Methods, systems, and computer-readable storage media for risk identification of service data using operations of determining, by a client-side computing device, a first service data corresponding to a first operation behavior associated with a user input on the client-side computing device, determining, by the client-side computing device, a first variable corresponding to the first service data, the first variable including a first eigenvalue, retrieving, by the client-side computing device, a second eigenvalue corresponding to a second operation behavior that was performed at a second time before the first operation behavior, generating, by the client-side computing device, a decay value by processing the first time and the second time a decay function, generating, by the client-side computing device, an aggregated data by processing the first variable, the second eigenvalue, and the decay value using an aggregation function, and determining, by the one or more processors, a risk associated with the first operation by processing the aggregated data using a risk identification model.