Signature log auditing management system based on artificial intelligence

Abstract

The invention discloses a signature log auditing management system based on artificial intelligence, relates to the technical field of auditing management, and discloses a signature log auditing module, a signature event independent analysis module, a signature event linkage analysis module, a signature event abnormal response module and a setting signature log auditing module. According to the method, each signature log can be subjected to multi-dimensional comprehensive analysis, the signature logs are audited efficiently and meticulously, the judgment precision of abnormal response to signature events is effectively improved, and the signature event independent analysis module and the signature event linkage analysis module are arranged, so that the accuracy of signature event analysis is improved. A signature log between signature events can be subjected to three-dimensional analysis from two aspects of independence and linkage, whether the signature events are abnormal or not is accurately judged, a signature event abnormal response module is arranged, accurate abnormal response level evaluation can be performed on abnormal response events, and the abnormal response level evaluation accuracy is improved. And corresponding personnel can conveniently and accurately manage and control the abnormal response event according to the abnormal response level.

Description

Technical Field

[0001] The present invention relates to the field of audit management technology, and more specifically, to an artificial intelligence-based signature log audit management system. Background Art

[0002] With the rapid development of information technology, electronic signatures, as an efficient and convenient digital tool, are increasingly used in the daily business of enterprises. It not only greatly improves the speed and efficiency of document processing, but also enhances the security and credibility of documents through encryption technology and digital signatures. However, with the increasing use of electronic signatures, how to ensure the compliance, authenticity and traceability of signature activities has become an important issue that enterprises must face.

[0003] Traditional signature log auditing methods mainly rely on manual operations, which have many limitations. First, manual auditing is inefficient and difficult to cope with large-scale, high-frequency signature activities; second, manual operations are prone to errors, which may miss important information or misjudge problems; finally, traditional methods can often only find problems in the signature log, but cannot conduct accurate and comprehensive audit management of the entire signature event, which to a certain extent limits the effective supervision of enterprises on signature events. Summary of the invention

[0004] In view of the deficiencies in the prior art, the purpose of the present invention is to provide a signature log audit management system based on artificial intelligence.

[0005] To achieve the above object, the present invention provides the following technical solutions:

[0006] An artificial intelligence-based signature log audit management system, including a signature log audit module, a signature event independent analysis module, a signature event linkage analysis module, and a signature event abnormal response module;

[0007] The signature log audit module: every c time period, count all the signature logs generated by the system within c time period, and obtain the signature log audit value of each signature log;

[0008] The signature event independent analysis module: obtains the signature event number of each signature log, marks the signature logs with the same signature event number as the same event signature logs, and then obtains the signature independent event management value of each signature event;

[0009] The signature event linkage analysis module: obtains the signature linkage event management value of each signature event, and determines whether to mark the signature event as an abnormal response event based on the comparison result between the signature linkage event management value and the signature linkage event management boundary value;

[0010] The signature event abnormal response module determines the abnormal response level of the abnormal response event.

[0011] Furthermore, the signature log audit value of the signature log is obtained in the following manner: obtain each type of information contained in the signature log, obtain the information audit value of each type of information, set the information audit standard value, when the information audit value is greater than or equal to the information audit standard value, mark the type of information as different information, when the information audit value is less than the information audit standard value, do not process it, mark the total number of different information as Rymd, pack all different information into a group, sum the information audit values ​​of the two different information in the same group, obtain the different additional value, and set The additional threshold for differences is set. When the additional value for differences is greater than or equal to the additional threshold for differences, the number of additional differences is increased by one. When the additional value for differences is less than the additional threshold for differences, no processing is performed and the number of additional differences is marked as Mdsk. The difference between the information audit values ​​of the two difference information in the same group is calculated and the absolute value is taken to obtain the outstanding value for differences. The outstanding threshold for differences is set. When the outstanding value for differences is greater than or equal to the outstanding threshold for differences, the number of outstanding differences is increased by one. When the outstanding value for differences is less than the outstanding threshold for differences, no processing is performed and the number of outstanding differences is marked as Pthg. The formula is used. The signature log audit value Kst of the signature log is obtained, where v1 is the coefficient of the number of difference information, v2 is the coefficient of the additional number of difference, and v3 is the coefficient of the outstanding number of difference.

