Risk user early warning method and device, and electronic equipment

Abstract

The application provides a risk user early warning method and device and electronic equipment. Behavior fingerprint labels generated by a target user at each link are sequentially connected in time sequence to form a behavior chain, and a longest common subsequence length matching algorithm based on time interval constraints is used to comprehensively evaluate the risk of the target user from two dimensions of behavior structure matching degree and time interval rationality, effectively reducing the risk of being unable to identify single-point low-medium-risk and combined high-risk behavior chains due to reliance on single-point abnormal detection and lack of cross-link correlation capability, so that the target user who may have fraudulent actions can be more accurately identified, and timely early warning intervention can be performed.

Description

Technical Field

[0001] This application relates to the field of risk control technology, and more specifically, to a risk user early warning method, device, and electronic device. Background Technology

[0002] In the risk control scenarios of live streaming platforms, impersonating guilds to defraud streamers has become a common tactic used by fraud gangs. Existing risk control systems primarily rely on single-point anomaly characteristics (such as rooted devices, IP blacklists, etc.) for judgment, with registration review, content review, and behavior monitoring operating independently. However, to evade platform detection, fraud gangs employ a "cleanup" strategy, using normal devices, normal IP addresses, and dispersed registration methods. This makes each individual action appear as a normal platform function, lacking any definitive anomaly characteristics to trigger risk control interception. Existing systems lack the ability to perform cross-stage temporal correlation analysis of low- to medium-risk behaviors at each stage, making it difficult to accurately identify risky users based on the correlations between these actions. Summary of the Invention

[0003] To overcome the aforementioned shortcomings in the prior art, the purpose of this application is to provide a risk user early warning method, the method comprising: Obtain the target user's target behavior fingerprint tag, wherein the target behavior fingerprint tag includes multiple target behaviors performed by the target user and the execution time corresponding to the target behaviors; According to the execution time, the multiple target behaviors are sorted to obtain a target behavior fingerprint tag sequence; Based on the longest common subsequence length between the target behavior fingerprint tag sequence and the template behavior fingerprint tag sequence in the preset risk tag library, the behavior dimension matching degree between the target behavior fingerprint tag sequence and the template behavior fingerprint tag sequence is calculated. Based on the execution time interval between the two target behaviors, calculate the behavior interval risk score corresponding to the behavior group consisting of the two target behaviors, and calculate the total time dimension score based on the behavior interval risk scores corresponding to multiple behavior groups. The user risk value of the target user is calculated based on the total score of the time dimension and the matching degree of the behavior dimension, and the corresponding early warning action is executed based on the user risk value.

[0004] In some possible implementations, the step of obtaining the target user's target behavior fingerprint tag includes: Based on at least two monitoring and data collection modules deployed in the registration, identity attribute modification, interaction behavior, and security verification stages, when a risky behavior is detected by the target user, a risky behavior tag is added to the target user, and the time of addition of the risky behavior tag is recorded; wherein, the risky behavior tag has a corresponding tag validity period; When any of the monitoring and acquisition modules generates a new behavior fingerprint tag, the risk behavior tag whose tag addition time is within the corresponding tag validity period is obtained as the fingerprint tag.

[0005] In some possible implementations, the step of calculating the behavioral dimension matching degree between the target behavioral fingerprint label sequence and the template behavioral fingerprint label sequence includes: Obtain the length of the longest common subsequence between the target behavior fingerprint label sequence and the template behavior fingerprint label sequence; The quotient of the longest common subsequence length and the number of tags in the template behavior fingerprint tag sequence is used as the behavior dimension matching degree.

[0006] In some possible implementations, the step of calculating the behavior interval risk score corresponding to the behavior group based on the execution time interval between two target behaviors in the behavior group includes: Calculate the execution time interval between two target behaviors in the behavior group, and obtain the risk duration range corresponding to the two target behaviors; A monotonically decaying function is used to calculate the behavior interval risk score corresponding to the behavior group based on the risk duration range and the execution time interval.

[0007] In some possible implementations, the step of using a monotonically decaying function to calculate the behavior interval risk score corresponding to the behavior group based on the risk duration range and the execution time interval includes: If the execution time interval is less than the lower limit of the risk duration range, then the behavior interval risk score is set to 1; If the execution time interval is greater than the upper limit of the risk duration range, the behavior interval risk score is set to a base score less than 1. If the execution time interval is between the lower limit and the upper limit of the risk duration range, then a value between the base score and 1 is determined as the behavior interval risk based on the difference between the execution time interval and the lower limit.

[0008] In some possible implementations, the step of calculating the total time dimension score based on the behavioral interval risk scores corresponding to multiple behavioral groups includes: The average of the risk scores for the behavioral intervals corresponding to multiple behavioral groups is calculated as the total score for the time dimension; The step of calculating the user risk value of the target user based on the total score of the time dimension and the matching degree of the behavior dimension includes: The product of the behavioral dimension matching degree of the target behavior and the total score of the time dimension is calculated as the risk value of the target behavior; The maximum value among the risk values ​​of each target behavior is taken as the user risk value of the target user.

[0009] In some possible implementations, the target user's target behavior fingerprint tag includes the target behavior generated by the target user interacting in the target live streaming room; The step of executing the corresponding early warning action based on the user's risk value includes: When the user's risk value is detected to be greater than a first set threshold, payment requests related to the target live streaming room are blocked within a set time period.

