跨境电商风控合规体系全景解析：从商品准入到反欺诈的技术实战

/**
 * 禁售商品检测引擎
 * 核心技术：规则引擎 + NLP自然语言处理 + 知识图谱
 */
@Service
@Slf4j
public class ProhibitedGoodsDetectionService {

    @Autowired
    private ProhibitedGoodsRepository prohibitedGoodsRepository;

    @Autowired
    private NlpService nlpService;

    @Autowired
    private KnowledgeGraphService knowledgeGraphService;

    /**
     * 商品上架前的合规检测
     */
    public ComplianceCheckResult checkCompliance(Product product) {
        List<ComplianceViolation> violations = new ArrayList<>();

        // 1. 关键词匹配（快速筛查）
        violations.addAll(checkByKeywords(product));

        // 2. 语义分析（识别变体词、谐音词）
        violations.addAll(checkBySemantic(product));

        // 3. 类目匹配（某些类目整体禁售）
        violations.addAll(checkByCategory(product));

        // 4. 品牌授权检查
        violations.addAll(checkBrandAuthorization(product));

        // 5. 资质文件检查
        violations.addAll(checkQualifications(product));

        if (violations.isEmpty()) {
            return ComplianceCheckResult.passed();
        } else {
            return ComplianceCheckResult.failed(violations);
        }
    }

    /**
     * 方法1：关键词匹配
     * 最基础的检测方式，但容易被绕过
     */
    private List<ComplianceViolation> checkByKeywords(Product product) {
        List<ComplianceViolation> violations = new ArrayList<>();

        // 1. 加载禁售关键词库
        List<String> prohibitedKeywords = prohibitedGoodsRepository.getAllKeywords();

        // 2. 检查商品标题
        String title = product.getName().toLowerCase();
        for (String keyword : prohibitedKeywords) {
            if (title.contains(keyword)) {
                violations.add(ComplianceViolation.builder()
                    .type("PROHIBITED_KEYWORD")
                    .severity("HIGH")
                    .description("商品标题包含禁售关键词：" + keyword)
                    .suggestion("请移除关键词或修改商品描述")
                    .build());
            }
        }

        // 3. 检查商品描述
        String description = product.getDescription().toLowerCase();
        for (String keyword : prohibitedKeywords) {
            if (description.contains(keyword)) {
                violations.add(ComplianceViolation.builder()
                    .type("PROHIBITED_KEYWORD")
                    .severity("HIGH")
                    .description("商品描述包含禁售关键词：" + keyword)
                    .build());
            }
        }

        return violations;
    }

    /**
     * 方法2：语义分析（识别变体词、谐音词）
     * 例如："电子烟" → "电子yan"、"dianziyan"、"雾化器"
     */
    private List<ComplianceViolation> checkBySemantic(Product product) {
        List<ComplianceViolation> violations = new ArrayList<>();

        // 1. 使用NLP提取商品核心概念
        List<String> concepts = nlpService.extractConcepts(product.getName());

        // 2. 在知识图谱中查询相关禁售商品
        for (String concept : concepts) {
            List<ProhibitedGoods> relatedProhibited = knowledgeGraphService
                .findRelatedProhibitedGoods(concept, 0.7);  // 相似度阈值70%

            for (ProhibitedGoods prohibited : relatedProhibited) {
                violations.add(ComplianceViolation.builder()
                    .type("SEMANTIC_PROHIBITED")
                    .severity("HIGH")
                    .description("商品语义与禁售商品相关：" + prohibited.getName())
                    .similarity(prohibited.getSimilarity())
                    .build());
            }
        }

        return violations;
    }

    /**
     * 方法3：类目匹配
     * 某些类目整体禁售
     */
    private List<ComplianceViolation> checkByCategory(Product product) {
        List<ComplianceViolation> violations = new ArrayList<>();

        // 禁售类目
        Set<String> prohibitedCategories = Set.of(
            "电子烟",
            "处方药",
            "枪支仿真品",
            "成人用品"
        );

        String category = product.getCategoryName();
        if (prohibitedCategories.contains(category)) {
            violations.add(ComplianceViolation.builder()
                .type("PROHIBITED_CATEGORY")
                .severity("CRITICAL")
                .description("该类目整体禁售：" + category)
                .suggestion("请选择其他类目")
                .build());
        }

        return violations;
    }

    /**
     * 方法4：品牌授权检查
     */
    private List<ComplianceViolation> checkBrandAuthorization(Product product) {
        List<ComplianceViolation> violations = new ArrayList<>();