[0012] Furthermore, the information audit value of each type of information is obtained in the following manner: obtain the information audit analysis model of each type of information, format each type of information, input each type of formatted information into the corresponding information audit analysis model, and output the information audit value of each type of information.

[0013] Furthermore, the signature independent event management value of the signature event is obtained in the following way: obtain all the signature logs of the same event of the signature event, obtain the signature log audit value of each signature log of the same event, obtain the log time of each signature log of the same event, sort all the signature logs of the same event in the order of log time, calculate the difference between the signature log audit values ​​of two adjacent signature logs of the same event after sorting and take the absolute value to obtain the audit floating value, sum up all the audit floating values ​​and take the average to obtain the audit floating average Tadz, set the signature log audit limit, when the signature log audit value is greater than or equal to the signature log audit limit, mark the signature log of the same event as the abnormal signature event log, when the signature log audit value is less than the signature log audit limit, mark the signature log of the same event as the normal signature event log, mark the total number of abnormal signature event logs as Gkrt, mark the total number of normal signature event logs as Sbep, and use the formula The signature independent event value Dsgg of the signature event is obtained, where s1 is the first event coefficient and s2 is the second event coefficient.

[0014] Furthermore, a signature event spectrum is constructed for each signature event, and then the signature linkage event management value of each signature event is obtained, and the signature linkage event management boundary value is set. The signature linkage event management boundary value is a threshold set by the system, and the specific value can be adjusted according to demand. When the signature linkage event management value is greater than the signature linkage event management boundary value, the signature event is marked as an abnormal response event. When the signature linkage event management value is less than or equal to the signature linkage event management boundary value, no processing is performed.

[0015] Furthermore, the signature linkage management value of the signature event is obtained in the following way: the signature independent management value Dsgg of the signature event, marking the remaining signature events in the signature event spectrum that have event influence lines with the signature event as linkage events, obtaining the linkage influence value YZ of each linkage event, summing up the linkage influence values ​​of all linkage events to obtain the total linkage influence value Zyz, and using the formula Hfs=Dsgg*b1+Zyz*b2 to obtain the signature linkage management value Hfs of the signature event, wherein b1 is the second signature independent management value coefficient, and b2 is the total linkage influence value coefficient.

[0016] Furthermore, the linkage impact value of the linkage event is obtained by the following method: obtain the signature independent event management value Dsgg of the linkage event, obtain the total number of event influence lines between the signature event and the linkage event, and mark it as AKd, and use the formula The linkage impact value YZ of the linkage event is obtained, where z1 is the independent management value coefficient of the first signature, and z2 is the number coefficient of the event influence line.

[0017] Further, the abnormal response level of the abnormal response event is determined, specifically: the difference between the signature linkage management value of the abnormal response event and the signature linkage management boundary value is calculated to obtain the abnormal response value Bk, the abnormal response value Bk includes multiple ranges, each range of abnormal response values ​​corresponds to an abnormal response level, the range of abnormal response values ​​is (0, B1], (B1, B2], ..., (Bk-1, Bk], the abnormal response level includes abnormal response level 1, abnormal response level 2, ..., abnormal response level k-1, abnormal response level k, the higher the abnormal response level, the greater the abnormal impact of the signature event.

[0018] Compared with the prior art, the present invention has the following beneficial effects:

[0019] By setting up a signature log audit module, you can conduct a multi-dimensional comprehensive analysis of each signature log. By efficiently and carefully auditing the signature logs, you can effectively improve the accuracy of determining abnormal responses to signature events. By setting up an independent signature event analysis module and a linkage analysis module for signature events, you can conduct a three-dimensional analysis of the signature logs between signature events from both independent and linkage aspects, and accurately determine whether a signature event is abnormal. By setting up a signature event abnormal response module, you can accurately assess the abnormal response level of abnormal response events, so that relevant personnel can accurately control abnormal response events according to the abnormal response level. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 This is an operation flow chart of a signature log audit management system based on artificial intelligence;

[0021] Figure 2 A flowchart for marking abnormal response events;

[0022] Figure 3 The module block diagram of a signature log audit management system based on artificial intelligence. DETAILED DESCRIPTION

[0023] Reference Figure 1-Figure 3 , an artificial intelligence-based signature log audit management system, including a signature log audit module, a signature event independent analysis module, a signature event linkage analysis module, and a signature event abnormal response module.

