CN117078352A

CN117078352A - E-commerce transaction cheating identification method and system

Info

Publication number: CN117078352A
Application number: CN202311120052.8A
Authority: CN
Inventors: 李旭峰
Original assignee: Soyoung Technology Beijing Co Ltd
Current assignee: Soyoung Technology Beijing Co Ltd
Priority date: 2023-08-31
Filing date: 2023-08-31
Publication date: 2023-11-17

Abstract

The application discloses a method for identifying cheating of electronic commerce transaction, which comprises the following steps: constructing graph data based on the relation among a plurality of users, wherein the graph data consists of a plurality of nodes and a plurality of edges, the nodes represent the users, the edges represent the relation established between the users, the weights of the edges represent the times of establishing the relation between the users, and the relation is established according to the characteristic data of a plurality of dimensions; aggregating the plurality of users based on the graph data to obtain a plurality of teams; and identifying the cheating team from the plurality of teams according to a team positioning strategy, wherein the team positioning strategy is based on the cheating team positioning strategy of team operation. The application also discloses an electronic commerce transaction cheating identification system, an electronic device and a computer readable storage medium. Therefore, the accuracy of cheating team identification can be effectively improved.

Description

E-commerce transaction cheating identification method and system

Technical Field

The present application relates to the field of data analysis technologies, and in particular, to a method, a system, an electronic device, and a computer readable storage medium for identifying electronic commerce transaction cheating.

Background

With the popularity of computer technology and the development of electronic commerce, users often conduct electronic commerce transactions on electronic devices. However, various cheating means also begin to appear in the e-commerce transaction process, and the cheating users present a team trend. Therefore, how to identify cheating teams and cheating users appearing in transactions and guarantee property safety becomes a problem to be solved urgently.

Disclosure of Invention

The application mainly aims to provide an electronic commerce transaction cheating identification method, an electronic device and a computer readable storage medium, which aim to solve the problem of accurately identifying cheating teams and cheating users.

In a first aspect, an embodiment of the present application provides a method for identifying fraud in electronic commerce transactions, where the method includes:

constructing graph data based on the relation among a plurality of users, wherein the graph data consists of a plurality of nodes and a plurality of edges, the nodes represent the users, the edges represent the relation established between the users, the weights of the edges represent the times of establishing the relation between the users, and the relation is established according to the characteristic data of a plurality of dimensions;

aggregating the plurality of users based on the graph data to obtain a plurality of teams;

And identifying the cheating team from the plurality of teams according to a team positioning strategy, wherein the team positioning strategy is based on the cheating team positioning strategy of team operation.

In a second aspect, an embodiment of the present application provides an electronic commerce transaction cheating identification system, the system including:

the building module is used for building graph data based on the relation among a plurality of users, the graph data consists of a plurality of nodes and a plurality of edges, the nodes represent users, the edges represent the relation established among the users, the weights of the edges represent the times of establishing the relation among the users, and the relation is established according to the characteristic data of a plurality of dimensions;

an aggregation module for aggregating the plurality of users based on the graph data to obtain a plurality of teams;

and the identification module is used for identifying the cheating team from the teams according to a team positioning strategy, wherein the team positioning strategy is based on the cheating team positioning strategy of the team operation behavior.

In a third aspect, an embodiment of the present application provides an electronic device, including: the electronic commerce transaction cheating identification system comprises a memory, a processor and an electronic commerce transaction cheating identification program which is stored in the memory and can run on the processor, wherein the electronic commerce transaction cheating identification program realizes the electronic commerce transaction cheating identification method when being executed by the processor.

In a fourth aspect, an embodiment of the present application provides a computer readable storage medium, where an e-commerce transaction cheating identification program is stored, where the e-commerce transaction cheating identification program implements an e-commerce transaction cheating identification method as described above when executed by a processor.

The method, the system, the electronic device and the computer readable storage medium for identifying the cheating of the e-commerce transaction can establish the user relationship according to the characteristic data of various dimensions, and take the times of establishing the user relationship as the weight of the edges in the graph data, so that the user relationship reflected by the graph data is more diversified, the considered basis of the aggregation model in the aggregation process is more comprehensive, and the aggregation result is more accurate. And after the graph data are constructed according to the user relationship and the graph data are processed through the aggregation model to obtain a plurality of teams, the cheating teams are identified from the teams according to the team positioning strategy based on team operation behaviors, so that the accuracy of identifying the cheating teams is effectively improved, the situation that a normal team is mistakenly treated as the cheating team is avoided, and the fairness and stability of the business ecology are ensured.

Drawings

The accompanying drawings are included to provide a further understanding of the application, and are incorporated in and constitute a part of this specification. It is appreciated that these drawings depict only some embodiments according to the disclosure and are not therefore to be considered limiting of its scope.

FIG. 1 is a diagram of an application environment architecture for implementing various embodiments of the present application;

FIG. 2 is a flowchart of a method for identifying fraud in electronic commerce transactions according to a first embodiment of the present application;

FIG. 3 is a schematic diagram of a refinement process of step S200 in FIG. 2;

FIG. 4 is a schematic diagram of a refinement procedure of step S202 in FIG. 2;

FIG. 5 is a schematic diagram of another refinement procedure of step S202 in FIG. 2;

FIG. 6 is a schematic diagram of a refinement procedure of step S204 in FIG. 2;

FIG. 7 is a flowchart of a method for identifying fraud in electronic commerce according to a second embodiment of the present application;

FIG. 8 is a schematic diagram of a refinement procedure of step S306 in FIG. 7;

fig. 9 is a schematic diagram of a hardware architecture of an electronic device according to a third embodiment of the present application;

fig. 10 is a schematic block diagram of an e-commerce transaction cheating identification system according to a fourth embodiment of the present application.

