A game account transaction abnormal behavior monitoring method and system

Abstract

The application provides a game account transaction abnormal behavior monitoring method and system, relates to the technical field of Internet transaction safety, and the method comprises the steps of collecting full-dimension data corresponding to a game account transaction request; performing desensitization and standardization processing on the full-dimension data to obtain standard risk control data; performing full-dimension feature extraction on the standard risk control data to obtain a risk control feature vector; generating a risk score corresponding to the game account transaction request according to the risk control feature vector; performing abnormal behavior trajectory sensing according to the standard risk control data to obtain an abnormal behavior matching result; determining a risk level corresponding to the game account transaction request according to the risk score and the abnormal behavior matching result; and performing hierarchical processing on the game account transaction request according to the risk level to realize monitoring of the abnormal behavior of the game account transaction.

Description

Technical Field

[0001] This invention relates to the field of internet transaction security technology, and in particular to a method and system for monitoring abnormal behavior in game account transactions. Background Technology

[0002] With the development of the online gaming industry, digital resources such as game accounts, virtual items, and game assets have gradually acquired trading value. Game account trading platforms are widely used in scenarios such as account buying and selling, recycling, resale, and escrow transactions. In the process of game account trading, the trading objects typically involve multiple types of data, including account level, equipment assets, recharge records, character resources, binding information, and user behavior. Furthermore, the trading process is characterized by online, real-time, and cross-regional transfers. Because game accounts possess virtual asset attributes, abnormal behaviors such as account theft and resale, fraudulent transactions, bulk order placement, abnormal password changes, or high-frequency operations from different locations can easily lead to user asset losses, platform disputes, and transaction security risks. Therefore, how to monitor transaction data and user behavior in real time during game account trading, and accurately identify and promptly handle abnormal transaction behaviors, has become a crucial issue in the security management of game account transactions.

[0003] Existing risk control methods for game account transactions typically include fixed threshold rule blocking, single-model risk assessment, manual review and verification, offline behavior statistics, and post-event risk handling. Fixed threshold rule blocking primarily uses preset rules such as transaction frequency, login region, and transaction price range to judge transaction requests; single-model risk assessment typically uses traditional algorithms such as logistic regression and Naive Bayes to score the risk of transaction requests; manual review and verification relies on manual verification of account information, behavior records, and transaction background; offline behavior statistics mainly involve periodically summarizing and analyzing historical transaction and behavior data; and post-event risk handling typically involves tracing and processing risk events after the transaction is completed.

[0004] However, existing risk control methods for game account transactions are difficult to uniformly desensitize, standardize, and characterize multi-source transaction data, and lack a progressive monitoring process of risk scoring, abnormal trajectory perception, and graded handling, resulting in untimely identification of abnormal behavior and insufficient targeted handling. Summary of the Invention

[0005] To address the technical issues that existing game account transaction risk control methods struggle to uniformly desensitize, standardize, and characterize multi-source transaction data, and lack a progressive monitoring process for risk scoring, abnormal trajectory perception, and tiered handling, resulting in untimely identification of abnormal behavior and insufficient targeted handling.

[0006] The technical solution provided by this invention is as follows: The first aspect of this invention provides a method for monitoring abnormal game account transaction behavior, comprising: S1: Collect full-dimensional data corresponding to game account transaction requests; S2: De-identify and standardize all-dimensional data to obtain standard risk control data; S3: Perform full-dimensional feature extraction on standard risk control data to obtain risk control feature vectors; S4: Generate a risk score corresponding to the game account transaction request based on the risk control feature vector; S5: Based on standard risk control data, detect abnormal behavior trajectories and obtain abnormal behavior matching results; S6: Determine the risk level corresponding to the game account transaction request based on the risk score and abnormal behavior matching results; S7: Based on the risk level, game account transaction requests are processed in a tiered manner to monitor abnormal game account transaction behavior.

[0007] A second aspect of this invention provides a game account transaction abnormality monitoring system, comprising: The system includes a multi-source behavioral data acquisition module, a privacy compliance de-identification module, an unstructured data standardization module, a full-dimensional feature engineering module, a dual-model fusion AI risk control module, an abnormal behavior trajectory perception module, a hierarchical intelligent handling module, and a real-time early warning and sample iteration module. The multi-source behavioral data acquisition module, privacy compliance desensitization module, unstructured data standardization module, full-dimensional feature engineering module, dual-model fusion AI risk control module, abnormal behavior trajectory perception module, hierarchical intelligent handling module, and real-time early warning and sample iteration module are connected in sequence.

