User behavior data processing method and device, electronic equipment and storage medium

Abstract

The application discloses a user behavior data processing method and device, electronic equipment and a storage medium. The method comprises the following steps: acquiring user multi-source behavior data and converting the user multi-source behavior data into behavior events; aggregating the behavior events according to a user dimension, arranging all behavior events of the same user in ascending order of event occurrence time, constructing a user dynamic behavior event sequence, and recording the user dynamic behavior event sequence as S_u={E1, E2,..., En}, wherein n is the total number of behavior events of the user; further encoding and risk attribute labeling are performed on each event in the constructed user dynamic behavior event sequence; the user dynamic behavior event sequence is divided by using multiple types of windows, dynamic behavior time sequence features are extracted from the user behavior event sequence based on the divided multiple types of windows; and the dynamic behavior time sequence features of different windows, different types and different risk meanings that are extracted above are fused to generate a user risk feature vector that can be used by a risk control model. The application improves the accuracy and timeliness of credit risk control.

Description

Technical Field

[0001] This application relates to the field of credit risk control technology, and in particular to a user behavior data processing method, device, electronic device, and storage medium. Background Technology

[0002] In credit risk control scenarios, user behavior data is the core basis for assessing user credit risk and identifying fraudulent behavior. Currently, there are four main implementation schemes for processing user behavior data and constructing risk characteristics, each with its own limitations, as detailed below:

[0003] However, this fixed-window static aggregation method has obvious limitations: on the one hand, it cannot fully express the time sequence, interval, trend and fluctuation characteristics of user behavior, and it is difficult to capture the dynamic change pattern of user behavior; on the other hand, it cannot effectively identify abnormal changes in user behavior, and does not consider the degree of impact of recent behavior on the user's current risk status, resulting in the constructed features being unable to comprehensively and accurately depict the user's risk changes, thereby affecting the evaluation effect of the credit risk control model and increasing the risk of credit business.

[0004] Option 1 is a fixed-time-window statistical scheme, a widely used basic scheme in credit risk control. Its core process is: raw behavioral data → data cleaning → user-dimensional aggregation → fixed-window statistics → static statistical features → risk control model scoring. Specifically, this scheme aggregates behavioral data by user dimension and selects fixed time lengths such as the past 1 day, 7 days, 30 days, and 90 days as statistical windows. It calculates core indicators such as the number of applications, logins, loan amounts, repayments, overdue payments, and device replacements within each window, using these static statistical indicators as input features for the risk control model. The advantage of this scheme is its simplicity and high computational efficiency, but it has significant limitations: it can only achieve static aggregation of behavioral data, failing to fully express the temporal sequence, intervals, trends, and fluctuations of user behavior. It struggles to capture the dynamic changes in user behavior and cannot effectively identify abnormal abrupt changes in behavior, resulting in features that cannot comprehensively depict the dynamic changes in user risk.

[0005] Option 2 is a manual rule-based identification solution. Its core process is: user behavior data → risk rule base → rule matching → risk labeling → approval or manual review. In this solution, risk control personnel configure risk identification rules based on their business experience. For example, rules could be set such as "application frequency exceeds a threshold in the past 24 hours," "loan application after logging in from a different location," "bank card modification after logging in from a new device," and "multiple changes to mobile phone number within a short period." By matching user behavior data with the risk rule base, risk labels are assigned to users, leading to approval results or manual review suggestions. The advantage of this solution is its strong rule interpretability and traceable risk control decisions. However, it relies heavily on the business experience of risk control personnel, has limited rule coverage, struggles to handle complex and ever-changing user behaviors and new fraud methods, and has low rule iteration efficiency, failing to achieve automated risk feature mining and updating.

[0006] Option 3 is a scoring card or machine learning model approach, an optimization of the fixed-window statistical approach. Its core process is: raw behavioral data → feature engineering → manually constructed features → model training and prediction → risk scoring. Specifically, the system inputs manually constructed fixed-window statistical features, credit features, loan repayment features, and device features into models such as logistic regression scoring cards, decision trees, random forests, GBDT, XGBoost, and LightGBM for training. The trained model then outputs a user risk score. The risk assessment effectiveness of this approach highly depends on the quality of the pre-processing feature engineering. If the input manually constructed features lack the ability to express the temporal information of user behavior, the model will struggle to fully identify the user's dynamic risk, fail to effectively capture the temporal evolution of behavior and abnormal changes, and the feature engineering process is time-consuming and labor-intensive, making it unsuitable for processing large-scale, high-dimensional behavioral data.

[0007] Option four is a behavioral sequence modeling approach. This approach aims to utilize the temporal information of user behavior. Its core process is: user behavior data → sequence construction → sequence model training → risk prediction. Specifically, this approach constructs behavioral sequences by chronologically ordering user behavior. These sequences are then input into sequence models such as RNN, LSTM, GRU, Transformer, or temporal convolutional networks for deep learning. The model automatically learns the temporal features and correlations within the behavioral sequences to achieve risk prediction. The advantage of this approach lies in its ability to utilize behavioral sequence information to uncover deep correlations between behaviors. However, it typically suffers from problems such as complex model structure, high requirements for sample size and computing power, weak model interpretability, and high real-time deployment costs. In scenarios such as credit approval and compliance interpretation, where high interpretability and real-time performance are crucial, its implementation is challenging and large-scale application is difficult.

[0008] In summary, none of the four existing solutions can effectively address the core issues of "integration of multi-source heterogeneous behavioral data" and "extraction of dynamic temporal risk features." They either fail to fully express the dynamic temporal characteristics of user behavior or rely on human experience, making implementation difficult. Therefore, there is an urgent need for a method and system that can automatically integrate multi-source heterogeneous behavioral data and comprehensively extract dynamic behavioral temporal features, including behavioral time sequence, behavioral intervals, behavioral trends, behavioral fluctuations, abnormal mutations, and the degree of impact of recent behaviors, in order to improve the accuracy, timeliness, and interpretability of credit risk control. Summary of the Invention

[0009] This application provides a user behavior data processing method, device, electronic device, and storage medium to process multi-source, heterogeneous, and continuously occurring user behavior data to construct dynamic behavioral time-series features that comprehensively reflect user risk characteristics, thereby improving the accuracy and timeliness of credit risk control. It is applicable to the entire credit risk control process, including credit application approval, post-loan risk warning, and fraud identification.

[0010] The embodiments of this application adopt the following technical solutions:

[0011] In a first aspect, embodiments of this application provide a user behavior data processing method, wherein the method includes:

[0012] Acquire multi-source user behavior data and transform it into behavior events. Each behavior event includes a user identifier, event time, event type, event value, event attributes, business scenario, device environment information, and risk attribute identifier, and is represented as follows:

[0013] E = {user_id, event_time, event_type, event_value, event_attr, scene, device_info, risk_tag}, where user_id is a unique user identifier used to associate all behaviors of the same user; event_time is the standard time when the event occurred; event_type is the type code of the behavior event; event_value is the numerical information corresponding to the event; event_attr is the additional attribute information of the event; scene is the business scenario in which the event occurred; device_info is the device environment information when the event occurred; and risk_tag is the risk attribute identifier of the event, used to initially mark the risk characteristics of the event.

[0014] The behavioral events are aggregated according to the user dimension. All behavioral events of the same user are arranged in ascending order according to the occurrence time of the event to construct a dynamic behavioral event sequence of the user, denoted as S_u={E1,E2,...,En}, where n is the total number of behavioral events of the user;

[0015] Each event in the constructed user dynamic behavior event sequence is further coded and labeled with risk attributes. The coding content includes event type coding, amount value coding, behavior frequency statistics coding, time attribute coding, device attribute coding, geographical location coding, and business scenario coding. The risk attribute labeling includes whether it is a new device operation, whether it is a login from a different location, whether it is a night operation, whether it is a sensitive account change, whether there is an overdue behavior, and whether it is an operation through a high-risk channel.

[0016] Multi-type windows are used to segment the user's dynamic behavior event sequence. Based on the segmented multi-type windows, dynamic behavior time-series features, including at least behavior frequency features, amount features, interval features, trend features, fluctuation features, abnormal change features, time decay features, and behavior combination features, are extracted from the user behavior event sequence.

[0017] By fusing the dynamic behavioral time-series features extracted above from different windows, types, and risk meanings, a user risk feature vector that can be used by the risk control model is generated.

[0018] In some embodiments, the user multi-source behavioral data is specifically divided into four types of data sources:

[0019] The first category of core credit business data includes credit applications, loan disbursements, proactive repayments, business extensions, and overdue records.

[0020] The second category of account operation data includes system login, page clicks, fund transaction records, and account information changes;

[0021] The third category of equipment and geographical location data includes equipment fingerprints, terminal models, login IPs, and provincial / municipal geographical locations;

[0022] The fourth category of external auxiliary risk data includes fragments of the People's Bank of China's credit information, third-party multiple borrowing, and fraud risk labels;

[0023] Before converting the raw multi-source behavioral data into standardized behavioral events, a complete data preprocessing workflow is performed. The specific preprocessing steps are as follows:

[0024] The system includes duplicate record deduplication, missing field filling, filtering of abnormal business values, unified global time format, unified amount, currency and unit, alignment of user identifier mapping across multiple data sources, and removal of invalid and noisy data. Missing field filling can be achieved through business rules, mean / median, or model prediction. Abnormal values ​​are identified and marked for removal using statistical thresholds or business risk control thresholds. The unified time format is a standard timestamp.

[0025] In some embodiments, when constructing a sequence of user dynamic behavior events, if multiple behavior events carry the same timestamp, they are sorted a second time according to a preset priority rule.

[0026] The sorting priority rule is as follows: high-risk events such as overdue payments and account changes take priority, followed by core credit business events, and ordinary login and browsing operations take the last place, ensuring that the risk order of events within the sequence is readable.

[0027] In some embodiments, the multiple types of differentiated windows include five window types:

[0028] Fixed duration windows can be configured with fixed time intervals of approximately 1 hour, 1 day, 7 days, 30 days, and 90 days, covering short, medium, and long-term behavioral statistics;

[0029] The sliding statistical window uses daily and weekly sliding steps to successively shift and divide the fixed duration window, capturing the daily dynamic changes in behavior.

[0030] The event count window uses the user's most recent N core behaviors of the same type as the window boundary, where N is a custom positive integer, to adapt to users with low-frequency behaviors.

[0031] Adaptive density window: Real-time statistics of the density of users' historical behavior. The window duration is shortened for users with dense behavior and automatically extended for users with sparse behavior.

[0032] The time decay weight window uses the current risk assessment point as a benchmark and calculates the weight of each behavior using a linear decay or exponential decay formula. Behaviors closer to the assessment point are assigned higher statistical weights to amplify the impact of recent behaviors on risk.

[0033] In some embodiments, the various dynamic behavior temporal features are specifically defined as follows:

[0034] Behavioral frequency characteristics: the total number of times each type of behavior occurs within the window, including the number of applications, logins, device changes, and overdue payments;

[0035] Statistical characteristics of the amount: average loan amount within the window, total repayment amount, month-on-month decrease in continuous repayment amount, capital volatility, and loan-to-expenditure ratio;

[0036] Behavioral interval characteristics, the time interval between two adjacent behaviors of the same type, and the interval mean, standard deviation, maximum interval, and minimum interval;

[0037] Behavioral change trends were observed through cross-window comparisons, revealing a linear trend of continuously increasing application frequency, gradually decreasing monthly repayment amount, and increased equipment replacement frequency.

