A multi-platform payment risk interception method and system based on abnormal monitoring

Abstract

The application relates to the technical field of payment risk control, and relates to a multi-platform payment risk interception method and system based on abnormality monitoring. The method comprises the following steps: confirming a platform standard feature vector based on a terminal type, an action timestamp, a terminal geographic longitude, a terminal geographic latitude and a terminal network address; respectively collecting encrypted operation objects, encrypted account information and the platform standard feature vector to obtain multiple encrypted operation objects, multiple encrypted account information and multiple platform standard feature vectors; confirming multiple abnormality features to be monitored based on multiple platforms to be monitored, the multiple encrypted operation objects, the multiple encrypted account information and the multiple platform standard feature vectors; confirming multiple comprehensive risk scores based on the multiple platforms to be monitored and the multiple abnormality features to be monitored; confirming multiple interception decision results based on multiple cross-platform collaborative risk scores; and completing multi-platform payment risk interception. The application can realize accurate identification and real-time interception of multi-platform payment risks.

Description

Technical Field

[0001] This invention relates to the field of payment risk control technology, and in particular to a multi-platform payment risk interception method and system based on anomaly monitoring. Background Technology

[0002] With the rapid development of mobile internet and e-commerce, online payment has become the main way for people to consume and transact in their daily lives. While multi-platform payment provides users with a convenient transaction experience, it also brings various payment risks.

[0003] Currently, payment risk prevention and control mainly relies on risk identification and interception methods based on preset rules within a single platform.

[0004] However, the existing methods mentioned above have many shortcomings. Risk control based on preset rules of a single platform is independent of each other, making it difficult to conduct correlation analysis on the payment behavior of the same user on multiple platforms. They also fail to effectively identify cross-platform, decentralized, and hidden risk transactions, resulting in a significant risk of missed detections. Therefore, how to achieve accurate identification and real-time interception of multi-platform payment risks has become an urgent problem to be solved. Summary of the Invention

[0005] This invention provides a method for intercepting multi-platform payment risks based on anomaly monitoring and a computer-readable storage medium. Its main purpose is to achieve accurate identification and real-time interception of multi-platform payment risks.

[0006] To achieve the above objectives, the present invention provides a multi-platform payment risk interception method based on anomaly monitoring, comprising: Once the user equipment is identified, platform access detection is performed on the user equipment to obtain multiple platforms to be monitored; Perform the following operations on each of the multiple platforms to be monitored: Based on the user equipment and the platform to be monitored, the terminal type, action timestamp, terminal geographical longitude, terminal geographical latitude, terminal network address, encrypted operation object, and encrypted account information are identified. The platform's standard feature vector is determined based on terminal type, action timestamp, terminal geographical longitude, terminal geographical latitude, and terminal network address. The encrypted operation objects, encrypted account information, and platform standard feature vectors are summarized separately to obtain multiple encrypted operation objects, multiple encrypted account information, and multiple platform standard feature vectors; Based on multiple monitoring platforms, multiple encrypted operation objects, multiple encrypted account information, and multiple platform standard feature vectors, multiple abnormal features to be monitored were identified. Multiple comprehensive risk scores were identified based on multiple monitoring platforms and multiple abnormal features to be monitored. For each of the multiple comprehensive risk scores, perform the following operation: Compare the comprehensive risk score with the preset warning threshold. If the comprehensive risk score is less than or equal to the warning threshold, the comprehensive risk score will be used as the cross-platform collaborative risk score. If the overall risk score is greater than the warning threshold, a cross-platform collaborative risk score is confirmed based on the user device and multiple monitored platforms. By aggregating the cross-platform collaboration risk scores, multiple cross-platform collaboration risk scores are obtained. Multiple interception decisions were confirmed based on cross-platform collaborative risk scoring, thus completing the interception of payment risks across multiple platforms.

[0007] Optionally, the step of identifying the terminal type, action timestamp, terminal geographical longitude, terminal geographical latitude, terminal network address, encrypted operation object, and encrypted account information based on the user equipment and the platform to be monitored includes: The user equipment type is confirmed to obtain the terminal type; Time data is collected from user equipment to obtain action timestamps; The location of the user equipment is obtained to get the terminal's geographical longitude and geographical latitude; Network signal monitoring is performed on user equipment to obtain the terminal network address; The operation target and account information were identified based on the user device and the platform to be monitored. The operation object and account information are encrypted to obtain encrypted operation object and encrypted account information.

[0008] Optionally, the step of encrypting the operation object and account information to obtain encrypted operation object and encrypted account information includes: The fields of the operation object are parsed to obtain multiple operation object fields; Standardize the fields of multiple operation objects to obtain multiple standard fields for operation objects; The account information is parsed to obtain multiple account information fields; Multiple account information fields are standardized to obtain multiple standard account information fields; The dynamic salt value was determined based on the platform to be monitored and the action timestamp. Perform the following operation on each of the standard fields of multiple operands: Calculate the hash value of the operation object based on its standard fields and dynamic salt value; Summarize the hash values ​​of the operation objects to obtain multiple hash values ​​of the operation objects; By fusing the hash values ​​of multiple operation objects, an encrypted operation object is obtained; Encrypted account information is identified based on multiple standard account information fields and dynamic salt values.

[0009] Optionally, the step of determining the platform standard feature vector based on terminal type, action timestamp, terminal geographic longitude, terminal geographic latitude, and terminal network address includes: Numerical mapping is performed on the terminal type to obtain the terminal type feature value; Periodically encode the action timestamps to obtain action time feature values; The terminal geographic longitude and terminal geographic latitude are normalized to obtain longitude feature values ​​and latitude feature values; The terminal network address is numerically processed to obtain network address feature values; The terminal type feature value, action time feature value, longitude feature value, latitude feature value and network address feature value are combined according to a preset feature order to obtain the platform feature vector; The platform feature vectors are standardized to obtain the platform standard feature vectors.

[0010] Optionally, the step of identifying multiple abnormal features to be monitored based on multiple platforms to be monitored, multiple encrypted operation objects, multiple encrypted account information, and multiple platform standard feature vectors includes: Multiple platforms to be monitored are combined in pairs to obtain multiple platform combinations, wherein each platform combination includes: a first platform to be monitored and a second platform to be monitored; For each of the multiple platform combinations, perform the following operation: Based on the first monitoring platform, multiple encrypted operation objects, and multiple encrypted account information, the first encrypted operation object and the first encrypted account information were identified. Based on the second platform to be monitored, multiple encrypted operation objects, and multiple encrypted account information, the second encrypted operation object and the second encrypted account information were identified. The first encrypted operation object is compared with the second encrypted operation object to obtain the operation object identifier, wherein the operation object identifier is either an operation consistency identifier or an operation inconsistency identifier. The first encrypted account information is compared with the second encrypted account information to obtain the account information identifier, wherein the account information identifier is either an account consistency identifier or an account inconsistency identifier; The platform combination association identifier is determined based on the operation object identifier and account information identifier. The platform combination association identifier can be either an association identifier or a non-association identifier. By aggregating the platform combination association identifiers, multiple platform combination association identifiers are obtained; Multiple associated platform combinations were identified based on the association identifiers of multiple platform combinations. Each associated platform combination includes: a first associated platform and a second associated platform. For each of the multiple associated platform combinations, perform the following operation: Based on the first associated platform in the associated platform combination, the second associated platform in the associated platform combination, and the standard feature vectors of multiple platforms, the first associated vector and the second associated vector are identified; The first and second correlation vectors are concatenated to obtain the correlation feature vector; By summing the associated feature vectors, multiple associated feature vectors are obtained; For each of the multiple associated feature vectors, perform the following operation: The associated feature vectors are input into a pre-trained anomaly detection model to obtain the anomaly features to be monitored. By summarizing the abnormal features to be monitored, multiple abnormal features to be monitored are obtained.

[0011] Optionally, the process of identifying multiple comprehensive risk scores based on multiple monitoring platforms and multiple anomaly features includes: Perform the following operations on each of the multiple platforms to be monitored: The target monitoring features were identified based on the platform to be monitored and multiple anomalies to be monitored. Obtain the set of historical abnormal features of the platform to be monitored; Based on the historical anomaly feature set and target monitoring features, the number of elements, the target baseline mean, and the target fluctuation range were identified. The target anomaly detection threshold is calculated based on the number of elements, the target baseline mean, and the target fluctuation amplitude. The calculation formula is as follows:

[0012] in, Indicates the threshold for determining target anomalies. Indicates the target baseline mean. Indicates the target fluctuation range. This indicates the preset sensitivity adjustment coefficient. Indicates the number of elements. Represents the natural logarithm; By summing up the target anomaly detection thresholds, multiple target anomaly detection thresholds are obtained; For each of the multiple anomaly features to be monitored, perform the following operation: The abnormal features to be monitored are input into a pre-constructed abnormality scoring model to obtain abnormality sub-scores; Summarize the abnormal sub-scores to obtain multiple abnormal sub-scores; For each of the multiple outlier sub-scores, perform the following operation: Based on the anomaly sub-scores and multiple target anomaly determination thresholds, the corresponding determination thresholds are identified. The abnormal sub-scores are compared with the corresponding judgment thresholds to obtain the over-limit quantity; Calculate the weighted risk component based on the amount exceeding the limit; By summing the weighted risk components, multiple weighted risk quantities are obtained; A comprehensive risk score is determined based on multiple weighted risk quantities, where the comprehensive risk score is the sum of multiple weighted risk quantities.