[0008] The beneficial effects of the technical solution provided by this invention include: In this embodiment of the invention, by collecting full-dimensional data corresponding to game account transaction requests and performing anonymization and standardization on this data, standard risk control data is obtained. Then, full-dimensional feature extraction is performed based on this standard risk control data to obtain risk control feature vectors. This enables unified processing of multiple types of data during the transaction process, improving the standardization and usability of risk control input data, thereby enhancing the accuracy of subsequent risk assessment. Furthermore, a risk score corresponding to the game account transaction request is generated based on the risk control feature vector, and abnormal behavior trajectory detection is performed to obtain abnormal behavior matching results. The risk level is then determined by combining the risk score and the abnormal behavior matching results. Finally, game account transaction requests are graded according to the risk level, enabling timely identification and differentiated handling of abnormal behavior, improving the effectiveness and targeted nature of monitoring and handling of abnormal game account transaction behavior. Attached Figure Description

[0009] Figure 1 This is a flowchart illustrating a method for monitoring abnormal game account transaction behavior according to an embodiment of the present invention. Figure 2 This is a schematic diagram of the structure of a game account transaction abnormal behavior monitoring system provided in an embodiment of the present invention. Detailed Implementation

[0010] Reference manual attached Figure 1 The diagram illustrates a flowchart of a method for monitoring abnormal behavior in game account transactions provided by an embodiment of the present invention.

[0011] This invention provides a method for monitoring abnormal game account transaction behavior, which may include the following steps: S1: Collect full-dimensional data corresponding to game account transaction requests.

[0012] Optionally, the full-dimensional data specifically includes: transaction data, behavioral trajectory data, and device environment data.

[0013] It should be noted that after a user initiates a transaction request, the transaction data collection unit, behavior trajectory collection unit, and device environment collection unit are started simultaneously. They collect data from all dimensions, including account asset information, transaction order data, user operation trajectory, login IP, device fingerprint, and network environment, in parallel. The entire collection process is non-intrusive and does not actively acquire sensitive information. The collection time for a single request is ≤50ms, and it supports the simultaneous processing of 10,000+ concurrent transactions.

[0014] S2: De-identify and standardize the data across all dimensions to obtain standard risk control data.

[0015] In one possible implementation, S2 specifically includes: S201: Identify sensitive information in full-dimensional data.

[0016] It should be noted that the collected data flows into the sensitive information identification unit in real time, automatically scanning and identifying privacy fields such as real name, mobile phone number, device ID, and login IP.

[0017] S202: Perform hash encryption masking on sensitive information to obtain de-identified transaction data.

[0018] It should be noted that after identification, the data is masked by hash encryption using an irreversible desensitization unit. The desensitized data cannot be reversed and no original sensitive information is stored throughout the process, thus avoiding the risk of privacy leakage from the source.

[0019] Furthermore, after completing the collection and privacy-anonymizing of multi-source transaction behavior data, the system performs a data integrity check, performing integrity checks on core transaction fields and core behavior fields, and calculating the integrity rate of these fields. When the integrity rate is greater than or equal to 95%, the currently collected data is deemed to meet the integrity requirements, and the collected data is unidirectionally transmitted to the subsequent standardization or feature engineering processing stages. When the integrity rate is less than 95%, the currently collected data is deemed not to meet the integrity requirements, and the corresponding abnormal data is fed back to the multi-source behavior data collection module to supplement the data collection for the corresponding game account transaction requests, or to mark the corresponding game account transaction requests as invalid requests. Through the above data integrity check and abnormal data feedback mechanism, a closed loop of data collection can be formed, achieving seamless access and privacy-compliant processing of all dimensions of game account transaction data, and improving data collection efficiency.

[0020] S203: Perform unstructured data parsing on the de-identified transaction data to obtain structured transaction data.

[0021] It should be noted that the compliance data input includes text structured units and behavior sequence encoding units, which parse unstructured data such as account text, asset images, and operation sequences.

[0022] S204: Normalize the structured transaction data to obtain standard risk control data.

[0023] It should be noted that core fields such as level, equipment rarity, recharge amount, and operation sequence are automatically extracted, converting scattered non-standard data into standardized risk control data in a unified format.

[0024] In this embodiment of the invention, by sequentially performing sensitive information identification, hash encryption masking, unstructured data parsing, and normalization processing on all-dimensional data, it is possible to convert game account transaction data from scattered sources and with inconsistent formats into standard risk control data that can be directly processed by subsequent risk control models, while ensuring data privacy and security. On the one hand, by irreversibly desensitizing sensitive information such as real names, mobile phone numbers, device IDs, and login IPs, the risk of exposure of original sensitive information during subsequent processing can be avoided, improving the compliance and security of the data processing process. On the other hand, by performing structured parsing on unstructured data such as account text, asset images, and operation sequences, and combining it with integrity judgment and abnormal data return mechanisms, the integrity and availability of data fields can be improved, reducing risk control misjudgments caused by missing data or format differences. At the same time, by unifying data of different types and dimensions into standardized feature expressions through normalization processing, the impact of data differences between different game types and different transaction scenarios on subsequent feature extraction and AI risk control judgment can be reduced, thereby providing a stable and accurate data foundation for subsequent all-dimensional feature construction, risk scoring, and abnormal behavior identification.

[0025] S3: Perform full-dimensional feature extraction on standard risk control data to obtain risk control feature vectors.

[0026] In one possible implementation, S3 specifically includes: S301: Extract static features, dynamic behavioral features, and market correlation features from standard risk control data.

[0027] It should be noted that the standard data enters the full-dimensional feature engineering module, where the static feature extraction unit, dynamic behavior feature unit, and market-related feature unit extract over 50 dimensions of features across three main categories: basic account attributes, behavioral patterns, and market conditions. Then, the data normalization unit maps the feature values ​​to the 0-1 range, eliminating data differences between different games and scenarios.

