A method and system for capturing business travel anomalies from multi-modal data

Abstract

The present application relates to big data risk control technical field, especially to a kind of multimodal data's business travel exception capture method and system, method includes: the multimodal data in business travel service is synchronously acquired, and the standardization preprocessing is carried out to multimodal data;Feature extraction is carried out to the multimodal data after standardization preprocessing;Based on the transaction statistical features, time series behavior features and semantic correlation features extracted, a dynamic heterogeneous entity relationship graph is constructed;On the dynamic heterogeneous entity relationship graph, an anomaly detection model based on graph neural network is used, the embedding representation of the nodes is learned, and the abnormal score of the target business travel order is calculated;According to the comparison between abnormal score and adaptive risk threshold value.The present application effectively breaks through the limitation of traditional anomaly detection relying on single data source and static rules, and realizes the capture of business travel exception of multimodal data.

Description

Technical Field

[0001] This application relates to the field of big data risk control technology, and in particular to a method and system for capturing anomalies in business travel data using multimodal data. Background Technology

[0002] Corporate travel management is a crucial aspect of corporate cost control and compliance management, and its health directly impacts a company's financial performance and operational efficiency. As companies grow larger and their business models become more complex, potential irregularities in business travel activities, such as budget overruns, fraudulent bookings, violations of compliance policies, and coordinated fraud, are increasingly characterized by their high degree of concealment and diverse patterns, posing a serious challenge to corporate risk control.

[0003] However, in current enterprise management practices, capturing abnormal business travel behavior faces significant challenges. The signal characteristics generated by abnormal behavior are often submerged in massive amounts of transaction records and operational logs. Traditional monitoring methods based on a single data source, such as financial expense data alone, struggle to effectively identify complex anomaly patterns with contextual relationships. Existing anomaly detection technologies largely rely on static rule engines or traditional statistical methods, which have limited identification capabilities when faced with constantly evolving fraud tactics and blurred compliance boundaries, often leading to missed or false alarms. Furthermore, a single data source cannot comprehensively reflect the complex relationships between multiple entities involved in abnormal behavior, such as personnel, equipment, orders, and payments; its representational capabilities are insufficient to address organized and group-based fraud. Inaccurate or untimely anomaly detection results often lead to corporate asset losses and increased compliance risks, causing not only direct economic losses but also potential threats to the company's internal management order and reputation. Therefore, there is an urgent need to develop intelligent anomaly detection methods that can deeply integrate multi-source information and possess strong correlation analysis capabilities. Summary of the Invention

[0004] In view of the aforementioned existing problems, the present invention is proposed.

[0005] Therefore, this invention provides a method for capturing business travel anomalies in multimodal data, which effectively breaks through the limitations of traditional methods that rely on a single data source and static rules for anomaly detection, and enables the capture of business travel anomalies in multimodal data.

[0006] To solve the above-mentioned technical problems, the present invention provides the following technical solution:

[0007] Firstly, this application provides a method for capturing anomalies in multimodal data related to business travel, including:

[0008] Simultaneously acquire multimodal data from business travel services, including structured order transaction data, user behavior sequence data, and unstructured text interaction data, and perform standardized preprocessing on the multimodal data;

[0009] Feature extraction is performed on the standardized preprocessed multimodal data, including transaction statistics features from structured order transaction data, time-series behavior features from user behavior sequence data, and semantic association features from unstructured text interaction data.

[0010] Based on the extracted transaction statistical features, temporal behavior features, and semantic association features, a dynamic heterogeneous entity relationship graph is constructed. Nodes in the entity relationship graph represent business travel entities, and edges represent the interaction relationships between business travel entities.

[0011] On a dynamic heterogeneous entity relationship graph, an anomaly detection model based on graph neural networks is adopted. By learning the embedded representation of nodes, the anomaly score of the target business travel order is calculated.

[0012] Based on the comparison between the anomaly score and the adaptive risk threshold, target business travel orders with an anomaly score greater than the adaptive risk threshold are identified as abnormal orders, and corresponding handling instructions and analysis reports are generated.

[0013] As a preferred embodiment of the multimodal data business travel anomaly capture method of the present invention, structured order transaction data is pulled in real time through application programming interface, user behavior sequence data is captured through front-end embedding and log collection system, and unstructured text interaction data is obtained by parsing communication records;

[0014] The acquired multimodal data undergoes data cleaning, format standardization, and numerical normalization. A comprehensive quality score is then calculated to determine whether the data stream should be adopted. The calculation method for the comprehensive quality score is as follows:

[0015]

[0016] in, To calculate the overall quality score, As a measure of the completeness of data fields, As an indicator of the time freshness of data, This is a validity indicator for the data format. For completeness weight, Weighted by time freshness, This is the validity weight.

