An AI-based operation and maintenance analysis management system

Abstract

The present invention relates to the field of operation and maintenance analysis management technology, specifically an operation and maintenance analysis management system based on AI, including a data acquisition module, a data preprocessing module, an AI analysis module, a security protection module, an early warning and feedback module and a database. The present invention obtains personnel status information by analyzing work attribute information and behavior information parameters, and obtains corresponding personnel abnormality feedback information based on the personnel status information. According to the personnel feedback information, early warning of personnel behavior can be carried out to reduce illegal operations; system status information is obtained by analyzing system log information and monitoring screen information, and corresponding system abnormality feedback information is obtained based on the system status information. Timely early warning is carried out based on the system feedback information, which prevents personnel from performing illegal operations through some concealing means and protects customer information security.

Description

Technical Field

[0001] The present invention relates to the field of operation and maintenance analysis management technology, and specifically to an operation and maintenance analysis management system based on AI. Background Art

[0002] In the field of financial services, the behavior of personnel is directly related to the security of customers' assets, the reputation of financial institutions and the stability of the market. With the increasing complexity and digitalization of financial services, traditional manual supervision methods have been unable to meet the needs. Operation and maintenance analysis management systems based on personnel behavior identification and analysis have emerged. They can identify personnel behavior in real time and accurately, and promptly discover potential risks and violations.

[0003] The existing management system only issues early warnings for personnel violations by identifying and analyzing personnel behavior. However, when some personnel use some covert means to perform illegal operations, such as blocking the camera, blocking operating behaviors, tampering with background data, etc., the accuracy of the violation warning is reduced, threatening data security and privacy. Summary of the invention

[0004] The present invention provides an AI-based operation and maintenance analysis and management system to solve the above-mentioned technical problems.

[0005] The first aspect of the present invention provides an AI-based operation and maintenance analysis management system, including a data acquisition module, a data preprocessing module, an AI analysis module, a security protection module, an early warning and feedback module and a database.

[0006] The data acquisition module includes a personnel information entry unit, a behavior acquisition unit and a system information unit; the personnel information entry unit is used to enter the personnel information parameters of each person, the behavior acquisition unit is used to collect the behavior information parameters of each person, and send the personnel information parameters and behavior information parameters to the data preprocessing module; the system information unit is used to collect system log information and monitoring screen information and send the system log information and monitoring screen information to the database.

[0007] The data preprocessing module is used to receive personnel information parameters and behavior information parameters, identify the personnel information parameters to obtain basic personnel information, facial information and position information; basic personnel information includes but is not limited to name, contact information, address and employee number; position information includes position scope and work schedule information, the scope of authority of each person is obtained according to the position information of each person, the work area and business scope corresponding to each person are obtained based on the scope of authority of each person, and the work area, business scope, work schedule information and business schedule information of each person are integrated to obtain the work attribute information of each person; the behavior information parameters are identified to obtain body behavior and position movement behavior, body behavior includes communication with customers and transaction operations; the position movement information includes the time and location information of each person leaving the post; and the work attribute information and behavior information parameters of each person are sent to the database.

[0008] The AI ​​analysis module is used to obtain the work attribute information and behavior information parameters of each person, analyze the work attribute information and behavior information parameters to obtain the personnel status information, and when the personnel status information is abnormal, mark the corresponding person as an abnormal person, generate corresponding personnel abnormal feedback information for the abnormal person, and send the personnel abnormal feedback information to the early warning feedback module.

[0009] As a further improvement of the present invention, the work attribute information and behavior information parameters are analyzed, and the specific analysis method is as follows:

[0010] Work attribute information includes each personnel's work area, business scope and work schedule information; behavior information parameters include body behavior and position movement behavior; identify the body behavior of personnel to obtain abnormal behavior of each personnel, abnormal behavior includes but is not limited to frequent lowering of the head or sideways, wandering eyes and long-term covering of the face or screen, count the number of abnormal behaviors of each personnel, compare the number of abnormal behaviors with the set threshold, when the number of abnormal behaviors is greater than the set threshold, the value calculated by subtracting the threshold from the number of abnormal behaviors is marked as the behavior impact value; according to the work schedule information of each personnel, the working time period and non-working time period of each personnel are obtained, and the body behavior of each personnel is analyzed based on the working time period of each personnel. When the personnel is in the behavior of communicating and trading with customers, the corresponding personnel is marked as a working state personnel, otherwise, the corresponding personnel is marked as a non-working state personnel; set the personnel status impact value and record it as T, the value of T is [1, t], t is a natural constant, when the personnel corresponds to a working state personnel, T=t; when the personnel corresponds to a non-working state personnel, T=t+1.

