Student comprehensive quality data management system based on behavior analysis

Abstract

This invention relates to the fields of educational informatization and big data analysis technology, and discloses a student comprehensive quality data management system based on behavior analysis, including the following steps: accessing the campus network and business logs; establishing a dynamic session index using authentication and accounting messages; parsing randomized terminal addresses and reconstructing real-name trajectories; integrating multi-source heterogeneous data; eliminating mandatory location data based on group occupancy entropy; constructing a community manifold reflecting autonomous social relationships; calculating the spatiotemporal entropy of individual behavior; and generating a denoised relative deviation by combining the dynamic baseline entropy of the community manifold; using data confidence factors to perform circuit breaking verification on the deviation results; and outputting a behavior stability index. This invention can solve the trajectory breakage problem caused by mobile terminal privacy protection, eliminate the interference of the external macro environment on behavior assessment, and, combined with data saturation judgment, effectively avoid statistical false alarms in sparse sample scenarios, achieving accurate quantification and dynamic monitoring of student behavior patterns.

Description

Technical Field

[0001] This invention relates to the field of educational informatization and big data processing technology, specifically to a student comprehensive quality data management system based on behavioral analysis. Background Technology

[0002] With the deepening of smart campus construction, using data mining technology to quantitatively analyze students' daily behaviors has become an important means to improve the level of precision in education management. Traditional comprehensive quality evaluation data collection often relies on manual reporting, questionnaires, or subjective evaluations by counselors. This method has problems such as delayed data updates, limited coverage, and significant subjective bias, making it difficult to comprehensively and objectively reflect students' real life patterns and psychological adaptation during their time at school.

[0003] To obtain more continuous and objective behavioral data, existing solutions are shifting towards utilizing seamless data sources such as campus Wi-Fi logs and campus card transaction records. However, in practical applications, behavior analysis based on network logs faces technical challenges posed by mobile terminal privacy protection mechanisms. Modern smart mobile terminals generally employ Media Access Control (MAC) address randomization, causing the terminal to dynamically generate virtual addresses when probing or connecting to Wi-Fi networks. This mechanism renders traditional trajectory tracking methods based on fixed hardware addresses ineffective, resulting in breaks in the behavioral trajectory of the same user on the timeline, preventing the formation of a complete spatiotemporal sequence and affecting the accuracy of subsequent data analysis.

[0004] Furthermore, when performing anomaly detection and stability assessment on the fused behavioral data, existing technologies typically employ judgment models based on absolute thresholds. This static evaluation standard ignores the group rhythms and periodic characteristics of the campus environment. For example, during specific periods such as final exam weeks or holidays, the overall daily routines of the student population generally deviate. Without dynamic calibration of environmental background factors, judging solely based on individual absolute indicators can easily misjudge normal group behavioral fluctuations as abnormal individual behavior. Simultaneously, existing assessment models often lack verification mechanisms for data sample sufficiency. In data-sparse scenarios such as new student enrollment or students returning from long-term absences, insufficient statistical samples can easily lead to low-confidence evaluation results, resulting in a higher false alarm rate in the management system. Summary of the Invention

[0005] To address the shortcomings of existing technologies, this invention provides a student comprehensive quality data management system based on behavior analysis, which solves the technical problems of existing technologies, such as reliance on manual data entry leading to strong data subjectivity, fragmentation of behavioral trajectories due to mobile terminal privacy protection mechanisms, and difficulty in eliminating interference from external environmental factors on individual behavior assessment.

[0006] The system provided by this invention includes a data access module, an identity resolution module, a trajectory fusion module, a community building module, an entropy calculation module, and a differential calibration module.

[0007] The data access module collects raw log data streams through network protocol interfaces. Addressing the technical issue of mobile terminals frequently changing their Media Access Control (MAC) addresses due to privacy protection mechanisms, leading to broken tracking patterns, the identity resolution module employs a dynamic indexing mechanism based on accounting log analysis. This module extracts the temporary binding relationship between user identities and virtual addresses from authentication logs, establishing a dynamic session mapping table. When parsing roaming logs, the system uses this mapping table to map dynamically changing device addresses to real-name user identities, thereby maintaining the continuity of behavioral tracking.

[0008] The trajectory fusion module is responsible for resolving time alignment and spatial conflicts in multi-source data. The system constructs a standard timeline and pre-configures a data source priority strategy, setting consumption and access control logs as primary confidence sources and wireless roaming logs as secondary confidence sources. When location record conflicts occur within the same time window, the system prioritizes the primary confidence source data and uses business data to correct the location drift of network data, generating structured spatiotemporal sequence data containing time, location, and behavior type.

[0009] The community building module calculates co-occurrence relationships among users based on structured spatiotemporal sequence data, constructing a community manifold neighbor set. To eliminate interference from forced gathering behavior on social analysis, the system introduces dynamic filtering logic based on location attributes. The system calculates the group occupancy entropy of each mixed-function location. If the entropy value is less than a preset threshold, the location is determined to exhibit forced scheduling attributes, and related data is removed; only data exhibiting voluntary access attributes are retained for calculating co-occurrence relationships. Based on the filtered voluntary access trajectories, the system calculates the co-occurrence strength among users and extracts strongly correlated neighbors as a reference system for subsequent behavior calibration.

[0010] The entropy calculation module uses information entropy theory to quantify the spatiotemporal regularity of behavior. The system divides the entire day into discrete time slots, counts the weighted frequency of the target user's activity in each time slot, generates a discrete probability distribution vector, and calculates the spatiotemporal entropy of individual behavior. The magnitude of this individual behavior spatiotemporal entropy value characterizes the degree of orderliness in the user's daily routine.

[0011] The differential calibration module is used to shield the common influence of external environmental factors on the evaluation results. The system aggregates the spatiotemporal entropy of individual behaviors of all members in the community's manifold neighbor set, and calculates the dynamic baseline entropy with co-occurrence intensity as the weight. This dynamic baseline entropy characterizes the average regularity of the target user's social circle in the current environment. The system calculates the difference between the individual behavior's spatiotemporal entropy and the dynamic baseline entropy, and generates a behavioral stability index through nonlinear mapping. This index only reflects the relative deviation of an individual from the community.

[0012] To prevent distorted evaluation results due to missing samples, the system is configured with confidence-based circuit breaker logic. The system counts the number of valid trajectory data entries for the target user within a preset window, representing the total number of interaction events. A data confidence factor is calculated using a preset data saturation function; this factor is positively correlated with the total number of interaction events and has an upper limit. The system compares the data confidence factor with a circuit breaker threshold: if it is below the threshold, insufficient samples are determined, and the evaluation result is forcibly corrected to a stable state value; if it is above or equal to the threshold, sufficient samples are determined, the behavioral stability index calculated by the differential calibration module is confirmed as valid, and the behavioral stability index is stored in the system as the final evaluation result.

[0013] This invention provides a blockchain-based intelligent traceability management system for enterprise supply chains. It offers the following advantages: 1. This invention establishes a dynamic session mapping mechanism based on accounting logs to achieve real-name resolution of the randomized media access control address of mobile terminals. This mechanism locks the temporary binding relationship between the user's identity and the virtual address during the network authentication phase, effectively addressing situations where mobile terminals frequently change addresses due to the activation of privacy protection functions. It ensures the continuity and integrity of user behavior trajectories in cross-AP roaming and multi-session scenarios, solving the data discontinuity problem caused by address hopping in traditional methods.

[0014] 2. This invention employs a multi-source trajectory fusion and location attribute dynamic filtering strategy based on confidence priority to improve the semantic accuracy of behavioral data. By prioritizing the use of contact-based data such as access control to correct wireless positioning drift, and by automatically identifying and eliminating mandatory gathering scenarios such as administrative scheduling using group occupancy entropy, the system can accurately extract effective behavioral data representing students' autonomous will from massive logs, thereby constructing a community manifold that truly reflects individual social relationships and avoiding false association analysis caused by passive gathering.

[0015] 3. This invention constructs a differential calibration and confidence circuit breaker model based on the community manifold, achieving adaptability and robustness in behavior assessment. By calculating the relative deviation between individual entropy values ​​and the community's dynamic baseline entropy, the system can automatically offset the general impact of macro-environmental factors such as exam weeks and holidays on group behavior, only issuing warnings for abnormal behaviors that deviate from the community's regular patterns; simultaneously, combined with data saturation judgment, it avoids statistical false alarms in scenarios with sparse samples, such as the beginning of the school year or returning to school after a long holiday. Attached Figure Description

[0016] Figure 1 This is a schematic diagram of the system architecture of the present invention; Figure 2 This is a flowchart of the method of the present invention; Figure 3This is a comparison diagram of individual behavioral entropy and community baseline entropy in this invention; Figure 4 This is a graph showing the trend and graded early warning of the behavioral stability index of the present invention.

