A user behavior analysis system and method for big data in the digital discipline inspection industry

Abstract

The present invention relates to the technical field of fund data processing, and in particular to a user behavior analysis system and method for big data in the digital discipline inspection industry. The present invention obtains the use risk coefficient of each user according to the frequency of fund use and the distribution of fund use quota of each user within any period; obtains multiple user groups according to the change trend and distribution characteristics of the use risk coefficients of all users; obtains the initial abnormality of each user group within each period according to the use risk coefficient level of users in each user group and the number of users in each user group; obtains the updated abnormality according to the change trend of the initial abnormality of each user group within different period ranges; and determines the target abnormal user group according to the updated abnormality of each user group. The present invention improves the accuracy of discipline inspection and supervision by adaptively adjusting the abnormality of each user group.

Description

Technical Field

[0001] The present invention relates to the technical field of fund data processing, and in particular to a user behavior analysis system and method for big data in the digital discipline inspection industry. Background Art

[0002] The digital discipline inspection analysis system embeds the supervision process into the entire process of the supervised unit's performance of duties through big data analysis, dynamically warns of abnormal data, and achieves active supervision of the entire process. It also monitors the comparison of various types of data through the data centrality formed by the behavioral characteristics of user groups, unearths potential risks and problem clues, and provides strong data support for discipline inspection work.

[0003] The existing technology analyzes the use of funds based on the method of setting a fund flow threshold based on experience. If the fund usage exceeds the fund flow threshold, it is judged that there is an abnormality in the user's fund usage behavior. However, due to the low transparency of the fund spending process when public funds are used for procurement, reimbursement, etc., and in order to circumvent review, the use of the same fund is often shared by multiple people. The change in the usage limit of a single user is not easy to be significantly screened and identified from the group, resulting in the problem of abnormal fund usage evading big data discipline inspection and supervision, and there are errors in the analysis of the abnormality of user fund usage behavior, and the results of discipline inspection and supervision are poor. Summary of the invention

[0004] In order to solve the technical problem of errors in analyzing abnormalities in user fund usage behavior, the purpose of the present invention is to provide a user behavior analysis system and method for big data in the digital discipline inspection industry. The technical solution adopted is as follows:

[0005] The present invention proposes a user behavior analysis method for big data in the digital discipline inspection industry, the method comprising:

[0006] Obtain the user's fund usage frequency and the amount of each fund usage within each cycle;

[0007] For any period, the use risk coefficient of each user is obtained according to the frequency of use of funds of each user and the distribution of the amount of funds used; multiple user groups are obtained according to the change trend and distribution characteristics of the use risk coefficients of all users; the initial abnormality of each user group in each period is obtained according to the use risk coefficient level of users in each user group and the number of users in each user group;

[0008] According to the change trend of the initial abnormality degree of each user group within different period ranges, an updated abnormality degree is obtained;

[0009] Display the personnel in the target abnormal user group and their corresponding fund flow records to the visual terminal of the discipline inspection personnel;

[0010] Determine a target abnormal user group according to the update abnormality degree of each user group;

[0011] The method for obtaining the target abnormal user group includes:

[0012] The update abnormality of each user group is normalized by a sigmoid function. If the normalized result is greater than or equal to a preset abnormal threshold, the corresponding user group is determined to be a target abnormal user group;

[0013] The update abnormality degree includes:

[0014] Select the adjacent period ranges whose changes in the initial abnormality are not equal to the preset changes, and the corresponding adjacent period ranges are used as reference adjacent period ranges;

[0015] A first ratio between the overall abnormality level and the amount of change of the initial abnormality between each reference adjacent cycle range is obtained, and a cumulative sum of the overall abnormality level and the first ratios between all reference adjacent cycle ranges is calculated as an updated abnormality for each user group.

[0016] Furthermore, the method for obtaining the use risk coefficient includes:

[0017] For any period, the fund usage activity of each user is obtained based on the change of each user's fund usage frequency relative to the maximum fund usage frequency among other users;

[0018] Obtaining a first difference between each fund usage limit of each user and the average fund usage limit; standardizing the first difference to obtain a standardized difference; calculating a preset even power of the standardized difference between all fund usage limits of each user and the average fund usage limit, and calculating the average to obtain a limit fluctuation degree;

[0019] The usage risk coefficient of each user is obtained according to the activeness of fund usage and the fluctuation degree of the credit limit of each user, and the activeness of fund usage and the fluctuation degree of the credit limit are positively correlated with the usage risk coefficient.

