Method and apparatus for detecting abnormal waybills
By combining isolated forest and decision forest models with a self-attention mechanism, an abnormal waybill detection method is developed, which solves the problems of low detection accuracy and recall in existing technologies and achieves efficient waybill anomaly detection.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- SF TECH CO LTD
- Filing Date
- 2021-10-25
- Publication Date
- 2026-06-09
AI Technical Summary
Existing technologies for detecting abnormal waybills have low accuracy and recall rates, resulting in wasted human resources and low detection efficiency.
An abnormal waybill detection method based on the isolated forest model and the decision forest model is adopted. The abnormal probability value of the waybill information is determined by multiple preset matching conditions, and the feature weights are adjusted by the self-attention mechanism to improve the detection accuracy and recall rate.
It improved the accuracy and recall rate of abnormal waybill detection, reduced the workload of manual detection, and improved detection efficiency.
Smart Images
Figure CN116030487B_ABST
Abstract
Description
Technical Field
[0001] This application mainly relates to the field of artificial intelligence recognition technology, specifically to a method and device for detecting abnormal waybills. Background Technology
[0002] In recent years, with the rise of online shopping, more and more people are sending goods via express delivery, a significant product of the transformation of distribution methods and consumption upgrades. However, while bringing immense convenience to the public, it also brings uncontrollable liquidity risks, posing a serious challenge to public safety. For example, express delivery is used to transport dangerous goods such as drugs and explosives.
[0003] Currently, the main method for detecting drug shipments is manual inspection, which involves opening and inspecting tens of thousands of packages every day, placing a heavy workload on frontline delivery workers and wasting manpower and time. Alternatively, the method simply inputs the shipment information into a neural network for prediction, but this method has low accuracy and recall.
[0004] In other words, the accuracy and recall rate of abnormal waybill detection in existing technologies are relatively low. Summary of the Invention
[0005] This application provides a method and apparatus for detecting abnormal waybills, aiming to solve the problems of low accuracy and recall rate in the detection of abnormal waybills in the prior art.
[0006] Firstly, this application provides a method for detecting abnormal waybills, the method comprising:
[0007] Obtain information on multiple waybills to be predicted;
[0008] Based on the multiple shipment information to be predicted and multiple preset matching conditions, determine multiple target matching conditions that each shipment information to be predicted must satisfy.
[0009] Based on each of the predicted waybill information and the multiple target matching conditions satisfied by each of the predicted waybill information, the abnormal probability value of each of the predicted waybill information belonging to an abnormal waybill is determined.
[0010] Anomaly detection is performed on the multiple anomaly probability values to obtain the anomaly value among the multiple anomaly probability values;
[0011] The waybill information corresponding to the outlier value is identified as an abnormal waybill.
[0012] Optionally, the step of performing anomaly detection on the plurality of anomaly probability values to obtain an anomaly value among the plurality of anomaly probability values includes:
[0013] From the multiple abnormal probability values, n points are randomly selected as subsamples and placed into the root node of an initialized isolated tree;
[0014] A cut point is randomly generated within the current node's data range, where the cut point is generated between the maximum and minimum values of the current node's data.
[0015] Based on the cutting point, the data space of the current node is divided into two branches. Points smaller than the cutting point in the currently selected dimension are taken as the left child nodes of the current node, and points greater than or equal to the cutting point are taken as the right child nodes of the current node.
[0016] Determine whether the generalization index of the isolated tree after node partitioning is greater than the generalization ability index of the isolated tree before node partitioning.
[0017] If yes, then recursively execute the process of randomly generating a cutting point within the current node's data range and dividing the current node's data space into two branches based on the cutting point for the left and right child nodes respectively; if no, then stop the division, obtain the target isolated tree, and form an isolated forest model.
[0018] Anomaly detection is performed on multiple target isolated trees based on the isolated forest model to obtain anomaly values among the multiple anomaly probability values, wherein different target isolated trees are trained from different subsamples.
[0019] Optionally, the multiple target isolated trees based on the isolated forest model perform anomaly detection on multiple anomaly probability values to obtain anomaly values among the multiple anomaly probability values, including:
[0020] For each of the above anomaly probability values, the anomaly probability value is traversed through each target isolated tree in the isolated forest model, and the expected path length of the anomaly probability value in multiple target isolated trees is calculated.
[0021] Anomaly scores are determined based on the expected path length.
[0022] The abnormal probability value corresponding to the abnormal score that meets the preset abnormal score condition is determined as an abnormal value.
[0023] Optionally, determining the probability value of each piece of information about a shipment to be predicted belonging to an abnormal shipment based on each piece of information about a shipment to be predicted and multiple target matching conditions satisfied by each piece of information about a shipment to be predicted includes:
[0024] Obtain the weight coefficients corresponding to each of the target matching conditions;
[0025] The waybill information to be predicted, the multiple target matching conditions satisfied by the waybill information to be predicted, and the weight coefficients of the multiple target matching conditions satisfied by the waybill information to be predicted are encoded respectively to obtain the waybill feature vector, waybill hit condition feature vector, and waybill weight feature vector of the waybill information to be predicted.
[0026] Input the waybill feature vector, waybill hit condition feature vector, and waybill weight feature vector of each waybill information to be predicted into the abnormal waybill prediction model to obtain the abnormal probability value of the waybill information to be predicted belonging to an abnormal waybill.
[0027] Optionally, before inputting the waybill feature vector, waybill hit condition feature vector, and waybill weight feature vector of each of the waybill information to be predicted into the abnormal waybill prediction model to obtain the abnormal probability value of the waybill information to be predicted belonging to an abnormal waybill, the following steps are included:
[0028] Obtain a first waybill sample set, wherein the first waybill sample set includes positive samples with abnormal sample labels and negative samples with normal sample labels;
[0029] Randomly remove some negative samples from the first waybill sample set to obtain a second waybill sample set, wherein the ratio of positive samples to negative samples in the second waybill sample set is a preset ratio.
[0030] The decision forest model is trained based on the second waybill sample set to obtain an abnormal waybill prediction model.