[0011] The away time information and away location information corresponding to the position movement behavior of each personnel during the working time period are obtained, and the away time and number of away times are obtained according to the away time information, and a pre-set away time threshold is obtained, and the away time of each personnel is compared with the away time threshold. When the away time is greater than the away time threshold, the away time threshold is subtracted from the away time threshold to obtain the time impact value; the number of away times is divided into multiple away number intervals, each away number interval corresponds to a number impact value, and the number of away times of each personnel is compared with multiple away number intervals to obtain the number impact value.

[0012] The enterprise is divided into multiple branch areas, and the work area of ​​each person is matched with the multiple branch areas to obtain the branch area corresponding to each person, and the branch modules within the enterprise are obtained. The branch modules include key modules and other modules. The key modules include but are not limited to data centers, vaults and valuables storage areas; other modules include but are not limited to conference rooms, rest areas and office warehouses; the key modules are matched with multiple branch areas to obtain the branch areas corresponding to the key modules and mark them as key areas, and the branch areas corresponding to each person are overlapped and compared with the key areas to obtain the key personnel corresponding to the key areas, and the remaining personnel are marked as non-key personnel, and the stay time of the non-key personnel in the key areas is obtained to obtain the stay duration, and the stay duration is set as multiple stay duration intervals, each stay duration interval corresponds to an abnormal stay value, and the stay duration of each non-key person is matched with the multiple stay duration intervals to obtain the corresponding abnormal stay value.

[0013] The current business operations of each person are obtained and matched with the business scope corresponding to each person. When the current business operations are different from the corresponding business scope, the corresponding person is marked as a violator, and the number of violations of the violators is counted and recorded as the total number of violations.

[0014] According to the formula The personnel status impact value ZT is obtained; XW, kcs, tkz and wgr represent the behavior impact value, the number of impact values, the abnormal stay value and the total number of violations respectively; r1, r2, r3 and r4 are all preset weight factors, with values ​​of 3.171, 2.237, 1.979 and 2.613 respectively; when the personnel status impact value is greater than the set threshold, the corresponding personnel status information is marked as abnormal.

[0015] The security protection module takes each date as a unit monitoring time based on the monitoring date, obtains the system log information and monitoring screen information of each unit monitoring time, and analyzes the system log information and monitoring screen information to obtain the system status information. When the system status information is abnormal, the system log information and monitoring screen information corresponding to the corresponding unit monitoring date are packaged to generate an abnormal data packet and generate corresponding system abnormal feedback information, and the abnormal data packet and system abnormal feedback information are sent to the early warning and feedback module.

[0016] As a further improvement of the present invention, the system log information and monitoring screen information are analyzed, and the specific analysis method is as follows:

[0017] Identify system log information to obtain user login records and user operation records; user login records include login address and login time, obtain a pre-set login reference area, and compare the login address of each user login record with the login reference area. When the login address exceeds the login reference area, mark the corresponding login address as an abnormal login location; obtain a pre-set login time interval, and similarly, obtain the abnormal login time corresponding to the user login record; mark the user operation records corresponding to the abnormal login address and abnormal login time as key operation records, and the user operation records include query, modification and deletion. Set the system content to multiple content ranges, each content range corresponds to a setting information, and the setting information includes but is not limited to non-viewable, non-modifiable and non-deletable. Match the user operation records of each user with multiple content ranges. When the user operation record is different from the setting information corresponding to the content range, it is marked as an abnormal user operation, and the number of abnormal user operations corresponding to each user is counted and recorded as the total number of abnormal operations.