[0017] Among them, 10 is the wireless access point; 20 is the wireless controller; 30 is the authentication server; 40 is the business database; 110 is the data access module; 120 is the identity resolution module; 130 is the trajectory fusion module; 140 is the community building module; 150 is the entropy calculation module; and 160 is the differential calibration module. Detailed Implementation

[0018] The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0019] See attached document Figure 1 This invention provides a student comprehensive quality data management system based on behavior analysis, which runs on a server cluster and is connected to the existing campus network infrastructure via a communication link.

[0020] The campus network infrastructure includes: wireless access points 10 distributed across various physical areas, a wireless controller 20 responsible for managing the wireless access points 10, an authentication server 30 responsible for user authentication and billing, and a business database 40 storing access control and consumption records. A student comprehensive quality data management system based on behavior analysis performs calculations by reading log data from the above-mentioned devices, without requiring additional sensing sensors to be deployed in the physical environment.

[0021] A student comprehensive quality data management system based on behavior analysis includes: a data access module 110, an identity resolution module 120, a trajectory fusion module 130, a community building module 140, an entropy calculation module 150, and a differential calibration module 160.

[0022] The data access module 110 is configured to connect to the wireless controller 20, the authentication server 30, and the business database 40 via network protocol interfaces to collect raw log data streams in real time or synchronize them periodically. The raw log data streams include network authentication logs, terminal roaming logs, and business behavior logs.

[0023] The identity resolution module 120 is configured to receive authentication logs from the authentication server 30 and extract the temporary binding relationship between the user identity identifier and the terminal virtual media access control address. The identity resolution module 120 maintains a dynamic session mapping table, which is used to parse the device address in the terminal roaming log and convert anonymous or randomized device addresses into real-name user identity identifiers.

[0024] The trajectory fusion module 130 is configured to fuse the roaming trajectory data parsed by the identity resolution module 120 with the business behavior data from the business database 40 based on a unified timeline. The trajectory fusion module 130 generates structured spatiotemporal sequence data containing time, location, and behavior type.

[0025] The community building module 140 is configured to calculate the physical co-occurrence frequency among different users based on spatiotemporal sequence data. The community building module 140 constructs a network of connections between users using graph theory algorithms and extracts the set of strongly associated neighbors for each target user, forming the community manifold of that target user.

[0026] The entropy calculation module 150 is configured to perform time discretization processing on spatiotemporal sequence data and calculate the probability distribution of a target user being in a specific location within a specific time slot. The entropy calculation module 150 calculates the spatiotemporal entropy of the target user's individual behavior based on the information entropy formula, quantifying the temporal determinism of their behavior.

[0027] The differential calibration module 160 is configured to aggregate the spatiotemporal entropy of individual behaviors of all members in the community manifold to generate a dynamic baseline entropy. The differential calibration module 160 calculates the difference between the spatiotemporal entropy of the target user's individual behavior and the dynamic baseline entropy, and generates a denoised behavior stability index based on this difference.

[0028] See attached document Figure 2 This invention provides a method for analyzing the stability of student behavior based on multi-source heterogeneous logs and community manifold calibration. Executed using the aforementioned system architecture, the method includes the following steps: S100 establishes a dynamic identity index for multi-source logs. It receives authentication start and end messages containing user identity information, defining the lifecycle of a user session. Within this lifecycle, it locks the mapping relationship between the user's identity identifier and the virtual media access control address used by the current session.

[0029] S200 reconstructs the real-name spatiotemporal trajectory. It reads roaming logs generated by the wireless network side, containing device addresses and access locations. Using the mapping relationship established by S100, it replaces the device addresses in the roaming logs with user identifiers and removes invalid records that cannot be mapped. Subsequently, the real-name roaming logs are merged with access control and consumption logs in chronological order to generate a full-dimensional spatiotemporal event sequence for the target user.

[0030] S300 constructs an implicit community manifold. It traverses the full-dimensional spatiotemporal event sequences of all users to identify spatiotemporal overlap events of different users in non-mandatory public places. It counts the overlap frequency and constructs a weighted adjacency matrix, then selects the set of neighbor nodes whose connection weights with the target user meet a preset threshold, serving as a reference system for calibrating the target user's behavioral data.

[0031] S400 calculates the absolute behavioral entropy of an individual. The entire day is divided into several continuous discrete time slots, and the empirical probability distribution of the target user's physical location in each time slot within the observation period is statistically analyzed. The entropy value of this probability distribution is calculated using the information entropy formula, yielding the raw entropy value reflecting the absolute regularity of the target user's life.

[0032] S500 generates a relative behavioral stability index. It retrieves the neighbor node set determined by S300 and calculates the arithmetic mean of the original entropy values ​​of all members within this set, using this as the environmental baseline entropy. It then calculates the difference between the target user's original entropy value and the environmental baseline entropy. This difference is used to eliminate the influence of common external environmental factors on behavioral regularity, outputting the final behavioral stability evaluation index.

[0033] To address the technical problem of dynamic changes in the Media Access Control Address (MAC address) caused by enabling privacy protection mechanisms on mobile terminals, leading to breaks in user behavior tracking, this embodiment employs a RADIUS-based accounting log analysis mechanism. The core principle lies in leveraging the requirement of real identity in the network access layer's authentication process. By capturing session attributes generated at the moment of authentication, a dynamic index table valid throughout the session's lifecycle is constructed. Even if the terminal changes its virtual MAC address between different sessions, as long as the session remains active, the binding relationship between the virtual address and the real identity remains constant. This resolution mechanism specifically includes the following processing steps: S101 captures and standardizes authentication accounting messages. The data access module receives data packets from the authentication server via switch port mirroring or log forwarding. The system filters accounting messages defined by the RADIUS protocol standard, retaining only messages with the packet type identifier "Accounting Request". Due to differences in the encoding format of media access control addresses between network devices from different manufacturers (e.g., using hyphens, colons, or no separators), the system performs normalization processing on the address field in the message before parsing, uniformly converting it into a continuous string format of 12 hexadecimal characters (e.g., aabbccddeeff) to ensure the uniqueness of subsequent index key values.

[0034] S102, Extract Key Session Attribute Tuples. The system parses the standardized accounting message to extract key attribute values ​​used to define the user's online status. Key attribute values ​​include at least: User Name (Attribute 1), Calling Station Id (Attribute 31), Accounting Session Id (Attribute 44), Accounting Status Type (Attribute 40), and Event Timestamp (Attribute 55).

[0035] The system identifies the calling station identifier as the terminal's current virtual media access control address and the username as a unique identifier of the user's real identity. The system defines the parsed single authentication session event as a five-tuple structure: ; in: This represents the parsed real identity identifier of the target user; This indicates the virtual media access control address (normalized) used by the terminal in this session. Indicates the timestamp of the event recorded in the message; Indicates the accounting status type, with values ​​including Start, Stop, and Interim Update. This represents a globally unique accounting session identifier.

[0036] S103, Maintain a dynamic session state table. The identity resolution module maintains a dynamic session state table in an in-memory database (such as Redis or a hash map). This state table is accessed via virtual media access control addresses. Use the index key to store the identity mapping information of the currently active user. The state maintenance logic is as follows: If the event of For Start, the system writes a mapping record to the status table. This record contains the target user's real identity identifier. Session start time and current accounting session identifier .

[0037] If the event of For Interim Update, the system according to Retrieve the status table. If the corresponding status exists in the status table... Then update the last active time of the record to the current time. If it does not exist (e.g., the Start message is lost due to network packet loss), the mapping record is completed based on the Update message to ensure the continuity of session tracking.

[0038] If the event of For Stop, the system according to Retrieve the status table and remove the corresponding mapping record, then remove the virtual media access control address. With the target user's real identity identifier The binding.

[0039] To prevent invalid records from remaining in the state table due to lost Stop messages, the system introduces a timeout cleanup mechanism. The system periodically scans the state table, and for each session, the difference between the last active timestamp and the current time exceeds a preset maximum session survival threshold. The records will be forcibly deleted. Maximum session liveness threshold. The value is determined based on the DHCP lease period setting of the campus network, and is usually set to 1.5 to 2 times the DHCP lease period (e.g., 24 hours) to cover the normal network quiet period.