[0020] Furthermore, the method for obtaining the user group includes:

[0021] Screening out multiple reference usage risk coefficients according to the change trend and distribution characteristics of the usage risk coefficients of all users;

[0022] The users corresponding to the usage risk coefficients within the range of every two reference usage risk coefficients are obtained in sequence to form a user group.

[0023] Furthermore, the method for obtaining the reference use risk coefficient includes:

[0024] Construct a descending sequence of usage risk coefficients for all users;

[0025] Obtain a usage risk coefficient differential sequence of a usage risk coefficient descending sequence, and obtain multiple maximum value points of the usage risk coefficient differential sequence; use the usage risk coefficient corresponding to the maximum value point, the maximum usage risk coefficient, and the minimum usage risk coefficient as reference usage risk coefficients.

[0026] Furthermore, the method for obtaining the initial abnormality degree includes:

[0027] Obtain the mean of the usage risk coefficients of all users in each user group as the overall usage risk level;

[0028] The user groups are sorted from large to small according to the overall usage risk level, and the usage risk concentration level of each user group is obtained according to the difference characteristics between the overall usage risk level of each user group and the adjacent overall usage risk level, and the central trend of the overall usage risk levels of all user groups, wherein the difference characteristics are positively correlated with the usage risk concentration level, and the central trend is negatively correlated with the usage risk concentration level;

[0029] Calculate the ratio of the number of users in each user group to the number of all users as the abnormality factor;

[0030] The usage risk concentration degree and the abnormal factor of each user group are fused to obtain the initial abnormality degree of each user group within each period.

[0031] Furthermore, the method for obtaining the update abnormality degree includes:

[0032] Obtain the mean of the initial abnormality of the user group in all periods as the overall abnormality level;

[0033] According to the overall abnormality level of each user group and the change amount of the initial abnormality between adjacent period ranges, the updated abnormality of each user group is obtained.

[0034] Furthermore, the method for obtaining the maximum value point includes:

[0035] The AMPD algorithm is used to obtain the maximum point of the risk coefficient difference sequence.

[0036] The present invention also proposes a user behavior analysis system for big data in the digital discipline inspection industry, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements any one of the steps of a user behavior analysis method for big data in the digital discipline inspection industry.

[0037] The present invention has the following beneficial effects:

[0038] The present invention obtains the use risk coefficient of each user according to the frequency of fund use and the distribution of fund use amount of each user within any cycle range, and more accurately reflects the fund use habits of the users by considering the frequency of fund use and the distribution of amount of the users within the cycle range; obtains multiple user groups according to the change trend and distribution characteristics of the use risk coefficients of all users, divides the users into different groups with similar fund use characteristics, and conducts targeted analysis to improve processing efficiency; since the use risk coefficient level can reflect the credibility of user behavior and quantify the risk level of the user group, and the number of users can evaluate the relative importance or representativeness of the user group in the overall user group, the initial abnormality of each user group within each cycle range is obtained according to the use risk coefficient level of the users in each user group and the number of users in each user group, and the initial abnormality of each user group can be more accurately evaluated; considering the characteristics of uninterrupted and small amount of behavior reflected by abnormal fund use, the updated abnormality is obtained according to the change trend of the initial abnormality of each user group within different cycle ranges, and the risk status of the user group is more accurately reflected; the target abnormal user group is judged according to the updated abnormality of each user group, and the target abnormal user group with high risk or abnormal behavior in fund use is accurately located. The present invention improves the accuracy of discipline inspection and supervision by adaptively adjusting the abnormality of each user group. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the technical solutions and advantages in the embodiments of the present invention or the prior art, the drawings required for use in the embodiments or the prior art descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0040] Figure 1 A flowchart of a method for analyzing user behavior in digital discipline inspection industry big data provided by an embodiment of the present invention;

[0041] Figure 2 A flow chart of a method for obtaining a usage risk coefficient provided by an embodiment of the present invention;

[0042] Figure 3 A flow chart of a method for obtaining an initial abnormality degree provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0043] In order to further explain the technical means and effects adopted by the present invention to achieve the predetermined invention purpose, the following is a detailed description of the user behavior analysis system and method for big data in the digital discipline inspection industry proposed by the present invention, its specific implementation method, structure, characteristics and effects, in combination with the accompanying drawings and preferred embodiments. In the following description, different "one embodiment" or "another embodiment" does not necessarily refer to the same embodiment. In addition, specific features, structures or characteristics in one or more embodiments may be combined in any suitable form.

