Transaction abnormal risk early warning method and system based on network traffic anomaly identification

Abstract

The present application belongs to the technical field of risk early warning, and discloses a transaction abnormal risk early warning method and system based on network flow anomaly identification; comprising: collecting original network flow data of each flow node, and assembling a flow multi-dimensional feature set; based on the flow multi-dimensional feature set, constructing a flow behavior correlation graph, and forming a flow anomaly pattern recognition result; based on the flow anomaly pattern recognition result, calculating a comprehensive abnormal risk index of each flow node, and generating an abnormal risk quantitative evaluation result; based on the abnormal risk quantitative evaluation result, determining a corresponding risk early warning level, and generating a corresponding hierarchical early warning strategy report for different early warning levels of risks; by introducing behavior quality value, behavior gravity strength and behavior entropy flow value, etc., the present application realizes a leap from isolated node analysis to correlation network analysis, and can greatly improve the identification accuracy of single-point abnormality and the identification accuracy of gang abnormal behavior.

Description

Technical Field

[0001] This invention relates to the field of risk warning technology, and more specifically, to a method and system for risk warning of abnormal transactions based on network traffic anomaly identification. Background Technology

[0002] With the rapid development of the digital economy and the widespread adoption of e-commerce, online payments, and online financial services, transaction security has become increasingly important. Industry statistics show that direct economic losses due to abnormal transactions in China's digital commerce sector exceed hundreds of billions of yuan annually, and the difficulty of identifying transaction anomalies continues to increase with the complexity of the network environment. Current transaction anomaly risk warning systems generally rely solely on shallow traffic attributes such as IP address, access frequency, and single request data volume to construct detection rules when extracting traffic features. They lack effective mining of the temporal evolution of session behavior sequences, collaborative anomaly patterns across user traffic, and semantic features of request content. This results in a large number of concealed anomalies failing to be effectively identified at the traffic level, severely limiting the recall rate of anomaly detection.

[0003] Meanwhile, existing methods for early warning of abnormal transaction risks generally treat each traffic node as an isolated individual for individual analysis, employing threshold judgments or simple statistical analysis methods based on single node characteristics. This ignores the group collaboration characteristics of abnormal groups in the traffic topology network, such as aggregation, synchronization, and gradient transmission. As a result, the accuracy of identifying single-point anomalies is low, and the ability to detect group-based abnormal behavior is severely insufficient, making it difficult to cope with large-scale, organized abnormal attacks. In addition, existing methods for early warning of abnormal transaction risks generally adopt a binary early warning mode triggered by a single threshold, outputting only two results: normal or alarm. This fails to provide differentiated response guidance based on the type, urgency, and potential loss scale of the abnormal risk, resulting in insufficient operability of the early warning results. Consequently, this severely restricts the efficiency of handling abnormal risks and fails to achieve closed-loop management from risk identification to automatic response.

[0004] In view of this, the present invention proposes a method and system for early warning of transaction anomaly risks based on network traffic anomaly identification to solve the above problems. Summary of the Invention

[0005] To overcome the aforementioned deficiencies of the prior art and achieve the above objectives, the present invention provides the following technical solution: A method for early warning of transaction anomalies based on network traffic anomaly identification, the method includes: S1. Collect raw network traffic data from each traffic node, perform multi-level feature analysis, and construct a multi-dimensional traffic feature set; S2. Construct a traffic behavior association graph, identify abnormal subgraph structures in the traffic behavior association graph, calculate the node anomaly degree of each traffic node, and calculate the subgraph aggregate anomaly degree of each traffic node based on the abnormal subgraph structure. Integrate the node anomaly degree of each traffic node with the subgraph aggregate anomaly degree to form the traffic anomaly pattern recognition result. S3. Based on the traffic anomaly pattern recognition results, combined with the preset abnormal behavior knowledge graph, calculate the probability of anomaly type attribution and the intensity of anomaly risk corresponding to each traffic node, obtain the historical risk records and related transaction amounts of each traffic node, and calculate the comprehensive anomaly risk index of each traffic node by combining the probability of anomaly type attribution and the intensity of anomaly risk, and generate the quantitative assessment result of anomaly risk. S4. Based on the quantitative assessment results of abnormal risks, a two-dimensional risk assessment matrix is ​​constructed using the comprehensive abnormal risk index and the probability of abnormal type attribution. The risks are divided into four warning levels, and corresponding graded warning strategy reports are generated for risks of different warning levels according to the preset warning response scheme library.

[0006] Furthermore, the method for constructing a multidimensional feature set of traffic is as follows: The raw network traffic data is parsed to obtain basic traffic features, session behavior features, device environment features, and content semantic features. These features are then combined to form a multi-dimensional traffic feature set.

[0007] Furthermore, the method for constructing the traffic behavior correlation graph is as follows: Based on the multidimensional feature vector of each flow node, calculate the behavior quality value of each flow node; calculate the behavior attraction strength between any two flow nodes based on the behavior quality value; when the behavior attraction strength is greater than or equal to the preset attraction threshold, establish a directed edge between the corresponding two flow nodes, and construct the original directed edge set based on all directed edges. The normalized behavioral gravity strength is used as the weight of each directed edge. The behavioral entropy flow value of each flow node is calculated and used as the dynamic attribute of each flow node. The behavioral gravity strength between each flow node is iteratively updated, and a new set of directed edges is obtained based on the updated behavioral gravity strength. Calculate the rate of change of the edge structure between the new set of directed edges and the original set of directed edges, and repeat the iterative process until the rate of change of the edge structure is less than the preset convergence threshold, and finally obtain the flow behavior association graph.

[0008] Furthermore, the method for generating traffic anomaly pattern recognition results is as follows: Based on the traffic behavior correlation graph, the node anomaly degree of each traffic node is calculated; traffic nodes with anomaly degrees greater than or equal to a preset anomaly threshold are used as seed nodes, and candidate anomaly subgraphs are obtained by greedily expanding the graph through the intensity of behavior attraction. Synchronization and gradient propagation tests are performed sequentially on each candidate anomaly subgraph to obtain the anomaly subgraph structure. Calculate the subgraph aggregation anomaly degree of the abnormal subgraph structure corresponding to each traffic node, integrate the node anomaly degree of each traffic node with the subgraph aggregation anomaly degree to obtain the fusion anomaly degree; sort all traffic nodes in descending order of fusion anomaly degree to generate traffic anomaly pattern recognition results.

[0009] Furthermore, the method for obtaining the abnormal subgraph structure is as follows: Calculate the similarity of session behavior features of each traffic node in each candidate anomaly subgraph within the same time window. When the similarity of session behavior features is greater than or equal to the preset synchronization threshold, the synchronization test is passed. At this time, the candidate anomaly subgraph is recorded as the initial screening candidate anomaly subgraph. Determine the boundary nodes of the initial screening candidate anomaly subgraphs. Starting from the seed node, traverse along the directed edge direction to the boundary node. Calculate the behavioral entropy flow value difference between adjacent flow nodes on the traversal path. When there is a traversal path from the seed node to the boundary node such that the behavioral entropy flow value difference between all adjacent flow nodes on the corresponding traversal path is positive, the gradient transitivity test is passed. At this time, all initial screening candidate anomaly subgraphs are merged to obtain the anomaly subgraph candidate set. Calculate the node overlap rate between any two abnormal subgraphs in the candidate set of abnormal subgraphs. When the node overlap rate is greater than or equal to the preset overlap threshold, only the abnormal subgraphs with higher aggregation abnormality are retained, and the abnormal subgraph structure is finally obtained.

[0010] Furthermore, the method for calculating the comprehensive anomaly risk index of each traffic node is as follows: Extract the fusion anomaly degree of each traffic node, combine the subgraph aggregation anomaly degree with the corresponding traffic multidimensional feature vector, and construct the anomaly pattern feature vector of each traffic node. Based on a pre-defined abnormal behavior knowledge graph, the abnormal pattern feature vectors of each abnormal pattern are extracted, the pattern entanglement strength between the abnormal pattern feature vectors of each traffic node and the feature vectors of each abnormal pattern is calculated, and the probability of the traffic node being assigned to the abnormal type of each abnormal pattern is determined. Based on the probability of the abnormal type being assigned, the abnormal risk intensity of each traffic node is calculated. Based on the historical risk records and related transaction amounts of traffic nodes, a historical risk attenuation factor and a transaction amount risk amplification factor are generated. Based on the abnormal risk intensity, historical risk attenuation factor, and transaction amount risk amplification factor, a comprehensive abnormal risk index for each traffic node is calculated through a pre-constructed risk potential energy field model.

[0011] Furthermore, the method for generating the quantitative assessment results of abnormal risks is as follows: Based on the comprehensive anomaly risk index of each traffic node, a risk potential energy field distribution map is constructed; the potential energy received value of each traffic node in the risk potential energy field distribution map is calculated. Based on the risk potential energy field distribution map, risk clustering is performed on each traffic node to form multiple risk clusters; risk homogeneity test is performed on each risk cluster, and the risk clusters that pass the risk homogeneity test are recorded as risk homogeneous clusters; Based on each risk homogeneous cluster, the cluster risk equivalent of each risk homogeneous cluster and the deviation of each flow node from the potential energy center in its respective risk homogeneous cluster are calculated; based on the comprehensive abnormal risk index, cluster risk equivalent and potential energy center deviation, the abnormal risk quantitative assessment results of the flow nodes are generated.

[0012] Furthermore, the method for constructing a two-dimensional risk assessment matrix is ​​as follows: Extract the comprehensive anomaly risk index and anomaly type attribution probability of each traffic node, construct an initial two-dimensional risk coordinate plane, and mark the risk coordinate points of each traffic node on the initial two-dimensional risk coordinate plane; Based on the historical risk distribution density of each abnormal pattern in the pre-set abnormal behavior knowledge graph, a risk density potential field is constructed on the initial two-dimensional risk coordinate plane; the initial two-dimensional risk coordinate plane is divided into several risk attraction domains, and each risk attraction domain corresponds to a candidate area for early warning level. Based on the average comprehensive abnormal risk index and the average probability of abnormal type attribution of all traffic nodes in each risk attraction domain, the risk attraction domain is mapped to four early warning levels. By projecting the risk coordinates of each traffic node onto the mapped warning level, the warning level of each traffic node is determined, forming a two-dimensional risk assessment matrix.

[0013] Furthermore, the method for mapping the risk attraction domain to the four warning levels is as follows: The average comprehensive abnormal risk index is compared with multiple preset risk thresholds to obtain the corresponding risk index level. The average probability of anomaly type is compared with multiple preset probability thresholds to obtain the corresponding probability level. The higher of the risk index level and the probability level is taken as the final warning level.

[0014] A transaction anomaly risk early warning system based on network traffic anomaly identification, comprising: The traffic multidimensional feature extraction module is used to construct a traffic multidimensional feature set based on the raw network traffic data of each traffic node; The abnormal pattern association and identification module is used to construct a traffic behavior association graph and identify abnormal traffic patterns. The abnormal risk quantification assessment module is used to generate abnormal risk quantification assessment results based on the identification results and in combination with a pre-set abnormal behavior knowledge graph. The graded early warning strategy generation module is used to construct a two-dimensional risk assessment matrix based on the results of abnormal risk quantification assessment, and generate an early warning strategy report by combining it with a pre-set early warning response scheme library.

[0015] The technical effects and advantages of the transaction anomaly risk early warning method based on network traffic anomaly identification of this invention are as follows: This invention achieves a leap from single, shallow attributes to multi-dimensional, deep features by extracting and deeply fusing features from four dimensions: basic traffic features, session behavior features, device environment features, and content semantic features, based on raw network traffic data. Through the mutual complementarity and organic fusion of the four dimensions of features, the feature coverage is greatly improved, effectively solving the problems of single dimensions and insufficient depth in network traffic feature extraction in existing technologies, and significantly enhancing the ability to identify covert abnormal behaviors at the traffic level.

[0016] This invention achieves a leap from isolated node analysis to interconnected network analysis by introducing behavioral quality values, behavioral gravity strength, and behavioral entropy flow values. Behavioral quality values ​​comprehensively reflect the overall state of traffic nodes across four dimensions: traffic foundation, session behavior, device environment, and content semantics. Behavioral gravity strength dynamically constructs directed edges based on node quality and feature space distance, forming a network topology that reflects the tightness of connections between nodes. Behavioral entropy flow values ​​achieve dynamic evolution of the graph through iterative updates, enabling adaptive adjustments to the interconnected structure. Based on this graph, a triple screening mechanism—identifying node clustering regions through clustering tests, verifying behavioral collaboration patterns through synchronization tests, and confirming information flow paths through gradient transmission tests—effectively identifies abnormal subgraph structures with group collaboration characteristics. This significantly improves the accuracy of identifying single-point anomalies and group-based abnormal behaviors, effectively solving the problems of weak correlation analysis capabilities and insufficient detection capabilities for group-based anomalies in existing technologies. It achieves effective identification and localization of large-scale, group-based abnormal attacks.