[0040] After establishing a dynamic identity mapping relationship through the above steps, this embodiment further discloses how to use this mapping relationship to heterogeneously fuse discrete physical layer roaming logs and application layer business logs to generate a standard spatiotemporal trajectory sequence for subsequent behavior analysis. This process specifically includes the following steps: S201, Acquisition and Preprocessing of Wireless Roaming Logs. The trajectory fusion module receives terminal roaming behavior logs from the wireless controller via the System Log Protocol (Syslog) or Simple Network Management Protocol (SNMP Trap) interface. The roaming behavior logs record handover events between different wireless access points. To eliminate ping-pong handover noise caused by signal fluctuations, the system performs pre-filtering based on Received Signal Strength Indication (RSSI).

[0041] The system sets a signal strength threshold. and stay duration threshold For any roaming record, only if the signal strength of the terminal at the target access point is greater than... And the continuous connection time exceeds Only when the roaming record is cleared is it marked as a valid dwell event; otherwise, the roaming record is discarded as transient drift noise.

[0042] S202, perform time-slice-based reverse identity resolution. For each pre-processed valid roaming record... Includes virtual media access control address and the time of the event The system calls the dynamic session state table maintained by the identity resolution module and executes the reverse resolution function. .

[0043] The parsing logic is: the system uses The system queries the status table using the key to retrieve the corresponding set of session records. It then iterates through this set of session records, searching for records that meet the time constraints. Extract the target user's real identity identifier from the unique session record. If the query result is empty or multiple conflicting records exist, the roaming record is marked as an unidentified entity and removed from subsequent analysis streams. After this step, the system outputs a set of named network trajectories. Each element is represented as: ; in: For the real identity identification of the target user; For sampling timestamps; Encoding the physical location of the wireless access point; This represents the signal strength value.

[0044] S203, Spatiotemporal Alignment and Fusion of Multi-Source Heterogeneous Trajectories. To compensate for the limitations of single-source network data, the system incorporates business logs from the smart card system and access control system. Since business logs inherently possess real-name authentication attributes, the system directly converts them into a standard-formatted collection of business trajectories. Each element is represented as: ; in, The physical location of the card reader or card swiping terminal. For behavior types (such as dining in the cafeteria, entering the library).

[0045] The system is based on the real identity identifier of the target user. ,right and Perform a union operation based on the sampling timestamp. Sort in ascending order to generate the original fused trajectory sequence. : ; S204, semantic structuring of trajectory sequences. Because... The physical location code and the physical location of the card reader or card swiping terminal. For heterogeneous spatial encoding (e.g., the AP is named LIB 3F 01, while the card reader is named LibraryGate In), the system loads a pre-defined Spatial Semantic Map. This mapping table defines the mapping relationship between physical device IDs and functional area IDs. .

[0046] System traversal All physical location codes are converted into unified functional area identifiers (e.g., the third floor of the library, the first canteen, and the north dormitory). For spatial conflicts occurring within the same time window (e.g., network data shows the dormitory, while access control data shows the library), the system adopts a hardware priority principle, that is, it prioritizes the location data of physical contact sensors (access control / card swipe), corrects the location drift of network data, and finally generates a structured standard spatiotemporal behavior sequence.

[0047] To address the spatiotemporal semantic conflicts and data fragmentation issues arising during the fusion of multi-source heterogeneous logs, this embodiment discloses a conflict arbitration mechanism and a dwell event extraction algorithm based on confidence weights. Its core technical principle lies in recognizing the differences in physical characteristics among different sensing sources: location estimation based on radio frequency signals (WiFi) is susceptible to multipath effects and signal drift, generating ping-pong switching noise, and belongs to non-contact fuzzy sensing; while location records based on physical barriers (access control) or near-field communication (POS machines) are triggered by physical contact and are deterministic. Therefore, this algorithm constructs a hierarchical data acquisition system, transforming discrete instantaneous location points into semantically continuous spatiotemporal dwell fragments. Specifically, it includes the following steps: S205, establish a priority-based heterogeneous data arbitration model. The trajectory fusion module has a pre-set data source priority strategy, which divides the data source into primary confidence sources (contact devices: access control, time and attendance machines, consumer terminals) and secondary confidence sources (non-contact devices: wireless access points).

[0048] The system performs fusion on the original trajectory sequence. Perform a time window scan. For any given time window... If multiple location records point to different physical regions, the system executes the following arbitration logic: Detection time window Does the system contain event records generated by a primary confidence source? If so (i.e.) If the primary confidence source indicates a specific location, then all secondary confidence source records within that window will be ignored, and the location indicated by the primary confidence source will be determined as the valid location for that time period. If multiple primary confidence source records exist within the same window and their locations conflict (e.g., both cafeteria card swipes and dormitory access control records appear within a very short period), it is considered an abnormal data conflict, and the record with the latest timestamp is accepted. If no primary confidence source record exists (i.e., ... If the secondary confidence source records are statistically analyzed, the location corresponding to the wireless access point with the highest frequency of occurrence or the strongest cumulative signal strength will be accepted.

[0049] Through this step, the system retains the advantage of high wireless data coverage while using the high accuracy of business data to correct positioning drift.

[0050] S206, Generate a spatiotemporal dwell event sequence. To meet the temporal continuity requirement of subsequent behavioral entropy calculations, the system transforms the arbitrated discrete point sequence into a dwell event sequence. The system traverses trajectory points in chronological order and uses a spatiotemporal clustering algorithm to merge adjacent records.

[0051] Define a single dwell event For a quadruple: ; The system maintains a sliding pointer for the current point in the sequence. and the next point Perform a merge decision: If and time interval Satisfy continuity constraints: ; Then determine To continue the current stay event, update the event end time. If the location is different or the time interval exceeds the interruption threshold. Then close the current resident event and use Initialize a new dwell event at the starting point.

[0052] Interruption threshold The value range is set to 5 to 15 minutes. This threshold is set to smooth out short-term signal blind spots (such as brief offline times caused by entering an elevator or restroom), avoiding breaking a complete study session into multiple fragmented events, thereby ensuring the accuracy of entropy calculation.

[0053] S207, attribute marker for non-autonomous social spaces. In the generated sequence of dwelling events. In this process, the system identifies events with mandatory constraints based on a pre-defined dictionary of location functional attributes. The system then examines each event. Position attribute : like , The system marks this event as non-voluntary residence (Attribute=Mandatory). Since the gathering of people in such places is based on administrative scheduling or accommodation allocation and does not represent the individual's initiative to socialize, it is excluded when constructing the community manifold (S300) in the subsequent process, but is retained when calculating the individual behavioral entropy (S400) to reflect objective work and rest patterns.

[0054] like (For example, libraries, cafeterias, and gymnasiums) The system marks the event as autonomous (Attribute=Voluntary) as basic data for mining implicit social relationships.

[0055] After this processing step, the system outputs a structured collection of resident events with attribute tags. .

[0056] After completing trajectory reconstruction based on multi-source logs, this embodiment further discloses how to mine the micro-relationship structures hidden in massive spatiotemporal data. This process does not rely on user-initiated reporting, but rather on the technical assumption that physical spatial coexistence reflects potential relationships. It quantifies the strength of the relationship by calculating the spatiotemporal overlap between individuals in non-mandatory locations. Specifically, it includes the following implementation steps: S301, Construct a spatiotemporal inverted index structure. The community building module reads the structured resident event set processed in step S207. The records marked with the attribute "autonomous residency" are filtered out. This is to address the problem of exploding computational complexity caused by pairwise comparisons of all users across the network. The system constructs a spatiotemporal inverted index based on a hash map (HashMap).

[0057] The system divides the observation period (e.g., 30 consecutive days) into a standardized time slot sequence. The time slot length is set. The time slots are 15 to 30 minutes (e.g., 15 minutes), and the day is divided into 96 time slots. The system defines the index key as... Hash Hash ,in This is for join operations. The index value is a linked list of all user IDs appearing within this spatiotemporal unit. Using this index structure, the system only needs to traverse non-empty index buckets to directly obtain user groups with co-occurrence relationships, avoiding invalid zero-value calculations.

[0058] S302, Calculate the location-weighted co-occurrence matrix. Based on the inverted index, the system calculates the real identity identifiers of any two target users. and the real identity identifiers of candidate neighbor users Co-occurrence intensity between This step introduces the Inverse Document Frequency (IDF) principle from information theory. Its physical meaning is that co-occurrences in densely populated public places (such as canteens and main roads) contain less social information and have high randomness; while co-occurrences in sparsely populated private or semi-private places (such as seminar rooms and laboratory corners) contain more social information and have high determinism.