[0031] Optionally, the step of training the decision forest model based on the second waybill sample set to obtain the abnormal waybill prediction model includes:
[0032] Encode each waybill sample in the second waybill sample set to obtain waybill feature vector, waybill hit condition feature vector, and waybill weight feature vector;
[0033] Input the waybill feature vector, waybill hit condition feature vector, and waybill weight feature vector into the self-attention model to adjust the feature weights, and obtain the weight-adjusted waybill feature vector, the weight-adjusted waybill hit condition feature vector, and the weight-adjusted waybill weight feature vector.
[0034] The decision forest model is trained based on the weighted feature vector of the waybill, the weighted feature vector of the waybill hit condition, and the weighted feature vector of the waybill weight to obtain the abnormal waybill prediction model.
[0035] Optionally, the step of randomly removing a portion of the negative samples from the first waybill sample set to obtain the second waybill sample set includes:
[0036] Remove duplicate waybill samples from the first waybill sample set to obtain the deduplicated first waybill sample set.
[0037] Randomly remove some negative samples from the first waybill sample set after deduplication to obtain the second waybill sample set, wherein the ratio of positive samples to negative samples in the second waybill sample set is a preset ratio.
[0038] Secondly, this application provides a device for detecting abnormal waybills, the device comprising:
[0039] The acquisition unit is used to acquire information on multiple waybills to be predicted.
[0040] The first determining unit is used to determine multiple target matching conditions satisfied by each of the multiple shipment information to be predicted based on the multiple shipment information to be predicted and multiple preset matching conditions.
[0041] The second determining unit is used to determine the abnormal probability value of each of the predicted waybill information as an abnormal waybill based on each of the waybill information to be predicted and multiple target matching conditions satisfied by each of the waybill information to be predicted.
[0042] An anomaly detection unit is used to perform anomaly detection on a plurality of the anomaly probability values and obtain an anomaly value among the plurality of the anomaly probability values;
[0043] The third determining unit is used to determine the waybill information to be predicted corresponding to the abnormal value as an abnormal waybill.
[0044] Optionally, the anomaly detection unit is used for:
[0045] From the multiple abnormal probability values, n points are randomly selected as subsamples and placed into the root node of an initialized isolated tree;
[0046] A cut point is randomly generated within the current node's data range, where the cut point is generated between the maximum and minimum values of the current node's data.
[0047] Based on the cutting point, the data space of the current node is divided into two branches. Points smaller than the cutting point in the currently selected dimension are taken as the left child nodes of the current node, and points greater than or equal to the cutting point are taken as the right child nodes of the current node.
[0048] Determine whether the generalization index of the isolated tree after node partitioning is greater than the generalization index of the isolated tree before node partitioning.
[0049] If yes, then recursively execute the process of randomly generating a cutting point within the current node's data range and dividing the current node's data space into two branches based on the cutting point for the left and right child nodes respectively; if no, then stop the division, obtain the target isolated tree, and form an isolated forest model.
[0050] Anomaly detection is performed on multiple target isolated trees based on the isolated forest model to obtain anomaly values among the multiple anomaly probability values, wherein different target isolated trees are trained from different subsamples.
[0051] Optionally, the anomaly detection unit is used for:
[0052] For each of the above anomaly probability values, the anomaly probability value is traversed through each target isolated tree in the isolated forest model, and the expected path length of the anomaly probability value in multiple target isolated trees is calculated.
[0053] Anomaly scores are determined based on the expected path length.
[0054] The abnormal probability value corresponding to the abnormal score that meets the preset abnormal score condition is determined as an abnormal value.
[0055] Optionally, the second determining unit is configured to:
[0056] Obtain the weight coefficients corresponding to each of the target matching conditions;
[0057] The waybill information to be predicted, the multiple target matching conditions satisfied by the waybill information to be predicted, and the weight coefficients of the multiple target matching conditions satisfied by the waybill information to be predicted are encoded respectively to obtain the waybill feature vector, waybill hit condition feature vector, and waybill weight feature vector of the waybill information to be predicted.
[0058] Input the waybill feature vector, waybill hit condition feature vector, and waybill weight feature vector of each waybill information to be predicted into the abnormal waybill prediction model to obtain the abnormal probability value of the waybill information to be predicted belonging to an abnormal waybill.
[0059] Optionally, the second determining unit is configured to:
[0060] Obtain a first waybill sample set, wherein the first waybill sample set includes positive samples with abnormal sample labels and negative samples with normal sample labels;
[0061] Randomly remove some negative samples from the first waybill sample set to obtain a second waybill sample set, wherein the ratio of positive samples to negative samples in the second waybill sample set is a preset ratio.
[0062] The decision forest model is trained based on the second waybill sample set to obtain an abnormal waybill prediction model.
[0063] Optionally, the second determining unit is configured to:
[0064] Encode each waybill sample in the second waybill sample set to obtain waybill feature vector, waybill hit condition feature vector, and waybill weight feature vector;
[0065] Input the waybill feature vector, waybill hit condition feature vector, and waybill weight feature vector into the self-attention model to adjust the feature weights, and obtain the weight-adjusted waybill feature vector, the weight-adjusted waybill hit condition feature vector, and the weight-adjusted waybill weight feature vector.
[0066] The decision forest model is trained based on the weighted feature vector of the waybill, the weighted feature vector of the waybill hit condition, and the weighted feature vector of the waybill weight to obtain the abnormal waybill prediction model.
[0067] Optionally, the second determining unit is configured to:
[0068] Remove duplicate waybill samples from the first waybill sample set to obtain the deduplicated first waybill sample set.
[0069] Randomly remove some negative samples from the first waybill sample set after deduplication to obtain the second waybill sample set, wherein the ratio of positive samples to negative samples in the second waybill sample set is a preset ratio.
[0070] Thirdly, this application provides a computer device, the computer device comprising:
[0071] One or more processors;
[0072] Memory; and
[0073] One or more applications, wherein the one or more applications are stored in the memory and configured to be executed by the processor to implement the method for detecting abnormal waybills as described in any of the first aspects.
[0074] Fourthly, this application provides a computer-readable storage medium storing a plurality of instructions adapted for loading by a processor to perform the steps in the abnormal waybill detection method described in any one of the first aspects.