[0017] This invention achieves refined hierarchical early warning by introducing pattern entanglement strength, a risk potential field model, and a two-dimensional risk assessment matrix. Pattern entanglement strength dynamically couples abnormal patterns of traffic nodes with typical abnormal patterns in an abnormal behavior knowledge graph, achieving precise attribution of abnormal types. The risk potential field model spatiotemporally fuses abnormal risk intensity, historical risk attenuation factors, and transaction amount risk amplification factors, achieving dynamic quantification of a comprehensive abnormal risk index. The two-dimensional risk assessment matrix, based on adaptive region division of the risk density potential field, finely divides risk into four levels: observation, early warning, interception, and emergency response, ensuring that the early warning boundary aligns with the risk level. The risk distribution structure is consistent with the risk profile. Combined with a pre-set early warning response plan library, it automatically generates a tiered early warning strategy report that includes abnormal behavior location, risk level description, priority ranking of handling, recommended response measures, and estimated loss scale. This provides safety operations personnel with one-stop decision support from risk identification to handling execution, effectively solving the problems of existing risk early warning response mechanisms lacking refined tiered strategies and insufficient operability of early warning results. It eliminates the need for safety operations personnel to spend extra time on manual secondary analysis, significantly shortens risk handling response time, realizes closed-loop management from risk identification to automatic response, and greatly improves the efficiency of abnormal risk handling. Attached Figure Description

[0018] Figure 1 This is a diagram illustrating the method steps of the present invention; Figure 2 This is a system module diagram of the present invention. Detailed Implementation

[0019] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0020] In one embodiment, a method for early warning of transaction anomaly risks based on network traffic anomaly identification is disclosed, such as... Figure 1 As shown, the method includes: S1. Collect raw network traffic data from each traffic node, perform multi-level feature analysis, and construct a multi-dimensional traffic feature set.

[0021] The process involves parsing the raw network traffic data to obtain basic traffic features, then concatenating and combining these features to obtain a basic traffic feature vector. These basic traffic features include request frequency sequences, joint statistics of skewness and kurtosis in packet size distribution, logarithmic transformation sequences of connection duration, and one-hot encoding of protocol types. The raw network traffic data is parsed to obtain session behavior features. These features are then concatenated and combined to obtain a session behavior feature vector. The session behavior features include operation sequence pattern features, page jump path features, dwell time distribution features, and mouse trajectory entropy features. The raw network traffic data is parsed to obtain device environment characteristics. These characteristics are then concatenated and combined to obtain a device environment feature vector. The device environment characteristics include device fingerprint hash value, operating system characteristics, browser behavior characteristics, geographic location jump rate, and device environment consistency tensor. The raw network traffic data is parsed to obtain content semantic features. These content semantic features are then concatenated and combined to obtain a content semantic feature vector. The content semantic features include the anomaly degree of request parameter distribution, form filling rate, and field association rationality matrix. By deeply fusing the feature vectors corresponding to the same traffic node, a multi-dimensional feature vector of traffic for each traffic node is obtained, and a multi-dimensional feature set of traffic is constructed based on the multi-dimensional feature vectors of traffic.

[0022] Specifically, the raw network traffic data includes basic data from the network and transport layers, application layer session behavior data, terminal device environment data, and request content semantic data. The basic data from the network and transport layers includes timestamp fields, packet payload length sequences, the time interval from TCP connection establishment to connection release, and network layer protocol identifier fields. The application layer session behavior data includes raw operation log data within the user session time window, operation event sequences, page navigation path sequences, dwell time distribution, and mouse trajectory point sequences. The terminal device environment data includes hardware fingerprint information collected from the terminal device, operating system version identifiers, kernel parameters, system call characteristics, browser rendering engine type, plugin list, Canvas fingerprint, WebGL characteristics, session log geolocation fields, and the joint distribution of various dimensions of the device environment at different time steps. The request content semantic data includes the value distribution of various parameter fields in the request log and form filling event streams. The timestamp field in the raw network traffic data is parsed, and the request frequency sequence is obtained based on the request count within a unit time window. The request frequency sequence reflects the access density of traffic nodes within a unit time period and is a basic indicator for identifying high-frequency attack behavior. Statistical distribution fitting is performed on the packet payload length sequence in the raw network traffic data to calculate skewness and kurtosis. The morphological characteristics of the packet size distribution are obtained based on the joint characterization of the skewness and kurtosis values. The skewness value is the ratio of the third central moment of the packet payload length sequence to the cube of the standard deviation, reflecting the degree of asymmetry in the distribution. The kurtosis value is the ratio of the fourth central moment of the packet payload length sequence to the square of the variance minus 3, reflecting the thickness of the tail of the distribution. The joint characterization of the two values ​​can capture the essential differences in packet size distribution between normal and abnormal traffic. Logarithmic transformation is performed on the time interval from TCP connection establishment to connection release in the original network traffic data. The distribution characteristics of connection duration are obtained from the transformed duration sequence. The logarithmic transformation can effectively compress the dynamic range of duration data, reduce the interference of extreme values ​​on the distribution characteristics, and make the distribution characteristics of connection duration more stable. The network layer protocol identifier field in the original network traffic data is subjected to category encoding mapping, and a one-hot encoding vector of the protocol type is generated according to the preset protocol type enumeration set. The protocol type enumeration set is the set of all protocol types that have appeared in the original network traffic data. The one-hot encoding vector converts the discrete protocol types into continuous numerical representations, which facilitates subsequent feature fusion processing. The request frequency sequence, the morphological characteristics of the data packet size distribution, the logarithmic transformation sequence of the connection duration, and the one-hot encoded vector of the protocol type are concatenated and combined to finally obtain the basic traffic feature vector.

[0023] Based on the original operation log data within the user session time window in the original network traffic data, the operation event sequence is mapped to trajectory points in the operation type encoding space. An operation transition Markov matrix is ​​constructed based on the transition frequency statistics between each operation type to obtain the operation sequence pattern characteristics. Here, the operation event sequence is the sequence of user operation behaviors recorded in the original network traffic data arranged in chronological order, the operation type is the classification encoding of the operation behaviors in the original operation log data, and the transition frequency is the number of times the transition between each operation type occurs as statistically obtained from the original network traffic data. The number of rows and columns of the operation transition Markov matrix is ​​the total number of operation types, and each element in the matrix represents the normalized transition probability from one operation type to another. This matrix can characterize the user's operation habit patterns in the session. Abnormal operation transition patterns often indicate automated scripts or abnormal behavior. The page jump path sequence in the original network traffic data is encoded into a directed graph structure, where nodes represent page entities, edges represent page jump relationships, and the edge weight is the reciprocal of the jump time interval. Based on this directed graph structure, a personalized PageRank vector is calculated to obtain the page jump path features. Setting the edge weight to the reciprocal of the jump time interval means that the shorter the jump time, the larger the edge weight, reflecting the close relationship between pages. The calculation of the personalized PageRank vector is an existing technology and will not be described in detail here. For example, an initial probability distribution of random jumps is set according to the user's historical preferences. The probability value of each node in the directed graph structure is iteratively calculated, and the finally converged probability distribution vector is the personalized PageRank vector. The personalized PageRank vector can identify the core access path of users in the page jump network. Jump behavior that deviates from the normal user core path has a higher suspicion of being abnormal. The probability density function is obtained by kernel density estimation of the dwell time distribution in the original network traffic data. Based on the probability density function, multi-scale quantile features and coefficient of variation are extracted to obtain the dwell time distribution features. The multi-scale quantile features include the decile, lower quartile, median, upper quartile, and ninetieth quartile, which can comprehensively characterize the distribution pattern of dwell time. The coefficient of variation, which is the ratio of the standard deviation to the mean, reflects the dispersion of the dwell time distribution. The dwell time distribution of abnormal users often exhibits extreme characteristics. The trajectory curvature entropy and the two-dimensional Shannon entropy of the velocity-acceleration joint distribution are calculated from the mouse trajectory point sequence in the original network traffic data to obtain the characteristics of mouse trajectory entropy. The trajectory curvature entropy is calculated by dividing the trajectory curvature into several intervals, counting the occurrence probability of each interval and calculating the information entropy, which reflects the curvature complexity of the mouse trajectory. The two-dimensional Shannon entropy of the velocity-acceleration joint distribution reflects the richness of the changes in the mouse motion state. The mouse trajectory of automated operation often has the regularity of low entropy value. The operation sequence pattern features, page jump path features, dwell time distribution features, and mouse trajectory entropy features are concatenated and combined to obtain the session behavior feature vector.

[0024] The device fingerprint hash value is generated based on the hardware fingerprint information collected from the terminal device in the original network traffic data. Hardware fingerprint information includes CPU model, memory capacity, hard drive serial number, network card MAC address, screen resolution and color depth, etc. A unique identifier string is generated by combining these fingerprint information, and then mapped to the device fingerprint hash value through a hash algorithm. The device fingerprint hash value is the unique identifier of the device. The hash processing protects the device's privacy information while retaining the device's identifiability. Operating system feature vectors are extracted from the operating system version identifier, kernel parameters, and system call characteristics in the raw network traffic data. For example, the operating system version identifier is one-hot encoded, the kernel parameters are numerically normalized, and the system call characteristics are frequency-counted. The three are then concatenated to obtain the operating system feature vector. The operating system version identifier reflects the type and version information of the operating system, the kernel parameters reflect the system configuration characteristics, and the system call characteristics refer to the interface call records provided by the operating system kernel to the application. The system call characteristics reflect the behavior pattern of the application and the operating system. Therefore, the operating system feature vector can comprehensively characterize the operating environment of the operating system. Browser behavior feature vectors are extracted from the original network traffic data based on the browser rendering engine type, plugin list, Canvas fingerprint, and WebGL features. For example, the browser rendering engine type is categorically encoded, the plugin list is binary-encoded for existence, and the Canvas fingerprint and WebGL features are numerically extracted and concatenated to obtain the browser behavior feature vector. The browser rendering engine type determines the rendering method of the webpage, the plugin list reflects the user's functional extension habits, and the Canvas fingerprint and WebGL features are unique identifiers of the browser's hardware acceleration capabilities. Therefore, the browser behavior feature vector can effectively distinguish different browser environments. Based on the adjacent comparison statistics of the geolocation field in the session log of the original network traffic data, the ratio of the number of geolocation jumps to the total number of sessions is calculated to obtain the geolocation jump rate. The geolocation jump rate reflects the frequency of user geolocation changes. Abnormal geolocation jumps often indicate the use of proxy IPs or account theft. Based on the joint distribution of various dimensions of the device environment in the original network traffic data at different time steps, the mutual information value between each pair of dimensions is calculated, and a device environment consistency tensor is constructed. The three dimensions of the device environment consistency tensor are the number of device environment dimensions, the number of device environment dimensions, and the time step. Each element in the tensor represents the mutual information value between two device environment dimensions at a specific time step. The mutual information value reflects the degree of statistical dependence between two device environment dimensions. The device environment consistency tensor can capture the collaborative change pattern of various dimensions of the device environment over time. Abnormal device environments often manifest as abrupt changes in the mutual information value between certain dimensions. The device fingerprint hash value, operating system feature vector, browser behavior feature vector, geolocation jump rate, and device environment consistency tensor are concatenated and combined to obtain the device environment feature vector.