[0059] The system first calculates the location attribute. sparsity weights : ; in, The total number of users covered by the system. For positional attributes The average number of concurrent users per time slot within the historical statistical period.

[0060] Subsequently, the system calculates the co-occurrence intensity. : ; in: For the number of days observed; This represents the total number of time slots throughout the day. For self-organized gathering places; For an indicator function, if and only if the target user's real identity is identified. and the real identity identifiers of candidate neighbor users In the Heavenly Each time slot is mapped to the same location attribute via an inverted index. The value is 1 if it is true, and 0 otherwise.

[0061] S303, extracting local community manifolds. The system is based on the co-occurrence intensity matrix. Real identity identification for each target user Extracting the community manifold neighbor set The community's manifold neighbor set represents microgroups that have stable companionship relationships with the target user.

[0062] The extraction logic employs a strategy combining threshold filtering and Top-K truncation. First, the system sets a minimum association threshold. . The value is set to ,in This is the arithmetic mean of the sparsity weights across all locations. The physical meaning of this minimum association threshold is that it requires neighboring nodes and the target user to co-occur effectively at least 5 times in locations with the average weight, in order to eliminate noise from accidental encounters.

[0063] Secondly, the system will meet Candidate users by Sort in descending order and select the first few. Each user constitutes a manifold neighbor set of the community. .

[0064] ; Among them, the truncation parameter The value ranges from 3 to 10 (e.g., a value of 5). This range is based on the statistical regularity of Dunbar's Number in strong ties, meaning that an individual's core close social circle typically does not exceed 10 people. If after screening... If the value is empty, the user is marked as an independent individual, and the global average benchmark will be used instead in subsequent calibration steps.

[0065] S304, Homogeneity Consistency Check. As a supplementary verification to the co-occurrence calculation, the system calculates the true identity of the candidate neighbor users. With the target user's real identity identifier The system calculates the overall behavioral pattern similarity and constructs a vector of user dwell time in all autonomous locations. and Calculate the cosine similarity between the two: ; like Then remove the neighbor from Remove from the middle. Homogeneity threshold. Set to 0.3 to 0.5. This step is used to exclude individuals who, although frequently encountered at specific locations, have completely different overall lifestyles (e.g., people who only meet on a fixed shuttle bus but have no overlap in other aspects of their lives), ensuring that the members of the reference frame have comparable lifestyles.

[0066] Given the ambiguity of physical space functions on campus (for example, the same classroom may be a mandatory class space during the day but a self-study space at night), relying solely on static names for classification can lead to biases in social relationship mining. This embodiment discloses a dynamic filtering strategy for location attributes based on crowd occupancy entropy, aiming to accurately extract autonomous behavior scenarios that reflect genuine social intentions from the full dataset. This strategy specifically includes the following steps: S305 establishes a static attribute benchmark based on spatiotemporal constraints. The system pre-configures a basic spatial semantic dictionary, dividing the campus physical location into three attribute domains: mandatory domain. (such as examination rooms, administrative meeting rooms), autonomous domains (such as canteens, commercial streets, stadiums) and mixed-use areas (Such as regular classrooms, multi-functional lecture halls, and library seminar rooms).

[0067] For those belonging to the mandatory domain Location records are directly marked as non-socially related data by the system and do not participate in the community manifold neighbor set. The construction of [the domain]. For those belonging to the autonomous domain... The system directly labels the location records as autonomous behavior data, using them as the basic input for calculating co-occurrence intensity. For data belonging to the mixed domain... The system records the location and treats it as an object to be judged, then proceeds to the subsequent dynamic entropy value analysis process.

[0068] S306, calculate the temporal distribution entropy of the mixed location. For each location attribute to be determined... The system statistically analyzes the distribution of group access times within the observation period to identify whether the current time is in collective scheduling mode or random access mode.

[0069] The system divides the daily active time (06:00-23:00) into... Each time slot. For the position attribute. The system calculates the first Relative occupancy rate within each time slot : ; in, In the time slot The system calculates the standardized time entropy of the location based on the total number of unique users recorded at that location, according to the probability distribution. : ; The physical principle behind this step is that if a venue is used for mandatory courses or meetings, the arrival and departure of people are highly synchronous, resulting in the occupancy rate being concentrated in a specific time period, which is characterized by low entropy. If a venue is used for self-study or free activities, the arrival of people follows a Poisson distribution or a random distribution, and the occupancy rate is distributed more evenly on the time axis, which is characterized by high entropy.

[0070] S307, performs dynamic classification based on entropy threshold. The system bases its classification on the calculated... The system performs a binary determination based on the specific time-period attributes of mixed-location spaces. A determination threshold is set within the system. .

[0071] like The system determines the location attribute. Within the current observation period, it exhibits a forced scheduling attribute, and all trajectory data it generates are discarded and not used to construct the community manifold neighbor set. .like The system determines the location attribute. It exhibits autonomous access attributes within the current observation period, and its trajectory data is retained.

[0072] Determination threshold The value range is set to 0.6 to 0.8 (e.g., 0.7). The determination of the judgment threshold is based on a discrete statistical experiment under a standard normal distribution, which aims to ensure that only those location data with sufficient randomness in the time dimension are used for social relationship inference, thereby eliminating false high-frequency co-occurrence caused by administrative scheduling (such as unified classes).

[0073] Through the above steps, the system generates a cleaned set of autonomous behavior trajectories. This set eliminates noise from forced aggregation, ensuring the co-occurrence weights calculated in the S300 series steps. It truly reflects the mutual companionship among users based on free will. After eliminating noise interference introduced by mandatory administrative arrangements using location attribute filtering strategies (S305 to S307), this embodiment further discloses how to construct the social topology of the entire network through matrix operations and abstract the complex network relationships into the local manifold space of each individual. This process transforms the discrete co-occurrence behavior between individuals into a mathematical graph structure, providing an algebraic basis for subsequent manifold-based anomaly detection. This part specifically includes the following processing steps: S308. Construct a globally weighted co-occurrence adjacency matrix. To perform global calculations on the social relationships of all users across the network, the community mining module constructs a globally weighted co-occurrence adjacency matrix based on filtered autonomous behavior trajectory data. Let the total number of valid users in the system be... Globally weighted co-occurrence adjacency matrix Defined as A real symmetric matrix of dimension 1.

[0074] The first in the matrix Line number Column elements Indicates the real identity identifier of the target user Real identity identifiers of candidate neighbor users The cumulative co-occurrence intensity among them. The system follows the weighting logic disclosed in S302, but only for the set of locations determined to have autonomous access attributes by step S307. Perform the calculation: ; in: Indicates the real identity identifier of the target user Real identity identifiers of candidate neighbor users The cumulative co-occurrence intensity between them; This represents the set of locations that are determined to have the autonomous access attribute by step S307; Represents the sparsity weight of locations; diagonal elements The values ​​are forcibly set to 0 to avoid the impact of self-loops on community structure analysis. Considering the sparsity of social networks (i.e., any user only intersects with a very small number of people, and the vast majority of elements in the matrix are 0), this embodiment uses the Compressed Sparse Row (CSR) format to store the globally weighted co-occurrence adjacency matrix. This optimizes memory usage and accelerates vector multiplication operations.

[0075] S309 performs sparsity pruning of the manifold structure. To extract manifold structures with strong topological significance from globally chaotic weak connections, the system performs global weighted co-occurrence adjacency matrix... Execution based on - Sparsification operation of the k-Nearest Neighbors rule. The physical principle of this step lies in transforming a fully connected undirected graph into a locally connected directed graph, thereby characterizing the asymmetry in social relationships (i.e., the true identity of candidate neighbor users). It could be the target user's real identity identifier. The core companion, but the real identity identifier of the target user. It may not be the real identity identifier of the candidate neighbor user. (Core companion).

[0076] The system constructs a binary mask matrix. For a globally weighted co-occurrence adjacency matrix each line The system identifies the largest value among the top performers. Column index set And in conjunction with the minimum association threshold set in S303 Make a judgment: ; in: This is the truncation parameter defined in S303. (Truncation parameter) The value range is set to 5 to 15. This parameter limits the maximum out-degree of each node, ensuring that the constructed manifold structure focuses on strongly relational layers and avoids computational divergence caused by excessive connections. Binary mask matrix elements in It indicates whether the connection should be retained.