[0075] This application provides a method and apparatus for detecting abnormal waybills. The method includes: acquiring multiple information on waybills to be predicted; determining multiple target matching conditions satisfied by each piece of information on waybills to be predicted based on the multiple information on waybills to be predicted and multiple preset matching conditions; determining the abnormal probability value of each piece of information on waybills to be predicted belonging to an abnormal waybill based on the multiple information on waybills to be predicted and the multiple target matching conditions satisfied by the multiple information on waybills to be predicted; and performing anomaly detection on the multiple abnormal probability values to obtain an abnormal value among the multiple abnormal probability values. In detecting abnormal waybills, this application first matches the information of the waybills to be predicted with multiple preset matching conditions to determine the target matching conditions that each piece of information of the waybills to be predicted meets. Then, based on each piece of information of the waybills to be predicted and the target matching conditions met, the abnormal probability value of each piece of information of the waybills to be predicted is determined. Compared with the prior art, which only relies on waybill information for prediction, this improves the prediction accuracy. In addition, after obtaining the abnormal probability value of each piece of information of the waybill to be predicted, this application performs anomaly detection on multiple abnormal probability values to identify abnormal waybills, which can improve the prediction recall rate, thereby improving the accuracy and recall rate of abnormal waybill detection. Attached Figure Description
[0076] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0077] Figure 1 A schematic diagram of a scenario for the abnormal waybill detection system provided in this application embodiment;
[0078] Figure 2 This is a schematic flowchart of an embodiment of the abnormal waybill detection method provided in this application;
[0079] Figure 3 This is a schematic flowchart of an embodiment of the abnormal waybill prediction model training in the abnormal waybill detection method provided in this application;
[0080] Figure 4 This is a schematic flowchart of an embodiment of the abnormal waybill detection method provided in this application;
[0081] Figure 5 This is a schematic diagram of an embodiment of the abnormal waybill detection device provided in this application.
[0082] Figure 6 This is a schematic diagram of an embodiment of the computer device provided in this application. Detailed Implementation
[0083] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.
[0084] In the description of this application, it should be understood that the terms "center," "longitudinal," "lateral," "length," "width," "thickness," "upper," "lower," "front," "rear," "left," "right," "vertical," "horizontal," "top," "bottom," "inner," and "outer," etc., indicating orientation or positional relationships based on the orientation or positional relationships shown in the accompanying drawings, are used only for the convenience of describing this application and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation, and therefore should not be construed as a limitation of this application. Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Thus, features defined with "first" and "second" may explicitly or implicitly include one or more features. In the description of this application, "a plurality of" means two or more, unless otherwise explicitly specified.
[0085] In this application, the term "exemplary" is used to mean "used as an example, illustration, or description." Any embodiment described as "exemplary" in this application is not necessarily to be construed as being more preferred or advantageous than other embodiments. The following description is provided to enable any person skilled in the art to make and use this application. Details are set forth in the following description for purposes of explanation. It should be understood that those skilled in the art will recognize that this application can be made without using these specific details. In other instances, well-known structures and processes are not described in detail to avoid obscuring the description of this application with unnecessary detail. Therefore, this application is not intended to be limited to the embodiments shown, but is consistent with the broadest scope of the principles and features disclosed in this application.
[0086] This application provides a method and apparatus for detecting abnormal waybills, which will be described in detail below.
[0087] Please see Figure 1 , Figure 1 This is a schematic diagram of a scenario for an abnormal waybill detection system provided in an embodiment of this application. The abnormal waybill detection system may include a computer device 100, which integrates an abnormal waybill detection device.
[0088] In this embodiment, the computer device 100 can be a standalone server, a server network, or a server cluster. For example, the computer device 100 described in this embodiment includes, but is not limited to, a computer, a network host, a single network server, a set of multiple network servers, or a cloud server composed of multiple servers. The cloud server is composed of a large number of computers or network servers based on cloud computing.
[0089] In this embodiment, the computer device 100 described above can be a general-purpose computer device or a special-purpose computer device. In specific implementations, the computer device 100 can be a desktop computer, a portable computer, a network server, a handheld computer (Personal Digital Assistant, PDA), a mobile phone, a tablet computer, a wireless terminal device, a communication device, an embedded device, etc. This embodiment does not limit the type of computer device 100.
[0090] Those skilled in the art will understand that Figure 1 The application environment shown is merely one application scenario of the solution in this application and does not constitute a limitation on the application scenario of the solution in this application. Other application environments may include more than one application scenario. Figure 1 The number of computer devices shown is more or less, for example Figure 1 Only one computer device is shown in the document. It is understood that the abnormal waybill detection system may also include one or more other computer devices capable of processing data, which are not specified here.
[0091] In addition, such as Figure 1 As shown, the abnormal waybill detection system may also include a memory 200 for storing data.
[0092] It should be noted that, Figure 1 The schematic diagram of the abnormal waybill detection system shown is merely an example. The abnormal waybill detection system and scenario described in this application embodiment are for the purpose of more clearly illustrating the technical solutions of this application embodiment and do not constitute a limitation on the technical solutions provided in this application embodiment. As those skilled in the art will know, with the evolution of abnormal waybill detection systems and the emergence of new business scenarios, the technical solutions provided in this application embodiment are also applicable to similar technical problems.
[0093] First, this application provides a method for detecting abnormal waybills. The method includes: acquiring multiple waybill information to be predicted; determining multiple target matching conditions satisfied by each waybill information based on the multiple waybill information to be predicted and multiple preset matching conditions; determining the abnormal probability value of each waybill information belonging to an abnormal waybill based on the multiple waybill information to be predicted and the multiple target matching conditions satisfied by each waybill information to be predicted; performing anomaly detection on the multiple abnormal probability values to obtain an abnormal value among the multiple abnormal probability values; and determining the waybill information to be predicted corresponding to the abnormal value as an abnormal waybill.
[0094] like Figure 2 As shown, Figure 2 This is a schematic flowchart of an embodiment of the abnormal waybill detection method provided in this application. The abnormal waybill detection method includes the following steps S201 to S205:
[0095] S201. Obtain information on multiple waybills to be predicted.
[0096] In this embodiment, the multiple waybills to be predicted can be waybills from one day, one hour, etc. The information of the waybills to be predicted can include waybill number, shipping time, sender's name, sender's phone number, sender's mobile phone number, recipient, recipient's phone number, recipient's mobile phone number, key origin postal outlets, etc. Preset matching conditions can be that the waybill's chargeable weight is less than a preset weight (e.g., 3kg), the waybill type is a preset type, the waybill's mode of transport is air freight, the sender or recipient of the waybill is a new user, etc.
