E-commerce risk control rule configuration method and device, equipment and medium

Abstract

This application relates to a method, apparatus, and medium for configuring e-commerce risk control rules. The method includes: using a risk control scoring model to infer from sample data containing activity features to obtain a causal dataset containing the activity features and their inference results; extracting model analysis data from the causal dataset; training a rule mining model using the causal dataset and performing rule mining to generate risk control rules containing activity features and their evaluation indicators, forming a candidate rule set; inputting the model analysis data and the candidate rule set into a large language model, which generates configuration suggestions containing recommended risk control rules based on a preset inference prompt template; and responding to a rule configuration command to deploy the specified risk control rules to the risk control strategy engine of the e-commerce platform for risk identification of e-commerce access data containing activity features. This application can reduce the reliance on algorithm engineers for risk control strategy iteration and improve the quality and effectiveness of risk control rule configuration.

Description

Technical Field

[0001] This application relates to the field of e-commerce risk control technology, and in particular to an e-commerce risk control rule configuration method and its apparatus, equipment, and medium. Background Technology

[0002] E-commerce platforms face numerous transaction risks in their daily operations, including account theft, payment fraud, malicious order placement, and fraudulent transactions. To address these risks, e-commerce platforms typically deploy risk control systems to monitor transaction behavior and identify risks in real time. The basic operating model of traditional e-commerce risk control systems is as follows: algorithm engineers train a risk control model based on historical transaction data, use this model to score the risk of transaction behavior, and then, based on the importance of the features output by the model and business experience, manually compile and configure a series of risk control rules into the risk control strategy engine. This engine then uses these rules to identify and handle risks in real-time transactions.

[0003] However, this traditional model has significant limitations. The training of risk control models and the manual refinement of rules heavily rely on the personal experience and expertise of algorithm engineers. While risk control operations personnel possess extensive business knowledge and keen insight into risk scenarios, they lack the technical ability to directly understand and analyze model outputs. When risk control operations personnel need to adjust risk control strategies to address new risk scenarios or evolving fraudulent methods, they often cannot do so independently and must rely on the intervention of algorithm engineers. This results in long iteration cycles for risk control strategies, making it difficult to respond promptly to rapidly evolving risk situations.

[0004] Furthermore, the data analyzed by risk control models is typically presented in technical numerical form, lacking intuitive business semantic interpretation. Faced with this data, risk control operations personnel struggle to quickly understand which features are key drivers of high risk, how changes in feature values ​​affect risk levels, and whether the current feature distribution indicates new risk trends. Similarly, the business rules derived from the models lack mechanisms to explain the causes of risk from a business perspective. Operations personnel find it difficult to judge the effectiveness and applicable scenarios of the rules, let alone make targeted strategy adjustment decisions based on them.

[0005] Therefore, how to enable risk control operations personnel without an algorithm engineering background to understand the output of risk control models and the business meaning of the extracted business rules, and to independently complete the selection and configuration of risk control strategies based on this, is a technical problem that urgently needs to be solved in the current e-commerce risk control field. Summary of the Invention

[0006] The purpose of this application is to solve at least one of the above-mentioned problems by providing an e-commerce risk control rule configuration method and its corresponding apparatus, equipment, non-volatile readable storage medium, and computer program product.

[0007] According to one aspect of this application, a method for configuring e-commerce risk control rules is provided, including: A pre-trained risk control scoring model is used to infer from sample data containing activity features to obtain a causal dataset containing the activity features and their inference results. Model analysis data is then extracted from the causal dataset using the activity features as the dimension. The rule mining model is trained using the causal dataset and rule mining is performed to generate risk control rules and their evaluation indicators that contain the activity features, thus forming a candidate rule set. The model analysis data and the candidate rule set are input into the large language model, which performs business semantic level reasoning analysis based on the preset reasoning prompt template to generate configuration suggestion information containing recommended risk control rules. In response to a rule configuration instruction triggered by the configuration suggestion information, the risk control rule specified by the instruction is deployed to the risk control strategy engine of the e-commerce platform for risk identification of e-commerce access data containing the activity characteristics.

[0008] According to another aspect of this application, an e-commerce risk control rule configuration device is provided, comprising: The scoring inference module is configured to use a pre-trained risk control scoring model to infer from sample data containing activity features, obtain a causal dataset containing the activity features and their inference results, and extract model analysis data from the causal dataset with the activity features as the dimension. The rule mining module is configured to train a rule mining model using the causal dataset and perform rule mining to generate risk control rules and their evaluation indicators that contain the activity features, thus forming a candidate rule set. The semantic reasoning module is configured to input the model analysis data and the candidate rule set into the large language model, and the large language model performs business semantic level reasoning analysis based on the preset reasoning prompt template to generate configuration suggestion information containing recommended risk control rules. The configuration execution module is configured to respond to rule configuration instructions triggered by the configuration suggestion information, and deploy the risk control rules specified by the instructions to the risk control strategy engine of the e-commerce platform for risk identification of e-commerce access data containing the activity characteristics.

[0009] According to another aspect of this application, an electronic device is provided, including a central processing unit and a memory, wherein the central processing unit is configured to invoke and run a computer program stored in the memory to perform the steps of the method described in this application.

[0010] According to another aspect of this application, a non-volatile readable storage medium is provided, which stores a computer program implemented according to the e-commerce risk control rule configuration method in the form of computer-readable instructions. When the computer program is invoked by a computer, it executes the steps included in the method.

[0011] According to another aspect of this application, a computer program product is provided, comprising a computer program / instructions that, when executed by a processor, implement the steps of the method.

[0012] Compared to traditional technologies, the technical solution provided in this application uses a risk control scoring model to infer causal datasets from sample data. A rule mining model automatically generates risk control rules and their evaluation indicators from these datasets, forming a candidate rule set. A large language model then performs business semantic-level reasoning analysis on the model analysis data and candidate rule set to generate configuration suggestions. Finally, in response to instructions triggered by these suggestions from operations personnel, the specified rules are deployed to the risk control strategy engine. This significantly reduces the reliance on algorithm engineers for risk control strategy iteration, enabling operations personnel to understand model outputs and rule meanings with the assistance of natural language suggestions and independently complete strategy selection and configuration, greatly shortening the iteration cycle. Simultaneously, the large language model interprets the direction and extent of the impact of activity characteristics on risk from a business perspective, analyzes the potential risk causes corresponding to risk control rules, and indicates subsequent focus areas for operations personnel, improving decision-making quality and strategy effectiveness. Furthermore, the entire process is automated within the risk control system, reducing manual intervention, maintaining consistency in data sources and processing logic, and improving the stability and reliability of the strategy. When faced with new risk scenarios, operators only need to provide new sample data to quickly generate risk control strategies that adapt to the new scenarios, which has good scalability and adaptability. Attached Figure Description

[0013] Figure 1 This is an exemplary network architecture for this application; Figure 2 A flowchart illustrating one embodiment of the e-commerce risk control rule configuration method of this application; Figure 3 A schematic diagram of the e-commerce risk control rule configuration device for this application; Figure 4 This is a schematic diagram of the structure of an electronic device used in this application. Detailed Implementation

[0014] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.

[0015] This application's embodiments can be applied to various e-commerce platform scenarios that employ risk control rules for real-time risk identification of user behavior. In these scenarios, e-commerce platforms need to process massive amounts of user access requests daily, including various operations such as login, browsing, order placement, and payment. Inevitably, these requests include risky behaviors such as account theft, payment fraud, malicious order placement, and fraudulent transactions. To effectively identify and intercept these risky behaviors, e-commerce platforms can use a risk control strategy engine based on pre-configured risk control rules to judge and handle e-commerce transaction data generated by user access. With the continuous evolution of fraud methods and the ongoing expansion of business scenarios, risk control rules need frequent updates and iterations. Traditional methods relying on algorithm engineers to manually model and configure rules are inefficient and cannot meet the demands for rapid response. This application's embodiments provide a solution capable of automatically completing risk control rule mining, intelligent analysis, and automated configuration in such application scenarios.

[0016] Please see Figure 1 , Figure 1 This is a schematic diagram of the architecture of an e-commerce risk control rule configuration system provided in this application embodiment. The system may include a terminal device 80, a security server 81, and a business server 82. The terminal device 80 can be a computer device used by risk control operators to view configuration suggestion information and trigger rule configuration commands. The security server 81 can serve as the main execution entity of the e-commerce risk control rule configuration system of this application, used to perform steps such as inference of the risk control scoring model, training of the rule mining model, invocation of the large language model, and deployment of risk control rules. The business server 82 is used to deploy one or more online stores or services of the e-commerce platform, bear various user access requests, and generate corresponding activity feature data. The terminal device 80, the security server 81, and the business server 82 communicate through a network, which can be a wired network or a wireless network, such as a local area network, a wide area network, or the Internet.

[0017] In this embodiment, a preliminary risk control scoring model is used to perform inference on sample data containing activity features, outputting the inference result for each sample. This inference result reflects the probability or score of the sample belonging to a risky behavior. The risk control scoring model can be a gradient boosting tree model, a random forest model, or a neural network model, etc., and this application does not limit it. The inference result of the risk control scoring model and the input activity features together constitute a causal dataset. This causal dataset can be used to extract model analysis data and to train a rule mining model. The model analysis data can include at least one of the following multi-dimensional information: the ranking of the contribution of each activity feature to the inference result, the correlation direction and value distribution between each activity feature and the inference result, and the distribution statistics of each activity feature in the sample space, so as to provide basic data for subsequent business semantic inference of the large language model.

[0018] This application also trains a rule mining model based on a decision tree to extract interpretable IF-THEN risk control rules and their evaluation metrics from causal datasets. The rule mining model is trained using activity features from the causal dataset as input features and inference results as supervision signals, generating a defined decision tree with multiple leaf nodes. Each leaf node corresponds to a partitioning path, which constitutes a risk control rule. The rule mining model can also employ a Boolean mask recursive propagation mechanism to perform precise sample statistics for each leaf node and execute a total sample coverage assertion check to ensure the accuracy and completeness of rule extraction.

[0019] The large language model used in this application is a natural language processing model pre-trained on a large-scale text corpus, capable of understanding and generating input text. In this application, the large language model receives model analysis data and a candidate rule set as input, performs business semantic-level reasoning analysis based on a preset reasoning prompt template, and generates configuration suggestion information containing recommended risk control rules. For example, the preset reasoning prompt template may include a description of the risk control business context, a structured input format definition, causal reasoning instructions, and output format constraints, used to guide the large language model to generate analysis results according to the expected logic and style. The configuration suggestion information is presented in natural language, including recommended risk control rules and their reasons for recommendation. For example, the reasons for recommendation may include a description of the risk scenario targeted by the recommended risk control rule, an explanation of its advantages compared to other rules, and the activity characteristics that need to be monitored after applying the rule.

[0020] The risk control strategy engine in this application is a core component responsible for real-time risk identification in the e-commerce platform. Internally, it maintains a rule base that stores multiple executable risk control rules. When the risk control strategy engine receives e-commerce access data forwarded by the business server 82, it performs risk identification on the access data based on the risk control rules deployed in the rule base, and executes corresponding risk handling actions according to the matching results, such as allowing access, requiring additional verification, or rejecting the transaction.

[0021] The e-commerce risk control rule configuration method of this application can be implemented as a computer program. This computer program is installed and runs on an electronic device such as a security server 81, and is executed by the server's processor to implement the various steps in the method. During operation, the security server 81 needs to interact with the business server 82 to obtain sample data and activity characteristics, communicate with the large language model service to obtain configuration suggestion information, and interact with the risk control strategy engine to complete the deployment of risk control rules.

[0022] Taking the risk control operation scenario of an e-commerce platform as an example, risk control operators discover a new fraud pattern emerging on the platform recently, requiring a rapid adjustment of risk control strategies to address this change. Risk control operators submit sample data containing historical risk samples and normal samples to security server 81 via terminal device 80. The e-commerce risk control rule configuration system on security server 81 automatically executes the method described in this application, starting with reasoning from the risk control scoring model, through rule mining and large language model analysis, ultimately generating configuration suggestions containing recommended risk control rules and displaying them on terminal device 80. After reviewing the configuration suggestions, risk control operators select to trust and apply one or more recommended risk control rules, triggering a rule configuration command. Security server 81 responds to this command by deploying the specified risk control rules to the risk control strategy engine. The risk control strategy engine then uses the new risk control rules to perform risk identification on subsequent e-commerce access data, thereby quickly and effectively responding to the new fraud pattern.