Detailed Description

The present application will be described in further detail with reference to the drawings and examples, in order to make the objects, technical solutions and advantages of the present application more apparent. It should be understood that the specific embodiments described herein are for purposes of illustration only and are not intended to limit the scope of the application. All other embodiments, which can be made by those skilled in the art based on the embodiments of the application without making any inventive effort, are intended to be within the scope of the application.

It should be noted that the descriptions of "first," "second," etc. in the embodiments of the present application are for descriptive purposes only and are not to be construed as indicating or implying a relative importance or implicitly indicating the number of technical features indicated. Thus, a feature defining "a first" or "a second" may explicitly or implicitly include at least one such feature. In addition, the technical solutions of the embodiments may be combined with each other, but it is necessary to base that the technical solutions can be realized by those skilled in the art, and when the technical solutions are contradictory or cannot be realized, the combination of the technical solutions should be considered to be absent and not within the scope of protection claimed in the present application.

Currently, security services in the e-commerce field have begun to apply a variety of anti-cheating techniques, wherein graph algorithms are widely used for their effectiveness. The graph algorithm is a simple algorithm for obtaining an answer by utilizing a specially-made line graph. However, in general, as a result of identifying anti-cheating technologies by applying graph algorithms in the e-commerce field, all team contents may include both cheating teams and non-cheating teams, and the required cheating team data cannot be obtained directly. To get the correct cheating team, all teams identified also need to be screened and located. Secondly, the cheating team identified through the graph algorithm often contains normal users, and if the cheating users need to be accurately identified, the users still need to be further positioned.

Based on the technical defects, the embodiment of the application provides a novel e-commerce transaction cheating identification method, wherein the relationship between users is established according to the characteristics of multiple dimensions, graph data is constructed based on the relationship between the users, and after the graph data are processed through an aggregation model to obtain multiple teams, the cheating teams and the cheating users in the multiple teams can be further accurately identified.

Referring to fig. 1, fig. 1 is a schematic diagram of an application environment for implementing various embodiments of the present application. The application is applicable to application environments including, but not limited to, client 2, server 4, and network 6.

The client 2 is configured to provide the user information and the feature data to be identified to the server 4, and display a cheating team, a cheating user, etc. output by the server 4. The server 4 is configured to construct graph data based on the received relationships between users to be identified, process the graph data through an aggregation model to obtain a plurality of teams, identify a cheating team from the teams according to a team positioning strategy based on a team operation behavior, identify a cheating user in the identified cheating team further according to a user positioning strategy based on a user operation behavior, and finally output an identification result to the client 2.

The client 2 may be a terminal device such as a PC (Personal Computer ), a mobile phone, a tablet computer, a portable computer, or a wearable device. The server 4 may be a rack server, a blade server, a tower server, or a cabinet server, and may be an independent server or a server cluster formed by a plurality of servers.

The network 6 may be a wireless or wired network such as an Intranet (Intranet), the Internet (Internet), a global system for mobile communications (Global System of Mobile communication, GSM), wideband code division multiple access (Wideband Code Division Multiple Access, WCDMA), a 4G network, a 5G network, bluetooth (Bluetooth), wi-Fi, etc. The server 4 and one or more clients 2 are in communication connection through the network 6 for data transmission and interaction.

Example 1

Fig. 2 is a flowchart of a method for identifying electronic commerce transaction cheating according to a first embodiment of the present application. It will be appreciated that the flow charts in the method embodiments are not intended to limit the order in which the steps are performed. Some of the steps in the flow chart may be added or subtracted as desired. The method will be described below taking the server as an execution body.

The method comprises the following steps:

and S200, constructing graph data based on the relation among a plurality of users.

The plurality of users refer to users to be identified, including users participating in a specified e-commerce transaction. After receiving the user information to be identified, the possible relationship between the users can be analyzed, and the graph data can be constructed according to the relationship between the users. The graph data is constructed by combining nodes and edges. The nodes represent users, the edges represent relationships established between users, and the weights of the edges (or the degree of the edges) represent the number of times a relationship is established between users.

Specifically, referring further to fig. 3, a schematic refinement flow chart of the above step S200 is shown. It will be appreciated that the flowchart is not intended to limit the order in which the steps are performed. Some of the steps in the flow chart may be added or subtracted as desired. In this embodiment, the step S200 specifically includes:

s2000, acquiring all user information to be identified, and taking each user as a node.

In an embodiment of the present application, the user information may be a user identification (Identity Document, ID), which is a unique ID of a user within the transaction system. Thus, each node in the graph data corresponds to a user ID of a user to be identified.

S2002, establishing a relation between users according to the characteristics of multiple dimensions, and taking each pair of user relations as one side.

First, feature data of each user is obtained, including, but not limited to, various dimensions of a user internet protocol (Internet Protocol, IP) address, a device Identification (ID), a purchase institution Identification (ID), a purchase goods time, a user registration time, and the like. And comparing the characteristic data between the users, and establishing a relation between any two users when the characteristic data between the two users are associated. In this embodiment, the associated feature data including two users is the same, or the difference between the feature data of two users is within a preset range.

