A platform transaction risk intelligent analysis method and system based on device logs

Abstract

The application discloses a kind of platform transaction risk intelligent analysis method and system based on equipment log, belong to transaction risk analysis technical field.The method includes: the transaction link node sequence of parsing equipment log data;Extract adjacent node time sequence correlation feature and construct directed acyclic graph structure;Collect each node transaction state parameter and normalize mapping is risk metric initial value;According to its determination risk propagation path and calculate each node risk cumulative amount;Mark cumulative amount threshold value node as risk node, according to its distribution density in graph determines global risk index;When global risk index exceeds early warning value, locate risk propagation path starting node, output its corresponding transaction link as risk source.The application realizes transaction link risk propagation path tracking and source positioning, improves risk investigation efficiency.

Description

Technical Field

[0001] This invention relates to the field of transaction risk analysis technology, specifically to a platform transaction risk intelligent analysis method and system based on device logs. Background Technology

[0002] Platform transaction systems typically employ a microservice architecture, where transaction requests require collaborative processing across multiple device nodes. For example, the API gateway handles request routing, the order service executes order placement logic, the payment gateway connects to third-party channels, the inventory service verifies product availability, and the message queue asynchronously pushes notifications. Device logs record the timestamp, device identifier, and processing status of each node, forming a complete call chain. Existing transaction risk analysis methods primarily rely on anomaly detection for single devices or individual transaction stages. For instance, fixed thresholds are set for response latency, request queue depth, or error count, triggering alarms when a node's metrics exceed these limits. This approach ignores the cascading effect of transaction requests propagating and amplifying along the call chain. For example, when the payment gateway experiences increased response latency due to network jitter, the upstream order service may accumulate requests due to timeouts, leading to a surge in the API gateway's queue depth and ultimately causing front-end timeouts.

[0003] Traditional methods can only detect anomalies in isolated nodes, failing to capture the dynamic process of risk propagation along the call chain and distinguish whether the true source of risk is the affected downstream node or the initial upstream node. Furthermore, while device logs contain access order and frequency relationships between nodes, existing log analysis methods fail to organize this temporal information into a structured graph model, such as a directed acyclic graph (DAG), to support propagation calculations. After identifying multiple anomalous nodes, the lack of a quantitative mechanism to measure the accumulation and global diffusion density of risk in the transaction chain topology leads to maintenance personnel spending significant time on manual investigation, resulting in a persistently high mean time to repair (MTTR). How to utilize the implicit temporal relationships in device logs to construct a directed topology representing transaction behavior, and based on this topology, perform path-based cumulative calculations and source tracing of risks, is a critical problem urgently needing to be solved in intelligent transaction risk analysis. Summary of the Invention

[0004] This invention provides a platform transaction risk intelligent analysis method and system based on device logs, aiming to solve the problems of existing technologies being unable to characterize the cross-device propagation and accumulation of risks in the transaction chain and unable to automatically locate the source of risks.

[0005] To achieve the above objectives, the present invention provides the following technical solution: The present invention provides a platform transaction risk intelligent analysis method based on device logs, comprising: acquiring device log data of the platform transaction system, parsing the device log data to obtain a transaction link node sequence; extracting temporal correlation features between adjacent nodes based on the transaction link node sequence, and constructing a directed acyclic graph structure of transaction behavior based on the temporal correlation features; collecting transaction status parameters of each node in the directed acyclic graph structure, and normalizing and mapping the transaction status parameters to obtain an initial value for risk measurement; determining the risk propagation path in the directed acyclic graph structure based on the initial value for risk measurement, and calculating the risk accumulation of each node along the risk propagation path; marking nodes whose risk accumulation exceeds a preset risk bearing threshold as risk nodes, and determining the global risk index of platform transactions based on the distribution density of all risk nodes in the directed acyclic graph structure; when the global risk index is greater than the warning trigger value, locating the starting node of the risk propagation path, and outputting the transaction link corresponding to the starting node as the risk source. This method reconstructs the directed acyclic graph of the transaction chain from device logs and quantifies the cumulative effect of risks along the propagation path. It can accurately locate the weak links in the transaction chain that cause systemic risks, thereby improving the accuracy of platform transaction risk identification and traceability efficiency.

[0006] As a technical solution of this invention, the process of obtaining device log data from a platform transaction system and parsing the device log data to obtain a transaction link node sequence includes: grouping the device log data according to the transaction serial number, and grouping all log records corresponding to the same transaction serial number into the same transaction instance; for each transaction instance, extracting the timestamp and device identifier from the log records, sorting the device identifiers according to the order of the timestamps, and arranging the sorted device identifiers sequentially to form the transaction link node sequence of that transaction instance. This solution utilizes the transaction serial number to realize the instantiation and reconstruction of log data, restoring the device-level flow path of the transaction in timestamp order, and providing an accurate node sequence foundation for subsequent graph structure construction.

[0007] As a technical solution of this invention, the process of extracting the temporal correlation features between adjacent nodes based on the transaction link node sequence and constructing a directed acyclic graph structure includes: traversing all adjacent node pairs in the transaction link node sequence and counting the frequency of each adjacent node pair in all transaction instances; using device identifiers as vertices and adjacent node pairs with frequencies greater than a frequency threshold as directed edges, the direction of the directed edges being determined according to the order of the adjacent node pairs in the transaction link node sequence; and constructing a directed acyclic graph structure based on the pointing relationships of the directed edges. This solution eliminates occasional device call relationships through frequency filtering, retains the topology with stable temporal dependencies in the transaction link, and makes the constructed directed acyclic graph more accurately reflect the inherent propagation logic of transaction behavior.