[0013] Optionally, the cross-platform collaborative risk score determined based on user equipment and multiple monitored platforms includes: During the preset review period, platform access detection is performed on user devices to obtain multiple review platforms; Multiple verification platforms are matched with multiple monitoring platforms to obtain multiple target verification platforms; Perform the following operations for each of the multiple target review platforms: Multiple data collection times were identified based on the review period; Perform the following operation for each of the multiple acquisition times: Based on the user equipment, the target verification platform, and the time of data collection, the verification encryption operation object, the verification encryption account information, and the standard feature vector of the verification platform are identified. The verification and encryption operation objects, verification and encryption account information, and verification platform standard feature vectors are summarized separately to obtain multiple verification and encryption operation objects, multiple verification and encryption account information, and multiple verification platform standard feature vectors; Based on multiple verification and encryption operation objects, multiple verification and encryption account information, and multiple verification platform standard feature vectors, multiple verification anomalies were identified. Multiple comprehensive review risk scores were identified based on multiple target review platforms and multiple review anomaly characteristics. A cross-platform collaborative risk score was determined based on multiple reviews and comprehensive risk scores, as well as confirmations from multiple data collection points.

[0014] Optionally, the step of confirming a cross-platform collaborative risk score based on multiple review and comprehensive risk scores and multiple data collection times includes: For each of the multiple review comprehensive risk scores, perform the following operations: The target collection time was determined based on the comprehensive risk score and multiple collection times. Once the current time is determined, the time decay weight is calculated based on the target acquisition time and the current time. The review weighted score is calculated based on the review comprehensive risk score and the time decay weight, whereby the review weighted score is the product of the review comprehensive risk score and the time decay weight. The time decay weights and review weighted scores are summarized separately to obtain multiple time decay weights and multiple review weighted scores; The cross-platform collaboration risk score is calculated based on multiple review weighted scores and multiple time decay weights, as shown in the following formula:

[0015] in, Indicates cross-platform collaborative risk scoring. Indicates the weighted score of multiple reviews. Each review weighted score, Represents the first of multiple time decay weights Each time decay weight, This indicates the number of weighted scores in a multi-review weighted score.

[0016] Optionally, the determination of multiple interception decision results based on multiple cross-platform collaborative risk scores includes: For each of the multiple cross-platform collaboration risk scores, perform the following operations: Compare the cross-platform collaboration risk score with the preset first threshold value. If the cross-platform collaboration risk score is less than the first threshold value, the preset release decision will be used as the interception decision result. If the cross-platform collaboration risk score is greater than or equal to the first threshold, then compare the cross-platform collaboration risk score with the preset second threshold. If the cross-platform collaboration risk score is less than or equal to the second threshold, then the preset decision to perform secondary verification will be used as the interception decision result. If the cross-platform collaboration risk score is greater than the second threshold, the preset interception decision will be used as the interception decision result. The interception decision results are aggregated to obtain multiple interception decision results.

[0017] To achieve the above objectives, the present invention also provides a multi-platform payment risk interception system based on anomaly monitoring, comprising: The encrypted information acquisition module is used to identify the user device, perform platform access detection on the user device, obtain multiple monitoring platforms, and perform the following operations on each of the multiple monitoring platforms: based on the user device and the monitoring platform, identify the terminal type, action timestamp, terminal geographical longitude, terminal geographical latitude, terminal network address, encrypted operation object, and encrypted account information. The abnormal feature monitoring module is used to identify the platform standard feature vector based on terminal type, action timestamp, terminal geographical longitude, terminal geographical latitude and terminal network address. It summarizes the encrypted operation object, encrypted account information and platform standard feature vector respectively to obtain multiple encrypted operation objects, multiple encrypted account information and multiple platform standard feature vectors. Based on multiple platforms to be monitored, multiple encrypted operation objects, multiple encrypted account information and multiple platform standard feature vectors, multiple abnormal features to be monitored are identified. The risk score calculation module is used to identify multiple comprehensive risk scores based on multiple monitored platforms and multiple monitored abnormal features. For each of the multiple comprehensive risk scores, the following operation is performed: the comprehensive risk score is compared with a preset warning threshold. If the comprehensive risk score is less than or equal to the warning threshold, the comprehensive risk score is used as a cross-platform collaborative risk score. The risk decision interception module is used to identify cross-platform collaborative risk scores based on user devices and multiple monitored platforms if the comprehensive risk score is greater than the warning threshold. It then summarizes the cross-platform collaborative risk scores to obtain multiple cross-platform collaborative risk scores, and identifies multiple interception decision results based on the multiple cross-platform collaborative risk scores to complete the interception of multi-platform payment risks.

[0018] To address the above problems, the present invention also provides an electronic device, the electronic device comprising: Memory, storing at least one instruction; and The processor executes the instructions stored in the memory to implement the multi-platform payment risk interception method based on anomaly monitoring described above.

[0019] To address the aforementioned issues, the present invention also provides a computer-readable storage medium storing at least one instruction, which is executed by a processor in an electronic device to implement the aforementioned multi-platform payment risk interception method based on anomaly monitoring.

[0020] To address the problems described in the background art, this invention identifies user devices and performs platform access detection on them to obtain multiple platforms to be monitored. Specifically, this embodiment determines the monitoring targets by clearly identifying the user's currently accessed device and detecting which platforms that device is accessing. Then, for each of the multiple monitoring platforms, the following operations are performed: based on the user device and the monitoring platform, the terminal type, action timestamp, terminal geographical longitude, terminal geographical latitude, terminal network address, encrypted operation object, and encrypted account information are identified. This embodiment collects information on the user terminal type, operation time, geographical location, network address, and the account and object information involved in the operation for each platform. The platform's standard feature vector is identified based on terminal type, action timestamp, terminal geographic longitude, terminal geographic latitude, and terminal network address. This embodiment of the invention combines terminal type, time, location, and network address into a standard feature vector for that platform, reflecting the basic characteristics of this access. By summarizing encrypted operation objects, encrypted account information, and platform standard feature vectors, multiple encrypted operation objects, multiple encrypted account information, and multiple platform standard feature vectors are obtained. Based on multiple platforms to be monitored, multiple encrypted operation objects, multiple encrypted account information, and multiple platform standard feature vectors, multiple abnormal features to be monitored are identified. This embodiment of the invention identifies abnormal features by summarizing the operation objects, account information, and feature vectors of all platforms. This invention identifies potentially abnormal features and, based on multiple monitored platforms and their anomaly characteristics, determines multiple comprehensive risk scores. It demonstrates that this embodiment of the invention calculates a comprehensive risk score for each platform by combining its own security attributes and identified anomaly features, thus assessing the risk level of the current access. For each of these comprehensive risk scores, the following operation is performed: the comprehensive risk score is compared with a preset warning threshold. If the comprehensive risk score is less than or equal to the warning threshold, it is used as a cross-platform collaborative risk score. Therefore, this embodiment of the invention directly uses a platform's collaborative risk score as its risk score if it does not exceed the warning threshold, without further processing. If the comprehensive risk score is greater than the warning threshold... The warning threshold is determined based on the user device and multiple monitored platforms to establish a cross-platform collaborative risk score. This embodiment of the invention determines that if a platform's risk exceeds the warning threshold, it combines the user device's overall behavior across all platforms to make a joint judgment, recalculates the cross-platform collaborative risk score, and aggregates these scores to obtain multiple cross-platform collaborative risk scores. Based on these multiple cross-platform collaborative risk scores, multiple interception decision results are confirmed, thus completing the multi-platform payment risk interception. Therefore, this embodiment of the invention achieves accurate identification and real-time interception of multi-platform payment risks by aggregating the collaborative risk scores of all platforms and making interception or release decisions for each platform based on the score ranking. Attached Figure Description

[0021] Figure 1 This is a flowchart illustrating a multi-platform payment risk interception method based on anomaly monitoring, provided in an embodiment of the present invention. Figure 2 This is a functional block diagram of a multi-platform payment risk interception system based on anomaly monitoring provided in an embodiment of the present invention; Figure 3 This is a schematic diagram of the structure of an electronic device that implements the multi-platform payment risk interception method based on anomaly monitoring, according to an embodiment of the present invention.

[0022] Explanation of reference numerals in the attached figures: 10. Electronic device; 11. Processor; 12. Memory; 13. Bus.

[0023] The realization of the objective, functional features and advantages of the present invention will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0024] It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

[0025] This application provides a method for intercepting multi-platform payment risks based on anomaly monitoring. The executing entity of this method includes, but is not limited to, at least one electronic device that can be configured to execute the method provided in this application, such as a server or a terminal. In other words, the method can be executed by software or hardware installed on a terminal device or a server device, and the software can be a blockchain platform. The server includes, but is not limited to, a single server, a server cluster, a cloud server, or a cloud server cluster.

[0026] Reference Figure 1 The diagram shown is a flowchart illustrating a multi-platform payment risk interception method based on anomaly monitoring according to an embodiment of the present invention. In this embodiment, the multi-platform payment risk interception method based on anomaly monitoring includes: S1. Identify the user equipment and perform platform access detection on the user equipment to obtain multiple platforms to be monitored.

