Search

CN-121998702-A - Gift package instead of charging identification and wind control method, system and equipment based on AI

CN121998702ACN 121998702 ACN121998702 ACN 121998702ACN-121998702-A

Abstract

The invention discloses a gift bag charging identification and wind control method, a system and equipment based on AI, wherein the method specifically comprises the steps of configuring a group of combined risk rules containing multi-dimensional factors based on a feature warehouse, and triggering a primary risk mark when the multi-dimensional factors meet abnormal conditions in a specific time window; the method comprises the steps of inputting a primary risk mark into a trust score model and an abnormality detection model, outputting a comprehensive risk score and a treatment suggestion, taking the comprehensive risk score, a result of executing the treatment suggestion and feedback thereof as a state input depth Q network, and automatically adjusting a risk score threshold value, treatment action intensity and weight of a combined risk rule according to a real-time wind control effect index. According to the invention, through constructing the AI dynamic wind control model based on multidimensional data and gift bag life cycle analysis, the problems of the traditional wind control method can be effectively solved, the precise identification and real-time interception of the gift bag charging behavior are realized, and a powerful guarantee is provided for the safe operation of the game prop gift bag.

Inventors

  • ZHANG YUSHENG

Assignees

  • 安徽三七极域网络科技有限公司

Dates

Publication Date
20260508
Application Date
20251229

Claims (10)

