Information determination method and device, equipment, storage medium and program product

Abstract

The application discloses a kind of information determination method, device, equipment, storage medium and program product, related to network security technical field, which comprises: obtaining target transaction system target payment evidence information, the first payment evidence information of known abnormal first transaction system and the second payment evidence information of known normal second transaction system;Utilize target payment evidence information, first payment evidence information and second payment evidence information, construct dynamic heterogeneous graph;Calculate the first total pressure value received from the adjacent node of target node, according to the first total pressure value, update the first abnormal pressure value of target node using preset update rule, obtain the second abnormal pressure value of target node;Determine the target node of second abnormal pressure value greater than preset pressure value as abnormal node;Determine the target payment evidence information corresponding to abnormal node as abnormal information. That is, the accuracy of abnormal information determination is improved by determining abnormal information between information.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a method, apparatus, device, computer-readable storage medium, and computer program product for determining information. Background Technology

[0002] With the rapid popularization and development of internet technology and e-commerce, online transactions have become one of the main ways for users to consume daily. At the same time, the e-commerce sector constantly faces various cybersecurity risks, such as the illegal theft of transaction funds and account information from unsuspecting internet users. These security risks are constantly evolving with technological iterations and upgraded attack methods, leading to the proliferation of various systems used to carry out abnormal transactions, such as fake shopping websites. Therefore, how to identify abnormal information involved in a transaction system is an urgent problem to be solved.

[0003] In existing technologies, mainstream cybersecurity protection systems primarily focus on building traditional cybersecurity models and identifying anomalies based on these models. Examples include classifiers based on Uniform Resource Locators (URLs), semantic analysis models based on page content, brand comparison models based on visual similarity, browser-embedded security services, and domain reputation list systems, all of which are used to identify anomalies in transaction systems.

[0004] However, existing technologies can only identify known anomalies. When facing detection and protection against certain transaction systems, because these systems aim to complete genuine transactions, their page structures are complete and fully functional, they generally integrate legitimate third-party payment gateways, and display detailed product catalogs, user reviews, logistics information, etc. Therefore, for this type of transaction system, there may not be any known anomalies, making it difficult to accurately determine the anomalies involved. Summary of the Invention

[0005] This application provides a method, apparatus, device, computer-readable storage medium, and computer program product for determining information, which can accurately determine abnormal information involved in a transaction system.

[0006] In a first aspect, embodiments of this application provide a method for determining information, including: Obtain target payment evidence information of the target transaction system, first payment evidence information of the first transaction system known to be abnormal, and second payment evidence information of the second transaction system known to be normal; Using target payment evidence information, first payment evidence information and second payment evidence information, a dynamic heterogeneous graph is constructed. Multiple nodes in the dynamic heterogeneous graph are marked with a preset first abnormal pressure value. The first abnormal pressure value of the node corresponding to the first payment evidence information is greater than the first abnormal pressure value of the node corresponding to the second payment evidence information. For each target node among multiple nodes, calculate the first total pressure value received from the nodes adjacent to the target node, and update the first abnormal pressure value of the target node according to the first total pressure value using a preset update rule to obtain the second abnormal pressure value of the target node. Among multiple nodes, the target node whose second abnormal pressure value is greater than the preset pressure value is identified as the abnormal node; The target payment evidence information corresponding to the abnormal node is identified as abnormal information.

[0007] In one possible implementation, obtaining target payment evidence information from the target transaction system includes: Obtain domain characteristic information corresponding to multiple domains; The domain name feature information is input into the trained classifier, and the trained classifier is used to determine the target domain name belonging to the target category. Obtain the target payment evidence information of the target transaction system under the target domain.

[0008] In one possible implementation, obtaining target payment evidence information of the target transaction system under the target domain name includes: Simulate user transaction behavior in the target transaction system under the target domain; When the transaction action involves clicking the target control, obtain the network request information of the target transaction system. The network request information includes the target payment evidence information of the target transaction system.

[0009] In one possible implementation, the transaction behavior includes clicking a link of a preset category, adding the transaction target to the transaction list, and clicking the target control; simulating user transaction behavior in a target transaction system under a target domain includes: Start the target transaction system under the target domain name; Once the target trading system's page has finished loading, identify at least one link in the preset category on the page; Click on a link randomly to access the transaction page of the corresponding transaction target; Use the transaction page to add the corresponding transaction target to the transaction list; Clicking the target control in the transaction list simulates the user's transaction behavior in the target transaction system under the target domain.

[0010] In one possible implementation, the transaction page is used to add the transaction target corresponding to the link to the transaction list, including: Identify interactive page elements on the transaction page; Get a screenshot of the transaction page; Identify preset text elements from the page elements marked in the screenshot; Click on the preset text element on the trading page to add the linked trading target to the trading list.

[0011] In one possible implementation, a dynamic heterogeneous graph is constructed using target payment evidence information, first payment evidence information, and second payment evidence information, including: Nodes are constructed using multiple sub-payment evidence information in the target payment evidence information, multiple sub-payment evidence information in the first payment evidence information, and multiple sub-payment evidence information in the second payment evidence information. Edges are constructed using the relationship types between multiple sub-payment evidence information to obtain a dynamic heterogeneous graph.

[0012] In one possible implementation, each edge in the dynamic heterogeneous graph is configured with a weight; for each target node among multiple nodes, a first total pressure value received from the nodes adjacent to the target node is calculated; based on the first total pressure value, a first abnormal pressure value of the target node is updated using a preset update rule to obtain a second abnormal pressure value of the target node, including: For each target node among multiple nodes, based on the weight of the edges between the target node and its neighboring nodes, the first total pressure value received from the neighboring nodes of the target node is calculated. Based on the first total pressure value, the first abnormal pressure value of the target node is updated using a preset update rule to obtain the second abnormal pressure value of the target node.

[0013] In one possible implementation, before calculating the first total pressure value received from the nodes adjacent to the target node based on the weights of the edges between the target node and its adjacent nodes, the method further includes: Based on the preset relationship types and weight configuration rules, determine the target weight configuration rules for each edge in the dynamic heterogeneous graph; Configure the weight of each edge in the dynamic heterogeneous graph according to the target weight configuration rules.

[0014] In one possible implementation, the weight of each edge in the dynamic heterogeneous graph is configured according to the target weight configuration rules, including: The initial weights of each edge in the dynamic heterogeneous graph are determined according to the target weight configuration rules. Get the first moment when the edge corresponding to each relation type was last added, and the second moment when the initial weights were obtained; For each relation type, determine the time decay factor based on the first time point and the second time point respectively; For each edge corresponding to each relation type, the weight is determined based on the time decay factor and the initial weight.

[0015] In one possible implementation, determining a target node among multiple nodes whose second abnormal pressure value is greater than a preset pressure value as an abnormal node includes: If the difference between the first abnormal pressure value and the second abnormal pressure value of the target node is greater than a preset threshold, calculate the second total pressure value received from the adjacent nodes of the target node. Based on the second total pressure value, update the second abnormal pressure value of the target node using a preset update rule to obtain the third abnormal pressure value of the target node. If the difference between the second and third abnormal pressure values ​​of the target node is not greater than a preset threshold, the target node with a third abnormal pressure value greater than the preset pressure value among multiple nodes is identified as an abnormal node.

[0016] In one possible implementation, after determining that the target payment evidence information corresponding to the anomalous node is anomalous, the method further includes: Obtain process information and preset prompt word templates for identifying abnormal information; Write the process information into the preset prompt word template to obtain the target prompt word; The target prompt is input into the large language model to obtain the inference result corresponding to the target prompt, which includes the risk level and the cause of the risk.