[0023] It should be noted that the above-mentioned e-commerce platform risk control operation scenarios are merely illustrative examples. In actual applications, different platforms can flexibly deploy the technical solutions of this application according to their own business characteristics and system architecture, and this application does not impose any restrictions on this. As long as there is a need for automatic mining, intelligent analysis, and automated configuration of risk control rules, the technical solutions of this application are applicable.

[0024] The technical solution of this application will be further described in detail below with reference to specific embodiments.

[0025] Please see Figure 2 According to the e-commerce risk control rule configuration method provided in this application, it can be implemented as a computer program product and run on electronic devices such as servers, including the following steps: Step S5100: Use a pre-trained risk control scoring model to perform inference on sample data containing activity features, obtain a causal dataset containing the activity features and their inference results, and extract model analysis data from the causal dataset with the activity features as the dimension. The risk control scoring model can be a pre-trained machine learning model, the training process of which will be described separately in subsequent embodiments and will not be elaborated here. The risk control scoring model can be a gradient boosting tree model, a random forest model, or a neural network model, etc., and this application does not limit it. After being pre-trained, the risk control scoring model has the ability to score the risk of input samples and can calculate the probability or score of the sample belonging to risky behavior based on the various activity features contained in the sample.

[0026] The sample data is a pre-prepared dataset, where each sample contains multiple activity features and corresponding risk labels. Activity features refer to various quantifiable attributes related to user behavior on e-commerce platforms, including but not limited to user login behavior features, browsing behavior features, order placement behavior features, payment behavior features, device fingerprint features, and network environment features. Risk labels are used to identify whether the sample constitutes a risky behavior, such as account theft, payment fraud, malicious order placement, or fraudulent transactions. In one embodiment, a sample dataset can be prepared and divided into a training set and a validation set. The risk control scoring model is trained using sample data from the training set during the training phase, while in this step, inference is performed using sample data from the validation set. The sample data in the validation set is not used during the training phase, thus allowing for a more objective evaluation of the risk control scoring model's inference performance.

[0027] During inference, samples can be input into the risk control scoring model. The model receives activity features from the sample data as input, performs internal calculations, and outputs the inference result for each sample. The inference result can reflect the probability or score of the sample belonging to a risky behavior, such as a probability value ranging from zero to one; a higher value indicates a greater likelihood that the sample is judged as a risky behavior. After the risk control scoring model performs inference on all samples in the validation set, the activity features of each sample and its corresponding inference result together constitute a dataset, called the causal dataset. Each row in the causal dataset corresponds to a sample, containing the values ​​of each activity feature of that sample and the inference result output by the risk control scoring model for that sample, forming a mapping relationship between activity features and inference results.

[0028] When extracting model analysis data from causal datasets, the extraction can be performed using activity features as a dimension. Model analysis data, as multi-dimensional quantitative information describing the relationship between various activity features and inference results, aims to provide foundational data support for subsequent business semantic reasoning in large language models. Specifically, the contribution ranking of each activity feature to the inference results can be extracted from the causal dataset as feature importance data, reflecting which activity features have the greatest impact on the judgment results of the risk control scoring model. The correlation direction and value distribution between each activity feature and the inference results can be extracted from the causal dataset as feature influence trend data, reflecting the correlation between changes in activity feature values ​​and risk levels; for example, a larger value for a certain activity feature indicates higher or lower risk. The distribution statistics of each activity feature in the sample space can be extracted from the causal dataset as feature distribution data, reflecting the distribution differences of each activity feature between normal and risky samples. All three types of model analysis data can be extracted, or any one or more can be extracted as needed; this application does not impose any restrictions on this.

[0029] Step S5200: Train a rule mining model using the causal dataset and perform rule mining to generate risk control rules and their evaluation indicators that contain the activity features, thus forming a candidate rule set; Rule mining models can be machine learning models used to automatically extract interpretable IF-THEN rules from data. Rule mining models can be implemented using various algorithms, including but not limited to decision tree models, association rule mining models, and rule extraction models based on frequent pattern growth. Different algorithmic implementations of rule mining models have different characteristics. Decision tree models generate rules with a natural hierarchical structure and interpretability; association rule mining models can discover co-occurrence relationships between features; and frequent pattern growth models are highly efficient in processing high-dimensional sparse data. In practical applications, a suitable rule mining model can be flexibly selected based on the data scale and business needs; this application does not impose any restrictions in this regard.

[0030] In one embodiment, the rule mining model is implemented using a decision tree model. A decision tree model is a supervised learning model based on a tree structure that establishes prediction rules by recursively partitioning the input feature space. During training, activity features from the causal dataset are used as input features, and the inference results are used as supervision signals. Using the inference results as supervision signals means that the inference results output by the risk control scoring model, such as predicted probabilities, are used as the learning target of the decision tree model. The decision tree model grows a complete decision tree by learning the mapping relationship between activity features and predicted probabilities. After training, the decision tree model forms a fixed decision tree containing multiple leaf nodes. Each leaf node corresponds to a partitioning path from the root node to that leaf node, and all splitting conditions on this path constitute an IF-THEN form risk control rule.

[0031] In one embodiment, to ensure the accuracy and completeness of rule extraction, a Boolean mask recursive propagation mechanism can be used to perform precise sample statistics on each leaf node of the decision tree. Specifically, an initial Boolean mask is constructed for each sample in the causal dataset, consisting of activity features and their inference results. Initially, all sample masks are true values. The Boolean mask is propagated layer by layer down along each split node of the decision tree. At each split node, the value at the corresponding position in the mask is updated to true or false based on whether the sample satisfies the splitting condition of that node, until the mask propagates to the leaf node. At each leaf node, based on the subset of samples identified by the Boolean mask that has reached that leaf node, the sample size and the number of positive samples corresponding to that leaf node are counted. Samples whose inference results reach a preset threshold are determined to be positive samples. The preset threshold can be flexibly set according to business needs and risk tolerance. For example, it can be set to 0.8, meaning that samples with a prediction probability greater than 0.8 are considered positive samples, or it can be set to 0.9 or other values. This application does not limit this. Precision is determined by the ratio of the number of positive samples to the total sample size. The precision formula is: precision equals the number of positive samples divided by the total sample size. A total sample coverage assertion is performed on all leaf nodes to ensure that the sum of the sample sizes of all leaf nodes equals the total sample size of the causal dataset. When the verification passes, the partition path corresponding to each leaf node is used as the risk control rule, and precision is used as the evaluation metric.

[0032] In another embodiment, a conventional decision tree rule extraction method can be used, which directly relies on the statistical information recorded in the internal nodes of the decision tree for rule extraction, without employing a Boolean mask recursive propagation mechanism. In this method, after the decision tree is trained, each leaf node is traversed, and statistical information such as the number of samples and positive samples for that leaf node is directly obtained from the internal nodes of the decision tree. The partitioning path corresponding to the leaf node is used as the risk control rule, and accuracy is used as the evaluation metric. This method is relatively simple to implement, but statistical bias may exist in extreme cases where floating-point precision is sensitive.

[0033] Risk control rules are represented as IF-THEN conditional statements, where the IF part contains conditional expressions for one or more activity characteristics, and the THEN part indicates the risk category determined by the rule. For example, a risk control rule can be represented as: IF transaction_amount > 5000 and register_days < 7 THEN high_risk Among them, transaction_amount and register_days are activity characteristics, and high_risk is the risk category determined by this rule.

[0034] Evaluation metrics are used to measure the quality of risk control rules, including but not limited to precision, recall, coverage, and F1 score. Precision represents the proportion of samples deemed risky by the rule that are actually risky; recall represents the proportion of all truly risky samples correctly identified by the rule; coverage represents the proportion of samples covered by the rule out of the total number of samples; and the F1 score is the harmonic mean of precision and recall. In practical applications, one or more of these metrics can be selected as evaluation metrics based on business needs. For example, in scenarios where the primary goal is to intercept high-risk transactions, precision can be prioritized; in scenarios where the goal is to expand risk coverage, recall can be prioritized.

[0035] For example, in a specific e-commerce risk control application scenario, multiple risk control rules and their evaluation metrics can be obtained after rule mining. Below are some example risk control rules and their evaluation metrics: Rule 1 has the following rule path: transaction_amount >= 9800 and register_days <= 1 and payment_method = credit_card. Its precision rate is 93.75%, and it covers 16 samples. Rule 2 has the following rule path: login_ip_country not in China and order_total > 3500. It has a precision rate of 90.00% and covers 10 samples. Rule 3 has the following rule path: device_fingerprint_score <= 0.3 and 0 < login_hour < 5. The precision rate is 85.71%, and the number of samples covered is 14.

[0036] These risk control rules and their evaluation metrics can be directly combined to construct a candidate rule set for use in subsequent steps. In one embodiment, the risk control rules in the candidate rule set can also be stratified by risk. Based on the accuracy of each risk control rule, the rules can be divided into three levels: high-risk rules, medium-risk rules, and low-risk rules. For example, rules with an accuracy of 90% or higher can be classified as high-risk rules, rules with an accuracy between 70% and 90% as medium-risk rules, and rules with an accuracy below 70% as low-risk rules. Risk stratification helps risk control operations personnel to more quickly identify and select risk control rules suitable for the current risk scenario in subsequent steps.

[0037] Step S5300: Input the model analysis data and the candidate rule set into the large language model. The large language model performs business semantic level reasoning analysis based on the preset reasoning prompt template to generate configuration suggestion information containing recommended risk control rules. Before being input into the large language model, the model analysis data and candidate rule set need to be structurally assembled to conform to the input format defined by the preset inference prompt template. The preset inference prompt template is a pre-designed structured text template used to guide the large language model to perform inference analysis according to the expected logic and style. The preset inference prompt template can contain multiple components; in one embodiment, it may include a risk control business context description, a structured input format definition, causal inference instructions, and output format constraints. The risk control business context description explains the current e-commerce risk control scenario background to the large language model, including information such as platform type, risk type, and business objectives. The structured input format definition specifies the organization of the model analysis data and candidate rule set during input, such as presenting feature importance data in tabular form, feature influence trend data in key-value pair form, and the conditional expressions and evaluation indicators of each risk control rule in list form. The causal inference instructions instruct the large language model to interpret the activity features and risk control rules according to causal relationships, rather than simply listing data or statistical descriptions. Output format constraints are used to limit the style and content structure of the configuration recommendation information output by the large language model. For example, they require the reasons for the recommendation to be presented in the form of natural language paragraphs and the content to be organized in a specified order.

[0038] In one embodiment, model analysis data and candidate rule sets are assembled into structured input data conforming to a preset inference prompt template. The structured input data includes a risk control business context description, numerical representations of the model analysis data, and conditional expressions and evaluation metrics for each risk control rule in the candidate rule set. The risk control business context description can be automatically generated by the system based on the source and business scenario of the currently processed sample data. For example, it can be described as the currently processed sample data originating from a payment transaction scenario on an e-commerce platform, with the main fraud types of concern including account theft and payment fraud. The numerical representation of the model analysis data involves organizing feature importance data, feature influence trend data, and feature distribution data into structured data blocks in numerical form. For example, feature importance data can be organized as a list of key-value pairs of activity feature names and contribution values; feature influence trend data can be organized as descriptive text of activity feature names, correlation directions, and value distributions; and feature distribution data can be organized as a numerical table of activity feature names and distribution statistics. The conditional expressions and evaluation metrics for each risk control rule in the candidate rule set can be organized into a rule list, with each rule including evaluation metrics such as rule path, precision, recall, and coverage.