[0027] For example, Xiao Zhang is a staff member of the payment security center. He needs to monitor multiple payment platforms for anomalies in order to intercept any risks. Therefore, Xiao Zhang identifies the user's device to facilitate subsequent platform access detection on the user's device, thereby achieving payment risk interception.

[0028] It should be explained that "user device" refers to the device (e.g., mobile phone, computer) used by the user to access payment platforms (e.g., Alipay, WeChat Pay). The "platform access detection of user device" refers to monitoring the user device to identify multiple payment platforms accessed by the user device; these multiple payment platforms are the platforms to be monitored.

[0029] S2. Perform the following operations on each of the multiple monitoring platforms: Based on the user equipment and the monitoring platform, identify the terminal type, action timestamp, terminal geographical longitude, terminal geographical latitude, terminal network address, encrypted operation object, and encrypted account information.

[0030] Specifically, the process of identifying the terminal type, action timestamp, terminal geographical longitude, terminal geographical latitude, terminal network address, encrypted operation object, and encrypted account information based on the user equipment and the platform to be monitored includes: The user equipment type is confirmed to obtain the terminal type; Time data is collected from user equipment to obtain action timestamps; The location of the user equipment is obtained to get the terminal's geographical longitude and geographical latitude; Network signal monitoring is performed on user equipment to obtain the terminal network address; The operation target and account information were identified based on the user device and the platform to be monitored. The operation object and account information are encrypted to obtain encrypted operation object and encrypted account information.

[0031] It should be explained that the user device type confirmation refers to identifying the type of the user device based on its serial number. The type of the user device is the terminal type, and the serial number refers to the IMEI. For example, if the IMEI of the user device is 8612345678910110, the first 8 digits of the IMEI are matched with a pre-built device model database to obtain the device model corresponding to the IMEI. Then, the terminal type is confirmed based on the device model, such as a smartphone, tablet, or wearable smart device. If the IMEI of a user device matches a smartphone of a certain brand in the device model database, then the terminal type of the user device is a smartphone.

[0032] It is understood that the "time collection of user equipment" refers to collecting the timestamp of the user equipment performing a payment operation, which is the action timestamp. The "location acquisition of user equipment" refers to obtaining the longitude and latitude of the user equipment's location, where the longitude and latitude are the terminal's geographical longitude and latitude, respectively. The "network signal monitoring of user equipment" refers to obtaining the user equipment's current IP address, which is the terminal's network address. The "operation object" refers to the name of the account on the platform to be monitored for the payment operation performed by the user equipment, and the "account information" refers to the account number of the account on the platform to be monitored for the payment operation performed by the user equipment.

[0033] Specifically, the encryption process for the operation object and account information to obtain encrypted operation object and encrypted account information includes: The fields of the operation object are parsed to obtain multiple operation object fields; Standardize the fields of multiple operation objects to obtain multiple standard fields for operation objects; The account information is parsed to obtain multiple account information fields; Multiple account information fields are standardized to obtain multiple standard account information fields; The dynamic salt value was determined based on the platform to be monitored and the action timestamp. Perform the following operation on each of the standard fields of multiple operands: The hash value of the operation object is calculated based on its standard fields and dynamic salt value, using the following formula:

[0034] in, Indicates the hash value of the object being operated on. This represents the standard field of the operation object. Indicates dynamic salt value, This represents a one-way hash function. This represents a string concatenation operation. The preset prime modulus, This represents the modulo operation; Summarize the hash values ​​of the operation objects to obtain multiple hash values ​​of the operation objects; By fusing the hash values ​​of multiple operation objects, an encrypted operation object is obtained; Encrypted account information is identified based on multiple standard account information fields and dynamic salt values.

[0035] It should be explained that the field parsing of the operation object refers to splitting the operation object character by character to obtain multiple individual fields. These multiple individual fields are the multiple operation object fields. For example, if the operation object is "Zhang San," then the two fields obtained after parsing the operation object are "Zhang" and "San." The standardization processing of the multiple operation object fields refers to representing each of the multiple operation object fields using a unified encoding mechanism. The operation object fields after standardization are the standard operation object fields. For example, the operation object field "Zhang" is converted to UTF-8 format, and any leading or trailing whitespace characters are removed to obtain the corresponding standard operation object field "Zhang." Similarly, the operation object field "San" is converted to UTF-8 format, and any leading or trailing whitespace characters are removed to obtain the corresponding standard operation object field "San." After the above processing, even if the same name is stored on different monitoring platforms using different encoding mechanisms, its standard operation object fields remain consistent, thus providing a basis for cross-platform comparison.

[0036] It should be noted that the field parsing of account information refers to splitting the account information (i.e., the account number) digit by digit to obtain multiple individual fields, which are the multiple account information fields. For example, if the account information is "6222021234567890xyz", then the multiple account information fields obtained after parsing the account information are as follows: 6, 2, 2, 2, 0, 2, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, x, y, z.

[0037] It should be understood that the method for standardizing multiple account information fields to obtain multiple standard account information fields is the same as the method for standardizing multiple operation object fields to obtain multiple standard operation object fields, and will not be repeated here. The account information fields after standardization are the standard account information fields.

[0038] It should be explained that the process of determining the dynamic salt value based on the monitored platform and action timestamp involves the following steps: First, the platform identifier of the monitored platform is obtained. Then, the time window identifier is determined based on the action timestamp. The platform identifier and the time window identifier are concatenated to obtain the concatenated result. Finally, a one-way hash operation is performed on the concatenated result to obtain the dynamic salt value. Here, the platform identifier is a string used to uniquely identify the monitored platform. Determining the time window identifier based on the action timestamp means: rounding the action timestamp down to the nearest integer using a preset time granularity (e.g., hours), and using the string corresponding to this rounded-down time as the time window identifier. For example, if the action timestamp is 13:27:45 on May 1, 2024, and the preset time granularity is hours, then the action timestamp is rounded down to the nearest integer to obtain 13:00 on May 1, 2024. The string corresponding to this exact hour (i.e., 2024050113) is then used as the time window identifier. It should be noted that, at the same time granularity, multiple payment operations falling within the same hour interval will correspond to the same time window identifier, thus ensuring that the dynamic salt value generated by the same monitored platform within the same time window remains consistent. Concatenating the platform identifier and the time window identifier means joining them end-to-end in a preset order (e.g., platform identifier, time window identifier) ​​to form a string. For example, if the platform identifier of a monitored platform is PLT_A and the time window identifier is 2024050113, the concatenation result is PLT_A2024050113. The value obtained after performing a one-way hash operation on the concatenation result is the dynamic salt value. Performing a one-way hash operation on the concatenation result means processing the concatenation result using a preliminary algorithm to generate a fixed-length string related to the concatenation result. This fixed-length string related to the concatenation result is the dynamic salt value. Optionally, MD4 is used as the preliminary algorithm.

[0039] It should be explained that the object hash value refers to the value obtained by performing a one-way hash operation on the standard fields and dynamic salt value of the object being operated on, and then taking the modulo of a prime number. The prime number modulo is a prime number whose length does not exceed the output bit width of the one-way hash function. The specific value can be selected by those skilled in the art according to practical needs. For example, if the output bit width of the one-way hash function is 256, then a value less than 256 should be selected. A prime number is used as the prime modulus.

[0040] Understandably, fusing the hash values ​​of multiple operation objects to obtain an encrypted operation object refers to the process of merging the hash values ​​of multiple operation objects into an encrypted string according to a preset fusion rule. This encrypted string is the encrypted operation object. Optionally, the fusion rule is as follows: concatenating the hash values ​​of multiple operation objects in a preset order and then performing a one-way hash operation. Specifically, the hash values ​​of multiple operation objects are concatenated into a single string according to the original order of their corresponding fields (e.g., Zhang, San), and then a one-way hash operation is performed on this single string, followed by modulo operation on a prime number, to obtain the final encrypted operation object.

[0041] It should be understood that the method for identifying encrypted account information based on multiple standard fields of account information and dynamic salt values ​​is the same as the method for identifying encrypted operation objects based on multiple standard fields of operation objects and dynamic salt values, and will not be described again here.

[0042] S3. Based on terminal type, action timestamp, terminal geographical longitude, terminal geographical latitude and terminal network address, the platform standard feature vector is identified. The encrypted operation object, encrypted account information and platform standard feature vector are summarized respectively to obtain multiple encrypted operation objects, multiple encrypted account information and multiple platform standard feature vectors.

[0043] Specifically, the process of identifying the platform's standard feature vector based on terminal type, action timestamp, terminal geographic longitude, terminal geographic latitude, and terminal network address includes: Numerical mapping is performed on the terminal type to obtain the terminal type feature value; Periodically encode the action timestamps to obtain action time feature values; The terminal geographic longitude and terminal geographic latitude are normalized to obtain longitude feature values ​​and latitude feature values; The terminal network address is numerically processed to obtain network address feature values; The terminal type feature value, action time feature value, longitude feature value, latitude feature value and network address feature value are combined according to a preset feature order to obtain the platform feature vector; The platform feature vectors are standardized to obtain the platform standard feature vectors.