[0017] As a preferred embodiment of the multimodal data-based business travel anomaly capture method of this invention, a pre-trained language model is used to extract semantic association features from unstructured text interaction data. These semantic association features are used to quantify the deviation between user intent and corporate policy. The method for calculating the deviation is as follows:

[0018]

[0019] in, The semantic deviation score is used to determine the degree of semantic deviation. This refers to the user intent vector extracted from unstructured text interaction data. A vector representation of the corporate travel policy text corresponding to the user intent vector;

[0020] A fixed-length sequence of behavioral events, including page browsing, searching, clicking, booking, and payment, is extracted using a sliding window method. The sequence of behavioral events is then input into a long short-term memory network to extract temporal behavioral features.

[0021] As a preferred embodiment of the multimodal data business travel anomaly capture method of the present invention, user, order, device, payment account, and service provider are used as business travel entity nodes to construct nodes;

[0022] Edges are constructed based on the interaction behaviors between business travel entities, and a temporal context weight is calculated for each edge. The method for calculating the temporal context weight is as follows:

[0023]

[0024] in, In order to be in Constant connection node and The weight of the edge. The frequency of interactions between nodes. The interaction frequency influence factor, Based on weights, The timestamp of the last interaction. The time decay coefficient, and This is the index of the node.

[0025] As a preferred embodiment of the multimodal data business travel anomaly capture method of the present invention, the embedded representation of nodes is updated through the message passing and aggregation mechanism of graph neural network;

[0026] Based on the updated embedding representation, the anomaly score of the target business travel order is calculated using the reconstruction error. The anomaly score is calculated as follows:

[0027]

[0028] in, For abnormal scores, This is an embedded representation of the node corresponding to the target business travel order. Let be the set of embedding representations of its first-order neighbor nodes. This is a function for aggregating neighbor node information. This is a decoder function used to reconstruct the representation of the central node. For the Euclidean norm, Neighbor nodes calculated based on edge weights Importance coefficient, The total number of neighboring nodes. This is the index of the neighboring node.

[0029] As a preferred embodiment of the multimodal data-based business travel anomaly capture method of the present invention, an adaptive risk threshold is dynamically calculated based on the statistical distribution of historical abnormal orders. The calculation method of the adaptive risk threshold is as follows:

[0030]

[0031] in, To adapt the risk threshold, This is a moving average of historical abnormal order scores. The moving standard deviation of the scores for historical outlier orders. This represents the risk preference coefficient.

[0032] As a preferred embodiment of the multimodal data business travel anomaly capture method of the present invention, a graph neural network is pre-trained using self-supervised learning before calculating the anomaly score of the target business travel order;

[0033] Self-supervised learning includes link prediction and node attribute reconstruction tasks. The link prediction task is used to learn the structural information of the graph, and the node attribute reconstruction task is used to learn the feature information of the nodes.

[0034] As a preferred embodiment of the multimodal data business travel anomaly capture method of the present invention, a multi-level risk threshold system is set up to classify the warning level according to the risk type and severity.

[0035] Establish a tiered response mechanism and formulate differentiated handling strategies for different risk levels;

[0036] To achieve dynamic optimization and adjustment of disposal strategies, and to continuously improve decision parameters based on historical disposal effect data.

[0037] Secondly, this invention provides a business travel anomaly capture system for multimodal data, comprising: a data acquisition and preprocessing module for synchronously acquiring multimodal data from business travel services, including structured order transaction data, user behavior sequence data, and unstructured text interaction data, and performing standardized preprocessing on the multimodal data; a multimodal feature extraction module for extracting features from the standardized preprocessed multimodal data, extracting transaction statistical features from structured order transaction data, extracting temporal behavior features from user behavior sequence data, and extracting semantic association features from unstructured text interaction data; and a dynamic graph construction module. The system is used to construct a dynamic heterogeneous entity relationship graph based on extracted transaction statistical features, temporal behavior features, and semantic association features. Nodes in the entity relationship graph represent business travel entities, and edges represent the interaction relationships between business travel entities. The anomaly detection and calculation module is used to calculate the anomaly score of the target business travel order by learning the embedding representation of the nodes on the dynamic heterogeneous entity relationship graph using a graph neural network-based anomaly detection model. The analysis and handling module is used to compare the anomaly score with an adaptive risk threshold, determine the target business travel order with the anomaly score greater than the adaptive risk threshold as an abnormal order, and generate corresponding handling instructions and analysis reports.

[0038] Thirdly, the present invention provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement a method for capturing business travel anomalies in multimodal data.