Wherein, the user IP address is the IP address used when the user logs in the transaction system. The relationship between users is established according to the IP addresses of the users, namely, when any two users have the same IP address, the relationship between the two users is generated.

The device ID is a unique ID allocated to the user device inside the system. Establishing a relationship between users according to device IDs means that when any two users have the same device ID, a relationship is generated between the two users.

The purchase mechanism ID is a unique ID of the mechanism where the user purchases the commodity. The relationship between users is established according to the purchase mechanism ID, namely, when any two users purchase goods of the same mechanism, the relationship between the two users is generated.

The purchase commodity ID is a unique ID allocated to the commodity purchased by the user by the transaction system. The relationship between users is established according to the purchased commodity ID, namely, when any two users purchase the same commodity, the relationship between the two users is generated.

The time to purchase the merchandise is the time left in the transaction system when the user purchases the merchandise. The relationship between users is established according to commodity purchasing time, namely when commodity purchasing time of any two users is the same, the relationship between the two users is generated. However, in general, the time for two users to purchase goods in the cheating team is very difficult to be identical, so that the time for purchasing goods is identical, and the time interval for purchasing goods for the two users is within a first preset time range. For example, when any two users purchase goods within 60 seconds of each other, a relationship is created between the two users.

The user registration time is the time left in the transaction system when the user registers. The relationship between users is established according to the registration time of the users, namely, when the registration time of any two users is the same, the relationship between the two users is generated. However, in general, the registration time of two users in the cheating team is very difficult to be identical, so that the user registration time is identical and the user registration time interval of the two users is within a second preset time range. For example, when any two users register for a time interval within 1 hour, a relationship is created between the two users.

If a relation is established between two users, constructing one edge between nodes corresponding to the two users in the graph data.

S2004, the number of times a relationship is established between each pair of users is taken as the weight of the corresponding edge.

The relationship between the two users can be determined by the characteristic data such as the user IP address, the device ID, the purchasing mechanism ID, the purchasing commodity time, the user registration time and the like. If multiple relationships occur between two users, the weight of the corresponding edge is also increased by 1 every time a relationship is established. That is, the weight of the edge is the number of times a relationship is established between the two users.

S2006, constructing the graph data through the combination of the nodes and the edges.

And constructing a graph through the combination of the nodes and the edges according to the nodes corresponding to each user, the edges corresponding to each pair of user relations and the weights of each edge, and obtaining the graph data.

The greater the number of times a relationship is established between two users, the greater the association between the two users, the more obvious the team behavior, and the higher the likelihood of constructing a team. In the embodiment of the application, the relation between the users is built from a plurality of dimensions such as the IP address of the user, the ID of the equipment, the ID of the purchasing mechanism, the ID of the purchasing commodity, the time of purchasing commodity, the registration time of the user and the like, and the number of times of building the relation is used as the weight of the side and used as one of judging indexes of a subsequent aggregation team. Compared with the method that whether the relationship exists between the two users is used as a judging index or not, the method and the device can detect the more multi-element relationship between the two users through the data with more dimensions, so that the user relationship reflected by the graph data is more comprehensive, missed judgment on the user relationship is prevented, and the calculation process of the subsequent aggregation model is affected.

Returning to FIG. 2, S202, based on the graph data, the plurality of users are aggregated to obtain a plurality of teams.

And inputting the graph data obtained in the previous step into an aggregation model, processing the graph data through the aggregation model, aggregating a plurality of users to be identified, and outputting a plurality of teams. The aggregation model aggregates the nodes according to the edges between two nodes in the graph data and the weights of the edges, and outputs an aggregation result, wherein the aggregation result comprises a plurality of teams corresponding to the plurality of users. The team is a group of associated users.

In the embodiment of the application, the aggregation model can aggregate the plurality of users in various ways. In an optional implementation manner, the aggregation model finds neighbor nodes of each node according to edges in the graph data, aggregates adjacent nodes into communities based on the weight of the edges and the maximum module degree increment, and outputs an aggregation result after multiple rounds of iteration.

Specifically, referring further to fig. 4, a detailed flowchart of step S202 is shown, that is, the process of the aggregation model processing the graph data. It will be appreciated that the flowchart is not intended to limit the order in which the steps are performed. Some of the steps in the flow chart may be added or subtracted as desired. In this embodiment, the step S202 specifically includes:

S2020, each node traverses all the neighboring nodes, and calculates the module degree increment aggregated with the neighboring nodes according to the weight of the edge between the node and the neighboring nodes.

First, each node is individually designated as a community, and each node regards itself as its own community label. Then, each node finds the neighbor node through the edge connected with the node, traverses all the neighbor nodes of the node, and tries to update the community label of the node to the community label of the neighbor node, namely, the node is aggregated with the neighbor node to form a community. The modularity increment needs to be calculated at each attempt, hopefully by changing the community label.

The calculation mode of the modularity is as follows:

wherein Q represents modularity,the sum of the weights representing the edges inside community c, +.>The sum of weights representing edges connected to nodes inside the community c includes edges inside the community and edges outside the community.

S2022, each node selects the neighbor node with the largest modularity increment to aggregate into a community until all nodes can not increase modularity through aggregation (i.e. change community labels).

S2024, merging each community into a new node to form new graph data.