[0039] After structured input data is fed into the big data model, the model interprets the business semantics of each activity feature in the data according to the causal reasoning instructions set in the preset reasoning prompt template, and performs risk causal analysis on each risk control rule in the candidate rule set. Business semantic interpretation means that the big data model explains the causal relationship between each activity feature and risk from a business perspective, rather than simply repeating numerical statistical results. For example, for activity features ranking high in feature importance data, the big data model can interpret that transaction amount is the most critical feature affecting risk judgment; the higher the transaction amount, the greater the risk, possibly because large transactions are more likely to become targets of fraud. Similarly, for activity features showing a positive correlation in feature influence trend data, the big data model can interpret that the shorter the number of days since registration, the higher the risk, because fraudsters often use newly registered accounts to commit crimes. Risk causal analysis refers to the big data model analyzing the potential risk causes corresponding to each risk control rule from a business perspective. For example, for a risk control rule with the conditions transaction_amount > 9800 and register_days <= 1 and payment_method = credit_card, the large language model can analyze that the possible risk cause of this rule is that a newly registered account uses a credit card to make a large payment, which is consistent with the typical characteristics of card theft payment.

[0040] After completing inference analysis, the large language model can output configuration suggestions containing recommended risk control rules and their reasons. Recommended risk control rules are one or more risk control rules selected by the large language model from the candidate rule set, most suitable for deployment in the current risk control scenario. The reasons for recommendation are business semantic explanations generated by the large language model for each recommended risk control rule, used to help risk control operations personnel understand why the rule is recommended and what precautions need to be taken after applying it. The reasons for recommendation can include at least one of the following: a description of the risk scenario targeted by the recommended risk control rule; an explanation of the advantages of the recommended risk control rule compared to other risk control rules in the candidate rule set; and activity characteristics to be monitored after applying the recommended risk control rule. The risk scenario description explains what type of risky behavior the recommended risk control rule is suitable for identifying, such as identifying large-scale fraudulent transactions by newly registered accounts. The advantages explanation explains the advantages of the recommended risk control rule compared to other rules in terms of precision, recall, or coverage, such as having the highest precision and minimizing false positives for legitimate users. The activity features to be monitored are used to indicate which activity features should be closely monitored after applying the rule, so as to detect signs of rule degradation in a timely manner. For example, after applying the rule, the distribution changes of the register_days feature should be closely monitored. If the distribution of the number of registration days of normal users decreases as a whole, it may lead to an increase in the false positive rate of the rule.

[0041] In one embodiment, the configuration recommendations output by the large language model can be presented in the form of natural language paragraphs. For example, the configuration recommendations could be expressed as: Based on the analysis of the current sample data, it is recommended to prioritize the deployment of the rules `transaction_amount > 9800` and `register_days <= 1` and `payment_method = credit_card`. This rule targets the risk scenario of newly registered accounts making large payments using credit cards, achieving an accuracy of 93.75%, the best performance among all candidate rules. After applying this rule, it is recommended to pay close attention to the distribution changes of the `register_days` feature. If the distribution of registration days for normal users shows an overall downward trend, it is necessary to consider appropriately adjusting the threshold for registration days to avoid false positives.

[0042] In another embodiment, the configuration suggestion information output by the large language model can also be presented in the form of structured data, such as organizing the recommendation rules and their reasons in JSON format, which facilitates automatic system parsing and subsequent processing. The specific presentation format of the configuration suggestion information can be flexibly selected according to the actual application scenario, and this application does not impose any restrictions on it.

[0043] In some embodiments, the preset inference prompt template can also include extended analysis instructions. These instructions instruct the large language model, after completing the basic risk control rule recommendation, to conduct a deeper comprehensive analysis of the model analysis data and candidate rule sets, generating additional analysis information to assist risk control operations personnel in decision optimization. This additional analysis information may include, but is not limited to, interpretation of feature importance rankings, rule combination optimization suggestions, risk trend predictions, and resource allocation suggestions.

[0044] Specifically, feature importance ranking interpretation refers to the large language model performing business semantic attribution analysis on the top-ranked activity features based on feature importance data. This explains why these features are key drivers of risk assessment and indicates their specific performance in the current sample data. For example, the large language model can analyze and point out that transaction amount is the primary feature affecting risk assessment, contributing far more than other features. Furthermore, transaction amounts are generally higher in high-risk samples than in normal samples, indicating that large transactions are the main targets of fraud in the current risk scenario. Rule combination optimization suggestions refer to the large language model recommending the combination of multiple rules to achieve better risk identification results based on the evaluation indicators and rule path overlap of various risk control rules in the candidate rule set. Alternatively, it can suggest adjusting the thresholds of certain rules to balance precision and recall. For example, the large language model can suggest combining the rule with the highest precision with the rule with the highest coverage to expand risk coverage while ensuring interception accuracy. Risk trend prediction refers to the large language model predicting the possible direction of risk evolution in the future based on the changing trends of feature distribution data, helping risk control operations personnel prepare strategies in advance. For example, a large language model might indicate an upward trend in the proportion of transactions from newly registered accounts, suggesting that the risk of fraud involving new accounts will continue to rise in the near future. It would then recommend preparing risk control rules for new accounts in advance. Resource allocation suggestions refer to the large language model's optimization recommendations for the allocation of computational resources to the risk control strategy engine based on the computational complexity and expected call frequency of each risk control rule, thereby reducing overall operating costs. For instance, the large language model might suggest deploying rules with lower computational complexity at the traffic entry layer for pre-filtering, while reserving rules with higher computational complexity at the post-deep detection layer, thus reducing system load without affecting recognition performance.

[0045] In one embodiment, a cost-benefit analysis instruction can be set in the preset inference prompt template to instruct the large language model to quantitatively evaluate the deployment cost and expected benefits of each recommended risk control rule, generating a cost-benefit analysis report. The cost-benefit analysis report may include information such as the expected daily number of calls for each recommended risk control rule, the computational resource consumption per call, the expected number of risky transactions intercepted, and the estimated loss of normal transactions due to false positives. Based on this information, the large language model can calculate the return on investment for each recommended risk control rule and rank the recommended rules in descending order of benefit, helping risk control operators make optimal rule deployment decisions under limited budget and computational resource conditions. For example, the large language model may analyze and indicate that although rule A has a slightly lower accuracy than rule B, its computational complexity is only one-tenth that of rule B and its coverage is five times that of rule B. Considering all factors, rule A has a higher cost-effectiveness and it is recommended to prioritize the deployment of rule A.

[0046] In one embodiment, the preset inference prompt template can also include monitoring and early warning suggestion instructions. These instructions are used to direct the large language model to generate personalized monitoring and early warning suggestions for each deployed or pending risk control rule based on feature distribution data and rule evaluation metrics. The monitoring and early warning suggestions may include key monitoring metrics for the rule, early warning threshold setting suggestions, and contingency plans for triggering an early warning. For example, for a risk control rule that relies on the `register_days` feature, the large language model may suggest using the distribution shift of the `register_days` feature as a key monitoring metric. When the distribution shift of this feature exceeds 20%, an early warning may be triggered, and it may be suggested that sample data be re-collected and a new round of model training and rule mining should be initiated.

[0047] In one embodiment, the preset inference prompt template can also include a resource consumption statistics instruction, which instructs the large language model to return resource consumption data for this call after completing the inference analysis task. Resource consumption data includes, but is not limited to, the number of input tokens, the number of output tokens, and the total number of tokens. The number of input tokens refers to the number of tokens used by the input data after assembling the model analysis data and candidate rule sets into structured input data. The number of output tokens refers to the number of tokens used by the configuration suggestion information generated by the large language model. The total number of tokens is the sum of the number of input tokens and the number of output tokens, used to measure the overall resource consumption level of this large language model call. Large language model service providers typically charge based on the number of tokens; therefore, token statistics can be directly used to calculate the call cost for each rule configuration suggestion generation.

[0048] In one embodiment, the token statistics for this call can be received and recorded simultaneously with the configuration suggestion information returned by the large language model. The token statistics are then associated with parameters such as the sample data size processed, the size of the candidate rule set, and the length of the generated configuration suggestion information, forming a historical call cost database. As the number of calls accumulates, the resource consumption of the large language model calls can be statistically analyzed based on the historical call cost database, calculating cost indicators such as the average token consumption per call and the token consumption per unit of sample data. These cost indicators can provide a quantitative basis for risk control operations personnel to assess the operating costs of the technical solution in this application, and can also be used for cost comparison and selection decisions among different large language model service providers.

[0049] In one embodiment, the preset inference prompt template can also include cost control instructions to instruct the large language model to control token consumption by optimizing the length and structure of the output content while ensuring the quality of inference analysis. For example, it can require a more concise expression when outputting configuration suggestions, omitting redundant descriptive language, or replacing some natural language descriptions with structured key-value pair formats. Furthermore, the amount of data input into the model analysis data and candidate rule set can be dynamically adjusted based on the cost budget limit preset by risk control operations personnel. For instance, with a limited budget, only the top ten activity features by feature importance and the top five risk control rules by accuracy can be input to reduce the number of input tokens, thereby obtaining key analysis results within a controllable cost range.

[0050] Step S5400: In response to the rule configuration instruction triggered by the configuration suggestion information, deploy the risk control rule specified by the instruction to the risk control strategy engine of the e-commerce platform for risk identification of e-commerce access data containing the activity characteristics.

[0051] After the configuration suggestions are generated, they need to be presented to risk control operations personnel through appropriate interactive methods, including but not limited to interface display, email notifications, system interface notifications, etc., to facilitate deployment decisions. After reviewing the configuration suggestions, risk control operations personnel can choose to enable one or more risk control rules based on their understanding of the business scenario and their level of trust in the large language model's recommendations. When a risk control operations personnel selects a target risk control rule, a rule configuration command is triggered. The rule configuration command can carry risk control rule identification information, which instructs the system to deploy the specified risk control rule to the risk control strategy engine.

[0052] In one embodiment, in response to a rule configuration instruction, the target risk control rule and its conditional expression specified by the instruction are extracted from the candidate rule set, for example, transaction_amount > 9800 and register_days <= 1 and payment_method = credit_card. When extracting the target risk control rule and its conditional expression, the rule identifier information carried in the rule configuration instruction can be used to search and match within the candidate rule set to locate the corresponding risk control rule and obtain its complete conditional expression and evaluation metrics.

[0053] After extracting the conditional expression of the target risk control rule, it can be converted into executable strategy code for the risk control strategy engine and written into the engine's rule base. The risk control strategy engine is a core component of an e-commerce platform responsible for real-time risk identification. Internally, it maintains a rule base storing multiple executable risk control rules. Different risk control strategy engines may support different rule syntax and formats, therefore, the conditional expression needs to be converted into strategy code compatible with the target risk control strategy engine. In one embodiment, the conditional expression of the target risk control rule is converted into executable strategy code for the risk control strategy engine. Strategy code is a rule description language that the risk control strategy engine can directly parse and execute. For example, it can be a structured rule description based on JSON format or a scripting language specific to the risk control strategy engine. The conversion process includes mapping the activity feature names in the conditional expression to the corresponding field names in the risk control strategy engine, converting comparison operators to operator formats supported by the risk control strategy engine, and reorganizing the entire conditional expression according to the syntax rules of the risk control strategy engine. After the conversion is complete, the strategy code is written into the rule base of the risk control strategy engine, making the rule a usable risk control rule in the risk control strategy engine.

[0054] After the rules are deployed, the risk control strategy engine, upon receiving subsequent e-commerce access data, performs risk identification based on the target risk control rule. E-commerce access data is real-time data generated by terminal devices when accessing e-commerce platforms, containing activity characteristics of the same type as the sample data, such as login IP, transaction amount, registration days, and payment method. Upon receiving the e-commerce access data, the risk control strategy engine extracts the values ​​of the activity characteristics upon which the target risk control rule depends, and matches these values ​​with the rule's conditional expressions. If the e-commerce access data meets all the conditions of the target risk control rule, the risk control strategy engine determines that the access data constitutes risky behavior and executes corresponding risk handling actions. Risk handling actions include, but are not limited to, allowing access, requiring additional verification, refusing the transaction, and marking it as suspicious. For example, for the rule transaction_amount > 9800 and register_days <= 1 and payment_method = credit_card, when a real-time transaction has a transaction amount of 12000, a registration day of 0, and a payment method of credit card, the transaction meets all the conditions of the rule. The risk control strategy engine determines that the transaction is high-risk and executes the risk disposal action of rejecting the transaction.

