Conference anomaly detection method and electronic device

Abstract

The disclosure discloses a conference anomaly detection method and an electronic device. The method comprises: in response to a conference attendance signal, obtaining account information of a conference attendance account; the account information comprises: daily average conference attendance duration, monthly average conference attendance frequency, and enterprise authentication information; if the account information satisfies an account anomaly condition, it is determined that there is a conference anomaly, and the conference anomaly is a conference attendance account anomaly; the account anomaly condition comprises: the monthly average conference attendance frequency of the conference attendance account is greater than a monthly average frequency threshold, the conference attendance account has not passed enterprise authentication, and the daily average conference attendance duration of the conference attendance account is greater than a daily average duration threshold. The method disclosed by the disclosure can match the conference attendance demand and the conference attendance behavior of the conference attendance account through information such as enterprise authentication, monthly average conference attendance frequency, and daily average conference attendance duration, thereby identifying abnormal accounts whose conference attendance demand and conference attendance behavior do not match, and achieving conference anomaly detection for abnormal accounts.

Description

Technical Field

[0001] This disclosure generally relates to the field of computer communication technology. More specifically, this disclosure relates to a method and electronic device for detecting conference anomalies. Background Technology

[0002] In the field of multimedia communication technology, video conferencing is widely used, providing reliable technical support for information exchange across various industries. A video conference refers to a meeting where people in two or more locations conduct face-to-face conversations through communication equipment and networks. Depending on the number of participating locations, video conferences can be divided into point-to-point conferences and multipoint conferences.

[0003] Video conferencing differs from in-person meetings because the terminals are often located in different places, making it difficult to identify or authenticate each participant. Furthermore, video conferencing supports multiple login modes, such as allowing participants to join anonymously, or joining via invitation codes or shared links, further increasing the management complexity of video conferencing.

[0004] Most current video conferencing software only detects anomalies in the network environment, without any anomaly detection functionality for the video conferencing itself. Some existing software only sends a notification to the meeting initiator when a new participant joins, indicating that a new user has joined; it cannot detect abnormal account access or other meeting anomalies.

[0005] In view of this, there is an urgent need to provide a meeting anomaly detection solution in order to effectively identify meeting anomalies such as abnormal account access, thereby improving the management of video conferencing. Summary of the Invention

[0006] In order to address at least one or more of the technical issues mentioned above, this disclosure proposes a meeting anomaly detection scheme in several aspects.

[0007] In the first aspect, this disclosure provides a method for detecting meeting anomalies, including: in response to a meeting participation signal, obtaining the account information of the participating account; the account information includes: average daily meeting duration, average monthly number of meetings attended, and enterprise authentication information; if the account information meets the account anomaly conditions, it is determined that there is a meeting anomaly, and the meeting anomaly is a participating account anomaly; the account anomaly conditions include: the average monthly number of meetings attended by the participating account is greater than the average monthly number of meetings threshold, the participating account has not passed enterprise authentication, and the average daily meeting duration of the participating account is greater than the average daily duration threshold.

[0008] In some embodiments, the meeting anomaly further includes: meeting topic anomaly; the meeting anomaly detection method further includes: obtaining meeting keywords; if the meeting keywords include preset abnormal keywords, then it is determined that there is a meeting anomaly, and the meeting anomaly is a meeting topic anomaly.

[0009] In some embodiments, the average daily participation time threshold is calculated through the following steps: obtaining the historical average daily participation time of all accounts; determining the average daily participation time threshold based on the historical average daily participation time of all accounts, specifically including: taking the average of the historical average daily participation time of all accounts as the average daily participation time threshold; or taking the historical average daily participation time with the highest frequency among the historical average daily participation times of all accounts as the average daily participation time threshold; or sorting the historical average daily participation time of all accounts from highest to lowest frequency, determining the historical average daily participation time in the top N% of the sorted data, and using its average value as the average daily participation time threshold, where N > 0.

[0010] In some embodiments, the average monthly session threshold is calculated by the following steps: obtaining the historical average monthly session attendance of all accounts; determining the average monthly session threshold based on the historical average monthly session attendance of all accounts. This step specifically includes: taking the average of the historical average monthly session attendance of all accounts as the average monthly session threshold; or sorting the historical average monthly session attendance of all accounts from largest to smallest, and taking the historical average monthly session attendance at the first M quantile as the average monthly session threshold, where M > 1.