[0038] Behavioral fluctuation characteristics, including the frequency fluctuation coefficient of behavior within the window, the range of changes in cross-regional login locations, and the monthly capital fluctuation coefficient;

[0039] Abnormal mutation characteristics are identified by calculating the difference, ratio, and standardized quantile deviation between short-term window indicators and medium- to long-term historical averages to identify the risk of sudden increases or decreases in behavior in the short term.

[0040] The time decay characteristic is used to calculate the weighted number of applications, the weighted number of risky operations, and the total amount of loans based on the decay weight.

[0041] Behavioral combination characteristics are analyzed by counting the number of times the combination hits and the time of the most recent hit according to the preset risk links of the business. The preset risk links include: new device login - change the bound mobile phone number - initiate a loan application, login from a different IP address - change the bank card binding - withdraw funds, continuous repayment delay - apply for extension - add a new loan.

[0042] In some embodiments, dynamic behavioral temporal feature fusion employs multiple fusion methods individually or in combination: direct feature vector concatenation, weighted fusion based on risk discrimination, hierarchical window grouping statistical fusion, risk control rule discrete encoding fusion, and autoencoder / attention mechanism deep learning encoding fusion; in weighted fusion, weight coefficients are used to distinguish between fraud features, overdue features, and regular behavioral features, thereby increasing the proportion of high-risk features in the vector.

[0043] In some embodiments, the method further includes a feature persistence and reuse step:

[0044] All original single-window time-series features and fused user risk feature vectors are uniformly stored in a distributed feature library;

[0045] The feature library supports two calling scenarios: offline scenarios provide historical samples for batch training of risk control models, and online real-time scenarios connect to real-time credit approval and post-loan monitoring interfaces for real-time inference.

[0046] At the same time, version tags and user time snapshots are added to each batch of generated features to achieve traceable management of the entire feature lifecycle.

[0047] Secondly, embodiments of this application also provide a user behavior data processing apparatus, wherein the apparatus includes:

[0048] The acquisition and conversion module is used to acquire multi-source user behavior data and convert it into behavior events. Each behavior event includes a user identifier, event time, event type, event value, event attribute, business scenario, device environment information, and risk attribute identifier, and is represented as follows:

[0049] E = {user_id, event_time, event_type, event_value, event_attr, scene, device_info, risk_tag}, where user_id is a unique user identifier used to associate all behaviors of the same user; event_time is the standard time when the event occurred; event_type is the type code of the behavior event; event_value is the numerical information corresponding to the event; event_attr is the additional attribute information of the event; scene is the business scenario in which the event occurred; device_info is the device environment information when the event occurred; and risk_tag is the risk attribute identifier of the event, used to initially mark the risk characteristics of the event.

[0050] The module is used to aggregate the behavioral events by user dimension, arrange all behavioral events of the same user in ascending order of event occurrence time, and construct a user dynamic behavioral event sequence, denoted as S_u={E1,E2,...,En}, where n is the total number of behavioral events of the user;

[0051] The encoding and labeling module is used to further encode and label each event in the constructed user dynamic behavior event sequence. The encoding content includes event type encoding, amount value encoding, behavior frequency statistics encoding, time attribute encoding, device attribute encoding, geographical location encoding, and business scenario encoding. The risk attribute labeling includes whether it is a new device operation, whether it is a login from a different location, whether it is a nighttime operation, whether it is a sensitive account change, whether there is an overdue behavior, and whether it is an operation through a high-risk channel.

[0052] The segmentation and extraction module is used to segment the user dynamic behavior event sequence using multiple types of windows. Based on the segmented multi-type windows, dynamic behavior time-series features are extracted from the user behavior event sequence, including at least behavior frequency features, amount features, interval features, trend features, fluctuation features, abnormal mutation features, time decay features, and behavior combination features.

[0053] The acquisition module is used to fuse the dynamic behavioral time-series features extracted above from different windows, types, and risk meanings to generate a user risk feature vector that can be used by the risk control model.

[0054] Thirdly, embodiments of this application also provide an electronic device, including: a processor; and a memory arranged to store computer-executable instructions, which, when executed, cause the processor to perform the above-described method.

[0055] Fourthly, embodiments of this application also provide a computer-readable storage medium that stores one or more programs, which, when executed by an electronic device including multiple applications, cause the electronic device to perform the above-described method.

[0056] The above-mentioned at least one technical solution adopted in the embodiments of this application can achieve the following beneficial effects: It provides a user behavior data processing method, which obtains multi-source user behavior data and transforms it into behavior events. Each behavior event includes user identifier, event time, event type, event value, event attribute, business scenario, device environment information, and risk attribute identifier, and is represented as E={user_id,event_time,event_type,event_value,event_attr,scene,device_info,risk_tag}. Standardized behavior events uniformly carry multi-source heterogeneous data from all credit channels, breaking down data barriers between different businesses, devices, and third-party data. It can integrate scattered data such as application, repayment, device, geographical location, and credit information through only one unified event structure, solving the defects of traditional solutions such as inconsistent formats of multiple data sources and inability to jointly model, and greatly improving the efficiency of multi-dimensional behavior data fusion and utilization. The behavioral events are aggregated according to the user dimension. All behavioral events of the same user are arranged in ascending order of event occurrence time to construct a dynamic user behavioral event sequence, denoted as S_u={E1,E2,...,En}, where n is the total number of behavioral events of the user. A complete user behavior sequence with time sorting rules is constructed, which fully preserves the order of occurrence of behaviors and adjacent relationships. This is different from the drawback of losing the time sequence logic in traditional fixed-window static statistical schemes. It can fully depict the evolution process of user behavior and provide a basic carrier for capturing dynamic risks. Each event in the constructed user dynamic behavior event sequence is further coded and labeled with risk attributes. The coding content includes event type coding, amount value coding, behavior frequency statistics coding, time attribute coding, device attribute coding, geographical location coding, and business scenario coding. The risk attribute labeling includes whether it is a new device operation, whether it is a login from a different location, whether it is a nighttime operation, whether it is a sensitive account change, whether there is an overdue behavior, and whether it is an operation through a high-risk channel. By subdividing and coding events and marking them with multi-dimensional risks, the system can automatically identify risk mutations by comparing and calculating deviations between short, medium, and long-term window indicators. This eliminates the need for risk control personnel to manually add rules, proactively discovers new fraud behavior patterns, reduces the reliance on manual iteration of risk control rules, and improves the timeliness and generalization ability of risk identification.This approach employs multiple window types to segment user dynamic behavior event sequences. Based on these segmented windows, it extracts dynamic behavioral time-series features from the user behavior event sequences, including at least behavioral frequency, monetary value, interval, trend, fluctuation, anomalous change, time decay, and behavioral combination features. The collaborative segmentation using multiple window types addresses multiple needs, including long- and short-term statistics, dynamic trend tracking, low-frequency user adaptation, adaptive behavior density, and recent risk weighting. This overcomes the limitations of a single fixed window, which can only provide static statistics and cannot adapt to different user activity levels. Time decay features amplify the impact of recent behavior, aligning with the business logic of short-term operations in credit risk control that better reflect the current risk status. Furthermore, it extracts eight time-series features—frequency, monetary value, interval, trend, fluctuation, anomalous change, time decay, and behavioral combination—at once. This not only quantifies basic behavioral statistical indicators but also automatically identifies behavioral change trends, fluctuation amplitudes, short-term risk anomalous changes, and continuous fraudulent behavior chains. This overcomes multiple shortcomings of manual rules (incomplete coverage), traditional machine learning features (lack of dynamic time-series expression), poor interpretability of simple sequence models, and high deployment costs. The dynamic behavioral time-series features extracted above, representing different windows, types, and risk meanings, are fused to generate user risk feature vectors usable by risk control models. The output is a standardized, structured risk feature vector that can seamlessly integrate with various mainstream risk control systems such as scoring cards, traditional tree models, and deep learning. It balances model performance with business interpretability, avoiding the difficulties in implementation and compliance explanation associated with pure deep sequence models. It is suitable for various business scenarios, including online real-time approval, offline model training, and post-loan risk warning.

[0057] Furthermore, the aforementioned process is a fully automated pipeline, from raw data eventification, sequence construction, encoding and annotation, multi-granularity window segmentation, multi-dimensional temporal feature extraction to feature fusion output. It eliminates the need for manual layer-by-layer construction of temporal features, significantly reducing the manpower required for feature engineering while improving the accuracy of credit risk identification and effectively reducing losses from delinquency and fraud. Moreover, it is equipped with a complete feature storage and version management mechanism, allowing extracted temporal features to be persistently reused. Offline batch training and online real-time inference share a single feature production logic, reducing redundant computation overhead and lowering the computing power and development / maintenance costs of the credit risk control system. Attached Figure Description

[0058] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0059] Figure 1 This is a flowchart illustrating the user behavior data processing method in an embodiment of this application;

[0060] Figure 2This is a schematic diagram of the user behavior event sequence in the user behavior data processing method in the embodiments of this application;

[0061] Figure 3 This is a schematic diagram of short-term / medium-term / long-term multi-window feature extraction in the user behavior data processing method of this application embodiment;

[0062] Figure 4 This is a schematic diagram of the user behavior data processing device in the embodiments of this application;

[0063] Figure 5 This is a schematic diagram of the structure of an electronic device according to an embodiment of this application. Detailed Implementation

[0064] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0065] The technical solutions provided by the various embodiments of this application are described in detail below with reference to the accompanying drawings.

[0066] This application provides a user behavior data processing method, such as... Figure 1 The diagram illustrates a user behavior data processing method according to an embodiment of this application. The method includes at least the following steps S110 to S140:

[0067] Step S110: Obtain multi-source user behavior data and convert it into behavior events. Each behavior event includes a user identifier, event time, event type, event value, event attribute, business scenario, device environment information, and risk attribute identifier, and is represented as follows:

[0068] E={user_id,event_time,event_type,event_value,event_attr,scene,device_info,risk_tag}, where user_id is a unique user identifier used to associate all behaviors of the same user; event_time is the standard time when the event occurred; event_type is the type code of the behavior event; event_value is the numerical information corresponding to the event; event_attr is the additional attribute information of the event; scene is the business scenario in which the event occurred; device_info is the device environment information when the event occurred; and risk_tag is the risk attribute identifier of the event, used to initially mark the risk characteristics of the event.

[0069] Collect multi-source behavioral data of users in credit risk control scenarios. The data sources cover core credit business data such as credit application, borrowing, repayment, extension, and overdue payment; account operation data such as login, page access, transaction flow, and account changes; device and environmental data such as device fingerprints, IP addresses, and geographical locations; and external auxiliary data such as credit data and third-party risk data. This ensures that the data covers all dimensions of information on user credit behavior, operational behavior, environmental characteristics, and external credit status.

[0070] The collected raw data undergoes standardized preprocessing to eliminate noise and standardize the data format, laying the foundation for subsequent processing. Preprocessing operations include: data deduplication (removing redundant data from repeated collections); missing value handling (filling missing data using methods such as mean imputation, median imputation, business rule imputation, or model prediction imputation); outlier handling (identifying and processing abnormal data deviating from the normal range using statistical analysis, business rules, or isolated forest algorithms); time format standardization (converting timestamps in all data to a unified standard time format); monetary unit standardization (converting monetary data from different units to the same currency unit); user identifier mapping (assigning a unique user identifier to each user to achieve user identity association across data sources); behavior type encoding (classifying and encoding different types of behavior data, converting unstructured behavior descriptions into structured coded data); and data denoising (removing random noise from the data using filtering, smoothing, and other algorithms to improve data quality). (1) Data deduplication: Remove duplicate login records and duplicate transaction records; (2) Missing value handling: Fill missing device model data with mode and missing application channel data with business rules; (3) Outlier handling: Identify and remove abnormal loan amounts (single loan applications that are 15 times higher than the user's monthly income) through the 3σ statistical threshold, mark and remove abnormal records; (4) Format unification: Convert the timestamps in all data to the standard format "YYYY-MM-DDHH:MM:SS", and convert all amount data to RMB yuan; (5) User identifier mapping: Assign a unique global user identifier user_001268 to the user, realize the user identity association across multiple data sources such as credit business, account operation, and device environment; (6) Behavior type encoding: Encode different behavior types digitally, such as credit application (001), system login (002), active repayment (003), mobile phone number modification (004), login from other places (005), and overdue repayment (006).