[0044] It should be explained that the numerical mapping of terminal types refers to mapping the terminal type to the corresponding value in the pre-built type encoding table. The resulting value is the terminal type feature value. Optionally, the type encoding table is as follows: smartphone corresponds to value 1, tablet corresponds to value 2, and wearable smart device corresponds to value 3. For example, if the terminal type is a smartphone, the terminal type feature value is 1. The periodic encoding of action timestamps refers to mapping the action timestamp to a value that reflects the periodicity of payment operations within a day (for example, payment operations in the early morning are more likely to be abnormal than those during the daytime). Specifically, the action timestamp is first converted into the number of seconds that have elapsed within the day. Then, the number of seconds that have elapsed within the day is calculated as the corresponding phase angle based on the total number of seconds in the day (i.e., 86400 seconds). The sine of the phase angle is then taken to obtain the action time feature value. For example, if the action timestamp is 13:27:45 on May 1, 2024, then the number of seconds that have elapsed within that day is... seconds, corresponding to a phase angle of The action time characteristic value is .

[0045] It is understood that the normalization processing of the terminal geographical longitude and latitude to obtain the longitude feature value and latitude feature value refers to calculating the longitude feature value and latitude feature value according to the following formula: ,in, Represents the longitude characteristic value. Represents latitudinal characteristic values. Indicates the geographical longitude of the terminal. This represents the terminal's geographical latitude and longitude. The terminal network address (i.e., the user device's current IP address) is generally represented in dotted decimal notation, meaning an IP address is represented by four bytes: byte 1.2.3.4. Each byte is represented in decimal as 0~255, such as 192.168.0.1. The process of numerically processing the terminal network address to obtain its network address characteristic value refers to calculating the network address characteristic value based on the four bytes of the terminal network address. The calculation formula is as follows: ,in, Represents the characteristic value of a network address. This represents the first byte of the four bytes in the terminal network address. This represents the second byte of the four bytes in the terminal network address. This represents the third byte of the four bytes in the terminal network address. This represents the fourth byte of the four bytes in the terminal's network address. For example, if the terminal's network address is 192.168.0.1, then the network address characteristic value is 192 × 256. 3 +168×256 2 +0×256+1, which is 3232235521.

[0046] It should be understood that combining terminal type feature values, action time feature values, longitude feature values, latitude feature values, and network address feature values ​​according to a preset feature order means arranging these feature values ​​sequentially. Optionally, the feature order is: terminal type feature value, action time feature value, longitude feature value, latitude feature value, and network address feature value. The platform feature vector is the vector obtained by combining terminal type feature values, action time feature values, longitude feature values, latitude feature values, and network address feature values ​​according to a preset feature order. For example, if the terminal type feature value is 1, the action time feature value is 2, the longitude feature value is 3, the latitude feature value is 4, and the network address feature value is 5, then the platform feature vector is (1, 2, 3, 4, 5).

[0047] It is understood that the standardization of platform feature vectors refers to the process of standardizing platform feature vectors, and the method of standardizing platform feature vectors is existing technology, which will not be described in detail here. The platform standard feature vector refers to the platform feature vector after standardization.

[0048] S4. Based on multiple monitoring platforms, multiple encrypted operation objects, multiple encrypted account information, and multiple platform standard feature vectors, multiple abnormal features to be monitored are identified.

[0049] Specifically, the process involves identifying multiple abnormal features to be monitored based on multiple monitored platforms, multiple encrypted operation objects, multiple encrypted account information, and multiple platform standard feature vectors. These features include: Multiple platforms to be monitored are combined in pairs to obtain multiple platform combinations, wherein each platform combination includes: a first platform to be monitored and a second platform to be monitored; For each of the multiple platform combinations, perform the following operation: Based on the first monitoring platform, multiple encrypted operation objects, and multiple encrypted account information, the first encrypted operation object and the first encrypted account information were identified. Based on the second platform to be monitored, multiple encrypted operation objects, and multiple encrypted account information, the second encrypted operation object and the second encrypted account information were identified. The first encrypted operation object is compared with the second encrypted operation object to obtain the operation object identifier, wherein the operation object identifier is either an operation consistency identifier or an operation inconsistency identifier. The first encrypted account information is compared with the second encrypted account information to obtain the account information identifier, wherein the account information identifier is either an account consistency identifier or an account inconsistency identifier; The platform combination association identifier is determined based on the operation object identifier and account information identifier. The platform combination association identifier can be either an association identifier or a non-association identifier. By aggregating the platform combination association identifiers, multiple platform combination association identifiers are obtained; Multiple associated platform combinations were identified based on the association identifiers of multiple platform combinations. Each associated platform combination includes: a first associated platform and a second associated platform. For each of the multiple associated platform combinations, perform the following operation: Based on the first associated platform in the associated platform combination, the second associated platform in the associated platform combination, and the standard feature vectors of multiple platforms, the first associated vector and the second associated vector are identified; The first and second correlation vectors are concatenated to obtain the correlation feature vector; By summing the associated feature vectors, multiple associated feature vectors are obtained; For each of the multiple associated feature vectors, perform the following operation: The associated feature vectors are input into a pre-trained anomaly detection model to obtain the anomaly features to be monitored. By summarizing the abnormal features to be monitored, multiple abnormal features to be monitored are obtained.

[0050] It should be explained that the phrase "combining multiple platforms to be monitored in pairs" means: arbitrarily selecting two different platforms from the multiple platforms to be monitored to form a platform combination, designating one as the first platform to be monitored and the other as the second platform to be monitored, and iterating through all possible combinations to obtain multiple platform combinations. For example, if the multiple platforms to be monitored are Alipay, WeChat Pay, and UnionPay QuickPass, then the resulting platform combinations are: (Alipay, WeChat Pay), (Alipay, UnionPay QuickPass), (WeChat Pay, UnionPay QuickPass). The first encrypted operation object refers to the encrypted operation object of the platform to be monitored corresponding to the first platform to be monitored, and the first encrypted account information refers to the encrypted account information of the platform to be monitored corresponding to the first platform to be monitored. The comparison between the first encrypted operation object and the second encrypted operation object refers to determining whether the first encrypted operation object and the second encrypted operation object are the same. If they are the same, the operation consistency identifier is used as the operation object identifier. The operation consistency identifier is an identifier used to indicate that the account names performing payment operations on the two platforms to be monitored in the platform combination are the same. If they are different, the operation inconsistency identifier is used as the operation object identifier. The operation inconsistency identifier is an identifier used to indicate that the account names performing payment operations on the two platforms to be monitored in the platform combination are different.

[0051] It should be understood that the method for comparing the first encrypted account information with the second encrypted account information is the same as the method for comparing the first encrypted operation object with the second encrypted operation object, and will not be described again here.

[0052] It should be explained that the determination of the platform combination association identifier based on the consistency identifier of the operation object and the consistency identifier of the account information means: combining the consistency identifier of the operation object and the consistency identifier of the account information, determining whether there is an association between the two monitored platforms in the platform combination. If there is an association, the association identifier is used as the platform combination association identifier; if there is no association, the non-association identifier is used as the platform combination association identifier. The association identifier is used to reflect the existence of an association between the two monitored platforms in the platform combination, and the non-association identifier is used to reflect the existence of no association between the two monitored platforms in the platform combination. Optionally, when the operation object identifier is an operation consistency identifier and the account information identifier is an account consistency identifier, the platform combination association identifier of the platform combination is confirmed as an association identifier; otherwise, the platform combination association identifier of the platform combination is confirmed as a non-association identifier.

[0053] It is understood that identifying multiple associated platform combinations based on multiple platform combination association identifiers means: selecting platform combinations whose platform combination association identifiers are association identifiers from the multiple platform combination association identifiers corresponding to the multiple platform combinations. These platform combinations whose platform combination association identifiers are association identifiers are the associated platform combinations. The first platform to be monitored in the associated platform combination is designated as the first associated platform, and the second platform to be monitored in the associated platform combination is designated as the second associated platform. The first association vector refers to the platform standard feature vector among the multiple platform standard feature vectors that corresponds to the first associated platform in the associated platform combination, and the second association vector refers to the platform standard feature vector among the multiple platform standard feature vectors that corresponds to the second associated platform in the associated platform combination.

[0054] It should be understood that concatenating the first and second correlation vectors to obtain the correlation feature vector means connecting the first and second correlation vectors end-to-end according to a preset concatenation order (e.g., first correlation vector, second correlation vector) to form a higher-dimensional vector, which is the correlation feature vector. For example, if the first correlation vector is (a1, a2, a3, a4, a5) and the second correlation vector is (b1, b2, b3, b4, b5), then the concatenated correlation feature vector is (a1, a2, a3, a4, a5, b1, b2, b3, b4, b5). Inputting the correlation feature vector into a pre-trained anomaly detection model to obtain the anomaly features to be monitored means analyzing the correlation feature vector using the anomaly detection model and outputting a feature vector indicating potential risk, which is the anomaly feature to be monitored. Optionally, the anomaly detection model is an isolated forest.

[0055] S5. Based on multiple monitoring platforms and multiple abnormal features, multiple comprehensive risk scores are identified.