[0011] In some embodiments, the abnormal account conditions, where the average daily participation time of the participating account exceeds the average daily participation time threshold, include: the proportion of the overtime portion to the average daily participation time threshold being greater than or equal to Q%, and 30 < Q < 60; wherein, the overtime portion is the portion of the average daily participation time of the participating account that exceeds the average daily participation time threshold.

[0012] In some embodiments, meeting keywords include: repeated keywords, compound keywords, and meeting topics; obtaining meeting keywords includes: collecting meeting record fields and meeting topics; taking S meeting record fields and concatenating them to obtain compound keywords, where S>1; traversing the meeting record fields, and if the number of repetitions of a meeting record field reaches a preset repetition threshold, then the meeting record field is used as a repeated keyword.

[0013] In some embodiments, obtaining meeting keywords includes: obtaining meeting keywords in response to a meeting end signal; and after determining that there is a meeting anomaly, it further includes: marking the account of the meeting initiator as an abnormal account.

[0014] In some embodiments, obtaining meeting keywords includes: obtaining meeting keywords in real time; if the meeting keywords include preset abnormal keywords, then it is determined that there is a meeting abnormality, and the meeting abnormality is a meeting topic abnormality, including: determining whether the meeting keywords obtained in real time belong to preset abnormal keywords; if so, then forcibly ending the meeting and determining that there is a meeting abnormality, and the meeting abnormality is a meeting topic abnormality.

[0015] In some embodiments, after obtaining the account information of the participating account, the method further includes: if the account information of the participating account meets the abnormal account conditions, then marking the participating account as an abnormal account; traversing the historical meeting keywords of the abnormal account; if the historical meeting keywords of the abnormal account include preset abnormal keywords, then banning the abnormal account.

[0016] In a second aspect, this disclosure provides an electronic device including: a processor; and a memory having executable code stored thereon, which, when executed by the processor, causes the processor to perform the method as described in any of the first aspects.

[0017] The meeting anomaly detection method described above identifies participating accounts by recognizing their account information and determining whether they meet the anomaly criteria, thereby identifying any meeting anomalies. Compared to everyday life, video conferencing is more frequently used in work settings. Since legitimate company accounts are typically verified, when an account's average monthly number of meetings exceeds a certain threshold (indicating it's an active account), its daily average meeting duration is excessively long, suggesting high participation rates. However, the lack of company verification indicates weak participation needs. Therefore, accounts meeting the anomaly criteria are identified as having mismatched participation behavior and needs, indicating anomalies. The method provided in this disclosure effectively identifies anomalous accounts with mismatched participation behavior and needs, achieving meeting anomaly detection and improving video conferencing management. Attached Figure Description

[0018] The above and other objects, features, and advantages of exemplary embodiments of this disclosure will become readily apparent upon reading the following detailed description with reference to the accompanying drawings. In the drawings, several embodiments of this disclosure are illustrated by way of example and not limitation, and like or corresponding reference numerals denote like or corresponding parts, wherein:

[0019] Figure 1 An exemplary flowchart of a meeting anomaly detection method according to some embodiments of this disclosure is shown;

[0020] Figure 2 An exemplary flowchart illustrating a method for calculating the average daily duration threshold according to some embodiments of this disclosure is shown;

[0021] Figure 3 An exemplary flowchart illustrating a method for calculating the average monthly number of sessions threshold according to some embodiments of this disclosure is shown;

[0022] Figure 4 This disclosure illustrates a method for detecting anomalies in meeting agenda items, representing some embodiments of the present disclosure.

[0023] Figure 5An exemplary flowchart of a meeting anomaly detection method according to other embodiments of this disclosure is shown;

[0024] Figure 6 An exemplary structural block diagram of an electronic device according to an embodiment of this disclosure is shown. Detailed Implementation

[0025] The technical solutions in the embodiments of this disclosure will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this disclosure, and not all of them. Based on the embodiments in this disclosure, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this disclosure.

[0026] It should be understood that the terms “comprising” and “including” used in this disclosure and claims indicate the presence of the described features, integrals, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or collections thereof.

[0027] It should also be understood that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the scope of this disclosure. As used in this disclosure and claims, the singular forms “a,” “an,” and “the” are intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used in this disclosure and claims refers to any combination and all possible combinations of one or more of the associated listed items, and includes such combinations.