[0071] The preprocessed multi-source heterogeneous data is converted into behavioral events in a unified format. Each behavioral event contains eight core elements: user identifier, event time, event type, event value, event attribute, business scenario, device environment information, and risk attribute identifier. This can be represented as E={user_id, event_time, event_type, event_value, event_attr, scene, device_info, risk_tag}. Here, user_id is a unique user identifier used to associate all actions of the same user; event_time is the standard time of the event occurrence; event_type is the type code of the behavioral event, such as application, loan, login, etc.; event_value is the corresponding numerical information of the event, such as loan amount, login duration, etc.; event_attr is the additional attribute information of the event, such as application channel, counterparty, etc.; scene is the business scenario in which the event occurs, such as loan application scenario, post-loan repayment scenario, etc.; device_info is the device environment information at the time of the event, such as device model, IP address, geographical location, etc.; and risk_tag is the risk attribute identifier of the event, used to initially label the risk characteristics of the event.

[0072] The preprocessed multi-source heterogeneous data is uniformly converted into standardized behavioral events according to eight preset core elements. Each behavioral event is represented as E={user_id,event_time,event_type,event_value,event_attr,scene,device_info,risk_tag}. The assignment rules and specific transformation examples for each element are as follows:

[0073] (1) user_id (user unique identifier): uniformly assigned a globally unique identifier for the user. In this embodiment, it is fixed as user_001268, which is used to associate all behavioral events of the user;

[0074] (2) event_time (standard time of event occurrence): The value is a preprocessed timestamp of the event occurrence in a uniform format, which can be accurate to the second;

[0075] (3) event_type (behavior event type code): assigned the numerical code of the behavior type completed in the preprocessing stage;

[0076] (4) event_value (event value information): For behaviors with quantified values, assign a specific value; for behaviors without quantified values, assign "none";

[0077] (5) event_attr (event-attached attribute): Assigns supplementary descriptive information about the behavior, such as application channel, login method, counterparty, etc.;

[0078] (6) Scene (business scenario): Based on the business scenario in which the behavior occurs, it is assigned to one of four categories: "credit application scenario", "loan repayment scenario", "account management scenario" and "risk verification scenario";

[0079] (7) device_info (device environment information): The value is a combination of device model, login IP, geographical location, and network type, in the format of "device model / IP address / geographical location / network type";

[0080] (8) risk_tag (risk attribute identifier): Based on business rules and preliminary risk assessment, it is assigned the values ​​"no risk", "low risk", "medium risk" and "high risk" to initially mark the risk characteristics of a single event.

[0081] By unifying multi-source, heterogeneous data on credit operations, account operations, device environments, and external risks into standardized behavioral events, the system breaks down format barriers between different data sources, achieving structured integration of multi-dimensional behavioral data. The transformed behavioral events contain core elements such as user identity, time, behavior type, environmental information, and preliminary risk tags, fully preserving key information about user behavior. Furthermore, the unified event format lays a solid foundation for subsequently constructing dynamic user behavior event sequences and extracting dynamic temporal features, effectively addressing the technical pain points of existing technologies that make it difficult to collaboratively utilize multi-source data and jointly characterize user risk.

[0082] Step S120: Aggregate the behavioral events by user dimension, arrange all behavioral events of the same user in ascending order of event occurrence time, and construct a user dynamic behavioral event sequence, denoted as S_u={E1,E2,...,En}, where n is the total number of behavioral events of the user.

[0083] Behavioral events in a unified format are aggregated by user dimension. All behavioral events of the same user are arranged in ascending order of occurrence time to construct a dynamic behavioral event sequence, denoted as S_u={E1,E2,...,En}, where n is the total number of behavioral events for that user. For multiple behavioral events occurring at the same timestamp, a secondary sorting can be performed based on business logic priority or event risk level to ensure that the event sequence accurately reflects the chronological order, adjacency relationships, and business scenario associations of user behaviors. This event sequence can completely preserve the temporal evolution of user behavior, providing a foundation for subsequent temporal feature extraction.

[0084] Step S130: Further encode and label each event in the constructed user dynamic behavior event sequence with risk attributes. The encoding content includes event type encoding, amount value encoding, behavior frequency statistics encoding, time attribute encoding, device attribute encoding, geographical location encoding, and business scenario encoding. The risk attribute labeling includes whether it is a new device operation, whether it is a login from a different location, whether it is a nighttime operation, whether it is a sensitive account change, whether there is an overdue behavior, and whether it is an operation through a high-risk channel.

[0085] Each event in the constructed user dynamic behavior event sequence is further coded and annotated with risk attributes to enrich the event's feature dimensions. The coding includes event type coding, monetary value coding, behavior frequency statistics coding, time attribute coding (such as event occurrence time period, holiday identifiers), device attribute coding (such as device type, whether it's a new device), geographic location coding (such as region level, whether it's from a different location), and business scenario coding, achieving the numerical conversion of non-numerical features. Risk attribute annotation includes, but is not limited to, whether it's a new device operation, whether it's a login from a different location, whether it's a nighttime operation, whether it's a sensitive account change, whether there's overdue behavior, and whether it's an operation through high-risk channels. Through business rules and risk models, the risk characteristics of events are accurately labeled, providing support for subsequent risk feature extraction.

[0086] Step S140: Use multi-type windows to segment the user dynamic behavior event sequence. Based on the segmented multi-type windows, extract dynamic behavior time-series features from the user behavior event sequence, including at least behavior frequency features, amount features, interval features, trend features, fluctuation features, abnormal mutation features, time decay features, and behavior combination features.

[0087] To adapt to the different behavioral frequencies of users and the needs of different credit risk control scenarios, multiple types of windows are used to segment the sequence of user dynamic behavioral events, specifically including the following five window types:

[0088] (1) Fixed window: Select fixed time lengths such as the last hour, 1 day, 7 days, 30 days, and 90 days as windows to cover different time dimensions such as short-term, medium-term, and long-term, and use them to statistically analyze user behavior characteristics within different time spans;

[0089] (2) Sliding window: The fixed window is divided into segments by sliding steps of hours, days, and weeks to capture the dynamic trend of user behavior. For example, the sliding window for the past 7 days (step of 1 day) can reflect the changes in the user's daily behavior in the past week.

[0090] (3) Event Count Window: The window is based on the N most recent specific behavioral events, such as the 3 most recent applications, the 5 most recent logins, the 2 most recent repayments, etc., focusing on the core behavioral characteristics of users recently, which is suitable for users with low behavioral frequency;

[0091] (4) Adaptive window: The window length is dynamically adjusted according to the user behavior density. For users with high behavior frequency, the window length is appropriately shortened, and for users with low behavior frequency, the window length is appropriately extended to ensure that each window contains enough effective behavior data and improve the effectiveness of feature extraction.

[0092] (5) Time decay window: A window is constructed based on time decay weights. The closer the behavior is to the current assessment point, the higher the weight is assigned, highlighting the impact of recent behavior on the user's current risk status. The decay weight can be calculated by exponential decay, linear decay, etc.

[0093] Based on the segmented multi-type windows, eight categories of dynamic behavioral temporal features are extracted from the user behavior event sequence to comprehensively depict user behavior patterns and risk characteristics, specifically including:

[0094] (1) Behavioral frequency characteristics: Statistically count the number of different types of behaviors in each window, such as the number of applications, logins, device changes, and overdue periods in the window, to reflect the activity level of user behavior;

[0095] (2) Amount characteristics: Calculate the amount statistics corresponding to the behavior in each window, such as the average loan amount, the total repayment amount, the decline in repayment amount, the amount volatility, the ratio of loan to repayment amount, etc., to reflect the user's capital flow characteristics and changes in repayment ability;

[0096] (3) Interval characteristics: Calculate the time interval between adjacent similar behavioral events, as well as statistical indicators such as the mean, standard deviation, maximum value, and minimum value of the interval, such as the mean of adjacent application intervals, repayment intervals, and login interval standard deviations, to reflect the regularity of user behavior;

[0097] (4) Trend characteristics: By comparing and analyzing the characteristics of multiple windows, the changing trends of behavior are extracted, such as the upward trend of application frequency, the downward trend of repayment amount, and the upward trend of device replacement frequency, so as to capture the dynamic changes of user behavior.

[0098] (5) Fluctuation characteristics: Calculate the volatility of indicators such as behavior frequency and amount in each window, such as behavior frequency volatility, location change range, amount volatility coefficient, etc., to reflect the stability of user behavior;

[0099] (6) Abnormal mutation characteristics: By calculating the difference, ratio or standardized deviation of short-term behavioral characteristics relative to medium- and long-term historical behavioral characteristics, abnormal mutations in user behavior can be identified, such as the deviation of short-term application number relative to long-term daily average number, the sudden increase in the number of logins from different locations, etc., to capture potential risk signals.

[0100] (7) Time decay characteristics: Combine time decay weights to calculate weighted statistical indicators of behavior within each window, such as weighted application number, weighted risk behavior number, weighted loan amount, etc., to highlight the impact of recent behavior;

[0101] (8) Behavioral combination characteristics: Identify the continuous behavioral links of users, and count the number of hits and the most recent occurrence time of risky behavioral combinations, such as "login to new device → change mobile phone number → apply for loan", "login from other place → change bank card binding → cash withdrawal", "repayment delay → extension → borrow again" and other risky links to capture users' fraudulent behavior or high-risk operation patterns.

[0102] Step S150: The dynamic behavioral time-series features extracted above for different windows, types, and risk meanings are fused to generate a user risk feature vector that can be used by the risk control model.

[0103] The dynamic behavioral time-series features extracted above, representing different windows, types, and risk meanings, are fused to generate a user risk feature vector usable by the risk control model. Fusion methods include, but are not limited to, feature concatenation, weighted fusion, hierarchical statistical fusion, rule-based encoding fusion, and model-based encoding fusion: Feature concatenation directly concatenates all features according to their dimensions to form a high-dimensional feature vector; Weighted fusion assigns different weights based on the risk discrimination of features, enhancing the impact of core risk features; Hierarchical statistical fusion performs hierarchical statistics on features of different windows and types before fusion, preserving the hierarchical structure of the features; Rule-based encoding fusion combines business risk control rules to encode and transform features before fusion; Model-based encoding fusion encodes features using models such as autoencoders and attention mechanisms to extract deep correlation information. The final generated user risk feature vector is denoted as V_u={F1,F2,...,Fm}, where m is the total dimension of the fused features.

[0104] Specifically, generating user risk feature vectors that can be used by risk control models includes

[0105] 1) Intra-window fusion: Within the same time window, basic statistical features, behavioral interval features, trend features, abnormal change features, and time decay features under the same behavioral type are combined to form a single-window behavioral feature set;

[0106] 2) Cross-window fusion: Compare similar features in short-term, medium-term and long-term windows, and calculate the difference, ratio, rate of change or standardized deviation between short-term and long-term to characterize the degree of change of recent behavior relative to historical behavior;

[0107] 3) Cross-behavioral integration: The characteristics of different behavioral types such as application, login, borrowing, repayment, device change, account change, and remote access are associated and combined to form cross-behavioral risk characteristics, such as "number of applications after logging in with a new device", "borrowing amount after account change", and "number of times borrowing again after repayment delay".