[0018] The monitoring screen information is identified to obtain the screen orientation, camera connection status and screen occlusion information; the camera orientation angle corresponding to the screen orientation is obtained, and the camera orientation angle is overlapped and compared with the set orientation angle to obtain the orientation angle deviation value; the connection status of each camera is identified, and when the camera connection is abnormal, the corresponding camera is marked as an abnormal camera, and the number of abnormal cameras is counted, and the number of abnormal cameras is compared with the total number of cameras to calculate the abnormal camera ratio; the high-quality screen area corresponding to each camera is extracted according to the monitoring area of ​​each camera, and the area of ​​the high-quality screen area of ​​each camera is used as the corresponding effective screen area, and the screen occlusion area of ​​each camera is obtained according to the screen occlusion information of each camera, and the screen occlusion area is compared with the effective screen area to obtain the screen occlusion ratio.

[0019] Draw a right triangle with the orientation angle deviation value and the abnormal camera ratio value as the two right-angled sides of the right triangle, draw a straight line perpendicular to the hypotenuse with the midpoint of the hypotenuse as the starting point, and the length of the straight line is equal to the screen occlusion ratio, and draw two side lines connected to the two ends of the hypotenuse with the end of the straight line as the starting point, calculate the area of ​​the closed figure formed by the right triangle and the two side lines, and record the value of the area as the monitoring screen abnormality index.

[0020] By formula The system status impact value XT is calculated; JC and λ represent the abnormal index of the monitoring screen and the total number of abnormal operations respectively; Represents the abnormal operation reference number; It is represented as a fixed reference value, which is [1, y], where y is a natural constant; z1 and z2 are both preset weight factors, which are 1.3 and 1.7 respectively; when the system status impact value is greater than the set threshold, the corresponding system status information is marked as abnormal.

[0021] The early warning and feedback module is used to receive personnel abnormal feedback information, abnormal data packets and system abnormal feedback information, generate corresponding personnel early warning information and system early warning information according to the personnel abnormal feedback information and the system abnormal feedback information, and isolate and process the abnormal data packets corresponding to the system abnormal feedback information; the feedback information includes but is not limited to screen abnormality alarms, behavior abnormality alarms and system abnormality alarms.

[0022] The database is used to store personnel information parameters and behavior information parameters, system log information and monitoring screen information, and personnel status information and system status information.

[0023] Compared with the prior art, the technical solution provided by the present invention has the following beneficial effects:

[0024] 1. The present invention obtains personnel status information by analyzing work attribute information and behavior information parameters, and obtains corresponding personnel abnormality feedback information based on the personnel status information. According to the personnel feedback information, early warning of personnel behavior can be carried out to reduce illegal operations.

[0025] 2. We also obtain system status information by analyzing system log information and monitoring screen information, and obtain corresponding system abnormality feedback information based on the system status information. We make timely warnings based on the system feedback information to prevent personnel from performing illegal operations through some cover-up means and ensure customer information security. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following briefly introduces the drawings required for use in the description of the embodiments. The following drawings are not intentionally scaled to the actual size, and the focus is on illustrating the main purpose of the present application.

[0027] Figure 1 It is a principle block diagram of the present invention. DETAILED DESCRIPTION

[0028] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0029] For ease of understanding, the specific process of the embodiment of the present invention is described below. Figure 1 In an embodiment of the present invention, an embodiment of an AI-based operation and maintenance analysis management system includes: a data acquisition module, a data preprocessing module, an AI analysis module, a security protection module, an early warning and feedback module and a database.

[0030] The data acquisition module includes a personnel information entry unit, a behavior acquisition unit and a system information unit; the personnel information entry unit is used to enter the personnel information parameters of each person, the behavior acquisition unit is used to collect the behavior information parameters of each person, and send the personnel information parameters and behavior information parameters to the data preprocessing module; the system information unit is used to collect system log information and monitoring screen information and send the system log information and monitoring screen information to the database.