[0010] Another objective of this application is to provide a risk user early warning device, the risk user early warning device comprising: The data acquisition module is used to acquire the target behavior fingerprint tag of the target user. The target behavior fingerprint tag includes multiple target behaviors performed by the target user and the execution time corresponding to the target behaviors. The sorting module is used to sort multiple target behaviors according to the execution time to obtain a target behavior fingerprint tag sequence; The first calculation module is used to calculate the behavioral dimension matching degree between the target behavioral fingerprint label sequence and the template behavioral fingerprint label sequence based on the longest common subsequence length between the target behavioral fingerprint label sequence and the template behavioral fingerprint label sequence in the preset risk label library. The second calculation module is used to calculate the behavior interval risk score corresponding to each behavior group consisting of two target behaviors in the target behavior fingerprint tag, based on the execution time interval between the two target behaviors in the behavior group, and to calculate the total score of the time dimension based on the behavior interval risk scores corresponding to multiple behavior groups. The early warning module is used to calculate the user risk value of the target user based on the total score of the time dimension and the matching degree of the behavior dimension, and to execute the corresponding early warning action based on the user risk value.

[0011] Another objective of this application is to provide an electronic device, including a processor and a machine-readable storage medium, wherein the machine-readable storage medium stores machine-executable instructions, and the machine-executable instructions, when executed by the processor, implement the risk user warning method provided in this application.

[0012] Another objective of this application is to provide a machine-readable storage medium storing machine-executable instructions that, when executed by one or more processors, implement the risk user warning method provided in this application.

[0013] Compared with the prior art, this application has the following beneficial effects: This application provides a risk user early warning method, device, and electronic device. By sequentially linking the behavioral fingerprint tags generated by the target user at each stage to form a behavioral chain, and using the LCS matching algorithm based on time interval constraints, the risk of the target user is comprehensively evaluated from two dimensions: behavioral structure matching degree and time interval rationality. This effectively reduces the risk of failing to identify single-point low-to-medium risk and combined high-risk behavioral chains due to reliance on single-point anomaly detection and lack of cross-stage correlation capabilities. As a result, it can more accurately identify target users who may be engaging in fraudulent activities and provide timely early warning and intervention. Attached Figure Description

[0014] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0015] Figure 1 This is a flowchart illustrating the steps of the risk user early warning method provided in the embodiments of this application; Figure 2 A schematic diagram of an electronic device provided in an embodiment of this application; Figure 3 This is a schematic diagram of the functional modules of the risk user early warning device provided in the embodiments of this application. Detailed Implementation

[0016] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. The components of the embodiments of this application described and shown in the accompanying drawings can generally be arranged and designed in various different configurations.

[0017] Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely to illustrate selected embodiments of the application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0018] It should be noted that similar labels and letters in the following figures indicate similar items. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0019] In the description of this application, it should be noted that the terms "center," "upper," "lower," "left," "right," "vertical," "horizontal," "inner," and "outer," etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings, or the orientation or positional relationship commonly used when the product of the invention is in use. They are used only for the convenience of describing this application and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on this application. In addition, the terms "first," "second," and "third," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0020] Furthermore, terms such as "horizontal," "vertical," and "sag" do not imply that components must be absolutely horizontal or suspended, but rather that they can be slightly tilted. For example, "horizontal" simply means that its direction is more horizontal relative to "vertical," and does not mean that the structure must be completely horizontal, but can be slightly tilted.

[0021] In the description of this application, it should also be noted that, unless otherwise expressly specified and limited, the terms "set up," "install," "connect," and "link" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; and they can refer to the internal connection of two components. Those skilled in the art can understand the specific meaning of the above terms in this application based on the specific circumstances.

[0022] Please see Figure 1 , Figure 1 This is a flowchart of a risk user early warning method provided in this embodiment. The steps of the method are described in detail below.

[0023] Step S110: Obtain the target user's target behavior fingerprint tag. The target behavior fingerprint tag includes multiple target behaviors performed by the target user and the execution time corresponding to the target behaviors.

[0024] In this embodiment, the target user refers to the user entity corresponding to a registered account on the live streaming platform. The behavioral fingerprint tag is defined as a data structure containing at least two fields: one is the target behavior type identifier, and the other is the timestamp when the target behavior is executed. It should be noted that the target behavior here does not refer to all user operation records on the platform, but rather to behavioral events identified as having suspicious characteristics by the monitoring and collection module in various business processes.

[0025] The target behavior fingerprint tag does not contain information about a single target behavior, but rather encompasses all target behaviors of the target user that have been marked in various business processes, along with their corresponding execution times. This information collectively forms the data foundation for subsequent steps. In this embodiment, a target user may have multiple behavior fingerprint tags, each tag representing a marked suspicious behavior performed by the user at a certain moment.

[0026] Step S120: Sort multiple target behaviors according to execution time to obtain target behavior fingerprint tag sequence.

[0027] In this embodiment, all target behaviors can be sorted in ascending order based on the execution timestamp recorded in each target behavior fingerprint tag. That is, the discrete tags are organized into an ordered sequence according to the order in which the behaviors occur. This ordered sequence is the target behavior fingerprint tag sequence.

[0028] It can be understood that the target behavior fingerprint label sequence is essentially a temporal representation of all the marked behaviors of the target user within a certain time window, which reflects the behavioral evolution trajectory of the target user.

[0029] For example, suppose a target user successively performs the following actions: registration (10:23), nickname modification (11:52), entering the live stream (13:47), and connecting with the user (13:55). After this sorting step, these actions are organized into a target behavior fingerprint tag sequence according to their chronological order. :

[0030] In this structure, the first element of each element is the type identifier of the target behavior, and the second element is the timestamp of the behavior. Therefore, the purpose of the sorting operation is to transform discrete labeled data into an ordered structure with temporal logic, laying the data structure foundation for subsequent sequence matching and time-series analysis.