[0108] 4) Risk weight fusion: Based on the risk level of the behavior type, the distance between the time of the behavior and the current assessment time, and whether the combination of behaviors hits the preset risk pattern, different characteristics are assigned corresponding weights to generate weighted risk characteristics;

[0109] 5) Vectorized output: The fused features are concatenated, normalized, or encoded according to preset feature encoding rules to generate a user risk feature vector `V_u={F1,F2,...,Fm}`, which can be used by the rule engine, scorecard model, or machine learning model.

[0110] In one embodiment of this application, the user multi-source behavioral data is specifically divided into four types of data sources: the first type is core credit business data, including credit applications, loan disbursements, proactive repayments, business extensions, and overdue records; the second type is account operation data, including system logins, page clicks, fund transaction records, and account information changes; the third type is device and geographical location environment data, including device fingerprints, terminal models, login IPs, and provincial / municipal geographical locations; and the fourth type is external auxiliary risk data, including People's Bank of China credit information fragments, third-party multiple lending, and fraud risk tags. Before converting the original multi-source behavioral data into standardized behavioral events, a complete data preprocessing process is performed. The preprocessing steps are as follows: deduplication of duplicate records, filling of missing fields, filtering of abnormal business values, unification of global time format, unification of amount, currency, and unit, alignment of user identifier mapping from multiple data sources, and removal of invalid and noisy data. Among these, filling of missing fields adopts any one of the following methods: filling with business rules, filling with mean / median, or filling with model prediction; abnormal values ​​are identified and marked for removal through statistical thresholds or business risk control thresholds; and the unified time format is a standard timestamp.

[0111] In actual business implementation, the system connects with internal credit business systems, account management systems, device tracking services, credit reporting platforms, and third-party risk service providers, simultaneously pulling user behavior data across all dimensions. The data sources are divided into four categories: core credit business data, account operation data, device geolocation data, and external auxiliary risk data. Core credit business data includes loan applications, loan disbursements, proactive repayments, loan extensions, and overdue records; account operation data includes login behavior, page browsing history, fund transaction records, and changes to account information such as mobile phone numbers and bank cards; device geolocation data includes unique device fingerprints, terminal models, login IP addresses, and the province / city of operation; and external auxiliary risk data includes credit summary information, third-party multiple borrowing records, and external fraud risk tags.

[0112] Before being converted into standard behavioral events, raw data undergoes a standardized preprocessing workflow, covering seven key steps: data deduplication, missing field filling, outlier filtering, time format standardization, monetary unit standardization, multi-system user ID mapping, and noise data removal. Missing fields can be filled using three methods depending on the business scenario: default filling based on business rules, filling with statistical mean / median, or filling with a simple prediction model. Outliers are identified and filtered using dual verification with 3σ statistical thresholds or credit business risk control thresholds. Time information from all systems is uniformly converted to a standard timestamp format, and amounts in various currencies are uniformly converted to RMB. User identifiers with different codes within business systems, device platforms, and third-party interfaces are mapped to globally unique user_ids, achieving seamless user behavior data flow across all data sources. Noisy data such as invalid clicks, test operations, and duplicate queries without business value are directly removed to ensure input data quality and eliminate data barriers caused by inconsistent formats and definitions across multiple data sources.

[0113] All preprocessed structured data is uniformly transformed into standardized behavioral events, and each behavioral event adopts a uniform structure definition.

[0114] E={user_id,event_time,event_type,event_value,event_attr,scene,device_info,risk_tag}

[0115] Among them, user_id is a globally unique user identifier, serving as the primary key to link all operations of the same user; event_time stores the time of the event in a unified standard format; event_type is a predefined numerical code for the behavior type, distinguishing different behaviors such as application, repayment, login, and account change; event_value stores the quantified value corresponding to the behavior, and fills in an empty identifier if there is no quantified indicator; event_attr records additional text attributes such as channel, operation method, and change content; scene marks business scenarios such as loan application, post-loan management, and account operation; device_info integrates operating environment information such as device model, IP, geographical location, and network environment; risk_tag is a preliminary risk tag at the single-event granularity, marking the basic risk attributes inherent in this behavior in advance.

[0116] By unifying the event structure, the originally scattered and heterogeneous multi-channel data is transformed into a unified structured carrier, providing standardized input for subsequent time-series processing.

[0117] In one embodiment of this application, when constructing a sequence of user dynamic behavior events, if multiple behavior events carry the same timestamp, they are sorted a second time according to a preset priority rule. The priority rule is: high-risk events such as overdue payments and account changes take priority, followed by core credit business events, and ordinary login and browsing operations take the last place, ensuring that the risk order of events within the same time period in the sequence is readable.

[0118] The system aggregates all standardized behavioral events of a user, grouped by user_id, and generates an initial behavioral sequence S_u={E1,E2,...,En}, sorted in ascending order by event_time timestamp, where n represents the total number of valid behavioral events for the user. For scenarios where multiple behavioral events have identical timestamps, the system configures a fixed priority rule for secondary rearrangement: high-risk operations such as overdue payments, account re-binding, and mobile phone number changes have the highest priority; core credit businesses such as loan disbursement, repayment, and loan applications have the next highest priority; and low-risk operations such as ordinary login and page browsing have the lowest priority. This sorting rule ensures that multiple behaviors at the same time are arranged in the sequence according to their risk level, fully preserving the time sequence of user behaviors and the correlation between adjacent behaviors. This overcomes the deficiency of traditional static statistics, which completely loses the logical sequence of behaviors, and fully reconstructs the evolution path of user risky behaviors.

[0119] For each behavioral event in the sequence, multi-level coding and risk labeling are carried out. The coding dimensions cover event type coding, discrete coding of monetary value, statistical coding of behavior frequency, time period / holiday time attribute coding, coding of device newness / oldness attribute, coding of geographical location attribute, and coding of business scenario classification, converting all text and classification information into calculable values; the corresponding risk attribute labeling dimensions include whether it is a new device operation, whether it is a cross-province login, whether it is an operation in the early morning or at night, whether it is a change of sensitive accounts such as bank card / mobile phone number, whether there is a history of overdue payments, and whether the business operation is initiated through high-risk promotion channels.

[0120] Multi-dimensional encoding and risk labeling refine the hidden risk information of each behavior, supporting subsequent feature calculation logic such as window comparison, mutation identification, and risk link mining.

[0121] In one embodiment of this application, the multi-type differentiated windows include five window types: a fixed duration window, configured with fixed time intervals of 1 hour, 1 day, 7 days, 30 days, and 90 days, covering short, medium, and long-term behavior statistics; a sliding statistics window, with daily and weekly sliding steps, progressively shifting and dividing the fixed duration window to capture daily dynamic changes in behavior; an event quantity window, using the user's most recent N core behaviors of the same type as the window boundary, where N is a custom positive integer, adapted for users with low-frequency behavior; an adaptive density window, which statistically analyzes the density of users' historical behavior in real time, shortening the window duration for users with dense behavior and automatically extending the window duration for users with sparse behavior; and a time decay weight window, which uses the current risk assessment point as a benchmark and calculates the weight of each behavior using a linear decay or exponential decay formula, assigning higher statistical weights to behaviors closer to the assessment point, amplifying the impact of recent behavior on risk.

[0122] Five types of differentiated windows are used to segment the complete behavioral sequence, taking into account multiple needs such as long-term and short-term statistics, dynamic trend tracking, high- and low-frequency user adaptation, and recent risk weighting. The five types of windows work in parallel and do not replace each other.

[0123] Fixed duration window: Configure fixed intervals of the past 1 hour, 1 day, 7 days, 30 days, and 90 days, which correspond to short-term, medium-term, and long-term behavior statistics, respectively;

[0124] Sliding statistics window: Using daily and weekly steps, a fixed window is moved to continuously capture the dynamic changes in user behavior on a daily and weekly basis.

[0125] Event Count Window: The window boundaries are defined by the user's most recent N core behaviors of the same type, where N is a configurable positive integer, specifically designed for users whose behaviors occur very infrequently.

[0126] Adaptive density window: Real-time statistics of the average daily density of users' historical behaviors. The window duration is automatically shortened for users with intensive behaviors and extended for users with sparse behaviors, ensuring that each window contains a sufficient number of effective behavior samples.

[0127] Time decay weight window: Based on the current risk assessment time, the statistical weight of each behavior is calculated using a linear decay or exponential decay formula. The closer the time of the behavior is to the assessment time, the higher the weight is assigned, amplifying the impact of recent operations on the user's current risk status.

[0128] Multi-granularity window combinations can break down user behavior from different time scales and statistical dimensions, making up for the shortcomings of a single fixed window that can only statically aggregate and cannot capture dynamic changes.

[0129] In one embodiment of this application, various dynamic behavioral time-series characteristics are specifically defined as follows: Behavior frequency characteristics: the total number of occurrences of each type of behavior within the window, including the number of applications, logins, device replacements, and overdue payments; Amount statistics characteristics: the average loan amount, total repayment amount, month-on-month decrease in continuous repayment amount, capital volatility, and loan-to-expenditure ratio within the window; Behavior interval characteristics: the time interval between two adjacent behaviors of the same type, as well as the mean, standard deviation, maximum interval, and minimum interval; Behavior trend characteristics: a linear trend obtained by comparing multiple windows, showing a continuous increase in application frequency, a gradual decrease in monthly repayment amount, and an increase in device replacement frequency; Behavior fluctuation characteristics: the window... Internal behavior frequency fluctuation coefficient, cross-regional login geographical variation range, and monthly capital fluctuation coefficient; abnormal mutation characteristics, short-term window indicators are compared with medium- and long-term historical averages by calculating the difference, ratio, and standardized quantile deviation to identify the risk of short-term sudden increases or decreases in behavior; time decay characteristics, weighted application number, weighted risk operation number, and weighted loan amount are calculated based on decay weight; behavior combination characteristics, the number of combinations hit and the time of the most recent hit are statistically analyzed according to the business preset risk links. The preset risk links include: new device login - change the bound mobile phone number - initiate a loan application, login from a different IP address - change the bank card binding - withdraw funds, continuous repayment delay - apply for extension - new loan.

[0130] Based on the fully segmented window data, eight types of dynamic temporal features are extracted to comprehensively quantify user behavior patterns and potential risks:

[0131] Behavioral frequency characteristics: Statistics on the number of times various behaviors occur in each window, including the frequency of behaviors such as application, login, device replacement, and overdue;

[0132] Financial statistics features: Calculate financial indicators such as average borrowing amount, total repayment amount, month-on-month decrease in repayment amount, capital volatility, and loan-to-expenditure ratio within the calculation window;

[0133] Behavioral interval characteristics: Calculate the time interval between adjacent similar behaviors, as well as the mean, standard deviation, and extreme values ​​of the intervals, to determine whether there is a stable pattern in user behavior;

[0134] Behavioral change trend characteristics: Cross-short window comparison identifies linear trends such as increased application frequency, continuous decrease in repayment amount, and more frequent device replacements;

[0135] Behavioral fluctuation characteristics: Quantify the fluctuation coefficient of behavioral frequency, the change range of cross-regional login, and the monthly fluctuation range of funds to judge the stability of user behavior;

[0136] Abnormal mutation characteristics: By calculating the difference, ratio, and standardized deviation between short-term window indicators and medium- to long-term historical averages, we can accurately identify risk anomalies such as sudden increases or decreases in short-term behavior.