        // 1. 判断是否是知名品牌
        boolean isFamousBrand = brandService.isFamousBrand(product.getBrand());

        if (isFamousBrand) {
            // 2. 检查商家是否有品牌授权
            boolean hasAuthorization = authorizationService.checkAuthorization(
                product.getMerchantId(),
                product.getBrand()
            );

            if (!hasAuthorization) {
                violations.add(ComplianceViolation.builder()
                    .type("NO_BRAND_AUTHORIZATION")
                    .severity("CRITICAL")
                    .description("销售知名品牌商品需要品牌授权：" + product.getBrand())
                    .suggestion("请上传品牌授权书")
                    .build());
            }
        }

        return violations;
    }

    /**
     * 方法5：资质文件检查
     * 特殊商品需要特殊资质（如食品经营许可证）
     */
    private List<ComplianceViolation> checkQualifications(Product product) {
        List<ComplianceViolation> violations = new ArrayList<>();

        // 需要特殊资质的类目
        Map<String, String> requiredQualifications = Map.of(
            "食品", "食品经营许可证",
            "保健品", "保健食品批准证书",
            "化妆品", "化妆品生产许可证",
            "医疗器械", "医疗器械经营许可证"
        );

        String category = product.getCategoryName();
        String requiredQualification = requiredQualifications.get(category);

        if (requiredQualification != null) {
            // 检查商家是否上传了资质文件
            boolean hasQualification = qualificationService.checkQualification(
                product.getMerchantId(),
                requiredQualification
            );

            if (!hasQualification) {
                violations.add(ComplianceViolation.builder()
                    .type("MISSING_QUALIFICATION")
                    .severity("HIGH")
                    .description("该类目商品需要资质：" + requiredQualification)
                    .suggestion("请上传相关资质证明文件")
                    .build());
            }
        }

        return violations;
    }
}

/**
 * 禁售关键词库管理
 * 支持动态更新、版本管理、变体词管理
 */
@Service
public class ProhibitedKeywordLibraryService {

    /**
     * 禁售关键词数据结构
     */
    @Data
    @Builder
    public static class ProhibitedKeyword {
        private String keyword;              // 关键词
        private List<String> variants;       // 变体词（谐音、拆字）
        private String category;             // 类别
        private String severity;             // 严重程度
        private String legalBasis;           // 法律依据
        private LocalDate effectiveDate;     // 生效日期
    }

    /**
     * 初始化禁售关键词库
     */
    @PostConstruct
    public void initKeywordLibrary() {
        List<ProhibitedKeyword> keywords = Arrays.asList(
            // 毒品类
            ProhibitedKeyword.builder()
                .keyword("大麻")
                .variants(Arrays.asList("hemp", "cannabis", "da ma", "大🌿"))
                .category("DRUGS")
                .severity("CRITICAL")
                .legalBasis("《刑法》第347条")
                .effectiveDate(LocalDate.of(2020, 1, 1))
                .build(),

            // 烟草类
            ProhibitedKeyword.builder()
                .keyword("电子烟")
                .variants(Arrays.asList("雾化器", "小烟", "电子yan", "vape"))
                .category("TOBACCO")
                .severity("HIGH")
                .legalBasis("《电子烟管理办法》")
                .effectiveDate(LocalDate.of(2022, 5, 1))
                .build(),

            // 武器类
            ProhibitedKeyword.builder()
                .keyword("仿真枪")
                .variants(Arrays.asList("玩具枪", "bb弹枪", "软弹枪"))
                .category("WEAPONS")
                .severity("CRITICAL")
                .legalBasis("《枪支管理法》")
                .effectiveDate(LocalDate.of(2019, 1, 1))
                .build()
        );

        // 保存到Redis（支持快速查询）
        for (ProhibitedKeyword keyword : keywords) {
            redisTemplate.opsForHash().put(
                "prohibited_keywords",
                keyword.getKeyword(),
                keyword
            );

            // 建立变体词索引
            for (String variant : keyword.getVariants()) {
                redisTemplate.opsForHash().put(
                    "prohibited_keywords",
                    variant,
                    keyword
                );
            }
        }
    }

    /**
     * 定时更新关键词库（从监管部门API同步）
     */
    @Scheduled(cron = "0 0 2 * * ?")  // 每天凌晨2点更新
    public void syncKeywordLibrary() {
        // 1. 调用监管部门API
        List<ProhibitedKeyword> latestKeywords = regulatoryApiClient.getProhibitedKeywords();

        // 2. 对比本地库，找出新增关键词
        List<ProhibitedKeyword> newKeywords = findNewKeywords(latestKeywords);