[0077] Based on binary mask matrix The system generates the final adjacency matrix of the community manifold. : ; in This represents the Hadamard product (element-wise multiplication of matrices). In this case, the adjacency matrix of the community manifold... To form an asymmetric sparse matrix, where non-zero elements are... Only the real identity identifier of the target user was retained. Neighbor weights that have clear reference value.

[0078] S310, Serialization Extraction and Benchmark Calculation of Neighbor Sets in Community Manifolds. Based on the Sparsified Adjacency Matrix of the Community Manifold. The system formally instantiates each user's community manifold neighbor set. .

[0079] For the true identity of any target user Its community manifold neighbor set Defined as the adjacency matrix of the community manifold The Middle The set of user indices corresponding to all non-zero elements in the row: ; Building upon this, the system further calculates the aggregation attributes of the community manifold neighbor set, serving as a benchmark for subsequent behaviors. The system defines the manifold centroid behavior vector. This is used to characterize the expected behavioral patterns of this micro-community: ; in: Represents the behavior vector of the centroid of the manifold; For the real identity identification of candidate neighbor users The corresponding multidimensional behavioral feature vector. In this embodiment, Defined as a dimension vectors (e.g.) This represents the distribution of user activity time per hour over a 24-hour period. This represents the co-occurrence weights after sparsification, and is used as weighting coefficients in the formula.

[0080] This formula utilizes a weighted averaging mechanism to ensure that neighbors with closer relationships (i.e., higher co-occurrence weights after sparsification) have a greater impact on the baseline, thereby enabling the constructed comparison baseline to accurately reflect the target user's true identity. The specific social context.

[0081] In the abnormal behavior detection phase, in order to quantitatively assess the true identity of the target user... To determine whether the current behavioral pattern deviates from the normal rhythm of its community, the system first needs to establish a unified temporal reference system. This embodiment discloses a time discretization model based on periodic segmentation, which maps continuous timestamps to finite-dimensional state vectors, thereby providing a standardized input space for subsequent relative entropy calculations. This part specifically includes the following processing steps: S401 defines a multi-granularity time slot structure. The system sets the basic unit of time discretization based on the daily routines of campus life. Considering the periodicity of user behavior (i.e., the difference between mandatory weekday routines and voluntary weekend routines), the system constructs two independent time slot index tables: a weekday model and a weekend model. Subsequent steps are executed independently for these two models, without interference.

[0082] The system sets the time span of the time slot. Time span The value range is set to 30 to 60 minutes (e.g., 60 minutes). This granularity is based on the frequency of major activities on campus (e.g., classes are usually 45 or 90 minutes). Too fine a granularity (e.g., 5 minutes) will introduce too much random jitter noise, while too coarse a granularity (e.g., 4 hours) will mask key behavioral characteristics such as morning reading and lunch break.

[0083] If set Minutes, then the entire 24 hours are divided into A discrete time slot. For the target user's true identity identifier. For any action log entry, the system first converts its occurrence time into the number of seconds elapsed relative to 00:00:00 on the current day. Then map to a specific time slot. : ; in: This represents the number of seconds the log entry occurred relative to midnight of the current day. The time slot length is expressed in seconds (e.g., 3600 seconds). This is a floor function; This is a time slot, with a value range of [value range missing]. ; This represents the total number of time slots throughout the day.

[0084] S402, construct a weighted discrete behavior counting vector. Based on the above mapping rules, the system iterates through the real identity identifiers of the target users. All valid autonomous behavior logs within a historical statistical period (e.g., the past 30 days).

[0085] The system initializes one dimension as counting vector For each log entry, if its occurrence time falls within the [number]th [log entry], [the following condition is met]. For each time slot, the corresponding counting component Weighted increments are applied. To enable the model to adapt to changes in users' recent lifestyle habits (e.g., gradually shifting from early risers to night owls), this embodiment introduces a time decay mechanism.

[0086] Assuming the current calculation date is The log entry date is Then the count contribution value of this log entry The calculation is as follows: ; in: This is the time decay factor. The value ranges from 0.9 to 0.99 (e.g., 0.95). This value setting ensures that the weight of a behavior from half a month ago decays to about half of the current weight, thereby achieving dynamic tracking of behavior drift. The number of days (in whole days) after the log occurred.

[0087] The system calculates the time slots. Update the counting components: .

[0088] S403, Generate a smooth probability distribution vector. To transform absolute count values ​​into a distribution form usable for probability measurement and to address the zero-probability problem caused by data sparsity, the system processes the count vector... Perform Laplace smoothing and normalization.

[0089] The system calculates the real identity identifier of the target user. In the The probability of activity in each time slot : ; in: For time slot index; For the real identity identification of target users In the The probability of activity in each time slot; For the first Weighted cumulative activity frequency within each time slot; This represents the total number of time slots throughout the day. This is the smoothing coefficient. The value ranges from 0.1 to 1.0 (usually 1.0). Its physical meaning is to assign a very small prior probability base to each time slot, ensuring that even if a user has never been active during a specific time period (such as 4 a.m.), the probability value of that time slot is still a non-zero positive number, thus avoiding mathematical errors when calculating the logarithmic operation involved in the Kullback Leibler Divergence. This is the normalized denominator.

[0090] After this step, the target user's true identity is identified. The behavioral pattern is abstracted into a discrete probability distribution vector. And satisfy This vector objectively describes the statistical pattern of when a user is most likely to be active.

[0091] After obtaining the target user's real identity identifier Discrete probability distribution vector of individual behavior Subsequently, to determine whether the behavior is abnormal, the system needs to construct a baseline distribution that represents the normal state of the user's social circle. This embodiment discloses a community reference distribution modeling method based on manifold weights. This method generates a customized target community baseline probability distribution vector by aggregating the behavioral patterns of local neighbors. The process specifically includes the following steps: S404, Obtain the probability distribution characteristics of the neighbor set. The system reads the community manifold neighbor set generated in step S310. For the real identity identifier of each candidate neighbor user in the set. (in The system retrieves the probability distribution vector of its corresponding time slot. .

[0092] Real identity identifiers of candidate neighbor users Time slot probability distribution vector It is generated independently according to steps S401 to S403, and includes Each component, namely ,in Indicates the real identity of the candidate neighbor user. In the The activity probability corresponding to each time slot.

[0093] S405, constructing the centroid distribution of the community manifold. The system is based on the adjacency matrix of the community manifold. The system uses weighted information to weight and aggregate the behavioral distribution of neighbors. The technical principle behind this step is to leverage the homogeneity of social relationships, assuming that an individual's behavior should be statistically consistent with the overall rhythm of their strong-tie community. Through weighted calculations, the system constructs a virtual distribution that reflects the average activity pattern of that specific social circle.

[0094] The system calculates the centroid distribution of the community manifold. The One component: ; in: This is a time slot, with a value range of [value range missing]. ; The first one obtained solely based on community neighbor aggregation The activity probability corresponding to each time slot; The real identity identifier of the target user in the adjacency matrix of the community manifold generated in step S309. Real identity identifiers of candidate neighbor users The sparsed co-occurrence weights between them; For the real identity identification of candidate neighbor users In the The activity probability corresponding to each time slot; This is a normalization factor to ensure that the sum of the generated distributions is 1.

[0095] S406 performs distribution smoothing and regularization. Considering the sparsity of community data, relying solely on neighbor aggregation may result in some time slots having a zero probability (e.g., if all neighbors are inactive at 3 AM, then...). (If the target user's real identity identifier is 0). If the behavior occurs at a specific moment, a mathematical singularity will occur when calculating the relative entropy, where the denominator is zero or the logarithm is negative infinity.

[0096] Therefore, the system introduces a global background noise distribution. right Linear interpolation smoothing (Jelinek Mercer Smoothing) is performed. The system generates the final target community baseline probability distribution vector. : ; in: The target community baseline probability distribution vector used for anomaly detection comparison is in the th... The probability value of each time slot; The global background noise distribution is at the th The probability value of each time slot index. In this embodiment, a uniform distribution is constructed using the maximum entropy principle, that is, a set probability value is used. This means that it is assumed that, without any prior information, the probability of the behavior occurring in any time slot is equal. Smoothing factor. The value range is set to 0.01 to 0.1 (e.g., 0.05). The technical effect of this parameter is to introduce a very small amount of random uncertainty into the baseline distribution, ensuring... All components are strictly greater than 0, thereby improving the model's robustness to unseen behaviors and avoiding outlier overflow caused by unexpected behavior at a single time point.