[0031] Step S130: Calculate the behavioral dimension matching degree between the target behavioral fingerprint label sequence and the template behavioral fingerprint label sequence based on the longest common subsequence length between the target behavioral fingerprint label sequence and the template behavioral fingerprint label sequence in the preset risk label library.

[0032] In this embodiment, the similarity in behavioral structure between the target behavioral fingerprint label sequence and each template behavioral fingerprint label sequence can be evaluated by calculating the length of the longest common subsequence (LCS).

[0033] It should be noted that the longest common subsequence refers to the longest subsequence that can be extracted from two sequences without changing the relative order of their elements. The algorithm is characterized by not requiring the two sequences to be completely identical, nor requiring matching elements to appear consecutively in the sequences; it allows for missing or inserted elements, thus exhibiting good robustness.

[0034] In practical applications, the behavior chain of fraud gangs may have some omissions or slight adjustments in the order of some links. For example, some fraudulent accounts may omit the bullet screen link and directly initiate a live chat. If a strict full match method is used, this variant cannot be identified. However, the longest common subsequence algorithm can tolerate such non-essential differences and still identify the matching of the core behavior chain.

[0035] Specifically, this step calculates the target behavior fingerprint label sequence S and a template behavior fingerprint label sequence. Length of the longest common subsequence Then divide that length by the template sequence. Total number of tags The resulting ratio is the behavioral dimension matching degree. This matching degree ranges from 0 to 1, with a higher value indicating a greater structural similarity between the target user's behavioral structure and the fraudulent behavior pattern described in the template.

[0036] Step S140: For each behavior group consisting of two target behaviors in the target behavior fingerprint label, calculate the behavior interval risk score corresponding to the behavior group based on the execution time interval between the two target behaviors in the behavior group, and calculate the total score of the time dimension based on the behavior interval risk scores corresponding to multiple behavior groups.

[0037] In this embodiment, the matching degree between the target user and the fraud pattern has been calculated from the behavioral structure dimension in step S130. However, relying solely on structural matching is insufficient to comprehensively assess risk, because two behavioral sequences with the same structure may differ significantly in their timing. For example, a normal user may change their nickname several days after registration and then enter the live stream and connect with the live stream several more days later, while a fraudulent account may complete the entire process within hours of registration. Although their behavioral structures are the same, the levels of risk are drastically different.

[0038] Therefore, in step S140, the target user's behavior chain can be evaluated from a time dimension. Specifically, in step S140, a behavior interval risk score corresponding to the behavior group consisting of two target behaviors can be calculated based on the execution time interval between two target behaviors.

[0039] For example, every two target behaviors in the target behavior fingerprint label can be combined into a behavior group. Here, a behavior group can be a combination of any two target rows in the target behavior fingerprint label, or a behavior group can refer to two behaviors that are adjacent in chronological order, i.e., adjacent label pairs.

[0040] For each behavior group, the execution time interval between the two target behaviors is calculated, which is the execution time of the latter behavior minus the execution time of the former behavior, to obtain the time interval value. Subsequently, the system calculates the behavior interval risk score corresponding to the behavior group based on this time interval value.

[0041] Specifically, for example, in the case scenario, the risk levels of "connecting to a live stream immediately 10 minutes after registration" and "connecting to a live stream 10 hours after registration" are completely different. The execution time interval between the two target behaviors is used to calculate the behavior interval risk score, which can effectively reflect the correlation between the execution target actions.

[0042] The system calculates a corresponding behavioral interval risk score for each adjacent tag pair, thus obtaining multiple behavioral interval risk scores. After calculating the risk scores for each behavioral group, the system aggregates the risk scores of multiple behavioral groups to obtain a total time-dimensional score. This total score reflects the degree of consistency between the target user's behavioral chain and the rapid fraud pattern in terms of time rhythm.

[0043] It should be understood that the total score of the time dimension in this step and the matching degree of the behavior dimension in step S130 evaluate the target user's behavior chain from different dimensions. The two are independent of each other and complement each other.

[0044] Step S150: Calculate the user risk value of the target user based on the total score of the time dimension and the matching degree of the behavior dimension, and execute the corresponding warning action based on the user risk value.

[0045] In this embodiment, the scores from the two dimensions obtained in steps S130 and S140 can be fused together to comprehensively assess the overall risk level of the target user.

[0046] Specifically, the user risk score is calculated by fusing the behavioral dimension matching score with the total time dimension. The benefit of this fusion method is that the user risk score will only reach a high level when both the behavioral structure and time rhythm dimensions are highly matched with the fraud pattern. A low score in either dimension will significantly lower the final risk score, thereby effectively reducing the false alarm rate while ensuring the detection rate.

[0047] After calculating the user's risk value, the system executes corresponding warning actions based on that risk value. These warning actions include, but are not limited to, sending in-system messages to the broadcaster, issuing voice warnings to the broadcaster via outbound calling systems, and blocking payment requests from the account within a set time period.

[0048] Based on the above design, the risk user early warning method provided in this embodiment forms a behavior chain by sequentially linking the behavioral fingerprint tags generated by the target user at each stage, and uses the LCS matching algorithm based on time interval constraints to comprehensively evaluate the risk of the target user from two dimensions: behavioral structure matching degree and time interval rationality. This effectively reduces the risk of failing to identify single-point low- and medium-risk or combined high-risk behavior chains due to reliance on single-point anomaly detection and lack of cross-stage correlation capabilities. As a result, it can more accurately identify target users who may be engaging in fraudulent activities and provide timely early warning intervention.