[0017] Secondly, embodiments of this application provide an information determining apparatus, comprising: The acquisition module is used to acquire target payment evidence information of the target transaction system, first payment evidence information of the first transaction system known to be abnormal, and second payment evidence information of the second transaction system known to be normal. The construction module is used to construct a dynamic heterogeneous graph using the target payment evidence information, the first payment evidence information, and the second payment evidence information. Multiple nodes in the dynamic heterogeneous graph are marked with a preset first abnormal pressure value. The first abnormal pressure value of the node corresponding to the first payment evidence information is greater than the first abnormal pressure value of the node corresponding to the second payment evidence information. The calculation module is used to calculate the first total pressure value received from the neighboring nodes of the target node for each of the multiple nodes, and update the first abnormal pressure value of the target node according to the first total pressure value using a preset update rule to obtain the second abnormal pressure value of the target node. The determination module is used to determine that among multiple nodes, the target node whose second abnormal pressure value is greater than a preset pressure value is an abnormal node. The determination module is also used to determine whether the target payment evidence information corresponding to the abnormal node is abnormal information.

[0018] Thirdly, embodiments of this application provide an electronic device, the device comprising: A processor and a memory storing computer program instructions; a method for determining the information that the processor implements when executing computer program instructions.

[0019] Fourthly, embodiments of this application provide a computer storage medium on which computer program instructions are stored, and a method for determining the information described above when the computer program instructions are executed by a processor.

[0020] Fifthly, embodiments of this application provide a computer program product in which instructions, when executed by a processor of an electronic device, enable the electronic device to execute the aforementioned method for determining information.

[0021] The information determination method, apparatus, device, computer-readable storage medium, and computer program product of this application embodiment utilize information to be determined as abnormal to construct a dynamic heterogeneous graph with known normal or abnormal information, and calculate the pressure value received from the node corresponding to the information to be determined as abnormal by using the dynamic heterogeneous graph, thereby determining whether the information to be determined as abnormal is abnormal. That is, abnormal information is determined by the correlation between information from different transaction systems, which improves the accuracy of abnormal information determination. Attached Figure Description

[0022] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0023] Figure 1 This is a flowchart illustrating a method for determining information provided in one embodiment of this application; Figure 2 This is a flowchart illustrating a method for determining information provided in another embodiment of this application; Figure 3 This is a flowchart illustrating a method for determining information provided in yet another embodiment of this application; Figure 4 This is a flowchart illustrating a simulated trading activity provided in another embodiment of this application; Figure 5 This is a flowchart illustrating a method for determining information provided in another embodiment of this application; Figure 6This is a flowchart illustrating the configuration weights provided in another embodiment of this application; Figure 7 This is a schematic diagram of the structure of an information determining device provided in another embodiment of this application; Figure 8 This is a schematic diagram of the structure of an electronic device provided in another embodiment of this application. Detailed Implementation

[0024] The features and exemplary embodiments of various aspects of this application will be described in detail below. To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain this application and not to limit it. For those skilled in the art, this application can be implemented without some of these specific details. The following description of the embodiments is merely to provide a better understanding of this application by illustrating examples.

[0025] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising..." does not exclude the presence of additional identical elements in the process, method, article, or apparatus that includes said element.

[0026] It should be noted that the acquisition, storage, use, and processing of data in this application embodiment all comply with the relevant provisions of national laws and regulations.

[0027] It should be noted that in the embodiments of this application, certain software, components, models and other existing solutions in the industry may be mentioned. These should be regarded as exemplary and are only intended to illustrate the feasibility of implementing the technical solution of this application. However, it does not mean that the applicant has used or necessarily used the solution.

[0028] As described in the background section, existing technologies struggle to accurately identify anomalous information corresponding to seemingly normal but abnormal trading systems, resulting in high false positive and false negative rates. Therefore, to address these issues, this application provides a method, apparatus, device, computer-readable storage medium, and computer program product for determining information. This application utilizes information to be determined as abnormal to construct a dynamic heterogeneous graph with known normal or abnormal information. Through this dynamic heterogeneous graph, it calculates the pressure values ​​received from the nodes corresponding to the information to be determined as abnormal, thereby determining whether the information to be determined as abnormal is indeed abnormal. In other words, by identifying anomalous information through the correlation between information from different trading systems, the accuracy of anomalous information determination is improved.

[0029] The method for determining information provided in the embodiments of this application will be described in detail below.

[0030] like Figure 1 As shown, the method for determining information provided in this application embodiment includes the following steps S110 to S150.

[0031] S110. Obtain the target payment evidence information of the target transaction system, the first payment evidence information of the first transaction system known to be abnormal, and the second payment evidence information of the second transaction system known to be normal.

[0032] The target transaction system refers to the transaction system for which it is to be determined whether there is any abnormal information. The target payment evidence information includes multiple sub-payment evidence information for which it is to be confirmed whether they are abnormal.

[0033] In some embodiments, transaction information of the target transaction system is obtained by simulating user transaction behavior within the target transaction system. For example, the transaction information may be network request information. Target payment evidence information of the target transaction system is then obtained from the transaction information. For example, the target payment evidence information may include the merchant identity (ID), domain name, and the target transaction system's Uniform Resource Locator (URL).

[0034] In some embodiments, an anomaly information list is obtained, which includes first payment evidence information from a first transaction system with known anomalies. The first payment evidence information is the source of the abnormal pressure value.

[0035] In some embodiments, a normal information list is obtained, which includes second payment evidence information of a known normal second transaction system. The second payment evidence information represents a "low point" of abnormal pressure values.

[0036] In some embodiments, a first target information is received from a first target device, the first target information including a list of abnormal information. Receive second target information sent by the second target device. The second target information includes a list of normal information. .

[0037] The first target device can be a device belonging to a financial institution or a pre-set device, and the second target device can be a device under a verified pre-set domain name.

[0038] In some embodiments, the normal information list includes preset sub-payment evidence information. For example, the preset sub-payment evidence information is a preset merchant ID.

[0039] S120. Using the target payment evidence information, the first payment evidence information, and the second payment evidence information, a dynamic heterogeneous graph is constructed. Multiple nodes in the dynamic heterogeneous graph are marked with a preset first abnormal pressure value. The first abnormal pressure value of the node corresponding to the first payment evidence information is greater than the first abnormal pressure value of the node corresponding to the second payment evidence information.

[0040] In some embodiments, the first payment evidence information and the second payment evidence information are used as seed nodes. A dynamic heterogeneous graph is constructed, consisting of target payment evidence information, first payment evidence information, and second payment evidence information. Each sub-payment evidence information in the target payment evidence information, first payment evidence information, and second payment evidence information is treated as a node, and multiple nodes in the dynamic heterogeneous graph are respectively marked with a preset first abnormal pressure value.

[0041] The preset first abnormal pressure value is pre-set according to actual needs. The first abnormal pressure value of the node corresponding to the first payment evidence information is greater than the first abnormal pressure value of the node corresponding to the second payment evidence information.

[0042] In one example, the first abnormal pressure value of the node corresponding to the first payment evidence information is 1, and the first abnormal pressure value of the node corresponding to the second payment evidence information is 0.

[0043] It should be noted that the first abnormal pressure value of the node corresponding to the first payment evidence information is the same, and the first abnormal pressure value of the node corresponding to the second payment evidence information is the same.

[0044] In some embodiments, the first abnormal pressure value of the node corresponding to the first payment evidence information is greater than the first abnormal pressure value of the node corresponding to the target payment evidence information, and the first abnormal pressure value of the node corresponding to the target payment evidence information is greater than the first abnormal pressure value of the node corresponding to the second payment evidence information. For example, the first abnormal pressure value of the node corresponding to the target payment evidence information is 0.1.

[0045] In some embodiments, the first abnormal pressure value of the node corresponding to the target payment evidence information is greater than the first abnormal pressure value of the node corresponding to the first payment evidence information, and the first abnormal pressure value of the node corresponding to the first payment evidence information is greater than the first abnormal pressure value of the node corresponding to the second payment evidence information.

[0046] In some embodiments, the first abnormal pressure value of the node corresponding to the first payment evidence information is greater than the first abnormal pressure value of the node corresponding to the second payment evidence information, and the first abnormal pressure value of the node corresponding to the second payment evidence information is greater than the first abnormal pressure value of the node corresponding to the target payment evidence information.