[0056] In detail, the process involves identifying multiple comprehensive risk scores based on multiple monitored platforms and multiple monitored anomaly features, including: Perform the following operations on each of the multiple platforms to be monitored: The target monitoring features were identified based on the platform to be monitored and multiple anomalies to be monitored. Obtain the set of historical abnormal features of the platform to be monitored; Based on the historical anomaly feature set and target monitoring features, the number of elements, the target baseline mean, and the target fluctuation range were identified. The target anomaly detection threshold is calculated based on the number of elements, the target baseline mean, and the target fluctuation amplitude. The calculation formula is as follows:

[0057] in, Indicates the threshold for determining target anomalies. Indicates the target baseline mean. Indicates the target fluctuation range. This indicates the preset sensitivity adjustment coefficient. Indicates the number of elements. Represents the natural logarithm; By summing up the target anomaly detection thresholds, multiple target anomaly detection thresholds are obtained; For each of the multiple anomaly features to be monitored, perform the following operation: The abnormal features to be monitored are input into a pre-constructed abnormality scoring model to obtain abnormality sub-scores; Summarize the abnormal sub-scores to obtain multiple abnormal sub-scores; For each of the multiple outlier sub-scores, perform the following operation: Based on the anomaly sub-scores and multiple target anomaly determination thresholds, the corresponding determination thresholds are identified. The abnormal sub-scores are compared with the corresponding judgment thresholds to obtain the over-limit quantity; The weighted risk component is calculated based on the amount exceeding the limit, and the calculation formula is as follows:

[0058] in, Indicates the weighted risk component. The more limited the quantity, This represents the preset risk weighting coefficient. Represents the natural constant; By summing the weighted risk components, multiple weighted risk quantities are obtained; A comprehensive risk score is determined based on multiple weighted risk quantities, where the comprehensive risk score is the sum of multiple weighted risk quantities.

[0059] It should be explained that the target monitoring feature refers to multiple anomaly features to be monitored and the corresponding anomaly features of the platform to be monitored. The historical anomaly feature set refers to a set composed of multiple historical monitoring feature values, which are multiple payment operations that have shown risk and are recorded in the historical operation of the platform to be monitored. The historical anomaly feature set can be obtained from the historical operation logs of the platform to be monitored. The process of identifying the number of elements, the target baseline mean, and the target fluctuation range based on the historical anomaly feature set and the target monitoring feature refers to the following: First, the total number of elements contained in the historical anomaly feature set is counted, which is the number of elements. Next, the arithmetic mean of the multiple historical anomaly features in the historical anomaly feature set corresponding to the target monitoring feature is calculated, which is the target baseline mean. Finally, the standard deviation of the multiple historical anomaly features in the historical anomaly feature set corresponding to the target monitoring feature relative to the target baseline mean is calculated, which is the target fluctuation range.

[0060] Understandably, the target anomaly detection threshold is a critical value used to determine whether the anomaly sub-score exceeds the limit, and the sensitivity adjustment coefficient is a non-negative number less than 1 used to adjust the strictness of the detection. Optionally, it can be obtained by fitting historical experimental data, for example, 0.1. The step of inputting the anomaly feature to be monitored into the pre-constructed anomaly scoring model to obtain the anomaly sub-score means: using the anomaly scoring model to quantitatively analyze the anomaly feature to be monitored, and outputting a value used to characterize the degree of anomaly of the anomaly feature to be monitored. The value used to characterize the degree of anomaly of the anomaly feature to be monitored is the anomaly sub-score. The larger the anomaly sub-score, the higher the degree of anomaly of the anomaly feature to be monitored. Optionally, the anomaly scoring model can use an isolated forest.

[0061] It should be understood that the corresponding judgment threshold refers to the target anomaly judgment threshold corresponding to the anomaly sub-score among multiple target anomaly judgment thresholds. The threshold is equal to the anomaly sub-score minus the corresponding judgment threshold. The weighted risk component reflects the degree of contribution of the anomaly sub-score to the overall risk. The larger the weighted risk component, the higher the degree of contribution of the anomaly sub-score to the overall risk. The risk weight coefficient is a coefficient used to artificially adjust the proportion of the risk component in the overall risk score. Optionally, the risk weight coefficient can be obtained by fitting historical experimental data, for example, 0.3.

[0062] S6. For each of the multiple comprehensive risk scores, perform the following operation: compare the comprehensive risk score with the preset warning threshold. If the comprehensive risk score is less than or equal to the warning threshold, then use the comprehensive risk score as the cross-platform collaborative risk score.

[0063] It should be explained that the warning threshold is a value set manually by the staff of the payment security center based on the maximum value of the comprehensive risk score of payment operations that have been completed normally in the past. For example, if the maximum value of the comprehensive risk score of payment operations that have been completed normally in the past is 30, then the warning threshold is 30.

[0064] S7. If the comprehensive risk score is greater than the warning threshold, the cross-platform collaborative risk score is confirmed based on the user equipment and multiple monitoring platforms. The cross-platform collaborative risk scores are then summarized to obtain multiple cross-platform collaborative risk scores.

[0065] In detail, the cross-platform collaborative risk score confirmed based on user equipment and multiple monitored platforms includes: During the preset review period, platform access detection is performed on user devices to obtain multiple review platforms; Multiple verification platforms are matched with multiple monitoring platforms to obtain multiple target verification platforms; Perform the following operations for each of the multiple target review platforms: Multiple data collection times were identified based on the review period; Perform the following operation for each of the multiple acquisition times: Based on the user equipment, the target verification platform, and the time of data collection, the verification encryption operation object, the verification encryption account information, and the standard feature vector of the verification platform are identified. The verification and encryption operation objects, verification and encryption account information, and verification platform standard feature vectors are summarized separately to obtain multiple verification and encryption operation objects, multiple verification and encryption account information, and multiple verification platform standard feature vectors; Based on multiple verification and encryption operation objects, multiple verification and encryption account information, and multiple verification platform standard feature vectors, multiple verification anomalies were identified. Multiple comprehensive review risk scores were identified based on multiple target review platforms and multiple review anomaly characteristics. A cross-platform collaborative risk score was determined based on multiple reviews and comprehensive risk scores, as well as confirmations from multiple data collection points.

[0066] It should be explained that the phrase "performing platform access detection on the user device within the preset review period to obtain multiple review platforms" means: within the review period, platform access detection is performed on the user device to obtain multiple payment platforms accessed by the user device during the review period. These multiple payment platforms accessed by the user device during the review period constitute the multiple review platforms. Optionally, the review period is 2 minutes. The phrase "matching the multiple review platforms with multiple monitoring platforms to obtain multiple target review platforms" means: selecting review platforms that match the multiple monitoring platforms from the multiple review platforms. These review platforms that match the multiple monitoring platforms constitute the multiple target review platforms. Multiple collection times refer to multiple times obtained by dividing the review period according to a preset interval (e.g., 2 seconds). For example, if the review period is 2 minutes, the multiple times obtained by dividing the review period according to the preset interval (e.g., 2 seconds) are: 2 seconds, 4 seconds, 6 seconds, ..., 116 seconds, 118 seconds, 120 seconds.

[0067] It should be understood that the identification of the encrypted operation object, encrypted account information, and standard feature vector of the verification platform based on the user device, the target verification platform, and the collection time means that at the current collection time, the encrypted operation object, encrypted account information, and standard feature vector of the verification platform are identified based on the user device and the target verification platform. The method for identifying the encrypted operation object, encrypted account information, and standard feature vector of the verification platform based on the user device and the target verification platform is the same as the method for identifying the encrypted operation object, encrypted account information, and standard feature vector of the platform based on the user device and the platform to be monitored, and will not be described again here.

[0068] It is understood that the method for identifying multiple review anomaly features based on multiple review encryption operation objects, multiple review encryption account information, and multiple review platform standard feature vectors is the same as the method for identifying multiple monitored anomaly features based on multiple monitoring platforms, multiple encryption operation objects, multiple encryption account information, and multiple platform standard feature vectors, and will not be repeated here. Similarly, the method for identifying multiple review comprehensive risk scores based on multiple target review platforms and multiple review anomaly features is the same as the method for identifying multiple comprehensive risk scores based on multiple monitoring platforms and multiple monitored anomaly features, and will not be repeated here.

[0069] In detail, the cross-platform collaborative risk score confirmed based on multiple review and comprehensive risk scores and multiple data collection times includes: For each of the multiple review comprehensive risk scores, perform the following operations: The target collection time was determined based on the comprehensive risk score and multiple collection times. Once the current time is determined, the time decay weight is calculated based on the target acquisition time and the current time. The calculation formula is as follows:

[0070] in, Indicates the time decay weight. Indicates the current moment. Indicates the target acquisition time. Indicates taking the absolute value; The review weighted score is calculated based on the review comprehensive risk score and the time decay weight, whereby the review weighted score is the product of the review comprehensive risk score and the time decay weight. The time decay weights and review weighted scores are summarized separately to obtain multiple time decay weights and multiple review weighted scores; The cross-platform collaboration risk score is calculated based on multiple review weighted scores and multiple time decay weights, as shown in the following formula:

[0071] in, Indicates cross-platform collaborative risk scoring. Indicates the weighted score of multiple reviews. Each review weighted score, Represents the first of multiple time decay weights Each time decay weight, This indicates the number of weighted scores in a multi-review weighted score.