[0049] In some possible implementations, step S110 may include the following sub-steps.

[0050] Step S111: Based on at least two monitoring and data collection modules deployed in the registration, identity attribute modification, interaction behavior, and security verification stages, when a risky behavior is detected by a target user, a risky behavior tag is added to the target user, and the time of addition of the risky behavior tag is recorded; wherein, the risky behavior tag has a corresponding tag validity period.

[0051] In this embodiment, each key business process of the live streaming platform is equipped with an independent monitoring and data collection module, specifically including an account lifecycle data collection module deployed in the registration process, an identity attribute data collection module deployed in the identity attribute modification process, an interaction behavior data collection module deployed in the interaction behavior process, and a security verification data collection module deployed in the security verification process.

[0052] Each monitoring and data collection module operates independently, performing real-time monitoring of its respective business processes. During the execution of the above steps, when a monitoring and data collection module detects that a target user has performed a risky behavior in the process it is monitoring, that module adds a risky behavior tag to the target user and records the time the tag is added.

[0053] It should be noted that the risky behavior here refers to the behavior that meets the preset suspicious conditions in each stage, and the suspicious conditions are different in different stages.

[0054] The account lifecycle collection module in the registration process uses whether the IP address belongs to a high-risk area and whether the device fingerprint matches the fingerprint of a historical fraudulent device as the judgment criteria; the identity attribute collection module in the identity attribute modification process uses whether the edit distance similarity and vector similarity between the modified nickname and the legitimate guild name exceed a set threshold as the judgment criteria; the interaction behavior collection module in the interaction behavior process uses whether the behavior of entering the room, the content of the bullet screen, or the content of the voice chat contains misleading information as the judgment criteria.

[0055] For example, during the registration process, if the IP address of an account falls within a high-risk area frequently used in historical scams, or if its device fingerprint matches the fingerprint of a flagged scam device, then the registration behavior is identified as a targeted behavior, and the system generates a tag of type "..." for this behavior. The behavior fingerprint tag records the specific timestamp of the registration behavior.

[0056] For example, during the identity attribute modification process, if an account changes its nickname to text that is highly similar to the name of a legitimate guild, this nickname modification behavior is identified as the target behavior, and the system generates a tag type of "". "behavioral fingerprint tags and record corresponding timestamps."

[0057] Furthermore, each risk behavior tag has a corresponding validity period, which varies depending on the tag type. For example, the validity period for registration behavior tags and nickname modification tags can be set to 7 days, while the validity period for room entry tags, bullet screen tags, and live chat tags can be set to 1 hour. This differentiated setting is based on business logic considerations. The impact of registration behavior and nickname modification behavior is long-term, and their tags need to remain valid for a longer time window to establish a connection with subsequent behaviors. On the other hand, interactive behaviors such as room entry, bullet screen, and live chat are immediate and sudden. If a complete crime chain has not been formed after too long, its correlation with the current behavior to be analyzed has been significantly weakened. Setting a shorter validity period can avoid false associations.

[0058] Step S112: When any monitoring and acquisition module generates a new behavior fingerprint tag, the risk behavior tag whose tag addition time is within the corresponding tag validity period is obtained as the fingerprint tag.

[0059] In this embodiment, step S112 does not use a timed batch aggregation method to obtain tags. Instead, the acquisition process is triggered immediately when any monitoring and acquisition module generates a new risk behavior tag. This real-time triggering mechanism differs from the offline batch processing mode. Its advantage lies in initiating risk identification while the fraud crime chain is still forming, rather than waiting for the entire chain to be completed before conducting post-event analysis, thus significantly advancing the time point of risk identification. When the triggering condition is met, the system iterates through all the risk behavior tags added by the target user, checking one by one whether the addition time of each tag is still within the valid duration corresponding to that tag type, and only those risk behavior tags that have not expired are used as target behavior fingerprint tags.

[0060] For example, suppose a target user has a registration tag (added 7 days ago, valid for 7 days), a nickname tag (added 6 days ago, valid for 7 days), a room entry tag (added 50 minutes ago, valid for 1 hour), and a live chat tag (added 10 minutes ago, valid for 1 hour). If this user's live chat behavior triggers new monitoring and calls this step again, the system will only obtain the registration tag, nickname tag, room entry tag, and live chat tag as the target behavior fingerprint tags, because the addition time of these tags has not exceeded their respective validity periods. Conversely, if the addition time of a room entry tag exceeds 1 hour, the tag will be filtered and will no longer participate in subsequent sequence construction and risk analysis.

[0061] Thus, the combination of differentiated validity periods and real-time filtering mechanisms ensures the integrity of valid labels while avoiding interference from expired labels in risk assessment.

[0062] In some possible implementations, in step S130, the length of the longest common subsequence between the target behavior fingerprint label sequence and the template behavior fingerprint label sequence can be obtained, and then the quotient of the length of the longest common subsequence and the number of labels in the template behavior fingerprint label sequence can be calculated as the behavior dimension matching degree.

[0063] Specifically, the target behavior fingerprint tag sequence and the first can be calculated according to the following formula. Behavioral dimension matching degree of each template behavioral fingerprint tag sequence :

[0064] in, For the target behavior fingerprint label sequence, For the first A template behavior fingerprint label sequence, For the target behavior fingerprint tag sequence and the first The length of the longest common subsequence of the template behavior fingerprint label sequences. For the first The number of tags in a template behavior fingerprint tag sequence.