[0039] Compared with existing technologies, the advantages of this invention are as follows: It can overcome the limitations of traditional anomaly detection relying on a single data source and static rules. By simultaneously acquiring multimodal data such as structured orders, user behavior sequences, and unstructured text, it provides a complementary and comprehensive data foundation for anomaly detection, fundamentally improving the ability to perceive abnormal behavior. By extracting multi-dimensional features such as transaction statistics, temporal behavior, and semantic associations from different modal data, it constructs a heterogeneous feature set that can comprehensively characterize various known and unknown anomaly patterns in business travel activities, significantly improving the richness and robustness of anomaly features. By constructing a dynamic heterogeneous entity relationship graph and using graph neural networks for analysis, the perspective of anomaly detection is elevated from isolated events to the level of interconnected entity networks. This allows for in-depth mining of deep relationships and transmission risks between entities such as users, orders, and devices, effectively identifying complex anomaly patterns such as collaborative fraud and gang-related crimes that are difficult to detect using traditional methods, and generating more context-aware anomaly judgment criteria. Ultimately, the model outputs accurate anomaly detection results and generates handling instructions and analysis reports, providing a reliable decision-making basis for risk management, compliance auditing and strategy optimization of corporate business travel activities, and effectively ensuring the asset security and management efficiency of enterprises in complex business travel scenarios. Attached Figure Description

[0040] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0041] Figure 1 This is a schematic diagram illustrating a method for capturing business travel anomalies using multimodal data, as proposed in this invention.

[0042] Figure 2 This is a schematic diagram of a business travel anomaly capture system based on multimodal data proposed in this invention;

[0043] Figure 3 This is a schematic diagram of an electronic device proposed by the present invention. Detailed Implementation

[0044] To make the above-mentioned objects, features, and advantages of the present invention more apparent and understandable, specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of them. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the protection scope of the present invention.

[0045] Example 1, referring to Figure 1 The first embodiment of the present invention provides a method for capturing business travel anomalies in multimodal data, comprising:

[0046] S1. Synchronously acquire multimodal data from business travel services. Multimodal data includes structured order transaction data, user behavior sequence data, and unstructured text interaction data. Perform standardized preprocessing on the multimodal data.

[0047] S2. Extract features from the standardized preprocessed multimodal data, extract transaction statistics features from structured order transaction data, extract time-series behavior features from user behavior sequence data, and extract semantic association features from unstructured text interaction data.

[0048] S3. Based on the extracted transaction statistical features, temporal behavior features and semantic association features, a dynamic heterogeneous entity relationship graph is constructed. The nodes in the entity relationship graph represent business travel entities, and the edges represent the interaction relationships between business travel entities.

[0049] S4. On the dynamic heterogeneous entity relationship graph, an anomaly detection model based on graph neural network is adopted. By learning the embedded representation of nodes, the anomaly score of the target business travel order is calculated.

[0050] S5. Based on the comparison between the abnormal score and the adaptive risk threshold, target business travel orders with an abnormal score greater than the adaptive risk threshold are identified as abnormal orders, and corresponding handling instructions and analysis reports are generated.

[0051] Specifically, this invention proposes a business travel anomaly detection framework based on deep fusion of multimodal data. Its core lies in integrating structured order transaction data, dynamic user behavior sequence data, and unstructured text interaction data to construct a panoramic view of business travel activities, thereby overcoming the limitations of traditional risk control relying on a single data source. This invention does not merely judge isolated transaction events, but examines each business travel activity within its complete context. By constructing a dynamic heterogeneous entity relationship graph, it connects previously scattered entity information such as users, orders, devices, and accounts into a network, and then uses graph neural network technology to learn deep relationships and anomaly patterns within the network. This method can effectively identify group fraud, collusion, and high-risk transactions hidden behind complex interactions that are difficult to detect using traditional rules. Ultimately, it outputs a quantitative risk score and clear handling recommendations, achieving a complete closed loop from multidimensional data collection, deep feature engineering, intelligent correlation analysis to automated risk decision-making, providing scientific, accurate, and highly adaptable risk control technology support for enterprise business travel management.

[0052] Specifically, S1 includes the following sub-steps:

[0053] Structured order transaction data is pulled in real time through application programming interfaces, user behavior sequence data is captured through front-end tracking and log collection systems, and unstructured text interaction data is obtained by parsing communication records.

[0054] The acquired multimodal data undergoes data cleaning, format standardization, and numerical normalization. A comprehensive quality score is then calculated to determine whether the data stream should be adopted. The calculation method for the comprehensive quality score is as follows:

[0055]

[0056] in, To calculate the overall quality score, As a measure of the completeness of data fields, As an indicator of the time freshness of data, This is a validity indicator for the data format. For completeness weight, Weighted by time freshness, This is the validity weight.