[0072] It should be explained that the target data collection time refers to the data collection time corresponding to the comprehensive risk score during the review process, among multiple data collection times. The current time refers to the current time. The time decay weight reflects the contribution of the comprehensive risk score during the review process to the final cross-platform collaborative risk score; the larger the time decay weight, the greater the contribution of the comprehensive risk score during the review process to the final cross-platform collaborative risk score. The cross-platform collaborative risk score reflects the overall risk level of a user device when performing payment operations across multiple payment platforms during the review period; the higher the cross-platform collaborative risk score, the higher the overall risk level of the user device when performing payment operations across multiple payment platforms during the review period.

[0073] S8. Based on multiple cross-platform collaborative risk scores, multiple interception decision results are confirmed, and multi-platform payment risk interception is completed.

[0074] In detail, the multiple interception decision results confirmed based on multiple cross-platform collaborative risk scores include: For each of the multiple cross-platform collaboration risk scores, perform the following operations: Compare the cross-platform collaboration risk score with the preset first threshold value. If the cross-platform collaboration risk score is less than the first threshold value, the preset release decision will be used as the interception decision result. If the cross-platform collaboration risk score is greater than or equal to the first threshold, then compare the cross-platform collaboration risk score with the preset second threshold. If the cross-platform collaboration risk score is less than or equal to the second threshold, then the preset decision to perform secondary verification will be used as the interception decision result. If the cross-platform collaboration risk score is greater than the second threshold, the preset interception decision will be used as the interception decision result. The interception decision results are aggregated to obtain multiple interception decision results.

[0075] It should be explained that the first threshold is a value manually set by the staff of the Payment Security Center based on the maximum cross-platform collaborative risk score of historically successfully completed payment transactions. For example, if the maximum cross-platform collaborative risk score of historically successfully completed payment transactions is 20, then the first threshold is 20. The second threshold is a value manually set by the staff of the Payment Security Center based on the minimum cross-platform collaborative risk score of historically risky payment transactions. For example, if the minimum cross-platform collaborative risk score of historically risky payment transactions is 70, then the second threshold is 70.

[0076] Understandably, a release decision means that the payment operation has no risk and can continue. A secondary verification decision means that the payment operation may have risk and requires secondary identity verification. An interception decision means that the payment operation has risk and needs to be intercepted. The interception decision result refers to the result confirmed by cross-platform collaborative risk scoring and sent to the payment platform to assist in completing risk interception.

[0077] For example, after obtaining multiple interception decision results, Xiao Zhang can send the multiple interception decision results to the corresponding payment platform. The payment platform can then intercept potential payment risks based on the received interception decision results, thereby completing the interception of payment risks across multiple platforms.

[0078] To address the problems described in the background art, this invention identifies user devices and performs platform access detection on them to obtain multiple platforms to be monitored. Specifically, this embodiment determines the monitoring targets by clearly identifying the user's currently accessed device and detecting which platforms that device is accessing. Then, for each of the multiple monitoring platforms, the following operations are performed: based on the user device and the monitoring platform, the terminal type, action timestamp, terminal geographical longitude, terminal geographical latitude, terminal network address, encrypted operation object, and encrypted account information are identified. This embodiment collects information on the user terminal type, operation time, geographical location, network address, and the account and object information involved in the operation for each platform. The platform's standard feature vector is identified based on terminal type, action timestamp, terminal geographic longitude, terminal geographic latitude, and terminal network address. This embodiment of the invention combines terminal type, time, location, and network address into a standard feature vector for that platform, reflecting the basic characteristics of this access. By summarizing encrypted operation objects, encrypted account information, and platform standard feature vectors, multiple encrypted operation objects, multiple encrypted account information, and multiple platform standard feature vectors are obtained. Based on multiple platforms to be monitored, multiple encrypted operation objects, multiple encrypted account information, and multiple platform standard feature vectors, multiple abnormal features to be monitored are identified. This embodiment of the invention identifies abnormal features by summarizing the operation objects, account information, and feature vectors of all platforms. This invention identifies potentially abnormal features and, based on multiple monitored platforms and their anomaly characteristics, determines multiple comprehensive risk scores. It demonstrates that this embodiment of the invention calculates a comprehensive risk score for each platform by combining its own security attributes and identified anomaly features, thus assessing the risk level of the current access. For each of these comprehensive risk scores, the following operation is performed: the comprehensive risk score is compared with a preset warning threshold. If the comprehensive risk score is less than or equal to the warning threshold, it is used as a cross-platform collaborative risk score. Therefore, this embodiment of the invention directly uses a platform's collaborative risk score as its risk score if it does not exceed the warning threshold, without further processing. If the comprehensive risk score is greater than the warning threshold... The warning threshold is determined based on the user device and multiple monitored platforms to establish a cross-platform collaborative risk score. This embodiment of the invention determines that if a platform's risk exceeds the warning threshold, it combines the user device's overall behavior across all platforms to make a joint judgment, recalculates the cross-platform collaborative risk score, and aggregates these scores to obtain multiple cross-platform collaborative risk scores. Based on these multiple cross-platform collaborative risk scores, multiple interception decision results are confirmed, thus completing the multi-platform payment risk interception. Therefore, this embodiment of the invention achieves accurate identification and real-time interception of multi-platform payment risks by aggregating the collaborative risk scores of all platforms and making interception or release decisions for each platform based on the score ranking.

[0079] like Figure 2 The diagram shown is a functional block diagram of a multi-platform payment risk interception system based on anomaly monitoring provided in an embodiment of the present invention.

[0080] The multi-platform payment risk interception system 100 based on anomaly monitoring described in this invention can be installed in an electronic device. Depending on the functions implemented, the multi-platform payment risk interception system 100 based on anomaly monitoring may include an encrypted information acquisition module 101, an anomaly feature monitoring module 102, a risk scoring calculation module 103, and a risk decision interception module 104. The module described in this invention can also be referred to as a unit, which refers to a series of computer program segments that can be executed by the processor of an electronic device and can perform a fixed function, and which are stored in the memory of the electronic device.

[0081] The encrypted information acquisition module 101 is used to identify the user equipment, perform platform access detection on the user equipment, obtain multiple monitoring platforms, and perform the following operations on each of the multiple monitoring platforms: based on the user equipment and the monitoring platform, identify the terminal type, action timestamp, terminal geographical longitude, terminal geographical latitude, terminal network address, encrypted operation object, and encrypted account information. The abnormal feature monitoring module 102 is used to identify the platform standard feature vector based on terminal type, action timestamp, terminal geographical longitude, terminal geographical latitude and terminal network address, and to summarize the encrypted operation object, encrypted account information and platform standard feature vector respectively to obtain multiple encrypted operation objects, multiple encrypted account information and multiple platform standard feature vectors. Based on multiple platforms to be monitored, multiple encrypted operation objects, multiple encrypted account information and multiple platform standard feature vectors, multiple abnormal features to be monitored are identified. The risk score calculation module 103 is used to identify multiple comprehensive risk scores based on multiple monitoring platforms and multiple monitoring anomaly features. For each of the multiple comprehensive risk scores, the following operation is performed: the comprehensive risk score is compared with a preset warning threshold. If the comprehensive risk score is less than or equal to the warning threshold, the comprehensive risk score is used as a cross-platform collaborative risk score. The risk decision interception module 104 is used to confirm the cross-platform collaborative risk score based on the user device and multiple monitored platforms if the comprehensive risk score is greater than the warning threshold, summarize the cross-platform collaborative risk scores to obtain multiple cross-platform collaborative risk scores, and confirm multiple interception decision results based on the multiple cross-platform collaborative risk scores to complete the multi-platform payment risk interception.

[0082] In detail, the modules in the multi-platform payment risk interception system 100 based on anomaly monitoring described in this embodiment of the invention employ the same methods as described above. Figure 1The method used here is the same as the multi-platform payment risk interception method based on anomaly monitoring described above, and can produce the same technical effect, so it will not be repeated here.

[0083] like Figure 3 The diagram shown is a structural schematic of an electronic device that implements a multi-platform payment risk interception method based on anomaly monitoring, according to an embodiment of the present invention.

[0084] The electronic device 1 may include a processor 10, a memory 11 and a bus 12, and may also include a computer program stored in the memory 11 and capable of running on the processor 10, such as a multi-platform payment risk interception method program based on anomaly monitoring.

[0085] The memory 11 includes at least one type of readable storage medium, such as flash memory, portable hard drive, multimedia card, card-type memory (e.g., SD or DX memory), magnetic memory, magnetic disk, optical disk, etc. In some embodiments, the memory 11 can be an internal storage unit of the electronic device 1, such as a portable hard drive. In other embodiments, the memory 11 can be an external storage device of the electronic device 1, such as a plug-in portable hard drive, smart media card (SMC), secure digital card (SD), flash card, etc., equipped on the electronic device 1. Furthermore, the memory 11 includes both internal storage units and external storage devices of the electronic device 1. The memory 11 can be used not only to store application software and various types of data installed on the electronic device 1, such as the code of a multi-platform payment risk interception method program based on anomaly monitoring, but also to temporarily store data that has been output or will be output.

[0086] In some embodiments, the processor 10 may be composed of integrated circuits, such as a single packaged integrated circuit or multiple integrated circuits with the same or different functions, including combinations of one or more central processing units (CPUs), microprocessors, digital processing chips, graphics processors, and various control chips. The processor 10 is the control unit of the electronic device, connecting various components of the entire electronic device through various interfaces and lines. It executes programs or modules stored in the memory 11 (e.g., a multi-platform payment risk interception method program based on anomaly monitoring) and calls data stored in the memory 11 to perform various functions of the electronic device 1 and process data.