[0025] Based on the request logs in the raw network traffic data, the value sequences of each parameter field are extracted. Parameter fields include URL path parameters, request body form fields, HTTP header fields, and Cookie key-value pairs. The value sequences of each parameter field are statistically analyzed to obtain the empirical distribution of each parameter field. The deviation of the empirical distribution of each parameter field from the baseline distribution preset based on historical normal traffic is measured. The deviation is measured using KL divergence, which is the log-weighted average of the probabilities of the empirical distribution and the baseline distribution, with the weights being the probability values ​​of the empirical distribution. The arithmetic mean of the KL divergences of each parameter field is then calculated to obtain the request parameter distribution anomaly. The larger the request parameter distribution anomaly, the more significant the deviation of the request parameter value distribution of this traffic node from the historical distribution of the normal pattern. Based on the number of fields completed and the start and end times of form filling in the original network traffic data, the form filling rate is calculated. The number of fields completed refers to the number of form fields that the user successfully entered during the form filling process, including the number of interactive elements that have been assigned values, such as text boxes, selection boxes, radio buttons, and check boxes. The form filling rate is the ratio of the number of fields completed to the total filling time (i.e., the filling stop time minus the filling start time). An abnormal form filling rate (too fast or too slow) often indicates automated script attacks or abnormal human behavior. Based on the frequency statistics of co-occurrence among fields in the form filling event stream of the original network traffic data, conditional probabilities between each field are constructed. The deviation of these conditional probabilities from the baseline conditional probabilities preset based on experience is calculated to obtain the field association rationality matrix. The deviation is the absolute difference between the conditional probability between each field and the corresponding pre-approved baseline conditional probability. Each element in the field association rationality matrix represents the deviation between the conditional probability between two fields and the baseline conditional probability. Abnormal field association patterns (such as abnormal co-occurrence of required and optional fields) can reveal forged forms or data tampering behavior. The content semantic feature vector is obtained by concatenating and combining the abnormality of request parameter distribution, form filling rate, and field association rationality matrix.

[0026] Dimensional standardization is performed on the feature vectors of each dimension to eliminate fusion bias caused by differences in the units and numerical ranges of features from different dimensions. Specifically, the traffic basic feature vector, session behavior feature vector, device environment feature vector, and content semantic feature vector are standardized independently, mapping the element values ​​of each feature vector to a unified numerical range. Based on empirically pre-set dimension weight coefficients, the standardized feature vectors of each dimension are weighted. The dimension weight coefficients are preset according to the discriminative contribution of each feature in historical abnormal samples. Dimensions with higher discriminative contributions are assigned larger weight coefficients, so that feature dimensions with strong discriminative power receive a higher representation weight in the fused traffic multidimensional feature vector. The weighted traffic basic feature vector, session behavior feature vector, device environment feature vector, and content semantic feature vector are concatenated end to end to form the fused traffic multidimensional feature vector. The number of dimensions of the traffic multidimensional feature vector is the sum of the number of dimensions of each feature vector, completely preserving all information of traffic basic features, session behavior features, device environment features, and content semantic features.

[0027] The above fusion operation is performed on each traffic node to obtain the corresponding multi-dimensional traffic feature vector. The multi-dimensional traffic feature vectors of all traffic nodes are collected to form a multi-dimensional traffic feature set. In this way, the system extracts and fuses four dimensions: basic traffic features, session behavior features, device environment features, and content semantic features. It can construct a comprehensive, rich, and complementary multi-dimensional traffic feature set from multiple levels, such as the statistical regularity of network traffic, user interaction behavior patterns, the trust status of the terminal environment, and the semantic rationality of the requested content. This multi-dimensional traffic feature set not only breaks through the limitations of traditional methods that rely only on a single shallow traffic attribute and achieves a significant expansion of the dimensions of representation of hidden abnormal behavior, but also forms a complete characterization of traffic node behavior profiles through the organic fusion of multi-dimensional features. This provides a high-discrimination and high-coverage feature input foundation for subsequent abnormal pattern recognition and abnormal risk warning, thereby effectively improving the accuracy of transaction abnormal behavior identification and early warning effect at the traffic level.

[0028] S2. Construct a traffic behavior association graph, identify abnormal subgraph structures in the traffic behavior association graph, calculate the node anomaly degree of each traffic node, and calculate the subgraph aggregate anomaly degree of each traffic node based on the abnormal subgraph structure. Integrate the node anomaly degree of each traffic node with the subgraph aggregate anomaly degree to form the traffic anomaly pattern recognition result.

[0029] The method for constructing the traffic behavior association graph is as follows: calculate the behavior quality value of each traffic node based on the traffic multidimensional feature vector of each traffic node; calculate the behavior attraction strength between any two traffic nodes based on the behavior quality value; when the behavior attraction strength is greater than or equal to the preset attraction threshold, establish a directed edge between the corresponding two traffic nodes, and construct the original directed edge set based on all directed edges. The normalized behavioral gravity strength is used as the weight of each directed edge. The behavioral entropy flow value of each flow node is calculated and used as the dynamic attribute of each flow node. The behavioral gravity strength between each flow node is iteratively updated, and a new set of directed edges is obtained based on the updated behavioral gravity strength. Calculate the rate of change of the edge structure between the new set of directed edges and the original set of directed edges, repeat the iterative process until the rate of change of the edge structure is less than the preset convergence threshold, and finally obtain the flow behavior association graph. The method for generating traffic anomaly pattern recognition results is as follows: calculate the node anomaly degree of each traffic node based on the traffic behavior association graph; take the traffic nodes with node anomaly degrees greater than or equal to the preset anomaly threshold as seed nodes, and greedily expand them through the behavior gravity strength to obtain candidate anomaly subgraphs; Synchronization and gradient propagation tests are performed sequentially on each candidate anomaly subgraph to obtain the anomaly subgraph structure. Calculate the subgraph aggregation anomaly degree of the abnormal subgraph structure corresponding to each traffic node, integrate the node anomaly degree of each traffic node with the subgraph aggregation anomaly degree to obtain the fusion anomaly degree; sort all traffic nodes in descending order of fusion anomaly degree to generate traffic anomaly pattern recognition results. The method for obtaining the abnormal subgraph structure is as follows: calculate the similarity of the session behavior features of each traffic node in each candidate abnormal subgraph within the same time window. When the similarity of the session behavior features is greater than or equal to the preset synchronization threshold, it is determined to pass the synchronization test. At this time, the candidate abnormal subgraph is recorded as the initial screening candidate abnormal subgraph. Determine the boundary nodes of the initial screening candidate anomaly subgraphs. Starting from the seed node, traverse along the directed edge direction to the boundary node. Calculate the behavioral entropy flow value difference between adjacent flow nodes on the traversal path. When there is a traversal path from the seed node to the boundary node such that the behavioral entropy flow value difference between all adjacent flow nodes on the corresponding traversal path is positive, the gradient transitivity test is passed. At this time, all initial screening candidate anomaly subgraphs are merged to obtain the anomaly subgraph candidate set. Calculate the node overlap rate between any two abnormal subgraphs in the candidate set of abnormal subgraphs. When the node overlap rate is greater than or equal to the preset overlap threshold, only the abnormal subgraphs with higher aggregation abnormality are retained, and the abnormal subgraph structure is finally obtained.

[0030] Specifically, based on the multi-dimensional feature vectors of each traffic node, a behavioral quality value is calculated for each traffic node. This behavioral quality value is obtained by weighted fusion of the stability measure of the node's basic traffic features, the sequence complexity measure of its session behavior features, the consistency measure of its device environment features, and the semantic deviation measure of its content semantic features. The weights of each are pre-set based on the experience of those in the field. The behavioral quality value comprehensively reflects the overall behavioral characteristic status of the traffic node across four dimensions: basic traffic features, session behavior, device environment, and content semantics. A higher behavioral quality value indicates a higher degree of behavioral abnormality and a more prominent behavioral pattern. Among these: The stability measure of traffic fundamental characteristics is obtained by weighted summation of the following: the coefficient of variation of the request frequency sequence of the traffic node (obtained by counting requests within a unit time window and then calculating the ratio of the standard deviation to the mean of the sequence); the range ratio of the logarithmic transformation sequence of connection duration (obtained by performing a logarithmic transformation on the time interval from TCP connection establishment to connection release and then calculating the ratio of the difference between the maximum and minimum values ​​of the transformed duration sequence to the mean of the sequence); and the entropy distribution deviation of the protocol type one-hot encoded vector (obtained by generating a protocol type one-hot encoded vector from the protocol type enumeration set and then calculating the reciprocal of the difference between the information entropy of each element of the vector and the preset baseline entropy value). The weighting coefficients for each of these values ​​can be preset based on the experience of those skilled in the art. A smaller coefficient of variation indicates more stable request frequency fluctuations; a smaller range ratio indicates a more concentrated distribution of connection durations; and a smaller distribution deviation indicates a more balanced distribution of protocol types. Therefore, the stability measure of traffic fundamental characteristics can comprehensively reflect the stability of traffic fundamental characteristics; a larger value indicates higher instability. The sequence complexity measure of session behavior characteristics is based on the following: the entropy value of the stationary distribution of the operation transition Markov matrix of the traffic node (obtained by iterating the operation transition Markov matrix until convergence to obtain a stationary distribution vector, and calculating the information entropy of the probability of each element of the stationary distribution vector); the entropy value of the out-degree distribution of the directed graph of the page jump path (obtained by counting the number of outgoing edges of each node in the directed graph of the page jump path, and calculating the information entropy of the out-degree distribution); the coefficient of variation of the dwell time distribution (obtained by calculating the ratio of the standard deviation to the mean of the dwell time distribution); and the entropy value of the mouse trajectory curvature (obtained by...). The curvature value of the mouse trajectory is divided into several intervals. The frequency of occurrence of each interval is statistically analyzed and the information entropy is calculated. The weighted sum is then obtained. The weight coefficients of each interval can be preset in advance based on the experience of those in the field. The higher the stationary distribution entropy value, the more complex the operation transfer mode. The higher the node out-degree distribution entropy value, the more diverse the page jump path. The larger the coefficient of variation, the more dispersed the dwell time distribution. The higher the mouse trajectory curvature entropy value, the more irregular the mouse trajectory. Therefore, the sequence complexity measure of session behavior features comprehensively reflects the complexity of session behavior features. The larger the value, the greater the possibility of anomalies. The consistency measure of device environment characteristics is obtained by weighting and summing the following: the average mutual information value of the device environment consistency tensor of the traffic node in the time dimension (obtained by extracting the mutual information value of each time step along the preset time step dimension and calculating the arithmetic mean); the matching degree between the device fingerprint hash value and the historical session device fingerprint hash value (obtained by cosine similarity calculation, where the historical session device fingerprint hash value is the device fingerprint hash value in the most recent past session record of the traffic node); and the reciprocal of the geographical location jump rate. The higher the average mutual information value, the stronger the coordination of the various dimensions of the device environment; the higher the matching degree, the more stable the device identity; the lower the geographical location jump rate and the larger its reciprocal, the more reasonable the geographical location change. Therefore, the larger the value of the consistency measure of device environment characteristics obtained by weighted summation and reciprocal transformation, the more abnormal it is. Thus, the consistency measure of device environment characteristics comprehensively reflects the credibility of device environment characteristics, and the larger the value, the higher the degree of untrustworthiness. The semantic deviation measure of content semantic features is obtained by weighted summation based on the abnormality of the request parameter distribution of the traffic node (obtained by calculating the KL divergence between the empirical distribution of each parameter field and the baseline distribution), the deviation of the form filling rate from the preset normal rate range (obtained by calculating the absolute value of the relative deviation between the form filling rate and the median of the preset normal rate range), and the average absolute value of the deviation of each element from zero in the field association rationality matrix. The weight coefficients of each can be preset in advance based on the experience of those in the field. The larger the abnormality of the request parameter distribution, the more the request parameters deviate from the normal pattern; the larger the deviation of the form filling rate, the more abnormal the form filling behavior; the larger the average absolute deviation of the elements in the field association rationality matrix, the more unreasonable the field association pattern. Therefore, the semantic deviation measure of content semantic features comprehensively reflects the degree of abnormality of content semantic features, and the larger the value, the higher the degree of abnormality.