[0028] As used in this specification and claims, the term "if" may be interpreted, depending on the context, as "when," "once," "in response to determination," or "in response to detection." Similarly, the phrase "if determined" or "if [described condition or event] is detected" may be interpreted, depending on the context, as "once determined," "in response to determination," "once [described condition or event] is detected," or "in response to detection of [described condition or event]."

[0029] The specific embodiments disclosed herein will now be described in detail with reference to the accompanying drawings.

[0030] Exemplary application scenarios

[0031] Video conferencing differs from in-person meetings in that it is distributed, with terminals often located in different places, making it difficult to identify or authenticate each participant. In particular, video conferencing supports multiple login modes, such as anonymous login or shared login, which, while facilitating meetings to some extent, also increases the risk of unauthorized account access or fraudulent meeting execution.

[0032] Most current video conferencing software only detects anomalies in the network environment, without addressing the anomaly detection within the video conferencing itself. Other software with account detection features only sends a notification to the meeting initiator when a new account joins, failing to effectively detect abnormal account access or other meeting anomalies.

[0033] Exemplary solution

[0034] In view of this, the present disclosure provides a meeting anomaly detection scheme, which matches the meeting needs and behaviors of participating accounts through multiple aspects such as enterprise authentication, average monthly number of meetings attended, and average daily meeting duration, thereby identifying abnormal accounts whose meeting needs and behaviors do not match, and realizing meeting anomaly detection for abnormal accounts.

[0035] Figure 1 An exemplary flowchart of a meeting anomaly detection method according to some embodiments of this disclosure is shown.

[0036] like Figure 1 As shown, in step S101, in response to the meeting participation signal, the account information of the meeting participants is obtained.

[0037] In this disclosed embodiment, the account information of the participating account includes: average daily participation time, average monthly number of participating sessions, and enterprise authentication information.

[0038] The average daily participation time refers to the average daily participation time of the participating account. This average can be obtained by dividing the total historical participation time of the participating account by the number of days since the account was created; or it can be obtained by selecting the daily participation time of a specific period in historical data and averaging it, such as the daily participation time of the two months prior to the meeting date.

[0039] Average monthly meeting attendance refers to the average number of meetings that the account participates in each month. Similar to average daily meeting duration, this average can also be obtained by dividing the total number of meetings the account has participated in by the account by the month the account was created; or, it can be obtained by selecting the number of meetings participated in each month for a specific period in historical data and averaging them, such as the number of meetings participated in each month of the previous year in the month of the current meeting.

[0040] It should be noted that the meeting attendance duration in this disclosure is measured on a daily basis, while the number of meetings attended is measured on a monthly basis. This is based on the following considerations: Since a day's duration is limited to 24 hours, accounts with longer attendance durations may actually have fewer meetings attended per day. Therefore, using daily average meeting attendance to evaluate an account's participation behavior can easily lead to bias. However, because active accounts have a high frequency of participation—for example, an active account might be attending meetings on 4 / 5 of the days in a month—even if an active account has a long daily attendance duration, its monthly average number of meetings attended will still be quite high. Based on the above analysis, it can be concluded that using both daily average attendance duration and monthly average number of meetings attended can provide a relatively accurate assessment of an account's participation behavior.

[0041] Enterprise verification information reflects whether a participating account has passed enterprise verification. In practice, video conferencing is used more frequently in work settings than in personal life, and legitimate company accounts are usually required to be verified. Therefore, enterprise verification information can not only filter out accounts that do not have a strong need to participate in meetings, but also filter out accounts from non-legitimate companies.

[0042] In step S102, if the account information meets the account abnormality conditions, it is determined that there is a meeting abnormality.

[0043] In this disclosed embodiment, abnormal account conditions include: the average number of sessions attended by the participating account per month is greater than the average number of sessions per month threshold, the participating account has not passed enterprise certification, and the average daily participation time of the participating account is greater than the average daily duration threshold.

[0044] In this disclosed embodiment, if the account information meets the account abnormality conditions, the abnormality type of the meeting can be identified as an abnormal participating account.

[0045] It should be noted that in practical applications, we can first determine whether the participating account has passed enterprise certification based on the enterprise certification information. If it has not passed, we can directly identify the participating account as abnormal and output the detection result of meeting abnormality. If the participating account has passed enterprise certification, we can then calculate the average number of meetings attended per month and the average daily meeting duration of the participating account.