[0097] S202. Based on multiple shipment information to be predicted and multiple preset matching conditions, determine multiple target matching conditions that each shipment information to be predicted must satisfy.
[0098] In this embodiment, the waybill information to be predicted is matched against multiple preset matching conditions to obtain multiple target matching conditions satisfied by the waybill information to be predicted. For example, the preset weight is 3kg, and the preset type is preferential type. The waybill information to be predicted is: chargeable weight 2.5kg, preferential type, automobile transport. Then the multiple target matching conditions satisfied by the waybill information to be predicted are: the chargeable weight of the waybill is less than the preset weight; the waybill type is the preset type.
[0099] S203. Based on each piece of information to be predicted and the multiple target matching conditions satisfied by each piece of information to be predicted, determine the probability value of each piece of information to be predicted belonging to an abnormal shipment.
[0100] The anomaly probability value represents the probability that each shipment to be predicted belongs to an abnormal shipment. An abnormal shipment can be a shipment containing drugs. For example, if there are 17,697 shipments to be predicted, then there are 17,697 anomaly probability values for these 17,697 shipments, forming a continuous numerical feature vector between 0 and 1, namely {0.1, 0.2, 0.9, ..., 0.2}.
[0101] To improve the accuracy of anomaly probability value calculation, in this embodiment of the application, the anomaly probability value of each to-be-predicted waybill information belonging to an abnormal waybill is determined based on each to-be-predicted waybill information and multiple target matching conditions satisfied by each to-be-predicted waybill information, which may include:
[0102] (1) Obtain the weight coefficients corresponding to each target matching condition.
[0103] In this embodiment, the weighting coefficients corresponding to each target matching condition can be set according to specific circumstances. For example, if the chargeable weight of the waybill is less than the preset weight, the weighting coefficient is 1; if the waybill type is a preset type, the weighting coefficient is 2; if the waybill's mode of transport is air freight, the weighting coefficient is 3.
[0104] (2) Encode the information of the waybill to be predicted, the multiple target matching conditions satisfied by the information of the waybill to be predicted, and the weight coefficients of the multiple target matching conditions satisfied by the information of the waybill to be predicted, respectively, to obtain the waybill feature vector, the waybill hit condition feature vector, and the waybill weight feature vector of the information of the waybill to be predicted.
[0105] (3) Input the waybill feature vector, waybill hit condition feature vector, and waybill weight feature vector of each waybill information to be predicted into the abnormal waybill prediction model to obtain the abnormal probability value of the waybill information to be predicted belonging to the abnormal waybill.
[0106] By extracting the waybill feature vector, waybill hit condition feature vector, and waybill weight feature vector of the waybill to be predicted, the features of the waybill can be reflected more accurately, thereby improving the model training effect and the model prediction accuracy.
[0107] Of course, in other embodiments, the waybill feature vector and waybill hit condition feature vector of each waybill information can also be input into the abnormal waybill prediction model to obtain the abnormal probability value of the abnormal waybill.
[0108] S204. Perform anomaly detection on multiple anomaly probability values to obtain the anomaly value among the multiple anomaly probability values.
[0109] In data mining, anomaly detection is the identification of items, events, or observations that do not match expected patterns or other items in a dataset. Anomalies are also known as outliers, novelties, noise, biases, and exceptions. Some popular anomaly detection methods include: density-based methods (nearest neighbor method, local anomaly factor, and many variations of this concept), outlier detection for high-dimensional data based on subspaces and correlations, a class of support vector machines, replicated neural networks, outlier detection based on clustering analysis, biases with association rules and frequent itemsets, and outlier detection based on fuzzy logic.
[0110] In a specific implementation, multiple anomaly probability values are input into the Isolation Forest model for anomaly detection, resulting in outliers among these probability values. In Isolation Forest (iForest), anomalies are defined as "outliers more likely to be separated," which can be understood as sparsely distributed points far from denser groups. In the feature space, sparsely distributed regions indicate a low probability of an event occurring in that region, thus data falling within these regions can be considered anomalous. Isolation Forest is an unsupervised anomaly detection method suitable for continuous numerical data, meaning it does not require labeled samples for training, but the features must be continuous. iForest employs a highly efficient strategy for identifying which points are likely to be isolated. In Isolation Forest, the dataset is recursively and randomly partitioned until all sample points are isolated. Under this random partitioning strategy, outliers typically have shorter paths.
[0111] The isolated forest model calculates anomaly scores for the waybill information to be predicted. When the anomaly score approaches 1, the waybill information is considered anomalous; when the anomaly score approaches 0.5, it is indistinguishable as anomalous; and when the anomaly score approaches 0, it is considered normal. Anomaly probabilities that meet a preset range can be defined as anomaly values. For example, the preset range is 0.9-1.
[0112] S205. Identify the waybill information corresponding to the outlier as an abnormal waybill.
[0113] Furthermore, warrants will be issued for arrests of those with unusual shipment orders.
[0114] See Figure 3 , Figure 3 This is a schematic flowchart of an embodiment of the abnormal waybill prediction model training in the abnormal waybill detection method provided in this application.
[0115] like Figure 3As shown, in a specific embodiment, the waybill feature vector, waybill hit condition feature vector, and waybill weight feature vector of each waybill information to be predicted are input into the abnormal waybill prediction model to obtain the abnormal probability value of the waybill information to be predicted belonging to an abnormal waybill. Prior to this, steps S301-S303 are included:
[0116] S301. Obtain the first waybill sample set, wherein the first waybill sample set includes positive samples with abnormal sample labels and negative samples with normal sample labels.
[0117] S302. Randomly remove some negative samples from the first waybill sample set to obtain the second waybill sample set, wherein the ratio of positive samples to negative samples in the second waybill sample set is a preset ratio.
[0118] Since there are at least 20-30 million waybill data entries daily, while the total number of abnormal waybill data entries over the past three years is only 233, this results in a severe imbalance between positive and negative samples. Therefore, stratified sampling is required for the first waybill sample set of the original data. Specifically, some negative samples are randomly removed from the first waybill sample set to obtain the second waybill sample set, where the ratio of positive to negative samples in the second waybill sample set is a preset ratio. For example, the stratified second waybill sample set contains 58,422 non-drug negative samples and 233 drug positive samples, resulting in a positive to negative sample ratio of 1:250.
