A method and system for real-time identification and blocking of fraudulent behavior of distributed data streams

Abstract

This application relates to the field of financial risk control technology, and in particular to a method and system for real-time identification and blocking of fraudulent activities using distributed data streams. The method includes: collecting transaction data streams, performing hash fragmentation, and distributing them to corresponding processing channels; sorting transaction records associated with the same user identifier and calculating the time interval between two adjacent transaction records; generating a fraud probability score by optimizing a decision tree classifier; when the fraud probability score exceeds a preset score threshold, sending a blocking instruction to the transaction execution node to freeze the pending transactions corresponding to the target user identifier; retrieving historical transaction records and generating a backtracking score by optimizing the decision tree classifier; determining whether to maintain the blocking based on the fraud probability score and the backtracking score, and sending corresponding control instructions. This application improves the real-time response capability of fraudulent activity identification, ensures the integrity of user behavior characteristics, and enhances the accuracy of transaction blocking decisions.

Description

Technical Field

[0001] This invention relates to the field of financial risk control technology, and in particular to a method and system for real-time identification and blocking of fraudulent activities using distributed data streams. Background Technology

[0002] With the rapid development of internet finance and e-commerce, the scale of online transactions continues to expand, and fraudulent activities are also showing trends of becoming more frequent, covert, and organized. Based on this, the identification and prevention of fraudulent activities has become one of the core technological requirements in the field of financial risk control.

[0003] Most existing fraud detection solutions rely on a centralized processing architecture, aggregating all transaction data to a single service node for unified analysis. While this approach is sufficient for smaller transaction volumes, it faces significant processing bottlenecks and latency issues in high-concurrency distributed transaction scenarios, making true real-time response difficult. Furthermore, although some solutions introduce distributed processing frameworks, their data sharding methods lack correlation with user behavior, resulting in transaction records for the same user being scattered across different nodes. This prevents the complete extraction of user-specific behavioral characteristics, thus affecting the accuracy of fraud detection.

[0004] Furthermore, existing solutions generally lack the ability to retrospectively verify historical transactions after a blocking event is triggered. Since fraudulent activities often do not occur in isolation, there may be a correlation between currently blocked transactions and historical transactions. If the judgment is made only based on the current transaction while ignoring the assessment of related historical transactions, it is easy to miss or misjudge fraudulent activities, resulting in poor reliability of blocking decisions. Summary of the Invention

[0005] In view of the aforementioned problems, this application is proposed to provide a method and system for real-time identification and blocking of fraudulent activities in distributed data streams that overcomes or at least partially solves the aforementioned problems, comprising: A method for real-time identification and blocking of fraudulent activities in distributed data streams, comprising the following steps: Collect transaction data streams, and distribute the transaction data streams to the corresponding processing channels after hashing and fragmenting them according to user identifiers; Within a preset time window, transaction records associated with the same user ID in each processing channel are sorted by transaction timestamp, and the time interval between two adjacent transaction records is calculated sequentially. Behavioral feature vectors are generated based on time intervals and transaction records, and a fraud probability score is generated based on the behavioral feature vectors by optimizing a decision tree classifier. When the fraud probability score exceeds the preset score threshold, a blocking instruction is sent to the transaction execution node, causing the transaction execution node to freeze the pending transactions corresponding to the target user identifier according to the blocking instruction; Retrieve historical transaction records of the target user from the historical transaction database, extract related transaction records, and generate a backtracking score based on the behavioral feature vector of the related transaction records by optimizing the decision tree classifier; The system determines whether to maintain the blockade based on the fraud probability score and the backtracking score, and sends the corresponding control command to the transaction execution node according to the judgment result.

[0006] This application has the following advantages: In the embodiments of this application, a method and system for real-time identification and blocking of fraudulent behavior in distributed data streams are provided. By maintaining the temporal integrity of user behavior through hash sharding, generating fraud probability scores in real time and combining them with historical transaction backtracking verification, this method can solve the technical problems of weak real-time response capability, missing user behavior features, and inaccurate blocking decisions in distributed scenarios. It has the effects of improving the real-time response capability of fraudulent behavior identification, ensuring the integrity of user behavior features, and enhancing the accuracy of transaction blocking decisions. Attached Figure Description

[0007] Figure 1 This is a flowchart of an embodiment of a method for real-time identification and blocking of fraudulent activities in a distributed data stream according to this application. Detailed Implementation

[0008] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0009] First, some nouns or terms that appear in the description of the embodiments of this application shall be interpreted as follows: Distributed data stream: This refers to a mode in which data is transmitted and processed in the form of a stream among multiple computing nodes. In this mode, data is typically generated and consumed continuously, requiring the system to have high throughput and low latency processing capabilities. The transaction data stream in this application embodiment is a type of distributed data stream, characterized by large data volume and high real-time requirements.

[0010] Hash sharding is a data distribution strategy that calculates a hash value for a key field in the data and maps the hash value to different processing nodes or storage units, thereby achieving uniform data distribution and parallel processing, which helps improve the scalability and processing efficiency of the system.

[0011] Processing channel: In a distributed system, this refers to a work unit used to receive and process specific data fragments. Each processing channel can independently perform calculations and analyses on its allocated data, thereby achieving parallel processing.

[0012] A time window is a finite time period defined in data stream processing, during which the system analyzes and calculates data only. Time windows can be fixed, sliding, or session-based, and are used to capture behavioral patterns within a specific time range.

[0013] Behavioral feature vectors are numerical features used to describe the behavioral patterns of users or entities. They can be extracted from transaction records, such as transaction amount, transaction frequency, and time interval. By quantifying these behavioral patterns, effective input can be provided to machine learning models.

[0014] Optimized decision tree classifiers are machine learning models that classify data by constructing a tree-like structure. Specifically, they guide data from the root node to leaf nodes using a series of decision rules, with each leaf node representing a classification result or probability. Furthermore, optimized decision tree classifiers are typically trained and tuned to improve their classification accuracy and generalization ability.

[0015] Fraud probability score: This measures the likelihood that a transaction or user behavior is fraudulent. A higher fraud probability score indicates a greater likelihood of fraud.

[0016] Scoring threshold: This refers to a preset value used to determine whether the fraud probability score meets the blocking standard. When the fraud probability score exceeds this scoring threshold, the system will trigger the corresponding blocking operation.

[0017] Transaction execution node: refers to the system component used to actually execute transaction operations. When a blocking instruction is received, the transaction execution node will freeze or reject the target transaction.

[0018] Historical transaction database: This refers to a database used to store all of a user's historical transaction records. This historical transaction database usually contains detailed information such as transaction time, amount, counterparty, etc., and can be used for retrospective analysis and risk assessment.

[0019] Related transaction records refer to historical transaction records that have a specific connection with the currently analyzed or blocked transactions. This connection can be determined based on dimensions such as counterparty, transaction amount range, and transaction geographical location.

[0020] Retrospective scoring: This refers to a score generated based on behavioral feature vectors from historical related transaction records, used to assess the rationality and reliability of the current blocking decision. The retrospective score will be combined with a fraud probability score to jointly determine whether to maintain the blocking.

[0021] Control instructions are instructions sent to the transaction execution node based on the judgment results of fraud probability score and backtracking score, used to maintain the block, unblock, or perform other risk control operations.

[0022] In one embodiment, such as Figure 1 As shown, this application discloses a method for real-time identification and blocking of fraudulent activities in distributed data streams, specifically including the following steps: S10: Collect transaction data streams, and distribute the transaction data streams to the corresponding processing channels after hashing and fragmenting them according to user identifiers; In the embodiments of this application, transaction data streams can be obtained in real time from multiple transaction sources, such as through message queue services. To achieve distributed processing, one approach is to hash the user identifier in each transaction record and then route the transaction record to one of a pre-configured processing channels based on the hash value. For example, a modulo operation can be used to map the hash value to an index of the processing channel. Another approach is to maintain a static hash table that directly maps user identifiers to specific processing channels. When transaction data arrives, this hash table is queried for distribution. This sharding mechanism allows all transaction records of the same user to be routed to the same processing channel as much as possible, facilitating user behavior analysis.

[0023] S20: Within a preset time window, sort the transaction records associated with the same user identifier in each processing channel according to the transaction timestamp, and calculate the time interval between two adjacent transaction records in turn. In the embodiments of this application, when each processing channel receives transaction records belonging to the same user identifier, they need to be sorted. One implementation is that the processing channel can maintain a transaction record cache for each user identifier. When a new transaction record arrives, it is added to the transaction record cache and sorted in ascending order according to the transaction timestamp. Subsequently, the sorted transaction record sequence is traversed, and the time difference between each pair of adjacent transactions is calculated. For example, if user A has three transactions at times t1, t2, and t3, then t2-t1 and t3 are calculated. 3-t2 is the time interval. The preset time window can be of a fixed length, for example, statistics are performed every 5 minutes or 10 minutes.

[0024] In another implementation, a sliding window mechanism based on event time can be used, with a window length of 5 minutes and a sliding step of 1 minute. To handle out-of-order transaction data caused by network latency, a watermark can be maintained, defined as "the maximum value of all currently received transaction timestamps minus the tolerable latency time, such as 30 seconds." The window is triggered for calculation when the watermark exceeds the window's end time. For late data arriving after the watermark, the system can choose to discard it or include it in the next window for processing. This mechanism ensures both real-time performance and data integrity.