[0046] Furthermore, in some embodiments, if the account information of a participating account meets the above-mentioned abnormal account conditions, the participating account can also be marked as an abnormal account so that it can be efficiently identified when the participating account participates in other meetings.

[0047] In this disclosed embodiment, when the average monthly number of meetings attended by a participating account exceeds the monthly average number of meetings threshold, the account can be considered an active account. If its average daily meeting duration is too long, it indicates that the participating account has a high participation rate, or that the account's participation behavior is frequent. However, if the participating account has not passed enterprise verification, it indicates that the participating account reflects a weak participation demand. In this case, the mismatch between participation behavior and participation demand indicates an anomaly. Taking a practical application scenario as an example, suppose a participating account has not been verified by an enterprise, indicating that it does not belong to a legitimate company. However, if it generates a large number of participation behaviors, the participating account is more likely to be a fraudulent account. The method shown in this disclosed embodiment can perform corresponding anomaly detection and thus complete risk warning.

[0048] In some embodiments, the average daily participation time of the participating account mentioned in the above account abnormality conditions is greater than the average daily duration threshold, which can be further set as follows: the proportion of the overtime portion to the average daily duration threshold is greater than or equal to Q%, where 30 < Q < 60, and the overtime portion is the portion of the average daily participation time of the participating account that exceeds the average daily duration threshold.

[0049] In other words, a timeout percentage can be set. Only when the average daily participation time of a participating account exceeds the daily average participation time threshold by the aforementioned timeout percentage will the participating account be deemed to meet one of the account abnormality conditions. Taking Q as 50 as an example, the condition that the average daily participation time of a participating account exceeds the daily average participation time threshold can be replaced with: the average daily participation time of a participating account exceeds 1.5 times the daily average participation time threshold.

[0050] Furthermore, the daily average duration threshold in the context of this disclosure can be obtained through... Figure 2 The method shown is used to determine this. Figure 2 An exemplary flowchart illustrating a method for calculating the average daily duration threshold according to some embodiments of this disclosure is shown.

[0051] like Figure 2 As shown, in step S201, the historical average number of sessions attended by all accounts is obtained.

[0052] In step S202, the monthly average number of sessions threshold is determined based on the historical monthly average number of sessions attended by all accounts.

[0053] In some embodiments, step S202 can be performed as follows: take the average of the historical daily average meeting duration of all accounts as the daily average duration threshold. Taking accounts A1 to A5 as an example, assuming that the historical daily average meeting duration of accounts A1 to A5 is 2h, 4h, 6h, 4h, and 9h respectively, then according to the method of this embodiment, the daily average duration threshold can be determined as (2h+4h+6h+4h+9h) / 5=3h.

[0054] In other embodiments, step S202 can also be performed as follows: Take the historical average daily participation time of all accounts, with the highest frequency, as the daily average participation time threshold. Taking accounts A1 to A5 as examples, according to this embodiment, the daily average participation time threshold can be determined to be 4 hours.

[0055] In some other embodiments, step S202 can also be performed as follows: Sort the historical average daily meeting duration of all accounts from highest to lowest frequency, determine the historical average daily meeting duration of the top N% of accounts, and use their average value as the daily average duration threshold, where N > 0. Taking accounts A1 to A5 as an example, according to this embodiment, after sorting the historical average daily meeting duration of accounts A1 to A5 from highest to lowest frequency, the array {4h, 2h, 6h, 9h} is obtained. Assuming N is 25, the daily average duration threshold can be determined as 4h * 2 / 2 = 4h.

[0056] It should be noted that the calculation methods used above for the average daily duration threshold are only some examples in this disclosure. In actual application, there are other calculation methods applicable to this disclosure, which will not be elaborated here. The above calculation methods do not constitute the only limitation of this disclosure.

[0057] In addition, this disclosure also provides, as Figure 3 The method for calculating the monthly average number of sessions threshold shown is applicable to any embodiment in the context of this disclosure.

[0058] Figure 3 An exemplary flowchart illustrating a method for calculating the average monthly number of sessions threshold according to some embodiments of this disclosure is shown.

[0059] like Figure 3 As shown, in step S301, the historical average number of sessions attended by all accounts is obtained.