[0097] After the above processing, the system obtains two discrete probability distribution vectors in the same measure space: one representing the real identity identifier of the target user. The individual's current state and characterizing the desired state of its community These two vectors are in dimension The data are fully aligned and all satisfy the normalization conditions, providing the necessary mathematical premise for subsequent calculation of the Kullback Leibler Divergence.

[0098] In steps S401 to S406, the system has constructed two distribution vectors in the same probability measure space: one representing the real identity identifier of the target user. Discrete probability distribution vector of individual behavior and the target community baseline probability distribution vector representing the desired state of its community. This embodiment discloses a specific difference measurement algorithm, which uses relative entropy as the core mathematical tool to map the structural differences between high-dimensional distributions into a single scalar index, thereby achieving quantitative classification of the degree of anomalies. This part specifically includes the following processing steps: S407, calculate the asymmetric relative entropy index. The system uses the discrete probability distribution vector of individual behaviors. As the posterior observation distribution, the target community's baseline probability distribution vector As a priori reference distribution, calculate the KL divergence between the two.

[0099] System-defined behavioral anomaly scores as follows: ; in: The calculated behavioral abnormality score is a non-negative real number. This represents the total number of time slots throughout the day. For time slots; For the real identity identification of target users In the The activity probability corresponding to each time slot; Let the baseline probability distribution vector of the target community be the first... The probability value corresponding to each time slot.

[0100] The technical principle behind this formula lies in quantifying information gain: that is, when the system assumes that users should follow community rules (i.e., ... When its actual behavior is observed (i.e.) The degree of unexpectedness that may result. If exist Smaller time slots (i.e., periods of inactivity in the community) have larger values, ratios The value will be significantly greater than 1, leading to a sharp increase in the logarithmic terms and the final score, thus keenly capturing abnormally active behavior.

[0101] S408 verifies the boundedness and directionality of the metric. In this step, the system utilizes the asymmetric characteristics of the KL divergence to adapt to anomaly detection scenarios. This embodiment explicitly selects... As a metric, rather than The technical consideration is that the detection target of this system is that individuals do things that the community does not (i.e., abnormally active), rather than individuals not doing things that the community does (i.e., abnormally absent).

[0102] Since a smoothing factor has already been introduced in step S406 It guarantees that for any They all This formula is mathematically strictly bounded, avoiding division by zero errors. Furthermore, according to Gibbs' inequality, this formula guarantees that... The condition holds true indefinitely, which gives the fraction the fundamental property of being a distance metric.

[0103] S409, Dynamic Threshold Determination Based on Statistical Distribution. To convert continuous abnormal behavior scores into binary warning signals, the system needs to set a threshold. Considering the macro-fluctuations in overall school activity across different time periods (such as regular days and exam weeks), a fixed threshold cannot meet robustness requirements. This embodiment discloses a dynamic threshold generation mechanism based on population statistics.

[0104] The system sets the update cycle for statistical parameters (e.g., every 24 hours). In each update cycle, the system extracts the abnormal behavior scores of all valid users across the entire network to form a set. And users Activity The reason for excluding users with zero activity here is to prevent a large number of inactive accounts from lowering the overall average, thereby increasing the false positive rate.

[0105] Based on sets The system calculates the arithmetic mean. and standard deviation And set dynamic anomaly detection thresholds. : ; in: This refers to the sensitivity coefficient. The value is set to a range of 2.0 to 3.0 (e.g., a value of 3.0). This value is based on the 3 Sigma criterion of the normal distribution, which means that under an ideal Gaussian distribution, only about 0.13% of extreme deviations will be marked as anomalies, thus ensuring a low false alarm rate for the system in high-throughput data environments.

[0106] When the system detects the target user's real identity. Behavioral abnormality score satisfies When the system determines that the user's current behavior pattern belongs to a statistically significant abnormal state, it generates an abnormal state warning signal.

[0107] Before using the differential calibration module 160 to assess the behavioral stability of students, the system first needs to quantify the behavioral certainty of each individual over time and construct a community benchmark for cross-sectional comparison. This embodiment discloses a reference entropy calculation method based on community manifold weighting. This method uses information entropy theory to quantify the dispersion of spatiotemporal distribution and generates a real identity identifier for the target user by aggregating the entropy features of community neighbors. The dynamic benchmark. This process specifically includes the following steps: S501, Calculate the spatiotemporal entropy of individual behavior. The system is based on the discrete probability distribution vector of individual behavior generated in step S403. Calculate the real identity of the target user Standardized information entropy.

[0108] The technical principle behind this indicator lies in using entropy to measure the degree of disorder in a system: when user behavior is highly regular (e.g., spending a fixed time in the library every day), the discrete probability distribution vector... The probability distribution tends to be concentrated in a few time slots, resulting in a lower calculated entropy value; conversely, when user behavior is highly random (without a fixed schedule), the probability distribution tends to be more uniform, resulting in a higher entropy value.

[0109] The system defines the spatiotemporal entropy of individual behavior. The calculation formula is as follows: ; in: The spatiotemporal entropy of the calculated individual behavior is given by a coefficient. Normalization, by its very nature, strictly limits the range of entropy values ​​to the interval [0,1]. This eliminates the influence of time slots... The difference in dimensions caused by different (e.g., dividing into 24 slots or 96 slots) ensures the universality and comparability of the indicators under different system configurations. This represents the total number of time slots throughout the day. For time slots; For the real identity identification of target users In the The activity probability corresponding to each time slot. When, according to the limit property, we define .

[0110] S502, extract the entropy features of the community neighbors. To construct a reference frame for calibration, the system needs to obtain the real identity identifiers of the target users. The overall regularity characteristics of the community. The system reads the community manifold neighbor set determined in step S310. .

[0111] For the real identity identifier of each candidate neighbor user in the set (in According to the method in step S501, the system independently calculates the spatiotemporal entropy of the corresponding individual behavior. This step transforms the complex spatiotemporal trajectories of each neighbor into a single scalar feature, reducing the dimensionality complexity of subsequent aggregation calculations.

[0112] S503 generates a weighted dynamic baseline entropy. The system is based on the adjacency matrix of the community manifold. The weight information in the data is used to perform linear weighted aggregation of the entropy values ​​of neighbors.

[0113] This embodiment employs a manifold-weighted average strategy instead of a simple arithmetic average. The underlying reason is that in social networks, the influence of different neighbors on the target user is uneven. A higher frequency of co-occurrence with the target user (i.e.,...) Larger neighbors, whose lifestyles are more relevant to the target user, should have their entropy values ​​given greater weight in the baseline calculation. This approach effectively suppresses noise interference from weakly related neighbors.

[0114] The system calculates the dynamic baseline entropy. : ; in: To identify the real identity of the target user The generated dynamic baseline entropy reflects the average regularity of life in the micro-social circle to which the user belongs; The real identity identifier of the target user in the adjacency matrix of the community manifold generated in step S309. Real identity identifiers of candidate neighbor users The sparsed co-occurrence weights between them; For the real identity identification of candidate neighbor users The spatiotemporal entropy of individual behavior; This is the normalization weighting factor, used to ensure that the sum of the weighting coefficients is 1.

[0115] Through the above steps, the system establishes a comparative framework between individuals and communities. It represents the absolute regularity of the user, while It provides the background regularity of the user's environment. This processing method can effectively eliminate the interference of macro-environmental factors (such as the overall increase in entropy value due to the whole school returning late during final exam week) on individual evaluations.

[0116] In steps S501 to S503, the system has calculated the spatiotemporal entropy of individual behavior, which reflects the absolute regularity of the individual. and dynamic benchmark entropy reflecting the regularity of environmental background In order to accurately assess the true identity of target users. To ensure the stability of behavioral patterns, the general influence of external macro-factors (such as exam weeks, holidays, and severe weather) on group behavioral patterns must be eliminated. This embodiment discloses a differential calibration model, which calculates the relative deviation between individuals and the community and uses a nonlinear mapping function to generate normalized evaluation indicators. The process specifically includes the following steps: S504 calculates the relative entropy difference after denoising. The differential calibration module performs a subtraction operation to calculate the algebraic difference between the spatiotemporal entropy of individual behavior and the dynamic baseline entropy.

[0117] System definition relative entropy difference as follows: ; in: This is the relative entropy difference. Due to the normalization property of entropy, the value ranges from [-1, 1]. For the spatiotemporal entropy of individual behavior; This is the dynamic baseline entropy.