[0055] In one embodiment, rule conflict detection can be performed before deploying the target risk control rule to the risk control strategy engine. Rule conflict detection checks whether the target risk control rule to be deployed logically conflicts with or overlaps with existing rules in the risk control strategy engine. For example, if the condition range of an existing rule completely covers the condition range of a new rule, the deployment of the new rule may be redundant. If a conflict is detected, a notification can be sent to risk control operations personnel, suggesting rule adjustments or cancellation of deployment to avoid confusion in risk identification logic caused by rule conflicts in the strategy engine.

[0056] In one embodiment, after deploying the target risk control rule to the risk control strategy engine, rule effectiveness verification can be performed. Rule effectiveness verification involves simulating and constructing a set of test data that meets and does not meet the conditions of the target risk control rule, inputting it into the risk control strategy engine for verification, and confirming that the engine can correctly identify risk samples that meet the conditions and execute the expected risk handling actions. Upon successful verification, a confirmation message of successful deployment is returned to the risk control operations personnel, including the name of the deployed rule, deployment time, and effectiveness status. If verification fails, an error message is returned, prompting the risk control operations personnel to check whether the rule configuration is correct.

[0057] In one embodiment, the risk control strategy engine can support canary releases of rules. A canary release refers to deploying a new rule to a small portion of traffic for observation, and gradually expanding it to the full traffic only after confirming its performance meets expectations. During the canary release, metrics such as precision and recall of the new rule are continuously monitored and compared with baseline metrics before deployment. If the metrics are stable or better than expected, the rule is automatically rolled out to the full traffic. If abnormal fluctuations occur in the metrics, such as a sudden increase in the false positive rate, the canary release is automatically paused and the rule is rolled back, while risk control operations personnel are notified to investigate. The canary release mechanism can effectively reduce the risks associated with launching new rules and ensure a smooth transition of risk control strategies.

[0058] As can be seen from the above embodiments, the technical solution provided in this application, by combining the reasoning results of the risk control scoring model with rule mining and introducing a large language model for business semantic level reasoning analysis, forms a complete risk control strategy generation and configuration mechanism, bringing many beneficial effects, including but not limited to: First, this application significantly reduces the reliance on algorithm engineers for risk control strategy iteration, enabling risk control operations personnel to independently generate and configure risk control strategies. Specifically, after the risk control scoring model performs inference on sample data, it forms a causal dataset containing the mapping relationship between activity features and inference results. Based on this, the rule mining model automatically generates risk control rules and their evaluation indicators containing activity features from the causal dataset, forming a candidate rule set, replacing the traditional method of relying on algorithm engineers to manually compile rules. Subsequently, the large language model performs business semantic-level inference analysis on the model analysis data and candidate rule set, generating configuration suggestions containing recommended risk control rules. This transforms the model output, originally presented in a technical numerical form, into configuration suggestions in natural language that risk control operations personnel can understand. Based on these configuration suggestions, risk control operations personnel specify risk control rules to deploy in the risk control strategy engine for risk identification of e-commerce access data. Throughout the process, risk control operations personnel do not need an algorithm engineering background; they can understand the model output and rule meaning with the assistance of natural language suggestions and independently complete the selection and configuration of strategies, thereby significantly shortening the iteration cycle of risk control strategies.

[0059] Secondly, this application enhances the depth of understanding and decision-making quality of model outputs and risk control rules for risk control operations personnel. In traditional technologies, risk control operations personnel deal with abstract numerical values ​​such as feature importance rankings and correlation coefficients, making it difficult to quickly grasp their business implications. In this application, the large language model, based on preset inference prompt templates, performs business semantic-level inference analysis on model analysis data and candidate rule sets. It can interpret the direction and extent of the impact of various activity features on risk from a business perspective, analyze the potential risk causes corresponding to each risk control rule, and indicate the key areas that risk control operations personnel need to focus on. This approach of transforming technical model outputs into natural language suggestions with business insights enables risk control operations personnel to make more accurate and targeted strategic decisions based on a full understanding of the nature of risk, thereby improving the effectiveness of risk control strategies.

[0060] Furthermore, this application achieves a fully automated closed-loop process for risk control strategies, from generation to deployment. From the initial reasoning of sample data by the risk control scoring model, to the formation of causal datasets, extraction of model analysis data, generation of candidate rule sets, generation of configuration suggestion information, and rule deployment after responding to instructions, the entire process flows automatically within the system, reducing manual intervention and lowering the probability of human error. Simultaneously, because the data sources and processing logic remain consistent throughout the process, it avoids the inconsistencies and discrepancies caused by manual operation in traditional models, thus improving the stability and reliability of the risk control strategy.

[0061] Furthermore, this application boasts excellent scalability and adaptability. When faced with new risk scenarios or evolving fraudulent methods, risk control operations personnel only need to provide new sample data to automatically complete the entire process from model inference to rule deployment, quickly generating risk control strategies adapted to the new scenario. This enables e-commerce platforms to respond promptly to the ever-evolving risk landscape, maintaining the effectiveness and competitiveness of their risk control systems.

[0062] Based on any embodiment of the method in this application, the model analysis data can include multiple different data dimensions, each describing the relationship between activity features and inference results from a different perspective. In practical applications, data from one, two, or all three dimensions can be extracted according to business needs and data characteristics. Specifically, extracting model analysis data from the causal dataset using the activity features as dimensions includes at least one of the following: Step S5110: Extract the contribution ranking of each activity feature to the inference result from the causal dataset, and use it as feature importance data in the model analysis data; Feature importance data reflects the influence of each activity feature on the risk assessment model. Contribution ranking arranges each activity feature from largest to smallest influence on the inference result; the higher the ranking, the greater the influence of the activity feature on the risk assessment model's judgment. Various algorithms can be used to extract feature importance data.

[0063] In one embodiment, a gain-based importance calculation method can be used to measure the importance of each activity feature by statistically analyzing the total purity improvement brought about by each activity feature being selected as a split node in all decision trees of the risk control scoring model. The greater the gain, the greater the contribution of the feature to the model's judgment.

[0064] In another embodiment, an importance calculation method based on the number of splits can be used. The importance of each activity feature is measured by counting the number of times it is selected as a split node in the risk control scoring model. The more splits, the higher the frequency of use of the feature in the model.

[0065] In another embodiment, a permutation importance calculation method can be used, which measures the importance of an activity feature by observing the degree of decrease in the model's prediction accuracy after randomly shuffling the values ​​of that feature. The greater the decrease in accuracy, the more important the feature is to the model.

[0066] Feature importance data can be organized as a list of key-value pairs, where each key-value pair contains the name of the activity feature and its corresponding contribution value. For example, feature importance data can be represented as transaction_amount:0.35, register_days:0.28, login_ip_country:0.15, payment_method:0.12, device_fingerprint_score:0.10, etc., among which the transaction_amount feature has the greatest impact on the judgment result of the risk control scoring model.

[0067] Step S5120: Extract the correlation direction and value distribution between each activity feature and the inference result from the causal dataset, and use them as feature influence trend data in the model analysis data; Feature influence trend data reflects the correlation between changes in the values ​​of various activity features and the level of risk. The correlation direction refers to the positive or negative correlation between the value of the activity feature and the inference result. A positive correlation indicates that the larger the value of the activity feature, the higher the inference result, i.e., the greater the risk; a negative correlation indicates that the larger the value of the activity feature, the lower the inference result, i.e., the smaller the risk. Value distribution refers to the average or distribution range of the inference results corresponding to different value intervals of the activity feature, used to more precisely characterize the non-linear relationship between the activity feature and risk. Various analytical methods can be used to extract feature influence trend data.

[0068] In one embodiment, the SHAP analysis method can be used to calculate the marginal contribution of each activity feature to the inference result of each sample, thereby obtaining the SHAP value of each activity feature. The sign of the SHAP value indicates whether the feature has a positive promoting effect or a negative inhibiting effect on the risk judgment of the sample, and the absolute value of the SHAP value indicates the strength of the feature's influence. After aggregating the SHAP values ​​of all samples by activity feature, the overall influence trend of each activity feature can be obtained.

[0069] In another embodiment, a partial dependency graph analysis method can be used. By keeping other features constant, the average change of the model output under different values ​​of a certain activity feature can be observed, thereby obtaining the functional relationship curve between the feature and the inference result.

[0070] In another embodiment, a univariate analysis method can be used to directly calculate the correlation coefficient between each activity feature and the inference result, such as the Pearson correlation coefficient or the Spearman rank correlation coefficient. The sign of the correlation coefficient indicates the direction of the correlation, and the magnitude of the absolute value of the correlation coefficient indicates the strength of the correlation.

[0071] The feature influence trend data is organized in the form of descriptive text describing the activity feature name, correlation direction, and value distribution. For example, the feature influence trend data can be represented as follows: transaction_amount is positively correlated, with higher values ​​indicating greater risk; the average inference result for transaction_amount greater than 9800 reaches 0.92. Register_days is negatively correlated, with lower values ​​indicating greater risk; the average inference result for register_days less than or equal to 1 reaches 0.88. In login_ip_country, the average inference result for non-China regions reaches 0.75, while the average inference result for China regions is only 0.15.

[0072] Step S5130: Extract the distribution statistics of each activity feature in the sample space corresponding to the sample data from the causal dataset, and use them as feature distribution data in the model analysis data.

[0073] Feature distribution data reflects the distribution differences of various activity features between normal and risky samples, as well as their statistical characteristics in the entire sample space. Distribution statistics include, but are not limited to, the mean, median, standard deviation, quantiles, maximum, and minimum values, which describe the central tendency and dispersion of the data. When extracting feature distribution data, the distribution statistics of each activity feature can be calculated separately for all samples, positive samples, and negative samples to compare and analyze the differences in feature distribution between different categories of samples. For example, for the feature "transaction_amount", its mean is 5000, standard deviation is 3000, median is 4500, and 90th percentile is 9000 in all samples; its mean is 8500 in positive samples and 4200 in negative samples, indicating that the transaction amount in positive samples is generally higher than that in negative samples. For the `register_days` feature, its mean is 45 days, standard deviation is 30 days, and median is 35 days across all samples. The mean is 3 days in positive samples and 50 days in negative samples, indicating that the registration days for risky samples are significantly lower than those for normal samples. The feature distribution data is organized in a numerical table format, showing the activity feature name and its distribution statistics. This facilitates the rapid acquisition of the overall distribution of each activity feature during subsequent business semantic reasoning using a large language model.

[0074] The above embodiments provide multi-dimensional model analysis data for subsequent business semantic reasoning of the large language model by extracting at least one of feature importance data, feature influence trend data, and feature distribution data from the causal dataset. Feature importance data enables the large language model to identify which activity features are key drivers affecting risk assessment; feature influence trend data enables the large language model to understand the correlation between the value changes of each activity feature and the level of risk; and feature distribution data enables the large language model to grasp the distribution differences of each activity feature between normal and risky samples. The flexible combination and mutual complementarity of these three types of data enable the large language model to no longer rely solely on single numerical statistical results when performing business semantic reasoning, but to comprehensively understand the complex relationship between activity features and risk from multiple dimensions such as importance, influence trend, and distribution characteristics. This generates more accurate and business-insightful configuration recommendations, further improving the decision-making quality and strategy effectiveness of risk control operations personnel.

[0075] Based on any embodiment of the method in this application, a rule mining model is trained using the causal dataset and rule mining is performed to generate risk control rules and their evaluation metrics that include the activity features, including: Step S5210: Using the activity features in the causal dataset as input features and the inference results as inference results, construct a supervised label training decision tree model to obtain a fixed decision tree containing multiple leaf nodes; Decision tree models establish prediction rules by recursively partitioning the input feature space. Training a decision tree model requires determining the input features and supervision labels. In this step, activity features from the causal dataset are used as input features, and the inference results are used as supervision labels. Activity features refer to the various quantifiable attributes contained in each sample in the causal dataset, such as transaction amount, number of days registered, country of login IP, and payment method. The inference results are the predicted probability output by the risk control scoring model for each sample, ranging from 0 to 1, reflecting the likelihood that the sample represents a risky behavior.