[0008] As a technical solution of this invention, the process of collecting and normalizing the transaction state parameters of each node in a directed acyclic graph (DAG) structure includes: determining the device corresponding to each vertex in the DAG structure; collecting the response latency parameter, request queue depth parameter, and error count parameter of the device during the transaction process; mapping the response latency parameter, request queue depth parameter, and error count parameter to a unified numerical range to obtain three mapping components; and performing a weighted summation of the three mapping components to obtain the initial risk metric value corresponding to the vertex. This solution integrates multiple observable state indicators to construct the initial risk metric value, comprehensively reflecting the instantaneous risk level of the device node and providing a reliable initial input for subsequent propagation and accumulation.

[0009] As a technical solution of the present invention, the process of determining the risk propagation path and calculating the risk accumulation of each node based on the initial value of the risk metric includes: starting from each vertex with an in-degree of zero in the directed acyclic graph structure, traversing all reachable vertices along the direction of the directed edges, and taking the sequence of directed edges traversed in each traversal as a candidate propagation path; for each candidate propagation path, accumulating the initial value of the risk metric of each vertex on the path in the traversal order, and taking the accumulated result as the path risk accumulation of that vertex under the current propagation path after each vertex is traversed; when a vertex exists in multiple candidate propagation paths, selecting the maximum value of the path risk accumulation of that vertex under all candidate propagation paths as the risk accumulation of that vertex. This solution simulates the physical process of risk propagation and amplification along the transaction link, conservatively estimating the true risk-bearing state of each node based on the principle of maximum accumulation, and avoiding the underestimation of risk caused by path diversion.

[0010] Preferably, the traversal process starting from each vertex with an in-degree of zero includes: obtaining all vertices with an in-degree of zero in the directed acyclic graph structure, and assigning an independent traversal thread to each vertex with an in-degree of zero; each traversal thread starts from the corresponding vertex with an in-degree of zero and traverses downwards along the directed edges using a depth-first strategy, recording the sequence of directed edges traversed at each vertex reached; when a vertex with an out-degree of zero is reached, the traversal of the current thread is terminated, and the recorded sequence of directed edges is output as a candidate propagation path. This scheme uses concurrent depth-first traversal to achieve exhaustive search of all paths, ensuring that every complete propagation path in the acyclic graph is effectively captured.

[0011] Preferably, in the calculation of path risk accumulation, the path accumulation variable is initialized with the initial risk metric value of the first vertex on the path; each time the path moves along a directed edge to the next vertex, the initial risk metric value of the current vertex is added to the path accumulation variable, and the sum is used to update the path accumulation variable; the updated path accumulation variable is assigned to the current vertex as the path risk accumulation of that vertex under the current propagation path. This scheme realizes the step-by-step superposition of risk along the directed edges, truly reflecting the transmission impact of upstream risk on downstream nodes.

[0012] As a technical solution of this invention, the process of determining the global risk index based on the distribution density of risk nodes includes: marking vertices in the directed acyclic graph structure whose cumulative risk exceeds a preset risk carrying threshold as risk vertices, and counting the total number of risk vertices; calculating the shortest path lengths between all pairs of vertices in the directed acyclic graph structure, and selecting the maximum value as the graph diameter; and normalizing the number of all risk vertices using the graph diameter as a normalization benchmark to obtain the global risk index. This solution, by associating the scale of risk nodes with the maximum span of the graph structure and using the graph diameter as a benchmark, eliminates the measurement scale differences caused by different transaction link scales, making the global risk index comparable across scenarios.

[0013] As a technical solution of this invention, the process of locating the risk source after the global risk index triggers an early warning includes: comparing the global risk index with the early warning trigger value; if the global risk index is greater than the early warning trigger value, then selecting all risk vertices whose cumulative risk exceeds a preset risk tolerance threshold; tracing back from each risk vertex along the reverse direction of the directed edge to the starting vertex with an in-degree of zero; counting the number of times each starting vertex is traced, and using the starting vertex with the most traces as the starting node of the risk propagation path; and outputting the device identifier and transaction link corresponding to the starting node as the risk source. This solution utilizes reverse tracing statistics to anchor the entry node that has a common triggering effect on multiple downstream risk nodes, using the tracing frequency as the basis for source confirmation, thereby improving the reliability and accuracy of risk root cause analysis.

[0014] This invention also provides a platform transaction risk intelligent analysis system based on device logs, including a memory, a processor, and a computer program stored in the memory and running on the processor. When the processor executes the computer program, it implements the steps of the aforementioned platform transaction risk intelligent analysis method based on device logs. This system embeds the above analysis method into an executable environment in program form, enabling automated end-to-end risk intelligent analysis and source tracing of platform transaction device logs.