[0025] S30: Generate behavioral feature vectors based on time intervals and transaction records, and generate fraud probability scores based on behavioral feature vectors by optimizing a decision tree classifier; In the embodiments of this application, generating a behavioral feature vector is crucial for quantifying user behavior. One implementation involves extracting a series of statistical features from sorted transaction records. For example, the average time interval, variance of the time interval, minimum time interval, and maximum time interval of all transactions for the user within the current time window can be calculated. Simultaneously, features of the transaction records themselves can be extracted, such as the average transaction amount, variance of the transaction amount, transaction frequency, and number of counterparties. Combining these extracted values ​​forms a multi-dimensional behavioral feature vector, which is then input into a pre-trained optimized decision tree classifier. The optimized decision tree classifier, using stored judgment rules, outputs a fraud probability score between 0 and 1 based on the feature vector's value, indicating the likelihood that the current behavior is fraudulent.

[0026] S40: When the fraud probability score exceeds the preset score threshold, a blocking instruction is sent to the transaction execution node, causing the transaction execution node to freeze the pending transactions corresponding to the target user identifier according to the blocking instruction; In the embodiments of this application, after generating a fraud probability score, the system compares it with a preset scoring threshold. One implementation is that if the fraud probability score is higher than the scoring threshold, the transaction or user behavior is considered to have a high risk of fraud, requiring immediate blocking measures. In this case, the system generates a blocking instruction containing the target user's identifier and related fraud risk information, and sends it to the transaction execution node responsible for the actual transaction processing. When the transaction execution node receives the blocking instruction, it immediately searches for all pending transactions related to that user identifier and marks their status as "frozen," thereby preventing further execution of these transactions.

[0027] S50: Retrieve historical transaction records of the target user from the historical transaction database, extract related transaction records, and generate a backtracking score based on the behavioral feature vector of the related transaction records by optimizing the decision tree classifier; In embodiments of this application, to improve the reliability of blocking decisions, the system performs backtracking analysis. One implementation involves querying the historical transaction database for all transaction records of the target user within a past period, based on the target user identifier of the blocked transaction. Records with some correlation to the currently blocked transaction are then selected from these historical transaction records; for example, historical transactions with the same payee, the same transaction amount range, or the same geographical location as the current transaction. For the selected related transaction records, the system extracts their behavioral feature vectors again and inputs them into an optimized decision tree classifier to generate a fraud probability score for the historically related transactions. A backtracking score is then generated based on the statistical features of the newly generated fraud probability score.

[0028] S60: Determine whether to maintain the blockade based on the fraud probability score and the backtracking score, and send the corresponding control command to the transaction execution node according to the judgment result.

[0029] In the embodiments of this application, the fraud probability score reflects the risk of the current transaction, while the retrospective score provides corroboration from historical behavior. One implementation involves the system comprehensively considering both scores. For example, if the fraud probability score is high, but the retrospective score shows the user's historical behavior is good, the necessity of blocking may need to be reassessed. Conversely, if both scores indicate high risk, the blocking should be maintained. Finally, the system generates corresponding control instructions based on the comprehensive judgment, such as "maintain blocking" or "unblock," and sends them to the transaction execution node to instruct it to process the frozen transaction.

[0030] Furthermore, in one implementation, a weighted comprehensive scoring mechanism can be used to determine whether to maintain the blocking. Specifically, the comprehensive risk score is calculated as α × fraud probability score + β × retrospective score, where α and β are weighting coefficients that can be adjusted according to the business scenario. For example, when the business is more concerned with the real-time risk of the current transaction, α can be set to 0.7 and β to 0.3; when the business is more concerned with the stability of historical behavior, α can be set to 0.5 and β to 0.5.

[0031] At this point, two thresholds can be preset: a maintenance blocking threshold and a release blocking threshold. When the overall risk score exceeds the maintenance blocking threshold, the system can send a maintenance blocking instruction to the transaction execution node; when the overall risk score is lower than the release blocking threshold, the system can send a release blocking instruction; when the overall risk score is between the two thresholds, a manual review process can be triggered or a decision can be made based on other business rules.

[0032] For example, as a specific implementation method, suppose in a distributed e-commerce transaction platform, user A makes multiple transactions in a short period of time. At this time, the system needs to identify in real time whether these multiple transactions have fraud risks and block them.

[0033] First, when user A's transaction data stream is generated, for example, user A makes a transaction of 100 yuan at location A using a mobile payment tool, and then makes another transaction of 200 yuan at location A, the system will collect these transaction data in real time, extract the user identifier from each transaction, and perform a hash calculation on it. Assuming the hash calculation result routes user A's transactions to processing channel 1, then processing channel 1 will receive these transaction records.

[0034] In processing channel 1, a sequence of transaction records for user A is maintained. When user A's transaction records arrive, these records are added to the sequence and sorted according to the transaction timestamp. For example, the first transaction occurs at 10:00:05, and the second occurs at 10:00:10. At this time, the system analyzes these transactions within a preset time window, calculating the time interval between adjacent transactions; for example, the time interval between the second and first transactions is 5 seconds.

[0035] Furthermore, the system generates a behavioral feature vector for user A based on the time intervals and information from the transaction records themselves. For example, in the last 5 minutes, user A's average transaction interval is 5 seconds, the time interval variance is 0, the average transaction amount is 150 yuan, the transaction frequency is 2 times, and the number of counterparties is 1. These features are then combined into a behavioral feature vector and input into a pre-trained optimized decision tree classifier. The optimized decision tree classifier determines user A's current behavioral pattern based on the input features and outputs a fraud probability score, for example, 0.85.

[0036] Based on this, the system compares the fraud probability score of 0.85 with a preset scoring threshold, such as 0.7. Since 0.85 is higher than 0.7, the system determines that user A's current transaction is high-risk and generates a blocking instruction. This blocking instruction includes user A's identifier and fraud probability score, and is sent to the transaction execution node. Upon receiving the blocking instruction, the transaction execution node immediately searches for all pending transactions of user A. For example, user A may have an ongoing transaction of 300 yuan, and its status is temporarily marked as "frozen," thus preventing the completion of that transaction.

[0037] Meanwhile, to further verify the accuracy of the blocking decision, the system retrieves user A's historical transaction records from the historical transaction database. Assuming the system retrieves all of user A's transactions within the past month, it extracts historical transaction records with the same payee identifier as the currently frozen transactions. For example, user A may have made two transactions to the same payee within the past week. The system then extracts behavioral feature vectors from these related transaction records and inputs them into an optimized decision tree classifier to obtain fraud probability scores for these historical related transactions. Subsequently, a backtracking score, for example, 0.6, is generated based on these fraud probability scores.

[0038] Finally, the system comprehensively considers the current fraud probability score of 0.85 and the backtracking score of 0.6. If the system's preset decision logic is: maintain blocking when both the fraud probability score and the backtracking score are high, or maintain blocking even when the fraud probability score is extremely high, then in this example, the fraud probability score of 0.85 is high, and the backtracking score of 0.6 also indicates that historical transactions carry a certain risk. Therefore, the system will determine that the blocking of user A's pending transactions should be maintained, and will send a "maintain blocking" control command to the transaction execution node to ensure that user A's pending transactions remain frozen, thereby effectively blocking potential fraudulent activities.

[0039] Based on the above example, firstly, by hashing and sharding the transaction data stream according to user identifiers and distributing it to the corresponding processing channels, this embodiment can effectively solve the processing bottlenecks and insufficient real-time performance of existing centralized architectures in high-concurrency scenarios. Unlike existing technologies that aggregate all data to a single node for analysis, this embodiment uses distributed processing, enabling each processing channel to process data from different users in parallel, improving system throughput and response speed. For example, in the transaction example of user A, their transaction data is routed to the corresponding specific processing channel, avoiding queuing on the centralized node and ensuring a certain level of real-time processing capability.

[0040] Secondly, by sorting and calculating the time intervals of transaction records associated with the same user identifier within each processing channel, and generating behavioral feature vectors based on this, the problem of incomplete extraction of user behavioral features in existing distributed solutions can be solved. Since existing technologies may result in scattered transaction records for the same user during data sharding, making it difficult to form a complete behavioral sequence, this embodiment ensures that the data of the same user is aggregated within the same processing channel, and extracts behavioral features such as time intervals and transaction amount statistics based on this, thereby comprehensively capturing user-level behavioral patterns. In the example of user A, the time intervals and transaction features of their continuous transactions are extracted and used to construct a behavioral feature vector, providing accurate input for fraud detection.

[0041] Finally, this embodiment improves the reliability of blocking decisions by introducing a mechanism that generates a retrospective score based on historical transaction backtracking analysis and combining it with a fraud probability score to jointly determine whether to maintain the blocking. Since existing solutions generally lack the ability to verify historical transactions after triggering a blocking action, they are prone to misjudgment or missed judgment. This embodiment retrieves related transaction records from the historical transaction database and generates a retrospective score based on these records, providing multi-dimensional verification for the current blocking decision. In User A's example, even if the current transaction has a high fraud probability score, the system will still backtrack and analyze its historical related transactions, thereby reducing the inaccuracy that may result from judging based on a single dimension and making the blocking decision more prudent and reliable. This comprehensive decision-making mechanism, combining real-time judgment and historical backtracking, can effectively reduce the false blocking rate and missed blocking rate, improving the accuracy and efficiency of overall risk control.

[0042] The following will further explain a method for real-time identification and blocking of fraudulent activities in a distributed data stream according to this exemplary embodiment.