[0057] For example, in a specific calculation, suppose the system receives an order data stream, and after evaluation, the completeness index of its required fields is... The delay between data generation time and current processing time is very small, resulting in a calculated time freshness index. All field formats conform to predefined specifications, validity metrics The weights for the three indicators are set as follows: completeness weight... Time freshness weight Validity weight Therefore, the overall quality score for this data stream is: If the system sets the data adoption threshold to be... Due to the calculated If the data stream exceeds this threshold, it will be classified as high-quality data and proceed to the subsequent feature extraction stage.

[0058] Specifically, step S1 lays a solid data foundation for subsequent accurate anomaly detection by building a collaborative data acquisition and preprocessing pipeline. Corporate travel activity data is naturally scattered across different systems; this step aims to effectively aggregate and integrate this data. For structured order transaction data, by calling application programming interfaces (APIs) of booking and financial systems, core transaction information such as order amount, booking time, and product type can be obtained in real time and accurately. For user behavior sequence data, by embedding event tracking at the front end of the booking application and leveraging a log collection system, the complete behavioral chain of users from login, search, browsing, comparison to final order placement or cancellation can be captured. This data reveals users' operating habits and true intentions. For unstructured text interaction data, by parsing customer service chat logs, emails, approval notes, and other text, the communication background and explanatory information behind the transaction can be extracted. After acquiring the raw data, standardized preprocessing is crucial. The data cleaning process removes duplicate, missing, or obviously erroneous records; format standardization ensures that data from different sources, such as timestamps and currency units, have a consistent representation; numerical normalization scales feature values ​​of different dimensions to a uniform range, avoiding bias caused by large numerical differences during model training. Finally, by calculating the comprehensive quality score of the data stream, a data admission threshold is established to effectively prevent low-quality or damaged data from entering the analysis system, ensuring the stability and reliability of the entire anomaly detection model.

[0059] Specifically, S2 includes the following sub-steps:

[0060] A pre-trained language model is used to extract semantic association features from unstructured text interaction data. These features are then used to quantify the deviation between user intent and corporate policy. The deviation is calculated as follows:

[0061]

[0062] in, The semantic deviation score is used to determine the degree of semantic deviation. This refers to the user intent vector extracted from unstructured text interaction data. A vector representation of the corporate travel policy text corresponding to the user intent vector;

[0063] A fixed-length sequence of behavioral events, including page browsing, searching, clicking, booking, and payment, is extracted using a sliding window method. The sequence of behavioral events is then input into a long short-term memory network to extract temporal behavioral features.

[0064] For example, in a specific calculation, when an employee submits an approval request for an overpriced hotel booking, the remarks could be something like, "Although the price is slightly higher, this is the closest hotel to the client's meeting venue, saving travel time." The system extracts this remarks to generate a user intent vector. Simultaneously, extract the corresponding hotel booking standards to generate policy vectors. After calculation, the cosine similarity value of the two vectors is... This indicates that although the price policy was violated, the intention was semantically related to the potential policy orientation of "efficient work." Therefore, the semantic deviation score is: This score quantitatively reflects the degree of deviation, rather than a simple "yes" or "no," providing a more refined basis for judgment in downstream models.

[0065] Specifically, step S2 extracts multi-dimensional features from standardized multimodal data that can deeply characterize the anomalous characteristics of business travel activities. This step aims to transform the raw data into high-dimensional vectors that can be understood and utilized by machine learning models. In processing unstructured text interaction data, this method abandons traditional keyword matching methods and instead employs advanced pre-trained language models. These models, pre-trained on massive amounts of text, possess powerful natural language understanding capabilities. By inputting the user's communication text and the relevant corporate travel policy text into the model, their vector representations in a high-dimensional semantic space can be obtained. Using cosine similarity calculation between vectors, the semantic deviation between user intent and compliance policies can be accurately quantified, thereby identifying behaviors that appear compliant but are actually suspicious in intent. In processing user behavior sequence data, this method utilizes Long Short-Term Memory (LSTM) networks to capture the temporal dependencies of behavior. The user's booking process is not a series of isolated clicks but has an inherent logic and temporal order. LTM networks, through their unique gating mechanism, can learn typical patterns of normal booking behavior, such as the smooth process of "search-compare-place order." When a user's behavioral sequence deviates from this normal pattern, such as a large number of repeated searches, unusual page jumps, or high-priced bookings made late at night, the Long Short-Term Memory (LSTM) network can effectively capture these temporal anomalies and encode them into the output temporal behavioral features. By combining the semantic features of the text with the temporal features of the behavior, this step constructs a risk profile that is much richer than a single transaction feature.