[0044] Unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs.

[0045] The following is a detailed description of a specific scheme of a user behavior analysis system and method for big data in the digital discipline inspection industry provided by the present invention in conjunction with the accompanying drawings.

[0046] See also Figure 1 , which shows a flow chart of a method for analyzing user behavior of big data in the digital discipline inspection industry provided by an embodiment of the present invention, and the specific method includes:

[0047] Step S1: Obtain the user's fund usage frequency and each fund usage amount within each cycle.

[0048] In the embodiments of the present invention, since the shared use of funds in an organization is often achieved through multiple users, the changes in the usage amount of a single user are not easy to be significantly screened and identified from the group, resulting in the problem of abnormal fund usage escaping big data discipline inspection and supervision. Therefore, it is necessary to analyze the user's fund usage status over a period of time in order to subsequently fully and accurately grasp the overall situation of fund sharing and use; first, the discipline inspection big data system includes the identification number corresponding to the user's name and the use of each fund, and the user's fund usage frequency and the amount of each fund usage within each period are obtained based on the discipline inspection big data system.

[0049] It should be noted that, in one implementation of the present invention, each cycle ranges from one natural month.

[0050] It should be noted that the acquisition of data in the embodiments of the present invention does not violate relevant laws and regulations, and does not violate public order and good morals.

[0051] Step S2: For any period, obtain each user's usage risk coefficient according to the frequency of fund usage and the distribution of fund usage amount of each user; obtain multiple user groups according to the change trend and distribution characteristics of the usage risk coefficients of all users; obtain the initial abnormality of each user group within each period according to the usage risk coefficient level of users in each user group and the number of users in each user group.

[0052] The frequency and amount of funds used are an intuitive reflection of the user's behavior analysis, which can evaluate the user's fund usage habits. Due to differences in users' fund usage habits, there are differences in the use risk coefficients between users. By grouping users into different groups, these characteristics can be better identified and targeted analysis can be conducted. The user group's use risk coefficient level and the number of users jointly reflect the group's risk status. The group with a higher use risk coefficient and a larger number of users may have a greater relative risk. The risk level of different user groups is quantified to evaluate the initial abnormality.

[0053] In the supervisory organization, different users have different frequencies and amounts of fund use. If the frequency and amount of use are consistent and relatively stable, the user's fund use is normal and the risk factor is smaller. If the frequency and amount of use are greatly different from the historical use behavior, the abnormal fund use changes and the risk factor is greater. Therefore, within any period, the risk factor of each user is obtained based on the frequency of fund use and the distribution of the amount of fund use.

[0054] Preferably, in one embodiment of the present invention, the method for obtaining the risk coefficient is as follows: Figure 2 , which shows a flow chart of a method for obtaining a usage risk coefficient provided by an embodiment of the present invention, the method comprising:

[0055] Step S201: within any period, obtain the ratio of each user's fund usage frequency to the maximum fund usage frequency among other users as the fund usage activity level of each user.

[0056] Taking the maximum fund usage frequency among other users as the benchmark, the ratio can reflect the user's fund usage frequency relative to the most active user among all other users. The larger the ratio, the higher the user's fund usage frequency and the more active the fund usage.

[0057] It should be noted that, in other embodiments of the present invention, the fund activity level of each user can also be obtained by calculating the difference between the fund usage frequency of each user and the maximum fund usage frequency of other users and normalizing the difference, that is, ,in, represents the normalization function; Indicates Frequency of fund use by individual users; Indicates that except The maximum frequency of fund usage among users other than the individual user; a correlation is established that the greater the frequency of fund usage of each user, the greater the difference between the maximum fund usage frequency among other users, and the greater the fund activity. The specific means are technical means well known to those skilled in the art and will not be elaborated here.

[0058] Step S202: Obtain a first difference between each fund usage limit of each user and the average fund usage limit; standardize the first difference as a standardized difference; calculate the preset even power of the standardized difference between all fund usage limits of each user and the average fund usage limit, and calculate the average to obtain the limit fluctuation degree.