[0076] Constructing supervised labels based on inference results means using the predicted probabilities output by the risk control scoring model as the learning objective of the decision tree model. The decision tree model learns the mapping relationship between activity features and predicted probabilities to find the features and splitting thresholds that most effectively divide samples. During training, the decision tree model starts from the root node, traverses all activity features and all possible splitting thresholds, and selects the features and thresholds that maximize the purity of the split child nodes as the splitting conditions for the current node. This process is recursively executed until a preset stopping condition is met, such as reaching the maximum depth or the number of samples in a leaf node falling below a minimum threshold.

[0077] After training, the decision tree model forms a fixed decision tree containing multiple leaf nodes. Each leaf node corresponds to a splitting path from the root node to that leaf node, and all splitting conditions on this path constitute an IF-THEN risk control rule. The structure of the fixed decision tree remains unchanged after training, and subsequent rule extraction and sample statistics are all based on this fixed structure.

[0078] Step S5220: Construct an initial Boolean mask for each sample in the causal dataset that consists of activity features and their inference results, and propagate the Boolean mask down layer by layer along each split node of the decision tree until it reaches the leaf node; A Boolean mask is a Boolean array of equal length to the number of samples. Each element in the array corresponds to a sample in the causal dataset and takes the value true or false, indicating whether the sample belongs to the subset of data being processed. When constructing the initial Boolean mask, each sample in the causal dataset is assigned an initial value of True, signifying that all samples participate in propagation starting from the root node of the decision tree. The length of the initial Boolean mask is equal to the total number of samples in the causal dataset, and all positions have a value of true.

[0079] The Boolean mask propagation process proceeds layer by layer downwards along each split node of the decision tree. At each split node, the Boolean mask arriving at that node is updated according to the splitting condition of that node. The splitting condition is a judgment statement determined during the training phase of the decision tree to split samples, such as transaction_amount greater than 9800 or register_days less than or equal to 1. For each Boolean mask arriving at the current split node, each sample with a true value in the mask is checked to see if it satisfies the splitting condition of that node. If a sample satisfies the splitting condition, the mask value corresponding to that sample remains true when propagating to the left child node and is updated to false when propagating to the right child node. If a sample does not satisfy the splitting condition, the mask value corresponding to that sample is updated to false when propagating to the left child node and remains true when propagating to the right child node. In this way, the Boolean mask propagates layer by layer downwards along each split node of the decision tree, and each sample eventually reaches only one leaf node. The Boolean mask received by each leaf node identifies the subset of samples belonging to that leaf node.

[0080] Step S5230: At each leaf node, based on the subset of samples identified by the Boolean mask that reaches the leaf node, count the number of samples and the number of positive samples corresponding to the leaf node, where samples whose inference results reach a preset threshold are positive samples. Upon reaching a leaf node, the leaf node receives a Boolean mask. The samples corresponding to the positions in the Boolean mask that are true are the sample subset belonging to that leaf node. The number of elements with true values ​​in the Boolean mask is the sample size corresponding to that leaf node. For each sample in the sample subset belonging to that leaf node, its inference result value in the causal dataset is obtained, and this inference result is compared with a preset threshold. The preset threshold is a value between 0 and 1, used to define whether a sample is a positive sample. If the inference result of a sample is greater than or equal to the preset threshold, the sample is determined to be a positive sample; if the inference result is less than the preset threshold, the sample is determined to be a negative sample. The total number of positive samples in the sample subset corresponding to that leaf node is the number of positive samples corresponding to that leaf node. The preset threshold can be flexibly set according to business needs and risk tolerance. For example, it can be set to 0.8, meaning that samples with a prediction probability greater than or equal to 0.8 are considered positive samples, or it can be set to 0.9 or other values. This application does not impose any restrictions on this. Step S5240: Determine the accuracy rate based on the ratio of the number of positive samples to the sample size. When the sum of the sample sizes of all leaf nodes is equal to the total sample size of the causal dataset, use the partitioning path corresponding to each leaf node as the risk control rule and the accuracy rate as the evaluation index.

[0081] Precision is equal to the number of positive samples divided by the sample size. It measures the proportion of samples classified as positive in the subset of samples corresponding to a leaf node. A higher precision indicates that the risk samples identified by the partitioning path corresponding to that leaf node are more accurate. A total sample coverage assertion check is performed on all leaf nodes. This involves calculating the sum of the sample sizes of all leaf nodes and comparing it to the total sample size of the causal dataset. If the sum of the sample sizes of all leaf nodes equals the total sample size of the causal dataset, it means that all samples have been correctly assigned to their respective leaf nodes, with no missing or duplicate samples, and the check passes. If the sum of the sample sizes of all leaf nodes does not equal the total sample size of the causal dataset, it indicates an error in sample allocation, and the check fails. In this case, it is necessary to check for anomalies in the decision tree structure or the Boolean mask propagation process.

[0082] When the validation passes, the splitting path corresponding to each leaf node is used as the risk control rule, and the accuracy of that leaf node is used as the evaluation metric for that risk control rule. The splitting path is the set of all splitting conditions traversed from the root node of the decision tree to that leaf node, combined using a logical AND relationship to form a complete IF-THEN risk control rule. For example, if the splitting path corresponding to a leaf node is: transaction_amount > 9800 at the root node, register_days <= 1 at the left child node, and payment_method = credit_card at the right child node, then the risk control rule corresponding to that leaf node is: IF transaction_amount > 9800 and register_days <= 1 and payment_method = credit_card THEN high_risk, with an accuracy of 93.75%.

[0083] The above embodiments use inference results as supervisory signals to train the decision tree model, ensuring that the mined risk control rules directly reflect the risk judgment logic of the risk control scoring model, thus guaranteeing the consistency between the rules and the model scoring system. The Boolean mask recursive propagation mechanism avoids floating-point precision errors that might be introduced by relying on intermediate statistical information recorded in the internal nodes of the decision tree by recalculating the sample size and positive sample count of each leaf node based on the original sample data, ensuring the accuracy of rule statistics. The total sample coverage assertion verification further guarantees that all samples are correctly assigned to each leaf node, with no sample loss or duplication, thereby ensuring the completeness of rule extraction. Precision rate, as an evaluation metric, provides a quantifiable quality measure for each risk control rule, enabling the subsequent large language model to make judgments based on accurate statistical data when making rule recommendations. In summary, this embodiment effectively guarantees the accuracy, completeness, and quantifiability of the rule mining process, laying a reliable data foundation for the subsequent generation of high-quality configuration suggestion information.

[0084] Based on any embodiment of the method in this application, the model analysis data and the candidate rule set are input into a large language model. The large language model performs business semantic level reasoning analysis based on a preset reasoning prompt template to generate configuration suggestion information containing recommended risk control rules, including: Step S5310: Assemble the model analysis data and the candidate rule set into structured input data that conforms to the preset reasoning prompt template. The structured input data includes a risk control business context description, a numerical representation of the model analysis data, and conditional expressions and evaluation indicators of each risk control rule in the candidate rule set. Before inputting the model analysis data and candidate rule sets into the large language model, these data need to be assembled into structured input data that conforms to a preset inference prompt template. The preset inference prompt template is a pre-designed structured text framework used to organize the model analysis data and candidate rule sets in a way that the large language model can efficiently understand and process. The structured input data consists of three components: a description of the risk control business context, a numerical representation of the model analysis data, and the conditional expressions and evaluation metrics of each risk control rule in the candidate rule set.

[0085] The risk control business context description in this embodiment is used to explain the current e-commerce risk control scenario background to the large language model. It can include information such as platform type, risk type, and business objectives. The risk control business context description can be automatically generated by the system based on the source of the currently processed sample data and the business scenario. For example, when the processed sample data comes from a payment transaction scenario on an e-commerce platform, the risk control business context description can be expressed as: "We are currently processing sample data from a payment transaction scenario on an e-commerce platform. The main fraud types we are concerned with include account theft and payment fraud. The business objective is to effectively intercept high-risk transactions while minimizing false positives against legitimate users." The risk control business context description provides the large language model with the business background needed to understand subsequent data, enabling it to analyze data in conjunction with specific business scenarios during business semantic reasoning, rather than interpreting data in a general way without context.

[0086] Numerical representation of model analysis data involves organizing feature importance data, feature influence trend data, and feature distribution data into structured data blocks in numerical form. Feature importance data can be organized as a list of key-value pairs between activity feature names and their contribution values, such as transaction_amount corresponding to 0.35, register_days corresponding to 0.28, and login_ip_country corresponding to 0.15. Feature influence trend data can be organized as descriptive text between activity feature names and their correlation direction and value range, such as transaction_amount showing a positive correlation with an average inference result of 0.92 in the range greater than 9800, and register_days showing a negative correlation with an average inference result of 0.88 in the range less than or equal to 1. Feature distribution data can be organized as a numerical table between activity feature names and their distribution statistics, such as transaction_amount having a mean of 5000 in the entire sample, a mean of 8500 in the positive sample, and a mean of 4200 in the negative sample. By representing the data analyzed by the model in numerical form, the large language model can directly read and understand the quantitative information of each activity feature in terms of importance, influence trend and distribution characteristics, providing accurate data input for subsequent business semantic reasoning.

[0087] The conditional expressions and evaluation metrics of each risk control rule in the candidate rule set can be organized into a rule list. Each rule includes evaluation metrics such as rule path, precision, recall, and coverage. For example, the conditional expression for rule one is that transaction_amount is greater than 9800, register_days is less than or equal to 1, and payment_method is equal to credit_card, with a precision of 93.75% and a coverage of 16 samples; the conditional expression for rule two is that login_ip_country is not in China and order_total is greater than 3500, with a precision of 90.00% and a coverage of 10 samples; the conditional expression for rule three is that device_fingerprint_score is less than or equal to 0.3 and login_hour is between 0 and 5, with a precision of 85.71% and a coverage of 14 samples.

[0088] By presenting the conditional expressions and evaluation indicators of each risk control rule in a structured rule list, the large language model can clearly understand the judgment logic and quality performance of each rule, providing a basis for subsequent rule recommendations and risk cause analysis.

[0089] Step S5320: Input the structured input data into the big language model. The big language model interprets the business semantics of each activity feature in the model analysis data according to the causal reasoning instructions set in the preset reasoning prompt template, and performs risk cause analysis on each risk control rule in the candidate rule set. After the structured input data is fed into the big data language model, the model interprets the business semantics of each activity feature in the data according to the causal inference instructions set in the preset inference prompt template, and performs risk cause analysis on each risk control rule in the candidate rule set. The causal inference instructions are a core component of the preset inference prompt template, instructing the big data language model to interpret activity features and risk control rules at the business semantic level according to causal relationships, rather than simply repeating numerical statistical results or listing data. Business semantic interpretation refers to the big data language model explaining the causal relationship between each activity feature and risk from a business perspective. For example, for the transaction_amount feature, which ranks high in feature importance data, the big data language model can interpret it as: transaction amount is the most critical feature affecting risk judgment; the higher the transaction amount, the greater the risk. This is because large transactions are more likely to become targets for fraudsters, who often try to complete large transactions in a short period to maximize illegal profits. For the register_days feature, the big data language model can interpret it as: the shorter the registration period, the higher the risk. This is because fraudsters often use newly registered accounts to commit crimes; these accounts lack long-term historical behavior records and are difficult to verify effectively through other behavioral characteristics. Risk causal analysis refers to the analysis of potential risk causes corresponding to each risk control rule from a business perspective using a large language model. For example, for a rule with the conditional expression "transaction_amount greater than 9800, register_days less than or equal to 1, and payment_method equal to credit_card", the large language model can analyze the possible risk causes of this rule as follows: a newly registered account makes a large payment using a credit card on the day of registration. This behavior is highly consistent with the typical characteristics of card theft payments. Fraudsters usually use the newly registered account to make large purchases immediately after stealing credit card information in order to quickly convert it into cash.

[0090] Step S5330: Receive configuration suggestion information output by the large language model, which includes recommended risk control rules and their reasons for recommendation. The reasons for recommendation include at least one of the following: a description of the risk scenario targeted by the recommended risk control rule, an explanation of the advantages of the recommended risk control rule compared with other risk control rules in the candidate rule set, and activity characteristics that need to be monitored after applying the recommended risk control rule.