[0047] S130. For each target node among multiple nodes, calculate the first total pressure value received from the adjacent nodes of the target node, and update the first abnormal pressure value of the target node according to the first total pressure value using a preset update rule to obtain the second abnormal pressure value of the target node.

[0048] In some embodiments, the diffusion of anomalous attributes is simulated through an iterative propagation process. Multiple nodes in the dynamic heterogeneous graph are each marked with a preset first anomalous pressure value, which is used as the initial anomalous pressure value. For each target node among multiple nodes. Calculate from the target node Adjacent nodes Upon receiving the first total pressure value, the target node is updated using a preset update rule. First abnormal pressure value , obtain the target node The second abnormal pressure value ensures that pressure can propagate from the seed set to the entire graph.

[0049] In some embodiments, for each target node among a plurality of nodes Calculate the target node Adjacent nodes Initial abnormal pressure value The average value is used as the target node. From adjacent nodes The first total pressure value received.

[0050] In some embodiments, for each target node among a plurality of nodes Calculate the target node Adjacent nodes Initial abnormal pressure value The weighted sum is used as the target node. From adjacent nodes The first total pressure value received.

[0051] In some embodiments, the target node is updated based on the received first total pressure value. The pressure state. The preset update rule introduces nonlinearity to simulate the cumulative effect of risk and the threshold characteristic of "quantitative change to qualitative change".

[0052] In one example, based on the first total pressure value, the first abnormal pressure value of the target node is updated using the preset update rule shown in the following formula (1), to obtain the second abnormal pressure value of the target node: (1) in, This represents the second abnormal pressure value of the target node; It is a user-defined saturated growth function with a range of [0,1), for example... This function simulates a slow increase in risk when the abnormal pressure value is small; when the abnormal pressure value is strong enough, the risk increases sharply and gradually saturates to 1. The parameters... Control the rate of this saturation process; This represents the damping factor, used to control the trade-off between new evidence and historical conditions; Indicates the first total pressure value; This represents the first abnormal pressure value of the target node.

[0053] It should be noted that the second abnormal pressure value can be the abnormal pressure value obtained after calculating the first total pressure value K+1 times and updating the abnormal pressure value of the target node K+1 times, that is, the abnormal pressure value obtained after repeating the S130 step K+1 times.

[0054] S140. Among multiple nodes, the target node whose second abnormal pressure value is greater than the preset pressure value is identified as an abnormal node.

[0055] In some embodiments, the second abnormal pressure value of each target node is compared with a preset pressure value to determine that among multiple nodes, the target node whose second abnormal pressure value is greater than the preset pressure value is an abnormal node.

[0056] In some embodiments, the preset pressure value may be set based on the first abnormal pressure value of the node corresponding to the target payment evidence information. When the first abnormal pressure value of the node corresponding to the first payment evidence information is greater than the first abnormal pressure value of the node corresponding to the target payment evidence information, and the first abnormal pressure value of the node corresponding to the target payment evidence information is greater than the first abnormal pressure value of the node corresponding to the second payment evidence information, the preset pressure value may be a value between the first abnormal pressure values ​​of the first and second payment evidence information nodes. For example, the preset pressure value is 0.85. When the first abnormal pressure value of the node corresponding to the target payment evidence information is greater than the first abnormal pressure value of the node corresponding to the first payment evidence information, and the first abnormal pressure value of the node corresponding to the first payment evidence information is greater than the first abnormal pressure value of the node corresponding to the second payment evidence information, the preset pressure value may be a value greater than the first abnormal pressure value of the node corresponding to the first payment evidence information. For example, if the first abnormal pressure value of the node corresponding to the target payment evidence information is 5, the preset pressure value is 5.8.

[0057] S150. Determine that the target payment evidence information corresponding to the abnormal node is abnormal information.

[0058] In some embodiments, since each sub-payment evidence information in the target payment evidence information, the first payment evidence information, and the second payment evidence information is treated as a node, the target sub-payment evidence information corresponding to the abnormal node can be identified as abnormal information.

[0059] This application embodiment utilizes information to determine whether it is abnormal to construct a dynamic heterogeneous graph with known normal or abnormal information. Through the dynamic heterogeneous graph, it calculates the pressure value received from the nodes corresponding to the information to be determined as abnormal, thereby determining whether the information to be determined as abnormal is abnormal. That is, abnormal information is determined by the correlation between information from different transaction systems, which improves the accuracy of abnormal information determination.

[0060] In some embodiments, such as Figure 2 As shown, in the above S110, obtaining the target payment evidence information of the target transaction system may include S111 to S113.

[0061] S111. Obtain domain characteristic information corresponding to multiple domains.

[0062] In some embodiments, multiple domain names are obtained. For each domain name, domain name feature information is obtained. This domain name feature information may include, but is not limited to, Deep Packet Inspection (DPI) data, WHOIS records, website content, and a visual snapshot of the website homepage.

[0063] In some embodiments, domain characteristic information corresponding to multiple domains is obtained at preset time intervals. For example, domain characteristic information corresponding to multiple domains is obtained daily.

[0064] In some embodiments, a preset domain name list is obtained, which includes preset domain names; an initial domain name is obtained, and domain names that match the preset domain names are removed from the initial domain name list to obtain multiple domain names.

[0065] In some embodiments, domains of a preset domain type are removed from the initial domain to obtain multiple domains.

[0066] In some embodiments, considering that a large number of newly registered domains may initially be inactive or have not yet hosted any abnormal transaction systems, it is possible to obtain domain characteristic information corresponding to multiple domains with a registration duration longer than a preset duration. This helps to more accurately assess currently operating and functioning transaction systems. For example, the preset duration is 14 days.

[0067] S112. Input the domain name feature information into the trained classifier, and use the trained classifier to determine the target domain name belonging to the target category.

[0068] The classifier can be a Lightweight Gradient Boosting Machine (LightGBM), an Extreme Gradient Boosting (XGBoost) model, etc., and is not specifically limited in this embodiment.

[0069] In some embodiments, domain name feature information is input into a trained classifier, which is then used to identify target domain names belonging to the target category. The target category is an anomaly category. The target transaction system under the target domain name may be anomaly-prone.

[0070] S113. Obtain the target payment evidence information of the target transaction system under the target domain.

[0071] In some embodiments, if a target domain belonging to a target category is identified, target payment evidence information of the target transaction system under the target domain is obtained. The target transaction system may be a web application system, i.e., a transaction website.

[0072] This application embodiment identifies target transaction systems under potentially abnormal target domains by using domain name feature information, thereby quickly obtaining target payment evidence information of the target transaction system and accurately determining abnormal information.

[0073] In some embodiments, such as Figure 3As shown, S113 can specifically include S210 to S220.

[0074] S210, Simulate user transaction behavior in the target transaction system under the target domain name.

[0075] In some embodiments, if a target domain name belonging to the target category is identified, the user enters the page of the target transaction system under the target domain name and simulates the user's transaction behavior on the page of the target transaction system.

[0076] S220. When the transaction behavior is clicking the target control, obtain the network request information of the target transaction system, which includes the target payment evidence information of the target transaction system.

[0077] In some embodiments, a transaction includes multiple actions, which are executed sequentially. Clicking the target control is the last of these actions, and the target control can be a payment control. When the transaction involves clicking the target control, a high-performance network request listener is activated to capture all Hypertext Transfer Protocol (HTTP) / Hypertext Transfer Protocol Secure (HTTPS) requests generated by the target transaction system. This listener is then used to track and parse redirects to the payment gateway using filtering and parsing algorithms, obtaining network request information from the target transaction system. This network request information includes the target payment evidence information of the target transaction system.

[0078] In some embodiments, in the captured HTTP / HTTPS request sequence In the process, requests whose domains belong to known payment service providers are filtered out, forming a request set. .for For each request (req) in the process, a deep scan is performed on its URL query parameters, POST data body, and HTTP Referer header. Target payment evidence information, such as the merchant ID, typically exists as specific parameter names (e.g., "merchant_id", "business", "seller_id"). The scanned target payment evidence information is then bound to the URL of the original page that triggered the request to form the target payment evidence information for the target transaction system. For example, the target payment evidence information is... , This represents the URL of the original page. Indicates the merchant ID. Indicates payment service provider, A timestamp for generating the target payment evidence information.