[0059] The degree of quota fluctuation reflects the change in the difference between each user's fund usage quota and the average fund usage quota, to reflect the distribution characteristics of the fund usage quota. If the closer the fund usage quota of each transaction is to the average fund usage quota, the smaller the difference change is, the user's fund usage quota remains stable, there is no outstanding change in the overall fund usage quota, and the degree of quota fluctuation is smaller; on the contrary, if there is a greater difference between each fund usage quota and the average fund usage quota, the greater the difference change is, the more obvious the difference is in the user's fund usage quota, which can better reflect the abnormal changes in the fund usage quota, and the greater the degree of quota fluctuation is.

[0060] It should be noted that, in one embodiment of the present invention, the first difference is standardized based on the standard deviation of all fund usage limits of each user. The larger the standard deviation, the greater the dispersion of the overall fund usage limit, the less prominent the characteristics of the first difference, and the smaller the standardized difference is; the smaller the standard deviation, the smaller the dispersion of the overall fund usage limit, the more obvious the characteristics of the first difference, and the larger the standardized difference is; in order to better show the characteristics of fund changes and amplify the impact of fund changes on the risk factor, the preset even powers of all standardized differences are calculated and averaged to obtain the degree of limit fluctuation, that is, the smaller the degree of limit fluctuation, the closer the standardized difference is to 0, and the user's fund usage limit distribution is relatively uniform, that is, the user's fund usage behavior is relatively stable; the greater the degree of limit fluctuation, the greater the degree of change of the standardized difference, and the user's fund usage limit distribution is relatively uneven, that is, the user's fund usage behavior is relatively unstable.

[0061] It should be noted that, in one embodiment of the present invention, the preset even power is the fourth power, that is, the kurtosis value of the changes in the user's multiple fund usage limits is calculated. The larger the kurtosis value, the more uneven the limit distribution characteristics.

[0062] Step S203: Obtain each user's usage risk coefficient based on each user's active fund usage and credit limit fluctuation. The active fund usage and credit limit fluctuation are positively correlated with the usage risk coefficient.

[0063] Among them, the positive correlation means that the dependent variable will increase as the independent variable increases, and the dependent variable will decrease as the independent variable decreases. The specific relationship can be the product or sum of the degree of fund use activity and the degree of quota fluctuation, which is determined by actual application.

[0064] In one embodiment of the present invention, the risk coefficient is expressed as:

[0065] ;

[0066] in, Indicates The risk factor of use for each user; Indicates Frequency of fund use by individual users; Indicates that except The maximum fund usage frequency among users other than the individual user; Indicates Amount of funds to be used; Indicates The average of all funds used by each user; Indicates The standard deviation of all funds used by a user; Represents the maximum value function.

[0067] In the formula using the risk factor, It means calculating the fourth power of the standardized difference between all fund usage amounts of each user and the average fund usage amount and finding the average, that is, finding the kurtosis value of the change in fund usage amount, and obtaining the amount fluctuation degree. The larger the kurtosis value, the greater the amount fluctuation degree, indicating that there is a greater change between the fund usage amount and the mean, the more unstable the user's fund usage amount distribution is, and the more obvious characteristics are maintained in more transactions, that is, the more obvious the difference information in fund usage is, the more likely it is to identify the user's abnormal fund usage; It means calculating the ratio of each user's fund usage frequency to the maximum fund usage frequency among other users, that is, the fund usage activity of each user. The larger the ratio, the more active the fund usage is. Compared with other users, the higher the fund usage frequency of the user, the more sufficient usage information is for analyzing the fund usage. Therefore, the greater the fluctuation of the credit limit, the more active the fund usage is, and the greater the usage risk coefficient.

[0068] It should be noted that, in other embodiments of the present invention, It can also be constructed by adding two parts and other basic mathematical operations to achieve a correlation that the more active the use of funds, the greater the fluctuation of the amount, and the greater the risk factor of use; the specific means are technical means well known to technicians in this field and will not be elaborated here.

[0069] The current monitoring organization contains users with different usage risk coefficients. The more users have usage risk coefficients, the more obvious they are from other users. The greater the deviation in the distribution of users with different usage risk coefficients, the more it reflects that the scope of funds flowing among members in the current organization is relatively fixed, reflecting that users have obvious differences in their behavior patterns in the use of funds. By identifying these differences, users can be divided into different groups for more accurate understanding and management. Therefore, multiple user groups are obtained based on the changing trends and distribution characteristics of the usage risk coefficients of all users.