[0015] The technical effects and advantages provided by the present invention in the above technical solution are as follows: By parsing device log data, complete device access records for the same transaction instance are obtained by grouping them by transaction serial number. These records are then sorted using timestamps and device identifiers to form a sequence of transaction link nodes. The frequency of adjacent node pairs in all transaction instances is traversed, and adjacent node pairs with frequencies exceeding a threshold are designated as directed edges, with device identifiers as vertices. The direction of the edges is determined by the order of the nodes in the sequence, thus constructing a directed acyclic graph (DAG). This graph structure transforms scattered log records into a topological representation of transaction behavior, clearly reflecting the actual flow path and dependencies of transaction requests between devices, providing a structured computational basis for analyzing the propagation of risks along the link.

[0016] After obtaining the directed acyclic graph (DAG), starting from each vertex with an in-degree of zero, the system traverses along the direction of the directed edges to vertices with an out-degree of zero, using the sequence of directed edges traversed during the traversal as candidate propagation paths. Transaction state parameters such as response latency, request queue depth, and error count are collected for each node. These parameters are normalized and weighted to obtain an initial risk metric for each node. The initial risk metric values ​​of each node are sequentially accumulated along the candidate propagation paths. When a node exists on multiple candidate propagation paths, the maximum value of the accumulated values ​​across all paths is taken as the node's accumulated risk. This method simulates the real process of risk transmission and accumulation from upstream to downstream devices, quantifying the cascading amplification effect of risk and accurately measuring the overall risk impact on each node. Nodes with accumulated risk exceeding a preset risk-bearing threshold are marked as risk nodes. The number of risk nodes is normalized using the diameter of the DAG to obtain a global risk index, which reflects the diffusion density of risk in the transaction link topology. When the global risk index exceeds the warning trigger value, the system traces back from each risk node along the directed edges to the starting vertex with an in-degree of zero. The number of times each starting vertex is traced is counted, and the device identifier and transaction link corresponding to the starting node with the most traces are output as the source of the risk. This reverse tracing mechanism utilizes the unidirectional dependency characteristic of directed acyclic graphs, eliminating interference from affected nodes and directly locating the initial device or transaction link that triggered the accumulation of link-level risks, thereby improving the automation and accuracy of risk root cause analysis. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this invention. For those skilled in the art, other drawings can be obtained based on these drawings.

[0018] Figure 1 This is a flowchart of intelligent analysis of platform transaction risks based on device logs; Figure 2 This is a flowchart of the global risk index calculation and risk source identification process; Figure 3 This is a graph showing the distribution of node sequence lengths and kernel density estimation in the transaction link. Figure 4 This is a schematic diagram of the ranking of vertex risk accumulation and the preset risk carrying threshold in a directed acyclic graph structure.

[0019] Figure 5 It is a cumulative percentile curve of the frequency of adjacent nodes; Figure 6 This is a chart assessing the platform's overall risk index. Detailed Implementation

[0020] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0021] See Figure 1 This invention provides a platform transaction risk intelligent analysis method based on device logs, comprising: acquiring device log data of the platform transaction system, parsing the device log data to obtain a transaction link node sequence; extracting temporal correlation features between adjacent nodes according to the transaction link node sequence, and constructing a directed acyclic graph structure of transaction behavior based on the temporal correlation features; collecting transaction status parameters of each node in the directed acyclic graph structure, and normalizing and mapping the transaction status parameters to obtain an initial value for risk measurement; determining the risk propagation path in the directed acyclic graph structure according to the initial value for risk measurement, and calculating the risk accumulation of each node along the risk propagation path; marking nodes whose risk accumulation exceeds a preset risk bearing threshold as risk nodes, and determining the global risk index of platform transactions according to the distribution density of all risk nodes in the directed acyclic graph structure; when the global risk index is greater than the warning trigger value, locating the starting node of the risk propagation path, and outputting the transaction link corresponding to the starting node as the risk source.

[0022] Example 1

[0023] In this embodiment, the device log data of the platform transaction system is obtained by collecting raw log records from multiple transaction processing devices involved in the platform transaction system. Each raw log record contains at least one transaction serial number field, one timestamp field, and one device identifier field. The transaction serial number field is used to uniquely identify a complete platform transaction process, the timestamp field records the system time when the log was generated, and the device identifier field records the unique identifier of the device that generated the log.

[0024] After acquiring the device log data, it is parsed to generate a transaction chain node sequence. The parsing process involves: traversing all raw log records, extracting the value of the transaction serial number field from each raw log record, and grouping all raw log records with the same transaction serial number field value into the same transaction instance. Thus, based on the different transaction serial number field values, the device log data is divided into multiple transaction instances, each corresponding to a complete platform transaction.

[0025] For each transaction instance, the timestamp and device identifier values ​​are extracted from all raw log records contained within that instance. Based on the extracted timestamp values, the extracted device identifier values ​​are sorted in ascending order of their timestamp values. Raw log records with smaller timestamp values ​​have their corresponding device identifier values ​​listed first in the sorted results; raw log records with larger timestamp values ​​have their corresponding device identifier values ​​listed later. These sorted device identifier values ​​are then arranged into a sequence, which constitutes the transaction link node sequence for that transaction instance. Each node in the transaction link node sequence corresponds to a device identifier value, and the order of the nodes reflects the processing flow sequence across different devices during a platform transaction.