[0065] In this embodiment, the target behavior fingerprint tag sequence It is an ordered list of tags arranged in chronological order, with the template behavior being a fingerprint tag sequence. It is a standard tag sequence of a certain fraud behavior pattern stored in a preset risk tag library. During the execution of the above steps, the system first calls the longest common subsequence algorithm to process the two sequences to obtain... The value represents the length of the longest tag subsequence that two sequences can match without changing the relative order of their elements.

[0066] Then, the system obtains the template sequence. Total number of tags in ,Will Divide by The ratio obtained is the behavioral dimension matching degree. Since the denominator uses the total number of labels in the template sequence rather than the total number of labels in the target sequence, this matching degree reflects the extent to which the target behavior sequence covers the template pattern.

[0067] For example, assuming a template sequence contains four tags, and the longest common subsequence length between the target sequence and the template sequence is 3, then the behavioral dimension matching degree is 3 / 4 = 0.75, indicating that the target user's behavioral structure covers 75% of the fraud pattern, with one link missing or not matched. Based on the above formula and calculation method, the behavioral dimension matching degree quantitatively describes the degree of structural similarity between the target behavioral sequence and the template behavioral pattern in a standardized ratio form.

[0068] In some possible implementations, step S140 may include the following sub-steps.

[0069] Step S141: Calculate the execution time interval between two target behaviors in the behavior group, and obtain the risk duration range corresponding to the two target behaviors.

[0070] For target behavior fingerprint tag sequence Each behavior group in The system first extracts the corresponding execution time. and Then calculate the difference between the two. This difference represents the execution time interval between two target behaviors in this behavior group.

[0071] Simultaneously, the system also needs to obtain the risk duration range corresponding to the behavior group. It should be noted that the risk duration range is not a globally uniform parameter, but rather is associated with the specific template behavior fingerprint tag sequence and the specific tag pairs. In the preset risk tag library, each template behavior fingerprint tag sequence stores not only the tag sequence itself, but also the time interval constraints between adjacent tag pairs in the sequence. This constraint is defined by a lower limit value. and upper limit value The composition represents the suspicious time window that business experts have defined for this tag based on the patterns of fraud. For example, for the template sequence... This tag, with a system storage time range constraint of [5 minutes, 72 hours], indicates that changing nicknames within 5 minutes to 72 hours after registration is a typical modus operandi for scammers; while for... This tag pair, with a time range constraint of [2 minutes, 30 minutes], indicates that initiating a live chat invitation shortly after entering the room is a typical fraudulent behavior pattern. The system obtains the risk duration range corresponding to the current behavior group based on the time constraint definition in the currently matching template sequence.

[0072] Step S142: Using a monotonically decaying function, calculate the behavior interval risk score corresponding to the behavior group based on the risk duration range and execution time interval.

[0073] In this embodiment, the monotonic decay function is defined as a function whose score decreases as the time interval increases. Its core business logic is that the faster the transition between actions (i.e., the shorter the time interval), the more it conforms to the characteristics of rapid fraud, and the higher the risk score; conversely, the longer the time interval, the weaker the temporal correlation between actions, and the lower the risk score. This monotonic decay function only needs to be defined... and Two parameters are sufficient to calculate a continuous risk score for any time interval, eliminating the need to enumerate dead labels for different time windows, thus significantly reducing rule maintenance costs while ensuring fine differentiation.

[0074] Specifically, in some possible implementations, if the execution time interval is less than the lower limit of the risk duration range, the behavior interval risk score is set to 1.

[0075] If the execution time interval is greater than the upper limit of the risk duration range, the behavior interval risk score is set to a base score less than 1.

[0076] If the execution time interval is between the lower limit and the upper limit of the risk duration range, then a value between the base score and 1 is determined as the behavior interval risk based on the difference between the execution time interval and the lower limit.

[0077] For example, the first can be calculated according to the following formula. The target behavior and the first Risk score of behavioral intervals between target behaviors :

[0078] in, For the first The target behavior and the first The execution time interval between target behaviors This represents the lower limit of the risk duration range. The upper limit of the risk duration range, The attenuation coefficient is... Based on scores, .

[0079] In this embodiment, the system will execute time intervals. The lower limit of the risk duration range and upper limit value The results are compared, and the corresponding calculation method is used to obtain the behavioral interval risk score based on the different intervals in which the comparison results fall.

[0080] The monotonically decaying function is defined as a three-part piecewise function. During the execution of the above steps, the system first compares... and The size relationship. If Less than This indicates that the transition between two behaviors is faster than the lower bound of experience, meaning the behavior switch is too rapid. This often reflects the non-human operational characteristics of automated script execution, thus assigning the highest risk score of 1. fall into to Within a certain range, it indicates that the time interval between two actions is within a suspicious range. In this case, a monotonically decreasing linear function is used to calculate the risk score, meaning the score starts near 1 and gradually decreases. It gradually decreases as it increases. If Greater than This indicates that the time interval between the two actions exceeds the upper limit of a reasonable risk window, and the temporal correlation between the two actions has been significantly weakened, thus assigning a relatively low base score M.

[0081] It should be noted that N in the above formula is the decay coefficient, which controls the rate of decline of the risk score within a reasonable time interval; M is the base score, representing the minimum risk value after exceeding the time limit. In practical applications, N and M can be adjusted according to the business scenario. For example, N = 0.3 and M = 0.5 can be set, in which case the condition M < 1 - N is satisfied.