[0043] In one embodiment, step S10 specifically includes: A hash ring is constructed based on the consistent hashing algorithm, and the node identifiers of each processing channel are mapped to the hash ring. The hash value is calculated for the user identifier associated with each transaction record in the transaction data stream. In the embodiments of this application, this step aims to map both storage nodes and data onto a virtual ring space. Its purpose is to provide a dynamic routing mechanism for transaction record distribution, ensuring that data is evenly distributed across all processing channels. In this way, when the number of nodes changes, the amount of data migration can be minimized, improving the scalability and stability of the system. The hash ring can be constructed using various hash functions, such as MD5 and SHA-1, mapping the unique identifier of the processing channel onto the ring, such as an IP address, port number, or logical ID. Simultaneously, the user identifier is also mapped onto the ring using the same hash function.

[0044] Before distributing transaction records, check if there is a corresponding processing channel mapping relationship for the user identifier in the mapping table. If it exists, the transaction record is directly distributed to the processing channel recorded in the mapping table. In the embodiments of this application, the mapping table refers to a lookup structure that stores the correspondence between user identifiers and processing channels. It can be an in-memory hash table, a Redis cache, or a distributed key-value store. The purpose of querying the mapping table is to quickly locate the processing channel corresponding to an established connection or assigned user identifier, avoiding repeated hash value calculations and hash ring searches, thereby improving the efficiency and determinism of data distribution. This pre-query mechanism ensures that transaction records for the same user identifier are continuously sent to the same processing channel, maintaining the locality of data processing.

[0045] If it does not exist, the nearest node is searched clockwise on the hash ring based on the hash value, and the transaction record is distributed to the processing channel corresponding to the nearest node. In the embodiments of this application, when no corresponding mapping relationship is found in the mapping table, the system utilizes the characteristics of consistent hashing to locate the hash value of the user identifier on the hash ring and searches clockwise for the first encountered processing channel node. This node is the "nearest node" for the user identifier, and the transaction record will be distributed to the processing channel corresponding to that node. Through this search mechanism, it can be ensured that even new user identifiers can be effectively assigned to the corresponding processing channel, and that only a small number of user identifier mapping relationships will change when processing channels are added or removed, thereby reducing system maintenance overhead.

[0046] The current load index of each processing channel is collected in real time. When the current load index of the target processing channel exceeds the preset load threshold, a backup processing channel whose load index does not exceed the load threshold is searched along the hash ring clockwise. In the embodiments of this application, load metrics may include CPU utilization, memory usage, network bandwidth, queue length, or number of transactions processed per second. Real-time collection of current load metrics can be achieved through monitoring agents, message queues, or RPC calls. The preset load threshold can be an upper limit set based on experience or test results, used to determine whether a processing channel is overloaded. When overload is detected, the system triggers a load balancing mechanism to find the next available, non-overloaded processing channel on the hash ring as a backup. This step aims to dynamically adjust the data flow routing, preventing a single processing channel from becoming a performance bottleneck and ensuring the overall stability and processing capacity of the system.

[0047] The transaction records are rerouted to the backup processing channel, and the mapping relationship between the backup processing channel and the corresponding user identifier is recorded in the mapping table.

[0048] In the embodiments of this application, once an alternative processing channel is found, subsequent transaction records belonging to that user identifier will no longer be sent to the original overloaded processing channel, but will be rerouted to the alternative processing channel. Simultaneously, the mapping table is updated to associate the user identifier with the new alternative processing channel. This step ensures that load balancing takes effect in real time, and by updating the mapping table, subsequent transaction distribution can directly utilize the new routing information, avoiding repeated load assessment and lookup processes.

[0049] Furthermore, to ensure the accuracy of fraud identification, after the above steps, the process further includes: the backup processing channel synchronizing the existing transaction sequence of the target user identifier from the original processing channel or the shared state storage, and merging and sorting the synchronized historical transaction sequence with the rerouted transaction records to maintain the complete time series of the same user identifier.

[0050] In the embodiments of this application, transaction records for the same user identifier must maintain a complete time series. When a transaction record is rerouted to a backup processing channel, the backup processing channel needs to obtain historical transaction records for that user identifier that have been processed or are yet to be processed in the original processing channel or shared storage (such as a distributed cache or database). After synchronization is complete, the backup processing channel will merge these historical transaction sequences with the newly received rerouted transaction records and sort them according to the transaction timestamp. This ensures that the context of user transaction data is not lost during load balancing or failover, improving the accuracy of behavioral feature extraction and fraud probability scoring.

[0051] For example, as a specific implementation, suppose a distributed transaction processing system contains three processing channels, namely channel A, channel B, and channel C.

[0052] First, the system constructs a hash ring based on the MD5 hash algorithm and maps the node identifiers of channels A, B, and C to the hash ring. A node identifier is, for example, the hash value of its IP address. When a new transaction record is received, with the user identifier "UserX", the system calculates the hash value of "UserX".

[0053] Before distribution, the system queries a distributed cache, such as a mapping table based on Redis, to check if a corresponding processing channel mapping already exists for "UserX". If "UserX" has been previously assigned to channel A, the transaction record is sent directly to channel A. If "UserX" is appearing for the first time, or its mapping relationship has expired, the system searches clockwise on the hash ring based on the hash value of "UserX". Assuming the nearest node found is channel B, the transaction record is distributed to channel B, and the mapping relationship between "UserX" and channel B is recorded in the distributed cache.

[0054] Furthermore, the system continuously monitors the load of channels A, B, and C, for example, by collecting the CPU utilization of each channel through Prometheus. If the CPU utilization of channel B consistently exceeds 80%, exceeding the preset load threshold, the system determines that channel B is overloaded. At this point, the system will search clockwise along the hash ring, starting from channel B. If the CPU utilization of channel C is below 80%, channel C is selected as the backup processing channel. Based on this, subsequent transaction records belonging to "UserX" will no longer be sent to channel B but will be rerouted to channel C. Simultaneously, the mapping relationship of "UserX" in the distributed cache will be updated to channel C.

[0055] Finally, to ensure the integrity of "UserX's" transaction sequence, channel C, upon receiving a rerouted transaction record, immediately requests the latest processed or pending transaction sequence of "UserX" on channel B. Alternatively, if the system is configured with a shared state store, such as a Kafka topic or a Cassandra database, channel C can directly pull "UserX's" historical transaction records from this shared state store. Based on this, channel C merges the synchronized historical transaction records with the newly received transaction records and sorts them according to transaction timestamps, thereby maintaining the complete transaction timeline of "UserX" and ensuring the accuracy of subsequent fraud detection.

[0056] By introducing a consistent hashing algorithm, the above technical solution enables transaction data streams to be evenly and dynamically distributed to various processing channels based on user identifiers. This effectively avoids data skew issues and enhances system scalability, minimizing data migration and ensuring service continuity even when the number of processing channels changes. Furthermore, by collecting current load metrics of processing channels in real time and performing dynamic load balancing, the system can promptly reroute transaction records to backup processing channels when a channel becomes overloaded. This effectively avoids single-point performance bottlenecks and ensures real-time data processing and high throughput. More importantly, during rerouting, the backup processing channel can synchronize existing transaction sequences of the target user identifier from the original processing channel or shared state storage and merge and sort them with the rerouted transaction records. This maintains a complete time series for the same user identifier, reducing false positives or false negatives in fraud detection caused by incomplete or disordered data sequences. This improves the accuracy and reliability of fraud detection, enabling more effective real-time blocking of fraudulent activities.

[0057] In one embodiment, step S30 specifically includes: Within a preset time window, extract the time interval characteristics and transaction record characteristics of transaction records associated with the same user identifier in each processing channel; In the embodiments of this application, by analyzing transaction records associated with the same user identifier within a preset time window, a user's transaction habits and abnormal behaviors within a specific time period can be captured. The time interval feature can reveal the density and regularity of transaction occurrences; for example, frequent transactions within a short period may indicate anomalies. Transaction record features can provide information from the attributes of the transaction itself and the dimensions of the interacting objects; for example, drastic fluctuations in transaction amounts or an abnormal increase in the number of counterparties may be related to fraudulent activities. The time interval feature includes the average time interval between adjacent transactions, the time interval variance, the minimum time interval, and the maximum time interval; the transaction record features include the mean transaction amount, the variance of the transaction amount, the transaction frequency, and the number of counterparties.

[0058] Generate behavioral feature vectors based on the extracted time interval features and transaction record features; In the embodiments of this application, multiple discrete or continuous feature values ​​are integrated into a unified numerical representation to form a behavioral feature vector, which is used as input to a machine learning model, thereby enabling the optimized decision tree classifier to identify potential fraud patterns.

[0059] The behavioral feature vector is input into a pre-optimized decision tree classifier, which performs splitting and judgment sequentially from the root node until it reaches the leaf node, and obtains the category label corresponding to the leaf node. In the embodiments of this application, the optimized decision tree classifier is a model used to classify behavioral feature vectors. By inputting the behavioral feature vectors into the optimized decision tree classifier, it can progressively determine whether the behavioral pattern corresponding to the behavioral feature vector belongs to the fraud or non-fraud category based on the decision rules it has learned internally. The splitting and judgment process starting from the root node is the classification reasoning process of the decision tree model, and the final leaf node represents the final classification result of the optimized decision tree classifier for that behavioral pattern.

[0060] An initial fraud probability score is generated based on the fraud probability value corresponding to the leaf node, and the consistency between the initial fraud probability score and the classification result indicated by the category label is judged. In the embodiments of this application, the fraud probability value can reflect the degree of confidence of the optimized decision tree classifier in that the sample belongs to the fraud category, and an initial fraud probability score is generated based on it for consistency judgment.