        // 3. 更新关键词库
        for (ProhibitedKeyword keyword : newKeywords) {
            saveKeyword(keyword);
            log.info("新增禁售关键词：{}", keyword.getKeyword());

            // 4. 触发全量商品重新检测
            triggerFullScan(keyword);
        }
    }

    /**
     * 触发全量商品重新检测
     * 当新增禁售关键词时，需要重新检测已上架商品
     */
    private void triggerFullScan(ProhibitedKeyword keyword) {
        // 1. 查询所有在售商品
        List<Product> products = productRepository.findByStatus("ONLINE");

        // 2. 异步检测
        for (Product product : products) {
            CompletableFuture.runAsync(() -> {
                ComplianceCheckResult result = checkCompliance(product);

                if (!result.isPassed()) {
                    // 3. 发现违规商品，自动下架
                    product.setStatus("OFFLINE");
                    product.setOfflineReason("包含新增禁售关键词：" + keyword.getKeyword());
                    productRepository.save(product);

                    // 4. 通知商家
                    notificationService.sendComplianceWarning(product);
                }
            });
        }
    }
}

/**
 * 品牌授权管理系统
 * 核心功能：授权书上传、OCR识别、真伪验证、有效期管理
 */
@Service
public class BrandAuthorizationService {

    @Autowired
    private OcrService ocrService;

    @Autowired
    private BlockchainService blockchainService;

    /**
     * 商家上传品牌授权书
     */
    @Transactional
    public AuthorizationResult uploadAuthorization(
        Long merchantId,
        String brandName,
        MultipartFile authorizationFile
    ) {
        // 1. OCR识别授权书内容
        AuthorizationInfo info = ocrService.recognizeAuthorization(authorizationFile);

        // 2. 验证授权书真伪
        boolean isValid = verifyAuthorization(info);

        if (!isValid) {
            return AuthorizationResult.failed("授权书验证失败，请上传真实有效的授权书");
        }

        // 3. 保存授权记录
        BrandAuthorization authorization = BrandAuthorization.builder()
            .merchantId(merchantId)
            .brandName(brandName)
            .authorizationNo(info.getAuthorizationNo())
            .issuer(info.getIssuer())              // 授权方
            .licensee(info.getLicensee())          // 被授权方
            .startDate(info.getStartDate())
            .endDate(info.getEndDate())
            .scope(info.getScope())                // 授权范围
            .status("VALID")
            .build();
        authorizationRepository.save(authorization);

        // 4. 将授权记录上链（防篡改）
        String txHash = blockchainService.recordAuthorization(authorization);
        authorization.setBlockchainTxHash(txHash);
        authorizationRepository.save(authorization);

        // 5. 定时检查授权有效期
        scheduleExpirationCheck(authorization);

        return AuthorizationResult.success(authorization);
    }

    /**
     * 验证授权书真伪
     * 方法1：品牌方官网验证接口
     * 方法2：区块链验证（品牌方预先将授权书上链）
     */
    private boolean verifyAuthorization(AuthorizationInfo info) {
        // 1. 调用品牌方官网验证接口
        boolean verifiedByBrand = brandApiClient.verifyAuthorization(
            info.getBrandName(),
            info.getAuthorizationNo()
        );

        if (verifiedByBrand) {
            return true;
        }

        // 2. 从区块链验证
        boolean verifiedByBlockchain = blockchainService.verifyAuthorization(
            info.getAuthorizationNo()
        );

        return verifiedByBlockchain;
    }

    /**
     * 定时检查授权有效期
     */
    @Scheduled(cron = "0 0 1 * * ?")  // 每天凌晨1点执行
    public void checkExpirations() {
        // 1. 查询即将过期的授权（30天内）
        LocalDate thirtyDaysLater = LocalDate.now().plusDays(30);
        List<BrandAuthorization> expiringAuthorizations = authorizationRepository
            .findByEndDateBefore(thirtyDaysLater);

        for (BrandAuthorization auth : expiringAuthorizations) {
            // 2. 提醒商家续期
            notificationService.sendExpirationWarning(auth);

            // 3. 已过期的授权，自动失效
            if (auth.getEndDate().isBefore(LocalDate.now())) {
                auth.setStatus("EXPIRED");
                authorizationRepository.save(auth);

                // 4. 下架该商家对应品牌的所有商品
                offlineBrandProducts(auth.getMerchantId(), auth.getBrandName());
            }
        }
    }