[0028] S302: Generate risk control feature vectors based on static features, dynamic behavioral features, and market correlation features.

[0029] Furthermore, after completing the extraction of full-dimensional risk control features, the system performs feature validity judgment, checking the validity of the extracted static risk control features, dynamic behavioral features, and market-related features, and calculating the proportion of valid features among all extracted features. When the proportion of valid features is greater than or equal to 90%, the current feature data is determined to meet the validity requirements, and the feature data is transmitted to the subsequent AI risk control stage. When the proportion of valid features is less than 90%, the current feature data is determined to not meet the validity requirements, and the corresponding abnormal feature data is fed back to the full-dimensional feature engineering module for re-execution of feature extraction. Through the above feature validity judgment and abnormal feature data feedback mechanism, a closed loop of feature construction can be formed, improving the usability of unstructured data parsing results in risk control modeling and enhancing the method's adaptability to different types of game account transaction data formats.

[0030] In this embodiment of the invention, by extracting static features, dynamic behavioral features, and market-related features from standard risk control data across all dimensions, a complete risk control feature expression can be constructed from multiple perspectives, including account attributes, user transaction behavior, and the external market environment. This enables subsequent AI risk control models to not only identify anomalies in basic account information but also behavioral anomalies such as logins from different locations, high-frequency trading, and abnormal password changes, as well as value anomalies such as transaction prices deviating from market conditions. By integrating these multiple features to generate a risk control feature vector, a unified and stable model input can be provided for subsequent risk scoring and abnormal behavior identification, reducing misjudgments or missed judgments caused by a single feature dimension.

[0031] S4: Generate a risk score corresponding to the game account transaction request based on the risk control feature vector.

[0032] In one possible implementation, S4 specifically includes: S401: Input the risk control feature vector into the gradient tree discrimination model and output the basic risk score.

[0033] The gradient tree discriminant model is used to assess the risk of static risk control features and some structured transaction features in game account transaction requests. The gradient tree discriminant model receives risk control feature vectors output by the full-dimensional feature engineering module and performs splitting and combination analysis on features such as basic account attributes, account asset value, registration duration, transaction price, historical transaction records, and market price deviation, thereby identifying whether the account itself has inherent risks.

[0034] It should be noted that the risk control feature vector is input into the gradient tree discrimination unit to process high-dimensional static features and accurately locate the basic risk of the account.

[0035] S402: Input the risk control feature vector into the time series behavior fitting model and output the time series behavior score.

[0036] Among them, the time-series behavior fitting model is used to identify time-series risks in continuous operation behaviors during game account transactions. The time-series behavior fitting model receives time-series behavior features converted from behavior trajectory data, and performs time-series fitting on the time intervals, operation order, operation frequency, geographical changes and device changes in continuous operation processes such as login, browsing, order placement, payment, and password change, in order to determine whether the current transaction behavior deviates from the normal transaction behavior pattern.

[0037] It should be noted that the risk control feature vector input time series behavior fitting unit captures abnormal trends in continuous operations and identifies hidden operational risks.

[0038] S403: Integrate the basic risk score and the time-series behavioral score to generate a risk score.

[0039] It should be noted that the final result is generated by the weighted fusion of the two models by the fusion decision unit, resulting in a risk score of 0-100, with a prediction error rate of <1%.

[0040] In this embodiment of the invention, by inputting risk control feature vectors into a gradient tree discriminant model and a time-series behavior fitting model respectively, a comprehensive judgment can be made on game account transaction requests from two dimensions: basic account risk and continuous abnormal behavior risk. The gradient tree discriminant model can combine and analyze structured features such as basic account attributes, asset value, registration duration, transaction price, and market price deviation to identify abnormal risks in the account itself and basic transaction information. The time-series behavior fitting model can perform time-series modeling of the time sequence, operation frequency, device changes, and geographical changes of continuous operations such as login, browsing, order placement, payment, and password change to identify hidden abnormal behaviors that are difficult to detect using fixed rules.

[0041] S5: Based on standard risk control data, detect abnormal behavior trajectories and obtain abnormal behavior matching results.

[0042] In one possible implementation, S5 specifically includes: S501: Construct a user operation sequence based on standard risk control data.

[0043] S502: The user operation sequence is clustered using the K-means algorithm to obtain the clustering results.

[0044] The K-means algorithm is used to perform cluster analysis on user action sequences to distinguish between normal and abnormal transaction behaviors. The system first converts continuous actions such as login, browsing, order placement, payment, and password change into behavioral feature vectors, and inputs these feature vectors as clustering samples into the K-means algorithm. The K-means algorithm initializes several cluster centers based on a preset number of clusters, calculates the distance between each behavioral feature vector and a cluster center, and assigns each feature vector to the category corresponding to the nearest cluster center. Then, it recalculates the cluster centers based on the samples in each category, and repeats the sample allocation and cluster center update process until the clustering results converge.

[0045] It should be noted that the risk score is simultaneously transmitted to the abnormal behavior trajectory perception module, and the trajectory clustering unit performs cluster analysis on the user's operation sequence to distinguish between normal and abnormal operation habits.