[0079] Understandably, the domain name can be obtained through HTTP / HTTPS requests. The original page is the page initially displayed by the target trading system.

[0080] In some embodiments, the domain name can also be used to resolve the IP address and obtain the email address used to register the domain. Target payment evidence information may also include the IP address and email address.

[0081] In some embodiments, to ensure robustness, the transaction simulation process is repeated multiple times for each original page URL to effectively reduce the potential risk of failure due to factors such as stock shortages of the transaction target or incorrect button selection.

[0082] In some embodiments, for Before performing authentication on each request (req), a deep scan of its URL query parameters, POST data body, and HTTP Referer header is conducted. For example, authentication is performed on a payment processor.

[0083] In some embodiments, network request information may also include performance logs.

[0084] This application's embodiments, by simulating the transaction behavior of real users, can accurately obtain target payment evidence information from the target transaction system, reducing the problem of inaccurate identification of abnormal information caused by relying on easily forged static features. By simulating the transaction behavior of real users, this application's embodiments can bypass client-side anti-scraping mechanisms, reliably track the transaction endpoint, and extract key payment evidence information.

[0085] In some embodiments, transaction actions include clicking a link of a preset category, adding a transaction target to a transaction list, and clicking a target control; such as Figure 4 As shown, S210 can specifically include S211 to S215.

[0086] S211. Start the target transaction system under the target domain name.

[0087] In some embodiments, when a target domain name belonging to the target category is identified, the target transaction system under the target domain name is launched, the page of the target transaction system under the target domain name is entered, and the user's transaction behavior is simulated on the page of the target transaction system.

[0088] In one example, the target trading system under the target domain is opened in a browser that supports Selenium. Selenium is an open-source web automation testing toolkit that can automatically control the browser to simulate real user access, clicks, input, and submission. It is commonly used for web content scraping, page load verification, functional automation testing, and website behavior monitoring.

[0089] S212. Once the target transaction system's page has finished loading, identify at least one link in a preset category on the page.

[0090] In some embodiments, after entering the target transaction system page under the target domain, the system waits for the page to finish loading. Once the target transaction system page has finished loading, at least one link of a preset category on the page is identified.

[0091] In some embodiments, considering that the target transaction system typically displays promotional information to first-time visitors, after opening the target transaction system under the target domain, wait for any pop-up modal windows to appear. Use an Automatic Controller (AC) to check the source code of the target transaction system for the presence of CSS classes for modal windows to identify these pop-ups. After a preset time, such as a few seconds, the AC will randomly click on an edge area of ​​the page to attempt to close the pop-up window, allowing the target transaction system page to complete loading.

[0092] In some embodiments, AC also executes JavaScript tags on the page to ensure that all page resources have been successfully loaded.

[0093] In some embodiments, XML Path Language (XPath) is used to query and collect all link elements on the target transaction system's page. Each link element contains multiple attributes, such as a class name, or optional attributes like "class=product". Using Access Controller (AC), each link element is checked for keywords (such as "prod" or "product"), and these keywords are added to a statistics list. The statistics list includes at least one link in a preset category and the corresponding keyword. Links in the preset category are links that lead to the transaction page of the target transaction.

[0094] In some embodiments, a list of preset keywords is obtained, which includes multiple preset keywords. For example, the preset keywords included in the list of preset keywords are: search, story, and live.

[0095] By using a pre-defined keyword list, external links and links related to their paths that are not in the pre-defined categories, as well as the keywords associated with those links, can be removed from the statistical list, thereby improving the efficiency of simulating transaction behavior.

[0096] S213. Click on a link randomly to enter the transaction page of the corresponding transaction target.

[0097] In some embodiments, a script is used to randomly select and click links in a statistics list to navigate to the transaction page of the corresponding transaction target.

[0098] In some embodiments, links are clicked repeatedly to enhance the diversity of interaction. The number of times the same link is clicked does not exceed a preset number. For example, the preset number is 10 times.

[0099] S214. Using the transaction page, add the corresponding transaction target to the transaction list.

[0100] In some embodiments, the transaction page displays at least one transaction target. If the transaction page includes a form element (e.g., a dropdown menu) for selecting at least one transaction target, any one of the at least one transaction target can be randomly selected and clicked, or the target content can be filled in.

[0101] Specifically, for content that needs to be selected in form elements, the selection of transaction target variations (such as size and color) is automated through interaction with dropdown menus and clickable elements. For content that needs to be filled, each input field in the form... Based on its HTML type, name, and placeholder, from a pre-built, semantically consistent test data dictionary Select and fill in the content. For example, for the field name="email", fill in test@example.com; for the field name="address", fill in a dummy but correctly formatted address. Loop through all available option-based HTML elements and randomly select or fill in content. After completing the iteration of all available options for a given transaction target, click the add control on the transaction page to add the linked transaction target to the transaction list. For example, the add control could be the "Add to Cart" control.

[0102] It should be noted that in this embodiment, all actions are implemented by script execution.

[0103] S215. Click the target control in the transaction list to simulate the user's transaction behavior in the target transaction system under the target domain.

[0104] In some embodiments, the transaction list is opened, and a target control in the transaction list is detected and clicked to simulate the user's transaction behavior in the target transaction system under the target domain. The target control can be a payment control.

[0105] In some embodiments, the target control can also be a quick payment control. If a quick payment control option is available, this function will be used directly to quickly simulate the user's transaction behavior in the target transaction system under the target domain, thereby efficiently obtaining payment evidence information. This ensures both comprehensive data collection and the ability to flexibly adapt to changes in different transaction system structures and payment processes.

[0106] In some embodiments, if the target control in the transaction list is not detected, a form element is detected. Required form fields are filled in the form element to make the target control appear in the transaction list.

[0107] This application's embodiments simulate user transaction behavior in a target transaction system under a target domain by executing stateful, multi-step interactive tasks. It simulates a complete transaction process, such as closing pop-ups, selecting transaction targets, filling out forms, adding transactions to the transaction list, and completing payments. It shifts from static features to dynamic behavior analysis, achieving highly realistic dynamic behavior simulation. It penetrates front-end interference and directly captures payment evidence information, reducing the problem of inaccurate identification of abnormal information caused by relying on easily forged static features.

[0108] In some embodiments, S214 may specifically include: Identify interactive page elements on the transaction page; Get a screenshot of the transaction page; Identify preset text elements from the page elements marked in the screenshot; Click on the preset text element on the trading page to add the linked trading target to the trading list.

[0109] The preset text element is the text element identified by the added control.

[0110] In this embodiment, for the transaction page, an element location strategy based on visual and semantic fusion is used to find interactive page elements. Obtain a screenshot of the transaction page. Use a computer vision object detection model (such as YOLO) to perform image recognition on the screenshot, and combine this with a natural language processing model to classify the intent of anchor text (such as "Add to Cart," "Buy Now," etc.) to jointly determine the preset text elements. Preset text elements The decision function is shown in formula (2): (2) in, It is the probability that element e, given by the visual model, is the desired icon. It is the degree of matching between element e (text) and transaction intent, given by the natural language processing model. For weighting coefficients, I represents the preset image, and T represents the preset transaction intent text.

[0111] This application embodiment can quickly identify and locate the added control by recognizing preset text elements, so as to quickly add the transaction target corresponding to the link to the transaction list.

[0112] In some embodiments, the above-described S120 may specifically include: Nodes are constructed using multiple sub-payment evidence information in the target payment evidence information, multiple sub-payment evidence information in the first payment evidence information, and multiple sub-payment evidence information in the second payment evidence information. Edges are constructed using the relationship types between multiple sub-payment evidence information to obtain a dynamic heterogeneous graph.