    /**
     * 下架商家品牌商品
     */
    private void offlineBrandProducts(Long merchantId, String brandName) {
        List<Product> products = productRepository.findByMerchantIdAndBrand(
            merchantId,
            brandName
        );

        for (Product product : products) {
            product.setStatus("OFFLINE");
            product.setOfflineReason("品牌授权已过期");
            productRepository.save(product);
        }

        // 通知商家
        notificationService.sendBrandAuthorizationExpired(merchantId, brandName);
    }
}

/**
 * 防伪溯源系统
 * 技术方案：区块链 + 物联网 + 二维码
 */
@Service
public class AntiCounterfeitingService {

    @Autowired
    private BlockchainService blockchainService;

    /**
     * 商品生产时，生成防伪码
     */
    public AntiFakeCode generateAntiFakeCode(Product product) {
        // 1. 生成唯一防伪码（UUID + 加密）
        String antiFakeCode = generateUniqueCode(product);

        // 2. 记录商品全链路信息
        ProductTraceInfo traceInfo = ProductTraceInfo.builder()
            .antiFakeCode(antiFakeCode)
            .productId(product.getId())
            .productName(product.getName())
            .brand(product.getBrand())
            .manufacturer(product.getManufacturer())
            .productionDate(product.getProductionDate())
            .batchNo(product.getBatchNo())
            .build();

        // 3. 上链（不可篡改）
        String txHash = blockchainService.recordTraceInfo(traceInfo);
        traceInfo.setBlockchainTxHash(txHash);

        // 4. 生成二维码
        byte[] qrCode = qrCodeService.generate(antiFakeCode);

        // 5. 保存防伪码
        AntiFakeCode code = AntiFakeCode.builder()
            .code(antiFakeCode)
            .productId(product.getId())
            .qrCode(qrCode)
            .blockchainTxHash(txHash)
            .status("ACTIVE")
            .build();
        antiFakeCodeRepository.save(code);

        return code;
    }

    /**
     * 用户扫码验证真伪
     */
    public VerificationResult verifyProduct(String antiFakeCode) {
        // 1. 从区块链查询商品信息
        ProductTraceInfo traceInfo = blockchainService.queryTraceInfo(antiFakeCode);

        if (traceInfo == null) {
            return VerificationResult.fake("该防伪码不存在，商品可能是假冒品");
        }

        // 2. 检查防伪码是否已被查询过多次（可能是复制的假码）
        int queryCount = incrementQueryCount(antiFakeCode);

        if (queryCount > 10) {
            return VerificationResult.warning(
                "该防伪码已被查询" + queryCount + "次，请警惕假冒商品"
            );
        }

        // 3. 返回商品全链路信息
        return VerificationResult.genuine(traceInfo);
    }

    /**
     * 记录物流轨迹到区块链
     */
    public void recordLogisticsTrace(String antiFakeCode, LogisticsEvent event) {
        // 1. 构建物流事件
        LogisticsTraceInfo trace = LogisticsTraceInfo.builder()
            .antiFakeCode(antiFakeCode)
            .eventType(event.getType())          // 揽收、运输、签收
            .location(event.getLocation())
            .operator(event.getOperator())
            .timestamp(event.getTimestamp())
            .build();

        // 2. 上链
        blockchainService.recordLogisticsTrace(trace);

        // 3. 用户扫码时可以看到完整的物流轨迹
    }
}

/**
 * 反欺诈规则引擎
 * 技术方案：Drools规则引擎 + 机器学习模型
 */
@Service
public class AntiFraudService {

    @Autowired
    private KieContainer kieContainer;

    @Autowired
    private MachineLearningModelService mlService;

    /**
     * 订单风险评估
     */
    public RiskAssessmentResult assessOrderRisk(Order order) {
        // 1. 规则引擎评分
        int ruleScore = evaluateByRules(order);

        // 2. 机器学习模型评分
        double mlScore = mlService.predictFraudProbability(order);

        // 3. 综合评分
        double finalScore = ruleScore * 0.4 + mlScore * 0.6;

        // 4. 风险等级判定
        RiskLevel riskLevel = determineRiskLevel(finalScore);

        // 5. 风控决策
        return makeDecision(order, riskLevel, finalScore);
    }

    /**
     * 规则引擎评估
     */
    private int evaluateByRules(Order order) {
        KieSession kieSession = kieContainer.newKieSession();

        // 1. 设置全局变量
        kieSession.setGlobal("riskScore", new AtomicInteger(0));

        // 2. 插入事实对象
        kieSession.insert(order);
        kieSession.insert(order.getUser());
        kieSession.insert(order.getPayment());