[0046] S503: Match the cluster analysis results with the preset abnormal pattern library to obtain abnormal behavior matching results.

[0047] It should be noted that the abnormal pattern matching unit matches over 100 abnormal patterns, including account theft and resale, bulk registration, fraudulent transactions, and high-frequency operations from different locations. The risk tracing unit locates the initiating node of the risk and generates a full-chain risk tracing report.

[0048] In this embodiment of the invention, by constructing a user operation sequence based on standard risk control data and using the K-means algorithm to perform cluster analysis on the user operation sequence, the differences between normal and abnormal transaction behavior habits can be identified from the perspective of the overall trajectory of the user's continuous operation behavior. Compared with methods that rely solely on a single login, a single order, or a single transaction field for judgment, this step can comprehensively analyze the user's operation sequence, operation frequency, and behavioral change characteristics in multiple transaction stages such as login, browsing, order placement, payment, and password change, thereby discovering hidden abnormal behaviors such as high-frequency operations from different locations, short-term batch transactions, and abnormal password changes.

[0049] S6: Determine the risk level corresponding to the game account transaction request based on the risk score and abnormal behavior matching results.

[0050] It should be noted that after generating a risk score for a game account transaction request, the system performs a risk level assessment and determines the corresponding risk level based on a preset score range.

[0051] Those skilled in the art can set preset transaction frequency, preset number of clusters, and preset score interval size according to actual needs, and the present invention does not limit these settings.

[0052] Specifically, when the risk score is between 0 and 30, the game account transaction request is determined to be low risk. When the risk score is between 31 and 60, the game account transaction request is determined to be medium risk. When the risk score is between 61 and 100, the game account transaction request is determined to be high risk. For abnormal risk data identified during the assessment process, the system automatically marks and retains the corresponding risk identification record, and transmits the risk level result to the subsequent graded handling stage. Through the above-mentioned risk level judgment, abnormal risk data marking and retention, and risk level result transmission mechanism, a closed loop of risk identification can be formed, improving the ability to identify new and hidden abnormal behaviors in game account transactions, and enhancing the real-time nature and accuracy of risk assessment.

[0053] In this embodiment of the invention, by jointly determining the risk level corresponding to a game account transaction request based on risk scores and abnormal behavior matching results, the quantitative risk results output by the AI ​​risk control model can be combined with the abnormal behavior trajectory perception results. This allows the risk level judgment to not only rely on a single score value, but also to refer to specific abnormal behavior types such as account theft and resale, batch registration, fraudulent transactions, and high-frequency operations in different locations, thereby improving the accuracy and rationality of risk classification.

[0054] S7: Based on the risk level, game account transaction requests are processed in a tiered manner to monitor abnormal game account transaction behavior.

[0055] Optionally, the risk levels may specifically include: a first risk level, a second risk level, and a third risk level.

[0056] S701: When the risk level is the highest risk level, the game account transaction request will be automatically approved.

[0057] It should be noted that the automatic release unit releases low-risk transactions without the user noticing.

[0058] S702: When the risk level is the second risk level, the game account transaction request will be subject to secondary verification.

[0059] It should be noted that the secondary verification unit triggers real-name / facial / device verification for medium-risk transactions, and the transaction is allowed once the verification is passed.

[0060] S703: When the risk level is the third risk level, the transaction request for game account trading will be intercepted.

[0061] It should be noted that the transaction interception unit immediately terminates orders and freezes fund flows for high-risk transactions.

[0062] Furthermore, the account management unit implements measures such as restricting transactions and blacklisting malicious and risky accounts, all automatically and without human intervention.

[0063] In this embodiment of the invention, by classifying game account transaction requests according to risk level, differentiated handling methods can be adopted for transaction requests with different risk levels, thereby avoiding the problem of normal transactions being blocked due to the uniform interception of all suspicious transactions in traditional risk control. For low-risk transaction requests corresponding to the first risk level, the system automatically allows them to pass without any noticeable impact. For medium-risk transaction requests corresponding to the second risk level, the system performs secondary verification processes such as real-name verification, facial verification, or device verification, and decides whether to allow them based on further confirmation of transaction security. For high-risk transaction requests corresponding to the third risk level, the system performs transaction interception to terminate orders or restrict fund flows in a timely manner, reducing the risk of account asset loss.

[0064] In one possible implementation, after S7, the following is also included: S8: Based on the results of the hierarchical processing, generate records of abnormal transaction behavior of game accounts, and use these records as risk control samples for feedback.

[0065] It should be noted that after the tiered handling is completed, the early warning push unit performs real-time two-way push of risk information based on the tiered handling results. This includes pushing risk details and corresponding handling records to the platform management end, and pushing transaction status and risk warnings to the user end, with the early warning response time not exceeding 100ms. Simultaneously, the log retention unit encrypts and stores all data throughout the entire process of data collection, data parsing, AI risk control identification, and tiered handling, and retains relevant logs for no less than 5 years for subsequent dispute verification or judicial auditing. After the handling process is completed, the system imports the corresponding transaction data, risk identification data, and handling result data into the risk control sample library to form a closed loop for transaction risk control execution, ensuring that every game account transaction is traceable and verifiable. Through the above-mentioned real-time early warning, log retention, and sample import mechanism, the efficiency of risk handling response can be improved, and the impact on normal transaction processes can be reduced while ensuring the effectiveness of abnormal transaction interception.