[0024] Signature log audit module: every c time period, count all signature logs generated by the system within c time period (signature logs are used to record various types of signature information to ensure the traceability, security and compliance of signature operations. Signature logs are generated throughout the life cycle of signature events), and obtain the signature log audit value of each signature log.

[0025] By setting up a signature log audit module, you can conduct a multi-dimensional comprehensive analysis of each signature log. By efficiently and carefully auditing the signature log, you can effectively improve the accuracy of determining abnormal responses to signature events.

[0026] The signature log audit value of the signature log is obtained in the following way: obtain various types of information contained in the signature log (information types include but are not limited to operation information, environment information, and authentication information), obtain information audit values ​​of various types of information, set information audit standard values, and the information audit standard value is a threshold set by the system. The specific value can be adjusted according to demand. When the information audit value is greater than or equal to the information audit standard value, the type of information is marked as difference information. When the information audit value is less than the information audit standard value, no processing is performed. The total number of difference information is marked as Rymd, all difference information is packaged into a group in pairs, and the information audit values ​​of two difference information in the same group are summed to obtain the difference additional value, and the difference additional threshold is set. Value, the additional review threshold is a threshold set by the system, and the specific value can be adjusted according to the needs. When the additional review value is greater than or equal to the additional review threshold, the additional review quantity is increased by one. When the additional review value is less than the additional review threshold, no processing is performed, and the additional review quantity is marked as Mdsk. The information audit values ​​of the two review information in the same group are calculated by difference and the absolute value is taken to obtain the outstanding review value. The outstanding review threshold is set. The outstanding review threshold is a threshold set by the system, and the specific value can be adjusted according to the needs. When the outstanding review value is greater than or equal to the outstanding review threshold, the outstanding review quantity is increased by one. When the outstanding review value is less than the outstanding review threshold, no processing is performed, and the outstanding review quantity is marked as Pthg. Using the formula Get the signature log audit value Kst of the signature log, where v1 is the coefficient of the number of difference information, v2 is the coefficient of the number of difference additional, and v3 is the coefficient of the number of difference outstanding. The value of v1 is 0.82, the value of v2 is 0.68, and the value of v3 is 0.71.

[0027] The information audit value of each type of information is obtained in the following manner: obtaining the information audit analysis model of each type of information (each type of information corresponds to an information audit analysis model), formatting each type of information (the purpose of formatting is to ensure that the information complies with a unified format standard to facilitate the analysis of the subsequent deep learning model), inputting each type of formatted information into the corresponding information audit analysis model (such as inputting environmental information into the information audit analysis model of environmental information, and inputting operation information into the information audit analysis model of operation information), and outputting the information audit value of each type of information;

[0028] In order to facilitate the comprehensive analysis of different types of information, the information audit analysis models of different types of information are constructed in a unified manner, and the value range of the information audit value assigned by training is also consistent. It is only necessary to replace the corresponding sample data. The sample data is the corresponding type of information after formatting. This case takes operation information as an example to introduce the construction method of the information audit analysis model. The construction method of the information audit analysis model of other types of information is similar: collect multiple operation information (all after formatting). The above collected operation information can be real collection or virtual setting. Build a deep learning model, use multiple operation information as sample data of the deep learning model, assign an information audit value to each sample data, divide the sample data into a training set and a validation set according to a preset ratio of 2:3, iteratively train the training set and the validation set to obtain the information audit analysis model of the operation information; the value range of the information audit value is (5~10), the larger the value of the information audit value, the more abnormal the operation information, and the smaller the value of the information audit value, the more normal the operation information.

[0029] Signature event independent analysis module: obtain the signature event number of each signature log (each signature log corresponds to a signature event number, which is used to indicate the signature event to which the signature log belongs, and the signature logs of the same signature event have the same number), mark the signature logs with the same signature event number as the same event signature logs, and then obtain the signature independent event management value of each signature event.