[0113] In some embodiments, nodes are constructed using multiple sub-payment evidence information in the target payment evidence information, multiple sub-payment evidence information in the first payment evidence information, and multiple sub-payment evidence information in the second payment evidence information. Edges are constructed using the relationship types between the multiple sub-payment evidence information to obtain a dynamic heterogeneous graph. Where V is the set of nodes, E is the set of edges, and A is the node attribute matrix. It is a node type mapping function. This is an edge type mapping function. Node type. This includes multiple sub-payment evidence pieces within the target payment evidence information, multiple sub-payment evidence pieces within the first payment evidence information, and multiple sub-payment evidence pieces within the second payment evidence information, such as "Domain", "MerchantID", "IP address", "Email", and "URL". (Side type) This includes relationship types between multiple sub-payment evidence information, such as "Uses" for the merchant ID used by the domain, "Resolves_to" for the IP address obtained from the domain resolution, and "Registered_by" for the email address used to register the domain. In this way, not only are domain names and merchant IDs associated, but entities such as IP addresses and email addresses are also introduced, quantifying the strength and timeliness of the association and enabling systematic modeling of abnormal information.

[0114] In some embodiments, the initial dynamic heterogeneous graph is constructed from historical data. Each node v is accompanied by a feature vector. For a "domain name" node, its features may include domain age, WHOIS information entropy, etc.; for a "merchant ID" node, its features may include the number of associated domain names, transaction activity, etc. Based on the initial dynamic heterogeneous graph, nodes constructed from multiple sub-payment evidence information in the target payment evidence information, multiple sub-payment evidence information in the first payment evidence information, and multiple sub-payment evidence information in the second payment evidence information are added to the initial dynamic heterogeneous graph, and edges constructed from the relationship types between the multiple sub-payment evidence information are obtained, thus obtaining the dynamic heterogeneous graph.

[0115] It should be noted that the dynamic heterogeneity map is not static, but rather a dynamic map that evolves over time t. Dynamic heterogeneous graph updates are triggered at fixed time intervals (e.g., every 24 hours) or by new evidence events (e.g., newly acquired target payment evidence information). When new payment evidence information... Upon arrival, if or Does not exist If so, create the corresponding node; create an edge of type "Use". .in, Represents a URL. Indicates the merchant ID. Indicates payment service provider, The timestamp used to generate payment evidence information.

[0116] This application's embodiments transform discrete payment evidence information into a structured knowledge network, constructing a multi-dimensional, time-evolving dynamic heterogeneous graph to reveal abnormal information across domain names and transaction systems, thus achieving systematic modeling of abnormal information.

[0117] In some embodiments, each edge in the dynamic heterogeneous graph is configured with a weight; such as Figure 5 As shown, the above-mentioned S130 may specifically include: S131. For each target node among multiple nodes, calculate the first total pressure value received from the adjacent nodes of the target node based on the weight of the edge between the target node and the adjacent nodes of the target node. According to the first total pressure value, update the first abnormal pressure value of the target node using a preset update rule to obtain the second abnormal pressure value of the target node.

[0118] In some embodiments, each edge in the dynamic heterogeneous graph is configured with a weight. Each edge type can correspond to a different weight, which can be pre-set according to actual conditions. For example, the association between domain name and merchant ID is stronger, so the weight is greater. Using a multi-relationship anomaly pressure propagation model, for each target node among multiple nodes, based on the weight of the edges between the target node and its adjacent nodes, a first total pressure value received from the adjacent nodes of the target node is calculated. Based on the first total pressure value, the first anomaly pressure value of the target node is updated using a preset update rule to obtain the second anomaly pressure value of the target node.

[0119] In some embodiments, the weights can also be automatically configured based on preset relationship types and weight configuration rules. In each repeated iteration of S131, each node receives pressure values ​​from all its neighbors, but the pressure values ​​are differentially weighted according to relationship type and connection strength. The first total pressure value received in the (K+1)th iteration It can be expressed using the following formula (3): (3) in, Through relation type r and Connected neighbor set, It is the edge The weight, It is with nodes Connected nodes The first abnormal pressure value. This is the relationship type propagation coefficient that the model needs to learn. It quantifies the relative importance of different types of edges in propagating pressure. For example, the pressure transmitted by a domain using an abnormal merchant ID should be far greater than the pressure transmitted by it simply resolving to the same IP as another abnormal domain.

[0120] In some embodiments, through constraints Make it a distribution, The constraint is between 0 and 1. This application embodiment learns the relation propagation coefficient by minimizing the cross-entropy loss on known labeled nodes (seed set). The loss function of formula (4) is optimized by gradient descent so that the model can automatically learn which relationship (such as shared merchant ID or shared registration email) is the strongest signal for judging anomalies in the current abnormal ecosystem.

[0121] (4) in, Represents the set of known label nodes. The actual label (normal or abnormal). This represents the second abnormal pressure value obtained in the Kth iteration. This represents the penalty parameter.

[0122] This application's embodiments simulate the spread of risks and anomalies in the network through multi-relation weighted propagation and nonlinear state updates, improving the ability to identify large-scale, cross-platform anomaly information. It can not only identify anomaly information of a single transaction system, but also reveal its underlying operating model and organizational structure, and provide users with real-time risk alerts, thus ensuring the security of user information.

[0123] In some embodiments, such as Figure 6 As shown, before S130 above, the method further includes S310 to S320.

[0124] S310. Based on the preset relationship type and weight configuration rules, determine the target weight configuration rules for each edge in the dynamic heterogeneous graph.

[0125] In some embodiments, edge weight It is a connection node and The strength of relation type r is quantified. It needs to reflect the strength of the association. For each relation type r, the target weight configuration rule is determined according to the relationship between the preset relation type and the weight configuration rule, and then the target weight configuration rule for each edge in the dynamic heterogeneous graph is obtained.

[0126] Specifically, the relationship between the preset relationship types and weight configuration rules is as follows: a) For the "Uses" (domain name using merchant ID) relationship, the weight configuration rule is as shown in the following formula (5): (5) in, Indicates weight, Within the observation window, the domain name node via merchant ID node The number of successful transactions initiated. A logarithmic function is used to prevent a few edges with extremely high transaction frequency from dominating the entire graph, while maintaining the relative diversity of weights.

[0127] b) For the "Registered_by" relationship (domain name registered to email address), the weight configuration rule is as shown in the following formula (6): (6) in, Indicates weight, This is the email node. The total number of registered domains. This design could suggest bulk registration; the more domains an email address registers, the lower its association weight with a single domain becomes, because this association might be automated and non-specific.

[0128] c) For the "Resolves_to" (domain name to IP) relationship, the weight configuration rule is as shown in the following formula (7): (7) in, Indicates weight, It resolves to the node of this IP address. The total number of domain names. This design is because if an IP address is shared by a large number of domain names, its association with a single domain name becomes less specific.

[0129] S320. Configure the weight of each edge in the dynamic heterogeneous graph according to the target weight configuration rules.

[0130] In some embodiments, for each edge corresponding to a relation type, the weight is configured according to the target weight configuration rule corresponding to the relation type, thereby obtaining the weight of each edge in the dynamic heterogeneous graph.

[0131] This application embodiment takes into account that the propagation pressure between different types of nodes depends on the type of association. Therefore, based on the relationship between the preset relationship type and the weight configuration rules, the target weight configuration rules for each edge in the dynamic heterogeneous graph are determined, and then the weights are configured. This conforms to the actual non-uniform distribution of abnormal propagation mode and can more accurately identify abnormal information.

[0132] In some embodiments, the above-mentioned S320 may specifically include: The initial weights of each edge in the dynamic heterogeneous graph are determined according to the target weight configuration rules. Get the first moment when the edge corresponding to each relation type was last added, and the second moment when the initial weights were obtained; For each relation type, determine the time decay factor based on the first time point and the second time point respectively; For each edge corresponding to each relation type, the weight is determined based on the time decay factor and the initial weight.

[0133] In this embodiment, to reflect the timeliness of the association between nodes, a uniform time decay factor is introduced for all relation types. The first moment when the edge corresponding to each relation type was last added, and the second moment when the initial weight was obtained, are obtained. For each relation type, the time decay factor is determined based on the first and second moments, respectively. The second moment when the initial weight was obtained is the current moment.