[0060] In step S302, the monthly average number of sessions threshold is determined based on the historical monthly average number of sessions attended by all accounts.

[0061] In some embodiments, step S302 can be performed as follows: take the average of the historical monthly average number of sessions attended by all accounts as the monthly average number of sessions threshold. Taking accounts A1 to A5 as an example, assuming that the historical monthly average number of sessions attended by accounts A1 to A5 are 10, 15, 25, 25, and 30 respectively, then according to the method in this embodiment, the monthly average number of sessions threshold can be determined as (10+15+25+25+30) / 5 = 21.

[0062] In other embodiments, step S302 can also be performed as follows: after sorting all accounts by the historical average number of sessions attended in descending order, take the historical average number of sessions attended at the first M quantile as the monthly average session threshold, where M > 1.

[0063] It's important to note that quantiles are numerical points that divide the probability distribution range of a random variable into several equal parts. Common examples include the median (i.e., quartiles), quartiles, and percentiles. Taking quartiles as an example, they are further divided into the first quartile, second quartile, third quartile, and fourth quartile. The first quartile, also known as the smaller quartile, is the number at the 25th percentile when all values ​​in the sample are arranged in order; the second quartile, also known as the median, is the number at the 50th percentile when all values ​​in the sample are arranged in order; and the third quartile, also known as the larger quartile, is the number at the 75th percentile when all values ​​in the sample are arranged in order.

[0064] Taking accounts A1 to A5 as an example, assuming M is 4, the historical average number of sessions attended per month after sorting from largest to smallest are 30, 25, 25, 15, and 10. The first quartile is the number 25, which is located at the 25th percentile, meaning the threshold for the average number of sessions per month is 25.

[0065] In practical applications, since the historical monthly average number of meetings attended by all accounts is discrete data, there may be cases where there is no corresponding number at the first M quantile. In such cases, we can find the number closest to that position as the result. Alternatively, we can perform a proportional conversion based on the closest numbers on either side of that position, using the following formula: Where 'a' represents the digit closest to the left of the first M quantile, and 'm' represents the digit closest to the left of the first M quantile. a Let 'a' represent the proportion corresponding to the position of 'a', 'b' represent the closest number to the right of the first M quantile, and 'm' represent the proportion of 'a'. b Let 'b' represent the proportion corresponding to the position of 'b', and 'm' represent the proportion corresponding to the position of the first M-quantile. For example, if we are using M=5 for accounts A1 to A5, then the first quintile is located between the numbers 30 and 25. In this case, we can calculate the number at the 20th percentile based on the proportion. That is, the monthly average number of sessions threshold is 26.

[0066] It should be noted that the calculation method used above for the average number of meetings attended per month is only a partial example in this disclosure. In actual application, there are other calculation methods applicable to this disclosure, which will not be elaborated here. The above calculation method does not constitute the only limitation on this disclosure.

[0067] It should be further noted that in practical applications, since the average daily participation time of active accounts is generally greater than that of ordinary accounts, using the average daily participation time of all accounts as the evaluation criterion may lead to too many active accounts being identified as abnormal accounts. Therefore, to prevent active accounts from being easily misjudged as abnormal accounts, in some embodiments, "all accounts" can refer to all active accounts when calculating the average daily participation time. That is to say, when calculating the average daily participation time threshold, the threshold can be determined based on the historical average daily participation time of all active accounts, where active accounts refer to accounts with an average monthly number of sessions exceeding a preset value. Furthermore, this preset value can be consistent with the average monthly number of sessions threshold.

[0068] In addition to the meeting account abnormality described above, the meeting abnormalities disclosed herein may also include meeting topic abnormalities.

[0069] Figure 4 This disclosure illustrates a method for detecting anomalies in meeting topics, representing some embodiments of which are shown.

[0070] like Figure 4 As shown, in step S401, the meeting keywords are obtained.

[0071] In some embodiments, meeting keywords include: repeated keywords, compound keywords, and meeting themes.

[0072] The meeting topic is the information that the meeting initiator uploads to the system when initiating the meeting to use as the meeting link.

[0073] Repeating keywords are words or phrases that appear repeatedly during the meeting. In some embodiments, the methods for capturing words or phrases may include, but are not limited to, speech recognition and / or character recognition.

[0074] Compound keywords are phrases generated by the system after combining and splicing multiple words or phrases.