[0066] Specifically, S3 includes the following sub-steps:

[0067] The nodes are constructed using users, orders, devices, payment accounts, and service providers as entities for business travel;

[0068] Edges are constructed based on the interaction behaviors between business travel entities, and a temporal context weight is calculated for each edge. The method for calculating the temporal context weight is as follows:

[0069]

[0070] in, In order to be in Constant connection node and The weight of the edge. The frequency of interactions between nodes. The interaction frequency influence factor, Based on weights, The timestamp of the last interaction. The time decay coefficient, and This is the index of the node.

[0071] For example, in specific calculations, analyzing user nodes With device nodes The relationship between them. Assume that in the past month, this user logged in through this device... Next. Set the interaction frequency influence factor. Basic weight The current time is Time point, The timestamp of the last interaction, the difference between the two Heaven, that is Set the time decay coefficient. The timeframe is 30 days. Therefore, at the current moment, the weight of the edge connecting these two nodes is calculated as follows: This weight value takes into account both the frequency of historical interactions and the novelty of those interactions, dynamically reflecting the closeness of the relationship between entities.

[0072] Specifically, step S3 organizes and associates the extracted multi-dimensional features to construct a dynamic heterogeneous entity relationship graph that reflects the complex relationships between entities. This step is the core of this invention's shift from "event detection" to "relationship analysis." Traditional anomaly detection methods typically view each transaction in isolation, while this step connects scattered entity information into a network through graph construction. Nodes in the graph represent core entities in business travel activities, such as users initiating bookings, generated orders, used devices, associated payment accounts, and service providers. Edges in the graph represent the actual interactions between these entities, such as a user booking an order through a device and using a payment account. This graph structure can intuitively reveal hidden connections, such as multiple newly registered users using the same device to make bookings, or multiple seemingly unrelated orders ultimately flowing to the same payment account—signals of organized fraud that are difficult to detect with single-point detection. Crucially, the graph is dynamic. By calculating temporal context weights for the edges, the model can perceive the temporal attributes of the interactions. The exponential decay term in the formula ensures that recently occurring interactions have higher weights, which aligns with the real-world laws of risk evolution—that is, recent behavioral patterns have a greater influence on future risk predictions. Through this step, the originally static and isolated data points are transformed into a dynamically evolving relational network full of contextual information, providing an ideal data structure for subsequent deep analysis using graph neural networks.

[0073] The specific S4 includes the following sub-steps:

[0074] The embedded representation of nodes is updated through the message passing and aggregation mechanism of graph neural networks;

[0075] Based on the updated embedding representation, the anomaly score of the target business travel order is calculated using the reconstruction error. The anomaly score is calculated as follows:

[0076]

[0077] in, For abnormal scores, This is an embedded representation of the node corresponding to the target business travel order. Let be the set of embedding representations of its first-order neighbor nodes. This is a function for aggregating neighbor node information. This is a decoder function used to reconstruct the representation of the central node. For the Euclidean norm, Neighbor nodes calculated based on edge weights Importance coefficient, The total number of neighboring nodes. This is the index of the neighboring node.

[0078] For example, in specific calculations, a target order node The embedding is represented as It has three neighboring nodes: user, device, and payment account, and their embedding representations are... After aggregate function The aggregate vector is obtained after processing. Decoder function Based on this aggregated vector, an attempt is made to reconstruct the central node, and the output reconstructed vector is: As can be seen, the reconstructed vector and the original vector... There are significant differences between them. Assume the importance coefficients of the three neighbors... All Then abnormal scores The calculation will be based on vectors The square of the Euclidean norm, i.e. This high score quantitatively reflects the inconsistency between the order node and its surrounding network environment, i.e., the existence of an anomaly.

[0079] Specifically, step S4 applies graph neural network technology to the constructed dynamic heterogeneous entity relationship graph for anomaly detection, achieving accurate quantification of business travel order risks. Graph neural networks are deep learning models specifically designed for processing graph-structured data, with their core being message passing and aggregation mechanisms. For any node in the graph (e.g., a target business travel order), this mechanism allows it to aggregate information from all its neighboring nodes (e.g., the user who booked the order, the device used, etc.) to update its own representation. After multiple rounds of message passing, the final embedded representation of each node not only encodes its own features but also incorporates its local network structure in the graph and the feature information of its neighbors, i.e., its "context." This step utilizes this context-rich embedded representation to identify anomalies by calculating the reconstruction error. The basic idea is that the model learns from a large number of normal samples, mastering how the embedded representation of a normal node should be "reconstructed" from the embedded representations of its neighboring nodes. When the context of a target order node is abnormal (e.g., the user behavior it is associated with is strange, or the associated device is risky), the representation reconstructed from its neighboring information will differ significantly from its original representation. This difference, or reconstruction error, is used as the final anomaly score. The more unusual the context of a node, the larger its reconstruction error and the higher its anomaly score. This context-based detection method enables the model to discover "contaminated" orders whose own features seem normal, but whose associated entities pose a risk, greatly improving the depth and breadth of detection.