[0119] Because waybill numbers may be duplicated, the original data must first be deduplicated based on the waybill number, removing waybill data with duplicate waybill numbers and matching rule data. In a specific embodiment, randomly removing a portion of negative samples from the first waybill sample set to obtain the second waybill sample set may include:
[0120] (1) Remove duplicate waybill samples from the first waybill sample set to obtain the deduplicated first waybill sample set.
[0121] Duplicate waybill samples can be waybill samples with duplicate waybill numbers.
[0122] (2) Randomly remove some negative samples from the first waybill sample set after deduplication to obtain the second waybill sample set, wherein the ratio of positive samples to negative samples in the second waybill sample set is a preset ratio.
[0123] S303. The decision forest model is trained based on the second waybill sample set to obtain the abnormal waybill prediction model.
[0124] Since the features constituted by waybill information are not completely independent but related (e.g., sender address and origin / destination branch code, recipient address and destination branch code), a self-attention mechanism is applied to leverage these coupling relationships and capture semantic and interdependent features. Self-attention directly links any two features in a single computational step, significantly reducing the distance between distantly dependent features and facilitating their efficient utilization. Furthermore, self-attention directly contributes to increasing computational parallelism.
[0125] Specifically, the decision forest model is the TensorFlow decision forest model. The TensorFlow decision forest model does not require explicitly listing or preprocessing input features (because decision forests can naturally handle both numerical and categorical attributes), specifying the architecture (e.g., by trying different layer combinations, just like in neural networks), or worrying about model divergence. Once your model is trained, you can directly plot it or analyze it with easily interpretable statistics. Since the data format input to the TensorFlow decision forest model must be in TensorFlow format, the second single-sample set is converted to the format required by the TensorFlow decision forest model using the `tfdf.keras.pd_dataframe_to_tf_dataset` function.
[0126] In one specific embodiment, the decision forest model is trained based on the second waybill sample set to obtain an abnormal waybill prediction model, which may include:
[0127] (1) Encode each waybill sample in the second waybill sample set to obtain waybill feature vector, waybill hit condition feature vector, and waybill weight feature vector.
[0128] (2) Input the waybill feature vector, waybill hit condition feature vector, and waybill weight feature vector into the self-attention model to adjust the feature weights, and obtain the weight-adjusted waybill feature vector, the weight-adjusted waybill hit condition feature vector, and the weight-adjusted waybill weight feature vector.
[0129] (3) The decision forest model is trained based on the weighted waybill feature vector, the weighted waybill hit condition feature vector, and the weighted waybill weight feature vector to obtain the abnormal waybill prediction model.
[0130] By adjusting the feature weights through Self Attention, the relationship between each feature in the order feature vector, the order hit condition feature vector, and the order weight feature vector can be reflected, thereby improving the training effect of the model.
[0131] To reduce the training and testing time of the isolated forest model, and to avoid making the isolated trees in the isolated forest model overly complex. See also Figure 4 , Figure 4 This is a schematic flowchart of an embodiment of the abnormal waybill detection method provided in this application, specifically step S204.
[0132] In this embodiment of the application, anomaly detection is performed on multiple anomaly probability values to obtain an anomaly value among the multiple anomaly probability values, including the following steps S401 to S406:
[0133] S401. Randomly select n points from multiple abnormal probability values as subsamples and put them into the root node of an initialized isolated tree.
[0134] When constructing an isolated forest, two parameters need to be set: the number of isolated trees, t, and the maximum sample size, n, for each isolated tree. The value of n is different for each of the t isolated trees in the isolated forest, and the subsamples used to construct each isolated tree are different.
[0135] S402. Randomly generate a cutting point within the current node's data range.
[0136] The cut-off point is generated between the maximum and minimum values of the current node's data. The current node is the node currently being recursively processed; for example, it is the root node at this point, and will be either the left or right child node in the next iteration.
[0137] The current node data range includes multiple anomaly probability values in the current node. For example, the current node data range is {0.8, 0.1, 0.3, 0.2}, and the cutoff point is 0.25.
[0138] S403. Divide the current node's data space into two branches based on the cutting point.
[0139] In this process, points smaller than the cut point in the currently selected dimension are designated as the left child of the current node, and points greater than or equal to the cut point are designated as the right child of the current node.
[0140] For example, {0.8,0.1,0.3,0.2} can be divided into two branches. The left child node of the left branch is {0.2,0.1}, and the right child node of the right branch is {0.3,0.8}.
[0141] S404. Determine whether the generalization index of the isolated tree after node partitioning is greater than the generalization index of the isolated tree before node partitioning.
[0142] Specifically, the generalization performance metrics of the isolated tree after node partitioning and the generalization ability metrics of the isolated tree before node partitioning are calculated on a preset test set. The preset test set includes multiple anomaly probability values and sample labels for each anomaly probability value. The sample labels include normal category and anomaly category.
[0143] In summary, generalization ability refers to the ability of a machine learning algorithm to adapt to new samples. Simply put, it involves adding new datasets to an existing dataset and training the algorithm to output a reasonable result. The goal of learning is to learn the patterns hidden behind the data. The trained network should also be able to provide appropriate outputs on data outside the learning set that exhibits the same patterns; this ability is called generalization ability.
[0144] Generalization ability metrics can include precision, accuracy, and recall. Precision is defined as the proportion of samples that are actually classified as positive. Accuracy is the number of correctly classified samples divided by the total number of samples; generally, the higher the accuracy, the better the classifier.
[0145] If the generalization index of the isolated tree after node partitioning is greater than the generalization ability index of the isolated tree before node partitioning, it indicates that further node partitioning can improve the model's generalization ability. The left and right child nodes are recursively executed to randomly generate a cutting point within the current node's data range and to divide the current node's data space into two branches based on the cutting point.
[0146] S405. Stop partitioning to obtain the target isolated tree, forming an isolated forest model.
[0147] If the generalization index of the isolated tree after node splitting is not greater than the generalization index of the isolated tree before node splitting, it means that continuing to split will lead to overfitting. Therefore, the splitting is stopped, the target isolated tree is obtained, and the isolated forest model is formed.