[0118] The technical principle behind this step lies in constructing a relative evaluation system: when the external environment causes the daily routines of all students in the school to become generally disordered (for example, increased late nights during final exam preparation), the dynamic baseline entropy of the community as a whole... It will rise accordingly. If at this time the target user's true identity is... entropy value If they also increase simultaneously, then the difference To maintain stability and avoid system misjudgment, only when the increase in an individual's entropy exceeds the increase in the community baseline (i.e., Only when the value is large can it indicate that the user has exhibited specific behavioral dispersion.

[0119] S505, Constructing a Nonlinear Stability Mapping Function. To transform the relative entropy difference into a quantitative scoring index and to achieve soft threshold compression of outlier data, the system introduces a Sigmoid function as the scoring mapping kernel.

[0120] System-defined behavioral stability index The calculation formula is as follows: ; in: This is a behavioral stability index, with a value range of (0, 100). This refers to the discrimination coefficient. The value range is set to 5.0 to 10.0 (for example, a value of 8.0). This parameter controls the slope of the mapping curve. The larger the value, the better the model performs. The more sensitive a user is to even the smallest changes, the greater the score gap between normal users and potentially abnormal users can be. This is the bias threshold. Bias threshold The value range is set to 0.05 to 0.15 (e.g., 0.1). Mathematically, this parameter defines the center offset of the rating curve; technically, it constitutes a tolerance range, allowing... Slightly higher (Right now Even when the value is a small positive value, the calculated stability index can still remain above the passing grade, reflecting the system's tolerance for the individual's moderate behavioral flexibility.

[0121] This formula implements a negative correlation mapping: when Greater than When (i.e., individual behavior is much more chaotic than that of the community), the exponential term in the denominator It tends toward infinity, leading to It tends to 0; when Less than When individual behavior is more regular or comparable to that of the community, the exponential term tends to 0, leading to... It tends towards 100.

[0122] S506, Generate the graded state assessment results. The system is based on the calculated behavioral stability index. By comparing with the preset classification standards, the true identity of the target user is determined. Current level of behavioral health.

[0123] The system sets two levels of judgment thresholds: warning threshold. and the critical boundary .like (For example If the system determines the user's state to be stable, no action will be triggered. (For example The system determines that the user's status is "following" and adds the user's identifier to the following list. The system determines the user's status as abnormal and generates an abnormal status warning signal. Through the aforementioned differential calibration mechanism, the system achieves the conversion from absolute data to relative status, ensuring the adaptability of evaluation standards at different semester stages. After generating the behavioral stability index, to prevent false alarms caused by statistical bias due to data sparsity, the system implements a confidence-based circuit breaker mechanism. This mechanism, acting as a logical gate for risk control, is located between the stability index calculation module and the early warning message push module. The system only recognizes the validity of the evaluation result if and only if the amount of underlying data supporting the calculation meets the statistical requirements; otherwise, the system will execute a circuit breaker operation to block low-confidence anomaly detections. This process specifically includes the following steps: S507, Calculate the data confidence factor. The system retrospectively retrieves the real identity identifiers of the target users collected in stage S200, which have not undergone probability normalization processing. The system collects raw behavior log data and counts the total number of valid interaction events generated by the user within a preset time window (e.g., the last 30 days). .

[0124] Effective interactive events refer to discrete behavioral records that, after data cleaning, can be clearly mapped to specific time slots and spatial coordinates (such as a specific access control card swipe record or a cafeteria consumption record).

[0125] System-defined data confidence factor The calculation formula is as follows: ; in: This is the data confidence factor, with a value range of [0,1]. This indicator is used to quantify whether the amount of behavioral data currently accumulated is sufficient to support statistical inference. The total number of valid interaction events that identify the target user's real identity. This refers to the data saturation parameter. The value range is usually set to 30 to 100 (e.g., set to 100). This parameter defines the growth rate of the confidence curve.

[0126] This formula utilizes the diminishing marginal property of the exponential function: in the early stages of data accumulation ( When it is smaller), The rapid increase with increasing data volume reflects the contribution of a small sample size to eliminating uncertainty; as... Exceed The curve flattens out, reflecting the gradually weakening effect of new samples on overall reliability after data saturation. This design conforms to the convergence property of the law of large numbers in statistics.

[0127] S508, Perform circuit breaker threshold determination. The system will calculate the data confidence factor. With the preset circuit breaker threshold Compare them.

[0128] Circuit breaker threshold The value range is usually set to 0.3 to 0.5 (e.g., setting...). This is the critical point at which the system determines whether the statistical results are credible. If... This indicates that the user's behavioral data is too sparse (e.g., a freshman just enrolled, or data gaps caused by long-term absence from school for internships). In this case, the calculated entropy value is highly susceptible to random factors and lacks statistical significance. The system triggers a circuit breaker. If This indicates that the amount of data is sufficient, the evaluation results are reliable, and the system maintains its connectivity.

[0129] S509 outputs the final evaluation result after risk control correction. Based on the judgment result of S508, the system adjusts the behavioral stability index generated in step S506. Perform condition adjustments to generate the final correction index. .

[0130] The correction logic is shown in the following formula: ; in: This is the final correction index. When the circuit breaker is triggered ( Regardless of the original calculation The system forces the final correction index to be reset to 100 (corresponding to a stable state) based on the numerical value.

[0131] This technical feature employs a low-confidence masking strategy and a fail-safe mechanism. When the system fails to obtain sufficient samples to accurately depict user behavior patterns, it chooses to suppress potential abnormal alarms to prevent false alarms caused by sample bias from interfering with management personnel.

[0132] For users in a circuit breaker state, the system marks them with an insufficient sample tag in the background logs and adds them to the data accumulation observation queue. No exception push notifications will be sent until the accumulated data volume meets the requirements. Normal monitoring and alarm functions will automatically resume only after the conditions are met.

[0133] See attached document Figure 3 and attached Figure 4 In this specific application embodiment, the system sets the observation period to 30 days, aiming to monitor the behavioral stability of the target student user U across the entire process. First, the system aggregates user U's wireless network roaming logs and access control card swipe records through the multi-source trajectory fusion module 130. Then, using a location attribute dynamic filtering strategy, it automatically removes trajectory data from mandatory administrative scheduling locations such as the first public classroom, retaining only the autonomous domain trajectory representing user U's autonomous will, thereby constructing a high-fidelity behavioral feature set. Based on this autonomous trajectory data, the system identifies the three students who co-occur most frequently with user U in locations such as the library and study rooms, forming its core community manifold, which serves as a dynamic reference benchmark. For example... Figure 3 As shown, during the stable fitting period in the initial monitoring phase (days 1 to 20), the system calculated the spatiotemporal entropy of user U's individual behavior. It stabilizes around 0.60, which is consistent with the dynamic baseline entropy of its community. Maintaining a high degree of convergence, the two curves are closely intertwined, representing the student's regular daily routine and deep integration into the group rhythm; however, during the later behavioral discrete period of the monitoring (days 21 to 30), due to user U's frequent late nights and random absences, the activity probability distribution of user U in each discrete time slot tends to become more uniform and disordered. The system calculates that the spatiotemporal entropy of user U's individual behavior monotonically increases to Meanwhile, the community's baseline entropy remained at around 0.60, resulting in a significant relative entropy difference between the two.

[0134] Subsequently, the differential calibration module 160 calculates the relative entropy difference. To achieve a non-linear quantitative assessment of this deviation, the system substitutes it into the formula: In the Sigmoid nonlinear mapping function shown, in this embodiment, a discrimination coefficient is set. To enhance sensitivity to moderate bias, a bias threshold is set. To filter out ambient noise. For example... Figure 4As shown, driven by this nonlinear mechanism, the behavioral stability index can effectively resist the interference of minor environmental noises from day 1 to day 20, maintaining a safe range of around 80 points; however, from day 21 onwards, as the entropy difference gradually exceeds the bias threshold... The behavioral stability index exhibited a sharp, non-linear decay, breaking through the 60-point warning threshold and the 40-point critical threshold around day 24 and day 26, respectively. The final behavioral stability index for day 30 was then calculated. The score indicates an extremely abnormal state, but before this output is officially generated, the system automatically performs a confidence circuit breaker verification step: the system counts the total number of valid interaction events and the signal-to-noise ratio of user U within the current time window, and calculates the data confidence factor. The system's decision logic is set as follows: if data sparsity is caused by equipment failure or the beginning of the school year (i.e., ... The system will trigger a circuit breaker mechanism, forcibly correcting the final result to 100 points (default stable state) to prevent false alarms due to insufficient samples; however, in this embodiment, the verified data volume is sufficient and meets the requirements. Under the given conditions, the system released the circuit breaker lock, officially output the evaluation result of 15.4 points, and pushed a red warning signal to the terminal, indicating to the administrator that the student's behavior pattern was seriously out of sync with the core community, thus realizing closed-loop management from autonomous domain data cleaning, entropy feature quantification to confidence risk control.