[0087] The bus 12 can be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus, etc. The bus 12 can be divided into an address bus, a data bus, a control bus, etc. The bus 12 is configured to realize the connection and communication between the memory 11 and at least one processor 10, etc.

[0088] Figure 3 Only electronic devices with components are shown; it will be understood by those skilled in the art that... Figure 3 The structure shown does not constitute a limitation on the electronic device 1, and may include fewer or more components than shown, or combine certain components, or have different component arrangements.

[0089] For example, although not shown, the electronic device 1 may also include a power supply (such as a battery) to power the various components. Preferably, the power supply can be logically connected to the at least one processor 10 through a power management device, thereby enabling functions such as charging management, discharging management, and power consumption management. The power supply may also include one or more DC or AC power supplies, recharging devices, power fault detection circuits, power converters or inverters, power status indicators, and other arbitrary components. The electronic device 1 may also include various sensors, Bluetooth modules, Wi-Fi modules, etc., which will not be described in detail here.

[0090] Furthermore, the electronic device 1 may also include a network interface. Optionally, the network interface may include a wired interface and / or a wireless interface (such as a Wi-Fi interface, a Bluetooth interface, etc.), which is typically used to establish communication connections between the electronic device 1 and other electronic devices.

[0091] Optionally, the electronic device 1 may further include a user interface, which may be a display, an input unit (such as a keyboard), and optionally, a standard wired interface or a wireless interface. Optionally, in some embodiments, the display may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, or an OLED (Organic Light-Emitting Diode) touchscreen, etc. The display may also be appropriately referred to as a screen or display unit, used to display information processed in the electronic device 1 and to display a visual user interface.

[0092] The multi-platform payment risk interception method program based on anomaly monitoring stored in the memory 11 of the electronic device 1 is a combination of multiple instructions. When run in the processor 10, it can achieve the following: Once the user equipment is identified, platform access detection is performed on the user equipment to obtain multiple platforms to be monitored; Perform the following operations on each of the multiple platforms to be monitored: Based on the user equipment and the platform to be monitored, the terminal type, action timestamp, terminal geographical longitude, terminal geographical latitude, terminal network address, encrypted operation object, and encrypted account information are identified. The platform's standard feature vector is determined based on terminal type, action timestamp, terminal geographical longitude, terminal geographical latitude, and terminal network address. The encrypted operation objects, encrypted account information, and platform standard feature vectors are summarized separately to obtain multiple encrypted operation objects, multiple encrypted account information, and multiple platform standard feature vectors; Based on multiple monitoring platforms, multiple encrypted operation objects, multiple encrypted account information, and multiple platform standard feature vectors, multiple abnormal features to be monitored were identified. Multiple comprehensive risk scores were identified based on multiple monitoring platforms and multiple abnormal features to be monitored. For each of the multiple comprehensive risk scores, perform the following operation: Compare the comprehensive risk score with the preset warning threshold. If the comprehensive risk score is less than or equal to the warning threshold, the comprehensive risk score will be used as the cross-platform collaborative risk score. If the overall risk score is greater than the warning threshold, a cross-platform collaborative risk score is confirmed based on the user device and multiple monitored platforms. By aggregating the cross-platform collaboration risk scores, multiple cross-platform collaboration risk scores are obtained. Multiple interception decisions were confirmed based on cross-platform collaborative risk scoring, thus completing the interception of payment risks across multiple platforms.

[0093] Specifically, the processor 10's implementation method for the above instructions can be found in [reference needed]. Figures 1 to 3 The descriptions of the relevant steps in the corresponding embodiments are not repeated here.

[0094] Furthermore, if the modules / units integrated in the electronic device 1 are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. The computer-readable storage medium can be volatile or non-volatile. For example, the computer-readable medium may include: any entity or device capable of carrying the computer program code, a recording medium, a USB flash drive, a portable hard drive, a magnetic disk, an optical disk, a computer memory, or a read-only memory (ROM).

[0095] The present invention also provides a computer-readable storage medium storing a computer program, which, when executed by a processor of an electronic device, can perform the following: Once the user equipment is identified, platform access detection is performed on the user equipment to obtain multiple platforms to be monitored; Perform the following operations on each of the multiple platforms to be monitored: Based on the user equipment and the platform to be monitored, the terminal type, action timestamp, terminal geographical longitude, terminal geographical latitude, terminal network address, encrypted operation object, and encrypted account information are identified. The platform's standard feature vector is determined based on terminal type, action timestamp, terminal geographical longitude, terminal geographical latitude, and terminal network address. The encrypted operation objects, encrypted account information, and platform standard feature vectors are summarized separately to obtain multiple encrypted operation objects, multiple encrypted account information, and multiple platform standard feature vectors; Based on multiple monitoring platforms, multiple encrypted operation objects, multiple encrypted account information, and multiple platform standard feature vectors, multiple abnormal features to be monitored were identified. Multiple comprehensive risk scores were identified based on multiple monitoring platforms and multiple abnormal features to be monitored. For each of the multiple comprehensive risk scores, perform the following operation: Compare the comprehensive risk score with the preset warning threshold. If the comprehensive risk score is less than or equal to the warning threshold, the comprehensive risk score will be used as the cross-platform collaborative risk score. If the overall risk score is greater than the warning threshold, a cross-platform collaborative risk score is confirmed based on the user device and multiple monitored platforms. By aggregating the cross-platform collaboration risk scores, multiple cross-platform collaboration risk scores are obtained. Multiple interception decisions were confirmed based on cross-platform collaborative risk scoring, thus completing the interception of payment risks across multiple platforms.

[0096] In the embodiments provided by this invention, it should be understood that the disclosed devices, systems, and methods can be implemented in other ways. For example, the system embodiments described above are merely illustrative, and actual implementations may have other classification methods.

[0097] The modules described as separate components may or may not be physically separate. The components shown as modules may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0098] Furthermore, the functional modules in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or in the form of hardware plus software functional modules.

[0099] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the present invention can be implemented in other specific forms without departing from the spirit or essential characteristics of the present invention.

[0100] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention.

Claims

1. A method for intercepting multi-platform payment risks based on anomaly monitoring, characterized in that, The method includes: Once the user equipment is identified, platform access detection is performed on the user equipment to obtain multiple platforms to be monitored; Perform the following operations on each of the multiple platforms to be monitored: Based on the user equipment and the platform to be monitored, the terminal type, action timestamp, terminal geographical longitude, terminal geographical latitude, terminal network address, encrypted operation object, and encrypted account information are identified. The platform's standard feature vector is determined based on terminal type, action timestamp, terminal geographical longitude, terminal geographical latitude, and terminal network address. The encrypted operation objects, encrypted account information, and platform standard feature vectors are summarized separately to obtain multiple encrypted operation objects, multiple encrypted account information, and multiple platform standard feature vectors; Based on multiple monitoring platforms, multiple encrypted operation objects, multiple encrypted account information, and multiple platform standard feature vectors, multiple abnormal features to be monitored were identified. Multiple comprehensive risk scores were identified based on multiple monitoring platforms and multiple abnormal features to be monitored. For each of the multiple comprehensive risk scores, perform the following operation: Compare the comprehensive risk score with the preset warning threshold. If the comprehensive risk score is less than or equal to the warning threshold, the comprehensive risk score will be used as the cross-platform collaborative risk score. If the overall risk score is greater than the warning threshold, a cross-platform collaborative risk score is confirmed based on the user device and multiple monitored platforms. By aggregating the cross-platform collaboration risk scores, multiple cross-platform collaboration risk scores are obtained. Multiple interception decisions were confirmed based on cross-platform collaborative risk scoring, thus completing the interception of payment risks across multiple platforms.

2. The multi-platform payment risk interception method based on anomaly monitoring as described in claim 1, characterized in that, The information obtained based on the user equipment and the platform to be monitored includes: terminal type, action timestamp, terminal geographical longitude, terminal geographical latitude, terminal network address, encrypted operation object, and encrypted account information. The user equipment type is confirmed to obtain the terminal type; Time data is collected from user equipment to obtain action timestamps; The location of the user equipment is obtained to get the terminal's geographical longitude and geographical latitude; Network signal monitoring is performed on user equipment to obtain the terminal network address; The operation target and account information were identified based on the user device and the platform to be monitored. The operation object and account information are encrypted to obtain encrypted operation object and encrypted account information.

3. The multi-platform payment risk interception method based on anomaly monitoring as described in claim 2, characterized in that, The process of encrypting the operation object and account information to obtain encrypted operation object and encrypted account information includes: The fields of the operation object are parsed to obtain multiple operation object fields; Standardize the fields of multiple operation objects to obtain multiple standard fields for operation objects; The account information is parsed to obtain multiple account information fields; Multiple account information fields are standardized to obtain multiple standard account information fields; The dynamic salt value was determined based on the platform to be monitored and the action timestamp. Perform the following operation on each of the standard fields of multiple operands: Calculate the hash value of the operation object based on its standard fields and dynamic salt value; Summarize the hash values ​​of the operation objects to obtain multiple hash values ​​of the operation objects; By fusing the hash values ​​of multiple operation objects, an encrypted operation object is obtained; Encrypted account information is identified based on multiple standard account information fields and dynamic salt values.