[0031] Based on the behavior quality values ​​of each traffic node, the behavioral attraction strength between any two traffic nodes is calculated. The behavioral attraction strength is directly proportional to the product of the behavior quality values ​​of the two corresponding nodes. Specifically, the higher the behavior quality values ​​of the two traffic nodes, the more significant their behavioral characteristics and patterns, and the stronger the foundation of their behavioral attraction. The product of the behavior quality values ​​of the two corresponding traffic nodes reflects the joint effect of the significance of their behavioral characteristics; the larger the product, the stronger the foundation of the behavioral attraction. The behavioral attraction strength is inversely proportional to the Euclidean distance between the multidimensional feature vectors of the traffic nodes. Specifically, the Euclidean distance between the multidimensional feature vectors of the traffic nodes in the feature space is calculated. The smaller the Euclidean distance, the closer the overall performance of the two nodes in the four dimensions of traffic foundation features, conversation behavior features, device environment features, and content semantic features, and the stronger their behavioral attraction. The larger the Euclidean distance, the stronger the attraction. The more distant the two nodes are in the feature space, the weaker their mutual behavioral attraction. The behavioral attraction strength is calculated by multiplying the corresponding behavioral quality values ​​of the two flow nodes as the numerator and using the Euclidean distance between the corresponding multidimensional feature vectors of the flow nodes as the denominator. When the calculated behavioral attraction strength is greater than or equal to a preset attraction threshold, a directed edge is established between the two corresponding flow nodes. The direction of the directed edge is from the flow node with the higher behavioral quality value to the flow node with the lower behavioral quality value, and the weight of the directed edge is the normalized behavioral attraction strength. The attraction threshold is set based on the distribution statistics of behavioral attraction strength in historical normal flow samples, typically using the upper quantile of the distribution as the threshold benchmark. The normalization of behavioral attraction strength is achieved by mapping each behavioral attraction strength value to a numerical range of zero to one, specifically by scaling the maximum behavioral attraction strength of the entire graph as the benchmark. Based on all established directed edges, the original set of directed edges is constructed.

[0032] The normalized behavioral gravity intensity is used as the weight of each directed edge, and the behavioral entropy flow value of each flow node is calculated based on the weight. The behavioral entropy flow value is obtained by calculating the weighted difference between the information entropy of the weight distribution of all incoming edges and the information entropy of the weight distribution of outgoing edges corresponding to the flow node. The information entropy of the incoming edge weight distribution reflects the degree of dispersion of the behavioral gravity received by the flow node from other flow nodes; the higher the information entropy, the more diverse the sources of incoming edges. The information entropy of the outgoing edge weight distribution reflects the degree of dispersion of the behavioral gravity exerted by the flow node on other flow nodes; the higher the information entropy, the more diverse the destinations of outgoing edges. The weighted difference between the two reflects the degree of information convergence and divergence of the flow node in the interconnected network; a positive behavioral entropy flow value indicates that the node mainly diverges information, while a negative value indicates a different outcome. The value indicates that the node is mainly for information aggregation; the behavioral entropy flow value is used as the dynamic attribute of each flow node, and the behavioral attraction strength between each flow node is iteratively updated. Specifically, the behavioral attraction strength is recalculated based on the updated behavioral quality value. Two flow nodes with behavioral attraction strength greater than or equal to the preset attraction threshold and which originally did not have directed edges are added as directed edges, and two flow nodes with behavioral attraction strength less than the preset attraction threshold and which originally had directed edges are deleted from the original directed edge set, resulting in a new directed edge set. The edge structure change rate between the new directed edge set and the original directed edge set is calculated. The edge structure change rate is the ratio of the number of changed edges between the new directed edge set and the original directed edge set to the total number of original directed edges, where the changed edges include newly added directed edges and deleted directed edges. Repeat the above iterative process, namely recalculating the behavior entropy flow value, updating the behavior quality value, recalculating the behavior gravity strength, adjusting the set of directed edges, and calculating the edge structure change rate, until the edge structure change rate is less than the preset convergence threshold (set in advance based on historical experience) and stop iterating. At this time, the set of directed edges tends to be stable and the structure of the flow behavior association graph reaches dynamic equilibrium. Finally, a flow behavior association graph is formed with flow nodes as vertices, directed edges corresponding to behavior gravity strength as edges, and behavior entropy flow value as the dynamic attribute of the nodes.

[0033] This approach introduces behavioral quality values ​​to characterize the multidimensional behavioral features of traffic nodes, establishes directed edges reflecting the closeness of behavioral connections between nodes based on behavioral gravity strength, and dynamically represents the information convergence and divergence roles of nodes in the network using behavioral entropy flow values. This achieves a leap from static traffic features to dynamic behavioral network associations. Through an iterative update mechanism, the edge structure adaptively adjusts with the evolution of node behavior until a dynamic equilibrium is reached. This approach can accurately capture the group behavior patterns of abnormal groups in the traffic topology, such as aggregation, synchronization, and gradient transmission. This provides a high-fidelity, adaptive network foundation for subsequent abnormal subgraph identification and abnormal risk warning, thereby significantly improving the detection capability and warning timeliness of group-related abnormal behavior.

[0034] Based on the constructed traffic behavior correlation graph, the node anomaly degree of each traffic node is calculated. The node anomaly degree is obtained by weighted fusion of three parts: the deviation of the traffic node's behavior quality value from the mean of the overall graph behavior quality value, the local inconsistency between the traffic node's behavior entropy flow value and the behavior entropy flow values ​​of its neighboring nodes, and the Mahalanobis distance between the traffic node's multidimensional feature vector and the feature centroid of the graph. Here, the weights of each part are independently determined based on the contribution of each indicator to the discriminative power of the anomaly nodes in historical anomaly samples and the experience of those in this field. The degree of deviation of the behavior quality value from the average behavior quality value of the entire graph is obtained by subtracting the arithmetic mean of the corresponding behavior quality values ​​of all traffic nodes in the entire graph from the behavior quality value of the traffic node and taking the absolute value. It reflects the extreme degree of the traffic node in the overall behavior quality distribution. The greater the deviation, the more significant the abnormality of the node's behavior and the more it deviates from the overall average level. The local inconsistency between the behavioral entropy flow value and the behavioral entropy flow value of the neighboring nodes is obtained by the absolute difference between the behavioral entropy flow value of the flow node and the average behavioral entropy flow value of all its directly connected neighboring nodes. It reflects the degree of difference between the flow node and its directly connected neighboring nodes in terms of information convergence and divergence patterns. The greater the inconsistency, the more uncoordinated the behavioral patterns of the node are with its surrounding nodes. The Mahalanobis distance between the multidimensional feature vector of the flow node and the centroid of the graph features is obtained by the covariance-weighted distance between the multidimensional feature vector of the flow node and the mean vector of the multidimensional feature vectors of the flow nodes in the whole graph. It reflects the degree of deviation of the flow node from the center of the feature distribution of the whole graph in the feature space. The Mahalanobis distance takes into account the covariance relationship between the dimensions of the features and can effectively eliminate the influence of the correlation between the dimensions of the features. The larger the distance, the more the multidimensional features of the node deviate from the normal pattern. The deviation degree, local inconsistency, and Mahalanobis distance are weighted and fused according to preset weights to obtain the node anomaly degree of the traffic node. The node anomaly degree comprehensively reflects the degree of anomaly of the traffic node in three aspects: individual behavior, local correlation, and global distribution.

[0035] Using flow nodes with an anomaly score greater than or equal to a preset anomaly threshold as seed nodes, a greedy expansion is performed based on behavioral gravity strength to form a candidate anomaly subgraph. The anomaly threshold is adaptively set based on the statistical distribution characteristics of the anomalies of all flow nodes in the entire graph. Specifically, the mean and standard deviation of the anomalies of all nodes in the graph are calculated, and the mean plus a preset multiple of the standard deviation is used as the preset anomaly threshold. The greedy expansion process is as follows: starting from the seed node, the expansion proceeds gradually along the direction of the directed edge with the greatest behavioral gravity strength, incorporating the next flow node pointed to by the current flow node into the candidate anomaly subgraph. During the expansion process, the changes in the behavioral gravity strength of each edge along the expansion path are monitored. When the behavioral gravity strength of each edge along the expansion path monotonically decreases along the expansion path direction, it indicates that the behavioral gravity on the expansion path is gradually weakening. Simultaneously, the behavioral entropy flow value of the flow node at the end of the expansion path is monitored in relation to the behavioral entropy flow value of the seed node. When the signs of their behavioral entropy flow values ​​are opposite, it indicates that the information convergence and divergence pattern of the node at the end of the expansion path is fundamentally different from that of the seed node, and the expansion should terminate. At this point, the candidate anomaly subgraph is formed by the seed node and all nodes traversed along the expansion path. Synchronization tests are performed on each candidate anomaly subgraph to filter those with collaborative behavior characteristics. The similarity of session behavior features among traffic nodes within each candidate anomaly subgraph within the same time window is calculated. This similarity is obtained by comparing the similarity of the operation transition Markov matrix, page jump path directed graph, dwell time distribution characteristics, and mouse trajectory entropy characteristics of each traffic node within the candidate anomaly subgraph. Specifically, the matrix element difference of the operation transition Markov matrix of each traffic node is calculated (calculating the mean absolute difference between corresponding elements in the operation transition Markov matrices of two traffic nodes), the node set overlap rate of the page jump path directed graph is calculated (calculating the ratio of the intersection to the union of the node sets of the page jump path directed graphs of two traffic nodes), and the multi-scale quantile difference of the dwell time distribution characteristics is calculated (calculating the multi-scale quantile difference of the dwell time distribution characteristics of two traffic nodes). The absolute difference between the mean absolute difference of the position corresponding to the number of bits and the absolute difference of the mouse trajectory entropy feature (calculated by the sum of the absolute differences between the mouse trajectory curvature entropy and the two-dimensional Shannon entropy of the joint distribution of velocity-acceleration between two traffic nodes) is weighted and fused and the reciprocal is taken. Here, the weights of each are independently determined based on the discriminative contribution of each difference measure in historical abnormal samples and the experience of those in the field, to obtain the similarity of the session behavior features. When the similarity of the session behavior features is greater than or equal to the preset synchronization threshold, it indicates that each traffic node in the candidate abnormal subgraph exhibits a highly consistent collaborative mode at the session behavior level, and the candidate abnormal subgraph is determined to have synchronization. The candidate abnormal subgraph that passes the synchronization test is recorded as the initial screening candidate abnormal subgraph. Here, the preset synchronization threshold is based on the distribution statistics of the similarity between historical normal traffic samples and session behavior features, and the upper quantile of the normal sample distribution is taken as the synchronization threshold. Gradient transportability testing is performed on each initial candidate anomaly subgraph to identify anomaly subgraphs with information transport paths. First, the boundary nodes of the initial candidate anomaly subgraphs are determined. Boundary nodes are those whose outgoing edges point to external flow nodes or have no outgoing edges. Specifically, all flow nodes within the initial candidate anomaly subgraph are traversed, and the outgoing edges of each flow node are checked. If a flow node's outgoing edge points to a flow node outside the initial candidate anomaly subgraph, or if the flow node has no outgoing edges, then that flow node is a boundary node. Then, starting from the seed node, the traversal proceeds along the directed edge direction to the boundary node. The traversal process follows the direction of the directed edges, gradually moving from the seed node to the boundary node, forming a gradient transport path. The traversal path from the seed node to the boundary node is calculated. The difference in behavioral entropy flow value between adjacent flow nodes on the traversal path is calculated as the difference between the behavioral entropy flow value of the next flow node and the behavioral entropy flow value of the previous flow node, reflecting the trend of the behavioral entropy flow value along the traversal path. When there is a traversal path from the seed node to the boundary node such that the difference in behavioral entropy flow value between all adjacent nodes on the traversal path is positive, it indicates that the behavioral entropy flow value from the seed node to the boundary node increases along the traversal path. That is, the behavioral entropy flow value of the seed node is the minimum and the behavioral entropy flow value of the boundary node is the maximum, forming a gradient transmission path from the information convergence center to the information divergence edge. At this time, the corresponding initial screening candidate anomaly subgraph is determined to pass the gradient transmission test. All preliminary candidate anomalous subgraphs that pass the gradient transitivity test are merged to obtain a candidate set of anomalous subgraphs. The node overlap rate between any two anomalous subgraphs in the candidate set is calculated. The node overlap rate is the ratio of the number of intersections of traffic nodes to the number of unions of traffic nodes in the two anomalous subgraphs, reflecting the degree of overlap between the two anomalous subgraphs at the node level. When the node overlap rate is greater than or equal to a preset overlap threshold (the preset overlap threshold is statistically set based on the average node overlap rate between anomalous subgraphs in historically confirmed anomalous group cases), it indicates that the two anomalous subgraphs have significant node sharing and may belong to the same anomalous group. Different expansion paths of the group need to be deduplicated. The deduplication rule is as follows: retain the abnormal subgraph with a high aggregation abnormality and delete the other abnormal subgraph. The aggregation abnormality of the subgraph reflects the overall risk level of the abnormal subgraph. The higher the aggregation abnormality of the subgraph, the more significant the risk of the abnormal subgraph, and it should be retained. After the overlap verification process, the final abnormal subgraph structure is obtained. At this time, the abnormal subgraph structure is a set of abnormal subgraphs that have passed the triple screening of synchronization test, gradient transmission test and overlap verification. Each abnormal subgraph structure represents a potential abnormal group with clustering, synchronization and gradient transmission characteristics.