[0066] Furthermore, after the tiered handling is completed, the real-time early warning and sample iteration module performs risk control sample closed-loop reflux and automatic model iteration optimization.

[0067] Specifically, the sample labeling unit automatically labels the game account transaction data and corresponding handling results after the processing is completed, and labels the relevant transaction data as positive or negative risk control samples according to the handling results, so as to continuously build an incremental risk control sample library. The automatic iteration unit periodically performs incremental model training based on the newly added risk control samples, updates and optimizes the feature weights and abnormal behavior discrimination rules, and switches the updated model in a gray-scale release manner to reduce the impact of the model update process on online transaction services. The updated model is synchronized to the dual-model fusion AI risk control module to replace the original model in the risk identification and abnormal behavior judgment of subsequent game account transaction requests, thereby forming a closed loop of model iteration and optimization, including risk control sample feedback, incremental model training, model update deployment, and subsequent risk control calculation, improving the system's adaptability to new risk behaviors and its generalization ability of risk identification.

[0068] In this embodiment of the invention, by generating records of abnormal game account transaction behavior after the graded processing is completed, and using these records as risk control samples for feedback, a recordable, traceable, and verifiable data link can be formed for each game account transaction throughout the entire process from data collection, standardized analysis, AI risk control identification, risk grading, to graded handling. On the one hand, by pushing risk details and handling records to the platform management end and transaction status and risk warnings to the user end, the timeliness of risk information transmission can be improved, enabling the platform and users to quickly learn about abnormal transaction situations. On the other hand, by encrypting and logging the data throughout the entire process, a basis can be provided for subsequent dispute verification, risk review, and compliance audit. At the same time, by integrating transaction data, risk identification data, and graded processing results into the risk control sample library, and performing positive and negative labeling and incremental training on the samples, the feature weights and abnormal behavior discrimination rules of the dual-model fusion AI risk control model can be continuously optimized, enabling the system to continuously adapt to new abnormal transaction behaviors, thereby improving the traceability of abnormal game account transaction behavior monitoring, the model's self-optimization capability, and long-term risk control stability.

[0069] Reference manual attached Figure 2 The diagram shows a structural schematic of a game account transaction abnormal behavior monitoring system provided by an embodiment of the present invention.

[0070] This invention also provides a game account transaction abnormal behavior monitoring system, applied to the above-mentioned game account transaction abnormal behavior monitoring method, comprising: The system includes a multi-source behavioral data acquisition module, a privacy compliance de-identification module, an unstructured data standardization module, a full-dimensional feature engineering module, a dual-model fusion AI risk control module, an abnormal behavior trajectory perception module, a hierarchical intelligent handling module, and a real-time early warning and sample iteration module.

[0071] Among them, the multi-source behavioral data acquisition module (data access layer) has the core function of collecting all-dimensional data on game account transactions across the entire domain, achieving non-intrusive, low-latency, and full-coverage data acquisition, and providing raw data input for risk control.

[0072] The core function of the privacy compliance desensitization module is to perform real-time privacy processing on the collected data, so as to make the data usable but invisible and ensure privacy compliance throughout the entire transaction process.

[0073] Among them, the core function of the unstructured data standardization module is to convert scattered text, behavioral sequences, and unstructured data into standard risk control data, eliminating the differences in data formats among multiple games.

[0074] Among them, the core function of the full-dimensional feature engineering module is to build a high-dimensional risk control feature library, providing high-quality input for AI models to improve the accuracy of risk identification.

[0075] The core function of the dual-model fusion AI risk control module is to output a high-precision risk score through collaborative calculation of the two models, replacing a single algorithm and fixed rules.

[0076] Among them, the core function of the abnormal behavior trajectory perception module is to match abnormal behavior patterns, identify new risks, and generate a full-chain risk tracing report.

[0077] The core function of the tiered intelligent handling module is to implement differentiated handling according to risk level, achieve millisecond-level response, and balance risk control efficiency with user experience.

[0078] Among them, the core function of the real-time early warning and sample iteration module is to push risk warnings and complete automatic model iteration, thus building a closed loop for continuous optimization of risk control.

[0079] The multi-source behavioral data acquisition module, privacy compliance desensitization module, unstructured data standardization module, full-dimensional feature engineering module, dual-model fusion AI risk control module, abnormal behavior trajectory perception module, hierarchical intelligent handling module, and real-time early warning and sample iteration module are connected in sequence.

[0080] Optionally, the multi-source behavioral data acquisition module specifically includes: a transaction data acquisition unit, a behavioral trajectory acquisition unit, and a device environment acquisition unit.

[0081] The transaction data collection unit collects core transaction data in real time, including account information, transaction price, order status, and transaction records, and supports access for all types of games.

[0082] It should be noted that the transaction data collection unit starts immediately when a user initiates a transaction request, and captures account information, transaction price, order status, and transaction records in real time, covering all categories of PC games, mobile games, channel servers, and niche games. The time taken to collect a single piece of data is ≤50ms.