  1. 1. The utility model provides a gift bag is filled discernment and wind control method based on AI which characterized in that, the method specifically includes: based on the gift package life cycle data and marketing data of the game server, combining account numbers, equipment and network behavior data acquired by the security component to construct a feature warehouse; Configuring a group of combined risk rules containing multi-dimensional factors based on the feature warehouse, and triggering a primary risk mark when the multi-dimensional factors simultaneously meet abnormal conditions in a specific time window; inputting the primary risk mark into a trust score model and an anomaly detection model, and outputting a comprehensive risk score and a treatment suggestion by fusing a dynamic trust value output by the trust score model, an anomaly score output by the anomaly detection model and a grade score of the primary risk mark; Taking the comprehensive risk score, the result of executing the treatment suggestion and the feedback thereof as a state input depth Q network, and automatically adjusting the risk score threshold value, the treatment action strength and the weight of the combined risk rule according to the real-time wind control effect index; and carrying out attribution analysis on the model decision process of the high-risk case by adopting an SHAP model interpretability technology, and outputting the contribution degree of the key risk features.
  2. 2. The method of claim 1, wherein the establishing a feature repository based on the package lifecycle data and marketing data of the game server in combination with account numbers, devices and network behavior data collected by the security component specifically comprises: Accessing gift package transaction logs from a game service server, activity data from a marketing platform, account numbers, equipment and network behavior data acquired by a client security component through an application programming interface and a data bus to form multi-source heterogeneous data; The method comprises the steps of performing format unification, cleaning and standardization treatment on multi-source heterogeneous data to form standardized data; extracting users, equipment, orders and marketing activities as core entities based on standardized data, and establishing association relations among the core entities, such as binding, purchasing, participation and asset transfer through orders and behavior logs; aiming at a core entity, carrying out statistical calculation in a preset time sliding window to generate time sequence behavior characteristics and aggregation environment characteristics; and splicing and encoding the standardized data, the association relation, the time sequence behavior characteristic and the aggregation environment characteristic according to the core entity to form a characteristic warehouse.
  3. 3. The method according to claim 1, wherein the feature-based repository configures a set of combined risk rules comprising multi-dimensional factors, and wherein the triggering of the primary risk flag when the multi-dimensional factors simultaneously meet the exception condition within a specific time window comprises: configuring a plurality of groups of combined risk rules based on quantitative feature factors defined by a feature warehouse; when a transaction risk judging request is received, inquiring and assembling feature vectors in a feature warehouse corresponding to the transaction risk judging request in real time to form a judging context; Performing traversal matching on the judging context and all the combined risk rules, and judging that the combined risk rule is hit when the sub-conditions of all the dimension factors in any group of combined risk rules are simultaneously met in a specific time window; And calculating and summarizing to obtain a preliminary weighted risk score based on the weight preconfigured by the hit combined risk rule, and triggering the corresponding preliminary risk mark and the grade score thereof by comparing the preliminary weighted risk score with a preset risk grade threshold.
  4. 4. The method according to claim 1, wherein the inputting the primary risk score into the trust score model and the anomaly detection model, and outputting the comprehensive risk score and the treatment suggestion by fusing the dynamic trust value output by the trust score model, the anomaly score output by the anomaly detection model, and the grade score of the primary risk score, specifically comprises: acquiring a full-dimensional feature vector of a user corresponding to the primary risk mark from a feature warehouse, and extracting a user long-term behavior feature subset, a transaction instant context and a group behavior feature subset from the full-dimensional feature vector; Inputting the user long-term behavior feature subset into a pre-trained trust scoring model, and outputting a dynamic trust value by analyzing the stability and the value of the user historical behavior; Inputting the instant transaction context and the group behavior feature subset into a pre-trained anomaly detection model, and outputting an anomaly score by identifying the deviation degree of the current transaction link; And normalizing and splicing the dynamic trust value, the abnormal score and the grade score corresponding to the primary risk mark to form a fusion feature vector, inputting the fusion feature vector into the integrated learning module to carry out nonlinear relation judgment, and outputting the comprehensive risk score and the corresponding treatment suggestion.
  5. 5. The method according to claim 4, wherein the inputting the subset of the long-term behavior features of the user into the pre-trained trust scoring model outputs a dynamic trust value by analyzing the stability and value of the user's historical behavior, specifically comprising: Constructing a multi-task learning neural network model, wherein the multi-task learning neural network model comprises a shared bottom layer feature embedding layer and a plurality of parallel output heads, the shared bottom layer feature embedding layer is used for extracting a plurality of feature sharing information, and the parallel output heads are used for outputting the probability of the future fraudulent behavior of a user, the long-term retention possibility of the user and the potential life cycle value grade of the user; Constructing a training sample set by using historical user data, and constructing a reference trust level label based on the continuous retention and payment performance of the user in a preset time period; Training a multi-task learning neural network model by using the training sample set and the reference trust level label, inputting the long-term behavior feature subset of the user into the trained multi-task learning neural network model for prediction, and outputting a preliminary static trust score; Monitoring the latest key behavior event stream of the user in real time, performing real-time fine adjustment on the preliminary static trust score based on a lightweight increment calculation model, introducing a time decay function to smoothly reduce the influence of long-term historical behaviors, and outputting a user trust value.
  6. 6. The method of claim 4, wherein inputting the transaction instant context and the subset of group behavioral characteristics into a pre-trained anomaly detection model, outputting anomaly scores by identifying a degree of departure of a current transaction link, comprises: training a baseline model by using historical normal transaction data, and introducing transaction context as a condition variable in the training process to enable the baseline model to learn normal behavior mode differences under different scenes so as to obtain a dynamic baseline model; inputting the feature combination of the transaction instant context and the group behavior feature subset into a dynamic baseline model, and generating an original abnormal index by calculating the deviation degree between the feature combination and a model built-in normal mode; And normalizing the original abnormality index, and outputting a quantized abnormality score for representing the abnormality possibility of the current transaction behavior.
  7. 7. The method according to claim 1, wherein the step of automatically adjusting the risk score threshold, the treatment action intensity and the weight of the combined risk rule according to the real-time wind control effect index by using the comprehensive risk score, the result of performing treatment advice and the feedback thereof as the state input depth Q network comprises the following steps: Setting the comprehensive risk score, the execution action of the treatment suggestion and the user feedback data thereof as state vectors, and setting an adjustment instruction for the wind control score threshold value, the treatment action intensity and the combination rule weight as an action space; designing a multi-objective weighted reward function based on the safety effect after action execution and user experience; training a deep Q network according to the state vector, the action space and the multi-target weighted reward function to learn the mapping strategy of the state to the optimal parameter adjustment action; and inputting the state data of the real-time wind control effect index into the trained deep Q network, selecting actions according to the highest expected long-term rewards output by the deep Q network, and generating a specific wind control parameter adjustment instruction.
  8. 8. The method according to any one of claims 1 to 7, wherein the attribution analysis of the model decision process of the high risk case using SHAP model interpretability technique, outputting a key risk feature contribution, specifically comprises: screening out a transaction case judged to be at high risk, and acquiring a first fusion feature vector and a corresponding high risk prediction result, wherein the first fusion feature vector is input to a trust scoring model and an anomaly detection model; Calculating the saproli value contribution degree of each feature in the first fused feature vector to the high-risk prediction result based on a representative background data set by adopting an SHAP interpretability framework; Sorting the features according to the absolute value of the saprolitic value contribution degree, identifying key risk driving features, analyzing the direction and the size of the contribution of each feature, and obtaining an analysis result; Based on the parsing result, a multi-modal interpretability report is generated that includes the text summary, the visual chart, and the structured data.
  9. 9. AI-based gift bag instead of charging identification and wind control system, which is characterized in that the system specifically comprises: The data acquisition module is used for constructing a feature warehouse based on the gift package life cycle data and marketing data of the game server and combining account number, equipment and network behavior data acquired by the security component; the rule configuration module is used for configuring a group of combined risk rules containing multi-dimensional factors based on the feature warehouse, and triggering a primary risk mark when the multi-dimensional factors simultaneously meet abnormal conditions in a specific time window; The risk scoring module is used for inputting the primary risk mark into the trust scoring model and the anomaly detection model, and outputting comprehensive risk scores and treatment suggestions by fusing the dynamic trust value output by the trust scoring model, the anomaly score output by the anomaly detection model and the grade score of the primary risk mark; The risk adjustment module is used for taking the comprehensive risk score, the result of executing the treatment suggestion and the feedback thereof as a state input depth Q network, and automatically adjusting the risk score threshold value, the treatment action intensity and the weight of the combined risk rule according to the real-time wind control effect index; and the attribution analysis module is used for attributing and analyzing the model decision process of the high-risk case by adopting the SHAP model interpretability technology and outputting the contribution degree of the key risk features.
  10. 10. A computer device comprising a memory and a processor and a computer program stored on the memory, which when executed on the processor, implements the AI-based gift certificate and air control method of any of claims 1-8.