[0080] The specific S5 includes the following sub-steps:

[0081] Based on the statistical distribution of historical abnormal orders, an adaptive risk threshold is dynamically calculated. The calculation method for the adaptive risk threshold is as follows:

[0082]

[0083] in, To adapt the risk threshold, This is a moving average of historical abnormal order scores. The moving standard deviation of the scores for historical outlier orders. This represents the risk preference coefficient.

[0084] Specifically, step S5 transforms the continuous anomaly scores output by the model into explicit, actionable business decisions. The core of this step lies in employing an adaptive risk threshold mechanism to replace a fixed threshold. In real-world business scenarios, risk profiles are dynamically changing, and fixed thresholds often struggle to adapt. For example, during marketing campaigns, user behavior patterns undergo significant changes, and using a fixed threshold may generate numerous false positives; conversely, when encountering new types of fraud attacks, a fixed threshold may be too insensitive. This method dynamically calculates the threshold by continuously monitoring the score distribution of historically identified anomaly orders. The moving average in the formula... It reflects the central trend of recent outlier scores, while the moving standard deviation reflects the central trend. This reflects the range of score fluctuation. The threshold is set as the central trend plus several times the fluctuation range, allowing the threshold to automatically fluctuate with the "level" of risk, increasing alertness when overall risk rises and maintaining a normal level during stable periods. Risk Preference Coefficient This provides business managers with an adjustable control lever, which can be adjusted... Values ​​can be adjusted under stricter risk control (lower risk level). "Value)" and "More relaxed user experience (high)" A balance is struck between the scores and the adaptive threshold. Ultimately, orders with scores exceeding the adaptive threshold are marked as abnormal and trigger subsequent handling processes, such as automatic interception, transfer to manual review, or sending alerts to risk management personnel. At the same time, the generated analysis report will detail the composition of the abnormal score, the associated risk entities, and other information to provide decision support for manual handling.

[0085] In some embodiments, a method for capturing business travel anomalies in multimodal data may further include the following steps:

[0086] Before calculating the outlier scores of the target business travel orders, a graph neural network is pre-trained using self-supervised learning.

[0087] Self-supervised learning includes link prediction and node attribute reconstruction tasks. The link prediction task is used to learn the structural information of the graph, and the node attribute reconstruction task is used to learn the feature information of the nodes.

[0088] Specifically, this implementation introduces self-supervised learning to pre-train the graph neural network, aiming to improve the model's learning efficiency and generalization ability in scenarios with sparse labeled samples. In the field of business travel risk control, confirmed abnormal samples are often scarce and valuable. If a complex graph neural network is trained directly on a small number of labeled samples, the model is prone to overfitting. Self-supervised learning constructs supervisory signals from the data itself, allowing the model to learn on massive amounts of unlabeled data first. The link prediction task requires the model to determine whether there is a real connection between any two nodes in the graph. Through this task, the model is forced to learn the topological structure of the graph and understand which entities tend to establish connections. The node attribute reconstruction task requires the model to predict the characteristics of a node based on its neighbor information, which prompts the model to learn the intrinsic relationship between node features and its network environment. Through pre-training on these two tasks, the graph neural network can master the "universal language" of the business travel relationship graph and learn node embedding representations with strong generalization ability. On this basis, the model is then fine-tuned using a small number of labeled samples, focusing on the anomaly detection task, which can achieve higher detection accuracy with less data and faster speed.

[0089] In some embodiments, a method for capturing business travel anomalies in multimodal data may further include the following steps:

[0090] Establish a multi-level risk threshold system and classify early warning levels according to the type and severity of risks;

[0091] Establish a tiered response mechanism and formulate differentiated handling strategies for different risk levels;

[0092] To achieve dynamic optimization and adjustment of disposal strategies, and to continuously improve decision parameters based on historical disposal effect data.

[0093] Specifically, after obtaining anomaly scores, this implementation method further constructs an intelligent early warning and handling closed loop, aiming to transform the model's analysis results into refined business operation actions. First, the system does not use a single threshold but sets up a multi-level risk threshold system. For example, anomaly scores are divided into multiple levels such as "Attention," "Warning," and "High Risk," with different score ranges corresponding to different risk levels, making risk assessment more hierarchical. Second, a graded response mechanism matching the risk level is established. For orders at the "Attention" level, only recording may be performed without interfering with the user process; for the "Warning" level, the system can automatically trigger secondary verification, such as requiring the user to provide supplementary explanations or conduct SMS verification; for the "High Risk" level, automatic interception can be performed, and a work order can be immediately generated and pushed to the manual review team. This differentiated handling strategy effectively controls risks while minimizing interference with normal users and optimizing the user experience. Finally, this mechanism has self-optimization capabilities. The system will continuously track and analyze the actual effects of different handling strategies, such as the accuracy of interception and the efficiency of manual review, and feed this effect data back to the decision-making system to continuously and automatically adjust the risk level classification criteria and corresponding handling strategies, forming a risk management closed loop that can continuously learn and evolve.