        // 3. 执行规则
        kieSession.fireAllRules();

        // 4. 获取风险分数
        AtomicInteger riskScore = (AtomicInteger) kieSession.getGlobal("riskScore");

        kieSession.dispose();

        return riskScore.get();
    }

    /**
     * 风控决策
     */
    private RiskAssessmentResult makeDecision(Order order, RiskLevel riskLevel, double score) {
        switch (riskLevel) {
            case LOW:
                // 低风险：直接放行
                return RiskAssessmentResult.pass(order);

            case MEDIUM:
                // 中风险：人工审核
                return RiskAssessmentResult.review(order, "订单风险分数：" + score);

            case HIGH:
                // 高风险：拒绝交易
                return RiskAssessmentResult.reject(order, "订单存在欺诈风险");

            default:
                return RiskAssessmentResult.review(order, "未知风险等级");
        }
    }
}

// fraud-detection-rules.drl
package com.crossborder.risk

import com.crossborder.model.Order
import com.crossborder.model.User
import java.util.concurrent.atomic.AtomicInteger

global AtomicInteger riskScore

// 规则1：新注册用户首单高价值
rule "New User High Value Order"
when
    $order: Order(totalAmount > 1000)
    $user: User(registerDays < 3)
then
    riskScore.addAndGet(30);
    System.out.println("触发规则：新用户高价值订单");
end

// 规则2：短时间内多次下单
rule "Frequent Orders"
when
    $user: User()
    $count: Number(intValue > 5) from accumulate(
        $o: Order(userId == $user.getId(), createTime > "1 hour ago"),
        count($o)
    )
then
    riskScore.addAndGet(40);
    System.out.println("触发规则：1小时内下单" + $count + "次");
end

// 规则3：收货地址异常
rule "Abnormal Shipping Address"
when
    $order: Order()
    eval(isAbnormalAddress($order.getAddress()))
then
    riskScore.addAndGet(25);
    System.out.println("触发规则：收货地址异常");
end

// 规则4：支付账户与收货人不一致
rule "Payer Not Match Receiver"
when
    $order: Order()
    $payment: Payment(payerName != $order.getConsignee())
then
    riskScore.addAndGet(20);
    System.out.println("触发规则：支付人与收货人不一致");
end

// 规则5：使用多个优惠券
rule "Multiple Coupons"
when
    $order: Order(coupons.size() > 3)
then
    riskScore.addAndGet(15);
    System.out.println("触发规则：使用" + $order.getCoupons().size() + "张优惠券");
end

/**
 * 机器学习反欺诈模型
 * 算法：XGBoost分类模型
 */
@Service
public class MachineLearningModelService {

    @Autowired
    private XGBoostModel model;

    /**
     * 预测订单欺诈概率
     */
    public double predictFraudProbability(Order order) {
        // 1. 特征工程（提取40+个特征）
        Map<String, Object> features = extractFeatures(order);

        // 2. 调用模型预测
        double probability = model.predict(features);

        return probability;
    }

    /**
     * 特征提取（40+个特征）
     */
    private Map<String, Object> extractFeatures(Order order) {
        Map<String, Object> features = new HashMap<>();

        // 用户维度特征
        User user = order.getUser();
        features.put("user_register_days", user.getRegisterDays());
        features.put("user_total_orders", user.getTotalOrders());
        features.put("user_total_amount", user.getTotalAmount());
        features.put("user_avg_order_amount", user.getAvgOrderAmount());
        features.put("user_refund_rate", user.getRefundRate());
        features.put("user_complaint_count", user.getComplaintCount());

        // 订单维度特征
        features.put("order_amount", order.getTotalAmount());
        features.put("order_item_count", order.getItems().size());
        features.put("order_discount_amount", order.getDiscountAmount());
        features.put("order_discount_rate", order.getDiscountRate());
        features.put("order_hour", order.getCreateTime().getHour());
        features.put("order_day_of_week", order.getCreateTime().getDayOfWeek().getValue());

        // 支付维度特征
        Payment payment = order.getPayment();
        features.put("payment_type", payment.getPayType());
        features.put("payment_delay_seconds", payment.getPayDelaySeconds());

        // 地址维度特征
        features.put("address_changed", order.isAddressChanged());
        features.put("address_province", order.getProvince());
        features.put("address_risk_score", addressRiskService.getScore(order.getAddress()));

        // 设备维度特征
        features.put("device_id", order.getDeviceId());
        features.put("device_type", order.getDeviceType());
        features.put("ip_address", order.getIpAddress());
        features.put("ip_risk_score", ipRiskService.getScore(order.getIpAddress()));