The weight of the edge between the two new nodes is the sum of the weights of the edges between the nodes of the original two communities.

And repeating the three steps until the modularity is not increased any more, and obtaining a plurality of communities finally aggregated, namely a plurality of teams corresponding to the plurality of users.

In another optional implementation manner, the aggregation model firstly divides the nodes in the graph data into two groups according to a specified scale in an arbitrary manner, then exchanges two nodes for any pair of node pairs which do not belong to the same group, calculates the variation of the cut set scale of the two groups before and after exchange, selects the node pair which reduces the cut set scale most in all node pairs for exchange until the cut set scale is not improved, and outputs an aggregation result after multiple iterations.

Specifically, referring further to fig. 5, another detailed flowchart of step S202 is shown, that is, the process of the aggregation model processing the graph data. It will be appreciated that the flowchart is not intended to limit the order in which the steps are performed. Some of the steps in the flow chart may be added or subtracted as desired. In this embodiment, the step S202 specifically includes:

S2021, dividing the nodes in the graph data into two groups according to a specified scale in an arbitrary mode, and calculating the variation of the cut set scale of the two groups before and after node exchange for any pair of two nodes which do not belong to the same group.

When the groups are divided for the first time, only the scale of the two groups, namely the number of nodes contained in the groups, is required to be specified, and the nodes in the graph data can be divided in any mode to obtain the two groups with the specified scale. For example, the two groups may be the same size. One node is selected from two groups at any time, the node pair is tried to exchange, the variation of the cut set scale of the two groups before and after exchange is calculated, and the cut set scale is hoped to be improved by exchange.

The calculation mode of the cut set scale variable quantity is as follows:

wherein gain represents the cut-set size variation after node a exchanges with node B, a represents any node in group a, B represents any node in group B, da represents the difference between the external weight and the internal weight of node a, db represents the difference between the external weight and the internal weight of node B, and Cab represents the sum of the weights of the edges connected between group a and group B.

The external weight of the node a refers to the sum of the weights of the edges connected between the node a and the nodes of the group B, and the internal weight of the node a refers to the sum of the weights of the edges connected between the node a and other nodes in the group A. The external weight of the node B refers to the sum of the weights of the edges connected between the node B and the nodes of the group A, and the internal weight of the node B refers to the sum of the weights of the edges connected between the node B and other nodes in the group B.

And S2023, selecting the node pair which reduces the cutting set scale most from all the node pairs to exchange, and obtaining two new groups.

Through the trial exchange and calculation, the cut set scale variation of all node pairs can be obtained. When there are node pairs that reduce the cut set size, the node pair that reduces the cut set size most is selected for switching. If there are no node pairs that reduce the cutset size, then the node pair that minimizes the cutset size increase is selected and then the two nodes are swapped.

S2025, removing the exchanged node pairs, and continuing to exchange other node pairs in the two new groups until no node pairs can be exchanged.

For the already exchanged node a and node b, no further participation in the subsequent exchange process is involved. The node pairs are selected from the rest of the two new groups, and the switching process is repeated until no node pairs can be switched.

S2027, recording the state after each exchange, and selecting the group in the state of minimum cutset scale as the optimal network division of the round.

After the exchange process, the first round of exchange is finished. And recording all exchanged states, including group division conditions and corresponding cutset scales. And then selecting the state with the smallest cutset scale, and taking the group division condition in the state as the optimal network division of the round.

And S2029, dividing the optimal network into initial groups of the next round, and outputting a plurality of groups finally aggregated after a plurality of iterations until the cutset scale is not improved.

Repeating the steps, wherein the initial group of each round is the optimal network division obtained in the previous round, and performing a new round of node pair exchange on the basis of the optimal network division in the previous round. And then repeatedly performing multiple rounds of iteration until the cutset scale is not improved any more, wherein the optimal network division obtained in the final round is a plurality of groups finally aggregated. Outputting a plurality of groups aggregated, each group being one of the teams.

The embodiment provides the feature data with multiple dimensions to establish the user relationship, and determines the weight of the edge according to the times of establishing the user relationship, so that more user relationships are input into the aggregation model. The weight of the edges is important data when the aggregation model carries out aggregation calculation, so that the basis considered by the aggregation model in the aggregation process is more comprehensive, the data used in calculation is more accurate, and the aggregation result is more accurate.

Returning to FIG. 2, S204, a cheating team is identified from the plurality of teams according to a team localization strategy.

In order to improve the accuracy of the cheating identification, after the aggregation model outputs a plurality of teams included in the plurality of users, it is further necessary to determine which of the teams are cheating teams and which are normal teams. In this embodiment, the team locating policy refers to a cheating team locating policy based on team operation behavior.

Specifically, referring to fig. 6, a schematic diagram of the refinement process of step S204 is shown. It will be appreciated that the flowchart is not intended to limit the order in which the steps are performed. Some of the steps in the flow chart may be added or subtracted as desired. In this embodiment, the step S204 specifically includes:

s2040, acquiring operation behavior data of a plurality of users in each team.

In the embodiment of the present application, the operation behavior data includes, but is not limited to, time of browsing goods N days before transaction, number of browsing goods N days before transaction, and number of sending private messages to merchants N days before transaction, where N is a preset positive integer, for example, 5.

And S2042, counting the average value of the operation behavior data of a plurality of users in the team.

And after the operation behavior data of all users in the team are obtained, counting the average value of each operation behavior data of the team to be used as an index for judging whether the team is a cheating team or not.