[0094] Example 2, refer to Figure 2 This is a second embodiment of the present invention, which provides a business travel anomaly capture system for multimodal data, including: a data acquisition and preprocessing module, used to synchronously acquire multimodal data from business travel services, the multimodal data including structured order transaction data, user behavior sequence data, and unstructured text interaction data, and to perform standardized preprocessing on the multimodal data; a multimodal feature extraction module, used to extract features from the standardized preprocessed multimodal data, extracting transaction statistical features from structured order transaction data, extracting temporal behavior features from user behavior sequence data, and extracting semantic association features from unstructured text interaction data; and a dynamic graph. The module constructs a dynamic heterogeneous entity relationship graph based on extracted transaction statistical features, temporal behavioral features, and semantic association features. Nodes in the entity relationship graph represent business travel entities, and edges represent the interaction relationships between business travel entities. The anomaly detection and calculation module uses a graph neural network-based anomaly detection model on the dynamic heterogeneous entity relationship graph to calculate the anomaly score of target business travel orders by learning the embedding representation of nodes. The analysis and handling module compares the anomaly score with an adaptive risk threshold, determines target business travel orders with anomaly scores greater than the adaptive risk threshold as anomaly orders, and generates corresponding handling instructions and analysis reports.

[0095] An electronic device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, it implements a method for capturing business travel anomalies in multimodal data.

[0096] like Figure 3 As shown, the electronic device may include a processor 610, a communications interface 620, a memory 630, and a communication bus 640. The processor 610, communications interface 620, and memory 630 communicate with each other via the communication bus 640. The processor 610 can call logical instructions from the memory 630 to execute a multimodal data business travel anomaly detection method.

[0097] Furthermore, the logical instructions in the aforementioned memory 630 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0098] On the other hand, the present invention also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer is able to execute a method for capturing business travel anomalies in multimodal data.

[0099] In another aspect, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to perform a method for capturing business travel anomalies in multimodal data.

[0100] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0101] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0102] Although preferred embodiments of this application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of this application.

[0103] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A method for capturing business travel anomalies in multimodal data, characterized in that, include: Synchronously acquire multimodal data from business travel services, including structured order transaction data, user behavior sequence data, and unstructured text interaction data, and perform standardized preprocessing on the multimodal data; Feature extraction is performed on the standardized preprocessed multimodal data, including extracting transaction statistical features from the structured order transaction data, extracting temporal behavior features from the user behavior sequence data, and extracting semantic association features from the unstructured text interaction data; Based on the extracted transaction statistical features, temporal behavior features, and semantic association features, a dynamic heterogeneous entity relationship graph is constructed. Nodes in the entity relationship graph represent business travel entities, and edges represent the interaction relationships between business travel entities. On the dynamic heterogeneous entity relationship graph, an anomaly detection model based on graph neural networks is used to calculate the anomaly score of the target business travel order by learning the embedding representation of the nodes. Based on the comparison between the anomaly score and the adaptive risk threshold, the target business travel orders with an anomaly score greater than the adaptive risk threshold are identified as anomaly orders, and corresponding handling instructions and analysis reports are generated. The steps for extracting semantic association features from the unstructured text interaction data include: A pre-trained language model is used to extract the semantic association features from the unstructured text interaction data. These semantic association features are used to quantify the deviation between user intent and corporate policy. A fixed-length sequence of behavioral events, including page browsing, searching, clicking, booking, and payment, is extracted using a sliding window method. The sequence of behavioral events is then input into a long short-term memory network to extract the temporal behavioral features. The steps for constructing a dynamic heterogeneous entity relationship graph based on the extracted transaction statistical features, temporal behavioral features, and semantic association features include: The nodes are constructed using users, orders, devices, payment accounts, and service providers as the business travel entities; The edges are constructed based on the interaction behavior between the business travel entities, and a temporal context weight is calculated for each edge; The steps for calculating the outlier score of a target business travel order include: The embedding representation of the node is updated through the message passing and aggregation mechanism of the graph neural network; Based on the updated embedded representation, the anomaly score of the target business travel order is calculated using the reconstruction error.