        // 行为维度特征
        features.put("browse_duration", order.getBrowseDuration());
        features.put("page_view_count", order.getPageViewCount());
        features.put("cart_add_count", order.getCartAddCount());

        return features;
    }

    /**
     * 模型训练（离线任务）
     */
    @Scheduled(cron = "0 0 3 * * ?")  // 每天凌晨3点训练
    public void trainModel() {
        // 1. 从数据仓库加载训练数据
        List<OrderSample> samples = dataWarehouseService.loadTrainingSamples(
            LocalDate.now().minusDays(30),  // 最近30天数据
            LocalDate.now()
        );

        // 2. 数据预处理
        Dataset dataset = preprocessData(samples);

        // 3. 训练模型
        XGBoostModel newModel = XGBoostTrainer.train(dataset);

        // 4. 模型评估
        ModelEvaluationResult evaluation = evaluateModel(newModel, dataset);

        // 5. 如果新模型效果更好，替换旧模型
        if (evaluation.getAuc() > 0.85) {
            this.model = newModel;
            log.info("模型更新成功，AUC：{}", evaluation.getAuc());
        }
    }
}

/**
 * 刷单识别系统
 * 核心逻辑：识别虚假交易、刷好评、刷销量
 */
@Service
public class OrderFraudDetectionService {

    /**
     * 识别刷单行为
     */
    public boolean isOrderFraud(Order order) {
        // 1. 检查设备指纹（同一设备多个账号下单）
        if (checkDeviceFingerprint(order)) {
            return true;
        }

        // 2. 检查收货地址（多个订单同一地址）
        if (checkShippingAddress(order)) {
            return true;
        }

        // 3. 检查支付账户（同一支付账户多笔订单）
        if (checkPaymentAccount(order)) {
            return true;
        }

        // 4. 检查行为模式（下单后立即好评）
        if (checkBehaviorPattern(order)) {
            return true;
        }

        return false;
    }

    /**
     * 检查设备指纹
     */
    private boolean checkDeviceFingerprint(Order order) {
        String deviceId = order.getDeviceId();

        // 查询该设备最近24小时的订单数
        long orderCount = orderRepository.countByDeviceIdAndCreateTimeAfter(
            deviceId,
            LocalDateTime.now().minusHours(24)
        );

        // 同一设备24小时内下单超过10次，疑似刷单
        if (orderCount > 10) {
            log.warn("设备指纹异常：设备{}在24小时内下单{}次", deviceId, orderCount);
            return true;
        }

        // 查询该设备关联的账号数
        long userCount = orderRepository.countDistinctUserByDeviceId(deviceId);

        // 同一设备关联超过5个账号，疑似刷单
        if (userCount > 5) {
            log.warn("设备指纹异常：设备{}关联{}个账号", deviceId, userCount);
            return true;
        }

        return false;
    }

    /**
     * 检查收货地址
     */
    private boolean checkShippingAddress(Order order) {
        String address = order.getAddress();

        // 查询该地址最近7天的订单数
        long orderCount = orderRepository.countByAddressAndCreateTimeAfter(
            address,
            LocalDateTime.now().minusDays(7)
        );

        // 同一地址7天内收货超过20次，疑似刷单
        if (orderCount > 20) {
            log.warn("收货地址异常：地址{}在7天内收货{}次", address, orderCount);
            return true;
        }

        return false;
    }

    /**
     * 检查行为模式（图算法）
     */
    private boolean checkBehaviorPattern(Order order) {
        // 构建关系图谱
        // 节点：用户、设备、地址、支付账户
        // 边：下单关系

        Graph graph = buildOrderGraph(order);

        // 检测社区（刷单团伙）
        List<Community> communities = graphService.detectCommunities(graph);

        for (Community community : communities) {
            // 如果该订单所属社区的密度过高，疑似刷单团伙
            if (community.getDensity() > 0.8 && community.getSize() > 10) {
                log.warn("检测到刷单团伙：社区规模{}，密度{}",
                    community.getSize(), community.getDensity());
                return true;
            }
        }

        return false;
    }
}

/**
 * 个人额度管理系统
 * 核心功能：实时额度扣减、额度查询、超额预警
 */
@Service
public class PersonalQuotaService {

    /**
     * 下单时检查额度
     */
    @Transactional
    public QuotaCheckResult checkAndDeductQuota(Order order) {
        Long userId = order.getUserId();
        BigDecimal orderAmount = order.getTotalAmount();
        int year = LocalDate.now().getYear();