S2044, determining whether the team is a cheating team or not according to the average value and the first threshold value.

Since the operation behavior data may include a plurality of data, the first threshold may also include a set of corresponding thresholds, respectively corresponding to each of the operation behavior data. And comparing the average value of each operation behavior data of the team with a corresponding first threshold value according to the team positioning strategy, and if the conditions set by the team positioning strategy are met, considering that the team belongs to the cheating team.

In an alternative embodiment, the team is determined to be a cheating team when the average of each operational behavior data in the team is less than the respective first threshold. And when the average value of each operation behavior data in the team is greater than or equal to the corresponding first threshold value, determining that the team is a normal team.

For example, the team localization policy may include three aspects of conditions: the average value of the browsing commodity time of 5 days before transaction is less than 60 seconds; the average value of the number of the browsed commodities is less than 5 in 5 days before transaction; and sending private messages to merchants 5 days before transaction, wherein the average value of the number of the merchants is less than 5. And determining the team meeting the conditions simultaneously as the cheating team, otherwise, determining the team as the normal team.

In other embodiments, the team localization policy may also be set to other conditions according to specific operational behavior data, for example, may be a cheating team when the average value is greater than the first threshold.

According to the method for identifying the cheating of the e-commerce transaction, which is provided by the embodiment, the user relationship can be established according to the characteristic data of various dimensions, and the number of times of establishing the user relationship is used as the weight of the edge in the graph data, so that the user relationship reflected by the graph data is more diversified, the considered basis of the aggregation model in the aggregation process is more comprehensive, and the aggregation result is more accurate. In addition, after the graph data are constructed according to the user relationship and the graph data are processed through the aggregation model to obtain a plurality of teams, the teams are further identified according to the team positioning strategy, normal teams in the teams can be effectively eliminated based on some team cheating behaviors, the identified cheating team results are more accurate, the situation that the normal teams are mistakenly treated as the cheating teams is avoided, property safety can be effectively guaranteed, and misjudgment can be reduced as much as possible.

Example two

Fig. 7 is a flowchart of a method for identifying electronic commerce transaction cheating according to a second embodiment of the present application. In a second embodiment, the method for identifying cheating on e-commerce transaction further includes step S306 on the basis of the first embodiment. It will be appreciated that the flow charts in the method embodiments are not intended to limit the order in which the steps are performed. Some of the steps in the flow chart may be added or subtracted as desired.

The method comprises the following steps:

s300, constructing graph data based on the relation among a plurality of users.

S302, aggregating the plurality of users based on the graph data to obtain a plurality of teams.

S304, identifying cheating teams from the teams according to team positioning strategies.

The implementation principle of the steps S300-S304 is the same as that of the steps S200-S204 in the foregoing first embodiment, and the specific implementation process may refer to the description in the first embodiment, and the embodiments of the present application are not repeated here.

S306, in the cheating team, the cheating user is further identified according to the user positioning strategy.

And further carrying out user identification from the cheating team according to a user positioning strategy, and positioning the cheating user. In this embodiment, the user positioning policy refers to a cheating user positioning policy based on user operation behavior.

Specifically, referring further to fig. 8, a schematic refinement flow chart of the above step S306 is shown. It will be appreciated that the flowchart is not intended to limit the order in which the steps are performed. Some of the steps in the flow chart may be added or subtracted as desired. In this embodiment, the step S306 specifically includes:

S3060, acquiring the operation behavior data of each user in the cheating team.

S3062, determining whether the user is a cheating user according to the operation behavior data and a second threshold value.

Likewise, since the operation behavior data may include a plurality of data, the second threshold may also include a set of corresponding thresholds, respectively corresponding to each of the operation behavior data. And comparing each piece of operation behavior data of each user in the cheating team with a corresponding second threshold according to the user positioning strategy, and if the operation behavior data meets the conditions set by the user positioning strategy, considering that the user belongs to the cheating user and outputting an end user identification result. The identification result may be the user IDs of all cheating users.

In an alternative embodiment, the user is determined to be a cheating user when each of the operational behavior data of the user is less than a respective second threshold. And when each operation behavior data of the user is greater than or equal to a corresponding second threshold value, determining that the user is a normal user.

For example, the user positioning policy may include three aspects of conditions: the commodity browsing time is less than 10 seconds 5 days before transaction; the number of browsed commodities is less than 3 in 5 days before transaction; and sending private messages to merchants with the number of less than 5 in 5 days before transaction. And in the cheating team, the users meeting the conditions are determined to be the cheating users, otherwise, the users are normal users.

In other embodiments, the user positioning policy may be set to other conditions according to specific operation behavior data, for example, the user positioning policy may be a cheating user when the operation behavior data is greater than the second threshold.

According to the method for identifying the cheating of the e-commerce transaction, which is provided by the embodiment, the user relationship can be established according to the characteristic data of various dimensions, and the number of times of establishing the user relationship is used as the weight of the edge in the graph data, so that the user relationship reflected by the graph data is more diversified, the considered basis of the aggregation model in the aggregation process is more comprehensive, and the aggregation result is more accurate. In addition, after the graph data are constructed according to the user relationship and the graph data are processed through the aggregation model to obtain a plurality of teams, the teams are identified according to the team positioning strategy, normal teams in the teams can be effectively eliminated based on some team cheating behaviors, the identified cheating team results are more accurate, and the situation that the normal teams are mistakenly treated as the cheating teams is avoided. In addition, after the cheating team is identified, the user with transaction cheating can be quickly and accurately identified according to the user positioning strategy based on the user operation behaviors, normal users in the cheating team are removed, and the fairness and stability of business ecology are guaranteed.