[0036] The subgraph aggregation anomaly degree of each flow node corresponding to the abnormal subgraph structure is calculated. This degree is obtained by weighting and fusing four components: the average node anomaly degree of each flow node within the abnormal subgraph structure; the coefficient of variation of the behavioral attraction strength within the abnormal subgraph structure (obtained by calculating the ratio of the standard deviation to the mean of the behavioral attraction strength of all directed edges within the abnormal subgraph structure); the ratio of the sum of the behavioral entropy flow values ​​of all flow nodes within the abnormal subgraph structure to the sum of the behavioral entropy flow values ​​of the entire graph; and the ratio of the number of flow nodes within the abnormal subgraph structure to the number of flow nodes in the entire graph. The weighting coefficients for each component can be extracted and determined based on the experience of those in the field. The weighted average node anomaly degree of each flow node within the abnormal subgraph structure reflects the average anomaly degree of all flow nodes within the abnormal subgraph structure. Flow nodes with higher anomaly degrees receive greater weight in the weighted average, thus increasing the weight of nodes with prominent anomalies in the subgraph aggregation. The contribution of anomaly degree is more significant; the coefficient of variation of the behavioral gravity intensity within the anomaly subgraph structure reflects the dispersion of the behavioral gravity intensity of each directed edge within the anomaly subgraph structure. The larger the corresponding coefficient of variation, the more significant the difference in the correlation strength within the anomaly subgraph structure, and the possible hierarchical differentiation between core nodes and edge nodes; the ratio of the sum of behavioral entropy flow values ​​of all traffic nodes within the anomaly subgraph structure to the sum of behavioral entropy flow values ​​of the entire graph reflects the proportion of the anomaly subgraph structure in the total amount of information convergence and divergence in the entire network. The larger the ratio, the stronger the influence of the anomaly subgraph structure on information activities in the entire network; the ratio of the number of traffic nodes within the anomaly subgraph structure to the number of traffic nodes in the entire graph reflects the scale proportion of the anomaly subgraph structure. The larger the ratio, the larger the scale of nodes involved in the anomaly subgraph structure; the subgraph aggregation anomaly degree comprehensively reflects the overall risk level of the anomaly subgraph structure in four aspects: individual anomaly, correlation strength, information activity, and group size.

[0037] Then, a pre-defined two-layer anomaly penetration model is used to integrate the node anomaly degree of each traffic node with the subgraph aggregation anomaly degree to obtain the fused anomaly degree. The two-layer anomaly penetration model comprises two levels: node-level anomaly penetration and subgraph-level anomaly penetration. Specifically, the first level, node-level anomaly penetration, defines the direct output rule for node anomaly degree in isolated node scenarios. That is, for traffic nodes that do not belong to any anomaly subgraph structure, their node anomaly degree is directly used as the fused anomaly degree without subgraph-level correction. The second level, subgraph-level anomaly penetration, defines the coupling rule between node anomaly degree and subgraph aggregation anomaly degree. For a traffic node belonging to an abnormal subgraph structure, the larger of the node's anomaly degree and the aggregate anomaly degree of the corresponding subgraph structure is taken as the basic anomaly value. Then, the number of incoming and outgoing edges of the traffic node within its abnormal subgraph structure is counted, and the sum of these is used as the node's centrality value. A larger centrality value indicates a denser connection between the node and other nodes in the abnormal subgraph structure, placing it in a more central position. The enhancement magnitude is determined based on the centrality value, specifically by averaging the centrality value with the center of all traffic nodes within the abnormal subgraph structure. The ratio of the maximum value of the anomaly location is used as the centrality coefficient, which is between zero and one. The larger the centrality coefficient, the closer the node is to the core of the anomaly subgraph structure, and the greater the enhancement. Finally, the basic anomaly value is multiplied by a weighted combination of an enhancement coefficient and the centrality coefficient, which is preset based on experience, to obtain the fusion anomaly degree of the traffic node. The preset enhancement coefficient is statistically set based on the contribution of core nodes to the group risk in historical anomaly samples. The weighted combination value is calculated using a linear weighting method, and the weights are preset based on experience in this field. The above node-layer anomaly penetration rules are combined with the subgraph anomaly rules. Common penetration rules are combined to form a preset two-layer anomaly penetration model. The corresponding fusion anomaly degree is obtained through the two-layer anomaly penetration model. Then, the fusion anomaly degrees of all traffic nodes are sorted from largest to smallest to generate traffic anomaly pattern recognition results. The traffic anomaly pattern recognition results are a list of traffic nodes arranged by risk priority, including the identification information of each traffic node, fusion anomaly degree value, risk ranking position, identification of the anomaly subgraph structure to which it belongs (if any), and anomaly type attribution information. The higher the fusion anomaly degree, the higher the position of the traffic node in the ranking, indicating that its anomaly risk is more significant and should be dealt with first.

[0038] This approach, employing a triple check of clustering, synchronicity, and gradient propagation to identify anomalous subgraph structures, effectively captures the group collaboration characteristics of anomalous groups in network traffic, significantly enhancing the detection capability of group-based anomalous behavior. Simultaneously, a two-layer anomaly penetration model nonlinearly couples node anomaly degree with subgraph aggregate anomaly degree, allowing individual and group risks to mutually reinforce each other. This achieves a leap from single-point anomaly identification to group anomaly identification. The final generated fused anomaly degree is ranked according to risk priority, providing security operations personnel with refined risk handling guidance, effectively shortening manual assessment time and improving the efficiency of anomaly risk handling.

[0039] S3. Based on the traffic anomaly pattern recognition results, combined with the preset abnormal behavior knowledge graph, calculate the probability of anomaly type attribution and the intensity of anomaly risk corresponding to each traffic node, obtain the historical risk records and related transaction amounts of each traffic node, and calculate the comprehensive anomaly risk index of each traffic node by combining the probability of anomaly type attribution and the intensity of anomaly risk, and generate the quantitative assessment result of anomaly risk.

[0040] The method for calculating the comprehensive anomaly risk index of each traffic node is as follows: extract the fusion anomaly degree of each traffic node, combine the subgraph aggregation anomaly degree and the corresponding traffic multidimensional feature vector, and construct the anomaly pattern feature vector of each traffic node. Based on a pre-defined abnormal behavior knowledge graph, the abnormal pattern feature vectors of each abnormal pattern are extracted, the pattern entanglement strength between the abnormal pattern feature vectors of each traffic node and the feature vectors of each abnormal pattern is calculated, and the probability of the traffic node being assigned to the abnormal type of each abnormal pattern is determined. Based on the probability of the abnormal type being assigned, the abnormal risk intensity of each traffic node is calculated. Based on the historical risk records and related transaction amounts of traffic nodes, historical risk attenuation factors and transaction amount risk amplification factors are generated respectively. Based on the abnormal risk intensity, historical risk attenuation factors and transaction amount risk amplification factors, the comprehensive abnormal risk index of each traffic node is calculated through a pre-constructed risk potential energy field model. The method for generating the quantitative assessment results of abnormal risks is as follows: based on the comprehensive abnormal risk index of each traffic node, a risk potential energy field distribution map is constructed; the potential energy receiving value of each traffic node in the risk potential energy field distribution map is calculated. Based on the risk potential energy field distribution map, risk clustering is performed on each traffic node to form multiple risk clusters; risk homogeneity test is performed on each risk cluster, and the risk clusters that pass the risk homogeneity test are recorded as risk homogeneous clusters; Based on each risk homogeneous cluster, the cluster risk equivalent of each risk homogeneous cluster and the deviation of each flow node from the potential energy center in its respective risk homogeneous cluster are calculated; based on the comprehensive abnormal risk index, cluster risk equivalent and potential energy center deviation, the abnormal risk quantitative assessment results of the flow nodes are generated.

[0041] Specifically, based on the traffic anomaly pattern recognition results, the fusion anomaly degree of each traffic node is extracted. Then, according to the subgraph aggregation anomaly degree of the anomaly subgraph structure to which the traffic node belongs and the traffic multidimensional feature vector corresponding to the traffic node, the fusion anomaly degree, subgraph aggregation anomaly degree, and traffic multidimensional feature vector are concatenated and combined to form the anomaly pattern feature vector of the traffic node. The anomaly pattern feature vector not only contains the individual risk information of the traffic node, but also the risk information of the group to which it belongs and the original multidimensional feature information, providing comprehensive feature input for subsequent pattern matching with the abnormal behavior knowledge graph.

[0042] Based on a pre-defined abnormal behavior knowledge graph, feature vectors for each abnormal pattern are extracted. This pre-defined knowledge graph is constructed as follows: Based on historically confirmed abnormal transaction case data, it is extracted through expert experience or machine learning to form a structured knowledge base containing abnormal pattern entities and their relationships. Nodes represent various abnormal patterns, covering typical types such as fraudulent order placement, fake registration, account theft, malicious cash-out, and group money laundering. Each node stores the abnormal behavior feature rules, historical case feature distribution, and a pre-defined risk baseline for the corresponding abnormal pattern. Edges represent the relationships between abnormal patterns, characterizing the collaborative or transformation paths of different abnormal patterns in behavioral chains, fund flows, or organizational structures. This knowledge graph is pre-built and regularly updated before system deployment, serving as a benchmark for subsequent abnormal type matching and risk quantification. Abnormal behavior feature rules define typical behavioral patterns for each abnormal pattern, such as the high-frequency repetitive operation pattern of fraudulent order placement and the batch registration behavior pattern of fake registration. The historical case feature distribution records the feature distribution of each abnormal pattern in historically confirmed cases, including comprehensive abnormal risk. Exponential distribution, abnormal pattern feature distribution, etc.; the correlation between abnormal patterns describes the degree of correlation between each abnormal pattern, such as the correlation path between account theft and malicious cash-out, the synergistic relationship between group money laundering and abnormal order brushing, etc.; based on the abnormal behavior feature rules and historical case feature distribution, a corresponding abnormal pattern feature vector is constructed for each abnormal pattern. The abnormal pattern feature vector contains the typical behavioral features, historical risk distribution features, and correlation features of the abnormal pattern, which is used for pattern matching with the abnormal pattern feature vector of the traffic node; then, the pattern entanglement strength between the abnormal pattern feature vector of each traffic node and the abnormal pattern feature vector of each abnormal pattern is calculated. The pattern entanglement strength is obtained by weighted fusion of: the product of the fusion anomaly degree of the traffic node and the historical activation frequency of the abnormal pattern, the feature consistency measure of the abnormal pattern feature vector of the traffic node and the abnormal pattern feature vector of the abnormal pattern, and the subgraph aggregation anomaly degree of the abnormal subgraph structure to which the traffic node belongs and the distribution deviation of the historical case feature distribution of the abnormal pattern. The weights of each are pre-determined based on the experience of those in the field, where: The product of the fusion anomaly degree of the traffic node and the historical activation frequency of the anomaly pattern is obtained by multiplying the fusion anomaly degree of the traffic node by the proportion of the historical activation frequency of the anomaly pattern in the anomaly behavior knowledge graph. This reflects the strength of the correlation between the individual anomaly degree of the traffic node and the historical activity level of the anomaly pattern. A higher fusion anomaly degree indicates a more anomalous traffic node, and a higher historical activation frequency indicates that the anomaly pattern has appeared more frequently in history. Therefore, a larger product indicates a stronger entanglement between the traffic node and the anomaly pattern. The feature consistency measure between the anomaly pattern feature vector of the traffic node and the anomaly pattern feature vector of the anomaly pattern is obtained by calculating the mean of the absolute values ​​of the differences between the corresponding dimensional elements of the two vectors, taking the reciprocal, and normalizing. This reflects the similarity between the two in the feature space. The feature consistency measure compares the anomaly pattern feature vector with the anomaly pattern feature vector. The distribution differences of the feature vectors of the normal pattern across various dimensions are obtained. The smaller the difference, the higher the feature consistency measure, indicating that the abnormal pattern of the traffic node matches the typical features of the abnormal pattern more closely. The distribution deviation between the subgraph aggregation anomaly degree of the abnormal subgraph structure to which the traffic node belongs and the distribution of the historical case features of the abnormal pattern is obtained by calculating the absolute difference between the subgraph aggregation anomaly degree of the abnormal subgraph structure to which the traffic node belongs and the mean of the distribution of the subgraph aggregation anomaly degree of the corresponding historical cases of the abnormal pattern. This reflects the degree of deviation between the overall anomaly degree of the group to which the traffic node belongs and the distribution of the historical case features of the abnormal pattern. The smaller the distribution deviation, the closer the overall anomaly characteristics of the group are to the historical case features of the abnormal pattern. The pattern entanglement strength comprehensively reflects the degree of correlation between the traffic node and the abnormal pattern at three levels: individual anomaly, feature similarity, and group distribution.