[0031] The data preprocessing module receives personnel information parameters and behavior information parameters, identifies the personnel information parameters to obtain basic personnel information, facial information and position information; basic personnel information includes but is not limited to name, contact information, address and employee number; position information includes position scope and work schedule information, and the scope of authority of each personnel is obtained based on the position information of each personnel, and the corresponding work area and business scope of each personnel are obtained based on the scope of authority of each personnel, and the work area, business scope, work schedule information and business schedule information of each personnel are integrated to obtain the work attribute information of each personnel; the behavior information parameters are identified to obtain physical behavior and position movement behavior, and physical behavior includes communication with customers and transaction operations; the position movement information includes the time and location information of each personnel leaving the post; and the work attribute information and behavior information parameters of each personnel are sent to the database.

[0032] The AI ​​analysis module obtains the work attribute information and behavior information parameters of each person, analyzes the work attribute information and behavior information parameters to obtain the personnel status information. When the personnel status information is abnormal, the corresponding person is marked as an abnormal person, and corresponding personnel abnormal feedback information is generated for the abnormal person and sent to the early warning feedback module.

[0033] The work attribute information and behavior information parameters are analyzed in the following specific ways:

[0034] Work attribute information includes each personnel's work area, business scope and work schedule information; behavior information parameters include body behavior and position movement behavior; identify the body behavior of personnel to obtain abnormal behavior of each personnel, abnormal behavior includes but is not limited to frequent lowering of the head or sideways, wandering eyes and long-term covering of the face or screen, count the number of abnormal behaviors of each personnel, compare the number of abnormal behaviors with the set threshold, when the number of abnormal behaviors is greater than the set threshold, the value calculated by subtracting the threshold from the number of abnormal behaviors is marked as the behavior impact value; according to the work schedule information of each personnel, the working time period and non-working time period of each personnel are obtained, and the body behavior of each personnel is analyzed based on the working time period of each personnel. When the personnel is in the behavior of communicating and trading with customers, the corresponding personnel is marked as a working state personnel, otherwise, the corresponding personnel is marked as a non-working state personnel; set the personnel status impact value and record it as T, the value of T is [1, t], t is a natural constant, when the personnel corresponds to a working state personnel, T=t; when the personnel corresponds to a non-working state personnel, T=t+1.

[0035] The away time information and away location information corresponding to the position movement behavior of each personnel during the working time period are obtained, and the away time and number of away times are obtained according to the away time information, and a pre-set away time threshold is obtained, and the away time of each personnel is compared with the away time threshold. When the away time is greater than the away time threshold, the away time threshold is subtracted from the away time threshold to obtain the time impact value; the number of away times is divided into multiple away number intervals, each away number interval corresponds to a number impact value, and the number of away times of each personnel is compared with multiple away number intervals to obtain the number impact value.

[0036] The enterprise is divided into multiple branch areas, and the work area of ​​each person is matched with the multiple branch areas to obtain the branch area corresponding to each person, and the branch modules within the enterprise are obtained. The branch modules include key modules and other modules. The key modules include but are not limited to data centers, vaults and valuables storage areas; other modules include but are not limited to conference rooms, rest areas and office warehouses; the key modules are matched with multiple branch areas to obtain the branch areas corresponding to the key modules and mark them as key areas, and the branch areas corresponding to each person are overlapped and compared with the key areas to obtain the key personnel corresponding to the key areas, and the remaining personnel are marked as non-key personnel, and the stay time of the non-key personnel in the key areas is obtained to obtain the stay duration, and the stay duration is set as multiple stay duration intervals, each stay duration interval corresponds to an abnormal stay value, and the stay duration of each non-key person is matched with the multiple stay duration intervals to obtain the corresponding abnormal stay value.

[0037] The current business operations of each person are obtained and matched with the business scope corresponding to each person. When the current business operations are different from the corresponding business scope, the corresponding person is marked as a violator, and the number of violations of the violators is counted and recorded as the total number of violations.

[0038] According to the formula The personnel status impact value ZT is obtained; XW, kcs, tkz and wgr represent the behavior impact value, the number of impact values, the abnormal stay value and the total number of violations respectively; r1, r2, r3 and r4 are all preset weight factors, with values ​​of 3.171, 2.237, 1.979 and 2.613 respectively; when the personnel status impact value is greater than the set threshold, the corresponding personnel status information is marked as abnormal.