[0026] See Figure 3 The bar chart in the figure shows the distribution of transaction link node sequence lengths among multiple acquired transaction instances. The horizontal axis represents the transaction link node sequence length (number of nodes), and the vertical axis represents the number of transaction instances of the corresponding length. The bar chart shows that the transaction link node sequence length is mainly concentrated in the range of 11 to 24 nodes. The number of nodes in this range first increases and then decreases, with the peak occurring at a length of 16 to 18 nodes. The highest number of single-point transaction instances exceeds 100, indicating that the number of device processing nodes involved in most platform transactions falls within this range.

[0027] The graph shows the corresponding kernel density estimation curve, with the vertical axis corresponding to the probability density value on the right. The probability density curve exhibits a single-peak shape, with the peak value located in the range of 16 to 18 nodes. The highest kernel density value is approximately 0.10, reflecting a relatively high frequency of transaction instances within this node length range. The number of transaction instances corresponding to transaction link lengths of less than 10 nodes on the left and more than 25 nodes on the right decreases significantly, with the probability density approaching zero, indicating that extremely short or extremely long node sequences are relatively rare.

[0028] Example 2

[0029] In practice, the transaction link node sequence corresponding to each of the multiple transaction instances is obtained. Each transaction link node sequence consists of multiple device identifiers arranged in chronological order of timestamps.

[0030] Iterate through each transaction link node sequence in the entire transaction link node sequence. For the currently traversed transaction link node sequence, starting from the first device identifier, extract two adjacent device identifiers to form an adjacent node pair. An adjacent node pair consists of a preceding device identifier and a following device identifier, with the preceding device identifier appearing before the following device identifier in the transaction link node sequence. Record this adjacent node pair and increment its occurrence count by one.

[0031] It is understandable that during the traversal, if the same pair of adjacent nodes appears multiple times in the same transaction link node sequence, the occurrence count is incremented each time it appears. After traversing all transaction link node sequences, we obtain each pair of adjacent nodes and its total frequency of occurrence in all transaction instances.

[0032] In some embodiments, the frequency threshold is determined as follows: the distribution of the frequency of all adjacent node pairs is statistically analyzed, the frequencies are arranged in descending order, the cumulative percentile is calculated, and the minimum frequency value that makes the cumulative percentile reach the preset percentile threshold is selected as the frequency threshold. The specific value of the preset percentile threshold is determined based on the analysis of the proportion of abnormal transaction paths in historical data. For example, the preset percentile threshold is set to 90.

[0033] In practice, all device identifiers appearing in the transaction link node sequence are used as the vertex set of the graph. All adjacent node pairs obtained through statistical analysis are traversed. For each adjacent node pair, if the total frequency of its occurrence is greater than a frequency threshold, then the adjacent node pair is considered a candidate directed edge. The direction of the candidate directed edge is determined according to the order of the adjacent node pairs in the transaction link node sequence: from the vertex corresponding to the preceding device identifier to the vertex corresponding to the following device identifier.

[0034] Before adding a candidate directed edge, it is checked whether adding the candidate directed edge would create a directed cycle in the currently constructed graph structure. The method for detecting directed cycles is as follows: starting from the vertex corresponding to the next device identifier pointed to by the candidate directed edge, a depth-first traversal is performed along the existing directed edges. If the vertex corresponding to the previous device identifier from which the candidate directed edge originates can be reached, it means that adding the candidate directed edge would create a directed cycle, and in this case, the candidate directed edge is not added to the graph structure. If it cannot be reached, the candidate directed edge is added as a directed edge.

[0035] After performing the above processing on all adjacent node pairs with frequencies greater than the frequency threshold, the resulting graph structure contains no directed loops, forming a directed acyclic graph (DAG) structure. Each vertex in the DAG structure corresponds to a device identifier, and each directed edge reflects the high-frequency flow relationship between two device identifiers during the transaction processing, with the direction of the directed edge pointing to the downstream device in the transaction processing flow.

[0036] See Figure 5 In the graph, the horizontal axis represents the sequence number of adjacent node pairs. All adjacent node pairs involved in device flow are sorted in descending order based on their total frequency of occurrence in the full transaction log. The vertical axis represents the cumulative percentage (%). Starting from the highest frequency node pair, the total frequency of all flow links is accumulated sequentially, and then divided by the total frequency of all node pairs to obtain the cumulative traffic percentage, visually demonstrating the scale of the overall transaction traffic currently covered by the included links. The purple-red dotted line is a monotonically rising line, consistent with the Pareto distribution characteristics of transaction traffic; each dot on the curve corresponds to the cumulative traffic contribution of a set of device flow node pairs. The starting point of the curve (number 0) is the platform's highest frequency device flow link, and a single link can carry about 13% of the overall transaction traffic, which is the core business flow channel of the platform; the intersection of the red vertical lines (number 9) is where the cumulative traffic reaches exactly 90%, which is the traffic layering boundary point, and the frequency of the flow pair corresponding to this number is 84, which is the filtering threshold; in the interval after number 9 (9, 10, 11), the low-frequency node pairs at the tail contribute less than 10% of the transaction traffic in total, which are mostly test and occasional abnormal flows, which are noise data and are not included in the DAG modeling scope.