[0082] To give another example, suppose the risk duration for a certain behavior group ranges from [2 minutes to 30 minutes]. If the actual time interval... If the time interval is 8 minutes, it falls within a reasonable range, and the corresponding risk score is 1 - 0.3 × (8 - 2) / (30 - 2) = 1 - 0.3 × 6 / 28 ≈ 0.936. If the actual time interval is 25 minutes, the score is 1 - 0.3 × (25 - 2) / (30 - 2) = 1 - 0.3 × 23 / 28 ≈ 0.754.

[0083] This demonstrates that within a reasonable time window, the shorter the time interval, the higher the risk score. This monotonically decaying characteristic aligns with the "rapid-fire" business pattern of fraud. Based on the aforementioned three-segment piecewise function design, each behavioral group receives a quantified risk score, which is used for the subsequent aggregation calculation of the total score over the time dimension.

[0084] In some possible implementations, step S130 can calculate the average of the behavioral interval risk scores corresponding to multiple behavioral groups as the total score in the time dimension. .

[0085]

[0086] Where k is the number of behavior groups.

[0087] In step S150, the product of the behavioral dimension matching degree of the target behavior and the total score of the time dimension can be calculated as the target behavior risk value, and then the maximum value among the target behavior risk values ​​can be used as the user risk value of the target user.

[0088] Specifically, the steps for calculating a target user's risk value based on the overall time-dimension score and the behavioral-dimension matching degree include: Calculate the user risk value using the following formula. :

[0089]

[0090] in, For the target behavior fingerprint tag sequence and the first The behavioral dimension matching degree of each template behavioral fingerprint label sequence. This is the total number of template behavior fingerprint tag sequences in the preset risk tag library.

[0091] Specifically, the system first matches the behavioral dimension. Overall score based on time dimension Multiply to obtain the overall matching degree. This comprehensive matching score integrates information from two dimensions: behavioral structure similarity and temporal rhythm rationality. It should be noted that since the overall score in the time dimension is calculated based on the temporal characteristics of the target behavioral sequence itself, it may differ from the specific template sequence. Since it is irrelevant, the total score in the time dimension remains the same when calculating the overall matching degree with different template sequences.

[0092] Then, the system iterates through all the tags in the preset risk tag library. Given a template sequence, obtain The maximum value among the comprehensive matching scores is taken as the user risk score for the target user. The reason for using the maximum value instead of the average or weighted sum is that the preset risk label library contains many different types of fraud patterns. The target user's behavior chain may completely match a specific pattern while differing significantly from the others. In this case, taking the maximum value can accurately identify the type of fraud corresponding to the user, while the average value may be diluted by a large number of irrelevant patterns, leading to missed detections.

[0093] For example, suppose the risk tag database contains three patterns. The overall match rate between the target user and pattern one is 0.97, the overall match rate with pattern two is 0.45, and the overall match rate with pattern three is 0.32. Then, the user's risk value is set to the maximum value of 0.97, indicating that the user's behavioral chain highly matches pattern one and should be identified as high-risk. In this way, the optimal matching and positioning of the target user's criminal pattern is achieved through the maximum value selection strategy.

[0094] In some possible implementations, the target user's target behavior fingerprint tag includes the target behavior generated by the target user's interaction in the target live broadcast room.

[0095] Specifically, the target live stream room refers to the specific live stream room to which the target user's current interactive behavior is directed. This live stream room has a unique identifier and belongs to a specific streamer. Interaction refers to the interactive behavior that occurs between the target user and the streamer within the target live stream room. This behavior can be one-way or two-way, and includes, but is not limited to, entering the live stream room, sending bullet screen messages in the live stream room's public chat area, initiating a voice call request to the streamer, and sending virtual gifts to the streamer. The target behavior generated by this interaction refers to the instance of the target behavior corresponding to the aforementioned interactive behavior itself after it has been identified by the monitoring and collection module as meeting preset suspicious conditions.

[0096] For example, in a typical scenario of "impersonating a guild for fraud," after registering and changing their nickname, the fraudulent account enters the target streamer's live stream room. This entry behavior is identified as suspicious by the interaction behavior collection module, generating a tag type of "...". The target behavior fingerprint tag; subsequently, the fraudulent account sent bullet comments containing misleading information in the live stream (such as "I am the guild leader of XX guild, let's chat privately"), and this bullet comment behavior generated a tag type of "". "Target behavior fingerprint tag; or the fraudulent account initiates a live chat request with the streamer and conducts a voice call, during which it uses the voice content to deeply induce others (such as claiming "I am an official staff member of the platform, and I am now inviting you to sign with a high-quality guild"), the tag type generated for this live chat behavior is "" "Target behavior fingerprint tags. The aforementioned behaviors of entering the room, sending bullet comments, and interacting with other users are all target behaviors generated by the target user's interaction in the target live stream room. These target behaviors, along with those generated during the account registration process..." "Tags generated during the nickname modification process" "Tags, and tags generated during the security verification process due to logins from different locations." "The tags together constitute a complete set of target user behavior fingerprint tags."

[0097] It is understandable that the scope of the target user's target behavior fingerprint tag is not limited to the target behavior generated by interacting in the target live stream room, but rather includes the aforementioned interactive behavior as a component. Target behaviors generated by the target user in other stages (such as registration, nickname modification, login from different locations, etc.) are also included in the target behavior fingerprint tag. Precisely because the target user performed suspicious interactive behavior in the target live stream room, the subsequent transfer of virtual assets involved in the payment request may use the target live stream room as the interaction scenario and fraud entry point. The action to intercept the payment request has a direct business correspondence with the target live stream room.