[0039] The security protection module takes each date as a unit monitoring time based on the monitoring date, obtains the system log information and monitoring screen information of each unit monitoring time, and analyzes the system log information and monitoring screen information to obtain the system status information. When the system status information is abnormal, the system log information and monitoring screen information corresponding to the corresponding unit monitoring date are packaged to generate an abnormal data packet and generate corresponding system abnormal feedback information, and the abnormal data packet and system abnormal feedback information are sent to the early warning and feedback module.

[0040] Analyze the system log information and monitoring screen information. The specific analysis method is as follows:

[0041] Identify system log information to obtain user login records and user operation records; user login records include login address and login time, obtain a pre-set login reference area, and compare the login address of each user login record with the login reference area. When the login address exceeds the login reference area, mark the corresponding login address as an abnormal login location; obtain a pre-set login time interval, and similarly, obtain the abnormal login time corresponding to the user login record; mark the user operation records corresponding to the abnormal login address and abnormal login time as key operation records, and the user operation records include query, modification and deletion. Set the system content to multiple content ranges, each content range corresponds to a setting information, and the setting information includes but is not limited to non-viewable, non-modifiable and non-deletable. Match the user operation records of each user with multiple content ranges. When the user operation record is different from the setting information corresponding to the content range, it is marked as an abnormal user operation, and the number of abnormal user operations corresponding to each user is counted and recorded as the total number of abnormal operations.

[0042] The monitoring screen information is identified to obtain the screen orientation, camera connection status and screen occlusion information; the camera orientation angle corresponding to the screen orientation is obtained, and the camera orientation angle is overlapped and compared with the set orientation angle to obtain the orientation angle deviation value; the connection status of each camera is identified, and when the camera connection is abnormal, the corresponding camera is marked as an abnormal camera, and the number of abnormal cameras is counted, and the number of abnormal cameras is compared with the total number of cameras to calculate the abnormal camera ratio; the high-quality screen area corresponding to each camera is extracted according to the monitoring area of ​​each camera, and the area of ​​the high-quality screen area of ​​each camera is used as the corresponding effective screen area, and the screen occlusion area of ​​each camera is obtained according to the screen occlusion information of each camera, and the screen occlusion area is compared with the effective screen area to obtain the screen occlusion ratio.

[0043] Draw a right triangle with the orientation angle deviation value and the abnormal camera ratio value as the two right-angled sides of the right triangle, and draw a straight line perpendicular to the hypotenuse with the center of the hypotenuse as the starting point. The length of the straight line is equal to the screen occlusion ratio, and with the end of the straight line as the starting point, draw two side lines connected to the two ends of the hypotenuse. Calculate the area of ​​the closed figure formed by the right triangle and the two side lines, and record the value of the area as the monitoring screen abnormality index.

[0044] By formula The system status impact value XT is calculated; JC and λ represent the abnormal index of the monitoring screen and the total number of abnormal operations respectively; Represents the abnormal operation reference number; It is represented as a fixed reference value, which is [1, y], where y is a natural constant; z1 and z2 are both preset weight factors, which are 1.3 and 1.7 respectively; when the system status impact value is greater than the set threshold, the corresponding system status information is marked as abnormal.

[0045] The early warning and feedback module receives personnel abnormal feedback information, abnormal data packets and system abnormal feedback information, generates corresponding personnel early warning information and system early warning information according to the personnel abnormal feedback information and the system abnormal feedback information, and isolates and processes the abnormal data packets corresponding to the system abnormal feedback information; the feedback information includes but is not limited to screen abnormality alarms, behavior abnormality alarms and system abnormality alarms.

[0046] The database stores personnel information parameters and behavior information parameters, system log information and monitoring screen information, and is also used to store personnel status information and system status information.