[0091] After completing the inference analysis, the large language model outputs configuration suggestions containing recommended risk control rules and their reasons. Recommended risk control rules are one or more risk control rules selected by the large language model from the candidate rule set, deemed most suitable for deployment in the current risk control scenario. The reasons for recommendation are business semantic explanations generated by the large language model for each recommended risk control rule, used to help risk control operations personnel understand why the rule is recommended and what precautions need to be taken after applying it. In this embodiment, the reasons for recommendation include at least one of the following: a description of the risk scenario targeted by the recommended risk control rule, an explanation of the advantages of the recommended risk control rule compared to other risk control rules in the candidate rule set, and activity characteristics that need to be monitored after applying the recommended risk control rule. The risk scenario description explains what type of risky behavior the recommended risk control rule is suitable for identifying; for example, the rule is suitable for identifying card theft payments made by newly registered accounts using credit cards for large payments. The advantages section explains the superiority of this recommended risk control rule compared to other rules in terms of precision, recall, or coverage. For example, this rule achieves a precision of 93.75%, performing best among all candidate rules and minimizing false positives against legitimate users. The activity characteristics to monitor indicate which activity characteristics should be closely monitored after applying this rule to promptly identify signs of rule degradation. For instance, after applying this rule, the distribution of the `register_days` characteristic should be closely monitored; if the overall distribution of legitimate users' registration days decreases, it may lead to an increase in the false positive rate of this rule.

[0092] In one embodiment, the configuration recommendations output by the large language model can be presented in the form of natural language paragraphs. For example, the configuration recommendations could be expressed as: Based on the analysis of the current sample data, it is recommended to prioritize the deployment of rules where transaction_amount is greater than 9800, register_days is less than or equal to 1, and payment_method is equal to credit_card. This rule targets the risk scenario of newly registered accounts making large payments using credit cards, achieving an accuracy rate of 93.75%, the best performance among all candidate rules. After applying this rule, it is recommended to pay close attention to the distribution changes of the register_days feature. If the distribution of registration days for normal users shows an overall downward trend, it is necessary to consider appropriately adjusting the threshold for registration days to avoid false positives.

[0093] In another embodiment, the configuration suggestion information output by the large language model can also be presented in the form of structured data, such as organizing the recommendation rules and their reasons in JSON format, which facilitates automatic system parsing and subsequent processing. The specific presentation format of the configuration suggestion information can be flexibly selected according to the actual application scenario, and this application does not impose any restrictions on it.

[0094] In the above embodiments, the structured input data, described through the risk control business context, provides the large language model with the business background needed to understand the data. Through model analysis of the data's numerical representation, the large language model can accurately read the quantitative information of each activity feature in terms of importance, impact trends, and distribution characteristics. Through the conditional expressions and evaluation metrics of the candidate rule set, the large language model can comprehensively understand the judgment logic and quality performance of each rule. When interpreting business semantics based on this structured data, the large language model is no longer limited to repetitive numerical statistical results, but can explain the causal relationship between each activity feature and risk from a business perspective, analyze the potential risk causes corresponding to each risk control rule, and on this basis, select the most suitable recommended rule for the current scenario and its reasons for recommendation. This method of transforming technical model output into natural language suggestions with business insights allows risk control operators to make more accurate and targeted strategic decisions based on a full understanding of the nature of risk, without needing an algorithm engineering background, effectively improving the configuration quality and decision-making efficiency of risk control strategies.

[0095] Based on any embodiment of the method in this application, in response to a rule configuration instruction triggered by the configuration suggestion information, the risk control rule specified by the instruction is deployed to the risk control strategy engine of the e-commerce platform, including: Step S5410: Display the configuration suggestion information in a visual interface, which includes the enable control for each risk control rule in the candidate rule set. After the configuration suggestion information is generated, it can be pushed to the terminal devices of risk control operations personnel and presented to them through a visual interactive method, enabling them to make deployment decisions based on this information. The visual interface is a graphical user interface running on the terminal device, used to display the configuration suggestion information generated by the large language model to risk control operations personnel and providing interactive controls for their operation. The visual interface contains detailed information about each risk control rule in the candidate rule set, including the conditional expression, precision, recall, coverage, and other evaluation metrics for each rule, as well as the recommendation reasons generated by the large language model for that rule. In this embodiment, an independent enable control is provided for each risk control rule as an interactive element to trigger rule configuration instructions; it can be implemented in any form such as a button, switch, or checkbox. Risk control operations personnel can click or toggle the enable control to choose whether to deploy the rule to the risk control strategy engine.

[0096] In one embodiment, the visualization interface can also display risk control rules in the candidate rule set in a risk stratification manner. For example, rules with an accuracy rate of 90% or higher are marked as high-risk rules and indicated in red, rules with an accuracy rate between 70% and 90% are marked as medium-risk rules and indicated in yellow, and rules with an accuracy rate of less than 70% are marked as low-risk rules and indicated in green, which helps risk control operators to more quickly identify and select risk control rules suitable for the current risk scenario.

[0097] Step S5420: In response to the rule configuration instruction generated by the activation control being triggered, extract the target risk control rule and its condition expression specified by the instruction from the candidate rule set; When a risk control operations staff member clicks or toggles the enable control for a specific risk control rule in the visual interface, this operation triggers a rule configuration instruction. The rule configuration instruction is a signal carrying risk control rule identification information, used to instruct the system to deploy the specified risk control rule to the risk control strategy engine. The rule configuration instruction contains the identification information of the target risk control rule selected by the risk control operations staff member, such as the rule number or rule path. After receiving the rule configuration instruction, the system searches and matches it in the candidate rule set based on the rule identification information carried in the instruction, locates the corresponding risk control rule, and extracts the rule's conditional expression and its evaluation metrics. In one embodiment, the risk control operations staff member can select multiple risk control rules simultaneously, and the system will generate a rule configuration instruction for each selected rule and process them sequentially. In another embodiment, the risk control operations staff member can also choose to perform batch operations on rules across the entire risk stratification level, such as enabling all high-risk rules with a single click.

[0098] Step S5430: Convert the conditional expression of the target risk control rule into executable strategy code of the risk control strategy engine and write it into the rule base of the risk control strategy engine, so that when the risk control strategy engine receives e-commerce access data in the future, it can perform risk identification on the e-commerce access data based on the target risk control rule.

[0099] After extracting the conditional expression of the target risk control rule, it needs to be converted into strategy code that the risk control strategy engine can directly parse and execute, and then written into the rule base of the risk control strategy engine. The rule base of the risk control strategy engine stores multiple executable risk control rules. Different risk control strategy engines may support different rule syntax and formats, therefore, the conditional expression needs to be converted into strategy code compatible with the target risk control strategy engine. Strategy code is a rule description language that the risk control strategy engine can directly parse and execute; for example, it can be a structured rule description based on JSON format, or a scripting language specific to the risk control strategy engine. The conversion process includes mapping the activity feature names in the conditional expression to the corresponding field names in the risk control strategy engine, converting comparison operators to the operator format supported by the risk control strategy engine, and reorganizing the entire conditional expression according to the syntax rules of the risk control strategy engine. After the conversion is complete, the strategy code is written into the rule base of the risk control strategy engine, making the rule a usable risk control rule in the risk control strategy engine.

[0100] After the rules are deployed, when the risk control strategy engine receives e-commerce access data, it extracts the values ​​of the activity characteristics upon which the target risk control rule depends and matches these values ​​with the rule's conditional expressions. If the e-commerce access data meets all the conditions of the target risk control rule, the risk control strategy engine determines that the access data constitutes a risky behavior and executes corresponding risk handling actions. Risk handling actions include, but are not limited to, allowing access, requiring additional verification, rejecting the transaction, and marking it as suspicious. For example, for the rule "transaction_amount > 9800 and register_days <= 1 and payment_method = credit_card", when a real-time transaction has a transaction amount of 12000, a registration day of 0, and a payment method of credit card, the transaction meets all the conditions of the rule, the risk control strategy engine determines that the transaction is high-risk, and executes the risk handling action of rejecting the transaction.

[0101] The above embodiments present configuration suggestions in a visual interface and provide an activation control, enabling risk control operations personnel to intuitively view detailed information of each risk control rule and the recommendation reasons generated by the large language model. They can trigger rule configuration commands through simple interactive operations. In response to the rule configuration command triggered by the activation control, the system automatically extracts the target risk control rule and its conditional expression from the candidate rule set, converts it into executable strategy code for the risk control strategy engine, and writes it into the rule base. This allows the risk control strategy engine to perform risk identification based on the rule when it subsequently receives e-commerce access data. This process organically combines the decision-making process of risk control operations personnel with the automated execution process of the system. Risk control operations personnel do not need programming skills to complete the rule deployment operation, while the system automatically completes the technical tasks such as rule format conversion and writing. This fully leverages the leading role of risk control operations personnel in business decision-making and reduces configuration errors that may be introduced by manual operation through automated execution, achieving a highly efficient human-machine collaborative strategy deployment model.

[0102] Based on any embodiment of the method in this application, in response to a rule configuration instruction triggered by the configuration suggestion information, the risk control rule specified by the instruction is deployed to the risk control strategy engine of the e-commerce platform for risk identification of e-commerce access data containing the activity characteristics, including: Step S5500: Periodically obtain the risk identification results generated by the risk control strategy engine based on the deployed risk control rules to perform risk identification on e-commerce access data; After risk control rules are deployed to the risk control strategy engine, the engine continuously identifies risks in the real-time incoming e-commerce access data and executes corresponding risk handling actions based on the matching results. During this process, the risk control strategy engine records the results of each risk identification, including whether each piece of e-commerce access data is determined to be a risk sample and what risk handling action was performed. The risk control system periodically retrieves these risk identification results from the risk control strategy engine; the frequency can be set according to business needs, such as once per hour, once per day, or once per week. The risk identification results are stored in the form of structured data. Each record contains the identification information of the e-commerce access data, the identifier of the matched risk control rule, the judgment result, and the handling action. These risk identification results constitute the basic data for evaluating the effectiveness of the deployed risk control rules.

[0103] Step S5600: Determine the group stability index of the proportion of risk samples judged by the deployed risk control rules based on the risk identification results. The group stability index is used to measure the degree of deviation of the current judgment proportion from the judgment proportion in the baseline period. The group stability index is a quantitative metric used to assess whether the proportion of samples identified as risky by the risk control strategy engine has changed significantly over different time periods. If the group stability index remains within the normal range, it indicates that the judgment behavior of the deployed risk control rules is consistent with the baseline period, and the risk control strategy is operating stably. If the group stability index exceeds a preset offset threshold, it indicates that the judgment behavior of the deployed risk control rules has changed significantly. This may be due to a shift in the activity feature distribution on which the risk control scoring model relies, leading to changes in the model's predictive behavior and consequently affecting the judgment results of the risk control rules.

[0104] The calculation of the population stability index is based on a statistical test of the distribution of risk sample proportions. Specifically, the risk sample proportion distribution in the baseline period is used as the reference distribution, and the risk sample proportion distribution in the current period is used as the test distribution. Population stability is quantified by calculating the degree of difference between the two distributions. In one embodiment, the formula for calculating the population stability index is as follows: PSI = ∑(P_current_i - P_base_i) × ln(P_current_i / P_base_i) Wherein, PSI represents the group stability index. The range of risk sample proportions is divided into several consecutive bins, each bin corresponding to a risk sample proportion interval, where i represents the i-th bin. P_base_i represents the proportion of samples whose risk sample proportion falls into the i-th bin during the baseline period, relative to the total number of samples during the baseline period. P_current_i represents the proportion of samples whose risk sample proportion falls into the i-th bin during the current period, relative to the total number of samples during the current period. ln represents the natural logarithm function. The larger the value of the group stability index, the greater the distribution difference between the current period and the baseline period, and the worse the stability of the risk control strategy. The preset offset threshold can be set according to business needs and risk tolerance. For example, it can be set to 0.25, where a significant distribution offset is judged when the group stability index exceeds 0.25. It can also be set to 0.1 or other values; this application does not impose any restrictions on this.

[0105] Step S5700: When the group stability index exceeds the preset offset threshold, the risk control scoring model is retrained using the latest e-commerce access data and its risk identification results as sample data. Then, the iteration restarts from the step of inferring from the sample data containing activity features using the pre-trained risk control scoring model.