4. The multi-platform payment risk interception method based on anomaly monitoring as described in claim 3, characterized in that, The platform's standard feature vector, determined based on terminal type, action timestamp, terminal geographic longitude, terminal geographic latitude, and terminal network address, includes: Numerical mapping is performed on the terminal type to obtain the terminal type feature value; Periodically encode the action timestamps to obtain action time feature values; The terminal geographic longitude and terminal geographic latitude are normalized to obtain longitude feature values ​​and latitude feature values; The terminal network address is numerically processed to obtain network address feature values; The terminal type feature value, action time feature value, longitude feature value, latitude feature value and network address feature value are combined according to a preset feature order to obtain the platform feature vector; The platform feature vectors are standardized to obtain the platform standard feature vectors.

5. The multi-platform payment risk interception method based on anomaly monitoring as described in claim 4, characterized in that, The method identifies multiple abnormal features to be monitored based on multiple monitored platforms, multiple encrypted operation objects, multiple encrypted account information, and multiple platform standard feature vectors, including: Multiple platforms to be monitored are combined in pairs to obtain multiple platform combinations, wherein each platform combination includes: a first platform to be monitored and a second platform to be monitored; For each of the multiple platform combinations, perform the following operation: Based on the first monitoring platform, multiple encrypted operation objects, and multiple encrypted account information, the first encrypted operation object and the first encrypted account information were identified. Based on the second platform to be monitored, multiple encrypted operation objects, and multiple encrypted account information, the second encrypted operation object and the second encrypted account information were identified. The first encrypted operation object is compared with the second encrypted operation object to obtain the operation object identifier, wherein the operation object identifier is either an operation consistency identifier or an operation inconsistency identifier. The first encrypted account information is compared with the second encrypted account information to obtain the account information identifier, wherein the account information identifier is either an account consistency identifier or an account inconsistency identifier; The platform combination association identifier is determined based on the operation object identifier and account information identifier. The platform combination association identifier can be either an association identifier or a non-association identifier. By aggregating the platform combination association identifiers, multiple platform combination association identifiers are obtained; Multiple associated platform combinations were identified based on the association identifiers of multiple platform combinations. Each associated platform combination includes: a first associated platform and a second associated platform. For each of the multiple associated platform combinations, perform the following operation: Based on the first associated platform in the associated platform combination, the second associated platform in the associated platform combination, and the standard feature vectors of multiple platforms, the first associated vector and the second associated vector are identified; The first and second correlation vectors are concatenated to obtain the correlation feature vector; By summing the associated feature vectors, multiple associated feature vectors are obtained; For each of the multiple associated feature vectors, perform the following operation: The associated feature vectors are input into a pre-trained anomaly detection model to obtain the anomaly features to be monitored. By summarizing the abnormal features to be monitored, multiple abnormal features to be monitored are obtained.

6. The multi-platform payment risk interception method based on anomaly monitoring as described in claim 5, characterized in that, The method identifies multiple comprehensive risk scores based on multiple monitoring platforms and multiple abnormal features, including: Perform the following operations on each of the multiple platforms to be monitored: The target monitoring features were identified based on the platform to be monitored and multiple anomalies to be monitored. Obtain the set of historical abnormal features of the platform to be monitored; Based on the historical anomaly feature set and target monitoring features, the number of elements, the target baseline mean, and the target fluctuation range were identified. The target anomaly detection threshold is calculated based on the number of elements, the target baseline mean, and the target fluctuation amplitude. The calculation formula is as follows: ； in, Indicates the threshold for determining target anomalies. Indicates the target baseline mean. Indicates the target fluctuation range. This indicates the preset sensitivity adjustment coefficient. Indicates the number of elements. Represents the natural logarithm; By summing up the target anomaly detection thresholds, multiple target anomaly detection thresholds are obtained; For each of the multiple anomaly features to be monitored, perform the following operation: The abnormal features to be monitored are input into a pre-constructed abnormality scoring model to obtain abnormality sub-scores; Summarize the abnormal sub-scores to obtain multiple abnormal sub-scores; For each of the multiple outlier sub-scores, perform the following operation: Based on the anomaly sub-scores and multiple target anomaly determination thresholds, the corresponding determination thresholds are identified. The abnormal sub-scores are compared with the corresponding judgment thresholds to obtain the over-limit quantity; Calculate the weighted risk component based on the amount exceeding the limit; By summing the weighted risk components, multiple weighted risk quantities are obtained; A comprehensive risk score is determined based on multiple weighted risk quantities, where the comprehensive risk score is the sum of multiple weighted risk quantities.

7. The multi-platform payment risk interception method based on anomaly monitoring as described in claim 6, characterized in that, The cross-platform collaborative risk score, determined based on user equipment and multiple monitored platforms, includes: During the preset review period, platform access detection is performed on user devices to obtain multiple review platforms; Multiple verification platforms are matched with multiple monitoring platforms to obtain multiple target verification platforms; Perform the following operations for each of the multiple target review platforms: Multiple data collection times were identified based on the review period; Perform the following operation for each of the multiple acquisition times: Based on the user equipment, the target verification platform, and the time of data collection, the verification encryption operation object, the verification encryption account information, and the standard feature vector of the verification platform are identified. The verification and encryption operation objects, verification and encryption account information, and verification platform standard feature vectors are summarized separately to obtain multiple verification and encryption operation objects, multiple verification and encryption account information, and multiple verification platform standard feature vectors; Based on multiple verification and encryption operation objects, multiple verification and encryption account information, and multiple verification platform standard feature vectors, multiple verification anomalies were identified. Multiple comprehensive review risk scores were identified based on multiple target review platforms and multiple review anomaly characteristics. A cross-platform collaborative risk score was determined based on multiple reviews and comprehensive risk scores, as well as confirmations from multiple data collection points.

8. The multi-platform payment risk interception method based on anomaly monitoring as described in claim 7, characterized in that, The cross-platform collaborative risk score, confirmed based on multiple review and comprehensive risk scores and multiple data collection times, includes: For each of the multiple review comprehensive risk scores, perform the following operations: The target collection time was determined based on the comprehensive risk score and multiple collection times. Once the current time is determined, the time decay weight is calculated based on the target acquisition time and the current time. The review weighted score is calculated based on the review comprehensive risk score and the time decay weight, whereby the review weighted score is the product of the review comprehensive risk score and the time decay weight. The time decay weights and review weighted scores are summarized separately to obtain multiple time decay weights and multiple review weighted scores; The cross-platform collaboration risk score is calculated based on multiple review weighted scores and multiple time decay weights, as shown in the following formula: ； in, Indicates cross-platform collaborative risk scoring. Indicates the weighted score of multiple reviews. Each review weighted score, Represents the first of multiple time decay weights Each time decay weight, This indicates the number of weighted scores in a multi-review weighted score.

9. The multi-platform payment risk interception method based on anomaly monitoring as described in claim 8, characterized in that, The multiple interception decision results confirmed based on multiple cross-platform collaborative risk scores include: For each of the multiple cross-platform collaboration risk scores, perform the following operations: Compare the cross-platform collaboration risk score with the preset first threshold value. If the cross-platform collaboration risk score is less than the first threshold value, the preset release decision will be used as the interception decision result. If the cross-platform collaboration risk score is greater than or equal to the first threshold, then compare the cross-platform collaboration risk score with the preset second threshold. If the cross-platform collaboration risk score is less than or equal to the second threshold, then use the preset decision to perform secondary verification as the interception decision result. If the cross-platform collaboration risk score is greater than the second threshold, the preset interception decision will be used as the interception decision result. The interception decision results are aggregated to obtain multiple interception decision results.

10. A multi-platform payment risk interception system based on anomaly monitoring, characterized in that, The system includes: The encrypted information acquisition module is used to identify the user device, perform platform access detection on the user device, obtain multiple monitoring platforms, and perform the following operations on each of the multiple monitoring platforms: based on the user device and the monitoring platform, identify the terminal type, action timestamp, terminal geographical longitude, terminal geographical latitude, terminal network address, encrypted operation object, and encrypted account information. The abnormal feature monitoring module is used to identify the platform standard feature vector based on terminal type, action timestamp, terminal geographical longitude, terminal geographical latitude and terminal network address. It summarizes the encrypted operation object, encrypted account information and platform standard feature vector respectively to obtain multiple encrypted operation objects, multiple encrypted account information and multiple platform standard feature vectors. Based on multiple platforms to be monitored, multiple encrypted operation objects, multiple encrypted account information and multiple platform standard feature vectors, multiple abnormal features to be monitored are identified. The risk score calculation module is used to identify multiple comprehensive risk scores based on multiple monitoring platforms and multiple monitoring anomaly features. For each of the multiple comprehensive risk scores, the following operation is performed: the comprehensive risk score is compared with a preset warning threshold. If the comprehensive risk score is less than or equal to the warning threshold, the comprehensive risk score is used as a cross-platform collaborative risk score. The risk decision interception module is used to identify cross-platform collaborative risk scores based on user devices and multiple monitored platforms if the comprehensive risk score is greater than the warning threshold. It then summarizes the cross-platform collaborative risk scores to obtain multiple cross-platform collaborative risk scores, and identifies multiple interception decision results based on these multiple cross-platform risk scores to complete the interception of multi-platform payment risks.

Images