[0137] Time decay feature: Combine decay weights to calculate weighted application count, weighted risk operation count, and weighted total loan amount, highlighting recent risky behavior;

[0138] Behavioral combination characteristics: Matching preset fraud risk behavior links, and counting the number of times the link is hit and the most recent occurrence time. Typical risk links include new device login → change mobile phone number → apply for loan, login from other places → change bank card binding → cash withdrawal, repayment delay → loan extension → new loan.

[0139] The entire feature system simultaneously covers basic statistics, temporal changes, mutations and anomalies, and continuous fraud chains, making up for the multiple shortcomings of traditional features that lack temporal expression, incomplete coverage of manual rules, and poor interpretability of pure deep learning.

[0140] Unlike basic features such as frequency, amount, and interval that are independently counted for a single behavior, this feature identifies multi-step operation links that are sequential and causally related. Based on the fraud and overdue high-risk behavior patterns accumulated from credit business, a standardized risk link template is pre-configured. Within various segmented windows, user behavior event sequences are matched in chronological order, and two core quantitative indicators are calculated: one is the total number of hits of the corresponding risk link; the other is the time of the most recent complete hit of the link. This is used to capture complex risk behaviors that are implemented step by step and are concealed.

[0141] Pre-matching basics

[0142] Based on the standardized behavioral event sequence S_u={E1,E2,...,En}, all events within the sequence carry a unified event_type behavior code, event_time timestamp, and risk_tag risk label. Events are strictly arranged in ascending order of time, with higher-risk events at the same timestamp given priority, ensuring that the order of behaviors is traceable and matchable.

[0143] Link matching rules

[0144] A risk link consists of two or more nodes with ordered behavior connected in series, and matching must meet two conditions simultaneously:

[0145] (1) Timing constraints: Each action node in the link must occur in the order of the template, and the order of actions is not allowed to be reversed;

[0146] (2) Window constraint: A valid hit is determined only if all behavioral nodes in the entire link fall within the same statistical window (short-term / medium-term / long-term fixed window, sliding window, event number window, etc.);

[0147] Output two core feature values

[0148] Link Hit Count: The total number of times the risk link template is fully matched within the current window; Recent Hit Time: The event timestamp corresponding to the last behavior of the link when the link was fully matched within the window. It is used to distinguish whether the risk behavior is recent or a distant historical behavior. It can be combined with time decay weight to amplify the impact of recent link risks.

[0149] Three types of pre-defined risk links: Detailed explanation of each business line, risk logic, and feature calculation method.

[0150] Link 1: New device login → Change bound mobile phone number → Initiate loan application

[0151] Link behavior node breakdown:

[0152] Node 1: New device login, the corresponding event risk_tag is marked as "new device operation", and event_type is the login type code; Node 2: Modify the bound mobile phone number, event_type is the sensitive account change code, which belongs to the high-risk account operation; Node 3: Initiate a loan application, event_type is the credit application code, and the user finally submits a loan credit request.

[0153] Underlying business risk logic:

[0154] This chain represents a typical operational process for online account theft and fraudulent loan applications using fake identities: After obtaining another person's account, criminals first log in using an unfamiliar terminal to circumvent device risk control, then change the registered mobile phone number to take over the account and receive verification codes, and finally immediately apply for credit funds. The entire continuous operation has extremely strong fraudulent characteristics; regular, genuine users would not immediately change their mobile phone number and apply for loans after logging in on a brand new device.

[0155] Corresponding output combination features

[0156] Feature 1: Total number of hits in the complete link of "New Device Login - Change Mobile Number - Loan Application" within the window; Feature 2: Time of the most recent complete hit of the loan application event in this link.

[0157] Link 2: Login from a different IP address → Change bank card binding → Withdraw funds

[0158] Link behavior node breakdown:

[0159] Node 1: Login from a different IP address, the event risk is marked as login from a different location, the operation location does not match the province or city that the user usually uses; Node 2: Change of bank card binding, which belongs to the sensitive account change operation of fund settlement; Node 3: Fund withdrawal, the event_type is the fund withdrawal transaction code.

[0160] Underlying business risk logic:

[0161] This chain typically corresponds to the risk of account theft and fund withdrawal: logging in from a region other than the user's usual location indicates that the account has been logged in from a different location. Then, the receiving bank card is changed, and finally, a cash withdrawal operation is performed. The purpose is to transfer the available credit limit and balance of funds in the account, which belongs to a high-risk fraud chain involving funds.

[0162] Corresponding output combination features:

[0163] Feature 1: Total number of times the complete link of "login from another location - change bank card - withdraw funds" is hit within the window; Feature 2: Time of the most recent complete hit of the withdrawal operation event in this link.

[0164] Link 3: Continuous repayment delay → Apply for loan extension → New loan

[0165] Link behavior node breakdown: Node 1: Continuous repayment delay, multiple repayment behaviors are later than the agreed repayment date, the event is accompanied by overdue and repayment delay risk labels; Node 2: Apply for extension, event_type is the business extension code, the user actively applies to extend the repayment period; Node 3: New loan, the user submits a new loan application on the basis of the existing debt extension.

[0166] Underlying business risk logic:

[0167] This link points to the deterioration of a user's debt repayment ability, multiple debts, and the risk of overdue and bad debts. Unlike fraud-related links, it belongs to the core model of pre-loan and post-loan overdue warning: the user has already experienced repayment difficulties, and the user alleviates the short-term repayment pressure by extending the loan, while continuing to borrow new loans, the debt scale continues to expand, and the probability of subsequent overdue and bad debts increases significantly.

[0168] Corresponding output combination features:

[0169] Feature 1: Total number of times the complete link of "Repayment Delay - Apply for Extension - Add Loan" is hit within the window; Feature 2: Time of the most recent complete hit of the new loan event in this link.

[0170] In one embodiment of this application, dynamic behavioral temporal feature fusion employs multiple fusion methods, used individually or in combination: direct feature vector concatenation, weighted fusion based on risk discrimination, hierarchical window grouping statistical fusion, risk control rule discrete encoding fusion, and autoencoder / attention mechanism deep learning encoding fusion; in weighted fusion, weight coefficients are used to distinguish between fraud features, overdue features, and regular behavioral features, thereby increasing the proportion of high-risk features in the vector.

[0171] The generated user risk feature vectors are input into the credit risk control model or rule engine for user risk assessment. The risk control model can employ traditional machine learning models such as scoring cards, logistic regression, decision trees, random forests, GBDT, XGBoost, and LightGBM, or deep learning models. Based on the input feature vectors, it outputs assessment results such as the user's risk score, credit approval result, credit limit suggestion, fraud risk level, and post-loan warning level. For users with high risk levels, it can output suggestions for manual review, improving the accuracy and flexibility of risk control decisions.

[0172] For time-series features with multiple windows, multiple types, and different risk weights, the system supports various fusion methods used individually or in combination, including direct feature concatenation, weighted fusion based on risk discrimination, hierarchical window grouping statistical fusion, discrete encoding fusion based on risk control rules, and deep learning encoding fusion using autoencoders / attention mechanisms. During weighted fusion, weight coefficients are used to distinguish between fraudulent, overdue, and regular behavioral features, increasing the proportion of high-risk features in the final vector; deep learning encoding is used to uncover deep correlations between features and reduce feature redundancy.

[0173] After fusion, a structured one-dimensional user risk feature vector is generated and directly input into the credit risk control decision-making system. The decision-making system is compatible with various traditional machine learning models, including scoring cards, logistic regression, decision trees, random forests, GBDT, XGBoost, and LightGBM, as well as deep neural networks. The model outputs a comprehensive risk score, approval / rejection conclusion, credit limit recommendation, fraud risk level, and post-loan warning level. For high-risk users, it simultaneously outputs manual review suggestions, balancing model prediction performance with business compliance interpretability.

[0174] In one embodiment of this application, the method further includes a feature persistence and reuse step: all original single-window time-series features and fused user risk feature vectors are uniformly stored in a distributed feature library; the feature library supports two calling scenarios: offline scenario provides historical samples for batch training of risk control models, and online real-time scenario connects to real-time credit approval and post-loan monitoring interfaces for real-time inference; at the same time, version tags and user time snapshots are added to each batch of generated features to achieve traceable management of the entire feature lifecycle.

[0175] The extracted dynamic behavioral time-series features and the fused user risk feature vectors are stored in a feature library to establish a feature management system, supporting offline model training and online real-time inference. In offline scenarios, the feature library provides large-scale, multi-dimensional feature data for risk control model training, improving model training performance. In online scenarios, features can be quickly extracted and fused based on real-time user behavior data to generate real-time risk feature vectors, providing efficient support for scenarios such as real-time loan application approval and real-time post-loan early warning, enabling feature reuse and full-process application. A feature persistence and reuse process is added, storing all single-window original time-series features and fused user risk feature vectors in a unified distributed feature library, establishing a standardized feature management system. The feature library simultaneously supports two types of business scenarios: in offline scenarios, it outputs massive user feature samples in batches for periodic offline retraining, feature importance analysis, and model iterative optimization; in online real-time scenarios, it connects to loan approval and post-loan monitoring interfaces, reading, calculating, and generating user risk feature vectors in real time, supporting millisecond-level online risk inference.

[0176] Meanwhile, the system configures independent version labels and user behavior time snapshots for each batch of generated features, and fully records the data source, window parameters, and fusion rules during feature calculation, realizing full lifecycle traceability of features, which facilitates subsequent risk backtracking, problem investigation and rule iteration; offline training and online inference reuse the same set of feature production logic, reducing redundant calculations and lowering system computing power and development and maintenance costs.

[0177] like Figure 2As shown, the system collects a user's credit application data, loan repayment data for the past 6 months, account login and operation data, device fingerprint and IP address data, credit report data, and third-party risk data. The data preprocessing module deduplicates the collected data, removing duplicate login records; fills in missing device model data using the mode; marks and removes abnormal loan amounts (more than 10 times the user's monthly income); converts all timestamps to the "YYYY-MM-DDHH:MM:SS" format; unifies the unit of amount to RMB; assigns a unique user_id to the user, and encodes the types of behaviors such as application, login, and repayment (application: 001, login: 002, repayment: 003). The preprocessed data is converted into unified behavioral events. For example, an event E1={user_001,2026-07-0109:30:25,001,5000,Online Channels,Loan Application,Device A / IP1 / Beijing,No Risk}, and E2={user_001,2026-07-0110:15:40,002,None,Password Login,Account Operation,Device A / IP1 / Beijing,No Risk}. The event sequence construction module arranges all behavioral events of the user in ascending order of time, generating a user behavior sequence S_u={E1,E2,E3,...,E28}, which includes 28 behavioral events such as application, login, repayment, and device replacement. Each event in the event sequence is coded and labeled with a risk attribute. For example, the behavior of "device replacement" is labeled as "high risk," and "login from another location" is labeled as "medium risk." The window segmentation module uses fixed windows (last 7 days, 30 days), sliding windows (7-day window, 1-day step), event quantity windows (last 3 applications), and time decay windows to segment the user's event sequence, generating multi-type window data. Based on the segmented window data, the module extracts the user's behavioral frequency features (2 applications and 15 logins in the last 7 days), amount features (average loan amount of 3000 yuan in the last 30 days, 20% decrease in repayment amount), interval features (15-day interval between adjacent applications), trend features (30% increase in login frequency in the last 7 days), anomalous change features (device change frequency in the last 3 days deviates from the long-term average by 150%), time decay features (weighted application frequency of 1.8 times), and behavioral combination features (matching the "new device login → loan application" combination once). The feature fusion module uses a combination of feature concatenation and weighted fusion to fuse the above features into a user risk feature vector V_u={2,15,3000,20%,15,30%,150%,1.8,1,...}. The generated feature vector is input into the XGBoost risk control model. The model outputs a risk score of 75 points for the user (out of 100 points, the higher the score, the lower the risk). The approval result is "approved", the credit limit is suggested to be 8,000 yuan, there is no risk of fraud, and no manual review is required.Meanwhile, the extracted features and the fused feature vectors are stored in a feature library for use in subsequent model training and other scenarios.