[0148] S406. Based on the isolated forest model, multiple target isolated trees are used to detect anomalies among multiple anomaly probability values, and the anomaly values among the multiple anomaly probability values are obtained.
[0149] Different target isolation trees are trained from different subsamples.
[0150] In a specific embodiment, multiple isolated trees based on an isolated forest model perform anomaly detection on multiple anomaly probability values to obtain anomaly values among the multiple anomaly probability values, which may include:
[0151] (1) For each anomaly probability value, the anomaly probability value is traversed through each target isolated tree in the isolated forest model, and the expected path length of the anomaly probability value in multiple target isolated trees is calculated.
[0152] (2) Determine the anomaly score based on the expected path length.
[0153] Specifically, the abnormal score is determined according to formula (1).
[0154]
[0155] Where Eh(x) is the expected path length of the anomaly probability value x in multiple isolated target trees, and s(x,n) is the anomaly score of the anomaly probability value x.
[0156] (3) The abnormal probability value corresponding to the abnormal score that meets the preset abnormal score condition is determined as the abnormal value.
[0157] When the anomaly score s(x,n) approaches 1, the waybill information to be predicted is judged as abnormal; when the anomaly score s(x,n) approaches 0.5, the waybill information to be predicted cannot be distinguished as abnormal; when the anomaly score s(x,n) approaches 0, the waybill information to be predicted is judged as normal. The anomaly probability value that satisfies a preset anomaly score condition can be defined as an anomaly value. For example, the preset anomaly score condition is an anomaly score between 0.9 and 1.
[0158] To better implement the abnormal waybill detection method in the embodiments of this application, based on the abnormal waybill detection method, the embodiments of this application also provide an abnormal waybill detection device, such as... Figure 5 As shown, the abnormal waybill detection device 500 includes:
[0159] Acquisition unit 501 is used to acquire information on multiple waybills to be predicted;
[0160] The first determining unit 502 is used to determine multiple target matching conditions that each piece of information to be predicted of the waybill satisfies based on multiple pieces of information to be predicted of the waybill and multiple preset matching conditions.
[0161] The second determining unit 503 is used to determine the abnormal probability value of each piece of information to be predicted as an abnormal shipment based on each piece of information to be predicted and multiple target matching conditions satisfied by each piece of information to be predicted.
[0162] Anomaly detection unit 504 is used to perform anomaly detection on multiple anomaly probability values and obtain anomaly values among the multiple anomaly probability values;
[0163] The third determining unit 505 is used to determine the waybill information to be predicted corresponding to the outlier as an abnormal waybill.
[0164] Optionally, the anomaly detection unit 504 is used for:
[0165] Randomly select n points from multiple anomaly probability values as subsamples and put them into the root node of an initialized isolated tree;
[0166] A cut point is randomly generated within the current node's data range, where the cut point is generated between the maximum and minimum values of the current node's data.
[0167] The data space of the current node is divided into two branches based on the cut point. Points in the currently selected dimension that are less than the cut point are taken as the left child nodes of the current node, and points that are greater than or equal to the cut point are taken as the right child nodes of the current node.
[0168] Determine whether the generalization index of the isolated tree after node partitioning is greater than the generalization index of the isolated tree before node partitioning.
[0169] If yes, then recursively execute the following steps for the left and right child nodes: randomly generate a cutting point within the current node's data range and divide the current node's data space into two branches based on the cutting point; if no, then stop the division, obtain the target isolated tree, and form an isolated forest model.
[0170] Anomaly detection is performed on multiple target isolation trees based on the isolation forest model, which are used to obtain the outlier values among the multiple anomaly probability values. Different target isolation trees are trained from different subsamples.
[0171] Optionally, the anomaly detection unit 504 is used for:
[0172] For each anomaly probability value, the anomaly probability value is traversed through each target isolated tree in the isolated forest model, and the expected path length of the anomaly probability value across multiple target isolated trees is calculated.
[0173] Determine the anomaly score based on the expected path length;
[0174] The abnormal probability value corresponding to the abnormal score that meets the preset abnormal score condition is determined as an abnormal value.
[0175] Optionally, the second determining unit 503 is used for:
[0176] Obtain the weight coefficients corresponding to each target matching condition;
[0177] Encode the order information to be predicted, the multiple target matching conditions satisfied by the order information to be predicted, and the weight coefficients of the multiple target matching conditions satisfied by the order information to be predicted, respectively, to obtain the order feature vector, the order hit condition feature vector, and the order weight feature vector of the order information to be predicted.
[0178] Input the waybill feature vector, waybill hit condition feature vector, and waybill weight feature vector of each waybill information to be predicted into the abnormal waybill prediction model to obtain the abnormal probability value of the waybill information to be predicted belonging to an abnormal waybill.
[0179] Optionally, the second determining unit 503 is used for:
[0180] Obtain the first waybill sample set, which includes positive samples with abnormal labels and negative samples with normal labels;
[0181] Randomly remove some negative samples from the first waybill sample set to obtain the second waybill sample set, wherein the ratio of positive samples to negative samples in the second waybill sample set is a preset ratio.
[0182] The decision forest model was trained based on the second shipment sample set to obtain an abnormal shipment prediction model.
[0183] Optionally, the second determining unit 503 is used for:
[0184] Encode each waybill sample in the second waybill sample set to obtain waybill feature vector, waybill hit condition feature vector, and waybill weight feature vector;
[0185] Input the waybill feature vector, waybill hit condition feature vector, and waybill weight feature vector into the self-attention model to adjust the feature weights, and obtain the weight-adjusted waybill feature vector, the weight-adjusted waybill hit condition feature vector, and the weight-adjusted waybill weight feature vector.
[0186] The decision forest model is trained based on the weighted feature vector of the waybill, the weighted feature vector of the waybill hit condition, and the weighted feature vector of the waybill weight to obtain the abnormal waybill prediction model.
[0187] Optionally, the second determining unit 503 is used for:
[0188] Remove duplicate waybill samples from the first waybill sample set to obtain the deduplicated first waybill sample set.