[0061] When the consistency judgment passes, the initial fraud probability score is used as the fraud probability score. When the consistency judgment fails, a confidence penalty coefficient is applied to the fraud probability score to obtain the fraud probability score.

[0062] In the embodiments of this application, consistency judgment is used to verify whether the classification tendency indicated by the initial fraud probability score matches the category label directly given by the leaf node, thereby discovering potential internal contradictions or edge cases within the classifier. When the classification result is consistent with the probability score, it indicates that the optimized decision tree classifier has a high degree of confidence in the judgment, and therefore the initial fraud probability score can be directly adopted. When the two are inconsistent, it indicates that the optimized decision tree classifier may have some degree of uncertainty. In this case, by applying a confidence penalty coefficient, the initial fraud probability score can be reduced, thereby reducing misjudgments or overconfidence caused by internal contradictions within the optimized decision tree classifier.

[0063] For example, as a specific implementation, suppose a user makes multiple small transactions within a short period of time, and the number of counterparties increases abnormally.

[0064] At this point, the system will first extract the user's transaction records in the current processing channel within a preset time window. For example, if the user made 10 transactions in the past 5 minutes, the system will calculate the time intervals between these 10 transactions, resulting in an average time interval of 30 seconds and a time interval variance of 100 seconds. 2 The minimum time interval is 5 seconds, and the maximum time interval is 60 seconds. The system also calculates the transaction amount, assuming an average transaction amount of 50 yuan and a transaction amount variance of 200 yuan. 2 The transaction frequency is 2 transactions / min, and the number of counterparties is 8.

[0065] Furthermore, these extracted feature values ​​are combined into a behavioral feature vector, such as [30, 100, 5, 60, 50, 200, 2, 8], and this behavioral feature vector is input into a pre-optimized decision tree classifier. The optimized decision tree classifier then starts from the root node and makes judgments based on its internal splitting rules. For example, the first node might judge "Is the transaction frequency greater than 1.5 transactions / min?", and since the current transaction frequency is 2, it is greater than 1.5, so it continues along the right child node. The next node might then judge "Is the number of counterparties greater than 5?", and since the current number is 8, it is greater than 5, so it continues along the right child node. After this series of judgments, a leaf node is finally reached. This leaf node might be trained to represent the "fraud" category, and its stored fraud probability value is 0.85. The system will then use 0.85 as the initial fraud probability score.

[0066] Based on this, a consistency check is performed between the initial fraud probability score and the classification result indicated by the category label. Since the leaf node category label is "fraud" and 0.85 is higher than the preset classification threshold of 0.5, the classification results indicated by the two are consistent, and therefore the consistency check is passed. Ultimately, the user's fraud probability score is determined to be 0.85.

[0067] Through the above technical solution, this application can improve the accuracy and reliability of fraud behavior identification in distributed data streams. Specifically, by extracting time interval features and transaction record features within a preset time window, abnormal user transaction behavior patterns can be captured, providing discriminative input information for fraud identification. Furthermore, based on the generated behavioral feature vector, combined with the judgment of an optimized decision tree classifier, potential fraud patterns can be effectively identified. More importantly, by introducing an initial fraud probability score generated based on the fraud probability value of leaf nodes and performing consistency judgment, the solution of this embodiment can calibrate the confidence level of the classifier's output. When the classification result is inconsistent with the probability score, by applying a confidence penalty coefficient, the risk of false positives caused by uncertainty within the classifier model or edge judgments can be effectively reduced, thereby making the final fraud probability score more reliable. This not only improves the accuracy of fraud identification but also effectively avoids unnecessary interference to normal transactions due to misjudgment, thus ensuring transaction security while improving user experience.

[0068] In one embodiment, before the step "inputting the behavioral feature vector into a pre-optimized decision tree classifier, performing splitting judgments sequentially starting from the root node until reaching the leaf node, and obtaining the category label corresponding to the leaf node", the following steps are specifically included: Obtain historical training samples, extract the values ​​of each feature dimension from the historical training samples, and calculate the feature importance weight of each feature dimension. In the embodiments of this application, obtaining historical training samples refers to collecting a dataset for classifier model training from accumulated transaction data. These historical training samples typically contain transaction records marked as fraudulent or non-fraudulent, along with various feature information related to these transactions. Their purpose is to provide the classifier model with a foundation for learning and recognizing fraud patterns. This can be achieved by batch extracting structured or semi-structured data from a data warehouse, or by acquiring and storing historical transaction snapshots in real time through a data lake interface. Extracting values ​​from each feature dimension of the historical training samples involves preprocessing the acquired historical training samples to parse out the attribute values ​​contained in each transaction record that can describe transaction behavior. These parsed attribute values ​​constitute the various dimensions of the behavioral feature vector, transforming the raw data into a numerical form that the classifier model can understand and process. This can be achieved by using a data parser to extract fields from transaction logs, such as transaction amount, transaction time, transaction location, and counterparty information; or by using feature engineering techniques to derive new features from the raw data, such as calculating transaction frequency and average transaction amount. Calculating the feature importance weights for each feature dimension assesses the degree to which each feature dimension is important in distinguishing between fraudulent and non-fraudulent transactions. A higher importance weight indicates a greater role that feature dimension plays in identifying fraudulent behavior. Its function is to quantify the contribution of features and provide a basis for feature selection. This can be achieved through feature importance assessment methods based on decision tree models, such as Gini importance or information gain; or through statistical methods, such as chi-square tests or mutual information, to measure the association between features and the target variable.

[0069] Feature dimensions are selected based on their importance weights, and feature dimensions with importance weights higher than a preset weight threshold are retained to obtain an optimized feature subset. In the embodiments of this application, feature dimension selection based on feature importance weights refers to selecting feature dimensions that contribute significantly to the classifier model's performance based on the calculated feature importance weights, while discarding feature dimensions that contribute less or are redundant. This aims to reduce the complexity of the classifier model and improve its generalization ability and training efficiency. This can be achieved by setting a preset weight threshold and selecting features with importance weights higher than that threshold; alternatively, the top N feature dimensions with the highest importance weights can be selected. Retaining feature dimensions with importance weights higher than the preset threshold means setting a numerical limit during feature selection; only when the importance weight of a feature exceeds this limit is it included in the final feature set. This ensures that the selected features have sufficient discriminative power. Optimizing the feature subset refers to the set obtained after feature selection that contains the most effective or critical feature dimensions for fraud detection; its purpose is to provide efficient input for classifier model training.

[0070] The optimized decision tree classifier is obtained by training the basic decision tree classifier based on the optimized feature subset.

[0071] In the embodiments of this application, training a basic decision tree classifier based on an optimized feature subset refers to using a selected optimized feature subset as input to train a standard decision tree model. Its purpose is to construct a classifier that performs well in a simplified feature space. This can be achieved using standard decision tree construction algorithms such as CART, C4.5, or ID3, recursively constructing the decision tree structure based on features in the optimized feature subset as the splitting basis. The optimized decision tree classifier refers to the final decision tree model obtained after the above feature selection and training process, used to generate fraud probability scores. Its purpose is to provide an efficient, accurate, and well-generalized fraud detection tool.

[0072] For example, as a specific implementation, assume that tens of thousands of transaction records have been collected in the historical training samples. Each record contains feature dimensions such as transaction amount, transaction time, transaction location, transaction frequency, number of counterparties, device ID, and IP address, and each record has been marked as "fraudulent" or "non-fraudulent".

[0073] First, the system extracts the specific values ​​of all feature dimensions from these historical training samples. To assess the importance of these feature dimensions, an initial random forest model can be used to train all features and calculate the Gini importance of each feature. For example, if the Gini importance of "transaction amount" is 0.35, "transaction frequency" is 0.28, "IP address" is 0.02, and "device ID" is 0.01, a weight threshold can be set, for example, to 0.05. Based on this weight threshold, feature dimensions with importance higher than 0.05, such as "transaction amount" and "transaction frequency," are selected, while features with lower importance, such as "IP address" and "device ID," are removed, thus obtaining an optimized feature subset containing a few key features.

[0074] Finally, using this optimized feature subset as input, a CART decision tree classifier is trained to construct the final optimized decision tree classifier, which will make decisions based solely on features in the optimized feature subset, thereby more efficiently and accurately identifying potential fraudulent activities.

[0075] Through the above technical solution, this application can effectively optimize the decision tree classifier before generating a fraud probability score. Specifically, by acquiring historical training samples and extracting corresponding feature dimensions, the importance weight of each feature dimension is calculated. Based on this importance weight, an optimized feature subset is selected for training the optimized decision tree classifier. This effectively reduces the interference from redundant or irrelevant features that may be encountered by the classifier model during training, thereby reducing the complexity of the classifier model, improving its training efficiency and generalization ability, and effectively avoiding overfitting. Based on this, when the behavioral feature vector is input into the optimized decision tree classifier, it can generate a more accurate and reliable fraud probability score, thus improving the accuracy and stability of the fraud detection process.