[0043] Based on the calculated pattern entanglement strength, the probability of anomaly type attribution for each anomalous pattern to the traffic node is determined. Specifically, the pattern entanglement strength of the traffic node for all anomalous patterns is normalized, mapping each pattern entanglement strength to its corresponding probability interval. The normalized pattern entanglement strength is the probability of anomaly type attribution for the traffic node to each anomalous pattern. The higher the probability of anomaly type attribution, the greater the likelihood that the traffic node belongs to that anomalous pattern. Then, based on the probability of anomaly type attribution, the anomalous risk intensity of each traffic node is calculated. The anomalous risk intensity is the product of the pattern entanglement strength corresponding to the anomalous pattern with the highest probability of anomaly type attribution for the traffic node and the preset risk base value for that anomalous pattern, plus the attenuation value of the anomalous pattern with the second highest probability of anomaly type attribution for the traffic node. Specifically, the product of the pattern entanglement strength corresponding to the second highest probability of anomaly type attribution and the preset risk base value is divided by... The attenuation value is obtained by adding one to the number of edges of the shortest path between two anomalous patterns in the knowledge graph. The preset risk base value is the baseline risk value pre-set for each anomalous pattern in the anomalous behavior knowledge graph, reflecting the inherent harm level of the anomalous pattern. Different anomalous patterns have different preset risk base values. For example, the preset risk base value for money laundering gangs is greater than or equal to that for fraudulent transactions. The attenuation value is determined by the path distance between the two corresponding anomalous patterns in the anomalous behavior knowledge graph. The path distance is the number of edges of the shortest path between the two anomalous patterns in the anomalous behavior knowledge graph. The greater the path distance, the greater the attenuation value, indicating that the contribution of the second-highest attributable anomalous pattern to the overall risk intensity weakens as the distance increases. The anomalous risk intensity comprehensively reflects the superimposed risk of the traffic node on the highest and second-highest attributable anomalous patterns. The contribution of the second-highest attributable anomalous pattern is attenuated according to the path distance, reflecting the impact of the anomalous pattern association on the risk superposition.

[0044] Based on the historical risk records of traffic nodes, a historical risk attenuation factor is generated. The historical risk record is a record of risk events that occurred at the traffic node over a past period, including the type of risk event, the time of occurrence, and the handling result. Based on the historical risk record, a historical risk attenuation function is constructed. This function uses the time interval from the most recent risk event at the traffic node to the current time as the independent variable, and a preset half-life parameter as the attenuation coefficient, outputting the historical risk attenuation factor. The historical risk attenuation function calculates the natural exponential function value using the negative of the ratio of the time interval to the half-life parameter as the exponent, outputting the historical risk attenuation factor. The longer the time interval, the smaller the historical risk attenuation factor, indicating that the impact of historical risk events on the current risk attenuates over time. The smaller the half-life parameter, the faster the attenuation rate, indicating that the impact of historical risk events fades more quickly. The historical risk attenuation factor reflects the time-dimensional attenuation effect of historical risk events on the current comprehensive abnormal risk index. Based on the associated transaction amounts of traffic nodes, a transaction amount risk amplification factor is generated. The associated transaction amount is the sequence of transaction amounts associated with that traffic node, including the amount of each transaction, transaction frequency, and transaction time distribution. Based on the associated transaction amounts, a transaction amount risk amplification function is constructed. This function takes the transaction amount sequence associated with that traffic node as input, calculates the weighted product of the coefficient of variation of the transaction amount sequence and the peak factor, and outputs the transaction amount risk amplification factor. The coefficient of variation of the transaction amount sequence is the ratio of the standard deviation to the mean of the transaction amount sequence, reflecting the degree of fluctuation in transaction amounts. A larger coefficient of variation indicates more drastic fluctuations in transaction amounts and a stronger risk amplification effect. The peak factor is the ratio of the maximum value to the mean in the transaction amount sequence, reflecting the extreme nature of transaction amounts. A larger peak factor indicates the presence of large abnormal transactions and a stronger risk amplification effect. The transaction amount risk amplification factor reflects the spatial dimension amplification effect of associated transaction amounts on the comprehensive abnormal risk index. Based on the abnormal risk intensity, historical risk decay factor, and transaction amount risk amplification factor of each traffic node, a comprehensive abnormal risk index is calculated using a risk potential energy field model. This model uses the abnormal risk intensity as the risk potential energy, the historical risk decay factor as the potential energy decay coefficient in the time dimension, and the transaction amount risk amplification factor as the potential energy amplification coefficient in the spatial dimension. The comprehensive abnormal risk index is the potential energy value of the risk potential energy after time decay and spatial amplification; specifically, it is the product of the abnormal risk intensity, the historical risk decay factor, and the transaction amount risk amplification factor. In particular, the higher the abnormal risk intensity... The higher the risk potential energy, the higher the base value of the comprehensive abnormal risk index; the smaller the historical risk decay factor, the more significant the potential energy decay in the time dimension, and the lower the comprehensive abnormal risk index becomes over time; the larger the transaction amount risk amplification factor, the more significant the potential energy amplification in the spatial dimension, and the higher the comprehensive abnormal risk index becomes with the fluctuation and extreme nature of the transaction amount; by dynamically coupling the abnormal risk intensity, historical risk decay factor, and transaction amount risk amplification factor through the risk potential energy field model, the comprehensive abnormal risk index of the flow node is obtained; the comprehensive abnormal risk index comprehensively reflects the degree of comprehensive abnormal risk of the flow node at the current moment and in the current trading environment.

[0045] Then, based on the comprehensive anomaly risk index of each flow node, a risk potential energy field distribution map is constructed. This map uses each flow node as the source point, the comprehensive anomaly risk index as the source intensity, and the behavioral gravitational strength between flow nodes as the field conduction coefficient. The potential energy received value of each flow node in the risk potential energy field distribution map is calculated. This received value is the sum of the source intensity of the flow node itself and the source intensity of neighboring flow nodes after attenuation by the field conduction coefficient. Specifically, neighboring flow nodes are flow nodes connected to the flow node by behavioral gravitational strength, and the field conduction coefficient is the behavioral gravitational strength. The normalized value is the sum of the field source strength after attenuation by the field conduction coefficient. The sum of the sum of the comprehensive abnormal risk index of the neighboring flow nodes is multiplied by the normalized value of the behavioral gravitational strength between the two nodes. Here, the normalization process adopts the maximum-minimum normalization method. For example, the behavioral gravitational strength between each flow node is subtracted from the minimum value and then divided by the difference between the maximum and minimum values, which is mapped to the interval of 0 to 1 to obtain the corresponding field conduction coefficient. The potential energy received value reflects that the flow node is not only affected by its own risk, but also by the superposition effect of the risk of neighboring nodes after correlation conduction, which reflects the diffusion effect of risk in the node network.

[0046] Based on the risk potential energy field distribution map, risk clustering is performed on each flow node to form multiple risk clusters. Flow nodes with potential energy received values ​​greater than or equal to a preset potential energy threshold (the preset potential energy threshold is set based on the sum of the mean and standard deviation of the potential energy received values ​​of all flow nodes in the entire map, i.e., the upper statistical bound is used as the anomaly judgment criterion) are designated as core nodes. Potential energy clustering is expanded using the field conduction coefficient. The expansion process starts from the core node and gradually incorporates neighboring nodes along the connection direction with the largest field conduction coefficient, forming risk clusters. When the field conduction coefficient on the expansion path monotonically decreases and the potential energy received value of the flow node at the end of the expansion path is equal to the threshold value, the risk clustering is further expanded. When the ratio of the potential energy received by the core node is less than the preset potential energy ratio threshold, it indicates that the risk potential energy of the terminal node of the expansion path has significantly decreased and its risk correlation with the core node is weak, thus terminating the expansion. A risk homogenization test is performed on each risk cluster, and the coefficient of variation of the comprehensive abnormal risk index of each flow node within the risk cluster is calculated. The coefficient of variation is the ratio of the standard deviation to the mean of the comprehensive abnormal risk index of each flow node within the risk cluster, reflecting the degree of dispersion of risk among nodes within the risk cluster. When the coefficient of variation is less than the preset homogenization threshold (the preset homogenization threshold is based on the comprehensive risk index of historically confirmed abnormal groups within the risk cluster), the risk homogenization is considered to be attenuated. When the coefficient of variation of the abnormal risk index is taken as the threshold (using the quantile value that minimizes the misclassification rate), it indicates that the comprehensive abnormal risk index distribution of each flow node within the risk cluster is relatively concentrated, and the risk characteristics are highly similar. This indicates that the risk cluster has risk homogenization characteristics, and the risk clusters that pass the risk homogenization test are identified as risk homogeneous clusters. Based on each risk homogeneous cluster, the cluster risk equivalent is calculated. The cluster risk equivalent is the product of the weighted value of the comprehensive abnormal risk index of each flow node within the risk homogeneous cluster and the logarithmic transformation value of the number of flow nodes within the risk homogeneous cluster. In the weighted value, each flow node... The weight of a node is determined based on its potential energy receiving value within the risk homogeneous cluster. Nodes with higher potential energy receiving values ​​have greater weights, ensuring that nodes with significant risk contributions are more representative in the average calculation. The logarithmic transformation value is the result of taking the natural logarithm of the number of flow nodes within the risk homogeneous cluster. Logarithmic transformation is used instead of nonlinear counting because the growth of group risk has a nonlinear characteristic, and the risk increment brought about by the increase in the number of nodes decreases as the scale expands. The cluster risk equivalent comprehensively reflects the average risk level of the risk homogeneous cluster and the group size effect. The higher the cluster risk equivalent, the more significant the overall risk of the risk homogeneous cluster.

[0047] Calculate the potential energy center deviation of each traffic node in its respective risk homogeneous cluster. The potential energy center is the virtual center point corresponding to the average value of the potential energy received by all traffic nodes in the risk homogeneous cluster. The potential energy center deviation is the absolute difference between the potential energy received value of the traffic node and the potential energy center, which is the value after normalization processing of the difference between the maximum and minimum potential energy received values ​​in the risk homogeneous cluster. The potential energy center deviation reflects the relative position of the traffic node in its respective risk homogeneous cluster. The larger the deviation, the more the node deviates from the risk center of the risk homogeneous cluster, and it may be a marginal node or an abnormally prominent node in the group.

[0048] Finally, based on the comprehensive abnormal risk index of each traffic node, the cluster risk equivalent of its risk homogeneous cluster, and the deviation of the traffic node from the potential energy center in its risk homogeneous cluster, a quantitative assessment result of the abnormal risk of the traffic node is generated. The quantitative assessment result of the abnormal risk includes the comprehensive abnormal risk index value (reflecting the individual comprehensive risk level of the traffic node), the risk homogeneous cluster identifier (indicating the group risk category to which the traffic node belongs), the cluster risk equivalent value (reflecting the overall risk level of the group to which the traffic node belongs), the probability distribution of abnormal type attribution (listing the probability of the traffic node attributing to each abnormal pattern, with the abnormal pattern with the highest probability being the main suspected type), the risk urgency level label (determined according to the coupling relationship between the comprehensive abnormal risk index and the cluster risk equivalent, divided into four levels: general urgency, relatively high urgency, high urgency, and emergency), and the suggested handling strategy code (matching the corresponding handling measure code from the preset handling strategy library according to the risk urgency level label and the probability distribution of abnormal type attribution, including strategies such as observation and monitoring, enhanced verification, transaction restriction, and account freezing).