[0134] In one example, the time decay factor is determined using the following formula (8) based on the first and second time points: (8) in, It is the current timestamp. It is the timestamp of the last time this edge was observed. This is a decay time constant specific to the relation type r. For example, it is set to 30 days for the "Uses" relation (payment relations change slowly) and 7 days for the "Resolves_to" relation (Domain Name System (DNS) resolution may change frequently).

[0135] Combined with initial weights and time decay factor The weights are determined using the following formula (9). : (9) It is understandable that for each edge Its weight It takes into account both the strength and timeliness of the association.

[0136] This application's embodiments introduce a time decay factor to determine weights, improving the timeliness of associations between nodes and further enhancing the accuracy of anomaly information determination.

[0137] In some embodiments, the above-mentioned S140 may specifically include: If the difference between the first abnormal pressure value and the second abnormal pressure value of the target node is greater than a preset threshold, calculate the second total pressure value received from the adjacent nodes of the target node. Based on the second total pressure value, update the second abnormal pressure value of the target node using a preset update rule to obtain the third abnormal pressure value of the target node. If the difference between the second and third abnormal pressure values ​​of the target node is not greater than a preset threshold, the target node with a third abnormal pressure value greater than the preset pressure value among multiple nodes is identified as an abnormal node.

[0138] In this embodiment, if the difference between the first and second abnormal pressure values ​​of the target node is greater than a preset threshold, the abnormal pressure value is considered unstable. Therefore, the second total pressure value received from the target node's neighboring nodes is then calculated. Based on this second total pressure value, the second abnormal pressure value of the target node is updated using a preset update rule to obtain the third abnormal pressure value of the target node. If the difference between the second and third abnormal pressure values ​​of the target node is not greater than a preset threshold, the target node with a third abnormal pressure value greater than the preset pressure value among multiple nodes is identified as an abnormal node.

[0139] Understandably, after the multi-relationship anomaly pressure propagation model reaches a stable pressure value, anomaly information naturally emerges in the dynamic heterogeneous graph through a dynamic process. Target nodes with a third anomaly pressure value greater than the preset pressure value are considered anomaly nodes, and the sub-payment evidence information corresponding to these anomaly nodes is considered anomaly information.

[0140] In this embodiment, when the difference between abnormal pressure values ​​is not greater than a preset threshold, that is, after the abnormal pressure values ​​have stabilized, the abnormal node is determined, which further improves the accuracy of abnormal information determination.

[0141] In some embodiments, after S150 described above, the method further includes: Obtain process information and preset prompt word templates for identifying abnormal information; Write the process information into the preset prompt word template to obtain the target prompt word; The target prompt is input into the large language model to obtain the inference result corresponding to the target prompt, which includes the risk level and the cause of the risk.

[0142] In some embodiments, leveraging the semantic understanding and logical reasoning capabilities of a large language model, a fusion reasoning engine based on cue engineering is constructed for open-ended reasoning. First, process information for identifying anomalous information and preset cue word templates are obtained. For the process information, it is transformed into a structured chain of evidence to obtain the evidence dictionary corresponding to the domain name to be evaluated. Dictionary of Evidence This can include behavioral simulation information and graph association evidence information. Behavioral simulation information may include, but is not limited to, simulated transaction success information (checkout_success), extracted merchant IDs (extracted_mids), payment redirection complexity (redirect_chain_length), payment service provider rating (psp_reputation), and time difference from launch to payment (time_to_checkout). Graph association evidence information may include, but is not limited to, node pressure score (graph_pressure_score), known anomalous merchant IDs (associated_malicious_mids), community profile information including the total number of anomalous nodes, the percentage of anomalous nodes, and relationship types (community_risk_profile), and the types of edges associated with nodes (direct_relations).

[0143] The simulation transaction success information can be a Boolean (Bool) indicating whether the simulation payment was successfully completed; the extracted merchant ID can be a string array (List[str]); the payment redirection complexity can be an integer (Int) indicating the length of the payment redirection chain; the payment service provider score can be a floating-point (Float); the time difference between online and payment can be an integer indicating the number of days from registration to the first observed payment behavior. The node stress score can be a floating-point (Float) indicating the abnormal stress value of the node; the known abnormal merchant IDs can be a string array (List[str]); the community profile information can be a dictionary (Dict); the edge type associated with the node can be a list of tuples (List[Tuple]), such as ('Uses', 'MID_123'), ('Registered_by', 'bad_actor@email.com'), etc.

[0144] The preset prompt template can be a multi-level, structured prompt template that incorporates a dictionary of evidence. The data is populated as variables and fed into a large language model, which then outputs an early warning report. The early warning report includes the inference results, which include the risk level and the cause of the risk.

[0145] In one example, the input data for the large language model, i.e., the target prompt words, is as follows:

[0146]

[0147] The output of the large language model is constrained to JSON format for easy programmatic parsing. Risk scores are used for threshold assessment and ranking, while risk levels facilitate rapid decision-making. The output of the large language model includes detailed explanations of the step-by-step reasoning process, making it highly interpretable and suitable for human review. Furthermore, the large language model can output natural language alerts directly to end users, clearly identifying risk points and providing action suggestions.

[0148] In some embodiments, the target prompt words can be input into the large language model multiple times to check the stability of the inference results and determine the confidence level of the inference results.

[0149] This application embodiment integrates behavioral simulation evidence and graph-related evidence, and utilizes a large language model to generate interpretable risk assessments and early warning reports, making abnormal information interpretable and improving user experience.

[0150] In the embodiments provided in this application, by integrating behavioral simulation and graph reasoning, and combining the semantic understanding capabilities of a large language model, a warning report with causal logic is output, which improves credibility and user acceptance, and achieves high-precision and interpretable risk assessment. Moreover, through repeated simulations, multi-source evidence fusion, and dynamic graph updates, it can effectively cope with anti-detection strategies such as frequent domain name changes and hidden payment paths of abnormal transaction systems. Compared with existing technologies, it has significant improvements in detection rate, robustness, and warning timeliness.

[0151] This application's embodiments shift the detection perspective from the traditional "what is the transaction system" (based on static features) to "what does the transaction system do" (based on payment behavior) and "who is the transaction system associated with" (based on graph relationships). Through highly realistic dynamic behavior simulation, it penetrates front-end interference and accurately extracts payment intent; then, it constructs and continuously updates a dynamic heterogeneous graph centered on the payment entity, utilizing graph mining to uncover deep relationships; finally, it integrates behavioral evidence and graph intelligence to achieve high-precision, early detection, and in-depth comprehensive anomaly determination.

[0152] Based on the information determination method provided in the above embodiments, this application also provides specific implementations of the information determination device. Please refer to the following embodiments.

[0153] See Figure 7 The information determination device 400 provided in this application embodiment includes: The acquisition module 410 is used to acquire the target payment evidence information of the target transaction system, the first payment evidence information of the first transaction system known to be abnormal, and the second payment evidence information of the second transaction system known to be normal. Module 420 is used to construct a dynamic heterogeneous graph using target payment evidence information, first payment evidence information and second payment evidence information. Multiple nodes in the dynamic heterogeneous graph are marked with a preset first abnormal pressure value. The first abnormal pressure value of the node corresponding to the first payment evidence information is greater than the first abnormal pressure value of the node corresponding to the second payment evidence information. The calculation module 430 is used to calculate, for each target node among multiple nodes, a first total pressure value received from the nodes adjacent to the target node, and update the first abnormal pressure value of the target node according to the first total pressure value using a preset update rule to obtain the second abnormal pressure value of the target node. The determination module 440 is used to determine that among multiple nodes, the target node whose second abnormal pressure value is greater than the preset pressure value is an abnormal node. The determination module 440 is also used to determine that the target payment evidence information corresponding to the abnormal node is abnormal information.

[0154] In some embodiments, the acquisition module 410 may include: The acquisition unit is used to acquire domain characteristic information corresponding to multiple domains; The determination unit is used to input domain name feature information into the trained classifier and use the trained classifier to determine the target domain name belonging to the target category; The acquisition unit is also used to acquire target payment evidence information of the target transaction system under the target domain.