[0070] Preferably, in one embodiment of the present invention, the method for obtaining a user group includes:

[0071] According to the change trend and distribution characteristics of the usage risk coefficients of all users, multiple reference usage risk coefficients are screened out;

[0072] The users corresponding to the usage risk coefficients within the range of every two reference usage risk coefficients are obtained in sequence to form a plurality of user groups.

[0073] It should be noted that, in one embodiment of the present invention, the range between every two reference usage risk coefficients is a range formed by the two reference usage risk coefficients and the usage risk coefficient in between, and each user corresponds to a user group.

[0074] Preferably, in one embodiment of the present invention, the method for obtaining the reference usage risk coefficient includes:

[0075] Construct a descending sequence of usage risk coefficients for all users;

[0076] Obtain a usage risk coefficient differential sequence of a usage risk coefficient descending sequence, and obtain multiple maximum value points of the usage risk coefficient differential sequence; use the usage risk coefficient corresponding to the maximum value point, the maximum usage risk coefficient, and the minimum usage risk coefficient as reference usage risk coefficients.

[0077] It should be noted that, in one embodiment of the present invention, the use risk coefficient differential sequence is obtained by performing differential processing on the use risk coefficient descending sequence in descending order; and the maximum point of the use risk coefficient differential sequence is obtained by using the AMPD algorithm. The specific differential and AMPD algorithm are technical means well known to those skilled in the art and will not be described in detail here.

[0078] The usage risk coefficient level can reflect the credibility of user behavior and quantify the risk level of the user group. The higher the usage risk coefficient, the greater the deviation in user behavior. For the analysis of the entire user group, the larger the usage risk coefficient level, the more users have greater deviations, and the more likely there is a risk of abnormal use of funds. The number of users can evaluate the relative importance or representativeness of the user group in the overall user group. If the number of users in a user group is large, then any abnormal behavior or risk in the user group may have a greater impact on the entire system, making it more likely to have abnormal fund risks. Therefore, based on the usage risk coefficient level of users in each user group and the number of users in each user group, the initial abnormality of each user group within each cycle is obtained.

[0079] Preferably, in one embodiment of the present invention, the method for obtaining the initial abnormality degree is as follows: Figure 3 , which shows a flow chart of a method for obtaining an initial abnormality degree provided by an embodiment of the present invention, the method comprising:

[0080] Step S301: Obtain the average of the usage risk coefficients of all users in each user group as the overall usage risk level.

[0081] In order to facilitate data comparison, the usage risk coefficients of all users in each user group are quantified and statistically analyzed by averaging, and compared by overall usage risk levels in subsequent calculations.

[0082] Step S302: Sort the user groups according to the overall usage risk level from large to small, and obtain the usage risk concentration level of each user group based on the difference characteristics between the overall usage risk level of each user group and the adjacent overall usage risk levels, as well as the central trend of the overall usage risk levels of all user groups. The difference characteristics are positively correlated with the usage risk concentration level, and the central trend is negatively correlated with the usage risk concentration level.

[0083] Among them, a positive correlation means that the dependent variable will increase as the independent variable increases, and the dependent variable will decrease as the independent variable decreases; a negative correlation means that the dependent variable will decrease as the independent variable increases, and the dependent variable will increase as the independent variable decreases.

[0084] The greater the difference between the overall usage risk level of each user group and the adjacent overall usage risk level, the higher the overall usage risk level of the user group, and the higher the concentration of usage risk; but the greater the centralization trend relative to the overall usage risk level of all user groups, that is, the smaller the centralization trend of the overall usage risk level of all user groups, the greater the overall usage risk level of each user group, indicating that the user group's usage risk concentration is greater, reflecting the lower the liquidity of funds within the organization.

[0085] It should be noted that, in one embodiment of the present invention, for the user group with the smallest overall usage risk level, the smaller the overall usage risk level is relative to the overall usage risk levels of all other user groups, the smaller the possibility of abnormal fund behavior. Therefore, it can be directly determined that there is no abnormal user group, and the risk situation of the user group is not considered; in other embodiments of the present invention, the usage risk concentration level corresponding to the user group with the previous adjacent overall usage risk level can also be used as the usage risk concentration level corresponding to the user group with the smallest overall usage risk level. The specific implementation method can be specifically set according to the actual situation, and will not be repeated here.