[0083] Among them, the behavior trajectory collection unit collects the user's entire operation trajectory, including login, browsing, order placement, payment, and password change, forming a behavior chain.

[0084] It should be noted that the behavior trajectory collection unit is triggered synchronously with the transaction request and continuously collects data throughout the process, fully recording the entire sequence of operations such as login, browsing, order placement, payment, and password change to form an unalterable behavior chain.

[0085] The equipment environment acquisition unit collects environmental characteristics such as equipment model, IP address, network environment, and operating frequency to identify abnormal equipment.

[0086] It should be noted that the device environment acquisition unit instantly collects environmental characteristics such as device model, IP address, network environment, and operation frequency when requesting access, and marks abnormal IPs / devices in real time, supporting 10,000+ concurrent acquisitions.

[0087] The privacy compliance desensitization module specifically includes: a sensitive information identification unit and an irreversible desensitization unit.

[0088] Among them, the sensitive information identification unit automatically identifies privacy data such as mobile phone number, real name information, device ID, and login IP.

[0089] It should be noted that the sensitive information recognition unit starts in milliseconds after data collection is completed. Based on a database of millions of sensitive features, it automatically matches privacy data such as mobile phone numbers, real-name information, device IDs, and login IPs. The recognition accuracy is ≥99.8% and the scanning time for a single line is ≤10ms.

[0090] Among them, the irreversible desensitization unit uses hash masking to process privacy fields. The data cannot be restored after desensitization and does not affect risk control calculations.

[0091] It should be noted that the irreversible desensitization unit is executed immediately upon identifying sensitive data. It uses the SHA-256 hash masking algorithm to replace the original privacy fields with fixed-length hash values. The desensitized data is irreversible and does not destroy the risk control calculation characteristics.

[0092] The unstructured data standardization module specifically includes: text structuring unit, behavior sequence encoding unit, and data normalization unit.

[0093] Among them, the text structure unit extracts core fields such as account level, asset rarity, and recharge amount.

[0094] It should be noted that the text structured unit uses a feature matching algorithm to extract core fields such as account level, asset rarity, and recharge amount, and the accuracy of non-standard data parsing is ≥99.5%.

[0095] Among them, the behavior sequence encoding unit converts continuous operation behaviors into fixed-dimensional vectors to adapt to the model input.

[0096] It should be noted that the behavior sequence encoding unit converts continuous operation behaviors into a 512-dimensional fixed vector to adapt to the input format of the AI ​​model.

[0097] Among them, the data normalization unit unifies the data format and numerical range, eliminating data differences between different games and different scenarios.

[0098] It should be noted that the data normalization unit maps the eigenvalues ​​to the [0,1] interval through the normalization formula to eliminate dimensional differences.

[0099] The normalization formula is as follows: in, This represents the eigenvalues ​​after normalization. X Represents eigenvalues. represents the minimum eigenvalue under the corresponding feature dimension, represents the maximum eigenvalue under the corresponding feature dimension.

[0100] It should be noted that the unstructured data standardization module has a built-in data integrity judgment mechanism.

[0101] Wherein, the judgment rule of the built-in data integrity judgment mechanism is: the core transaction and behavior field integrity rate greater than or equal to 95% is qualified, and less than 95% is abnormal. Flow branch: qualified data enters feature engineering, and abnormal data triggers data re-collection or marks an invalid request.

[0102] It should be noted that the data integrity judgment is automatically triggered after the standardization is completed. Taking the core transaction and behavior field integrity rate greater than or equal to 95% as qualified and less than 95% as abnormal, the qualified data enters the feature engineering link, and the abnormal data triggers data re-collection or is marked as an invalid request.

[0103] The full-dimensional feature engineering module specifically includes: a static feature extraction unit, a dynamic behavior feature unit, and a market correlation feature unit.

[0104] Wherein, the static feature extraction unit extracts fixed features such as basic account attributes, asset value, and registration duration.

[0105] It should be noted that the static feature extraction unit captures more than 20 fixed features such as basic account attributes, asset value, and registration duration, and automatically fills missing feature values with zeros.

[0106] Wherein, the dynamic behavior feature unit extracts behavior features such as cross-location login, batch operation, high-frequency transaction, and abnormal password modification.

[0107] It should be noted that the dynamic behavior feature unit extracts more than 20 behavior features such as cross-location login, batch operation, high-frequency transaction, and abnormal password modification, and marks behaviors with an operation frequency threshold ≥ 5 times per minute as abnormal.

[0108] Wherein, the market correlation feature unit extracts value fluctuation features in combination with game versions, item market conditions, and transaction average prices.

[0109] It should be noted that the market correlation feature unit synchronizes game versions, item market conditions, and transaction average prices in real time, and calculates the value fluctuation coefficient to generate more than 10 market features.

[0110] It should be noted that the full-dimensional feature engineering module has a built-in feature validity judgment mechanism.

[0111] Wherein, the rule of the feature validity judgment mechanism is: the effective feature proportion greater than or equal to 90% is qualified, and less than 90% is abnormal. Flow branch: qualified data enters the AI risk control model, and abnormal data re-executes feature extraction.