Claims

1. A student comprehensive quality data management system based on behavior analysis, characterized in that, include: The data access module (110) is used to collect raw log data streams containing network logs and business logs; The identity resolution module (120) is used to establish a mapping between device address and user identity based on the network log and output a real-name roaming trajectory; The trajectory fusion module (130) is used to fuse the real-name roaming trajectory with the business log on a unified time axis to generate structured spatiotemporal sequence data; The community building module (140) is used to calculate the co-occurrence relationship of users based on the structured spatiotemporal sequence data and construct the community manifold neighbor set of the target user; The entropy calculation module (150) is used to calculate the spatiotemporal entropy of the individual behavior of the target user based on the structured spatiotemporal sequence data. The spatiotemporal entropy of the individual behavior is used to quantitatively characterize the degree of orderliness of the target user's daily routine. The differential calibration module (160) is used to generate a dynamic baseline entropy based on the community manifold neighbor set, and calculate the difference between the spatiotemporal entropy of the individual behavior and the dynamic baseline entropy to obtain a behavior stability index; the behavior stability index is used to characterize the degree of deviation of the target user's behavior relative to the social circle, and is managed as data reflecting the student's comprehensive quality.

2. The student comprehensive quality data management system based on behavior analysis according to claim 1, characterized in that, The data access module (110) is specifically used for: The authentication logs are collected through the network authentication server, and the roaming logs are collected through the wireless access point device. The authentication logs and the roaming logs are used as the network logs. Consumption records, access control records, and book borrowing records are collected through the campus business system interface and used as the business log.

3. The student comprehensive quality data management system based on behavior analysis according to claim 2, characterized in that, The identity resolution module (120) is specifically used for: Receive the authentication log and extract the temporary binding record between the user identity and the device address, wherein the device address is the virtual media access control address; The temporary binding record is stored in the dynamic session mapping table as a mapping relationship between the device address and the user identity, and the dynamic session mapping table uses the device address as the index key; When parsing the roaming logs, the dynamic session mapping table is queried based on the time recorded in the logs, and the device address in the roaming logs is replaced with the corresponding user identity to generate the real-name roaming trajectory.

4. The student comprehensive quality data management system based on behavior analysis according to claim 1, characterized in that, The trajectory fusion module (130) is specifically used for: Extract the timestamps from the business logs and the real-name roaming trajectory, and map the timestamps to a standard timeline to complete time alignment; Based on the preset data source priority strategy of the standard timeline, the data source corresponding to the business log is set as the first-level confidence source, and the data source corresponding to the real-name roaming trajectory is set as the second-level confidence source. Arbitration is performed on the position records within the same time window on the standard time axis: if there is a record generated by a primary confidence source, then the record generated by a secondary confidence source is ignored; If only records generated by secondary confidence sources exist, then the record with the highest signal strength is accepted. The arbitrated discrete location records are aggregated into residency events, and the structured spatiotemporal sequence data is generated based on the residency events.

5. A student comprehensive quality data management system based on behavior analysis according to claim 1, characterized in that, The community building module (140) is specifically used for: The structured spatiotemporal sequence data is traversed, the continuous time information is discretized into time slices of fixed length, the physical location information is mapped into location identifiers, and the time slices and the location identifiers are combined to generate a unique spatiotemporal key value. Using the unique spatiotemporal key as the index key, user identities with the same index key are aggregated into a user list, generating a spatiotemporal inverted index; When calculating the user co-occurrence relationship, candidate neighbor users whose user identities appear in the same user list as the target user are identified based on the spatiotemporal inverted index. The co-occurrence frequency is counted and a location sparsity weight is introduced for weighted calculation to obtain the co-occurrence strength that characterizes the user co-occurrence relationship. When constructing the community manifold neighbor set, the co-occurrence strength is compared with a preset connection determination threshold to filter out candidate neighbor users who meet the conditions, so as to complete the construction of the community manifold neighbor set.

6. A student comprehensive quality data management system based on behavior analysis according to claim 5, characterized in that, The community building module (140) also includes dynamic filtering logic for location attributes, which is used to filter valid data participating in the calculation of the co-occurrence intensity, specifically for: According to the preset classification strategy, the physical locations corresponding to the location identifiers are divided into mandatory domains, autonomous domains, and hybrid domains. For each target mixed location in the mixed domain, the group access time distribution of the target mixed location within the observation period is statistically analyzed, and the group occupancy entropy is calculated based on the group access time distribution. If the group occupancy entropy is less than the preset attribute judgment threshold, the target mixed site is determined to exhibit a forced scheduling attribute in the current period, and data involving the target mixed site is removed when generating the spatiotemporal inverted index or calculating the co-occurrence intensity. If the group occupancy entropy is greater than or equal to the attribute determination threshold, the target mixed location is determined to exhibit autonomous access attribute in the current period, and the data involving the target mixed location is retained for calculating the co-occurrence intensity.

7. A student comprehensive quality data management system based on behavior analysis according to claim 1, characterized in that, The entropy calculation module (150) is specifically used for: Divide the entire day into several continuous discrete time slots; Based on the structured spatiotemporal sequence data, the weighted frequency of the target user's identity being active in each discrete time slot within the observation period is statistically analyzed to generate a discrete probability distribution vector. The entropy value of the discrete probability distribution vector is calculated using the information entropy formula, and the calculated entropy value is normalized to obtain the spatiotemporal entropy of the individual behavior. The spatiotemporal entropy of individual behavior is used to quantitatively characterize the uncertainty of the target user's spatiotemporal distribution and the regularity of their daily routine.

8. A student comprehensive quality data management system based on behavior analysis according to claim 1, characterized in that, The differential calibration module (160) is specifically used for generating the dynamic reference entropy when: Traverse the community manifold neighbor set and identify each user identity contained in the community manifold neighbor set as a neighbor member; Call the spatiotemporal entropy of the individual behavior corresponding to the neighbor member, and call the co-occurrence strength between the neighbor member and the target user; Using the co-occurrence intensity as the weight, a weighted average calculation is performed on the spatiotemporal entropy of the individual behaviors of all the neighboring members, and the calculated weighted average value is used as the dynamic baseline entropy.

9. A student comprehensive quality data management system based on behavior analysis according to claim 8, characterized in that, When generating the behavioral stability index, the differential calibration module (160) performs the following calculation logic: Calculate the numerical deviation between the spatiotemporal entropy of the individual behavior and the dynamic baseline entropy, and use it as the entropy difference. The entropy difference is mapped to the behavioral stability index using a nonlinear mapping function. The logic of the nonlinear mapping function is as follows: calculate the difference between the entropy difference and the bias threshold, multiply the difference by the discrimination coefficient to obtain the intermediate index, calculate the power value with the natural constant as the base and the intermediate index as the exponent, add one to the power value and use it as the divisor, use the preset full score constant as the dividend, and perform the division operation to obtain the behavior stability index.

10. A student comprehensive quality data management system based on behavior analysis according to claim 9, characterized in that, It also includes confidence circuit breaker logic, the specific execution steps of which are used to verify the sufficiency of the behavioral analysis sample before outputting the evaluation results include: Valid trajectory data representing autonomous access behavior are filtered from the structured spatiotemporal sequence data, and the number of valid trajectory data entries of the target user within a preset time window is counted as the total number of interaction events used to support behavior analysis. The data confidence factor corresponding to the total number of interactive events is calculated using a preset data saturation function. The data confidence factor is positively correlated with the total number of interactive events and has an upper limit. The data confidence factor is compared with a preset circuit breaker threshold: If the data confidence factor is less than the circuit breaker threshold, it is determined that the current behavior analysis sample is insufficient, triggering the circuit breaker mechanism and forcibly correcting the behavior stability index to a preset stable state value to prevent misjudgment of students' comprehensive quality due to missing data. If the data confidence factor is greater than or equal to the circuit breaker threshold, it is determined that the current behavior analysis sample is sufficient, the behavior stability index is confirmed to be effective, the behavior stability index is mapped to the final evaluation result that represents the true state of students' psychological adaptability and self-discipline, and stored in the system as student comprehensive quality data for management.

Images