[0075] In practical application, the execution process of step S401 is as follows: collect meeting record fields and meeting topic; take S meeting record fields and concatenate them to obtain compound keywords, S>1; traverse the meeting record fields, and if the number of repetitions of the meeting record field reaches the preset repetition threshold, then the meeting record field is used as the repetition keyword.

[0076] It should be noted that the meeting record field refers to the words or phrases captured by the system during the meeting process. When performing field concatenation, two or more meeting record fields can be concatenated, and the concatenation order and number of fields are not limited in this embodiment.

[0077] In step S402, if the meeting keywords include preset abnormal keywords, then it is determined that there is a meeting abnormality.

[0078] In this embodiment, the preset abnormal keywords are data stored in the system thesaurus. In actual application, this thesaurus can be preset in the system and updated according to actual needs. When one or more of the preset abnormal keywords are present in the meeting keywords obtained in step S401, the meeting topic is deemed abnormal.

[0079] In this disclosure, the aforementioned method for detecting anomalies in meeting agenda items can have two operating modes: a real-time detection mode and a post-meeting detection mode. Under these two operating modes, the system will employ different anomaly handling methods for abnormal situations.

[0080] In real-time detection mode, the system can acquire meeting keywords in real time. Then, it determines whether the acquired meeting keywords belong to preset abnormal keywords. If so, the meeting is forcibly ended, and it is determined that there is a meeting abnormality. At this time, the meeting abnormality is a meeting topic abnormality.

[0081] In the aforementioned real-time detection mode, the system can forcibly terminate meetings with abnormal agenda items, thus preventing losses to participants in a timely manner.

[0082] In post-meeting monitoring mode, the system responds to the meeting end signal by retrieving all meeting keywords from the meeting process. If any of these keywords include preset abnormal keywords, a meeting abnormality is identified, specifically a meeting agenda abnormality. After identifying a meeting abnormality, the meeting initiator's account can also be marked as an abnormal account.

[0083] In the post-meeting monitoring mode described above, the system uniformly detects meeting keywords during the meeting process. If a preset abnormal keyword is detected, the meeting agenda is deemed abnormal. Since the meeting has already ended, the aforementioned method of forcibly ending the meeting is not suitable. Therefore, anomaly handling can be achieved by marking the meeting initiator's account as an abnormal account, thereby alerting other participants when the initiator attends or initiates a meeting. Furthermore, the system can also restrict the initiator from initiating another meeting within a specific timeframe.

[0084] It should be noted that the meeting keyword acquisition method described in the previous embodiments is also applicable to the two operating modes mentioned above.

[0085] It should be further explained that, Figure 4 The method for detecting anomalies in meeting topics shown can be executed independently or in conjunction with the methods described above. Figure 1 This is implemented based on the meeting anomaly detection method shown.

[0086] For example, Figure 5 An exemplary flowchart of a meeting anomaly detection method according to other embodiments of this disclosure is shown. Figure 5 The method shown can be used in Figure 1 Based on the meeting anomaly detection method shown, a meeting topic anomaly detection method is further implemented to detect accounts that seriously violate regulations.

[0087] like Figure 5 As shown, in step S501, the account information of the participating accounts is obtained.

[0088] In this embodiment, the content of step S501 is the same as that of step S101 in the previous embodiment, and will not be described again here.

[0089] In step S502, if the account information of the participating account meets the abnormal account conditions, the participating account is marked as an abnormal account.

[0090] The abnormal account conditions in this embodiment have been described in detail in the previous embodiments, and will not be repeated here.

[0091] In step S503, the historical meeting keywords of the abnormal account are traversed.

[0092] In step S503, the participating account has been identified as an abnormal account. At this time, its historical meeting keywords are checked in order to determine whether the abnormal account has participated in, hosted or organized abnormal meetings.

[0093] In step S504, if the historical meeting keywords of the abnormal account include preset abnormal keywords, the abnormal account will be blocked.

[0094] If the historical meeting keywords of an abnormal account include preset abnormal keywords, it indicates that not only is the reliability of the account itself questionable, but its participation behavior also poses risks. Therefore, the account will be suspended.

[0095] In summary, this disclosure provides a method for detecting meeting anomalies. It can determine the degree of matching between the participation behavior of participating accounts and their participation needs from multiple aspects such as enterprise authentication, average monthly number of meetings attended, and average daily meeting duration, identify situations where the two do not match, realize meeting anomaly detection, and meet the management needs of video conferencing.