[0189] Randomly remove some negative samples from the first waybill sample set after deduplication to obtain the second waybill sample set, wherein the ratio of positive samples to negative samples in the second waybill sample set is a preset ratio.
[0190] This application also provides a computer device that integrates any of the abnormal waybill detection devices provided in this application. The computer device includes:
[0191] One or more processors;
[0192] Memory; and
[0193] One or more applications, wherein the applications are stored in memory and configured to be executed by a processor as steps of the abnormal waybill detection method in any of the embodiments described above.
[0194] like Figure 6 As shown, it illustrates a structural schematic diagram of the computer device involved in the embodiments of this application, specifically:
[0195] The computer device may include components such as a processor 601 with one or more processing cores, a memory 602 with one or more computer-readable storage media, a power supply 603, and an input unit 604. Those skilled in the art will understand that the computer device structure shown in the figures does not constitute a limitation on the computer device, and may include more or fewer components than shown, or combine certain components, or have different component arrangements. Wherein:
[0196] Processor 601 is the control center of the computer device. It connects various parts of the computer device via various interfaces and lines, and performs various functions and processes data by running or executing software programs and / or modules stored in memory 602, and by calling data stored in memory 602, thereby providing overall monitoring of the computer device. Optionally, processor 601 may include one or more processing cores; processor 601 may be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor. Preferably, processor 601 may integrate an application processor and a modem processor, wherein the application processor mainly handles the operating system, user interface, and applications, and the modem processor mainly handles wireless communication. It is understood that the aforementioned modem processor may not be integrated into processor 601.
[0197] The memory 602 can be used to store software programs and modules. The processor 601 executes various functional applications and data processing by running the software programs and modules stored in the memory 602. The memory 602 may mainly include a program storage area and a data storage area. The program storage area may store the operating system, application programs required for at least one function (such as sound playback function, image playback function, etc.), etc.; the data storage area may store data created according to the use of the computer device, etc. In addition, the memory 602 may include high-speed random access memory, and may also include non-volatile memory, such as at least one disk storage device, flash memory device, or other volatile solid-state storage device. Accordingly, the memory 602 may also include a memory controller to provide the processor 601 with access to the memory 602.
[0198] The computer device also includes a power supply 603 that supplies power to the various components. Preferably, the power supply 603 can be logically connected to the processor 601 through a power management system, thereby enabling functions such as charging, discharging, and power consumption management through the power management system. The power supply 603 may also include one or more DC or AC power supplies, recharging systems, power fault detection circuits, power converters or inverters, power status indicators, and other arbitrary components.
[0199] The computer device may also include an input unit 604, which can be used to receive input digital or character information and generate keyboard, mouse, joystick, optical or trackball signal inputs related to user settings and function control.
[0200] Although not shown, the computer device may also include a display unit, etc., which will not be described in detail here. Specifically, in this embodiment, the processor 601 in the computer device loads the executable files corresponding to the processes of one or more application programs into the memory 602 according to the following instructions, and the processor 601 runs the application programs stored in the memory 602 to realize various functions, as follows:
[0201] Obtain information on multiple waybills to be predicted;
[0202] Based on multiple shipment information to be predicted and multiple preset matching conditions, determine multiple target matching conditions that each shipment information to be predicted must satisfy.
[0203] Based on the information of each waybill to be predicted and the multiple target matching conditions satisfied by each waybill to be predicted, the probability value of each waybill to be predicted belonging to an abnormal waybill is determined.
[0204] Anomaly detection is performed on multiple anomaly probability values to identify the outliers among them.
[0205] The waybill information corresponding to the outlier is identified as an abnormal waybill.
[0206] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be performed by instructions, or by instructions controlling related hardware. These instructions can be stored in a computer-readable storage medium and loaded and executed by a processor.
[0207] Therefore, embodiments of this application provide a computer-readable storage medium, which may include: read-only memory (ROM), random access memory (RAM), a disk, or an optical disk, etc. A computer program is stored thereon, and the computer program is loaded by a processor to execute the steps in any of the abnormal waybill detection methods provided in embodiments of this application. For example, the computer program loaded by the processor can execute the following steps:
[0208] Obtain information on multiple waybills to be predicted;
[0209] Based on multiple shipment information to be predicted and multiple preset matching conditions, determine multiple target matching conditions that each shipment information to be predicted must satisfy.
[0210] Based on the information of each waybill to be predicted and the multiple target matching conditions satisfied by each waybill to be predicted, the probability value of each waybill to be predicted belonging to an abnormal waybill is determined.
[0211] Anomaly detection is performed on multiple anomaly probability values to identify the outliers among them.
[0212] The waybill information corresponding to the outlier is identified as an abnormal waybill.
[0213] In the above embodiments, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the detailed descriptions of other embodiments above, which will not be repeated here.
[0214] In practice, each of the above units or structures can be implemented as an independent entity or can be arbitrarily combined to be implemented as the same or several entities. For the specific implementation of each of the above units or structures, please refer to the previous method embodiments, which will not be repeated here.
[0215] For details on the implementation of each of the above operations, please refer to the previous examples, which will not be repeated here.
[0216] The above provides a detailed description of the method and apparatus for detecting abnormal waybills provided in the embodiments of this application. Specific examples have been used to illustrate the principles and implementation methods of this application. The description of the above embodiments is only for the purpose of helping to understand the method and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.
Claims
1. A method for detecting abnormal waybills, characterized in that, The method for detecting abnormal waybills includes: Obtain information on multiple waybills to be predicted; Based on the multiple shipment information to be predicted and multiple preset matching conditions, determine multiple target matching conditions that each shipment information to be predicted must satisfy. Based on each of the predicted waybill information and the multiple target matching conditions satisfied by each of the predicted waybill information, the abnormal probability value of each of the predicted waybill information belonging to an abnormal waybill is determined. Anomaly detection is performed on the multiple anomaly probability values to obtain the anomaly value among the multiple anomaly probability values; The waybill information corresponding to the outlier value is identified as an abnormal waybill. The step of performing anomaly detection on multiple anomaly probability values to obtain anomaly values among the multiple anomaly probability values includes: Randomly select n points from the multiple abnormal probability values as subsamples and put them into the root node of an initialized isolated tree; A cut point is randomly generated within the current node's data range, where the cut point is generated between the maximum and minimum values of the current node's data. Based on the cutting point, the data space of the current node is divided into two branches. Points smaller than the cutting point in the currently selected dimension are taken as the left child nodes of the current node, and points greater than or equal to the cutting point are taken as the right child nodes of the current node. Determine whether the generalization index of the isolated tree after node partitioning is greater than the generalization index of the isolated tree before node partitioning. If yes, then recursively execute the process of randomly generating a cutting point within the current node's data range and dividing the current node's data space into two branches based on the cutting point for the left and right child nodes respectively; if no, then stop the division, obtain the target isolated tree, and form an isolated forest model. Anomaly detection is performed on multiple target isolated trees based on the isolated forest model to obtain anomaly values among the multiple anomaly probability values, wherein different target isolated trees are trained from different subsamples.