        // 1. 查询用户年度已用额度
        BigDecimal usedQuota = getUserUsedQuota(userId, year);

        // 2. 计算剩余额度
        BigDecimal remainingQuota = new BigDecimal("26000").subtract(usedQuota);

        // 3. 检查是否超额
        if (orderAmount.compareTo(remainingQuota) > 0) {
            return QuotaCheckResult.exceeded(
                "您的年度额度不足，剩余额度：" + remainingQuota + "元，" +
                "本次订单：" + orderAmount + "元"
            );
        }

        // 4. 扣减额度（Redis分布式锁）
        String lockKey = "quota_lock:" + userId + ":" + year;
        RLock lock = redissonClient.getLock(lockKey);

        try {
            lock.lock(10, TimeUnit.SECONDS);

            // 4.1 再次查询额度（防止并发问题）
            usedQuota = getUserUsedQuota(userId, year);
            remainingQuota = new BigDecimal("26000").subtract(usedQuota);

            if (orderAmount.compareTo(remainingQuota) > 0) {
                return QuotaCheckResult.exceeded("额度不足");
            }

            // 4.2 扣减额度
            deductQuota(userId, year, orderAmount);

            // 4.3 保存额度变更记录
            saveQuotaChangeRecord(userId, year, orderAmount, order.getOrderNo());

            return QuotaCheckResult.success(remainingQuota.subtract(orderAmount));

        } finally {
            lock.unlock();
        }
    }

    /**
     * 查询用户年度已用额度
     */
    private BigDecimal getUserUsedQuota(Long userId, int year) {
        // 1. 先从Redis查询（缓存）
        String cacheKey = "user_quota:" + userId + ":" + year;
        String cachedQuota = redisTemplate.opsForValue().get(cacheKey);

        if (cachedQuota != null) {
            return new BigDecimal(cachedQuota);
        }

        // 2. 从数据库查询
        BigDecimal usedQuota = quotaRepository.sumUsedQuota(userId, year);

        // 3. 写入缓存（有效期至年底）
        LocalDateTime endOfYear = LocalDate.of(year, 12, 31).atTime(23, 59, 59);
        long ttl = Duration.between(LocalDateTime.now(), endOfYear).getSeconds();
        redisTemplate.opsForValue().set(cacheKey, usedQuota.toString(), ttl, TimeUnit.SECONDS);

        return usedQuota;
    }

    /**
     * 扣减额度
     */
    private void deductQuota(Long userId, int year, BigDecimal amount) {
        // 1. 更新Redis缓存
        String cacheKey = "user_quota:" + userId + ":" + year;
        redisTemplate.opsForValue().increment(cacheKey, amount.doubleValue());

        // 2. 更新数据库
        UserQuota quota = quotaRepository.findByUserIdAndYear(userId, year);
        if (quota == null) {
            quota = UserQuota.builder()
                .userId(userId)
                .year(year)
                .usedQuota(amount)
                .totalQuota(new BigDecimal("26000"))
                .build();
        } else {
            quota.setUsedQuota(quota.getUsedQuota().add(amount));
        }
        quotaRepository.save(quota);
    }

    /**
     * 订单取消时，退还额度
     */
    @Transactional
    public void refundQuota(Order order) {
        Long userId = order.getUserId();
        int year = order.getCreateTime().getYear();
        BigDecimal orderAmount = order.getTotalAmount();

        // 1. 退还额度
        String cacheKey = "user_quota:" + userId + ":" + year;
        redisTemplate.opsForValue().increment(cacheKey, -orderAmount.doubleValue());

        // 2. 更新数据库
        UserQuota quota = quotaRepository.findByUserIdAndYear(userId, year);
        quota.setUsedQuota(quota.getUsedQuota().subtract(orderAmount));
        quotaRepository.save(quota);

        // 3. 保存额度变更记录
        saveQuotaChangeRecord(userId, year, orderAmount.negate(), order.getOrderNo());
    }

    /**
     * 用户查询剩余额度
     */
    public QuotaInfo getUserQuota(Long userId) {
        int year = LocalDate.now().getYear();

        BigDecimal usedQuota = getUserUsedQuota(userId, year);
        BigDecimal totalQuota = new BigDecimal("26000");
        BigDecimal remainingQuota = totalQuota.subtract(usedQuota);

        return QuotaInfo.builder()
            .userId(userId)
            .year(year)
            .totalQuota(totalQuota)
            .usedQuota(usedQuota)
            .remainingQuota(remainingQuota)
            .usageRate(usedQuota.divide(totalQuota, 4, RoundingMode.HALF_UP))
            .build();
    }
}