Example III

As shown in fig. 9, a hardware architecture of an electronic device 20 according to a third embodiment of the present application is provided. In this embodiment, the electronic device 20 may include, but is not limited to, a memory 21, a processor 22, and a network interface 23, which may be communicatively connected to each other through a system bus. It should be noted that fig. 9 only shows an electronic device 20 having components 21-23, but it should be understood that not all of the illustrated components are required to be implemented and that more or fewer components may alternatively be implemented. In this embodiment, the electronic device 20 may be the server.

The memory 21 includes at least one type of readable storage medium including flash memory, hard disk, multimedia card, card memory (e.g., SD or DX memory, etc.), random Access Memory (RAM), static Random Access Memory (SRAM), read Only Memory (ROM), electrically Erasable Programmable Read Only Memory (EEPROM), programmable Read Only Memory (PROM), magnetic memory, magnetic disk, optical disk, etc. In some embodiments, the storage 21 may be an internal storage unit of the electronic device 20, such as a hard disk or a memory of the electronic device 20. In other embodiments, the memory 21 may also be an external storage device of the electronic apparatus 20, such as a plug-in hard disk, a Smart Media Card (SMC), a Secure Digital (SD) Card, a Flash memory Card (Flash Card) or the like, which are provided on the electronic apparatus 20. Of course, the memory 21 may also include both an internal memory unit and an external memory device of the electronic apparatus 20. In this embodiment, the memory 21 is generally used for storing an operating system and various application software installed on the electronic device 20, such as program codes of the e-commerce transaction cheating identification system 60. Further, the memory 21 may be used to temporarily store various types of data that have been output or are to be output.

The processor 22 may be a central processing unit (Central Processing Unit, CPU), controller, microcontroller, microprocessor, or other data processing chip in some embodiments. The processor 22 is generally used to control the overall operation of the electronic device 20. In this embodiment, the processor 22 is configured to execute the program code or process data stored in the memory 21, for example, execute the e-commerce transaction cheating identification system 60.

The network interface 23 may comprise a wireless network interface or a wired network interface, which network interface 23 is typically used for establishing a communication connection between the electronic apparatus 20 and other electronic devices.

Example IV

As shown in fig. 10, a block diagram of an e-commerce transaction cheating identification system 60 according to a fourth embodiment of the present application is provided. The e-commerce transaction cheating identification system 60 may be partitioned into one or more program modules that are stored in a storage medium and executed by one or more processors to perform embodiments of the application. Program modules in accordance with the embodiments of the present application may be implemented as a series of computer program instruction segments capable of implementing specific functions, and the following description may be presented in terms of their respective functions.

In this embodiment, the e-commerce transaction cheating identification system 60 includes:

a construction module 600 for constructing graph data based on relationships between a plurality of users.

The plurality of users refer to users to be identified, typically users participating in transactions of a specified e-commerce. After receiving the user information to be identified, the possible relationship between the users can be analyzed, and the graph data can be constructed according to the relationship between the users. The graph data is constructed by combining nodes and edges. The nodes represent users, the edges represent relationships established between users, and the weights of the edges (or the degree of the edges) represent the number of times a relationship is established between users.

In the embodiment of the application, the relation between the users is established according to the characteristic data of multiple dimensions. The feature data includes, but is not limited to, user IP address, device ID, purchase mechanism ID, purchase article time, user registration time, etc. Comparing the characteristic data between the users, and establishing a relation between any two users when the characteristic data between the two users are associated. If multiple relationships occur between two users, the weight of the corresponding edge is also increased by 1 every time a relationship is established. In this embodiment, the associated feature data including two users is the same, or the difference between the feature data of two users is within a preset range.

An aggregation module 602, configured to aggregate the plurality of users to obtain a plurality of teams based on the graph data.

And inputting the graph data into an aggregation model, processing the graph data through the aggregation model so as to aggregate a plurality of users to be identified and output a plurality of teams. The aggregation model aggregates the nodes according to the edges between two nodes in the graph data and the weights of the edges, and outputs an aggregation result, wherein the aggregation result comprises a plurality of teams corresponding to the plurality of users. The team is a group of associated users.

In the embodiment of the application, the aggregation model can aggregate the plurality of users in various ways. In an optional implementation manner, the aggregation model finds neighbor nodes of each node according to edges in the graph data, aggregates adjacent nodes into communities based on the weight of the edges and the maximum module degree increment, and outputs an aggregation result after multiple rounds of iteration. The modularity is obtained according to the sum of the weights of the edges in the community and the sum of the weights of the edges connected with the nodes in the community.

In another optional implementation manner, the aggregation model firstly divides the nodes in the graph data into two groups according to a specified scale in an arbitrary manner, then exchanges two nodes for any pair of node pairs which do not belong to the same group, calculates the variation of the cut set scale of the two groups before and after exchange, selects the node pair which reduces the cut set scale most in all node pairs for exchange until the cut set scale is not improved, and outputs an aggregation result after multiple iterations. And the aggregation result is a plurality of groups corresponding to the optimal network division obtained in the final round, and each group is one team. The cut set scale variable quantity is obtained according to the difference between the external weight and the internal weight of each node in the node pair and the sum of the weights of the edges connected between the two groups.