2. The method for detecting abnormal waybills according to claim 1, characterized in that, The isolated trees based on the isolated forest model perform anomaly detection on multiple anomaly probability values to obtain anomaly values among the multiple anomaly probability values, including: For each of the above anomaly probability values, the anomaly probability value is traversed through each target isolated tree in the isolated forest model, and the expected path length of the anomaly probability value in multiple target isolated trees is calculated. Anomaly scores are determined based on the expected path length. The abnormal probability value corresponding to the abnormal score that meets the preset abnormal score condition is determined as an abnormal value.
3. The method for detecting abnormal waybills according to claim 1, characterized in that, The step of determining the probability value of each piece of information to be predicted as an abnormal shipment based on each piece of information to be predicted and multiple target matching conditions satisfied by each piece of information to be predicted includes: Obtain the weight coefficients corresponding to each of the target matching conditions; The waybill information to be predicted, the multiple target matching conditions satisfied by the waybill information to be predicted, and the weight coefficients of the multiple target matching conditions satisfied by the waybill information to be predicted are encoded respectively to obtain the waybill feature vector, waybill hit condition feature vector, and waybill weight feature vector of the waybill information to be predicted. Input the waybill feature vector, waybill hit condition feature vector, and waybill weight feature vector of each waybill information to be predicted into the abnormal waybill prediction model to obtain the abnormal probability value of the waybill information to be predicted belonging to an abnormal waybill.
4. The method for detecting abnormal waybills according to claim 3, characterized in that, The step of inputting the waybill feature vector, waybill hit condition feature vector, and waybill weight feature vector of each waybill to be predicted information into the abnormal waybill prediction model to obtain the abnormal probability value of the waybill to be predicted information belonging to an abnormal waybill includes: Obtain a first waybill sample set, wherein the first waybill sample set includes positive samples with abnormal sample labels and negative samples with normal sample labels; Randomly remove some negative samples from the first waybill sample set to obtain a second waybill sample set, wherein the ratio of positive samples to negative samples in the second waybill sample set is a preset ratio. The decision forest model is trained based on the second waybill sample set to obtain an abnormal waybill prediction model.
5. The method for detecting abnormal waybills according to claim 4, characterized in that, The step of training the decision forest model based on the second waybill sample set to obtain an abnormal waybill prediction model includes: Encode each waybill sample in the second waybill sample set to obtain waybill feature vector, waybill hit condition feature vector, and waybill weight feature vector; Input the waybill feature vector, waybill hit condition feature vector, and waybill weight feature vector into the self-attention model to adjust the feature weights, and obtain the weight-adjusted waybill feature vector, the weight-adjusted waybill hit condition feature vector, and the weight-adjusted waybill weight feature vector. The decision forest model is trained based on the weighted feature vector of the waybill, the weighted feature vector of the waybill hit condition, and the weighted feature vector of the waybill weight to obtain the abnormal waybill prediction model.
6. The method for detecting abnormal waybills according to claim 4, characterized in that, The process of randomly removing a portion of negative samples from the first waybill sample set to obtain the second waybill sample set includes: Remove duplicate waybill samples from the first waybill sample set to obtain the deduplicated first waybill sample set. Randomly remove some negative samples from the first waybill sample set after deduplication to obtain the second waybill sample set, wherein the ratio of positive samples to negative samples in the second waybill sample set is a preset ratio.
7. A device for detecting abnormal waybills, characterized in that, The detection device for the abnormal waybill includes: The acquisition unit is used to acquire information on multiple waybills to be predicted. The first determining unit is used to determine multiple target matching conditions satisfied by each of the multiple shipment information to be predicted based on the multiple shipment information to be predicted and multiple preset matching conditions. The second determining unit is used to determine the abnormal probability value of each of the predicted waybill information as an abnormal waybill based on each of the waybill information to be predicted and multiple target matching conditions satisfied by each of the waybill information to be predicted. An anomaly detection unit is used to perform anomaly detection on a plurality of the anomaly probability values and obtain an anomaly value among the plurality of the anomaly probability values; The third determining unit is used to determine the waybill information to be predicted corresponding to the abnormal value as an abnormal waybill. Anomaly detection unit, used for: Randomly select n points from multiple anomaly probability values as subsamples and put them into the root node of an initialized isolated tree; A cut point is randomly generated within the current node's data range, where the cut point is generated between the maximum and minimum values of the current node's data. The data space of the current node is divided into two branches based on the cut point. Points in the currently selected dimension that are less than the cut point are taken as the left child nodes of the current node, and points that are greater than or equal to the cut point are taken as the right child nodes of the current node. Determine whether the generalization index of the isolated tree after node partitioning is greater than the generalization index of the isolated tree before node partitioning. If yes, then recursively execute the following steps for the left and right child nodes: randomly generate a cutting point within the current node's data range and divide the current node's data space into two branches based on the cutting point; if no, then stop the division, obtain the target isolated tree, and form an isolated forest model. Anomaly detection is performed on multiple target isolation trees based on the isolation forest model, which are used to obtain the outlier values among the multiple anomaly probability values. Different target isolation trees are trained from different subsamples.
8. A computer device, characterized in that, The computer device includes: One or more processors; Memory; and One or more applications, wherein the one or more applications are stored in the memory and configured to be executed by the processor to implement the method for detecting abnormal waybills as described in any one of claims 1 to 6.
9. A computer-readable storage medium, characterized in that, It stores a computer program, which is loaded by a processor to execute the steps of the abnormal waybill detection method according to any one of claims 1 to 6.