Description

Gift package instead of charging identification and wind control method, system and equipment based on AI Technical Field The invention relates to the technical field of artificial intelligence, in particular to a gift bag charging identification and wind control method, system and equipment based on AI. Background In a long line period of game operation, prop packages are used as core assets of games and important carriers for paying by users, and play a key role in establishing transaction trust between a platform and the users. The method is not only an important component of an economic system in the game, directly influences the balance and the interest of the game, but also is an important way for a game operator to obtain benefits and maintain the continuous development of the game. However, current game item gift bag operations face serious challenges, and the malicious behavior of the black-office organization severely compromises game ecology and platform interests. The black product organization adopts various means to perform illegal operations, such as maliciously brushing the benefits of the activities, obtaining a large amount of gift bags which should be normally issued to users by utilizing the loopholes of the game activities, destroying the fairness of the activities, utilizing the code loopholes to bypass the rules and restrictions set by the games to perform illegal gift bag acquisition and transaction, and providing substitute recharging services at low price, such as obtaining 648 yuan gift bags with 100 yuan, earning the difference from the gift bags, thereby seriously disturbing the economic order in the games. The method comprises the steps of obtaining a game server, obtaining a virtual account number, generating a plurality of false account numbers in a short time by a black product organization, generating a large number of false account numbers in a short time by means of batch account number registration, increasing unstable factors in the game, forging an IP address, avoiding wind control detection based on the IP address, enabling a wind control system to be difficult to accurately identify the real position and a behavior mode of the wind control system, and carrying out illegal recharging operation by utilizing differences among game servers in different areas. These means are complex and variable, which brings great trouble to the game operation. In the face of these malicious behaviors of the black-producing organization, the traditional wind control method mainly relies on a single rule engine or manual auditing, however, the methods have a plurality of limitations, and are difficult to effectively cope with complicated and changeable black-producing means. The manner of air control of a single rule engine, the rules of which are usually formulated based on known patterns of black yielding behavior, lacks flexibility and adaptability. When the black-birth organization changes its behavior mode or adopts new means, the original rules may not be recognized and intercepted in time, resulting in a great discount on the wind control effect. Moreover, a single rule engine can only judge from limited dimensions, so that complex relationships among various factors are difficult to comprehensively consider, and misjudgment or missed judgment is easy to occur. The manual auditing can identify suspicious behaviors by virtue of experience and judgment of auditors to a certain extent, but has low efficiency and high cost. With the continuous increase of the number of game users and the increasing of the transaction amount, the manual auditing cannot meet the requirement of real-time wind control, and each transaction is difficult to audit timely and accurately. Meanwhile, the problem of strong subjectivity exists in manual auditing, and different auditors can have differences in judging the same behavior, so that auditing results are inconsistent. Therefore, the traditional wind control method is worry when dealing with malicious behaviors of black organizations, and the safe operation and the benefits of a platform of a game prop gift bag cannot be effectively ensured. Disclosure of Invention The invention aims to provide an AI-based gift bag charging identification and wind control method, system and equipment, which can effectively solve the problems of the traditional wind control method by constructing an AI dynamic wind control model based on multidimensional data and gift bag life cycle analysis, realize the accurate identification and real-time interception of the gift bag charging behavior, and provide powerful guarantee for the safe operation of game prop gift bags so as to solve at least one of the problems in the prior art. In a first aspect, the present invention provides an AI-based gift bag charging identification and wind control method, which specifically includes: based on the gift package life cycle data and marketing data of the game server, combining account num