risk control decision-making methods for online marketing of coupon benefits that integrate knowledge graphs, such as... Figure 1 As shown, the system executes step S101 to acquire a concurrent heterogeneous data stream containing a source device identifier field and interaction attribute data. Step S102 constructs a directed acyclic transient feature subgraph from the source device identifier field and interaction attribute data within a preset sliding time window. Nodes in the transient feature subgraph contain interaction attribute data, and edges contain temporal relationships determined by the arrival time of data packets. Then, in step S103, the system reads the persistent baseline subgraph corresponding to the source device identifier field from the underlying graph database, calculates the adjacency matrix similarity between the transient feature subgraph and the persistent baseline subgraph to obtain the basic topological isomorphism, extracts the absolute timestamp difference between adjacent edges, and uses the penalty convergence constant divided by the absolute timestamp difference to obtain the temporal penalty parameter. The fusion admission weight is obtained by subtracting the temporal penalty parameter from the basic topological isomorphism. A graph admission control model based on the physical spatiotemporal characteristics of data is established using this weight to achieve the underlying resolution of heterogeneous data conflicts. Then, in step S104, it is determined whether the fusion admission weight is greater than the preset structural convergence threshold. Finally, in step S105, a branching process is performed. If the fusion admission weight is not lower than the structural convergence threshold, the nodes and edges of the transient feature subgraph are merged into the underlying graph database to complete knowledge fusion. If the fusion admission weight is lower than the structural convergence threshold, the transient feature subgraph is migrated to the isolation domain, an anomaly filtering mechanism for graph topological integrity is executed, and a decision instruction representing the abnormal request initiated by the terminal corresponding to the source device identification field is generated.

[0034] like Figure 2As shown, in the initial access state, when receiving concurrent heterogeneous data streams, device fingerprint information is parsed and account status data is extracted. Edges are constructed through semantic heterogeneity mapping and arrival time sequence, leading to the transient awareness state. The transient feature subgraph in the transient awareness state undergoes sliding time window instantiation and entity alignment mechanism mapping to construct directed acyclic associations. When the fusion admission weight is not lower than the structural convergence threshold and the time-series decay correction is effective, the system transitions from the transient awareness state to the persistent convergence state. In the persistent convergence state, the underlying graph database completes knowledge fusion and incorporation, enabling multi-hop association paths to converge and maintaining logical consistency. Furthermore, when the consistency index monotonically increases... The time reduction generates a feedback path to the initial access state by shortening the time window step. On the other hand, when in the transient awareness state, if the fusion admission weight is lower than the structural convergence threshold and the timing asynchronous deviation is too large, the system flows to the risk isolation state. In the risk isolation state, the disputed subgraph of the isolation domain generates abnormal decision instructions to restrict the terminal from initiating requests and to verify the conflict edges one by one. In the risk isolation state, the topology density compensation feature is used to align and form an adjustment feedback to the transient awareness state. When the global information entropy matching degree exceeds the risk threshold, the system finally flows to the deterministic fraud state and marks it as a fraud gang node in the deterministic fraud state.

[0035] Example 4: In a cross-regional coupon marketing system deployed in a geographically distributed, multi-active architecture, the front-end access layer handles over 100,000 TPS of concurrent requests within 10 seconds of the promotion starting. Because data packets are transmitted to the data fusion center via different physical links, the differences in hop counts and network congestion levels across these links exhibit dynamic fluctuations, resulting in irregular and discrete distributions in the arrival time of interaction records belonging to the same device entity. The system obtains the baseline background noise of the current network environment through the processor and determines the penalty convergence constant using an offline calibration method. The specific calibration procedures include collecting data during the system pre-operation phase. Average network jitter latency within each sampling period and will Set as The time decay penalty parameter is increased by 5 to 10 times to ensure that the timing decay penalty parameter is within the normal jitter range. It is in the low range, and at the same time, it is related to the basic topological isomorphism. The system uses the Frobenius norm to calculate the adjacency matrix of the transient eigenmap. Adjacency matrix of persistent reference subgraph The specific calculation formula is as follows: ,in, Based on the fundamental topological isomorphism, The adjacency matrix of the transient eigengraph. The adjacency matrix of the persistent reference subgraph. The Frobenius norm of the matrix is ​​used to ensure that graph structures at different scales have physical dimension consistency in mathematical operations. Before performing matrix interpolation, the system extracts the node set of the transient feature subgraph, locates the mapping coordinates of these nodes in the persistent reference subgraph, and cuts out local structural fragments containing the same nodes from the macroscopic reference subgraph based on the mapping coordinates. The system fills all empty elements without connections with zero values, so that the adjacency matrix A and the adjacency matrix B are forcibly abstracted and aligned into square matrices of the same order in the topological space, thereby completing cross-scale dimension reduction and matching.