[0112] It should be noted that 4. Feature validity judgment is automatically triggered after feature extraction is completed. Data with an effective feature proportion greater than or equal to 90% is deemed qualified, and data with a proportion less than 90% is deemed abnormal. Qualified data enters the AI risk control model, while abnormal data re-performs feature extraction.

[0113] The dual-model fusion AI risk control module specifically includes: a gradient tree discrimination unit, a time series behavior fitting unit, and a fusion decision unit.

[0114] The gradient tree discrimination unit processes high-dimensional static features to accurately locate the basic risk of the account.

[0115] It should be noted that the gradient tree discrimination unit performs inference immediately after feature input, processes high-dimensional static features and outputs a basic risk score to avoid overfitting.

[0116] The time series behavior fitting unit captures abnormal trends of continuous behaviors to identify hidden operation risks.

[0117] It should be noted that the time series behavior fitting unit and the gradient tree unit perform parallel calculations, and capture abnormal behavior trends based on time series features to identify hidden operation risks.

[0118] The fusion decision unit performs weighted fusion of the results of the two models, outputs a risk score ranging from 0 to 100, with an error rate of less than 1%.

[0119] It should be noted that the fusion decision unit performs weighted fusion of the output results of the two models through the formula: Risk Score = Gradient Tree Score × 40% + Time Series Behavior Score × 60%, generates a risk score ranging from 0 to 100, with a prediction error rate of less than 1% and a single inference time of no more than 1.5s.

[0120] The abnormal behavior trajectory perception module specifically includes: a trajectory clustering unit, an abnormal pattern matching unit, and a risk tracing unit.

[0121] The trajectory clustering unit performs clustering analysis on the behavior sequence to distinguish normal and abnormal operation habits.

[0122] It should be noted that the trajectory clustering unit uses the K-means algorithm to perform clustering analysis on the behavior sequence, and marks abnormal operation habits when the clustering similarity threshold is no more than 0.6.

[0123] The abnormal pattern matching unit matches more than a hundred abnormal patterns such as account theft, click farming, false transactions, and batch registration.

[0124] It should be noted that the abnormal pattern matching unit is connected to a library of more than 100 abnormal patterns, which can accurately identify abnormal behaviors such as account theft, click farming, false transactions, and batch registration, with a matching accuracy of no less than 99.8%.

[0125] Among them, the risk tracing unit locates the risk initiation node and generates a full-chain risk tracing report.

[0126] It should be noted that the risk tracing unit locates the risk initiation node and generates a time-series, end-to-end traceable report.

[0127] It should be noted that the abnormal behavior trajectory perception module is linked to the risk level determination mechanism.

[0128] The risk level assessment mechanism is as follows: 0-30 points - low risk; 31-60 points - medium risk; 61-100 points - high risk. The process is as follows: Low-risk individuals are allowed entry; medium-risk individuals undergo secondary verification; high-risk individuals are immediately blocked.

[0129] It should be noted that the risk level is determined as follows: 0-30 points is low risk, 31-60 points is medium risk, and 61-100 points is high risk. Low-risk transactions are allowed to proceed directly, medium-risk transactions trigger secondary verification, and high-risk transactions are immediately blocked.

[0130] The tiered intelligent processing module specifically includes: an automatic release unit, a secondary verification unit, a transaction interception unit, and an account management unit.

[0131] Among them, the automatic release unit allows low-risk transactions to pass without being detected, and does not affect normal circulation.

[0132] It should be noted that the automatic release unit is executed immediately upon the output of the low-risk score, releasing the transaction without interrupting the normal process.

[0133] The secondary verification unit triggers real-name, facial, or device verification for medium-risk situations, and releases the user after passing the verification.

[0134] It should be noted that the secondary verification unit is activated when the medium-risk score is output, triggering real-name, facial, or device verification. If the verification is successful, the user is allowed to proceed; otherwise, the user is blocked.

[0135] Among them, the transaction interception unit immediately terminates orders and freezes fund flows for high-risk transactions.

[0136] It should be noted that the transaction interception unit is executed instantly when a high-risk score is output, terminating the order and freezing the flow of funds to prevent asset loss.

[0137] Among them, the account management unit restricts transactions and blacklists malicious and risky accounts.

[0138] It should be noted that the account management unit executes the action when identifying malicious risks, taking irreversible control measures such as restricting transactions and blacklisting the account, with a processing time of ≤100ms.

[0139] The real-time early warning and sample iteration module specifically includes: an early warning push unit, a sample annotation unit, and an automatic iteration unit.

[0140] Among them, the early warning push unit pushes risk information and handling results to the platform and users in real time.

[0141] It should be noted that after the early warning push unit completes the handling, it immediately pushes risk details to the platform and transaction status notifications to the user through both SMS and system messages, with a response time of ≤100ms.

[0142] Among them, the sample labeling unit automatically labels the risk control results and builds an incremental sample library.

[0143] It should be noted that the sample labeling unit automatically marks released orders as positive samples and intercepted orders as negative samples, thus building an incremental risk control sample library.

[0144] Among them, the automatic iteration unit updates the model regularly based on new samples, continuously improving the recognition accuracy.