[0106] When the group stability index exceeds a preset offset threshold, the risk control scoring model is retrained using the latest e-commerce access data and its risk identification results as sample data, and the iteration restarts from step S5100. The group stability index exceeding the preset offset threshold indicates that the current risk control scoring model can no longer accurately reflect the latest data distribution characteristics, and the effectiveness of risk control rules mined based on the original model also decreases. At this point, a new round of model training and rule mining needs to be triggered to adapt to the current changes in data distribution. Specifically, the latest e-commerce access data and its risk identification results are used as new sample data, which reflects the latest risk situation and user behavior patterns. The risk control scoring model is retrained based on this new sample data, enabling the model to learn the mapping relationship between the latest activity characteristics and risks. After retraining, the process restarts from the pre-trained risk control scoring model, inferring from sample data containing activity features. This involves using the newly trained risk control scoring model to infer from new sample data, generating a new causal dataset. Then, the rule mining model is retrained using this new causal dataset, and rule mining is performed to generate a new set of candidate rules. Next, a large language model generates new configuration suggestions. Finally, after confirmation by risk control operations personnel, the new risk control rules are deployed to the risk control strategy engine. Through this iterative mechanism, the risk control system can automatically perceive changes in data distribution and adjust risk control strategies in a timely manner, maintaining an effective ability to identify the latest risk trends.

[0107] The above embodiments periodically acquire risk identification results generated by the risk control strategy engine after the risk control rules are deployed, and calculate a group stability index based on these results, representing the proportion of risk samples identified by the deployed risk control rules. When this index exceeds a preset offset threshold, a new round of model training and rule mining is triggered, forming a complete adaptive iterative closed loop. The group stability index quantifies the degree of offset in the distribution of risk sample proportions between the current period and the baseline period, providing an objective quantitative basis for evaluating the performance degradation of the risk control strategy and avoiding the uncertainty of relying on subjective experience. When a significant distribution offset is detected, the system automatically retrains the risk control scoring model with the latest e-commerce access data and its risk identification results, and re-executes the entire process from the inference step, enabling the risk control strategy to adapt to changes in data distribution in a timely manner and maintain an effective ability to identify the latest risk situation. This mechanism enables the risk control system to have self-awareness and self-repair capabilities, automatically completing the complete cycle from performance monitoring to strategy updates without manual intervention, significantly improving the continuous effectiveness of the risk control system.

[0108] Based on any embodiment of the method in this application, the training process of the risk control scoring model includes: Step S4100: Train the first model by taking each sample of all sample data carrying full activity features as input, and determine the importance ranking of each activity feature based on the first model; The training process of the risk control scoring model begins with training a full-feature model. Each sample in the entire dataset serves as input, containing one or more activity features. Full-feature activity refers to all quantifiable attributes in the entire dataset used for training that can describe user behavior, including but not limited to user login behavior features, browsing behavior features, order placement behavior features, payment behavior features, device fingerprint features, and network environment features. During training, samples carrying these activity features are used as input features, and the corresponding risk labels are used as supervision signals to train the first model.

[0109] The first model itself is a relatively complex machine learning model with strong fitting capabilities, capable of fully utilizing information from all activity features for risk prediction. The first model can be a gradient boosting tree model, a random forest model, or a neural network model, etc., and this application does not impose any restrictions on this. After the first model is trained, the importance ranking of each activity feature can be determined based on the first model.

[0110] Similarly, feature importance ranking reflects the contribution of each activity feature to risk prediction in the first model. The higher the ranking of an activity feature, the greater its influence on the model's decision. To determine feature importance ranking, a gain-based importance calculation method can be used. This method measures the importance by calculating the total purity increase brought by each activity feature when selected as a split node in all decision trees of the first model; a larger gain indicates a greater contribution to the model's decision. Alternatively, a split-country-based importance calculation method can be used, measuring the importance by counting the number of times each activity feature is selected as a split node in the first model; more splits indicate a higher frequency of use of the feature in the model. Feature importance ranking is presented in list form, for example, transaction_amount ranked first, register_days ranked second, login_ip_country ranked third, etc.

[0111] Step S4200: The activity features are removed in order of importance from low to high. Each removal generates a subset of candidate features. The second model is trained using each subset of candidate features as input. The complexity of the second model is lower than that of the first model. After determining the importance ranking of each activity feature, starting with the least important feature, features are removed from the full set of activity features in ascending order of importance. Each removed feature results in a subset of candidate features. For example, assuming the full set of activity features contains ten features, ranked from least to most important as feature ten, feature nine, feature eight, down to feature one, the first removal yields a subset of candidate features containing features one through nine, the second removal yields a subset containing features one through eight, and so on, until a subset containing only the most important activity feature is obtained.

[0112] For each candidate feature subset, a corresponding second model is trained using the activity features it contains as input and the risk label corresponding to the sample as the supervision signal. The second model uses the same algorithm as the first model, but its complexity is lower. For example, the second model has fewer trees, a shallower tree depth, or a higher learning rate than the first model. By reducing the complexity of the first model to varying degrees, the second model focuses more on the most important information in the candidate feature subset during training, reducing overfitting to redundant features and shortening the training time for each candidate feature subset. Each candidate feature subset corresponds to one second model, therefore the number of second models is equal to the number of candidate feature subsets.

[0113] Step S4300: Obtain the accuracy attenuation magnitude of each second model relative to the first model. In the candidate feature subset where the accuracy attenuation magnitude does not exceed a preset tolerance threshold, determine the second model corresponding to the candidate feature subset with the fewest active features as the risk control scoring model.

[0114] After the second model corresponding to each subset of candidate features is trained, its performance relative to the first model needs to be evaluated using the accuracy decay rate. Accuracy decay rate refers to the degree to which the prediction accuracy of the second model on the validation set decreases compared to the prediction accuracy of the first model on the same validation set. Prediction accuracy can be measured using various evaluation metrics, including but not limited to precision, exact rate, recall, F1 score, and AUC. In practical applications, appropriate evaluation metrics can be selected based on business needs. For example, in scenarios where the primary goal is to intercept high-risk transactions, precision can be prioritized; in scenarios where the goal is to expand risk coverage, recall can be prioritized. The accuracy decay rate is calculated as the precision value of the first model minus the precision value of the second model. If the precision value of the second model is equal to or higher than that of the first model, the accuracy decay rate is zero or negative, indicating that the second model has no loss of accuracy or even an improvement.

[0115] The preset tolerance threshold is a pre-defined upper limit for accuracy decay, used to control the acceptable range of accuracy loss during feature selection. The preset tolerance threshold can be flexibly set according to business needs and risk tolerance. For example, it can be set to 0.01, indicating that the accuracy of the second model is allowed to decrease by no more than one percentage point relative to the first model; it can also be set to other values ​​such as 0.02 or 0.05. This application does not impose any restrictions on this. For the second model corresponding to each candidate feature subset, its accuracy decay rate relative to the first model is calculated, and this rate of decay is compared with the preset tolerance threshold. If the accuracy decay rate does not exceed the preset tolerance threshold, it means that the second model corresponding to the candidate feature subset has achieved a reduction in the number of features within an acceptable accuracy range, and the candidate feature subset is an effective simplification scheme. If the accuracy decay rate exceeds the preset tolerance threshold, it means that the second model corresponding to the candidate feature subset has suffered excessive accuracy loss due to the removal of too many active features, and the candidate feature subset does not meet the requirements.

[0116] Among all candidate feature subsets where the accuracy decay does not exceed a preset tolerance threshold, the second model corresponding to the candidate feature subset with the fewest active features is selected as the risk control scoring model. The candidate feature subset with the fewest active features means that the number of active features in this subset has been reduced to the minimum, while the accuracy decay of the corresponding second model remains within an acceptable range. This second model is selected as the risk control scoring model, serving as the pre-trained model for inference on sample data containing active features in subsequent step S5100. Through this feature selection process, the risk control scoring model uses the fewest possible active features for risk scoring while maintaining acceptable prediction accuracy, thereby reducing the computational complexity and resource consumption of the model during the inference stage and improving the model's operating efficiency.

[0117] In one embodiment, if the accuracy decay of the second model corresponding to all candidate feature subsets exceeds a preset tolerance threshold, it indicates that a simplified feature subset that meets the accuracy requirements cannot be found under the current preset tolerance threshold. In this case, the preset tolerance threshold can be appropriately relaxed, or the second model corresponding to the candidate feature subset with the smallest accuracy decay can be selected as the risk control scoring model to ensure that the model at least has usable predictive ability.

[0118] In another embodiment, the feature selection process can also employ a reverse strategy, starting with the most important active features and adding active features sequentially in descending order of importance. Each addition generates a subset of candidate features and trains a corresponding second model, until the accuracy improvement after adding more features falls below a preset improvement threshold. This approach complements the aforementioned elimination strategy and can be flexibly chosen based on the actual data characteristics.

[0119] The above embodiments train a first model using all activity features and determine the importance ranking of each activity feature. Then, activity features are sequentially eliminated in order of increasing importance, and corresponding second models are trained. Finally, the second model corresponding to the subset of candidate features with the fewest activity features is selected as the risk control scoring model from the subset of candidate features whose accuracy decay does not exceed a preset tolerance threshold, forming a systematic feature selection mechanism. This mechanism uses the first model to perform a global importance assessment of all features, providing an objective ranking basis for subsequent feature elimination and avoiding the subjectivity and uncertainty of feature selection based on human experience. By successively eliminating low-importance features and training a less complex second model, the number of features can be gradually reduced while maintaining prediction accuracy. The preset tolerance threshold is used to quantitatively control the accuracy loss, ensuring that the final selected risk control scoring model achieves a balance between accuracy and efficiency. By determining the second model corresponding to the candidate feature subset with the fewest activity features as the risk control scoring model, the subsequent inference process only needs to use the fewest number of activity features to complete the risk scoring, significantly reducing the computational complexity and resource consumption of the model in the inference stage and improving the overall operating efficiency of the risk control system.

[0120] Please see Figure 3 According to one aspect of this application, an e-commerce risk control rule configuration device includes a scoring inference module 5100, a rule mining module 5200, a semantic inference module 5300, and a configuration execution module 5400. The scoring inference module 5100 is configured to use a pre-trained risk control scoring model to infer from sample data containing activity features, obtaining a causal dataset containing the activity features and their inference results, and extracting model analysis data from the causal dataset using the activity features as a dimension. The rule mining module 5200 is configured to train a rule mining model using the causal dataset and perform rule mining. The system generates risk control rules and their evaluation indicators that include the activity characteristics, forming a candidate rule set. The semantic reasoning module 5300 is configured to input the model analysis data and the candidate rule set into a large language model, which performs business semantic level reasoning analysis based on a preset reasoning prompt template to generate configuration suggestion information containing recommended risk control rules. The configuration execution module 5400 is configured to respond to a rule configuration instruction triggered by the configuration suggestion information, and deploy the risk control rule specified by the instruction to the risk control strategy engine of the e-commerce platform for risk identification of e-commerce access data containing the activity characteristics.

[0121] Based on any embodiment of the apparatus in this application, the scoring inference module 5100 includes at least one of the following: a contribution quantification module, configured to extract the contribution ranking of each activity feature to the inference result from the causal dataset, as feature importance data in the model analysis data; an influence quantification module, configured to extract the correlation direction and value distribution between each activity feature and the inference result from the causal dataset, as feature influence trend data in the model analysis data; and a distribution statistics module, configured to extract the distribution statistics of each activity feature in the sample space corresponding to the sample data from the causal dataset, as feature distribution data in the model analysis data.

[0122] Based on any embodiment of the device in this application, the rule mining module 5200 includes: a model shaping module, configured to use the activity features in the causal dataset as input features and construct supervised labels to train a decision tree model with the inference results, thereby obtaining a shaped decision tree containing multiple leaf nodes; a mask propagation module, configured to construct an initial Boolean mask for each sample in the causal dataset composed of activity features and their inference results, and propagate the Boolean mask layer by layer down along each split node of the decision tree until it reaches a leaf node; a leaf processing module, configured to, at each leaf node, based on the subset of samples identified by the Boolean mask that reaches the leaf node, count the sample size and positive sample size corresponding to the leaf node, wherein samples whose inference results reach a preset threshold are positive samples; and a rule shaping module, configured to determine the accuracy rate according to the ratio of the number of positive samples to the sample size, and when the sum of the sample sizes of all leaf nodes is equal to the total sample size of the causal dataset, use the split path corresponding to each leaf node as the risk control rule, and use the accuracy rate as the evaluation index.