2. The method for capturing business travel anomalies in multimodal data according to claim 1, characterized in that, The process involves synchronously acquiring multimodal data from business travel services, including structured order transaction data, user behavior sequence data, and unstructured text interaction data, and performing standardized preprocessing on the multimodal data. Specifically, this includes: The structured order transaction data is retrieved in real time through the application programming interface, the user behavior sequence data is captured through the front-end data tracking and log collection system, and the unstructured text interaction data is obtained by parsing communication records. The acquired multimodal data undergoes data cleaning, format standardization, and numerical normalization. A comprehensive quality score is then calculated to determine whether the data stream should be adopted. The calculation method for the comprehensive quality score is as follows: in, The overall quality score is... As a measure of the completeness of data fields, As an indicator of the time freshness of data, This is a validity indicator for the data format. For completeness weight, Weighted by time freshness, This is the validity weight.

3. The method for capturing business travel anomalies in multimodal data according to claim 2, characterized in that, The method for calculating the deviation is as follows: in, The semantic deviation score is used to determine the degree of semantic deviation. This refers to the user intent vector extracted from the unstructured text interaction data. This is a vector representation of the corporate travel policy text corresponding to the user intent vector.

4. The method for capturing business travel anomalies in multimodal data according to claim 3, characterized in that, The method for calculating the temporal context weights is as follows: in, In order to be in Constant connection node and The weight of the edge. The interaction frequency characteristics between the nodes. The interaction frequency influence factor, Based on weights, The timestamp of the last interaction. The time decay coefficient, and This is the index of the node.

5. The method for capturing business travel anomalies in multimodal data according to claim 4, characterized in that, The method for calculating the anomaly score is as follows: in, The abnormal score is... This is the embedded representation of the node corresponding to the target business travel order. Let be the set of embedding representations of its first-order neighbor nodes. This is a function for aggregating neighbor node information. This is a decoder function used to reconstruct the representation of the central node. For the Euclidean norm, Neighbor nodes calculated based on temporal context weights Importance coefficient, The total number of neighboring nodes. This is the index of the neighboring node.

6. The method for capturing business travel anomalies in multimodal data according to claim 5, characterized in that, The steps of comparing the anomaly score with an adaptive risk threshold, identifying target business travel orders with anomaly scores greater than the adaptive risk threshold as anomaly orders, and generating corresponding handling instructions and analysis reports are as follows: Based on the statistical distribution of historical abnormal orders, the adaptive risk threshold is dynamically calculated. The calculation method for the adaptive risk threshold is as follows: in, The adaptive risk threshold, This is a moving average of historical abnormal order scores. The moving standard deviation of the scores for historical outlier orders. This represents the risk preference coefficient.

7. The method for capturing business travel anomalies in multimodal data according to claim 1, characterized in that, The method further includes: Before calculating the anomaly score of the target business travel order, the graph neural network is pre-trained using self-supervised learning; The self-supervised learning includes a link prediction task and a node attribute reconstruction task. The link prediction task is used to learn the structural information of the graph, and the node attribute reconstruction task is used to learn the feature information of the nodes.

8. The method for capturing business travel anomalies in multimodal data according to claim 1, characterized in that, The method also includes the step of establishing an intelligent early warning and response mechanism: Establish a multi-level risk threshold system and classify early warning levels according to the type and severity of risks; Establish a tiered response mechanism and formulate differentiated handling strategies for different risk levels; To achieve dynamic optimization and adjustment of disposal strategies, and to continuously improve decision parameters based on historical disposal effect data.

9. A business travel anomaly detection system based on multimodal data, characterized in that, include: The data acquisition and preprocessing module is used to synchronously acquire multimodal data from business travel services, including structured order transaction data, user behavior sequence data, and unstructured text interaction data, and to perform standardized preprocessing on the multimodal data. The multimodal feature extraction module is used to extract features from the standardized preprocessed multimodal data, extract transaction statistical features from the structured order transaction data, extract temporal behavior features from the user behavior sequence data, and extract semantic association features from the unstructured text interaction data; The dynamic graph construction module is used to construct a dynamic heterogeneous entity relationship graph based on the extracted transaction statistical features, temporal behavior features and semantic association features. The nodes in the entity relationship graph represent business travel entities, and the edges represent the interaction relationships between the business travel entities. An anomaly detection and calculation module is used to calculate the anomaly score of the target business travel order by learning the embedded representation of the nodes on the dynamic heterogeneous entity relationship graph using an anomaly detection model based on a graph neural network. The analysis and handling module is used to compare the anomaly score with the adaptive risk threshold, determine the target business travel order with the anomaly score greater than the adaptive risk threshold as an abnormal order, and generate corresponding handling instructions and analysis reports.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements a method for capturing business travel anomalies in multimodal data as described in any one of claims 1-8.

Images