[0096] This disclosure also provides another method for detecting meeting anomalies, which can not only detect anomalies in the participant accounts themselves to identify meeting anomalies as a type of meeting anomaly, but also detect anomalies in the meeting itself based on meeting keywords to identify meeting topic anomalies as a type of meeting anomaly.

[0097] In addition, this disclosure provides a meeting anomaly detection method, which sets up different anomaly handling methods for two operating modes: real-time detection and post-meeting detection, in order to adapt to different abnormal scenarios of meeting topics.

[0098] Corresponding to the aforementioned functional embodiments, this invention also provides a method such as... Figure 6 The electronic device shown. Figure 6 An exemplary structural block diagram of an electronic device according to an embodiment of this disclosure is shown.

[0099] Figure 6 The illustrated electronic device 600 includes: a processor 610; and a memory 620 storing executable program instructions that, when executed by the processor 610, cause the electronic device to perform any of the methods described above.

[0100] exist Figure 6 In the electronic device 600, only the components relevant to this embodiment are shown. Therefore, it will be apparent to those skilled in the art that the electronic device 600 may also include components related to... Figure 6 The following are common constituent elements with different constituent elements.

[0101] Processor 610 can control the operation of electronic device 600. For example, processor 610 controls the operation of electronic device 600 by executing a program stored in memory 620 on electronic device 600. Processor 610 can be implemented by a central processing unit (CPU), application processor (AP), artificial intelligence processor chip (IPU), etc., provided in electronic device 600. However, this disclosure is not limited thereto. In this embodiment, processor 610 can be implemented in any suitable manner. For example, processor 610 can take the form of, for example, a microprocessor or processor and a computer-readable medium storing computer-readable program code (e.g., software or firmware) executable by the (micro)processor, logic gates, switches, application-specific integrated circuits (ASICs), programmable logic controllers, and embedded microcontrollers, etc.

[0102] The memory 620 can be used to store various data and instructions processed in the electronic device 600. For example, the memory 620 can store processed data and data to be processed in the electronic device 600. The memory 620 can store datasets that have been processed or are to be processed by the processor 610. In addition, the memory 620 can store applications, drivers, etc., to be driven by the electronic device 600. For example, the memory 620 can store various programs related to task type identification, operator type identification, etc., to be executed by the processor 610. The memory 620 can be DRAM, but this disclosure is not limited thereto. The memory 620 can include at least one of volatile memory or non-volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), flash memory, phase-change RAM (PRAM), magnetic RAM (MRAM), resistive RAM (RRAM), ferroelectric RAM (FRAM), etc. Volatile memory may include dynamic RAM (DRAM), static RAM (SRAM), synchronous DRAM (SDRAM), PRAM, MRAM, RRAM, ferroelectric RAM (FeRAM), etc. In an embodiment, memory 620 may include at least one of hard disk drive (HDD), solid-state drive (SSD), high-density flash memory (CF), secure digital card (SD), micro-secure digital card (Micro-SD), mini-secure digital card (Mini-SD), extreme digital card (xD), cache, or memory stick.

[0103] In summary, the specific functions implemented by the memory 620 and processor 610 of the electronic device 600 provided in the embodiments of this specification can be explained in comparison with the foregoing embodiments in this specification, and can achieve the technical effects of the foregoing embodiments. Therefore, they will not be repeated here.

[0104] Alternatively, this disclosure may be implemented as a non-transitory machine-readable storage medium (or computer-readable storage medium, or machine-readable storage medium) storing computer program instructions (or computer program, or computer instruction code) that, when executed by a processor of an electronic device (or electronic device, server, etc.), cause the processor to perform some or all of the steps of the methods described above according to this disclosure.

[0105] While numerous embodiments of this disclosure have been shown and described herein, it will be apparent to those skilled in the art that such embodiments are provided by way of example only. Many modifications, alterations, and alternatives will occur to those skilled in the art without departing from the spirit and intent of this disclosure. It should be understood that various alternatives to the embodiments of this disclosure described herein may be employed in the practice of this disclosure. The appended claims are intended to define the scope of this disclosure and therefore cover equivalents or alternatives within the scope of these claims.