[0047] As described above, the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features thereof may be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. An AI-based operation and maintenance analysis management system, including a data acquisition module and a database, characterized in that: Also includes: The data preprocessing module is used to receive personnel information parameters and behavior information parameters, identify the personnel information parameters to obtain basic personnel information, facial information and position information; obtain the scope of authority of each person according to the position information of each person, obtain the corresponding work area and business scope of each person based on the scope of authority of each person, and integrate the work area, business scope, work time arrangement information and business arrangement information of each person to obtain the work attribute information of each person; identify the behavior information parameters to obtain body behavior and position movement behavior, and send the work attribute information and behavior information parameters of each person to the database; The AI ​​analysis module is used to obtain the work attribute information and behavior information parameters of each person, analyze the work attribute information and behavior information parameters to obtain the personnel status information, and when the personnel status information is abnormal, mark the corresponding person as an abnormal person, generate corresponding personnel abnormal feedback information for the abnormal person, and send the personnel abnormal feedback information to the early warning feedback module; The security protection module takes each date as a unit monitoring time based on the monitoring date, obtains the system log information and monitoring screen information of each unit monitoring time, and analyzes the system log information and monitoring screen information to obtain the system status information. When the system status information is abnormal, the system log information and monitoring screen information corresponding to the corresponding unit monitoring date are packaged to generate an abnormal data packet, and the corresponding system abnormal feedback information is generated, and the abnormal data packet and the system abnormal feedback information are sent to the early warning and feedback module; The specific analysis method of analyzing the system log information and monitoring screen information is as follows: Identify system log information to obtain user login records and user operation records; user login records include login addresses and login times, obtain a pre-set login reference area, compare the login addresses of each user login record with the login reference area, and when the login address exceeds the login reference area, mark the corresponding login address as an abnormal login location; obtain a pre-set login time interval, and similarly, obtain the abnormal login time corresponding to the user login record; The user operation records corresponding to the abnormal login address and abnormal login time are marked as key operation records. The user operation records include query, modification and deletion. The system content is set as multiple content ranges, each content range corresponds to a setting information, and the user operation records of each user are matched with multiple content ranges. When the user operation record is different from the setting information corresponding to the content range, it is marked as an abnormal user operation. The number of abnormal user operations corresponding to each user is counted and recorded as the total number of abnormal operations; the monitoring screen information is identified to obtain the screen direction, camera connection status and screen occlusion information, and the screen direction, camera connection status and screen occlusion information are analyzed to obtain the monitoring screen abnormality index; The image orientation, camera connection status and image occlusion information are analyzed to obtain the monitoring image abnormality index, and the specific analysis method is as follows: Get the camera orientation angle corresponding to the screen orientation, and compare the camera orientation angle with the set orientation angle to obtain the orientation angle deviation value; identify the connection status of each camera, and when the camera connection is abnormal, mark the corresponding camera as an abnormal camera, count the number of abnormal cameras, and compare the number of abnormal cameras with the total number of cameras to calculate the abnormal camera ratio; Extracting the high-quality picture area corresponding to each camera according to the monitoring area of ​​each camera, taking the area of ​​the high-quality picture area of ​​each camera as the corresponding effective picture area, obtaining the picture occlusion area of ​​each camera according to the picture occlusion information of each camera, and comparing the picture occlusion area with the effective picture area to obtain the picture occlusion ratio; Draw a right triangle with the orientation angle deviation value and the abnormal camera ratio value as the two right-angled sides of the right triangle, draw a straight line perpendicular to the hypotenuse with the midpoint of the hypotenuse as the starting point, and the length of the straight line is equal to the screen occlusion ratio, and draw two side lines connected to the two ends of the hypotenuse with the end of the straight line as the starting point, calculate the area of ​​the closed figure formed by the right triangle and the two side lines, and record the value of the area as the monitoring screen abnormality index; By formula The system status impact value XT is calculated; JC and λ represent the abnormal index of the monitoring screen and the total number of abnormal operations respectively; Represents the abnormal operation reference number; It is represented as a fixed reference value, which is [1, y], where y is a natural constant; z1 and z2 are both preset weight factors; when the system state impact value is greater than the set threshold, the corresponding system state information is marked as abnormal; The early warning and feedback module is used to receive personnel abnormal feedback information, abnormal data packets and system abnormal feedback information, generate corresponding personnel early warning information and system early warning information according to the personnel abnormal feedback information and the system abnormal feedback information, and isolate and process the abnormal data packets corresponding to the system abnormal feedback information.