[0086] It should be noted that, in one embodiment of the present invention, the central trend of the overall usage risk level of all user groups is reflected by obtaining the median of the overall usage risk level of all user groups, that is, the most common usage risk level distribution among all user groups; in other embodiments of the present invention, the mean or mode of the overall usage risk level of all user groups may also be used to express it.

[0087] Step S303: Calculate the ratio of the number of users in each user group to the number of all users as an abnormality factor.

[0088] By comparing the ratio of the number of users in a user group to the total number of users, the impact of the user group on the use of funds of the entire user group can be reflected; if the number of users in a user group accounts for a large proportion, then any abnormal behavior or risk in the user group may have a greater impact on the entire system. Therefore, by calculating the abnormal factor, those user groups with a high risk concentration can be identified, so as to take targeted monitoring and prevention measures.

[0089] Step S304: The usage risk concentration degree and the abnormal factor of each user group are integrated to obtain the initial abnormality degree of each user group within each period.

[0090] In some embodiments of the present invention, the usage risk concentration degree and the abnormality factor of each user group may be fused by multiplication or addition to obtain the initial abnormality degree of each user.

[0091] In one embodiment of the present invention, the formula of the initial abnormality is expressed as:

[0092] ;

[0093] in, Indicates The initial abnormality of the user group; Indicates The average of the usage risk coefficients of all users in the user group, that is, The overall usage risk level of each user group; Indicates that all user groups are adjacent to the The overall usage risk level of each user group corresponds to the overall usage risk level; Represents the median of the overall usage risk level among all user groups; Indicates The number of users in a user group; Indicates the number of all users.

[0094] In the formula of initial abnormality, Avoid formulas that are 0. Indicates the calculation The ratio of the difference between the overall usage risk level of a user group and the adjacent overall usage risk level to the median of the overall usage risk level of all user groups, i.e. The greater the ratio, the higher the risk concentration of the user group. The greater the overall usage risk level of a user group is relative to the overall usage risk level of the majority of user groups, that is, the capital flow is more likely to be concentrated in a few user groups; Indicates the calculation The ratio of the number of users in a user group to the number of all users, that is, the abnormal factor. The larger the ratio, the larger the number of users in the user group, which means that the impact of abnormal fund use risk is greater and the abnormal factor is larger; the greater the concentration of usage risk of the user group, the larger the abnormal factor and the greater the initial abnormality of the user group.

[0095] Step S3: Obtaining updated abnormality according to the changing trend of the initial abnormality of each user group within different period ranges.

[0096] Since abnormal use of funds usually starts from some user groups with low abnormality, the amount of abnormal funds allocated to the user group keeps increasing and after the user receives the allocation, the actual user of the allocated abnormal funds gives the reward to the allocated person. User funds are not used frequently, reflecting the characteristics of uninterrupted and small-amount behavior. The increase in funds used by normal users in a certain period of time may be a short-term growth caused by needs within the organization. Therefore, by analyzing the changing trend of the initial abnormality of each user group in different period ranges, the long-term or short-term trend of user behavior, as well as the regularity and anomalies of user behavior over time are identified, and the abnormality of the user group is further corrected. Therefore, according to the changing trend of the initial abnormality of each user group in different period ranges, the updated abnormality is obtained.

[0097] Preferably, in one embodiment of the present invention, the method for acquiring the update abnormality degree includes:

[0098] Obtain the mean of the initial abnormality of the user group in all periods as the overall abnormality level;

[0099] According to the overall abnormality level of each user group and the change amount of the initial abnormality between adjacent period ranges, the updated abnormality of each user group is obtained.

[0100] Preferably, in one embodiment of the present invention, obtaining the updated abnormality of each user group according to the overall abnormality level of each user group and the change amount of the initial abnormality between adjacent period ranges includes:

[0101] The corresponding adjacent period range of the variation that is not equal to the preset variation is selected as the reference adjacent period range;

[0102] A first ratio between the overall abnormality level and the amount of change in the initial abnormality between each reference adjacent cycle range is obtained, and a cumulative sum of the overall abnormality level and the first ratios between all reference adjacent cycle ranges is calculated as the updated abnormality of each user group.

[0103] In one embodiment of the present invention, the formula for updating the abnormality degree is expressed as:

[0104] ;

[0105] in, Indicates Update abnormality of each user group; Indicates The mean of the initial abnormality of the user group in all periods; Indicates the serial number of the reference adjacent cycle range; Indicates The user group is the first in the reference adjacent cycle range Initial abnormality within a period range; Indicates The user group is the first in the reference adjacent cycle range Initial abnormality within a period range; Indicates the number of reference adjacent period ranges.