[0123] Based on any embodiment of the device in this application, the semantic reasoning module 5300 includes: a data assembly module, configured to assemble the model analysis data and the candidate rule set into structured input data conforming to the preset reasoning prompt template, wherein the structured input data includes a risk control business context description, a numerical representation of the model analysis data, and conditional expressions and evaluation indicators of each risk control rule in the candidate rule set; an input reasoning module, configured to input the structured input data into the large language model, wherein the large language model performs business semantic interpretation on each activity feature in the model analysis data according to the causal reasoning instructions set in the preset reasoning prompt template, and performs risk cause analysis on each risk control rule in the candidate rule set; and a result processing module, configured to receive configuration suggestion information output by the large language model, which includes recommended risk control rules and their recommendation reasons, wherein the recommendation reasons include at least one of the following: a description of the risk scenario targeted by the recommended risk control rule, an explanation of the advantages of the recommended risk control rule compared to other risk control rules in the candidate rule set, and activity features that need to be paid attention to after applying the recommended risk control rule.

[0124] Based on any embodiment of the device in this application, the configuration execution module 5400 includes: an interface display module, configured to display the configuration suggestion information in a visual interface, the visual interface including an enable control for each risk control rule in the candidate rule set; an instruction response module, configured to extract the target risk control rule and its condition expression specified by the instruction from the candidate rule set in response to a rule configuration instruction generated by triggering the enable control; and a rule writing module, configured to convert the condition expression of the target risk control rule into executable strategy code of the risk control strategy engine and write it into the rule base of the risk control strategy engine, so that when the risk control strategy engine subsequently receives e-commerce access data, it can perform risk identification on the e-commerce access data based on the target risk control rule.

[0125] Based on any embodiment of the device in this application, following the configuration execution module 5400, the device further includes: a periodic acquisition module, configured to periodically acquire the risk identification results generated by the risk control strategy engine performing risk identification on e-commerce access data based on deployed risk control rules; a group quantification module, configured to determine a group stability index of the proportion of risk samples judged by the deployed risk control rules based on the risk identification results, wherein the group stability index is used to measure the degree of deviation of the current judgment proportion relative to the judgment proportion in the baseline period; and a deviation iteration module, configured to, when the group stability index exceeds a preset deviation threshold, retrain the risk control scoring model using the latest e-commerce access data and its risk identification results as sample data, and then restart the iteration from the step of performing inference on sample data containing activity features using the pre-trained risk control scoring model.

[0126] Based on any embodiment of the device in this application, the device further includes: a first training module, configured to train a first model with each sample of all sample data carrying full activity features as input, and determine the importance ranking of each activity feature based on the first model; a second training module, configured to sequentially eliminate the activity features in order of increasing importance, generating a candidate feature subset after each elimination, and training a corresponding second model with each candidate feature subset as input, wherein the complexity of the second model is lower than that of the first model; and a model selection module, configured to obtain the accuracy decay of each second model relative to the first model, and determine the second model corresponding to the candidate feature subset with the fewest activity features in the candidate feature subset with the lowest accuracy decay as the risk control scoring model.

[0127] Another embodiment of this application also provides an electronic device. For example... Figure 4 The diagram shows the internal structure of an electronic device. This electronic device includes a processor, a computer-readable storage medium, a memory, and a network interface connected via a system bus. The computer-readable, non-volatile storage medium stores an operating system, a database, and computer-readable instructions. The database can store information sequences, and when executed by the processor, the computer-readable instructions enable the processor to implement an e-commerce risk control rule configuration method.

[0128] The processor of this electronic device provides computing and control capabilities to support the operation of the entire device. The memory of this electronic device can store computer-readable instructions, which, when executed by the processor, cause the processor to execute the e-commerce risk control rule configuration method of this application. The network interface of this electronic device is used for communication with a terminal.

[0129] Those skilled in the art will understand that Figure 4 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the electronic device to which the present application is applied. The specific electronic device may include more or fewer components than shown in the figure, or combine certain components, or have different component arrangements.

[0130] In this embodiment, the processor is used to execute... Figure 3 The specific functions of each module are described, and the memory stores the program code and various data required to execute the above modules or sub-modules. The network interface is used to realize data transmission between user terminals or servers. The non-volatile readable storage medium in this embodiment stores the program code and data required to execute all modules in the e-commerce risk control rule configuration device of this application, and the server can call the server's program code and data to execute the functions of all modules.

[0131] This application also provides a non-volatile readable storage medium storing computer-readable instructions, which, when executed by one or more processors, cause the one or more processors to perform the steps of the e-commerce risk control rule configuration method of any embodiment of this application.

[0132] This application also provides a computer program product, including a computer program / instructions that, when executed by one or more processors, implement the steps of the method described in any embodiment of this application.

[0133] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments of this application can be implemented by a computer program instructing related hardware. This computer program can be stored in a non-volatile readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. The aforementioned storage medium can be a computer-readable storage medium such as a magnetic disk, optical disk, read-only memory (ROM), or random access memory (RAM).

Claims

1. A method for configuring e-commerce risk control rules, characterized in that, include: A pre-trained risk control scoring model is used to infer from sample data containing activity features to obtain a causal dataset containing the activity features and their inference results. Model analysis data is then extracted from the causal dataset using the activity features as the dimension. The rule mining model is trained using the causal dataset and rule mining is performed to generate risk control rules and their evaluation indicators that contain the activity features, thus forming a candidate rule set. The model analysis data and the candidate rule set are input into the large language model, which performs business semantic level reasoning analysis based on the preset reasoning prompt template to generate configuration suggestion information containing recommended risk control rules. In response to a rule configuration instruction triggered by the configuration suggestion information, the risk control rule specified by the instruction is deployed to the risk control strategy engine of the e-commerce platform for risk identification of e-commerce access data containing the activity characteristics.

2. The e-commerce risk control rule configuration method according to claim 1, characterized in that, Model analysis data is extracted from the causal dataset based on the activity features, including at least one of the following: The contribution of each activity feature to the inference result is extracted from the causal dataset and ranked as the feature importance data in the model analysis data; The correlation direction and value distribution between each activity feature and the inference result are extracted from the causal dataset and used as feature influence trend data in the model analysis data. The distribution statistics of each activity feature in the sample space corresponding to the sample data are extracted from the causal dataset and used as the feature distribution data in the model analysis data.

3. The e-commerce risk control rule configuration method according to claim 1, characterized in that, A rule mining model is trained using the causal dataset, and rule mining is performed to generate risk control rules and their evaluation metrics that include the activity features, including: Using the activity features in the causal dataset as input features and the inference results as input, a supervised label is constructed to train a decision tree model, thereby obtaining a fixed decision tree containing multiple leaf nodes; An initial Boolean mask is constructed for each sample in the causal dataset, which consists of activity features and their inference results. The Boolean mask is then propagated down the decision tree layer by layer until a leaf node is reached. At each leaf node, based on the subset of samples identified by the Boolean mask that reaches that leaf node, the sample size and positive sample size corresponding to that leaf node are counted. Among them, samples whose inference results reach a preset threshold are positive samples. The accuracy rate is determined based on the ratio of the number of positive samples to the total sample size. When the sum of the sample sizes of all leaf nodes equals the total sample size of the causal dataset, the partition path corresponding to each leaf node is used as the risk control rule, and the accuracy rate is used as the evaluation index.

4. The e-commerce risk control rule configuration method according to claim 1, characterized in that, The model analysis data and the candidate rule set are input into the large language model, which performs business semantic level reasoning analysis based on a preset reasoning prompt template to generate configuration suggestion information containing recommended risk control rules, including: The model analysis data and the candidate rule set are assembled into structured input data that conforms to the preset reasoning prompt template. The structured input data includes a risk control business context description, a numerical representation of the model analysis data, and conditional expressions and evaluation indicators of each risk control rule in the candidate rule set. The structured input data is input into the large language model, which then interprets the business semantics of each activity feature in the model analysis data according to the causal reasoning instructions set in the preset reasoning prompt template, and performs risk cause analysis on each risk control rule in the candidate rule set. The system receives configuration suggestion information output by the large language model, which includes recommended risk control rules and their reasons for recommendation. The reasons for recommendation include at least one of the following: a description of the risk scenario targeted by the recommended risk control rule, an explanation of the advantages of the recommended risk control rule compared to other risk control rules in the candidate rule set, and activity characteristics that need to be monitored after applying the recommended risk control rule.

5. The e-commerce risk control rule configuration method according to claim 1, characterized in that, In response to a rule configuration command triggered by the configuration suggestion information, the risk control rule specified by the command is deployed to the risk control strategy engine of the e-commerce platform, including: The configuration suggestion information is displayed in a visual interface, which includes the enable control for each risk control rule in the candidate rule set; In response to the rule configuration instruction generated by the activation control being triggered, the target risk control rule and its condition expression specified by the instruction are extracted from the candidate rule set; The conditional expression of the target risk control rule is converted into executable strategy code of the risk control strategy engine and written into the rule base of the risk control strategy engine, so that when the risk control strategy engine subsequently receives e-commerce access data, it can perform risk identification on the e-commerce access data based on the target risk control rule.

6. The e-commerce risk control rule configuration method according to claim 1, characterized in that, In response to a rule configuration instruction triggered by the configuration suggestion information, the risk control rule specified by the instruction is deployed to the risk control strategy engine of the e-commerce platform. This rule is used to perform risk identification on e-commerce access data containing the activity characteristics, including: Periodically obtain the risk identification results generated by the risk control strategy engine based on the deployed risk control rules to perform risk identification on e-commerce access data; Based on the risk identification results, a group stability index is determined for the proportion of risk samples identified by the deployed risk control rules. The group stability index is used to measure the degree of deviation of the current identification proportion from the identification proportion in the baseline period. When the group stability index exceeds the preset offset threshold, the risk control scoring model is retrained using the latest e-commerce access data and its risk identification results as sample data. Then, the step of inferring from the sample data containing activity features using the pre-trained risk control scoring model is restarted.

7. The e-commerce risk control rule configuration method according to any one of claims 1 to 6, characterized in that, The training process of the risk control scoring model includes: The first model is trained by taking each sample of all sample data carrying full activity features as input, and the importance ranking of each activity feature is determined based on the first model. The activity features are removed sequentially in order of importance from low to high. Each removal generates a subset of candidate features. The second model is trained using each subset of candidate features as input. The complexity of the second model is lower than that of the first model. The accuracy attenuation of each second model relative to the first model is obtained. In the candidate feature subset where the accuracy attenuation does not exceed a preset tolerance threshold, the second model corresponding to the candidate feature subset with the fewest active features is determined as the risk control scoring model.

8. An e-commerce risk control rule configuration device, characterized in that, include: The scoring inference module is configured to use a pre-trained risk control scoring model to infer from sample data containing activity features, obtain a causal dataset containing the activity features and their inference results, and extract model analysis data from the causal dataset with the activity features as the dimension. The rule mining module is configured to train a rule mining model using the causal dataset and perform rule mining to generate risk control rules and their evaluation indicators that contain the activity features, thus forming a candidate rule set. The semantic reasoning module is configured to input the model analysis data and the candidate rule set into the large language model, and the large language model performs business semantic level reasoning analysis based on the preset reasoning prompt template to generate configuration suggestion information containing recommended risk control rules. The configuration execution module is configured to respond to rule configuration instructions triggered by the configuration suggestion information, and deploy the risk control rules specified by the instructions to the risk control strategy engine of the e-commerce platform for risk identification of e-commerce access data containing the activity characteristics.

9. An electronic device comprising a central processing unit and a memory, characterized in that, The central processing unit is used to invoke and run a computer program stored in the memory to perform the steps of the method as described in any one of claims 1 to 7.

10. A non-volatile readable storage medium, characterized in that, It stores, in the form of computer-readable instructions, a computer program implemented according to any one of claims 1 to 7, which, when invoked by a computer, executes the steps included in the corresponding method.

Images