[0037] Example 3

[0038] In practice, the directed acyclic graph (DAG) structure contains multiple vertices, each corresponding to a device identifier. The device identifier corresponding to each vertex in the DAG structure is determined, and for each device identifier, real-time status data generated by that device during transaction processing is collected. The collected status data specifically includes response latency parameters, request queue depth parameters, and error count parameters.

[0039] The response latency parameter indicates the time elapsed from when the device receives a transaction processing request to when it returns a processing response, in milliseconds. The request queue depth parameter indicates the number of transaction requests waiting to be processed in the device at the time of data collection. The error count parameter indicates the cumulative number of errors that occurred when the device processed transaction requests within a preset statistical period, which is set to one minute.

[0040] For each device corresponding to a vertex, after collecting the response latency parameter, request queue depth parameter, and error count parameter, the three parameters are mapped to a unified numerical range to eliminate the influence of differences in the units of different parameters. The unified numerical range is set to [0, 1].

[0041] In specific implementation, the mapping method for response delay parameters is as follows: obtain the maximum and minimum values ​​of historical response delay parameters of all devices of the same type within a preset historical time period, and use the minimum-maximum normalization method to map the currently collected response delay parameters to the interval [0, 1]. The mapped values ​​are used as response delay mapping components.

[0042] The mapping method for the request queue depth parameter is as follows: obtain the maximum and minimum values ​​of the historical request queue depth parameters of all devices of the same type within a preset historical time period, and use the minimum-maximum normalization method to map the currently collected request queue depth parameter to the interval [0, 1]. The mapped value is used as the request queue depth mapping component.

[0043] The error count parameter mapping method is as follows: obtain the maximum and minimum values ​​of the historical error count parameters of all devices of the same type within a preset historical time period, and use the minimum-maximum normalization method to map the currently collected error count parameter to the interval [0, 1]. The mapped value is used as the error count mapping component.

[0044] After mapping is complete, each vertex corresponds to a device that receives three mapping components: response latency, request queue depth, and error count. The three mapping components are then weighted and summed to obtain the initial risk metric for that vertex. The weighted sum is calculated using the following formula: ;

[0045] in, This represents the initial value of the risk metric corresponding to a vertex. This represents the response delay mapping component corresponding to that vertex. This indicates the request queue depth mapping component corresponding to that vertex. This represents the error count mapping component corresponding to that vertex. For response delay weighting coefficient, The weighting factor for the request queue depth. This is the error count weighting factor.

[0046] Response delay weighting factor The value range is [0, 1], and the request queue depth weighting coefficient is... The value range is [0, 1], and the error count weighting coefficient is... The value range of is [0, 1], and satisfies The specific values ​​of the three weighting coefficients are determined by analyzing the correlation strength between each parameter in the historical risk event sample and the final occurrence of the risk. The determination method is as follows: obtain a historical transaction sample set with labeled risk results, calculate the Pearson correlation coefficients between the response latency parameter, request queue depth parameter, and error count parameter and the risk label, respectively, normalize the absolute values ​​of the three Pearson correlation coefficients, and use the three normalized values ​​as the response latency weighting coefficients. Request queue depth weighting coefficient Error count weighting factor The value of .

[0047] See Figure 6 The horizontal axis represents the total number of risk vertices, and the vertical axis represents the global risk index, quantifying the overall risk level of the platform. The three curves represent three different topological scales of directed acyclic graphs (DAGs): the blue curve represents a graph diameter of 3 (short transaction links with fewer device transfer stages), the orange curve represents a graph diameter of 5 (medium-length transaction links), and the green curve represents a graph diameter of 7 (long links, involving multiple devices and long transaction processes). All three curves are directly proportional lines passing through the origin: the more risk vertices there are, the more linearly the global risk index increases. This intuitively demonstrates that the more faulty risk nodes there are, the higher the overall transaction risk of the platform. With the same number of risky nodes, a smaller graph diameter results in a significantly higher global risk index. Short-link topologies are most sensitive to risky nodes; even a small number of faulty devices can quickly increase the global risk. Long-link topologies have more dispersed risk, resulting in lower overall risk from the same number of faulty nodes.

[0048] Example 4

[0049] In the specific implementation, the in-degree information of all vertices in the constructed directed acyclic graph (DAG) structure is obtained. The in-degree value of each vertex in the DAG structure is counted, and all vertices with an in-degree value of zero are grouped into a starting vertex set. An independent traversal thread is allocated to each starting vertex in the starting vertex set.

[0050] Each traversal thread begins its depth-first traversal from its assigned starting vertex. Each traversal thread maintains an edge sequence list, which records the sequence of directed edges traversed from the starting vertex to the current vertex. Starting from the starting vertex, the traversal thread examines all outgoing edges from the starting vertex. For each outgoing edge from the starting vertex, the traversal thread adds it to the edge sequence list and proceeds along the direction of that outgoing edge to the next vertex. If the reached vertex has an out-degree of zero, the traversal thread outputs all directed edges recorded in the current edge sequence list as a single directed edge sequence, which serves as a candidate propagation path. If the reached vertex has a non-zero outgoing degree, the traversal thread continues to examine all outgoing edges from that vertex, repeatedly adding the outgoing edge to the edge sequence list, proceeding along the outgoing edge direction, and removing the outgoing edge from the edge sequence list upon return, recursively traversing all possible branches. After reaching a vertex with an outgoing degree of zero and outputting a candidate propagation path, the traversal thread backtracks to the previous vertex and continues exploring untraversed outgoing edges. Using the depth-first strategy described above, all possible directed edge sequences originating from the same starting vertex are exhaustively enumerated, and each directed edge sequence corresponds to a candidate propagation path. After all independent traversal threads have completed their execution, a set of all candidate propagation paths is obtained.