[0145] It should be noted that the automatic iteration unit performs incremental training based on incremental samples every day at midnight, and uses a gray-scale release method to seamlessly switch and update the model, continuously optimizing feature weights and discrimination rules.

[0146] The above are merely specific embodiments of the present invention, but the scope of protection of the present invention is not limited thereto. The scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for monitoring abnormal transaction behavior of game accounts, characterized in that, include: S1: Collect full-dimensional data corresponding to game account transaction requests; S2: De-identify and standardize the full-dimensional data to obtain standard risk control data; S3: Perform full-dimensional feature extraction on the standard risk control data to obtain the risk control feature vector; S4: Generate a risk score corresponding to the game account transaction request based on the risk control feature vector; S5: Based on the standard risk control data, perform abnormal behavior trajectory detection and obtain abnormal behavior matching results; S6: Determine the risk level corresponding to the game account transaction request based on the risk score and the abnormal behavior matching result; S7: Based on the risk level, the game account transaction requests are processed in a tiered manner to monitor abnormal game account transaction behavior.

2. The method for monitoring abnormal game account transaction behavior according to claim 1, characterized in that: The comprehensive data specifically includes: transaction data, behavioral trajectory data, and device environment data.

3. The method for monitoring abnormal game account transaction behavior according to claim 1, characterized in that: S2 specifically includes: S201: Identify sensitive information in the full-dimensional data; S202: Perform hash encryption masking on the sensitive information to obtain de-identified transaction data; S203: Perform unstructured data parsing on the de-identified transaction data to obtain structured transaction data; S204: Normalize the structured transaction data to obtain the standard risk control data.

4. The method for monitoring abnormal game account transaction behavior according to claim 1, characterized in that: S3 specifically includes: S301: Extract static features, dynamic behavioral features, and market correlation features from the standard risk control data; S302: Generate the risk control feature vector based on the static features, the dynamic behavioral features, and the market correlation features.

5. The method for monitoring abnormal game account transaction behavior according to claim 1, characterized in that: S4 specifically includes: S401: Input the risk control feature vector into the gradient tree discrimination model and output the basic risk score; S402: Input the risk control feature vector into the time series behavior fitting model and output the time series behavior score; S403: The basic risk score and the time-series behavior score are fused to generate the risk score.

6. The method for monitoring abnormal game account transaction behavior according to claim 1, characterized in that: S5 specifically includes: S501: Construct a user operation sequence based on the aforementioned standard risk control data; S502: Perform cluster analysis on the user operation sequence using the K-means algorithm to obtain the cluster analysis results; S503: Match the clustering analysis results with the preset abnormal pattern library to obtain the abnormal behavior matching results.

7. The method for monitoring abnormal game account transaction behavior according to claim 1, characterized in that: The risk levels specifically include: the first risk level, the second risk level, and the third risk level; S701: When the risk level is the first risk level, the game account transaction request is automatically approved; S702: When the risk level is the second risk level, the game account transaction request is subject to secondary verification. S703: When the risk level is the third risk level, the transaction request for the game account is intercepted.

8. The method for monitoring abnormal game account transaction behavior according to claim 1, characterized in that: Following S7, it also includes: S8: Based on the hierarchical processing results, generate records of abnormal game account transactions, and use these records as risk control samples for feedback.

9. A monitoring system for abnormal game account transaction behavior, characterized in that, The game account transaction abnormal behavior monitoring method applied to any one of claims 1 to 8 includes: a multi-source behavior data collection module, a privacy compliance desensitization module, an unstructured data standardization module, a full-dimensional feature engineering module, a dual-model fusion AI risk control module, an abnormal behavior trajectory perception module, a hierarchical intelligent handling module, and a real-time early warning and sample iteration module; The multi-source behavioral data acquisition module, the privacy compliance desensitization module, the unstructured data standardization module, the full-dimensional feature engineering module, the dual-model fusion AI risk control module, the abnormal behavior trajectory perception module, the hierarchical intelligent handling module, and the real-time early warning and sample iteration module are connected in sequence.

10. The game account transaction abnormal behavior monitoring system according to claim 9, characterized in that: The multi-source behavioral data acquisition module specifically includes: a transaction data acquisition unit, a behavioral trajectory acquisition unit, and a device environment acquisition unit; The privacy compliance desensitization module specifically includes: a sensitive information identification unit and an irreversible desensitization unit; The unstructured data standardization module specifically includes: a text structuring unit, a behavior sequence encoding unit, and a data normalization unit; The full-dimensional feature engineering module specifically includes: a static feature extraction unit, a dynamic behavior feature unit, and a market-related feature unit; The dual-model fusion AI risk control module specifically includes: a gradient tree discrimination unit, a time-series behavior fitting unit, and a fusion decision unit; The abnormal behavior trajectory perception module specifically includes: a trajectory clustering unit, an abnormal pattern matching unit, and a risk tracing unit; The tiered intelligent processing module specifically includes: an automatic release unit, a secondary verification unit, a transaction interception unit, and an account management unit; The real-time early warning and sample iteration module specifically includes: an early warning push unit, a sample labeling unit, and an automatic iteration unit.

Images