[0155] In some embodiments, the acquisition unit may be specifically used for: Simulate user transaction behavior in the target transaction system under the target domain; When the transaction action involves clicking the target control, obtain the network request information of the target transaction system. The network request information includes the target payment evidence information of the target transaction system.

[0156] In some embodiments, the transaction behavior includes clicking a link of a preset category, adding a transaction target to a transaction list, and clicking a target control; the acquisition unit may specifically be used for: Start the target transaction system under the target domain name; Once the target trading system's page has finished loading, identify at least one link in the preset category on the page; Click on a link randomly to access the transaction page of the corresponding transaction target; Use the transaction page to add the corresponding transaction target to the transaction list; Clicking the target control in the transaction list simulates the user's transaction behavior in the target transaction system under the target domain.

[0157] In some embodiments, the acquisition unit may be specifically used for: Identify interactive page elements on the transaction page; Get a screenshot of the transaction page; Identify preset text elements from the page elements marked in the screenshot; Click on the preset text element on the trading page to add the linked trading target to the trading list.

[0158] In some embodiments, the construction module 420 may specifically be used for: Nodes are constructed using multiple sub-payment evidence information in the target payment evidence information, multiple sub-payment evidence information in the first payment evidence information, and multiple sub-payment evidence information in the second payment evidence information. Edges are constructed using the relationship types between multiple sub-payment evidence information to obtain a dynamic heterogeneous graph.

[0159] In some embodiments, each edge in the dynamic heterogeneous graph is configured with a weight; the calculation module 430 can specifically be used for: For each target node among multiple nodes, based on the weight of the edges between the target node and its neighboring nodes, the first total pressure value received from the neighboring nodes of the target node is calculated. Based on the first total pressure value, the first abnormal pressure value of the target node is updated using a preset update rule to obtain the second abnormal pressure value of the target node.

[0160] In some embodiments, the device 400 may further include: The determination module 440 is also used to determine the target weight configuration rule for each edge in the dynamic heterogeneous graph before calculating the first total pressure value received from the nodes adjacent to the target node based on the weight of the edge between the target node and the nodes adjacent to the target node, according to the relationship between the preset relationship type and the weight configuration rule. The configuration module is used to configure the weight of each edge in the dynamic heterogeneous graph according to the target weight configuration rules.

[0161] In some embodiments, the configuration module can specifically be used for: The initial weights of each edge in the dynamic heterogeneous graph are determined according to the target weight configuration rules. Get the first moment when the edge corresponding to each relation type was last added, and the second moment when the initial weights were obtained; For each relation type, determine the time decay factor based on the first time point and the second time point respectively; For each edge corresponding to each relation type, the weight is determined based on the time decay factor and the initial weight.

[0162] In some embodiments, the determining module 440 may specifically be used for: If the difference between the first abnormal pressure value and the second abnormal pressure value of the target node is greater than a preset threshold, calculate the second total pressure value received from the adjacent nodes of the target node. Based on the second total pressure value, update the second abnormal pressure value of the target node using a preset update rule to obtain the third abnormal pressure value of the target node. If the difference between the second and third abnormal pressure values ​​of the target node is not greater than a preset threshold, the target node with a third abnormal pressure value greater than the preset pressure value among multiple nodes is identified as an abnormal node.

[0163] In some embodiments, the device 400 may further include: The acquisition module 410 is used to acquire the process information of determining the abnormal information and the preset prompt word template after determining that the target payment evidence information corresponding to the abnormal node is abnormal information; The writing module is used to write process information into a preset prompt word template to obtain the target prompt word; The determination module 440 is also used to input the target prompt word into the large language model and obtain the reasoning result corresponding to the target prompt word. The reasoning result includes the risk level and the risk cause.

[0164] Each module of the information determination device provided in this application embodiment can realize the functions of each step of the information determination method provided above, and can achieve its corresponding technical effects. For the sake of brevity, it will not be described in detail here.

[0165] Based on the same inventive concept, embodiments of this application also provide an electronic device.

[0166] Figure 8 A schematic diagram of the hardware structure of the electronic device provided in an embodiment of this application is shown.

[0167] An electronic device may include a processor 501 and a memory 502 storing computer program instructions.

[0168] Specifically, the processor 501 may include a central processing unit (CPU), an application specific integrated circuit (ASIC), or one or more integrated circuits that can be configured to implement the embodiments of this application.

[0169] Memory 502 may include mass storage for data or instructions. For example, and not limitingly, memory 502 may include a hard disk drive (HDD), floppy disk drive, flash memory, optical disk, magneto-optical disk, magnetic tape, or Universal Serial Bus (USB) drive, or a combination of two or more of these. Where appropriate, memory 502 may include removable or non-removable (or fixed) media. Where appropriate, memory 502 may be internal or external to an electronic device. In a particular embodiment, memory 502 is a non-volatile solid-state memory.

[0170] Memory may include read-only memory (ROM), random access memory (RAM), disk storage media devices, optical storage media devices, flash memory devices, and electrical, optical, or other physical / tangible memory storage devices. Therefore, typically, memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., memory devices) encoded with software including computer-executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform the operations described with reference to the methods according to one aspect of this disclosure.

[0171] The processor 501 reads and executes computer program instructions stored in the memory 502 to implement any of the information determination methods in the above embodiments.

[0172] In one example, the electronic device may also include a communication interface 503 and a bus 510. Wherein, as... Figure 8 As shown, the processor 501, memory 502, and communication interface 503 are connected through bus 510 and complete communication with each other.

[0173] The communication interface 503 is mainly used to realize communication between various modules, devices, units and / or equipment in the embodiments of this application.

[0174] Bus 510 includes hardware, software, or both, that couples components of an electronic device together. For example, and not limitingly, the bus may include an Accelerated Graphics Port (AGP) or other graphics bus, an Extended Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), a Hyper Transport (HT) interconnect, an Industry Standard Architecture (ISA) bus, an Infinite Bandwidth Interconnect, a Linear Predictive Coding (LPC) bus, a memory bus, a MicroChannel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (Peripheral Component Interconnect-X, PCI-X) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association Local Bus (VESA Local Bus, VLB) bus, or other suitable buses, or a combination of two or more of these. Where appropriate, bus 510 may include one or more buses. Although specific buses are described and illustrated in the embodiments of this application, this application contemplates any suitable bus or interconnection. The electronic device can perform the information determination method described in the embodiments of the present invention, thereby implementing the information determination method described above.

[0175] Furthermore, in conjunction with the information determination methods in the above embodiments, this application embodiment can provide a computer storage medium for implementation. This computer storage medium stores computer program instructions; when these computer program instructions are executed by a processor, they implement any of the information determination methods in the above embodiments.

[0176] This application also provides a computer program product, wherein the instructions in the computer program product, when executed by a processor of an electronic device, cause the electronic device to perform various processes implementing the methods for determining any of the above-described information.

[0177] It should be clarified that this application is not limited to the specific configurations and processes described above and shown in the figures. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of this application is not limited to the specific steps described and shown. Those skilled in the art can make various changes, modifications, and additions, or change the order of steps, after understanding the spirit of this application.

[0178] The functional blocks shown in the above-described structural diagram can be implemented as hardware, software, firmware, or a combination thereof. When implemented in hardware, they can be, for example, electronic circuits, application-specific integrated circuits (ASICs), appropriate firmware, plug-ins, function cards, etc. When implemented in software, the elements of this application are programs or code segments used to perform the required tasks. Programs or code segments can be stored on a machine-readable medium or transmitted over a transmission medium or communication link via data signals carried on a carrier wave. "Machine-readable medium" can include any medium capable of storing or transmitting information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, read-only memory (ROM), flash memory, erasable read-only memory (EROM), floppy disks, compact disc read-only memory (CD-ROM), optical disks, hard disks, fiber optic media, radio frequency (RF) links, etc. Code segments can be downloaded via computer networks such as the Internet, intranets, etc.