[0178] like Figure 3 As shown, taking the current assessment point as the endpoint, three behavioral windows—short-term (1 / 3 day), medium-term (7 / 30 days), and long-term (90 / 180 days)—are extracted to the left along the historical behavior time axis. Basic indicators such as behavior frequency, amount, and interval are statistically analyzed within each of the three windows. The short-term and medium-term indicators are cross-operated with the long-term benchmark indicators, and multi-window comparison features are generated by calculating the difference, ratio, standardized deviation, and trend slope. The multi-window comparison features are incorporated into eight categories of dynamic time-series features, participate in subsequent feature fusion, and are input into the risk control model to complete the risk assessment.

[0179] like Figure 3 As shown, the basic coordinate axes are: historical behavior timeline and current evaluation point.

[0180] The historical behavior timeline uses arrows from left to right to represent the direction of time progression. The left side shows the user's earlier historical behavior, and the rightmost vertical line marks the current assessment point, which is the real-time node for credit risk control execution risk scoring and approval judgment. All windows use this point as the endpoint and trace back to the left to capture the user's historical behavior data.

[0181] The hierarchical labels are defined as follows: the right side of the long-term window is labeled "long-term benchmark"; the right side of the medium-term window is labeled "medium-term changes"; and the right side of the short-term window is labeled "short-term anomalies". The three windows each serve different dimensions of risk control interpretation, depicting user behavior in a layered manner.

[0182] (1) Short-term window: the next 1 day / 3 days

[0183] Time range: User behavior events within 1 or 3 days prior to the current assessment point are captured, with the shortest time span; Risk control positioning: Short-term anomaly capture, focusing on users' recent sudden operations, such as multiple applications in a short period of time, frequent changes in linked bank cards, and overnight operations in different locations, etc., which are instantaneous risk behaviors; Technical value: Separate statistics can reflect the user's latest operational behavior and are the core data source for identifying fraudulent and sudden operations.

[0184] (2) Mid-term window: the next 7 days / 30 days

[0185] Time range: Using the current assessment point as the endpoint, the behavior over a period of 7 or 30 days is captured, with the time span being in the middle; Risk control positioning: Mid-term change observation, used to capture continuous deviations in behavior within a period of time, such as gradual risks such as a continuous decrease in repayment amount over 30 consecutive days, a continuous increase in weekly application frequency, and frequent changes in login devices; Technical value: Connecting short-term instantaneous operations with long-term stable habits, depicting the phased change trend of user behavior.

[0186] (3) Long-term window: the last 90 days / 180 days

[0187] Time range: Starting from the current assessment point, the entire historical behavior of the user is captured over a period of 90 or 180 days, covering the user's complete credit lifecycle; Risk control positioning: A long-term benchmark, representing the baseline of the user's normalized and stable historical behavior, serving as a standard for judging whether short-term and medium-term behavior deviates from normal habits; Technical value: Provides the mean, median, and normal fluctuation range of the user's historical behavior, serving as a benchmark for calculating deviation, difference, and ratio.

[0188] The three-layered windows are nested and cover different time granularities. At the same time, they correspond to the fixed-duration window type described in the claims of this invention, achieving full coverage of short / medium / long-term behaviors and overcoming the limitation that a single window can only perform statistics on a single time scale.

[0189] The statistical indicators from the three-layer window converge downwards, and a unified calculation is used to generate multi-window comparison features. The figure indicates that this type of feature includes four calculation logics: difference, ratio, deviation, and trend slope. The business meaning of each calculation method is as follows:

[0190] Difference: Short-term indicator value minus long-term benchmark indicator value, intuitively quantifying the absolute difference between short-term behavior and historical norms; Ratio: Short-term indicator ÷ Long-term benchmark indicator, eliminating the influence of indicator dimensions and quantifying relative volatility; Standardized deviation: Standardizing short-term indicators based on long-term window mean and standard deviation to unify the threshold for judging risk anomalies; Trend slope: Using short-term, medium-term, and long-term window indicators as time series sampling points, fitting a linear slope to quantify the rate of change of behavior continuously rising / falling.

[0191] This application embodiment also provides a user behavior data processing device 400, such as Figure 4 As shown, a schematic diagram of the user behavior data processing device in this application embodiment is provided. The device 400 includes at least: an acquisition and conversion module 410, a construction module 420, an encoding and annotation module 430, a segmentation and extraction module 440, and an acquisition module 450, wherein:

[0192] In one embodiment of this application, the acquisition and conversion module 410 is specifically used to: acquire multi-source user behavior data, convert it into behavior events, each behavior event including user identifier, event time, event type, event value, event attribute, business scenario, device environment information, and risk attribute identifier, and represented as...

[0193] E={user_id,event_time,event_type,event_value,event_attr,scene,device_info,risk_tag}, where user_id is a unique user identifier used to associate all behaviors of the same user; event_time is the standard time when the event occurred; event_type is the type code of the behavior event; event_value is the numerical information corresponding to the event; event_attr is the additional attribute information of the event; scene is the business scenario in which the event occurred; device_info is the device environment information when the event occurred; and risk_tag is the risk attribute identifier of the event, used to initially mark the risk characteristics of the event.

[0194] Collect multi-source behavioral data of users in credit risk control scenarios. The data sources cover core credit business data such as credit application, borrowing, repayment, extension, and overdue payment; account operation data such as login, page access, transaction flow, and account changes; device and environmental data such as device fingerprints, IP addresses, and geographical locations; and external auxiliary data such as credit data and third-party risk data. This ensures that the data covers all dimensions of information on user credit behavior, operational behavior, environmental characteristics, and external credit status.

[0195] The collected raw data undergoes standardized preprocessing to eliminate noise and standardize the data format, laying the foundation for subsequent processing. Preprocessing operations include: data deduplication (removing redundant data from repeated collections); missing value handling (filling missing data using methods such as mean imputation, median imputation, business rule imputation, or model prediction imputation); outlier handling (identifying and processing abnormal data deviating from the normal range using statistical analysis, business rules, or isolated forest algorithms); time format standardization (converting timestamps in all data to a unified standard time format); monetary unit standardization (converting monetary data from different units to the same currency unit); user identifier mapping (assigning a unique user identifier to each user to achieve user identity association across data sources); behavior type encoding (classifying and encoding different types of behavior data, converting unstructured behavior descriptions into structured coded data); and data denoising (removing random noise from the data using filtering, smoothing, and other algorithms to improve data quality). (1) Data deduplication: Remove duplicate login records and duplicate transaction records; (2) Missing value handling: Fill missing device model data with mode and missing application channel data with business rules; (3) Outlier handling: Identify and remove abnormal loan amounts (single loan applications that are 15 times higher than the user's monthly income) through the 3σ statistical threshold, mark and remove abnormal records; (4) Format unification: Convert the timestamps in all data to the standard format "YYYY-MM-DDHH:MM:SS", and convert all amount data to RMB yuan; (5) User identifier mapping: Assign a unique global user identifier user_001268 to the user, realize the user identity association across multiple data sources such as credit business, account operation, and device environment; (6) Behavior type encoding: Encode different behavior types digitally, such as credit application (001), system login (002), active repayment (003), mobile phone number modification (004), login from other places (005), and overdue repayment (006).

[0196] The preprocessed multi-source heterogeneous data is converted into behavioral events in a unified format. Each behavioral event contains eight core elements: user identifier, event time, event type, event value, event attribute, business scenario, device environment information, and risk attribute identifier. This can be represented as E={user_id, event_time, event_type, event_value, event_attr, scene, device_info, risk_tag}. Here, user_id is a unique user identifier used to associate all actions of the same user; event_time is the standard time of the event occurrence; event_type is the type code of the behavioral event, such as application, loan, login, etc.; event_value is the corresponding numerical information of the event, such as loan amount, login duration, etc.; event_attr is the additional attribute information of the event, such as application channel, counterparty, etc.; scene is the business scenario in which the event occurs, such as loan application scenario, post-loan repayment scenario, etc.; device_info is the device environment information at the time of the event, such as device model, IP address, geographical location, etc.; and risk_tag is the risk attribute identifier of the event, used to initially label the risk characteristics of the event.

[0197] The preprocessed multi-source heterogeneous data is uniformly converted into standardized behavioral events according to eight preset core elements. Each behavioral event is represented as E={user_id,event_time,event_type,event_value,event_attr,scene,device_info,risk_tag}. The assignment rules and specific transformation examples for each element are as follows:

[0198] (1) user_id (user unique identifier): uniformly assigned a globally unique identifier for the user. In this embodiment, it is fixed as user_001268, which is used to associate all behavioral events of the user;

[0199] (2) event_time (standard time of event occurrence): The value is a preprocessed timestamp of the event occurrence in a uniform format, which can be accurate to the second;

[0200] (3) event_type (behavior event type code): assigned the numerical code of the behavior type completed in the preprocessing stage;

[0201] (4) event_value (event value information): For behaviors with quantified values, assign a specific value; for behaviors without quantified values, assign "none";

[0202] (5) event_attr (event-attached attribute): Assigns supplementary descriptive information about the behavior, such as application channel, login method, counterparty, etc.;

[0203] (6) Scene (business scenario): Based on the business scenario in which the behavior occurs, it is assigned to one of four categories: "credit application scenario", "loan repayment scenario", "account management scenario" and "risk verification scenario";

[0204] (7) device_info (device environment information): The value is a combination of device model, login IP, geographical location, and network type, in the format of "device model / IP address / geographical location / network type";

[0205] (8) risk_tag (risk attribute identifier): Based on business rules and preliminary risk assessment, it is assigned the values ​​"no risk", "low risk", "medium risk" and "high risk" to initially mark the risk characteristics of a single event.

[0206] By unifying multi-source, heterogeneous data on credit operations, account operations, device environments, and external risks into standardized behavioral events, the system breaks down format barriers between different data sources, achieving structured integration of multi-dimensional behavioral data. The transformed behavioral events contain core elements such as user identity, time, behavior type, environmental information, and preliminary risk tags, fully preserving key information about user behavior. Furthermore, the unified event format lays a solid foundation for subsequently constructing dynamic user behavior event sequences and extracting dynamic temporal features, effectively addressing the technical pain points of existing technologies that make it difficult to collaboratively utilize multi-source data and jointly characterize user risk.

[0207] In one embodiment of this application, the construction module 420 is specifically used to: aggregate the behavioral events according to the user dimension, arrange all behavioral events of the same user in ascending order according to the event occurrence time, and construct a user dynamic behavioral event sequence, denoted as S_u={E1,E2,...,En}, where n is the total number of behavioral events of the user.

[0208] Behavioral events in a unified format are aggregated by user dimension. All behavioral events of the same user are arranged in ascending order of occurrence time to construct a dynamic behavioral event sequence, denoted as S_u={E1,E2,...,En}, where n is the total number of behavioral events for that user. For multiple behavioral events occurring at the same timestamp, a secondary sorting can be performed based on business logic priority or event risk level to ensure that the event sequence accurately reflects the chronological order, adjacency relationships, and business scenario associations of user behaviors. This event sequence can completely preserve the temporal evolution of user behavior, providing a foundation for subsequent temporal feature extraction.