[0051] For each candidate propagation path obtained, obtain the vertex sequence contained in the candidate propagation path. The first vertex in the vertex sequence is the starting vertex corresponding to the candidate propagation path, the second vertex is the vertex reached along the first directed edge, and so on, with the last vertex being the ending vertex with an out-degree of zero. Obtain the initial risk metric value corresponding to each vertex in the vertex sequence.

[0052] The method for calculating the path risk accumulation of each vertex on the candidate propagation path is as follows: A path accumulation variable is defined, and its initial value is set to the initial risk metric of the first vertex in the vertex sequence. This initial risk metric is then directly used as the path risk accumulation of the first vertex on the candidate propagation path. Starting from the second vertex in the vertex sequence, the initial risk metric of the currently processed vertex is sequentially added to the path accumulation variable after the previous vertex's update. The sum is used to update the path accumulation variable, and the updated value is assigned to the current vertex as its path risk accumulation on the candidate propagation path. This accumulation and assignment operation is continued until the last vertex in the vertex sequence has been processed.

[0053] After performing the above calculations for each candidate propagation path, the same vertex in the directed acyclic graph structure may exist in multiple candidate propagation paths, thus having multiple path risk accumulations. For each vertex in the directed acyclic graph structure, the path risk accumulation corresponding to that vertex under all candidate propagation paths containing that vertex is collected. The maximum value is selected from all collected path risk accumulations as the risk accumulation of that vertex. The operation of selecting the maximum value is expressed by the following formula:

[0054] in, Represents a vertex in a directed acyclic graph structure. Indicates passing through vertices, The set of all candidate propagation paths, Represents a set One of the candidate propagation paths, Indicating in candidate propagation paths The vertices obtained from the following calculations The cumulative amount of path risk, This represents the function that takes the maximum value. Represents vertices The final determined cumulative risk amount. The cumulative risk amount for each vertex in the directed acyclic graph structure is obtained through the above method.

[0055] See Figure 4 In the graph, the horizontal axis represents the vertex number in the directed acyclic graph structure, with vertices sorted from highest to lowest risk accumulation. The vertical axis represents the risk accumulation of the corresponding vertex. The curve shows the trend of risk accumulation as the vertex's ranking position changes, exhibiting a monotonically decreasing trend overall. Starting from the left, there are fewer vertices with high risk accumulation, and the highest risk accumulation exceeds 80, significantly higher than the preset risk tolerance threshold of approximately 45, indicated by the dashed line in the graph. As the vertex number increases, the risk accumulation gradually decreases, first falling below the preset risk tolerance threshold at vertex number approximately 50, and then continuing to decrease gradually until approaching zero.

[0056] The preset risk tolerance threshold is represented by an orange dashed line, with its ordinate fixed at 45, serving as the safe boundary value for risk accumulation. Vertices on the risk accumulation curve above this threshold are identified as risk vertices. As shown in the figure, approximately 50 vertices on the left side have risk accumulation exceeding this threshold, indicating that these vertices are marked as risk vertices.

[0057] Example 5

[0058] In specific implementation, please refer to Figure 2The method involves calculating the cumulative risk for each vertex in a directed acyclic graph (DAG). This cumulative risk is then compared to a preset risk tolerance threshold. The preset risk tolerance threshold is determined based on a statistical analysis of the cumulative risk of all vertices during historical normal trading periods, serving as a safety boundary value. The sample set of cumulative risk values ​​collected during historical normal trading periods is sorted, and the value at the 95th percentile is selected as the preset risk tolerance threshold.

[0059] In practice, if the cumulative risk of a vertex exceeds a preset risk tolerance threshold, the vertex is marked as a risk vertex. After traversing all vertices in the directed acyclic graph structure and performing the above comparison and marking operations, the total number of vertices marked as risk vertices is counted to obtain the total number of risk vertices.

[0060] In practice, the shortest path length between all pairs of vertices in the directed acyclic graph (DAG) structure is calculated. For any two distinct vertices in the DAG, a breadth-first search algorithm is used to determine the shortest path length from one vertex to the other. The shortest path length is defined as the minimum number of directed edges traversed from one vertex to the other. After calculating the shortest path length for all possible vertex pairs in the DAG, the maximum value among all calculated shortest path lengths is selected as the graph diameter.

[0061] In some embodiments, when the directed acyclic graph structure is not connected, for two vertices that cannot be reached from each other by directed edges, the shortest path length between the two vertices is set to the total number of vertices in the directed acyclic graph structure to reflect the overall dispersion of the graph structure.

[0062] Using the calculated graph diameter as the normalization benchmark, the total number of risk vertices is normalized to obtain the global risk index. The global risk index is calculated using the following formula: ;

[0063] in, This represents the overall risk index, measured in units of "number / item". This represents the total number of vertices marked as risk vertices. The graph diameter represents the structure of a directed acyclic graph. The unit is consistent with the path length unit in the directed acyclic graph structure, representing the number of directed edges and the total number of risk vertices. The unit is "unit". Global Risk Index It reflects the degree of clustering of risk vertices along the unit graph diameter.