[0098] In this case, in step S150, after calculating the user's risk value, the system first compares the user's risk value with a first preset threshold. If the user's risk value is greater than the first preset threshold, it indicates that the target user has been identified as having an extremely high risk level. At this time, the system performs an interception action, specifically intercepting the target user's payment requests related to the target live stream within a set time period. Payment requests refer to requests initiated by the target user on the live streaming platform involving the transfer of virtual assets or real currency payments, such as topping up the streamer's account, purchasing virtual gifts, or transferring virtual assets within the account. The interception time range is set to a period of time window from the moment of risk identification, for example, it can be set to 1 hour. During this time window, all payment requests of the target user are temporarily intercepted pending further manual review or streamer confirmation.

[0099] It should be noted that although this step only specifically describes the payment interception action in extremely high-risk scenarios, the graded intervention strategy based on the user's risk value falling into different threshold ranges also falls within the protection scope of this invention. Those skilled in the art can implement intervention methods of different strengths, such as medium-risk in-site message reminders and high-risk automatic outbound calls, based on the teachings of the above embodiments.

[0100] In addition, when a user's risk level is low, the system may temporarily refrain from intervention; when a user's risk level reaches a medium level, the system may send an in-system message to the broadcaster; when a user's risk level reaches a high level, the system may trigger an automatic outbound call system to issue a voice warning to the broadcaster; and when a user's risk level reaches an extremely high level, the system may block payment requests from that account within a set time period.

[0101] Please refer to Figure 2 , Figure 2 This is a block diagram of an electronic device 100 provided in this embodiment. The electronic device 100 includes a risk user warning device 110, a machine-readable storage medium 120, and a processor 130.

[0102] The machine-readable storage medium 120 and the processor 130 are electrically connected directly or indirectly to each other to enable data transmission or interaction. For example, these components can be electrically connected to each other via one or more communication buses or signal lines. The risk user warning device 110 includes at least one software function module that can be stored in the machine-readable storage medium 120 or embedded in the operating system (OS) of the electronic device 100 in the form of software or firmware. The processor 130 is used to execute the executable modules stored in the machine-readable storage medium 120, such as the software function modules and computer programs included in the risk user warning device 110.

[0103] The machine-readable storage medium 120 may be, but is not limited to, random access memory (RAM), read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), etc. The machine-readable storage medium 120 is used to store programs, and the processor 130 executes the programs after receiving execution instructions, thereby implementing the risk user warning method provided in this embodiment.

[0104] Processor 130 may be an integrated circuit chip with signal processing capabilities. The aforementioned processor can be a general-purpose processor, including a Central Processing Unit (CPU), a Network Processor (NP), etc.; it can also be a Digital Signal Processor (DSP), an Application-Specific Integrated Circuit (ASIC), a Field-Programmable Gate Array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor.

[0105] Please refer to Figure 3 This embodiment also provides a risk user early warning device 110, which includes at least one functional module that can be stored in machine-readable storage medium 120 in software form. Functionally, the risk user early warning device 110 may include a data acquisition module 111, a sorting module 112, a first calculation module 113, a second calculation module 114, and an early warning module 115.

[0106] The data acquisition module 111 is used to acquire the target behavior fingerprint tag of the target user. The target behavior fingerprint tag includes multiple target behaviors performed by the target user and the execution time corresponding to the target behaviors. In this embodiment, the data acquisition module 111 can be used to perform... Figure 1 For a detailed description of the data acquisition module 111, see the description of step S110 shown.

[0107] The sorting module 112 is used to sort multiple target behaviors according to their execution time to obtain a target behavior fingerprint tag sequence; In this embodiment, the sorting module 112 can be used to perform... Figure 1 For a detailed description of the sorting module 112, see the description of step S120 shown.

[0108] The first calculation module 113 is used to calculate the behavioral dimension matching degree between the target behavioral fingerprint label sequence and the template behavioral fingerprint label sequence based on the longest common subsequence length between the target behavioral fingerprint label sequence and the template behavioral fingerprint label sequence in the preset risk label library. In this embodiment, the first calculation module 113 can be used to execute... Figure 1 For a detailed description of the first calculation module 113, see the description of step S130 shown.

[0109] The second calculation module 114 is used to calculate the behavior interval risk score corresponding to each behavior group consisting of two target behaviors in the target behavior fingerprint tag, based on the execution time interval between the two target behaviors in the behavior group, and to calculate the total score of the time dimension based on the behavior interval risk scores corresponding to multiple behavior groups. In this embodiment, the second calculation module 114 can be used to execute... Figure 1 For a detailed description of the second calculation module 114, see the description of step S140 shown.

[0110] The early warning module 115 is used to calculate the user risk value of the target user based on the total score in the time dimension and the matching degree in the behavior dimension, and to execute the corresponding early warning action based on the user risk value.

[0111] In this embodiment, the early warning module 115 can be used to perform... Figure 1 For a detailed description of the early warning module 115, please refer to the description of step S150 shown.

[0112] In summary, this application provides a risk user early warning method, device, and electronic device. By sequentially linking the behavioral fingerprint tags generated by the target user at each stage to form a behavioral chain, and employing the LCS matching algorithm based on time interval constraints, the risk of the target user is comprehensively assessed from two dimensions: behavioral structure matching degree and time interval rationality. This effectively reduces the risk of failing to identify single-point low-to-medium risk or combined high-risk behavioral chains due to reliance on single-point anomaly detection and lack of cross-stage correlation capabilities. As a result, it can more accurately identify target users who may be engaging in fraudulent activities and provide timely early warning intervention.