[0209] In one embodiment of this application, the encoding and labeling module 430 is specifically used for: step S130, further encoding and risk attribute labeling of each event in the constructed user dynamic behavior event sequence, wherein the encoding content includes event type encoding, amount value encoding, behavior frequency statistics encoding, time attribute encoding, device attribute encoding, geographical location encoding, and business scenario encoding; wherein the risk attribute labeling includes whether it is a new device operation, whether it is a login from a different location, whether it is a night operation, whether it is a sensitive account change, whether there is an overdue behavior, and whether it is an operation through a high-risk channel.

[0210] Each event in the constructed user dynamic behavior event sequence is further coded and annotated with risk attributes to enrich the event's feature dimensions. The coding includes event type coding, monetary value coding, behavior frequency statistics coding, time attribute coding (such as event occurrence time period, holiday identifiers), device attribute coding (such as device type, whether it's a new device), geographic location coding (such as region level, whether it's from a different location), and business scenario coding, achieving the numerical conversion of non-numerical features. Risk attribute annotation includes, but is not limited to, whether it's a new device operation, whether it's a login from a different location, whether it's a nighttime operation, whether it's a sensitive account change, whether there's overdue behavior, and whether it's an operation through high-risk channels. Through business rules and risk models, the risk characteristics of events are accurately labeled, providing support for subsequent risk feature extraction.

[0211] In one embodiment of this application, the segmentation and extraction module 440 is specifically used to: segment the user dynamic behavior event sequence using a multi-type window, and extract dynamic behavior time-series features from the user behavior event sequence based on the segmented multi-type window, including at least behavior frequency features, amount features, interval features, trend features, fluctuation features, abnormal mutation features, time decay features, and behavior combination features.

[0212] To adapt to the different behavioral frequencies of users and the needs of different credit risk control scenarios, multiple types of windows are used to segment the sequence of user dynamic behavioral events, specifically including the following five window types:

[0213] (1) Fixed window: Select fixed time lengths such as the last hour, 1 day, 7 days, 30 days, and 90 days as windows to cover different time dimensions such as short-term, medium-term, and long-term, and use them to statistically analyze user behavior characteristics within different time spans;

[0214] (2) Sliding window: The fixed window is divided into segments by sliding steps of hours, days, and weeks to capture the dynamic trend of user behavior. For example, the sliding window for the past 7 days (step of 1 day) can reflect the changes in the user's daily behavior in the past week.

[0215] (3) Event Count Window: The window is based on the N most recent specific behavioral events, such as the 3 most recent applications, the 5 most recent logins, the 2 most recent repayments, etc., focusing on the core behavioral characteristics of users recently, which is suitable for users with low behavioral frequency;

[0216] (4) Adaptive window: The window length is dynamically adjusted according to the user behavior density. For users with high behavior frequency, the window length is appropriately shortened, and for users with low behavior frequency, the window length is appropriately extended to ensure that each window contains enough effective behavior data and improve the effectiveness of feature extraction.

[0217] (5) Time decay window: A window is constructed based on time decay weights. The closer the behavior is to the current assessment point, the higher the weight is assigned, highlighting the impact of recent behavior on the user's current risk status. The decay weight can be calculated by exponential decay, linear decay, etc.

[0218] Based on the segmented multi-type windows, eight categories of dynamic behavioral temporal features are extracted from the user behavior event sequence to comprehensively depict user behavior patterns and risk characteristics, specifically including:

[0219] (1) Frequency characteristics of behavior: Statistically count the number of different types of behavior in each window, such as the number of applications, logins, device changes, and overdue payments in the window, to reflect the activity level of user behavior; Basic statistical characteristics: Statistically count the number of times, amount, mean, maximum, and minimum values ​​of behaviors such as applications, logins, loans, repayments, and device changes in the window.

[0220] (2) Amount characteristics: Calculate the amount statistics corresponding to the behavior in each window, such as the average loan amount, the total repayment amount, the decline in repayment amount, the amount volatility, the ratio of loan to repayment amount, etc., to reflect the user's capital flow characteristics and changes in repayment ability;

[0221] (3) Interval characteristics: Calculate the time interval between adjacent similar behavioral events, as well as the statistical indicators such as the mean, standard deviation, maximum and minimum values ​​of the interval, such as the mean of adjacent application intervals, the mean of repayment intervals, and the standard deviation of login intervals, to reflect the regularity of user behavior; Behavioral interval characteristics: Calculate the time interval between adjacent application, login, loan, repayment and other events, as well as the average interval, the shortest interval, the longest interval and the interval fluctuation.

[0222] (4) Trend characteristics: By comparing and analyzing the characteristics of multiple windows, the changing trends of behavior are extracted, such as the upward trend of application frequency, the downward trend of repayment amount, and the upward trend of device replacement frequency, to capture the dynamic changes of user behavior; Trend change characteristics: Based on the statistical results of sliding windows or multiple time windows, the changing trends of indicators such as application frequency, loan amount, repayment amount, repayment time, device replacement frequency, and frequency of login from different locations are calculated.

[0223] (5) Fluctuation characteristics: Calculate the volatility of indicators such as behavior frequency and amount in each window, such as behavior frequency volatility, location change range, amount volatility coefficient, etc., to reflect the stability of user behavior;

[0224] (6) Abnormal mutation characteristics: By calculating the difference, ratio, or standardized deviation of short-term behavioral characteristics relative to medium- and long-term historical behavioral characteristics, abnormal mutations in user behavior can be identified, such as the deviation of the number of short-term applications relative to the long-term daily average, the sudden increase in the number of logins from different locations, etc., to capture potential risk signals; Abnormal mutation characteristics: By comparing short-term windows with medium- and long-term windows, the difference, ratio, or deviation of recent behavior relative to historical behavior can be calculated to identify abnormal changes such as concentrated short-term applications, frequent device changes, and sudden decreases in repayment amounts.

[0225] (7) Time decay characteristics: Combine time decay weights to calculate weighted statistical indicators of behavior within each window, such as weighted application count, weighted risk behavior count, weighted loan amount, etc., highlighting the impact of recent behavior; Time decay characteristics: Assign decay weights based on the time interval between the behavioral event and the current assessment point to generate weighted application count, weighted loan amount, weighted repayment amount, and weighted risk behavior count.

[0226] (8) Behavioral Combination Characteristics: Identify continuous behavioral links of users, and count the number of times risky behavioral combinations are hit and the most recent occurrence time, such as "new device login → change mobile number → apply for loan", "login from another location → change bank card → cash withdrawal", "repayment delay → extension → borrow again", etc., to capture users' fraudulent behavior or high-risk operation patterns. Behavioral Combination Sequence Characteristics: Identify behavioral combination links with risky implications, such as "new device login → change mobile number → apply for loan", "login from another location → change bank card → cash withdrawal", "repayment delay → extension → borrow again", and calculate whether they occur, the number of times they occur, the most recent occurrence time, and the interval between adjacent events within the combination.

[0227] Through the above feature extraction, the system converts discrete user behavior events into dynamic behavioral time-series features that can be called by the risk control model.

[0228] In one embodiment of this application, the acquisition module 450 is specifically used to: fuse the dynamic behavioral time-series features of different windows, different types, and different risk meanings extracted above to generate a user risk feature vector that can be used by the risk control model.

[0229] The dynamic behavioral time-series features extracted above, representing different windows, types, and risk meanings, are fused to generate a user risk feature vector usable by the risk control model. Fusion methods include, but are not limited to, feature concatenation, weighted fusion, hierarchical statistical fusion, rule-based encoding fusion, and model-based encoding fusion: Feature concatenation directly concatenates all features according to their dimensions to form a high-dimensional feature vector; Weighted fusion assigns different weights based on the risk discrimination of features, enhancing the impact of core risk features; Hierarchical statistical fusion performs hierarchical statistics on features of different windows and types before fusion, preserving the hierarchical structure of the features; Rule-based encoding fusion combines business risk control rules to encode and transform features before fusion; Model-based encoding fusion encodes features using models such as autoencoders and attention mechanisms to extract deep correlation information. The final generated user risk feature vector is denoted as V_u={F1,F2,...,Fm}, where m is the total dimension of the fused features.

[0230] It is understood that the above-mentioned user behavior data processing device can implement each step of the user behavior data processing method provided in the foregoing embodiments. The relevant explanations of the user behavior data processing method are applicable to the user behavior data processing device and will not be repeated here.

[0231] Figure 5 This is a schematic diagram of the structure of an electronic device according to an embodiment of this application. Please refer to it. Figure 5 At the hardware level, the electronic device includes a processor, and optionally also includes an internal bus, a network interface, and memory. The memory may include main memory, such as high-speed random-access memory (RAM), or non-volatile memory, such as at least one disk drive. Of course, the electronic device may also include other hardware required for other business operations.

[0232] The processor, network interface, and memory can be interconnected via an internal bus, which can be an ISA (Industry Standard Architecture) bus, a PCI (Peripheral Component Interconnect) bus, or an EISA (Extended Industry Standard Architecture) bus, etc. This bus can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 5 The symbol is represented by a single double-headed arrow, but this does not mean that there is only one bus or one type of bus.

[0233] Memory is used to store programs. Specifically, programs may include program code, which includes computer operation instructions. Memory may include main memory and non-volatile memory, and provides instructions and data to the processor.

[0234] The processor reads the corresponding computer program from non-volatile memory into main memory and then executes it, forming a user behavior data processing device at the logical level. The processor executes the program stored in memory and specifically performs the following operations:

[0235] Acquire multi-source user behavior data and transform it into behavior events. Each behavior event includes a user identifier, event time, event type, event value, event attribute, business scenario, device environment information, and risk attribute identifier, and is represented as follows:

[0236] E = {user_id, event_time, event_type, event_value, event_attr, scene, device_info, risk_tag}, where user_id is a unique user identifier used to associate all behaviors of the same user; event_time is the standard time when the event occurred; event_type is the type code of the behavior event; event_value is the numerical information corresponding to the event; event_attr is the additional attribute information of the event; scene is the business scenario in which the event occurred; device_info is the device environment information when the event occurred; and risk_tag is the risk attribute identifier of the event, used to initially mark the risk characteristics of the event.

[0237] The behavioral events are aggregated according to the user dimension. All behavioral events of the same user are arranged in ascending order according to the occurrence time of the event to construct a user dynamic behavioral event sequence, denoted as S_u={E1,E2,...,En}, where n is the total number of behavioral events of the user;

[0238] Each event in the constructed user dynamic behavior event sequence is further coded and labeled with risk attributes. The coding content includes event type coding, amount value coding, behavior frequency statistics coding, time attribute coding, device attribute coding, geographical location coding, and business scenario coding. The risk attribute labeling includes whether it is a new device operation, whether it is a login from a different location, whether it is a night operation, whether it is a sensitive account change, whether there is an overdue behavior, and whether it is an operation through a high-risk channel.

[0239] Multi-type windows are used to segment the user's dynamic behavior event sequence. Based on the segmented multi-type windows, dynamic behavior time-series features, including at least behavior frequency features, amount features, interval features, trend features, fluctuation features, abnormal change features, time decay features, and behavior combination features, are extracted from the user behavior event sequence.

[0240] By fusing the dynamic behavioral time-series features extracted above from different windows, types, and risk meanings, a user risk feature vector that can be used by the risk control model is generated.

[0241] The above is as stated in this application. Figure 1 The user behavior data processing device disclosed in the illustrated embodiments can be applied to a processor or implemented by a processor. The processor may be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above method can be completed by integrated logic circuits in the processor's hardware or by instructions in software form. The processor can be a general-purpose processor, including a Central Processing Unit (CPU), a Network Processor (NP), etc.; it can also be a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field-Programmable Gate Array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this application can be directly embodied in the execution of a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor. The software module can reside in a mature storage medium in the field, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, or registers. This storage medium is located in memory, and the processor reads information from the memory and, in conjunction with its hardware, completes the steps of the above method.