[0064] In practice, an early warning trigger value is obtained. The trigger value is determined by statistically analyzing the global risk index calculated over multiple historical trading periods to establish an alarm threshold. The global risk index for each day within multiple consecutive historical trading periods is sorted in descending order, and the value at the 90th percentile of the sorted results is selected as the early warning trigger value.

[0065] Compare global risk index The magnitude of the warning trigger value. If the global risk index... If the value exceeds the warning trigger threshold, it is determined that there is a global risk in the current platform's transactions, triggering the risk source identification process. If the global risk index... If the risk level is less than or equal to the warning trigger value, the transaction risk on the platform is considered to be within a controllable range.

[0066] After triggering the risk source localization process, all risk vertices are selected from all marked risk vertices. Each selected risk vertex must satisfy the condition that its accumulated risk exceeds a preset risk tolerance threshold. For each selected risk vertex, tracing is performed in the reverse direction of the directed edges in the directed acyclic graph structure. The tracing method is as follows: starting from the current risk vertex, move backward along the reverse direction of the directed edge pointing to the current risk vertex to the predecessor vertex, and then continue tracing backward from that predecessor vertex until a vertex with an in-degree of zero is reached. This vertex with an in-degree of zero is recorded as a starting vertex corresponding to the current risk vertex.

[0067] After completing the reverse tracing of all risk vertices, count the number of times each starting vertex is traced. The starting vertex with the most traced occurrences is taken as the starting node of this risk propagation path. If multiple starting vertices have the same number of traced occurrences, and all of them are the maximum value, then all of these starting vertices are taken as the starting nodes of the risk propagation path.

[0068] The device identifier corresponding to the final determined starting node, along with the transaction stage in the transaction process represented by that device identifier, will be output as the risk source. The transaction stage is determined by querying the device configuration information of the platform's transaction system, obtaining the name of the processing function module undertaken by the device identifier corresponding to the starting node in the transaction chain, and outputting the name of that processing function module as the transaction stage.

[0069] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application.

Claims

1. A platform transaction risk intelligent analysis method based on device logs, characterized in that, include: Obtain device log data from the platform's transaction system, and parse the device log data to obtain a transaction link node sequence; Based on the transaction link node sequence, extract the temporal correlation features between adjacent nodes, and construct a directed acyclic graph structure of transaction behavior based on the temporal correlation features; The transaction state parameters of each node in the directed acyclic graph structure are collected, and the transaction state parameters are normalized and mapped to obtain the initial value of the risk measurement. Based on the initial value of the risk metric, determine the risk propagation path in the directed acyclic graph structure, and calculate the risk accumulation of each node along the risk propagation path; Nodes whose accumulated risk exceeds a preset risk tolerance threshold are marked as risk nodes, and the global risk index of platform transactions is determined based on the distribution density of all risk nodes in the directed acyclic graph structure. When the global risk index is greater than the warning trigger value, the starting node of the risk propagation path is located, and the transaction link corresponding to the starting node is output as the source of risk.

2. The intelligent analysis method for platform transaction risk based on device logs according to claim 1, characterized in that, The process of obtaining device log data from the platform's transaction system and parsing the device log data to obtain the transaction link node sequence specifically involves: The device log data is grouped according to the transaction serial number, and all log records corresponding to the same transaction serial number are grouped into the same transaction instance; For each transaction instance, the timestamp and device identifier are extracted from the log records. The device identifiers are sorted according to the order of the timestamps, and the sorted device identifiers are arranged in sequence to form the transaction link node sequence of the transaction instance.

3. The intelligent analysis method for platform transaction risk based on device logs according to claim 1, characterized in that, The step of extracting temporal correlation features between adjacent nodes based on the transaction link node sequence, and constructing a directed acyclic graph structure of transaction behavior based on the temporal correlation features, specifically involves: Traverse all adjacent node pairs in the transaction link node sequence and count the frequency of each adjacent node pair in all transaction instances. Using the device identifier as a vertex, and the adjacent node pairs with frequencies greater than a frequency threshold as directed edges, the direction of the directed edges is determined according to the order of the adjacent node pairs in the transaction link node sequence; The directed acyclic graph structure is constructed based on the pointing relationships of the directed edges.

4. The intelligent analysis method for platform transaction risk based on device logs according to claim 1, characterized in that, The process involves collecting the transaction state parameters of each node in the directed acyclic graph structure, and then normalizing and mapping these parameters to obtain initial values ​​for the risk metric. Specifically: Identify the device corresponding to each vertex in the directed acyclic graph structure, and collect the response latency parameter, request queue depth parameter, and error count parameter of the device during the transaction process; The response latency parameter, the request queue depth parameter, and the error count parameter are each mapped to a unified numerical range to obtain three mapping components; The three mapping components are weighted and summed to obtain the initial value of the risk metric corresponding to the vertex.