[0076] In one embodiment, the step "inputting the behavioral feature vector into a pre-optimized decision tree classifier, performing splitting judgments sequentially starting from the root node until reaching the leaf node, and obtaining the category label corresponding to the leaf node" specifically includes: (a) Start with the root node of the optimized decision tree classifier; (b) Extract the preset splitting feature dimensions and corresponding splitting thresholds of the current node; (c) Extract the feature values ​​corresponding to the split feature dimensions from the behavior feature vector, and determine whether the extracted feature values ​​are greater than the split threshold; In the embodiments of this application, the root node of the optimized decision tree classifier is the starting point of the decision tree, representing the starting point of the entire classification process. In the structure of the decision tree, the root node is the first node to perform feature splitting judgment. Its selected feature dimension and splitting threshold have a decisive impact on the subsequent classification path. Its role is to provide a clear starting position for the classification of behavioral feature vectors, ensuring that each vector to be classified traverses the decision tree from the same logical starting point. Specifically, this can be achieved by loading the decision tree model into memory and designating its top-level node as the current processing node. The splitting feature dimension refers to the specific feature used to distinguish different categories of samples at the current decision tree node. The splitting threshold is a value on the splitting feature dimension used to divide the sample data into two subsets. Furthermore, the splitting feature dimension and splitting threshold are usually predetermined during the decision tree training phase and stored in each node. Their role is to provide a basis for the classification judgment of the current node, guiding the behavioral feature vector along specific branches of the decision tree. For example, preset feature indices and values ​​can be directly read from the node's data structure, or obtained by consulting the configuration table associated with the node ID. The core operation of decision tree classification is to extract the specific feature values ​​required for the current node's judgment from the behavioral feature vector and compare these extracted feature values ​​with the preset splitting threshold for the current node. This determines which child node the behavioral feature vector should enter. For example, feature values ​​of a specified dimension can be obtained from the behavioral feature vector using array indexes or dictionary key-value pairs, and then numerical comparison operations can be performed.

[0077] (d) If the eigenvalue is greater than the splitting threshold, continue splitting along the right child of the current node; if the eigenvalue is less than or equal to the splitting threshold, continue splitting along the left child of the current node. (e) Determine if the current node is a leaf node. If not, repeat steps (b), (c), and (d) until a leaf node is reached. If it is, execute step (f). (f) Obtain the pre-stored category label from the leaf node, wherein the category label is the sample category with the highest number of samples in the historical training samples corresponding to the leaf node during the training phase.

[0078] In the embodiments of this application, the binary splitting logic of the decision tree is as follows: based on the comparison result of the feature value and the splitting threshold, the behavioral feature vector will be guided to the left or right child node of the decision tree, ensuring that each behavioral feature vector can traverse downwards from the root node along a unique path until a leaf node is reached. For example, in the internal representation of the decision tree, each node can contain pointers or indices pointing to its left and right child nodes, and the current processing node is updated to the corresponding child node according to the judgment result. The leaf node is the terminal node of the decision tree, which does not contain further splitting conditions, but directly gives the classification result. By checking whether the current node is a leaf node, the termination of the decision tree traversal process can be controlled: if the current node is not a leaf node, the splitting judgment continues; if the current node is a leaf node, it means that the classification path has been completed and the final category label can be obtained. For example, each node can contain a boolean flag to indicate whether it is a leaf node, or it can be determined whether it is a leaf node by checking whether its child node pointer is null. Once a leaf node is reached, the category label pre-stored in the leaf node is the classification result of the behavioral feature vector. The class label is determined during the decision tree training process based on the class with the highest frequency among all historical training samples reaching that leaf node, such as fraud or non-fraud. Its role is to provide the final classification judgment, serving as the basis for generating a fraud probability score. For example, a leaf node can directly store an enumeration value or string to represent its class label, or store a reference to the class definition.

[0079] For example, as a specific implementation, assume that an optimized decision tree classifier has been trained and loaded.

[0080] When the system receives a new user transaction behavior feature vector, such as one containing features like "transaction amount," "transaction frequency," and "transaction time interval," the classification process begins with the root node of the optimized decision tree classifier. Assume the root node's preset splitting feature dimension is "transaction amount," with a corresponding splitting threshold of 1000 yuan. The system extracts the "transaction amount" feature value from the input behavior feature vector. For example, if this feature value is 1200 yuan, since 1200 yuan is greater than 1000 yuan, it can be determined that the feature value exceeds the splitting threshold. Therefore, the splitting process continues along the right child node of the current root node.

[0081] Furthermore, the right child node might have a preset splitting feature dimension of "transaction frequency," with a corresponding splitting threshold of 5 times / hour. In this case, the system will again extract the "transaction frequency" feature value from the behavioral feature vector; for example, if this feature value is 8 times / hour. Since 8 times / hour is greater than 5 times / hour, the system will continue splitting along the right child node of the current node. This process will repeat until the system determines that the current node is a leaf node.

[0082] Finally, once a leaf node is reached, for example, if the pre-stored category label of this leaf node is "fraud", the system can then obtain the final classification result of the behavioral feature vector as "fraud". This "fraud" category label was determined during the training phase when the number of fraud samples accounted for the highest among the historical training samples covered by this leaf node.

[0083] Through the above technical solution, this application provides a clear and efficient decision tree classification mechanism, which can ensure that behavioral feature vectors can be accurately classified by the optimized decision tree classifier. This systematic traversal process avoids ambiguity in classification judgment, ensuring that each behavioral feature vector reaches a unique leaf node along a pre-defined logical path, thereby obtaining a stable and reliable category label. This improves the accuracy and credibility of the fraud probability score generation process, and ultimately enhances the overall performance of real-time identification and blocking of distributed data stream fraud.

[0084] In one embodiment, the step "generating an initial fraud probability score based on the fraud probability value corresponding to the leaf node, and performing a consistency judgment between the initial fraud probability score and the classification result indicated by the category label" specifically includes: Retrieve the pre-stored fraud probability value from the leaf node and use the fraud probability value as the initial fraud probability score; In the embodiments of this application, the fraud probability value is derived by the decision tree classifier during the training phase by statistically analyzing the proportion of fraudulent samples among all historical training samples falling into a specific leaf node. It quantifies the likelihood of fraudulent behavior occurring under the feature combination represented by that leaf node. In practical applications, the fraud probability value can serve as a preliminary quantitative assessment of the fraud risk of current transaction behavior. For example, after the decision tree training is complete, the system can traverse all leaf nodes, count the number of fraudulent samples in each leaf node relative to the total number of samples, calculate the ratio, and store it as the fraud probability value for that leaf node. Alternatively, during training, techniques such as Bayesian smoothing can be used to correct the fraud probability value to improve its estimation accuracy for leaf nodes with smaller sample sizes.

[0085] The classification result corresponding to the initial fraud probability score is determined based on the preset classification threshold. When the initial fraud probability score is higher than the classification threshold, it corresponds to the fraud category. When the initial fraud probability score is lower than or equal to the classification threshold, it corresponds to the non-fraud category. In the embodiments of this application, this step aims to convert continuous fraud probability scores into discrete classification results for comparison with preset category labels in the leaf nodes. The classification threshold is a key parameter, directly affecting the sensitivity and specificity of the classification. For example, the classification threshold can be optimized based on historical data analysis, business risk tolerance, or receiver operation characteristic curve analysis to balance false positive and false negative rates. Furthermore, the classification threshold can also be dynamically adjusted according to real-time business needs or risk conditions to adapt to the constantly changing fraud detection environment.

[0086] Determine whether the classification result corresponding to the initial fraud probability score is consistent with the category label. If they are consistent, the consistency judgment passes; otherwise, the consistency judgment fails.

[0087] In the embodiments of this application, consistency judgment provides a mechanism for verifying the reliability of the initial fraud probability score. The category label is the primary category determined for the leaf node during the training phase of the decision tree, while the classification result is derived based on the current initial fraud probability score and a classification threshold. By comparing these two, the robustness of the current classification decision can be evaluated. For example, the system can directly compare the classification result derived from the initial fraud probability score with the category label pre-stored in the leaf node. If both are identical, the classification result is considered consistent with the dominant tendency of the leaf node, and the consistency judgment passes. If they are inconsistent, it indicates that the current score may be near the decision boundary or that some uncertainty exists, and the consistency judgment fails.

[0088] For example, as a specific implementation, suppose an optimized decision tree classifier, after training, has a leaf node storing a fraud probability value of 0.75 and a class label of "fraud," indicating that most samples falling into that leaf node during training were fraudulent samples.

[0089] At a certain moment, a new transaction behavior feature vector falls into this leaf node after being judged by the classifier. At this time, the system will obtain a fraud probability value of 0.75 from this leaf node as the initial fraud probability score. Assuming the preset classification threshold is 0.6, since 0.75 is higher than 0.6, the classification result corresponding to the initial fraud probability score can be judged as "fraud".

[0090] Finally, the classification result representing "fraud" is compared with the pre-stored category label "fraud" in the leaf node. They match, therefore the consistency check passes. In this case, the initial fraud probability score of 0.75 can be directly used as the final fraud probability score.

[0091] In another instance, suppose another leaf node stores a fraud probability value of 0.55, but its category label is still "fraud", which means that there may be slightly more fraudulent samples than non-fraudulent samples in the leaf node, but the proportions are close.

[0092] When a transaction behavior feature vector falls into this leaf node, its initial fraud probability score is set to 0.55. If the classification threshold is still 0.6, since 0.55 is less than or equal to 0.6, the classification result corresponding to the initial fraud probability score can be judged as "non-fraud". At this point, comparing the classification result "non-fraud" with the pre-stored category label "fraud" in the leaf node reveals an inconsistency, thus failing the consistency judgment. In this case, a confidence penalty coefficient can be applied to the fraud probability score to obtain a more cautious fraud probability score.