[0242] The electronic device can also perform Figure 1 The method executed by the user behavior data processing device, and the implementation of the user behavior data processing device in... Figure 1 The functions of the embodiments shown are not described in detail here.

[0243] This application also proposes a computer-readable storage medium that stores one or more programs, the programs including instructions that, when executed by an electronic device including multiple applications, enable the electronic device to perform... Figure 1 The method executed by the user behavior data processing device in the illustrated embodiment is specifically used to perform:

[0244] Acquire multi-source user behavior data and transform it into behavior events. Each behavior event includes a user identifier, event time, event type, event value, event attribute, business scenario, device environment information, and risk attribute identifier, and is represented as follows:

[0245] E = {user_id, event_time, event_type, event_value, event_attr, scene, device_info, risk_tag}, where user_id is a unique user identifier used to associate all behaviors of the same user; event_time is the standard time when the event occurred; event_type is the type code of the behavior event; event_value is the numerical information corresponding to the event; event_attr is the additional attribute information of the event; scene is the business scenario in which the event occurred; device_info is the device environment information when the event occurred; and risk_tag is the risk attribute identifier of the event, used to initially mark the risk characteristics of the event.

[0246] The behavioral events are aggregated according to the user dimension. All behavioral events of the same user are arranged in ascending order according to the occurrence time of the event to construct a user dynamic behavioral event sequence, denoted as S_u={E1,E2,...,En}, where n is the total number of behavioral events of the user;

[0247] Each event in the constructed user dynamic behavior event sequence is further coded and labeled with risk attributes. The coding content includes event type coding, amount value coding, behavior frequency statistics coding, time attribute coding, device attribute coding, geographical location coding, and business scenario coding. The risk attribute labeling includes whether it is a new device operation, whether it is a login from a different location, whether it is a night operation, whether it is a sensitive account change, whether there is an overdue behavior, and whether it is an operation through a high-risk channel.

[0248] Multi-type windows are used to segment the user's dynamic behavior event sequence. Based on the segmented multi-type windows, dynamic behavior time-series features, including at least behavior frequency features, amount features, interval features, trend features, fluctuation features, abnormal change features, time decay features, and behavior combination features, are extracted from the user behavior event sequence.

[0249] The dynamic behavioral time-series features extracted above from different windows, types, and risk meanings are fused to generate a user risk feature vector that can be used by the risk control model.

[0250] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0251] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0252] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0253] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0254] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0255] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0256] Computer-readable media include both permanent and non-permanent, removable and non-removable media that can store information by any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0257] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0258] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0259] The above description is merely an embodiment of this application and is not intended to limit this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principle of this application should be included within the scope of the claims of this application.

Claims

1. A method for processing user behavior data, wherein, The method includes: Acquire multi-source user behavior data and transform it into behavior events. Each behavior event includes a user identifier, event time, event type, event value, event attributes, business scenario, device environment information, and risk attribute identifier, and is represented as follows: E = {user_id, event_time, event_type, event_value, event_attr, scene, device_info, risk_tag}, where user_id is a unique user identifier used to associate all behaviors of the same user; event_time is the standard time when the event occurred; event_type is the type code of the behavior event; event_value is the numerical information corresponding to the event; event_attr is the additional attribute information of the event; scene is the business scenario in which the event occurred; device_info is the device environment information when the event occurred; and risk_tag is the risk attribute identifier of the event, used to initially mark the risk characteristics of the event. The behavioral events are aggregated according to the user dimension. All behavioral events of the same user are arranged in ascending order according to the occurrence time of the event to construct a dynamic behavioral event sequence of the user, denoted as S_u={E1,E2,...,En}, where n is the total number of behavioral events of the user; Each event in the constructed user dynamic behavior event sequence is further coded and labeled with risk attributes. The coding content includes event type coding, amount value coding, behavior frequency statistics coding, time attribute coding, device attribute coding, geographical location coding, and business scenario coding. The risk attribute labeling includes whether it is a new device operation, whether it is a login from a different location, whether it is a night operation, whether it is a sensitive account change, whether there is an overdue behavior, and whether it is an operation through a high-risk channel. Multi-type windows are used to segment the user's dynamic behavior event sequence. Based on the segmented multi-type windows, dynamic behavior time-series features, including at least behavior frequency features, amount features, interval features, trend features, fluctuation features, abnormal change features, time decay features, and behavior combination features, are extracted from the user behavior event sequence. By fusing the dynamic behavioral time-series features extracted above from different windows, types, and risk meanings, a user risk feature vector that can be used by the risk control model is generated.

2. The user behavior data processing method according to claim 1, characterized in that, The user multi-source behavior data is specifically divided into four types of data sources: The first category of core credit business data includes credit applications, loan disbursements, proactive repayments, business extensions, and overdue records. The second category of account operation data includes system login, page clicks, fund transaction records, and account information changes; The third category of equipment and geographical location data includes equipment fingerprints, terminal models, login IPs, and provincial / municipal geographical locations; The fourth category of external auxiliary risk data includes fragments of the People's Bank of China's credit information, third-party multiple borrowing, and fraud risk labels; Before converting the raw multi-source behavioral data into standardized behavioral events, a complete data preprocessing workflow is performed. The specific preprocessing steps are as follows: Duplicate record deduplication, missing field filling, business exception value filtering, global time format unification, currency unit unification, multi-data source user identifier mapping alignment, and invalid noise data removal; Missing fields are filled using any of the following methods: business rule filling, mean / median filling, or model prediction filling; abnormal values ​​are identified and marked for removal using statistical thresholds or business risk control thresholds; and the unified time format is a standard timestamp.

3. The user behavior data processing method according to claim 1, characterized in that, When constructing a sequence of user dynamic behavior events, if multiple behavior events carry the exact same timestamp, they are sorted a second time according to a preset priority rule. The sorting priority rule is as follows: high-risk events such as overdue payments and account changes take priority, followed by core credit business events, and ordinary login and browsing operations take the last place, ensuring that the risk order of events within the sequence is readable.

4. The user behavior data processing method according to claim 1, characterized in that, The various differentiated windows include five window types: Fixed duration windows can be configured with fixed time intervals of approximately 1 hour, 1 day, 7 days, 30 days, and 90 days, covering short, medium, and long-term behavioral statistics; The sliding statistical window uses daily and weekly sliding steps to successively shift and divide the fixed duration window, capturing the daily dynamic changes in behavior. The event count window uses the user's most recent N core behaviors of the same type as the window boundary, where N is a custom positive integer, to adapt to users with low-frequency behaviors. Adaptive density window: Real-time statistics of the density of users' historical behavior. The window duration is shortened for users with dense behavior and automatically extended for users with sparse behavior. The time decay weight window uses the current risk assessment point as a benchmark and calculates the weight of each behavior using a linear decay or exponential decay formula. Behaviors closer to the assessment point are assigned higher statistical weights to amplify the impact of recent behaviors on risk.

5. The user behavior data processing method according to claim 1, characterized in that, The specific definitions of various dynamic behavior temporal features are as follows: Behavioral frequency characteristics: the total number of times each type of behavior occurs within the window, including the number of applications, logins, device changes, and overdue payments; Statistical characteristics of the amount: average loan amount within the window, total repayment amount, month-on-month decrease in continuous repayment amount, capital volatility, and loan-to-expenditure ratio; Behavioral interval characteristics, the time interval between two adjacent behaviors of the same type, and the interval mean, standard deviation, maximum interval, and minimum interval; Behavioral change trends were observed through cross-window comparisons, revealing a linear trend of continuously increasing application frequency, gradually decreasing monthly repayment amount, and increased equipment replacement frequency. Behavioral fluctuation characteristics, including the frequency fluctuation coefficient of behavior within the window, the range of changes in cross-regional login locations, and the monthly capital fluctuation coefficient; Abnormal mutation characteristics are identified by calculating the difference, ratio, and standardized quantile deviation between short-term window indicators and medium- to long-term historical averages to identify the risk of sudden increases or decreases in behavior in the short term. The time decay characteristic is used to calculate the weighted number of applications, the weighted number of risky operations, and the total amount of loans based on the decay weight. Behavioral combination characteristics are analyzed by counting the number of times the combination hits and the time of the most recent hit according to the preset risk links of the business. The preset risk links include: new device login - change the bound mobile phone number - initiate a loan application, login from a different IP address - change the bank card binding - withdraw funds, continuous repayment delay - apply for extension - add a new loan.

6. The user behavior data processing method according to claim 1, characterized in that, Dynamic behavior time series feature fusion employs various fusion methods individually or in combination: direct feature vector concatenation, weighted fusion based on risk discrimination, hierarchical window grouping statistical fusion, risk control rule discrete coding fusion, and autoencoder / attention mechanism deep learning coding fusion. The weighted fusion process distinguishes between fraudulent features, overdue features, and regular behavioral features by adjusting the weight coefficients, thereby increasing the proportion of high-risk features in the vector.

7. The user behavior data processing method according to claim 1, characterized in that, The method further includes a feature persistence and reuse step: All original single-window time-series features and fused user risk feature vectors are uniformly stored in a distributed feature library; The feature library supports two calling scenarios: offline scenarios provide historical samples for batch training of risk control models, and online real-time scenarios connect to real-time credit approval and post-loan monitoring interfaces for real-time inference. At the same time, version tags and user time snapshots are added to each batch of generated features to achieve traceable management of the entire feature lifecycle.

8. A user behavior data processing device, wherein, The device includes: The acquisition and conversion module is used to acquire multi-source user behavior data and convert it into behavior events. Each behavior event includes a user identifier, event time, event type, event value, event attribute, business scenario, device environment information, and risk attribute identifier, and is represented as follows: E = {user_id, event_time, event_type, event_value, event_attr, scene, device_info, risk_tag}, where user_id is a unique user identifier used to associate all behaviors of the same user; event_time is the standard time when the event occurred; event_type is the type code of the behavior event; event_value is the numerical information corresponding to the event; event_attr is the additional attribute information of the event; scene is the business scenario in which the event occurred; device_info is the device environment information when the event occurred; and risk_tag is the risk attribute identifier of the event, used to initially mark the risk characteristics of the event. The module is used to aggregate the behavioral events by user dimension, arrange all behavioral events of the same user in ascending order of event occurrence time, and construct a user dynamic behavioral event sequence, denoted as S_u={E1,E2,...,En}, where n is the total number of behavioral events of the user; The encoding and labeling module is used to further encode and label each event in the constructed user dynamic behavior event sequence. The encoding content includes event type encoding, amount value encoding, behavior frequency statistics encoding, time attribute encoding, device attribute encoding, geographical location encoding, and business scenario encoding. The risk attribute labeling includes whether it is a new device operation, whether it is a login from a different location, whether it is a nighttime operation, whether it is a sensitive account change, whether there is an overdue behavior, and whether it is an operation through a high-risk channel. The segmentation and extraction module is used to segment the user dynamic behavior event sequence using multiple types of windows. Based on the segmented multi-type windows, dynamic behavior time-series features are extracted from the user behavior event sequence, including at least behavior frequency features, amount features, interval features, trend features, fluctuation features, abnormal mutation features, time decay features, and behavior combination features. The acquisition module is used to fuse the dynamic behavioral time-series features extracted above from different windows, types, and risk meanings to generate a user risk feature vector that can be used by the risk control model.

9. An electronic device, comprising: processor; as well as A memory configured to store computer-executable instructions, which, when executed, cause the processor to perform the method of any one of claims 1 to 7.

10. A computer-readable storage medium storing one or more programs, which, when executed by an electronic device including a plurality of applications, cause the electronic device to perform the method of any one of claims 1 to 7.

Images