5. The intelligent analysis method for platform transaction risk based on device logs according to claim 1, characterized in that, The step of determining the risk propagation path in the directed acyclic graph structure based on the initial value of the risk metric, and calculating the cumulative risk of each node along the risk propagation path, specifically involves: Starting from each vertex with an in-degree of zero in the directed acyclic graph structure, traverse all reachable vertices along the direction of the directed edges, and treat the sequence of directed edges traversed in each traversal as a candidate propagation path; For each candidate propagation path, the initial risk metric of each vertex on the path is accumulated in traversal order, and the accumulated result is used as the cumulative path risk of that vertex under the current propagation path after each vertex is passed. When a vertex exists in multiple candidate propagation paths, the maximum value of the path risk accumulation of that vertex under each candidate propagation path is selected as the risk accumulation of that vertex.

6. The intelligent analysis method for platform transaction risk based on device logs according to claim 1, characterized in that, The step of marking nodes whose accumulated risk exceeds a preset risk tolerance threshold as risk nodes, and determining the global risk index of platform transactions based on the distribution density of all risk nodes in the directed acyclic graph structure, specifically involves: In the directed acyclic graph structure, vertices whose cumulative risk exceeds a preset risk tolerance threshold are marked as risk vertices, and the total number of risk vertices is counted. Calculate the shortest path length between all pairs of vertices in the directed acyclic graph structure, and select the maximum value as the graph diameter; Using the graph diameter as the normalization benchmark, the number of all risk vertices is normalized to obtain the global risk index.

7. The intelligent analysis method for platform transaction risk based on device logs according to claim 5, characterized in that, When the global risk index exceeds the warning trigger value, the starting node of the risk propagation path is located, and the transaction link corresponding to the starting node is output as the source of risk. Specifically: Compare the global risk index with the warning trigger value. If the global risk index is greater than the warning trigger value, then select all risk vertices whose cumulative risk exceeds a preset risk tolerance threshold. Starting from each risk vertex, trace back along the opposite direction of the directed edge to the initial vertex with an in-degree of zero; The number of times each starting vertex is traced is counted, and the starting vertex with the most traces is taken as the starting node of the risk propagation path. The device identifier and transaction link corresponding to the starting node are output as the source of risk.

8. The intelligent analysis method for platform transaction risk based on device logs according to claim 5, characterized in that, Starting from each vertex with an in-degree of zero in the directed acyclic graph structure, traversing all reachable vertices along the direction of the directed edges, and using the sequence of directed edges traversed in each traversal as a candidate propagation path, specifically: Obtain all vertices with an in-degree of zero in the directed acyclic graph structure, and assign an independent traversal thread to each vertex with an in-degree of zero; Each traversal thread starts from the corresponding vertex with an in-degree of zero and traverses downwards along the directed edges using a depth-first strategy. When it reaches a vertex, it records the sequence of directed edges it has traversed. When traversing to a vertex with an out-degree of zero, the current thread terminates its traversal and outputs the recorded directed edge sequence as a candidate propagation path.

9. The intelligent analysis method for platform transaction risk based on device logs according to claim 5, characterized in that, The initial risk metric values ​​of each vertex on the path are accumulated in traversal order, and the accumulated result is used as the cumulative path risk of that vertex under the current propagation path after each vertex is visited. Specifically: Initialize the path accumulation variable to the initial value of the risk metric of the first vertex on the path; When moving along a directed edge to the next vertex, the initial value of the risk metric of the current vertex is added to the path cumulative variable, and the path cumulative variable is updated with the sum of the addition. The updated path accumulation variable is assigned to the current vertex as the accumulated path risk for that vertex under the current propagation path.

10. The intelligent analysis method for platform transaction risk based on device logs according to claim 2, characterized in that, The frequency threshold is determined as follows: The distribution of the frequency of all adjacent node pairs is statistically analyzed, and the frequencies are arranged in descending order. The cumulative percentile of the frequency is calculated, and the minimum frequency value that makes the cumulative percentile reach the preset percentile threshold is selected as the frequency threshold.

11. The intelligent analysis method for platform transaction risk based on device logs according to claim 6, characterized in that, The formula for calculating the global risk index is as follows: The global risk index is equal to the total number of vertices marked as risk vertices divided by the graph diameter, where the graph diameter is the number of directed edges. The global risk index reflects the degree of clustering of risk vertices per unit graph diameter.

12. The intelligent analysis method for platform transaction risk based on device logs according to claim 6, characterized in that, When the directed acyclic graph structure is not connected, for two vertices that cannot be reached from each other by a directed edge, the shortest path length between the two vertices is set to the total number of vertices in the directed acyclic graph structure.

13. The intelligent analysis method for platform transaction risk based on device logs according to claim 3, characterized in that, Before adding adjacent node pairs with frequencies greater than a frequency threshold as directed edges to the directed acyclic graph structure, it is checked whether adding such adjacent node pairs would form a directed loop. If a directed loop is formed, the adjacent node pairs are not added to the graph structure.

14. The intelligent analysis method for platform transaction risk based on device logs according to claim 1, characterized in that, The warning trigger value is determined by statistically analyzing the global risk index calculated over multiple historical trading periods. Specifically, the global risk index for each day in multiple consecutive historical trading periods is sorted in descending order, and the value at the 90th percentile of the sorted result is selected as the warning trigger value.

15. A platform transaction risk intelligent analysis system based on device logs, comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the intelligent analysis method for platform transaction risk based on device logs as described in any one of claims 1 to 14.

Images