[0093] Through the above technical solution, this application can effectively verify the reliability of the initial fraud probability score. Specifically, by comparing the quantified fraud probability value with the dominant classification tendency of the decision leaf nodes, potential classification uncertainties or contradictions can be identified. When the consistency judgment passes, it indicates that the classification result is robust and reliable; when the consistency judgment fails, potential biases in the scoring can be detected in a timely manner, triggering a confidence penalty mechanism. This allows the final fraud probability score to be more accurate or prudent, effectively reducing the risk of misjudgment and improving the accuracy and reliability of real-time identification and blocking of fraudulent behavior in distributed data streams.

[0094] In one embodiment, step S40 specifically includes: When the fraud probability score exceeds the preset score threshold, a blocking instruction is generated that includes the target user identifier, the fraud probability score, and the blocking timestamp. In the embodiments of this application, when the fraud probability score exceeds a preset scoring threshold, the system generates a blocking instruction to instruct the transaction execution node to freeze a specific transaction. This instruction includes at least key information such as the target user identifier, the fraud probability score, and a blocking timestamp. The target user identifier identifies the user to whom the transaction to be blocked belongs; the fraud probability score provides a risk basis for the blocking; and the blocking timestamp records the time the instruction was generated, facilitating subsequent tracking and auditing. Furthermore, the blocking instruction can exist in the form of structured data, such as a JSON object or a Protocol Buffers message, for ease of transmission and parsing.

[0095] The blocking priority is determined based on the fraud probability score, and the node address of the transaction execution node is queried based on the target user identifier. The blocking instruction is then inserted into the priority blocking queue of the corresponding transaction execution node. In the embodiments of this application, after generating a blocking instruction, the system determines the blocking priority based on a fraud probability score. The blocking priority is an indicator of the urgency of the blocking instruction; higher-priority instructions should be processed first to prevent high-risk fraudulent activities as quickly as possible. Determining the blocking priority can be achieved by dividing the fraud probability score into different intervals, each interval corresponding to a preset priority level; or, the fraud probability score can be directly used as the priority weight, with higher scores indicating higher priority. Further, the system queries the node address of the transaction execution node based on the target user identifier. In a distributed environment, transaction execution nodes may be distributed across different servers, thus requiring the location of the node responsible for processing specific user transactions. This can be achieved through service registration and discovery mechanisms, such as using ZooKeeper or Consul to maintain the mapping relationship between user identifiers and node addresses; or, a consistent hashing algorithm can be used to map user identifiers to specific transaction execution nodes. After the node address is found, the blocking instruction is inserted into the priority blocking queue of the corresponding transaction execution node. The priority blocking queue is a special message queue that sorts instructions according to their priority, ensuring that higher-priority instructions are retrieved and processed first. Furthermore, the priority blocking queue can be an in-memory queue maintained within the transaction execution node, such as a priority queue implemented based on a heap; or it can be a distributed message queue that supports priority features, such as a specific configuration of Kafka or RabbitMQ.

[0096] The transaction execution node processes the blocking instructions in the priority blocking queue in descending order of blocking priority, and retrieves all pending transactions associated with the target user identifier from the pending transaction queue; In the embodiments of this application, the transaction execution node processes blocking instructions in the priority blocking queue in descending order of blocking priority. This means that the transaction execution node continuously listens for and processes the highest priority blocking instruction from the queue, ensuring that the system can respond promptly to the most urgent fraud risks. When processing blocking instructions, the transaction execution node retrieves all pending transactions associated with the target user identifier from the pending transaction queue, which stores transaction records that have not yet been processed. Further, the retrieval operation can be implemented by traversing the queue and matching user identifiers, or, if the pending transaction queue supports indexing, by quickly locating the transaction using the index.

[0097] The retrieved pending transactions are marked as frozen, and the blocking timestamp and fraud probability score are recorded in the transaction status table. In the embodiments of this application, once a pending transaction is retrieved, its status is marked as frozen, indicating that the transaction is temporarily suspended from execution, pending further review or unblocking. Simultaneously, the blocking timestamp and fraud probability score are recorded in the transaction status table. This transaction status table is a persistent storage system used to record the current status of all transactions and their related operational information.

[0098] Return a blocking confirmation message to the processing channel that sent the blocking command to notify that the blocking operation has been completed.

[0099] In the embodiments of this application, the blocking confirmation message is the system's feedback on the execution result of the blocking command. It informs the processing channel that initiated the blocking that the blocking command has been successfully received and executed. The blocking confirmation message can be implemented through asynchronous message notification, remote procedure call, or callback mechanisms to ensure the closed-loop and reliability of the entire blocking process.

[0100] For example, as a specific implementation, suppose in a distributed data stream, a transaction of a user identified as "UserA" is detected with a fraud probability score of 0.95, exceeding the preset score threshold of 0.8. At this time, the system will generate a blocking instruction, which includes "UserA" as the target user identifier, 0.95 as the fraud probability score, and the current system time as the blocking timestamp.

[0101] Simultaneously, due to its high score of 0.95, the system will assign it the highest blocking priority. Furthermore, by querying the service registry, the system will locate the transaction execution node responsible for handling "UserA's" transaction. The blocking instruction will then be sent to that transaction execution node and inserted into its internal priority blocking queue. Subsequently, the transaction execution node continuously retrieves instructions from the queue. When it retrieves the blocking instruction for "UserA," it will immediately scan its pending transaction queue to identify all incomplete transactions initiated by "UserA." For example, suppose it finds two pending transactions with transaction IDs "TX001" and "TX002." At this point, the transaction execution node will update the status of these two transactions from "processing" to "frozen" and record the blocking timestamp and fraud probability score in the "blocked_transactions" table in the transaction status database.

[0102] Finally, the transaction execution node will send a blocking confirmation message to the processing channel that initially sent the blocking instruction, informing that "UserA's" transaction has been successfully frozen.

[0103] Through the aforementioned technical solution, this application ensures that blocking instructions are executed efficiently, reliably, and with priority when potential fraudulent activity is detected. This blocking process improves the response speed and success rate of real-time fraud blocking and effectively reduces losses caused by fraudulent transactions. Furthermore, the recording and confirmation of blocking operations provide a data foundation for subsequent risk analysis, auditing, and system optimization, enhancing the credibility of the fraud identification and blocking system.

[0104] In one embodiment, step S50 specifically includes: Retrieve historical transaction records from the historical transaction database within a preset time range based on the target user identifier; In the embodiments of this application, the historical transaction database can be a distributed database system, such as HBase, Cassandra, or ClickHouse, used to store massive amounts of transaction data and support efficient queries based on user identifiers. Retrieval operations are implemented through a query interface, using the user identifier as the primary key or index for rapid location, and limiting the query time range, such as transaction records within the most recent month, three months, or six months, to ensure the retrieved data is timely and relevant.

[0105] Extract related transaction records from historical transaction records that have a preset association with the currently frozen pending transactions; In embodiments of this application, the association includes the same payee identifier, the same transaction amount range, or the same transaction geographical location. Related transaction records with a preset association with the currently frozen pending transaction are extracted from historical transaction records. For example, if the currently frozen transaction is user A transferring 1000 yuan to payee B at transaction location C, the system will filter user A's historical transaction records for transactions with payee B, transactions with transaction amounts between 900-1100 yuan, or transactions with geographical locations close to C (e.g., within a preset geographical radius). The extraction of associations can be achieved through a preset rule engine or pattern matching algorithm to identify historical behaviors similar to the current suspicious transaction in certain key dimensions.

[0106] Calculate the time interval characteristics between adjacent related transaction records based on the transaction timestamps of related transaction records, and extract the transaction record characteristics of related transaction records; In the embodiments of this application, the calculation method of the time interval feature is similar to that of real-time detection, including the average time interval between adjacent transactions, the time interval variance, the minimum time interval, and the maximum time interval. These features can reflect the transaction frequency and regularity of users in the related transaction sequence. Transaction record features include the mean of related transaction amounts, the variance of transaction amounts, transaction frequency, and the number of counterparties, etc. These features can reflect the scale, volatility, and diversity of related transactions.

[0107] Based on the time interval characteristics and the transaction record characteristics of related transaction records, a behavioral feature vector of related transaction records is generated; In the embodiments of this application, the behavioral feature vector is a multi-dimensional numerical vector formed by combining all extracted time interval features and transaction record features, which is used to comprehensively quantify the behavioral pattern of each related transaction record.

[0108] The behavioral feature vectors of related transaction records are input into an optimized decision tree classifier to obtain the fraud probability score corresponding to the related transaction records, and a backtracking score is generated based on the statistical features of the fraud probability score.

[0109] In the embodiments of this application, the optimized decision tree classifier used here is the same as the classifier used in the real-time identification stage. It has been optimized using historical training samples and is capable of effectively identifying fraud patterns. The optimized decision tree classifier receives behavioral feature vectors as input and outputs a fraud probability value between 0 and 1, indicating the likelihood that the associated transaction record is a fraudulent transaction. Backtracking scoring refers to the result of a comprehensive evaluation of the fraud probability scores of all associated transaction records. The statistical characteristics of the fraud probability scores may include the average, maximum, median, and standard deviation of the fraud probability scores, or they may be aggregated through weighted averaging. For example, higher weights can be assigned to the fraud probability scores of recent associated transactions to reflect their influence.

[0110] For example, as a specific implementation method, suppose a user A's transaction is initially frozen due to an excessively high real-time fraud probability score. At this time, the system will initiate a backtracking analysis process.

[0111] First, retrieve all of User A's transaction records from the historical transaction database within the past three months. If the frozen transaction is a transfer of 1,000 yuan to Recipient B, and the transaction location is XX City, the system will extract all of User A's historical transaction records for transfers to Recipient B, all transfer records with amounts between 900 and 1,100 yuan, and all transfer records with transaction locations in or around XX City, i.e., related transaction records.