And the identifying module 604 is used for identifying the cheating team from the teams according to the team positioning strategy.

First, operation behavior data of a plurality of users in each team is acquired. In the embodiment of the present application, the operation behavior data includes, but is not limited to, time of browsing goods N days before transaction, number of browsing goods N days before transaction, and number of sending private messages to merchants N days before transaction, where N is a preset positive integer, for example, 5.

And then, counting the average value of the operation behavior data of a plurality of users in the team, and determining whether the team is a cheating team according to the average value and a first threshold value.

In a preferred embodiment, the identification module 604 is also configured to identify the cheating user in the cheating team further based on a user location policy.

In order to further identify the user from the cheating team according to the user positioning strategy, the cheating user is positioned, and in this embodiment, the user positioning strategy refers to the cheating user positioning strategy based on the user operation behavior.

The identification module 604 first obtains the operational behavior data for each user in the cheating team and then determines whether the user is a cheating user based on the operational behavior data and a second threshold.

The specific implementation process of the functions of each module may be referred to the descriptions in the above first and second embodiments, and will not be repeated here.

The electronic commerce transaction cheating identification system provided by the embodiment can establish the user relationship according to the characteristic data of various dimensions, and takes the times of establishing the user relationship as the weight of the edges in the graph data, so that the user relationship reflected by the graph data is more diversified, the considered basis of the aggregation model in the aggregation process is more comprehensive, and the aggregation result is more accurate. In addition, after the graph data are constructed according to the user relationship and the graph data are processed through the aggregation model to obtain a plurality of teams, the teams are further identified according to the team positioning strategy, normal teams in the teams can be effectively eliminated based on some team cheating behaviors, the identified cheating team results are more accurate, and the situation that the normal teams are mistakenly treated as the cheating teams is avoided. In addition, after the cheating team is identified, the user with transaction cheating can be quickly and accurately identified according to the user positioning strategy based on the user operation behaviors, normal users in the cheating team are removed, and the fairness and stability of business ecology are guaranteed.

Example five

The present application also provides another embodiment, namely, a computer readable storage medium storing an e-commerce transaction cheating identification program, where the e-commerce transaction cheating identification program is executable by at least one processor, so that the at least one processor performs the steps of the e-commerce transaction cheating identification method as described above.

In this embodiment, the computer-readable storage medium includes a flash memory, a hard disk, a multimedia card, a card memory (e.g., SD or DX memory, etc.), a Random Access Memory (RAM), a Static Random Access Memory (SRAM), a read-only memory (ROM), an electrically erasable programmable read-only memory (EEPROM), a programmable read-only memory (PROM), a magnetic memory, a magnetic disk, an optical disk, and the like. In some embodiments, the computer readable storage medium may be an internal storage unit of a computer device, such as a hard disk or a memory of the computer device. In other embodiments, the computer readable storage medium may also be an external storage device of a computer device, such as a plug-in hard disk, smart Media Card (SMC), secure Digital (SD) Card, flash memory Card (Flash Card), etc. that are provided on the computer device. Of course, the computer-readable storage medium may also include both internal storage units of a computer device and external storage devices. In this embodiment, the computer readable storage medium is typically used to store an operating system and various application software installed on the computer device, for example, program code of the e-commerce transaction cheating identification method in the embodiment, and the like. Furthermore, the computer-readable storage medium may also be used to temporarily store various types of data that have been output or are to be output.

It should be noted that, in this document, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one … …" does not exclude the presence of other like elements in a process, method, article, or apparatus that comprises the element.

The foregoing embodiment numbers of the present application are merely for the purpose of description, and do not represent the advantages or disadvantages of the embodiments.

It will be apparent to those skilled in the art that the modules or steps of the embodiments of the application described above may be implemented in a general purpose computing device, they may be concentrated on a single computing device, or distributed across a network of computing devices, they may alternatively be implemented in program code executable by computing devices, so that they may be stored in a storage device for execution by computing devices, and in some cases, the steps shown or described may be performed in a different order than what is shown or described, or they may be separately fabricated into individual integrated circuit modules, or a plurality of modules or steps in them may be fabricated into a single integrated circuit module. Thus, embodiments of the application are not limited to any specific combination of hardware and software.

The foregoing description is only the preferred embodiments of the present application, and is not intended to limit the scope of the embodiments of the present application, but rather the equivalent structures or equivalent flow changes made by the descriptions of the embodiments of the present application and the contents of the drawings, or the direct or indirect application in other related technical fields, are all included in the scope of the embodiments of the present application.

Claims

1. An electronic commerce transaction cheating identification method, which is characterized by comprising the following steps:

2. The method for identifying the cheating in the e-commerce transaction according to claim 1, wherein the constructing graph data based on the relationship between the plurality of users comprises:

Acquiring information of all users to be identified, and taking each user as a node;

establishing a relation between users according to the characteristics of multiple dimensions, and taking each pair of user relations as one edge;

the times of establishing the relation between each pair of users are used as the weight of the corresponding edge;

the graph data is constructed by a combination of the nodes and the edges.