[0106] In the formula for updating the abnormality degree, Indicates the calculation The user group is the first in the reference adjacent cycle range Within the period range The difference in the initial abnormality between the cycle ranges, that is, the change in the initial abnormality between the adjacent cycle ranges, for the case where the difference is greater than 0 but smaller, that is, there is a small increase in the abnormality of the user group within different adjacent cycle ranges, the smaller the change, the more likely it is that the user group has been slightly apportioned multiple times, the larger the abnormality after the update, the more necessary it is to conduct disciplinary inspection; on the contrary, if the difference is larger, that is, there is a sudden increase in the abnormality of the user group within different cycle ranges, the larger the change, it may be due to changes in organizational needs, the smaller the possibility of abnormal usage behavior, and the smaller the updated abnormality; The larger the mean of the initial abnormality of a user group in all cycles, the larger the update abnormality.

[0107] It should be noted that, considering that when there is no change in the degree of abnormality within adjacent periods, the user group's use of funds has not changed, and therefore, there is no need to adjust the degree of abnormality. In one embodiment of the present invention, the preset change amount is a constant of 0; in other embodiments of the present invention, the size of the preset change amount can be set according to the specific situation, and is not limited or elaborated here.

[0108] It should be noted that, in other embodiments of the present invention, positive and negative correlations may also be constructed through other basic mathematical operations, and the specific means are well known to those skilled in the art and will not be elaborated herein.

[0109] Step S4: Determine the target abnormal user group according to the update abnormality degree of each user group.

[0110] User behavior changes dynamically. By updating the abnormality degree, the latest status of the user group behavior can be reflected, and potential high-abnormal user groups can be identified more accurately. Therefore, the target abnormal user group is determined based on the updated abnormality degree of each user group.

[0111] Preferably, in one embodiment of the present invention, the method for acquiring the target abnormal user group includes:

[0112] The update abnormality of each user group is normalized. If the normalized result is greater than or equal to the preset abnormal threshold, the corresponding user group is determined to be the target abnormal user group.

[0113] It should be noted that, in one embodiment of the present invention, the update anomaly degree of each user group can be mapped to (0, 1) by a sigmoid function, that is, the update anomaly degree of each user group is normalized. The specific sigmoid function is a technical means well known to those skilled in the art, and is not limited or elaborated herein.

[0114] It should be noted that, in one embodiment of the present invention, the size of the preset abnormal threshold is 0.6; in other embodiments of the present invention, the size of the preset abnormal threshold can be set according to specific circumstances, and will not be limited or elaborated here.

[0115] After obtaining the target abnormal user group, the discipline inspection big data system will display the personnel in the target abnormal user group and the corresponding fund flow record information on the discipline inspection personnel's visualization terminal for discipline inspection personnel to make judgments. This will enable them to have a more intuitive understanding of the specific circumstances of fund use, and can effectively expose and curb illegal activities such as corruption, money laundering, and provide strong guarantees for maintaining economic development order.

[0116] In summary, the present invention obtains the use risk coefficient of each user according to the frequency of fund use and the distribution of fund use amount of each user within any period; obtains multiple user groups according to the change trend and distribution characteristics of the use risk coefficients of all users; obtains the initial abnormality of each user group within each period according to the use risk coefficient level of users in each user group and the number of users in each user group; obtains the updated abnormality according to the change trend of the initial abnormality of each user group within different period ranges; and determines the target abnormal user group according to the updated abnormality of each user group. The present invention improves the accuracy of discipline inspection and supervision by adaptively adjusting the abnormality of each user group.

[0117] The present invention also proposes a user behavior analysis system for big data in the digital discipline inspection industry, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements any step of a user behavior analysis method for big data in the digital discipline inspection industry.

[0118] It should be noted that the sequence of the above embodiments of the present invention is only for description and does not represent the advantages and disadvantages of the embodiments. The processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0119] The various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referenced to each other, and each embodiment focuses on the differences from other embodiments.