[0113] In the embodiments provided in this application, it should be understood that the disclosed apparatus and methods can also be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of apparatus, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than those marked in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram and / or flowchart, and combinations of blocks in block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0114] In addition, the functional modules in the various embodiments of this application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0115] If the aforementioned functions are implemented as software functional modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0116] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0117] The above descriptions are merely various embodiments of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A risk user early warning method, characterized in that, The method includes: Obtain the target user's target behavior fingerprint tag, wherein the target behavior fingerprint tag includes multiple target behaviors performed by the target user and the execution time corresponding to the target behaviors; According to the execution time, the multiple target behaviors are sorted to obtain a target behavior fingerprint tag sequence; Based on the longest common subsequence length between the target behavior fingerprint tag sequence and the template behavior fingerprint tag sequence in the preset risk tag library, the behavior dimension matching degree between the target behavior fingerprint tag sequence and the template behavior fingerprint tag sequence is calculated. Based on the execution time interval between the two target behaviors, calculate the behavior interval risk score corresponding to the behavior group consisting of the two target behaviors, and calculate the total time dimension score based on the behavior interval risk scores corresponding to multiple behavior groups. The user risk value of the target user is calculated based on the total score of the time dimension and the matching degree of the behavior dimension, and the corresponding early warning action is executed based on the user risk value.

2. The method according to claim 1, characterized in that, The step of obtaining the target user's target behavior fingerprint tag includes: Based on at least two monitoring and data collection modules deployed in the registration, identity attribute modification, interaction behavior, and security verification stages, when a risky behavior is detected by the target user, a risky behavior tag is added to the target user, and the time of addition of the risky behavior tag is recorded; wherein, the risky behavior tag has a corresponding tag validity period; When any of the monitoring and acquisition modules generates a new behavior fingerprint tag, the risk behavior tag whose tag addition time is within the corresponding tag validity period is obtained as the fingerprint tag.

3. The method according to claim 1 or 2, characterized in that, The step of calculating the behavioral dimension matching degree between the target behavioral fingerprint label sequence and the template behavioral fingerprint label sequence includes: Obtain the length of the longest common subsequence between the target behavior fingerprint label sequence and the template behavior fingerprint label sequence; The quotient of the longest common subsequence length and the number of tags in the template behavior fingerprint tag sequence is used as the behavior dimension matching degree.

4. The method according to claim 1 or 2, characterized in that, The step of calculating the behavior interval risk score corresponding to the behavior group based on the execution time interval between two target behaviors in the behavior group includes: Calculate the execution time interval between two target behaviors in the behavior group, and obtain the risk duration range corresponding to the two target behaviors; A monotonically decaying function is used to calculate the behavior interval risk score corresponding to the behavior group based on the risk duration range and the execution time interval.

5. The method according to claim 4, characterized in that, The step of calculating the behavior interval risk score corresponding to the behavior group using a monotonically decaying function based on the risk duration range and the execution time interval includes: If the execution time interval is less than the lower limit of the risk duration range, then the behavior interval risk score is set to 1; If the execution time interval is greater than the upper limit of the risk duration range, the behavior interval risk score is set to a base score less than 1. If the execution time interval is between the lower limit and the upper limit of the risk duration range, then a value between the base score and 1 is determined as the behavior interval risk based on the difference between the execution time interval and the lower limit.

6. The method according to claim 5, characterized in that, The step of calculating the total time dimension score based on the behavioral interval risk scores corresponding to multiple behavioral groups includes: The average of the risk scores for the behavioral intervals corresponding to multiple behavioral groups is calculated as the total score for the time dimension; The step of calculating the user risk value of the target user based on the total score of the time dimension and the matching degree of the behavior dimension includes: The product of the behavioral dimension matching degree of the target behavior and the total score of the time dimension is calculated as the risk value of the target behavior; The maximum value among the risk values ​​of each target behavior is taken as the user risk value of the target user.

7. The method according to claim 1 or 2, characterized in that, The target user's target behavior fingerprint tag includes the target behavior generated by the target user's interaction in the target live broadcast room; The step of executing the corresponding early warning action based on the user's risk value includes: When the user's risk value is detected to be greater than a first set threshold, payment requests related to the target live streaming room are blocked within a set time period.

8. A risk user early warning device, characterized in that, The risk user early warning device includes: The data acquisition module is used to acquire the target behavior fingerprint tag of the target user. The target behavior fingerprint tag includes multiple target behaviors performed by the target user and the execution time corresponding to the target behaviors. The sorting module is used to sort multiple target behaviors according to the execution time to obtain a target behavior fingerprint tag sequence; The first calculation module is used to calculate the behavioral dimension matching degree between the target behavioral fingerprint label sequence and the template behavioral fingerprint label sequence based on the longest common subsequence length between the target behavioral fingerprint label sequence and the template behavioral fingerprint label sequence in the preset risk label library. The second calculation module is used to calculate the behavior interval risk score corresponding to each behavior group consisting of two target behaviors in the target behavior fingerprint tag, based on the execution time interval between the two target behaviors in the behavior group, and to calculate the total score of the time dimension based on the behavior interval risk scores corresponding to multiple behavior groups. The early warning module is used to calculate the user risk value of the target user based on the total score of the time dimension and the matching degree of the behavior dimension, and to execute the corresponding early warning action based on the user risk value.

9. An electronic device, characterized in that, The method includes a processor and a machine-readable storage medium, wherein the machine-readable storage medium stores machine-executable instructions, which, when executed by the processor, implement the method according to any one of claims 1-7.

10. A machine-readable storage medium, characterized in that, The machine-readable storage medium stores machine-executable instructions that, when executed by one or more processors, implement the method of any one of claims 1-7.

Images