/**
 * 个人信息脱敏服务
 */
@Service
public class DataMaskingService {

    /**
     * 姓名脱敏
     * 张三 → 张*
     */
    public String maskName(String name) {
        if (name == null || name.length() == 0) {
            return "";
        }
        if (name.length() == 1) {
            return name;
        }
        return name.charAt(0) + "*".repeat(name.length() - 1);
    }

    /**
     * 身份证号脱敏
     * 330102199001011234 → 3301**********1234
     */
    public String maskIdCard(String idCard) {
        if (idCard == null || idCard.length() != 18) {
            return "";
        }
        return idCard.substring(0, 4) + "**********" + idCard.substring(14);
    }

    /**
     * 手机号脱敏
     * 13800138000 → 138****8000
     */
    public String maskPhone(String phone) {
        if (phone == null || phone.length() != 11) {
            return "";
        }
        return phone.substring(0, 3) + "****" + phone.substring(7);
    }

    /**
     * 地址脱敏
     * 浙江省杭州市西湖区文一西路XXX号 → 浙江省杭州市西湖区***
     */
    public String maskAddress(String address) {
        if (address == null || address.length() < 10) {
            return "";
        }
        return address.substring(0, 9) + "***";
    }
}

/**
 * 跨境数据传输合规服务
 * 依据：《个人信息保护法》第38-43条
 */
@Service
public class CrossBorderDataTransferService {

    /**
     * 向海外推送数据前的合规检查
     */
    public ComplianceCheckResult checkDataTransfer(
        String targetCountry,
        DataTransferRequest request
    ) {
        List<String> violations = new ArrayList<>();

        // 1. 检查目标国家是否在白名单
        if (!isWhitelistedCountry(targetCountry)) {
            violations.add("目标国家不在数据传输白名单中");
        }

        // 2. 检查是否已获得用户同意
        if (!hasUserConsent(request.getUserId(), targetCountry)) {
            violations.add("未获得用户跨境数据传输同意");
        }

        // 3. 检查数据是否已脱敏
        if (!isDataMasked(request.getData())) {
            violations.add("敏感数据未脱敏");
        }

        // 4. 检查是否签署了标准合同条款
        if (!hasStandardContract(targetCountry)) {
            violations.add("未与目标国家签署标准合同条款");
        }

        if (violations.isEmpty()) {
            return ComplianceCheckResult.passed();
        } else {
            return ComplianceCheckResult.failed(violations);
        }
    }

    /**
     * 获取用户跨境数据传输同意
     */
    public boolean obtainUserConsent(Long userId, String targetCountry) {
        // 1. 展示同意书
        ConsentForm form = ConsentForm.builder()
            .userId(userId)
            .title("跨境数据传输同意书")
            .content("为了完成您的跨境购物订单，我们需要将您的姓名、身份证号、" +
                    "收货地址等个人信息传输至" + targetCountry + "海关进行清关。" +
                    "我们承诺采取加密传输、最小化原则等措施保护您的个人信息安全。")
            .targetCountry(targetCountry)
            .build();

        // 2. 用户同意后，保存同意记录
        UserConsent consent = UserConsent.builder()
            .userId(userId)
            .consentType("CROSS_BORDER_DATA_TRANSFER")
            .targetCountry(targetCountry)
            .consentTime(LocalDateTime.now())
            .ipAddress(request.getRemoteAddr())
            .build();
        consentRepository.save(consent);

        return true;
    }
}

# 风控规则配置
risk_rules:
  # 商品合规规则
  product_compliance:
    - name: "禁售关键词检测"
      enabled: true
      priority: 1
      action: "REJECT"
      keywords:
        - "电子烟"
        - "大麻"
        - "仿真枪"

  # 交易风控规则
  transaction_risk:
    - name: "新用户高价值订单"
      enabled: true
      priority: 2
      action: "REVIEW"
      conditions:
        - field: "user.register_days"
          operator: "<"
          value: 7
        - field: "order.amount"
          operator: ">"
          value: 1000

    - name: "频繁下单"
      enabled: true
      priority: 3
      action: "REVIEW"
      conditions:
        - field: "user.recent_order_count_1h"
          operator: ">"
          value: 5

  # 额度管理规则
  quota_management:
    - name: "年度额度检查"
      enabled: true
      priority: 1
      action: "REJECT"
      conditions:
        - field: "user.used_quota"
          operator: ">"
          value: 26000