[0036] The processor determines the fusion admission weights Then, the weighting results are compared with the structure convergence threshold stored in the register. If... If the value is 0.355 and greater than the structural convergence threshold of 0.200, a persistence operation instruction is triggered. The system calls the graph database's index interface, uses the hash value generated by the source device identifier field to locate the target node in the persistent storage layer, and incorporates the newly added associated edges in the transient feature subgraph into the persistent baseline subgraph in an incremental update manner. If attacked by malicious scripts, the absolute timestamp difference between adjacent associated edges in the input data stream is used. It is 0.5ms, calculated according to the aforementioned formula. When the value drops to negative, the system blocks index calls and releases the transient feature subgraph in memory. By establishing a isomorphic metric based on matrix norm and a parameter calibration procedure based on network latency benchmark, the system resolves heterogeneous data conflicts. This ensures that when the underlying knowledge graph is subjected to ultra-high concurrency, the updating of its topology is controlled by the uniqueness constraints of physical time and space, maintaining the true value attributes of the underlying database under non-ideal working conditions.

[0037] Example 5: When the system is in a multi-dimensional heterogeneous data source access state, the processor performs statistical clustering on the entire historical data set, uses the coefficient of variation to determine the numerical range of the structural convergence threshold, and the calibration process includes continuously collecting the fusion weight distribution sequence of non-fraudulent samples for 24 hours after the system goes online, and extracting the mean of the sequence. with standard deviation And according to the formula The calculation procedure is based on a parameterized probabilistic statistical model. To avoid interference from high-frequency concurrent script attacks that could cause the data set to exhibit an asymmetric long-tail distribution, the processor synchronously extracts the median of the sequence and calculates the median absolute deviation of each sampled value from the median. When the ratio of the median absolute deviation to the standard deviation is detected to be less than a constant threshold of 0.67, the processor suspends the current calculation instruction and extracts the 15th percentile value of the sequence as the corrected dynamic benchmark threshold to complete the forced decoupling of multi-factor feature variables. In this detection mechanism, a constant threshold of 0.67 is used because it corresponds to the standard deviation. The theoretical asymptotic limit ratio of the mean to the standard deviation of the absolute deviation under the quasi-normal distribution curve serves as the statistical boundary for judging whether the data source is contaminated by asymmetric features. The selection of the 15th percentile of the sequence as the bottom-line protection is based on the feature backtracking results of historical anonymized interaction logs from the business platform. This level can stably eliminate rapidly emerging long-tail interference clusters, ensuring that parameter sampling always falls within the frequency band of the vast majority of normal user interactions with physically authentic characteristics. Simultaneously, to offset transient latency fluctuations caused by the network physical layer, the processor, within a 10-second statistical step... Real-time background noise is calculated using a moving average filter over several periods. This provides a penalty for the convergence constant. The values ​​provided provide calibration data that matches the current operating environment; among them, For dynamic baseline threshold, To achieve the mean of the fused weighted distribution sequence, To determine the standard deviation of the fused weighted distribution sequence, The number of sampling periods. For average network jitter latency; in cross-application protocol rights verification scenarios, the processor performs atomic conflict verification before merging the transient feature subgraph into the underlying graph database. This process includes retrieving the degree distribution characteristics of the nodes to be merged in the graph topology, calculating the edge density change rate between the newly added associated edges and the existing topology, and if the change rate exceeds a preset range of 3 standard deviations, the system suspends the fusion instruction and performs hash consistency tracing, extracting secondary entity features stored in the memory mirror layer using the source device identifier field, until the fusion admission weight of the transient feature subgraph is determined. In continuous Within each sampling point, the dynamic baseline threshold is met. Within the above numerical range; To integrate access weights, This represents the number of sampling steps within the observation window.

[0038] Example 6: During the deployment of a distributed multi-region anti-fraud system, the data processing system receives account interaction node streams from heterogeneous physical links. Due to differences in business activity and user behavior habits across different regions, the system faces an engineering obstacle before incorporating transient feature subgraphs into persistent baseline subgraphs. This obstacle stems from the lack of a consistent topological distribution baseline, making it difficult to determine the quantification limits of topological anomalies. To address this, the system uses a processor to run a standardized calibration procedure during the pre-deployment phase. This procedure extracts topological distribution features from an authorized historical full dataset. The calibration procedure includes the processor calculating the first-order neighborhood association density of each node in the dataset and using a mean statistical method to determine the degree of the baseline node. The specific calculation formula is as follows: ,in, The degree of the reference node. This represents the total number of nodes in the entire historical dataset. For the first 1 node For the first The processor will determine the degree of the baseline node by summing the in-degrees and out-degrees of each node. The value is stored in the logic decision register of the controller. During system operation, the processor extracts the degree distribution value of the transient feature subgraph in the memory working area in real time. When it detects that the average node degree in the transient feature subgraph deviates from the reference node degree, the processor will take action. When the value is 5 times the standard deviation, the system triggers an overflow isolation command.