Claims

1. A user behavior analysis method for big data in the digital discipline inspection industry, characterized in that: The method comprises: Obtain the user's fund usage frequency and the amount of each fund usage within each cycle; For any period, the use risk coefficient of each user is obtained according to the frequency of use of funds of each user and the distribution of the amount of funds used; multiple user groups are obtained according to the change trend and distribution characteristics of the use risk coefficients of all users; the initial abnormality of each user group in each period is obtained according to the use risk coefficient level of users in each user group and the number of users in each user group; According to the change trend of the initial abnormality degree of each user group within different period ranges, an updated abnormality degree is obtained; Determine a target abnormal user group according to the update abnormality degree of each user group; Display the personnel in the target abnormal user group and their corresponding fund flow records to the visual terminal of the discipline inspection personnel; The method for obtaining the target abnormal user group includes: The update abnormality of each user group is normalized by a sigmoid function. If the normalized result is greater than or equal to a preset abnormal threshold, the corresponding user group is determined to be a target abnormal user group; The update abnormality degree includes: Select the adjacent period ranges whose changes in the initial abnormality are not equal to the preset changes, and the corresponding adjacent period ranges are used as reference adjacent period ranges; A first ratio between the overall abnormality level and the amount of change of the initial abnormality between each reference adjacent cycle range is obtained, and a cumulative sum of the overall abnormality level and the first ratios between all reference adjacent cycle ranges is calculated as an updated abnormality for each user group.

2. According to claim 1, a user behavior analysis method for big data in the digital discipline inspection industry is characterized in that: The method for obtaining the use risk coefficient includes: For any period, the activeness of each user's fund usage is obtained based on the change in the frequency of each user's fund usage relative to the maximum fund usage frequency among other users; Obtaining a first difference between each fund usage limit of each user and the average fund usage limit; standardizing the first difference to obtain a standardized difference; calculating a preset even power of the standardized difference between all fund usage limits of each user and the average fund usage limit, and calculating the average to obtain a limit fluctuation degree; The usage risk coefficient of each user is obtained according to the activeness of fund usage and the fluctuation degree of the credit limit of each user, and the activeness of fund usage and the fluctuation degree of the credit limit are positively correlated with the usage risk coefficient.

3. According to claim 1, a user behavior analysis method for big data in the digital discipline inspection industry is characterized in that: The method for obtaining the user group includes: Screening out multiple reference usage risk coefficients according to the change trend and distribution characteristics of the usage risk coefficients of all users; The users corresponding to the usage risk coefficients within the range of every two reference usage risk coefficients are obtained in sequence to form a user group.

4. According to claim 3, a user behavior analysis method for big data in the digital discipline inspection industry is characterized in that: The method for obtaining the reference use risk coefficient includes: Construct a descending sequence of usage risk factors for all users; Obtain a usage risk coefficient differential sequence of a usage risk coefficient descending sequence, and obtain multiple maximum value points of the usage risk coefficient differential sequence; use the usage risk coefficient corresponding to the maximum value point, the maximum usage risk coefficient, and the minimum usage risk coefficient as reference usage risk coefficients.

5. According to claim 1, a user behavior analysis method for big data in the digital discipline inspection industry is characterized in that: The method for obtaining the initial abnormality degree includes: Obtain the mean of the usage risk coefficients of all users in each user group as the overall usage risk level; The user groups are sorted from large to small according to the overall usage risk level, and the usage risk concentration level of each user group is obtained according to the difference characteristics between the overall usage risk level of each user group and the adjacent overall usage risk level, and the central trend of the overall usage risk levels of all user groups, wherein the difference characteristics are positively correlated with the usage risk concentration level, and the central trend is negatively correlated with the usage risk concentration level; Calculate the ratio of the number of users in each user group to the number of all users as the abnormality factor; The usage risk concentration degree and the abnormal factor of each user group are fused to obtain the initial abnormality degree of each user group within each period.

6. According to claim 1, a user behavior analysis method for big data in the digital discipline inspection industry is characterized in that: The method for obtaining the update abnormality degree includes: Obtain the mean of the initial abnormality of the user group in all periods as the overall abnormality level; According to the overall abnormality level of each user group and the change amount of the initial abnormality between adjacent period ranges, the updated abnormality of each user group is obtained.

7. According to claim 4, a user behavior analysis method for big data in the digital discipline inspection industry is characterized in that: The method for obtaining the maximum value point includes: The AMPD algorithm is used to obtain the maximum point of the risk coefficient difference sequence.

8. A user behavior analysis system for big data in the digital discipline inspection industry, the system comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of a user behavior analysis method for big data in the digital discipline inspection industry as described in any one of claims 1 to 7 are implemented.

Images