[0049] This approach, by constructing anomaly pattern feature vectors and calculating the pattern entanglement strength of anomaly pattern feature vectors in anomaly behavior knowledge graphs, achieves a precise mapping from traffic anomaly patterns to specific anomaly types. This solves the problem of traditional methods being disconnected from anomaly patterns and anomaly types, and unable to locate specific anomaly behaviors. By introducing a risk potential energy field model to spatiotemporally couple anomaly risk intensity, historical risk decay factor, and transaction amount risk amplification factor, the comprehensive anomaly risk index not only reflects the current degree of anomaly but also takes into account the time decay effect of historical risks and the spatial amplification effect of transaction scale, achieving dynamic and comprehensive risk quantification. By constructing a risk potential energy field distribution map and performing risk clustering and homogeneity testing, the risk assessment of isolated nodes is extended to the group assessment of risk homogeneous clusters. The introduction of cluster risk equivalent and potential energy center deviation enables differentiated characterization of group risk and individual position. The final anomaly risk quantification assessment results include multi-dimensional information such as comprehensive anomaly risk index, cluster risk equivalent, anomaly type attribution probability distribution, risk urgency level, and recommended handling strategies. This provides security operations personnel with a complete basis from risk identification to handling decisions, significantly improving the accuracy and operability of transaction anomaly risk early warning.

[0050] S4. Based on the quantitative assessment results of abnormal risks, a two-dimensional risk assessment matrix is ​​constructed using the comprehensive abnormal risk index and the probability of abnormal type attribution. The risks are divided into four warning levels, and corresponding graded warning strategy reports are generated for risks of different warning levels according to the preset warning response scheme library.

[0051] The method for constructing the two-dimensional risk assessment matrix is ​​as follows: extract the comprehensive abnormal risk index and the probability of abnormal type attribution for each traffic node, construct an initial two-dimensional risk coordinate plane, and mark the risk coordinate points of each traffic node on the initial two-dimensional risk coordinate plane; Based on the historical risk distribution density of each abnormal pattern in the pre-set abnormal behavior knowledge graph, a risk density potential field is constructed on the initial two-dimensional risk coordinate plane; the initial two-dimensional risk coordinate plane is divided into several risk attraction domains, and each risk attraction domain corresponds to a candidate area for early warning level. Based on the average comprehensive abnormal risk index and the average probability of abnormal type attribution of all traffic nodes in each risk attraction domain, the risk attraction domain is mapped to four early warning levels. The risk coordinates of each traffic node are projected onto the mapped warning level to determine the warning level of each traffic node, forming a two-dimensional risk assessment matrix. The average comprehensive abnormal risk index is compared with multiple preset risk thresholds to obtain the corresponding risk index level, and the average probability of abnormal type classification is compared with multiple preset probability thresholds to obtain the corresponding probability level. The higher of the risk index level and the probability level is taken as the final warning level classification. The method for generating corresponding graded early warning strategy reports for risks of different early warning levels is as follows: Based on a two-dimensional risk assessment matrix, extract the early warning level attribution, comprehensive abnormal risk index, probability distribution of abnormal type attribution, and cluster risk equivalent of the risk homogeneous cluster to which each traffic node belongs; Based on a pre-set early warning response scheme library, the corresponding response measure template is matched according to the early warning level of each traffic node and the anomaly pattern with the highest probability of corresponding anomaly type. The early warning response plan library includes response measure templates for four early warning levels: observation level, early warning level, interception level and emergency response level. Each response measure template includes a description of abnormal behavior location, risk level description text, response priority, a list of recommended response measures and an estimated loss range. Based on the comprehensive abnormal risk index of each traffic node, the priority of handling is determined in the matching response measure template. Based on the cluster risk equivalent of the risk homogeneous cluster to which each traffic node belongs, the range of estimated loss scale is adjusted in the matching response measure template. The report generates a tiered early warning strategy report for each traffic node by combining the early warning level classification, abnormal behavior location description, risk level description text, priority ranking of handling, recommended response measures list, and adjusted estimated loss range.

[0052] Specifically, the comprehensive anomaly risk index and anomaly type attribution probability of each traffic node are first extracted. An initial two-dimensional risk coordinate plane is constructed with the comprehensive anomaly risk index as the horizontal axis and the anomaly type attribution probability as the vertical axis. The initial two-dimensional risk coordinate plane is arranged from left to right with the comprehensive anomaly risk index in ascending order and from bottom to top with the anomaly type attribution probability in ascending order, forming a coordinate space covering the risk distribution of all traffic nodes. The risk coordinate points of each traffic node are marked on the initial two-dimensional risk coordinate plane. Each traffic node corresponds to one risk coordinate point. The horizontal axis of the point is the comprehensive anomaly risk index value of the traffic node, and the vertical axis is the anomaly type attribution probability value of the traffic node. Through the distribution of risk coordinate points, the aggregation and dispersion of all traffic nodes in the risk space can be observed intuitively.

[0053] Based on the historical risk distribution density of each abnormal pattern in the pre-defined abnormal behavior knowledge graph, a risk density potential field is constructed on the initial two-dimensional risk coordinate plane. The abnormal behavior knowledge graph covers typical abnormal patterns such as fraudulent transactions, fake registrations, account theft, malicious cash-out, and group money laundering. Each abnormal pattern has accumulated a large amount of comprehensive abnormal risk index distribution and abnormal type attribution probability distribution data in historical cases. The risk density potential field uses the comprehensive abnormal risk index distribution of each abnormal pattern in historical cases as the potential field source in the horizontal direction and the abnormal type attribution probability distribution as the potential field source in the vertical direction. Specifically, the comprehensive abnormal risk index value and abnormal type attribution probability value of each abnormal pattern in historically confirmed cases are collected to form a historical risk distribution sample set. Through the kernel density estimation method, based on the historical risk distribution sample... The dataset generates a continuous risk density equipotential line distribution. Kernel density estimation, centered on each historical risk sample point, calculates the density contribution of the surrounding area using a kernel function. The density contributions of all sample points are then superimposed to form a smooth, continuous risk density distribution surface. Risk density equipotential lines are lines connecting points with equal risk density values. Regions with denser equipotential lines indicate a more concentrated distribution of historical risk samples and a higher risk density in that region. Therefore, the risk density potential field reflects the distribution pattern of historical abnormal cases in the two-dimensional space of the comprehensive abnormal risk index and the probability of abnormal type attribution, providing a density basis for subsequent risk attraction domain division. Based on the risk density potential field, the initial two-dimensional risk coordinate plane is divided into several risk attraction domains, each corresponding to a candidate area for a warning level. The specific division process is as follows: Local density maxima in the risk density equipotential line distribution are identified as risk clustering cores. These local density maxima are points with risk density values ​​greater than or equal to those of the surrounding area, indicating a high concentration of historical risk samples in that region, representing a typical risk pattern center for abnormal behavior. Using these risk clustering cores as the center and the risk density saddles between adjacent risk clustering cores as the boundaries, the initial two-dimensional risk coordinate plane is divided into several risk attraction domains. The risk density saddles are the regions with the lowest risk density between two adjacent risk clustering cores, serving as natural boundaries distinguishing different risk clustering cores. Dividing risk attraction domains by using saddles as boundaries ensures that risk coordinate points within each risk attraction domain cluster around a single risk clustering core, clearly defining the boundaries between different risk attraction domains. Each risk attraction domain corresponds to a candidate area for an early warning level. Traffic nodes within a risk attraction domain exhibit similar comprehensive abnormal risk indices and anomaly type attribution probability characteristics, indicating that these nodes may belong to the same risk level category.

[0054] Based on the average comprehensive anomaly risk index and the average probability of anomaly type attribution for each traffic node within the risk attraction domain, the risk attraction domain is mapped to four preset warning levels: observation, early warning, interception, and emergency response. The average comprehensive anomaly risk index is the arithmetic mean of the comprehensive anomaly risk indices of all traffic nodes within the risk attraction domain, reflecting the overall risk level of the domain. The average probability of anomaly type attribution is the arithmetic mean of the probability of anomaly type attribution for all traffic nodes within the risk attraction domain, reflecting the degree of certainty regarding anomaly types within the domain. A first risk threshold, a second risk threshold, and a third risk threshold are preset. The risk thresholds consist of a first probability threshold, a second probability threshold, and a third probability threshold. These six thresholds are dynamically and adaptively determined based on the equipotential line distribution of the risk density potential field, rather than being fixed presets. Specifically, the risk density distribution is divided into four intervals according to the density of the equipotential lines. The boundary points of each interval are the corresponding thresholds. Regions with dense equipotential lines correspond to lower risk and probability thresholds, while regions with sparse equipotential lines correspond to higher risk and probability thresholds, ensuring that the threshold division aligns with the natural structure of historical risk distributions. The specific mapping rules are as follows: When the average comprehensive anomaly risk index is less than the first risk threshold and the average probability of anomaly type attribution is less than the first probability threshold, it indicates that the comprehensive risk of traffic nodes in the risk attraction domain is low and the certainty of anomaly type is weak. The corresponding risk attraction domain is mapped to the observation level. The observation level means that the traffic nodes in this area need to be continuously observed and do not need to be actively intervened for the time being. When the average comprehensive abnormal risk index is less than the first risk threshold, the risk index level is determined to be observation level; when the average comprehensive abnormal risk index is greater than or equal to the first risk threshold and less than the second risk threshold, the risk index level is determined to be warning level; when the average comprehensive abnormal risk index is greater than or equal to the second risk threshold and less than the third risk threshold, the risk index level is determined to be interception level; when the average comprehensive abnormal risk index is greater than or equal to the third risk threshold, the risk index level is determined to be emergency response level. When the average probability of an anomaly type is less than the first probability threshold, the probability level is determined to be observation level; when the average probability of an anomaly type is greater than or equal to the first probability threshold and less than the second probability threshold, the probability level is determined to be warning level; when the average probability of an anomaly type is greater than or equal to the second probability threshold and less than the third probability threshold, the probability level is determined to be interception level; when the average probability of an anomaly type is greater than or equal to the third probability threshold, the probability level is determined to be emergency response level. The higher of the risk index level and the probability level is used as the final warning level for the corresponding risk attraction domain. The observation level indicates that the traffic nodes in the area need to be continuously observed and no active intervention is required at this time; the warning level indicates that the traffic nodes in the area have potential risks and a warning should be issued; the interception level indicates that the traffic nodes in the area have significant risks and interception measures need to be taken; and the emergency response level indicates that the traffic nodes in the area have urgent risks and need to be dealt with immediately.

[0055] Finally, the risk coordinates of each traffic node are projected onto the mapped warning level area to determine the warning level of each traffic node. Specifically, based on the position of the risk coordinates of each traffic node on the initial two-dimensional risk coordinate plane, it is determined which warning level area the risk coordinates fall into, thus determining the warning level of the traffic node. Each traffic node is assigned one of the following warning levels: observation level, warning level, interception level, or emergency response level. Finally, a two-dimensional risk assessment matrix is ​​formed, with the comprehensive abnormal risk index as the horizontal axis, the probability of abnormal type as the vertical axis, and the warning level as the matrix element, presenting the distribution and level classification results of all traffic nodes in the risk space.

[0056] Based on the generated two-dimensional risk assessment matrix, the warning level attribution, comprehensive anomaly risk index, anomaly type probability distribution, and cluster risk equivalent of the risk homogeneity cluster to which each traffic node belongs are extracted. The warning level attribution is the warning level determined for the traffic node in the two-dimensional risk assessment matrix. A pre-set warning response plan library is established. This library can select the optimal combination of measures as a template by statistically analyzing the success rate and loss control effect of different response measures under various combinations of warning levels and anomaly modes based on feedback data of the handling effects of historically handled anomaly cases, and continuously iterate and update it with feedback from new cases. Based on the anomaly mode type with the highest probability value in the warning level attribution and anomaly type probability distribution of each traffic node, the corresponding response measure template is matched. The warning response plan library includes measures for observation... The system includes response templates for four warning levels: Observation, Early Warning, Interception, and Emergency Response. Each template includes a description of the abnormal behavior, a risk level description, a response priority, a list of recommended response measures, and an estimated loss range. The description of the abnormal behavior is generated based on the matched abnormal pattern type, describing the typical behavioral characteristics and identification criteria of the abnormal pattern. The risk level description is generated based on the warning level, explaining the meaning of the current risk level and the response requirements. The response priority indicates the urgency of responding to the risk. The list of recommended response measures includes specific actions for the abnormal pattern, such as enhanced verification, transaction restrictions, and account freezing. The estimated loss range is preset based on loss data from similar historical cases, reflecting the potential economic loss range caused by the risk. Based on the comprehensive anomaly risk index of each traffic node, the priority ranking of handling is determined in the matched response measure template. The higher the comprehensive anomaly risk index, the higher the priority ranking, indicating that the risk of the traffic node is more urgent and requires priority handling. Based on the cluster risk equivalent of the risk homogeneous cluster to which each traffic node belongs, the estimated loss scale range is adjusted in the matched response measure template. The larger the cluster risk equivalent, the higher the upper limit of the estimated loss scale range, indicating that the overall risk of the group to which the traffic node belongs is more significant and the potential economic loss is greater, requiring a higher loss estimate, such as by adding 1 to the ratio of the cluster risk equivalent to the average cluster risk equivalent of the entire graph. Then, multiply it by the upper limit of the estimated loss range to obtain the adjusted upper limit of the estimated loss range. Finally, combine the warning level classification, abnormal behavior location description, risk level description text, handling priority ranking, recommended response measure list, and adjusted estimated loss range of each traffic node to generate a hierarchical warning strategy report for the corresponding traffic node. The hierarchical warning strategy report is a structured risk handling guidance document for security operations personnel, containing complete information such as risk identification, level determination, priority ranking, measure recommendation, and loss estimation, enabling operations personnel to quickly understand the risk situation and take targeted handling actions.