2. The AI-based operation and maintenance analysis management system according to claim 1, characterized in that: The data collection module also includes a personnel information entry unit, a behavior collection unit and a system information unit; The personnel information input unit is used to input personnel information parameters of each person, and the behavior collection unit is used to collect behavior information parameters of each person, and send the personnel information parameters and behavior information parameters to the data preprocessing module; The system information unit is used to collect system log information and monitoring screen information and send the system log information and monitoring screen information to the database.

3. The AI-based operation and maintenance analysis management system according to claim 1, characterized in that: The position information includes the scope of authority and work schedule information; physical behavior includes communication with customers and transaction operations; location movement information includes the time and location of each person leaving the post.

4. The AI-based operation and maintenance analysis management system according to claim 1, characterized in that: The work attribute information and behavior information parameters are analyzed in the following specific analysis methods: Work attribute information includes each personnel's work area, business scope and work schedule information; behavior information parameters include physical behavior and position movement behavior; identify the physical behavior of personnel to obtain abnormal behavior of each personnel, count the number of abnormal behaviors of each personnel, compare the number of abnormal behaviors with the set threshold, and when the number of abnormal behaviors is greater than the set threshold, mark the value calculated by subtracting the threshold from the number of abnormal behaviors as the behavior impact value; obtain the working time period and non-working time period of each personnel according to the work schedule information of each personnel, analyze the physical behavior of each personnel based on the working time period of each personnel, and when the personnel is in the behavior of communicating and trading with customers, mark the corresponding personnel as working personnel, otherwise, mark the corresponding personnel as non-working personnel; set the personnel status impact value and record it as T, the value of T is [1, t], t is a natural constant, when the personnel corresponds to a working personnel, T=t; when the personnel corresponds to a non-working personnel, T=t+1; Obtain the off-duty time information and off-duty location information corresponding to the location movement behavior of each person during the working time period, obtain the off-duty duration and the number of off-duty times according to the off-duty time information, obtain a pre-set off-duty duration threshold, compare the off-duty duration of each person with the off-duty duration threshold, and when the off-duty duration is greater than the off-duty duration threshold, subtract the off-duty duration threshold from the off-duty duration to obtain the duration impact value; divide the number of off-duty times into multiple off-duty frequency intervals, each off-duty frequency interval corresponds to a frequency impact value, and compare the number of off-duty times of each person with multiple off-duty frequency intervals to obtain the frequency impact value; The enterprise is divided into multiple divisional areas, and the work area of ​​each person is matched with the multiple divisional areas to obtain the divisional area corresponding to each person, and the divisional modules within the enterprise are obtained. The divisional modules include key modules and other modules; other modules include conference rooms, rest areas and office warehouses; the key modules are matched with multiple divisional areas to obtain the divisional areas corresponding to the key modules and marked as key areas, and the divisional areas corresponding to each person are overlapped and compared with the key areas to obtain the key personnel corresponding to the key areas, and the remaining personnel are marked as non-key personnel, and the stay time of the non-key personnel in the key areas is obtained to obtain the stay duration, and the stay duration is set as multiple stay duration intervals, each stay duration interval corresponds to an abnormal stay value, and the stay duration of each non-key person is matched with multiple stay duration intervals to obtain the corresponding abnormal stay value; Obtain the current business of each person and match the current business with the business scope of each person. When the current business is different from the corresponding business scope, mark the corresponding person as a violator, count the number of violations of the violator and record it as the total number of violations; According to the formula The personnel status impact value ZT is obtained; XW, kcs, tkz and wgr represent the behavior impact value, the number of impact values, the abnormal stay value and the total number of violations respectively; r1, r2, r3 and r4 are all preset weight factors; when the personnel status impact value is greater than the set threshold, the corresponding personnel status information is marked as abnormal.

Images