[0179] It should also be noted that the exemplary embodiments mentioned in this application describe methods or systems based on a series of steps or apparatus. However, this application is not limited to the order of the above steps; that is, the steps can be performed in the order mentioned in the embodiments, or in a different order, or several steps can be performed simultaneously.

[0180] The aspects of this disclosure have been described above with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this disclosure. It should be understood that each block in the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that these instructions, executable via the processor of the computer or other programmable data processing apparatus, enable the implementation of the functions / actions specified in one or more blocks of the flowchart illustrations and / or block diagrams. Such a processor can be, but is not limited to, a general-purpose processor, a special-purpose processor, a special application processor, or a field-programmable logic circuit. It is also understood that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can also be implemented by special-purpose hardware performing the specified functions or actions, or can be implemented by a combination of special-purpose hardware and computer instructions.

[0181] The above are merely specific embodiments of this application. Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, modules, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here. It should be understood that the protection scope of this application is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in this application, and these modifications or substitutions should all be covered within the protection scope of this application.

Claims

1. A method for determining information, characterized in that, include: Obtain target payment evidence information of the target transaction system, first payment evidence information of the first transaction system known to be abnormal, and second payment evidence information of the second transaction system known to be normal; Using the target payment evidence information, the first payment evidence information, and the second payment evidence information, a dynamic heterogeneous graph is constructed. Multiple nodes in the dynamic heterogeneous graph are marked with a preset first abnormal pressure value. The first abnormal pressure value of the node corresponding to the first payment evidence information is greater than the first abnormal pressure value of the node corresponding to the second payment evidence information. For each target node among the plurality of nodes, calculate the first total pressure value received from the nodes adjacent to the target node, and update the first abnormal pressure value of the target node according to the first total pressure value using a preset update rule to obtain the second abnormal pressure value of the target node; Among the plurality of nodes, the target node whose second abnormal pressure value is greater than the preset pressure value is identified as an abnormal node; The target payment evidence information corresponding to the abnormal node is determined to be abnormal information.

2. The method according to claim 1, characterized in that, The acquisition of target payment evidence information from the target transaction system includes: Obtain domain characteristic information corresponding to multiple domains; The domain name feature information is input into the trained classifier, and the trained classifier is used to determine the target domain name belonging to the target category; Obtain the target payment evidence information of the target transaction system under the target domain name.

3. The method according to claim 2, characterized in that, The step of obtaining the target payment evidence information of the target transaction system under the target domain name includes: Simulate user transaction behavior in the target transaction system under the target domain name; When the transaction behavior is clicking the target control, the network request information of the target transaction system is obtained, and the network request information includes the target payment evidence information of the target transaction system.

4. The method according to claim 3, characterized in that, The transaction actions include clicking links in preset categories, adding transaction targets to the transaction list, and clicking target controls; The simulated user's transaction behavior in the target transaction system under the target domain name includes: Start the target transaction system under the target domain name; Once the target transaction system's page has finished loading, identify at least one link of the preset category on the page; Clicking the link randomly will take you to the transaction page of the transaction target corresponding to the link; Using the transaction page, add the transaction target corresponding to the link to the transaction list; Clicking the target control in the transaction list simulates the user's transaction behavior in the target transaction system under the target domain.

5. The method according to claim 4, characterized in that, Adding the transaction target corresponding to the link to the transaction list using the transaction page includes: Identify interactive page elements in the transaction page; Obtain a screenshot of the transaction page; Identify preset text elements from the page elements marked in the screenshot image; Click the preset text element on the transaction page to add the transaction target corresponding to the link to the transaction list.

6. The method according to claim 1, characterized in that, The step of constructing a dynamic heterogeneous graph using the target payment evidence information, the first payment evidence information, and the second payment evidence information includes: Nodes are constructed using multiple sub-payment evidence information in the target payment evidence information, multiple sub-payment evidence information in the first payment evidence information, and multiple sub-payment evidence information in the second payment evidence information. Edges are constructed using the relationship types between the multiple sub-payment evidence information to obtain a dynamic heterogeneous graph.

7. The method according to claim 6, characterized in that, Each edge in the dynamic heterogeneous graph is assigned a weight; for each target node among the plurality of nodes, a first total pressure value received from the nodes adjacent to the target node is calculated, and based on the first total pressure value, a first abnormal pressure value of the target node is updated using a preset update rule to obtain a second abnormal pressure value of the target node, including: For each target node among the plurality of nodes, a first total pressure value received from the neighboring nodes of the target node is calculated based on the weight of the edge between the target node and the neighboring nodes of the target node. Based on the first total pressure value, the first abnormal pressure value of the target node is updated using a preset update rule to obtain the second abnormal pressure value of the target node.

8. The method according to claim 7, characterized in that, Before calculating the first total pressure value received from the nodes adjacent to the target node based on the weights of the edges between the target node and its adjacent nodes, the method further includes: Based on the preset relationship type and weight configuration rules, the target weight configuration rule for each edge in the dynamic heterogeneous graph is determined; Configure the weight of each edge in the dynamic heterogeneous graph according to the target weight configuration rules.

9. The method according to claim 8, characterized in that, The step of configuring the weight of each edge in the dynamic heterogeneous graph according to the target weight configuration rule includes: The initial weights of each edge in the dynamic heterogeneous graph are determined according to the target weight configuration rules. Obtain the first moment when the edge corresponding to each relation type was last added, and the second moment when the initial weight was obtained; For each of the aforementioned relationship types, a time decay factor is determined based on the first time point and the second time point, respectively; For each edge corresponding to the aforementioned relation type, the weight is determined based on the time decay factor and the initial weight.

10. The method according to claim 1, characterized in that, The step of determining that among the plurality of nodes, the target node whose second abnormal pressure value is greater than a preset pressure value is an abnormal node includes: If the difference between the first abnormal pressure value and the second abnormal pressure value of the target node is greater than a preset threshold, calculate the second total pressure value received from the adjacent nodes of the target node, update the second abnormal pressure value of the target node according to the second total pressure value using the preset update rule, and obtain the third abnormal pressure value of the target node. If the difference between the second abnormal pressure value and the third abnormal pressure value of the target node is not greater than the preset threshold, the target node whose third abnormal pressure value is greater than the preset pressure value among the plurality of nodes is determined to be an abnormal node.

11. The method according to claim 1, characterized in that, After determining that the target payment evidence information corresponding to the abnormal node is abnormal information, the method further includes: Obtain process information and preset prompt word templates for identifying abnormal information; The process information is written into the preset prompt word template to obtain the target prompt word; The target prompt word is input into a large language model to obtain the inference result corresponding to the target prompt word. The inference result includes the risk level and the risk cause.

12. An information determining device, characterized in that, include: The acquisition module is used to acquire target payment evidence information of the target transaction system, first payment evidence information of the first transaction system known to be abnormal, and second payment evidence information of the second transaction system known to be normal. The construction module is used to construct a dynamic heterogeneous graph using the target payment evidence information, the first payment evidence information and the second payment evidence information. Multiple nodes in the dynamic heterogeneous graph are marked with a preset first abnormal pressure value. The first abnormal pressure value of the node corresponding to the first payment evidence information is greater than the first abnormal pressure value of the node corresponding to the second payment evidence information. The calculation module is used to calculate, for each target node among the plurality of nodes, a first total pressure value received from the nodes adjacent to the target node, and update the first abnormal pressure value of the target node according to the first total pressure value using a preset update rule to obtain a second abnormal pressure value of the target node. The determination module is used to determine that among the plurality of nodes, the target node whose second abnormal pressure value is greater than a preset pressure value is an abnormal node; The determining module is further configured to determine that the target payment evidence information corresponding to the abnormal node is abnormal information.

13. An electronic device, characterized in that, The device includes: a processor and a memory storing computer program instructions; the processor, when executing the computer program instructions, implements the method for determining information as described in any one of claims 1-11.

14. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer program instructions, which, when executed by a processor, implement the method for determining information as described in any one of claims 1-11.

15. A computer program product, characterized in that, When the instructions in the computer program product are executed by the processor of the electronic device, the electronic device is able to perform the information determination method as described in any one of claims 1-11.

Images