[0112] Based on this, for each related transaction record, the system calculates its time interval characteristics with adjacent transactions, such as an average interval of 2 hours and a maximum interval of 1 day, as well as transaction record characteristics, such as an average amount of 950 yuan, high transaction frequency, and a small number of counterparties. It then generates a corresponding behavioral feature vector, which is subsequently input into a pre-trained optimized decision tree classifier to generate a fraud probability score for each related transaction record. For example, if user A frequently made small transfers to recipient B in the past, but suddenly a large transfer is frozen, backtracking analysis might reveal that the fraud probability score for transfers to B in the past was generally low, indicating that the current transaction might be normal behavior. Conversely, if backtracking analysis finds that user A's fraud probability score was generally high in multiple past transactions to recipient B, or that there are historical transactions with highly similar characteristics (such as amount and location) to the currently frozen transaction and marked as fraudulent, this would further confirm the fraud risk of the current transaction.

[0113] Ultimately, the system will combine the fraud probability scores of related transaction records, such as calculating their weighted average or maximum value, to generate a retrospective score. This retrospective score, together with the real-time fraud probability score, will serve as the basis for the final decision on whether to maintain the blockade.

[0114] Through the above technical solution, this application can effectively solve the problems of misjudgment and missed judgment that may occur if fraud identification is based solely on real-time data. Specifically, by analyzing the historical related transactions of the target user identifier, transaction risks can be assessed more comprehensively, and abnormal fluctuations in normal transactions can be distinguished from genuine fraudulent behavior. This not only improves the accuracy of fraud identification and reduces interference with normal users, but also enhances the system's ability to combat complex and covert fraud patterns, and improves the accuracy and reliability of fraud blocking decisions.

[0115] In one embodiment, the step "inputting the behavioral feature vector of the related transaction record into the optimized decision tree classifier to obtain the fraud probability score corresponding to the related transaction record, and generating a backtracking score based on the statistical features of the fraud probability score" specifically includes: The behavioral feature vectors of each related transaction record are sequentially input into the optimized decision tree classifier to obtain the fraud probability score corresponding to each related transaction record. In the embodiments of this application, after obtaining the historical transaction records associated with the target user identifier, the behavioral feature vector of each associated transaction record is first input into a pre-optimized decision tree classifier. The function of the optimized decision tree classifier is to output a fraud probability score based on the input behavioral feature vector, indicating the likelihood that the associated transaction record is a fraudulent transaction.

[0116] Calculate the time decay coefficient of each related transaction record based on the time distance between the transaction timestamp of each related transaction record and the timestamp of the currently frozen pending transaction; In the embodiments of this application, to reflect the timeliness and relevance of related transaction records to the current fraud assessment, it is necessary to calculate the time decay coefficient of each related transaction record based on the time distance between the transaction timestamp of each related transaction record and the timestamp of the currently frozen pending transaction. The time distance can be in units such as seconds, minutes, hours, or days, representing the time difference between the time of the related transaction and the time of the current pending transaction. The time decay coefficient is a value between 0 and 1, used to quantify the impact of time distance on risk assessment. Generally, the longer the time distance, the smaller the time decay coefficient, indicating that the related transaction record is less important to the current risk assessment. Furthermore, the time decay coefficient can be calculated using an exponential decay function, for example... ,in, It is a configurable attenuation rate parameter.

[0117] The fraud probability scores of each related transaction record are weighted based on the time decay coefficient, and the weighted average and weighted maximum values ​​of the weighted fraud probability scores are calculated. In the embodiments of this application, the fraud probability score of each related transaction record is multiplied by the corresponding time decay coefficient to obtain a weighted fraud probability score. Then, the weighted average and weighted maximum of the weighted fraud probability scores are calculated. The weighted average reflects the overall average fraud risk level of all related transaction records after considering the time factor, while the weighted maximum reflects the highest fraud risk existing in the related transaction records after considering the time factor.

[0118] Calculate the standard deviation of the weighted fraud probability score. When the standard deviation is lower than the preset discrete threshold, increase the weight of the weighted average in the retrospective score calculation formula. When the standard deviation is higher than or equal to the preset discrete threshold, increase the weight of the weighted maximum in the retrospective score calculation formula. In this embodiment of the application, to further improve the accuracy of backtesting scoring, the standard deviation of the weighted fraud probability score is also calculated. The standard deviation is an indicator that measures the dispersion of a set of data, reflecting the volatility between the weighted fraud probability scores of various related transaction records. When the standard deviation is lower than a preset dispersion threshold, it indicates that the risk patterns of related transactions are relatively consistent. In this case, the weight of the weighted average in the backtesting scoring formula can be increased to make it more representative of the overall risk. Conversely, when the standard deviation is higher than or equal to the preset dispersion threshold, it indicates that the risk patterns of related transactions fluctuate significantly or that there are individual high-risk events. In this case, the weight of the maximum weighted average in the backtesting scoring formula should be increased to ensure that potential extreme risks can be captured. Furthermore, the dispersion threshold can be determined based on historical fraud data analysis, expert experience, or through model optimization experiments.

[0119] The weighted average and weighted maximum values ​​are weighted according to the dynamically adjusted weights to generate a retrospective score.

[0120] In the embodiments of this application, the final backtracking score is generated by weighting the weighted average and the weighted maximum value according to the dynamically adjusted weights.

[0121] For example, as a specific implementation, suppose that for a frozen pending transaction, the system retrieves three related transaction records T1, T2, and T3.

[0122] First, the behavioral feature vectors of T1, T2, and T3 are input into a pre-trained XGBoost classifier to obtain their respective fraud probability scores, for example, P1=0.8, P2=0.3, and P3=0.9. Next, the time distance between each related transaction record and the current pending transaction is calculated; for example, T1 occurred one hour ago, T2 occurred five hours ago, and T3 occurred thirty minutes ago. At this point, the time decay coefficient can be calculated using the exponential decay function, resulting in DC1=0.90, DC2=0.61, and DC3=0.95.

[0123] Based on this, a weighted fraud probability score can be calculated, resulting in WP1 = 0.8. 0.90 = 0.72, WP2 = 0.3 0.61 = 0.183, WP3 = 0.9 0.95 = 0.855. Based on the calculated weighted fraud probability score, the weighted average and weighted maximum values ​​can be further calculated. Simultaneously, the standard deviation of the weighted fraud probability score set {0.72, 0.183, 0.855} is calculated. Assuming the calculated standard deviation is 0.3, and the preset discrete threshold is 0.2, since the standard deviation of 0.3 is higher than the discrete threshold of 0.2, the system will increase the weight of the weighted maximum value in the backtracking score calculation formula. For example, the weight of the weighted average is set to 0.3, and the weight of the weighted maximum value is set to 0.7.

[0124] Finally, based on the dynamically adjusted weights, the weighted average and the weighted maximum are weighted and calculated to generate the final backtracking score.

[0125] By introducing a time decay coefficient through the above technical solution, this embodiment ensures that recent transactions play a dominant role in risk assessment, thereby reducing the interference of outdated information on judgment. Simultaneously, by combining the weighted average and weighted maximum values ​​and dynamically adjusting their weights based on the dispersion of the risk score, the backtesting score can reflect the overall risk level while effectively capturing potential extreme risks, thus improving the accuracy of fraud identification and providing a more reliable basis for transaction blocking decisions. This effectively reduces the false positive and false negative rates.

[0126] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0127] In one embodiment, a real-time fraud detection and blocking system for distributed data streams is provided. This system corresponds one-to-one with the real-time fraud detection and blocking method for distributed data streams described in the previous embodiment. The real-time fraud detection and blocking system for distributed data streams includes: The data distribution module is used to collect transaction data streams and distribute them to the corresponding processing channels after hashing and fragmenting the transaction data streams according to user identifiers. The interval calculation module is used to sort transaction records associated with the same user identifier in each processing channel by transaction timestamp within a preset time window, and to calculate the time interval between two adjacent transaction records in turn. The first scoring generation module is used to generate behavioral feature vectors based on time intervals and transaction records, and to generate fraud probability scores based on behavioral feature vectors by optimizing a decision tree classifier. The first instruction sending module is used to send a blocking instruction to the transaction execution node when the fraud probability score exceeds a preset score threshold, so that the transaction execution node freezes the pending transactions corresponding to the target user identifier according to the blocking instruction. The second rating generation module is used to retrieve historical transaction records of the target user identifier from the historical transaction database, extract related transaction records, and generate a retrospective rating based on the behavioral feature vector of the related transaction records by optimizing the decision tree classifier. The second instruction sending module is used to determine whether to maintain the blockade based on the fraud probability score and the backtracking score, and to send the corresponding control instructions to the transaction execution node according to the judgment result.

[0128] For specific limitations regarding a real-time fraud detection and blocking system for distributed data streams, please refer to the limitations of a real-time fraud detection and blocking method for distributed data streams described above, which will not be repeated here. Each module in the aforementioned real-time fraud detection and blocking system for distributed data streams can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the corresponding operations of each module.