[0039] Overflow isolation instructions control the physical migration of transient feature subgraphs from the memory computation layer to an independent overflow buffer, thereby limiting the frequency of writes from transient feature subgraphs to the underlying graph database. Simultaneously, the system uses the Least Recently Used algorithm to dynamically maintain the space of the independent overflow buffer. When the storage capacity exceeds 80% of the preset limit, the system removes transient feature subgraphs from the storage in the order of entry time, from farthest to nearest, until the space of the independent overflow cache is reclaimed to less than 40% of the storage capacity. This method of determining the topology distribution benchmark by deploying pre-calibration and combining it with independent cache management enables the system to maintain the structural integrity and retrieval performance of the persistent storage layer when subjected to non-steady-state topology impacts.

[0040] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the present invention can be implemented in other specific forms without departing from the spirit or essential characteristics of the present invention.

[0041] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention.

Claims

1. A method for online marketing fraud prevention and risk control decision-making of a coupon benefit fused with a knowledge graph, characterized in that, Includes the following steps: Step S101: Obtain a concurrent heterogeneous data stream containing the source device identifier field and interaction attribute data; Step S102: Within a preset sliding time window, the source device identification field and interaction attribute data are constructed into a directed acyclic transient feature subgraph, wherein the nodes in the transient feature subgraph contain interaction attribute data and the edges contain timing relationships determined by the arrival time of the data packets. Step S103: Read the persistent reference subgraph corresponding to the source device identifier field in the underlying graph database, calculate the adjacency matrix similarity between the transient feature subgraph and the persistent reference subgraph to obtain the basic topological isomorphism, extract the absolute timestamp difference of adjacent associated edges in the transient feature subgraph, divide the preset penalty convergence constant by the absolute timestamp difference to obtain the temporal penalty parameter, and subtract the temporal penalty parameter from the basic topological isomorphism to obtain the fusion admission weight; Step S104: Determine whether the fusion admission weight is greater than the preset structural convergence threshold; In step S105, if the fusion admission weight is not lower than the preset structural convergence threshold, the nodes and edges of the transient feature subgraph are merged into the underlying graph database to complete knowledge fusion; if the fusion admission weight is lower than the preset structural convergence threshold, the transient feature subgraph is migrated to the isolation domain to generate a decision instruction representing the abnormal request initiated by the terminal corresponding to the source device identifier field.

2. The method according to claim 1, wherein, The sub-steps of calculating the fusion admission weights in step S103 include: step S1031, calculating the node attribute similarity between the transient feature subgraph and the persistent baseline subgraph; step S1032, obtaining the temporal asynchronous deviation of each edge during the generation and arrival processes; and step S1033, adjusting the basic topological isomorphism using the weight calculation model based on the temporal asynchronous deviation correction to obtain the fusion admission weights. 3.The method of claim 1, wherein, After migrating the transient feature subgraph to the isolation domain, the following steps are also included: Step S301, extract the global information entropy index of the disputed subgraph in the isolation domain; Step S302, compare the matching degree between the global information entropy index and the risk feature index, and when the matching degree exceeds the risk threshold, mark the disputed subgraph as a fraud gang node; Step S303, when the matching degree is not greater than the risk threshold, use the local edge connectivity of the persistent baseline subgraph to perform topological density compensation on the disputed subgraph, and complete feature alignment based on the obtained compensation result.

4. The method according to claim 1, wherein, The sub-steps of constructing the transient feature subgraph in step S102 include: step S1021, parsing the device fingerprint information and account status data in the source device identifier field; step S1022, based on the semantic heterogeneity of the account status data, using an entity alignment mechanism to map the interaction attribute data to a preset business ontology framework; and step S1023, constructing directed edges according to the arrival time sequence of each interaction attribute data within a preset sliding time window to form a transient feature subgraph.

5. The method according to claim 1, wherein, The sub-steps of reading the persistent state benchmark subgraph in step S103 include: step S1034, retrieving local association features associated with the source device identifier field in the underlying graph database; step S1035, extracting multi-hop association paths within a preset stable period, filtering out nodes whose in-degree volatility exceeds the steady-state threshold, and constructing the persistent state benchmark subgraph.

6. The method according to claim 1, wherein, After incorporating the transient feature subgraphs into the underlying graph database, the following steps are also included: Step S601, real-time monitoring of the topology consistency index of the underlying graph database; Step S602, when the topology consistency index decreases monotonically, shortening the step size of the preset sliding time window and increasing the structure convergence threshold to complete the dynamic adaptation of high-frequency heterogeneous data influx.

7. The method according to claim 1, wherein, After migrating the transient feature subgraph to the isolation domain, the following steps are also included: Step S701, generate risk control decision instructions to restrict terminals with source device identifier fields from initiating coupon benefit requests; Step S702, count the topology evolution rate of conflicting subgraphs in the isolation domain, and when the topology evolution rate shows an exponential increase, start the logical coherence self-check of the underlying graph database. 8.The method of claim 1, wherein, Interactive attribute data includes geographic location coordinates, network access path, coupon redemption duration, and account behavior fingerprints. The temporal correlation characterizes the feature drift pattern of interactive attribute data within the 10μs to 100ms scale. 9.The method of claim 1, wherein, The underlying graph database uses a local topology density dynamic compensation strategy to mitigate feature matching decay caused by concurrent ingestion, ensuring that multi-hop association paths converge within a closed topology space.

Images