[0057] This approach, by introducing a dynamic partitioning mechanism of risk density potential field and risk attraction domain, transforms the traditional fixed threshold partitioning into an adaptive region mapping based on historical risk distribution density. This ensures that the warning level boundary aligns with the natural clustering structure of abnormal risks, effectively avoiding misjudgments and omissions caused by rigid thresholds. Through dual-dimensional coordinate positioning using a comprehensive abnormal risk index and anomaly type attribution probability, a joint assessment of risk intensity and risk certainty is achieved, overcoming the one-sidedness of single-indicator assessments. Dynamic adjustment of the estimated loss scale using the cluster risk equivalent of homogeneous risk clusters links individual warnings with group risks, improving the granularity of warning results. The final generated tiered warning strategy report includes complete information such as abnormal behavior location, risk level description, priority ranking of handling, recommended response measures, and estimated loss scale. This provides safety operations personnel with one-stop decision support from risk identification to handling execution, significantly shortening manual assessment time and improving the response speed and accuracy of abnormal risk handling.

[0058] In one embodiment, you can see a transaction anomaly risk early warning system based on network traffic anomaly identification, such as... Figure 2 As shown, the system includes: The traffic multidimensional feature extraction module is used to collect raw network traffic data from various traffic nodes, perform multi-level feature analysis on the collected raw network traffic data, generate traffic basic feature vectors, session behavior feature vectors, device environment feature vectors, and content semantic feature vectors, and construct a traffic multidimensional feature set. The abnormal pattern association recognition module is used to construct a traffic behavior association graph, identify abnormal subgraph structures in the traffic behavior association graph, calculate the node abnormality degree of each traffic node, and calculate the subgraph aggregate abnormality degree of each traffic node based on the abnormal subgraph structure. The node abnormality degree of each traffic node and the subgraph aggregate abnormality degree are integrated to form the traffic abnormal pattern recognition result. The abnormal risk quantification assessment module, based on the traffic abnormality pattern recognition results and combined with the preset abnormal behavior knowledge graph, calculates the probability of abnormality type attribution and the intensity of abnormal risk for each traffic node, obtains the historical risk records and related transaction amounts of each traffic node, calculates the comprehensive abnormal risk index of each traffic node based on the probability of abnormality type attribution and the intensity of abnormal risk, and generates the abnormal risk quantification assessment results based on the comprehensive abnormal risk index. The graded early warning strategy generation module, based on the quantitative assessment results of abnormal risks, constructs a two-dimensional risk assessment matrix using a comprehensive abnormal risk index and the probability of abnormal type attribution. It divides risks into four early warning levels: observation level, early warning level, interception level, and emergency response level. Based on a preset early warning response scheme library, it generates corresponding graded early warning strategy reports for risks of different early warning levels.

[0059] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing embodiments or make equivalent substitutions for some of the technical features. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

[0060] All formulas in this manual are dimensionless and calculated numerically. The formulas are derived from software simulations based on a large amount of collected data to obtain the most recent real-world results. The preset parameters and thresholds in the formulas are set by those skilled in the art according to the actual situation.

[0061] Although embodiments of the invention have been shown and described, those skilled in the art will understand that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the claims and their equivalents.

Claims

1. A method for early warning of transaction anomaly risks based on network traffic anomaly identification, characterized in that, The methods include: S1. Collect raw network traffic data from each traffic node, perform multi-level feature analysis, and construct a multi-dimensional traffic feature set; S2. Construct a traffic behavior association graph, identify abnormal subgraph structures in the traffic behavior association graph, calculate the node anomaly degree of each traffic node, and calculate the subgraph aggregate anomaly degree of each traffic node based on the abnormal subgraph structure. Integrate the node anomaly degree of each traffic node with the subgraph aggregate anomaly degree to form the traffic anomaly pattern recognition result. S3. Based on the traffic anomaly pattern recognition results, combined with the preset abnormal behavior knowledge graph, calculate the probability of anomaly type attribution and the intensity of anomaly risk corresponding to each traffic node, obtain the historical risk records and related transaction amounts of each traffic node, and calculate the comprehensive anomaly risk index of each traffic node by combining the probability of anomaly type attribution and the intensity of anomaly risk, and generate the quantitative assessment result of anomaly risk. S4. Based on the quantitative assessment results of abnormal risks, a two-dimensional risk assessment matrix is ​​constructed using the comprehensive abnormal risk index and the probability of abnormal type attribution. The risks are divided into four warning levels, and corresponding graded warning strategy reports are generated for risks of different warning levels according to the preset warning response scheme library.

2. The method according to claim 1, characterized in that, The method for constructing a multidimensional feature set of traffic is as follows: The raw network traffic data is parsed to obtain basic traffic features, session behavior features, device environment features, and content semantic features. These features are then combined to form a multi-dimensional traffic feature set.

3. The method according to claim 1, characterized in that, The method for constructing a traffic behavior correlation graph is as follows: Calculate the behavioral quality value of each flow node based on its multidimensional feature vector; calculate the behavioral attraction strength between any two flow nodes based on the behavioral quality value. When the intensity of the behavior gravity is greater than or equal to the preset gravity threshold, a directed edge is established between the two corresponding flow nodes, and the original set of directed edges is constructed based on all directed edges. The normalized behavioral gravity intensity is used as the weight of each directed edge, and the behavioral entropy flow value of each flow node is calculated. The behavioral entropy flow value is used as the dynamic attribute of each flow node. Iteratively update the behavioral gravity strength between each flow node, and obtain a new set of directed edges based on the updated behavioral gravity strength; Calculate the rate of change of the edge structure between the new set of directed edges and the original set of directed edges, and repeat the iterative process until the rate of change of the edge structure is less than the preset convergence threshold, and finally obtain the flow behavior association graph.

4. The method according to claim 3, characterized in that, The method for generating traffic anomaly pattern recognition results is as follows: Based on the traffic behavior correlation graph, the node anomaly degree of each traffic node is calculated; traffic nodes with anomaly degrees greater than or equal to a preset anomaly threshold are used as seed nodes, and candidate anomaly subgraphs are obtained by greedily expanding the graph through the intensity of behavior attraction. Synchronization and gradient propagation tests are performed sequentially on each candidate anomaly subgraph to obtain the anomaly subgraph structure. Calculate the subgraph aggregation anomaly degree of the abnormal subgraph structure corresponding to each traffic node, integrate the node anomaly degree of each traffic node with the subgraph aggregation anomaly degree to obtain the fusion anomaly degree; sort all traffic nodes in descending order of fusion anomaly degree to generate traffic anomaly pattern recognition results.

5. The method according to claim 4, characterized in that, The method for obtaining the abnormal subgraph structure is as follows: Calculate the similarity of session behavior features of each traffic node in each candidate anomaly subgraph within the same time window. When the similarity of session behavior features is greater than or equal to the preset synchronization threshold, the synchronization test is passed. At this time, the candidate anomaly subgraph is recorded as the initial screening candidate anomaly subgraph. Determine the boundary nodes of the initial screening candidate anomaly subgraphs. Starting from the seed node, traverse along the directed edge direction to the boundary node. Calculate the difference in behavioral entropy flow value between adjacent flow nodes on the traversal path. When there exists a traversal path from the seed node to the boundary node such that the difference in behavioral entropy flow value between all adjacent flow nodes on the corresponding traversal path is positive, the gradient transitivity test is passed. At this time, all initial screening candidate anomaly subgraphs are merged to obtain the candidate anomaly subgraph set. Calculate the node overlap rate between any two abnormal subgraphs in the candidate set of abnormal subgraphs. When the node overlap rate is greater than or equal to the preset overlap threshold, only the abnormal subgraphs with higher aggregation abnormality are retained, and the abnormal subgraph structure is finally obtained.

6. The method according to claim 5, characterized in that, The method for calculating the comprehensive anomaly risk index of each traffic node is as follows: Extract the fusion anomaly degree of each traffic node, combine the subgraph aggregation anomaly degree with the corresponding traffic multidimensional feature vector, and construct the anomaly pattern feature vector of each traffic node. Based on a pre-defined abnormal behavior knowledge graph, the abnormal pattern feature vectors of each abnormal pattern are extracted, the pattern entanglement strength between the abnormal pattern feature vectors of each traffic node and the feature vectors of each abnormal pattern is calculated, and the probability of the traffic node being assigned to the abnormal type of each abnormal pattern is determined. Based on the probability of the abnormal type being assigned, the abnormal risk intensity of each traffic node is calculated. Based on the historical risk records and related transaction amounts of traffic nodes, a historical risk attenuation factor and a transaction amount risk amplification factor are generated. Based on the abnormal risk intensity, historical risk attenuation factor, and transaction amount risk amplification factor, the comprehensive abnormal risk index of each traffic node is calculated through a pre-constructed risk potential energy field model.

7. The method according to claim 6, characterized in that, The method for generating quantitative assessment results of abnormal risks is as follows: Based on the comprehensive anomaly risk index of each traffic node, a risk potential energy field distribution map is constructed; the potential energy received value of each traffic node in the risk potential energy field distribution map is calculated. Based on the risk potential energy field distribution map, risk clustering is performed on each traffic node to form multiple risk clusters; Perform a risk homogeneity test on each risk cluster, and record the risk clusters that pass the risk homogeneity test as risk homogeneous clusters; Based on each risk homogeneous cluster, calculate the cluster risk equivalent of each risk homogeneous cluster and the deviation of each flow node from the potential energy center in its respective risk homogeneous cluster; The abnormal risk quantitative assessment results of the flow nodes are generated based on the comprehensive abnormal risk index, cluster risk equivalent, and potential energy center deviation.

8. The method according to claim 7, characterized in that, The method for constructing a two-dimensional risk assessment matrix is ​​as follows: Extract the comprehensive anomaly risk index and anomaly type attribution probability of each traffic node, construct an initial two-dimensional risk coordinate plane, and mark the risk coordinate points of each traffic node on the initial two-dimensional risk coordinate plane; Based on the historical risk distribution density of each abnormal pattern in the pre-set abnormal behavior knowledge graph, a risk density potential field is constructed on the initial two-dimensional risk coordinate plane; the initial two-dimensional risk coordinate plane is divided into several risk attraction domains, and each risk attraction domain corresponds to a candidate area for early warning level. Based on the average comprehensive abnormal risk index and the average probability of abnormal type attribution of all traffic nodes in each risk attraction domain, the risk attraction domain is mapped to four early warning levels. By projecting the risk coordinates of each traffic node onto the mapped warning level, the warning level of each traffic node is determined, forming a two-dimensional risk assessment matrix.

9. The method according to claim 8, characterized in that, The method for mapping risk attraction domains to four warning levels is as follows: The average comprehensive abnormal risk index is compared with multiple preset risk thresholds to obtain the corresponding risk index level. The average probability of anomaly type is compared with multiple preset probability thresholds to obtain the corresponding probability level. The higher of the risk index level and the probability level is taken as the final warning level.

10. A transaction anomaly risk early warning system based on network traffic anomaly identification, comprising the method described in any one of claims 1-9, characterized in that, The system includes: The traffic multidimensional feature extraction module is used to construct a traffic multidimensional feature set based on the raw network traffic data of each traffic node; The abnormal pattern association and identification module is used to construct a traffic behavior association graph and identify abnormal traffic patterns. The abnormal risk quantification assessment module is used to generate abnormal risk quantification assessment results based on the identification results and in combination with a pre-set abnormal behavior knowledge graph. The graded early warning strategy generation module is used to construct a two-dimensional risk assessment matrix based on the results of abnormal risk quantification assessment, and generate an early warning strategy report by combining it with a pre-set early warning response scheme library.

Images