[0129] The above description is merely an embodiment of this application and is not intended to limit the scope of protection of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A method for real-time identification and blocking of fraudulent behavior of distributed data streams, characterized in that, The method includes the following steps: Collect transaction data streams, and distribute the transaction data streams to the corresponding processing channels after hashing and fragmenting them according to user identifiers; Within a preset time window, transaction records associated with the same user ID in each processing channel are sorted by transaction timestamp, and the time interval between two adjacent transaction records is calculated sequentially. Behavioral feature vectors are generated based on time intervals and transaction records, and a fraud probability score is generated based on the behavioral feature vectors by optimizing a decision tree classifier. When the fraud probability score exceeds the preset score threshold, a blocking instruction is sent to the transaction execution node, causing the transaction execution node to freeze the pending transactions corresponding to the target user identifier according to the blocking instruction; Retrieve historical transaction records of the target user from the historical transaction database, extract related transaction records, and generate a backtracking score based on the behavioral feature vector of the related transaction records by optimizing the decision tree classifier; The system determines whether to maintain the blockade based on the fraud probability score and the backtracking score, and sends the corresponding control command to the transaction execution node according to the judgment result.

2. The method of claim 1, wherein, The steps of collecting transaction data streams and distributing them to corresponding processing channels after hashing and fragmenting the transaction data streams according to user identifiers specifically include: A hash ring is constructed based on the consistent hashing algorithm, and the node identifiers of each processing channel are mapped to the hash ring. The hash value is calculated for the user identifier associated with each transaction record in the transaction data stream. Before distributing transaction records, check if there is a corresponding processing channel mapping relationship for the user identifier in the mapping table. If it exists, the transaction record is directly distributed to the processing channel recorded in the mapping table. If it does not exist, the nearest node is searched clockwise on the hash ring based on the hash value, and the transaction record is distributed to the processing channel corresponding to the nearest node. The current load index of each processing channel is collected in real time. When the current load index of the target processing channel exceeds the preset load threshold, a backup processing channel whose load index does not exceed the load threshold is searched along the hash ring clockwise. The transaction records are rerouted to the backup processing channel, and the mapping relationship between the backup processing channel and the corresponding user identifier is recorded in the mapping table.

3. The method of claim 1, wherein, The step of generating behavioral feature vectors based on time intervals and transaction records, and generating fraud probability scores based on these behavioral feature vectors using an optimized decision tree classifier, specifically includes: Within a preset time window, extract the time interval characteristics and transaction record characteristics of transaction records associated with the same user identifier in each processing channel; Generate behavioral feature vectors based on the extracted time interval features and transaction record features; The behavioral feature vector is input into a pre-optimized decision tree classifier, which performs splitting and judgment sequentially from the root node until the leaf node is reached, and the category label corresponding to the leaf node is obtained. An initial fraud probability score is generated based on the fraud probability value corresponding to the leaf node, and the consistency between the initial fraud probability score and the classification result indicated by the category label is judged. When the consistency judgment passes, the initial fraud probability score is used as the fraud probability score. When the consistency judgment fails, a confidence penalty coefficient is applied to the fraud probability score to obtain the fraud probability score.

4. The method for real-time identification and blocking of fraudulent behavior in distributed data streams according to claim 3, characterized in that, Before the step of inputting the behavioral feature vector into a pre-optimized decision tree classifier, performing splitting judgments sequentially from the root node until reaching the leaf node, and obtaining the category label corresponding to the leaf node, the following specific steps are included: Obtain historical training samples, extract the values ​​of each feature dimension from the historical training samples, and calculate the feature importance weight of each feature dimension. Feature dimensions are selected based on their importance weights, and feature dimensions with importance weights higher than a preset weight threshold are retained to obtain an optimized feature subset. The optimized decision tree classifier is obtained by training the basic decision tree classifier based on the optimized feature subset.

5. The distributed real-time fraud identification and blocking method for data streams according to claim 3, characterized in that, The step of inputting the behavioral feature vector into a pre-optimized decision tree classifier, performing splitting judgments sequentially from the root node until reaching the leaf node, and obtaining the category label corresponding to the leaf node, specifically includes: (a) Start with the root node of the optimized decision tree classifier; (b) Extract the preset splitting feature dimensions and corresponding splitting thresholds of the current node; (c) Extract the feature values ​​corresponding to the split feature dimensions from the behavior feature vector, and determine whether the extracted feature values ​​are greater than the split threshold; (d) If the eigenvalue is greater than the splitting threshold, continue splitting along the right child of the current node; if the eigenvalue is less than or equal to the splitting threshold, continue splitting along the left child of the current node. (e) Determine if the current node is a leaf node. If not, repeat steps (b), (c), and (d) until a leaf node is reached. If it is, execute step (f). (f) Obtain the pre-stored category label from the leaf node, wherein the category label is the sample category with the highest number of samples in the historical training samples corresponding to the leaf node during the training phase.

6. The distributed real-time fraud identification and blocking method for data streams according to claim 3, characterized in that, The step of generating an initial fraud probability score based on the fraud probability value corresponding to the leaf node, and performing a consistency judgment between the initial fraud probability score and the classification result indicated by the category label, specifically includes: Retrieve the pre-stored fraud probability value from the leaf node and use the fraud probability value as the initial fraud probability score; The classification result corresponding to the initial fraud probability score is determined based on the preset classification threshold. When the initial fraud probability score is higher than the classification threshold, it corresponds to the fraud category. When the initial fraud probability score is lower than or equal to the classification threshold, it corresponds to the non-fraud category. Determine whether the classification result corresponding to the initial fraud probability score is consistent with the category label. If they are consistent, the consistency judgment passes; otherwise, the consistency judgment fails.

7. The distributed real-time fraud detection and prevention method for data streams according to claim 1, characterized in that, The step of sending a blocking instruction to the transaction execution node when the fraud probability score exceeds a preset scoring threshold, causing the transaction execution node to freeze the pending transactions corresponding to the target user identifier according to the blocking instruction, specifically includes: When the fraud probability score exceeds the preset score threshold, a blocking instruction is generated that includes the target user identifier, the fraud probability score, and the blocking timestamp. The blocking priority is determined based on the fraud probability score, and the node address of the transaction execution node is queried based on the target user identifier. The blocking instruction is then inserted into the priority blocking queue of the corresponding transaction execution node. The transaction execution node processes the blocking instructions in the priority blocking queue in descending order of blocking priority, and retrieves all pending transactions associated with the target user identifier from the pending transaction queue; The retrieved pending transactions are marked as frozen, and the blocking timestamp and fraud probability score are recorded in the transaction status table. Return a blocking confirmation message to the processing channel that sent the blocking command to notify that the blocking operation has been completed.

8. The distributed real-time fraud detection and prevention method for data streams according to claim 1, characterized in that, The steps of retrieving historical transaction records of the target user identifier from the historical transaction database, extracting related transaction records, and generating a retrospective score based on the behavioral feature vectors of the related transaction records using an optimized decision tree classifier specifically include: Retrieve historical transaction records from the historical transaction database within a preset time range based on the target user identifier; Extract related transaction records from historical transaction records that have a preset association with the currently frozen pending transactions; Calculate the time interval characteristics between adjacent related transaction records based on the transaction timestamps of related transaction records, and extract the transaction record characteristics of related transaction records; Based on the time interval characteristics and the transaction record characteristics of related transaction records, a behavioral feature vector of related transaction records is generated; The behavioral feature vectors of related transaction records are input into an optimized decision tree classifier to obtain the fraud probability score corresponding to the related transaction records, and a backtracking score is generated based on the statistical features of the fraud probability score.

9. The distributed real-time fraud identification and blocking method of data streams according to claim 8, characterized in that, The step of inputting the behavioral feature vector of related transaction records into an optimized decision tree classifier to obtain the fraud probability score corresponding to the related transaction records, and generating a backtracking score based on the statistical features of the fraud probability score, specifically includes: The behavioral feature vectors of each related transaction record are sequentially input into the optimized decision tree classifier to obtain the fraud probability score corresponding to each related transaction record. Calculate the time decay coefficient of each related transaction record based on the time distance between the transaction timestamp of each related transaction record and the timestamp of the currently frozen pending transaction; The fraud probability scores of each related transaction record are weighted based on the time decay coefficient, and the weighted average and weighted maximum values ​​of the weighted fraud probability scores are calculated. Calculate the standard deviation of the weighted fraud probability score. When the standard deviation is lower than the preset discrete threshold, increase the weight of the weighted average in the retrospective score calculation formula. When the standard deviation is higher than or equal to the preset discrete threshold, increase the weight of the weighted maximum in the retrospective score calculation formula. The weighted average and weighted maximum values ​​are weighted according to the dynamically adjusted weights to generate a retrospective score.

10. A system for real-time identification and blocking of fraudulent activities of distributed data streams, characterized in that, include: The data distribution module is used to collect transaction data streams and distribute them to the corresponding processing channels after hashing and fragmenting the transaction data streams according to user identifiers. The interval calculation module is used to sort transaction records associated with the same user identifier in each processing channel by transaction timestamp within a preset time window, and to calculate the time interval between two adjacent transaction records in turn. The first scoring generation module is used to generate behavioral feature vectors based on time intervals and transaction records, and to generate fraud probability scores based on behavioral feature vectors by optimizing a decision tree classifier. The first instruction sending module is used to send a blocking instruction to the transaction execution node when the fraud probability score exceeds a preset score threshold, so that the transaction execution node freezes the pending transactions corresponding to the target user identifier according to the blocking instruction. The second rating generation module is used to retrieve historical transaction records of the target user identifier from the historical transaction database, extract related transaction records, and generate a retrospective rating based on the behavioral feature vector of the related transaction records by optimizing the decision tree classifier. The second instruction sending module is used to determine whether to maintain the blockade based on the fraud probability score and the backtracking score, and to send the corresponding control instructions to the transaction execution node according to the judgment result.

Images