Claims

1. A method for detecting meeting anomalies, characterized in that, include: In response to the participation signal, obtain the account information of the participating account; The account information includes: average daily meeting duration, average monthly number of meetings attended, and enterprise authentication information; If the account information meets the conditions for account abnormality, then it is determined that there is a meeting abnormality, and the meeting abnormality is an abnormality of the participating account; The abnormal conditions for the account include: the average number of sessions attended by the account per month is greater than the average number of sessions per month threshold, the account has not passed enterprise certification, and the average daily session duration of the account is greater than the average daily duration threshold. The daily average duration threshold is calculated through the following steps: Get the historical average daily meeting duration for all accounts; The daily average session duration threshold is determined based on the historical daily average session duration of all accounts; The monthly average number of sessions threshold is calculated through the following steps: Get the average number of sessions attended per month for all accounts; The monthly average number of sessions threshold is determined based on the historical monthly average number of sessions attended by all accounts.

2. The meeting anomaly detection method according to claim 1, characterized in that, The meeting anomalies also include: anomalies in the meeting agenda; The meeting anomaly detection method further includes: Obtain conference keywords; If the meeting keywords include preset abnormal keywords, then a meeting abnormality is determined to exist, and the meeting abnormality is an abnormal meeting topic.

3. The meeting anomaly detection method according to claim 1, characterized in that, The daily average participation time threshold is determined based on the historical average daily participation time of all accounts, specifically including: The average daily participation time of all accounts is taken as the daily average time threshold. or The highest frequency of historical daily average participation time among all accounts is taken as the daily average participation time threshold. or Sort all accounts by frequency from highest to lowest historical average daily meeting duration, determine the historical average daily meeting duration of the top N% of accounts, and use their average value as the threshold for average daily meeting duration, where N > 0.

4. The meeting anomaly detection method according to claim 1, characterized in that, The monthly average number of sessions attended is determined based on the historical average number of sessions attended by all accounts, specifically including: The average number of sessions attended by all accounts in a given month is taken as the threshold for the average number of sessions attended in a given month. or After sorting all accounts by their historical average number of sessions attended in descending order, the historical average number of sessions attended at the first M quantile is taken as the threshold for the average number of sessions attended in a month, where M > 1.

5. The meeting anomaly detection method according to claim 1, characterized in that, Among the abnormal account conditions, the average daily participation time of the participating account is greater than the average daily participation time threshold, including: the proportion of the timeout portion to the average daily participation time threshold is greater than or equal to Q%, and 30 < Q < 60; wherein, the timeout portion is the portion of the average daily participation time of the participating account that exceeds the average daily participation time threshold.

6. The meeting anomaly detection method according to claim 2, characterized in that, The conference keywords include: repeated keywords, compound keywords, and conference themes; The acquisition of meeting keywords includes: Collect meeting record fields and meeting topic; Take S meeting record fields and concatenate them to obtain compound keywords, where S > 1; The meeting record fields are iterated through. If the number of repetitions of a meeting record field reaches a preset repetition threshold, then the meeting record field is identified as a repetition keyword.

7. The meeting anomaly detection method according to claim 2, characterized in that, The step of obtaining meeting keywords includes: obtaining the meeting keywords in response to a meeting end signal; After determining that there is a meeting anomaly, the method also includes: marking the account of the meeting initiator as an abnormal account.

8. The meeting anomaly detection method according to claim 2, characterized in that, The acquisition of meeting keywords includes: real-time acquisition of meeting keywords; If the meeting keywords include preset abnormal keywords, then it is determined that there is a meeting abnormality, and the meeting abnormality is a meeting topic abnormality. This includes: determining whether the meeting keywords obtained in real time belong to preset abnormal keywords. If so, the meeting is forcibly terminated, and it is determined that there is a meeting abnormality, and the meeting abnormality is a meeting topic abnormality.

9. The meeting anomaly detection method according to claim 2, characterized in that, After obtaining the account information of the participating accounts, the process also includes: If the account information of the participating account meets the abnormal account conditions, then the participating account will be marked as an abnormal account. Iterate through the historical meeting keywords of the abnormal account; If the historical meeting keywords of the abnormal account include the preset abnormal keywords, the abnormal account will be banned.

10. An electronic device, characterized in that, include: processor; as well as A memory having executable code stored thereon, which, when executed by the processor, causes the processor to perform the method as described in any one of claims 1-9.

Images