3. The method for identifying the cheating in the e-commerce transaction according to claim 2, wherein the establishing a relationship between users according to the characteristics of the plurality of dimensions comprises:

the method comprises the steps of obtaining multidimensional feature data of each user, wherein the multidimensional feature data comprise user IP addresses, equipment identifiers, purchase mechanism identifiers, commodity purchase time and user registration time;

when any of the feature data between any two users is associated, a relationship is established between the two users.

4. The method of claim 1, wherein aggregating the plurality of users based on the graph data to obtain a plurality of teams comprises:

and processing the graph data through an aggregation model to aggregate the nodes according to the edges and the weights of the edges between two nodes in the graph data, and outputting an aggregation result, wherein the aggregation result comprises a plurality of teams corresponding to the plurality of users.

5. The method for identifying the cheating in electronic commerce transactions according to claim 4, wherein said processing said graph data through an aggregate model comprises:

the aggregation model finds neighbor nodes of each node according to the edges in the graph data, aggregates the adjacent nodes into communities based on the weight of the edges and the increment of the maximum modularity, and outputs an aggregation result after multiple iterations, wherein the modularity is obtained according to the sum of the weights of the edges in the communities and the sum of the weights of the edges connected with the nodes in the communities.

6. The method for identifying the cheating in electronic commerce transaction according to claim 5, wherein said processing said graph data through an aggregation model comprises:

each node traverses all the neighboring nodes of the node, and calculates a module degree increment aggregated with the neighboring nodes according to the weight of the edge between the node and the neighboring nodes;

each node selects the neighbor node with the largest modularity increment to be aggregated into a community until all nodes can not increase the modularity through aggregation;

merging each community into a new node to form new graph data;

repeating the steps for the new graph data until the modularity is not increased any more, and outputting a plurality of communities finally aggregated, wherein the communities are the teams.

7. The method for identifying the cheating in electronic commerce transactions according to claim 4, wherein said processing said graph data through an aggregate model comprises:

the aggregation model divides nodes in the graph data into two groups according to a specified scale in an arbitrary mode, exchanges node pairs which do not belong to the same group, calculates the variation of the cut set scale of the two groups before and after exchange to improve the cut set scale of the groups, and outputs an aggregation result after multiple iterations until the cut set scale is not improved, wherein the variation of the cut set scale is obtained according to the difference between the external weight and the internal weight of each node in the node pair and the sum of the weights of the edges connected between the two groups.

8. The method for identifying the cheating in electronic commerce transactions according to claim 7, wherein said processing said graph data through an aggregate model comprises:

dividing nodes in the graph data into two groups according to a specified scale in any mode, and calculating the change quantity of the cut set scale of the two groups before and after node exchange for any pair of two nodes which do not belong to the same group;

selecting node pairs with the most cut set scale reduction from all node pairs for exchanging to obtain two new groups;

Removing the exchanged node pairs, and continuing to exchange other node pairs in the two new groups until no node pairs can be exchanged;

recording the state after each exchange, and selecting a group in the state of minimum cut set scale as the optimal network division of the round;

and dividing the optimal network into an initial group of the next round, and performing multiple rounds of iteration until the cutset scale is not improved any more, and outputting a plurality of finally aggregated groups, wherein the groups are the teams.

9. The method for identifying electronic commerce transaction cheating according to claim 1, wherein said identifying a cheating team from said plurality of teams according to a team locating strategy comprises:

acquiring operation behavior data of a plurality of users in each team;

counting the average value of the operation behavior data of a plurality of users in the team;

and determining whether the team is a cheating team according to the average value and the first threshold value.

10. The method for identifying e-commerce transaction cheating as claimed in claim 1, further comprising:

in the cheating team, the cheating user is identified according to a user positioning strategy, wherein the user positioning strategy is based on the user operation behavior.

11. The method for identifying the cheating in the e-commerce transaction according to claim 10, wherein the step of identifying the cheating user according to the user positioning policy comprises:

acquiring operation behavior data of each user in the cheating team;

and determining whether the user is a cheating user according to the operation behavior data and the second threshold value.

12. The method for identifying the cheating of e-commerce transactions according to claim 9 or 11, wherein the operation behavior data includes a time of browsing goods N days before the transaction, a number of browsing goods N days before the transaction, and a number of private messages sent to merchants N days before the transaction, wherein N is a preset positive integer.

13. The method of claim 9, wherein determining whether the team is a cheating team based on the average and a first threshold comprises:

when the average value of each operation behavior data in the team is smaller than a corresponding first threshold value, determining that the team is a cheating team;

and when the average value of each operation behavior data in the team is greater than or equal to the corresponding first threshold value, determining that the team is a normal team.

14. The method for identifying the cheating in the e-commerce transaction according to claim 11, wherein the determining whether the user is a cheating user according to the operation behavior data and the second threshold value comprises:

When each operation behavior data of the user is smaller than a corresponding second threshold value, determining that the user is a cheating user;

and when each operation behavior data of the user is greater than or equal to a corresponding second threshold value, determining that the user is a normal user.

15. An electronic commerce transaction cheating identification system, the system comprising:

16. An electronic device, the electronic device comprising: memory, a processor and an e-commerce transaction cheating identification program stored on the memory and executable on the processor, which when executed by the processor implements the e-commerce transaction cheating identification method of any one of claims 1 to 14.

17. A computer readable storage medium, wherein an e-commerce transaction cheating identification program is stored on the computer readable storage medium, which when executed by a processor, implements the e-commerce transaction cheating identification method of any one of claims 1 to 14.