[0030] The signature independent event management value of the signature event is obtained in the following way: obtain all the signature logs of the same event of the signature event, obtain the signature log audit value of each signature log of the same event, obtain the log time of each signature log of the same event (that is, the generation time corresponding to the signature log), sort all the signature logs of the same event in the order of log time, calculate the difference between the signature log audit values ​​of the two adjacent signature logs of the same event after sorting and take the absolute value to obtain the audit floating value, sum up all the audit floating values ​​and take the average to obtain the audit The floating mean Tadz sets the audit limit of the signature log. The audit limit of the signature log is a threshold set by the system. The specific value can be adjusted according to the needs. When the audit value of the signature log is greater than or equal to the audit limit of the signature log, the signature log of the same event is marked as an abnormal log of the signature event. When the audit value of the signature log is less than the audit limit of the signature log, the signature log of the same event is marked as a normal log of the signature event. The total number of abnormal logs of the signature event is marked as Gkrt, and the total number of normal logs of the signature event is marked as Sbep. Using the formula The signature independent event management value Dsgg of the signature event is obtained, where s1 is the first event coefficient, s2 is the second event coefficient, the value of s1 is 3.59, and the value of s2 is 2.81.

[0031] Signature event linkage analysis module: construct the signature event spectrum of each signature event, and then obtain the signature linkage event management value of each signature event, set the signature linkage event management boundary value, the signature linkage event management boundary value is a threshold set by the system, and the specific value can be adjusted according to demand. When the signature linkage event management value is greater than the signature linkage event management boundary value, the signature event is marked as an abnormal response event. When the signature linkage event management value is less than or equal to the signature linkage event management boundary value, no processing is performed.

[0032] The signature linkage management value of the signature event is obtained in the following way: the signature independent management value Dsgg of the signature event, marking the remaining signature events in the signature event spectrum that have event influence lines with the signature event as linkage events, obtaining the linkage influence value YZ of each linkage event, summing up the linkage influence values ​​of all linkage events to obtain the total linkage influence value Zyz, and using the formula Hfs=Dsgg*b1+Zyz*b2 to obtain the signature linkage management value Hfs of the signature event, where b1 is the second signature independent management value coefficient, b2 is the total linkage influence value coefficient, the value of b1 is 1.21, and the value of b2 is 0.37.

[0033] The linkage impact value of the linkage event is obtained by the following method: obtain the signature independent management value Dsgg of the linkage event, obtain the total number of event influence lines between the signature event and the linkage event, and mark it as AKd, and use the formula The linkage impact value YZ of the linkage event is obtained, where z1 is the independent management value coefficient of the first signature, z2 is the event influence line quantity coefficient, the value of z1 is 0.67, and the value of z2 is 0.85.

[0034] All signature events in the system are included in a signature event spectrum. All signature events are displayed in the signature event spectrum in the form of signature event numbers. The signature event spectrum is used to show the association between each signature event. The association types of signature events include but are not limited to signatory identity association (that is, two signature events belong to the same signatory), project association (that is, two signature events belong to the same project), and clause association (that is, two signature events contain the same clause). When there are i types of associations between two signature events, there are i event influence lines between the two signature events; for example: when there is a signatory identity association and a project association between signature event a and signature event b, there are 2 event influence lines between signature event a and signature event b.

[0035] Signature event abnormal response module: the signature linkage management value of the abnormal response event is calculated by the difference between the signature linkage management value and the signature linkage management boundary value to obtain the abnormal response value Bk. The abnormal response value Bk contains multiple ranges. Each range of abnormal response values ​​corresponds to an abnormal response level. The range of abnormal response values ​​is (0, B1], (B1, B2], ..., (Bk-1, Bk], and the abnormal response levels include abnormal response level 1, abnormal response level 2, ..., abnormal response level k-1, and abnormal response level k. The higher the abnormal response level, the greater the abnormal impact of the signature event, and the more rapid response and processing are required.

[0036] By setting up an independent analysis module for signature events and a linkage analysis module for signature events, it is possible to conduct a three-dimensional analysis of the signature logs between signature events from both independent and linkage aspects, and accurately determine whether a signature event is abnormal. By setting up an abnormal response module for signature events, it is possible to accurately assess the abnormal response level of abnormal response events, making it easier for relevant personnel to accurately control abnormal response events based on the abnormal response level.

[0037] The above formulas are all dimensionless and numerical calculations. The formula is a formula for the most recent real situation obtained by collecting a large amount of data and performing software simulation. The preset parameters in the formula are set by technicians in this field according to actual conditions.

[0038] The above embodiments can be implemented in whole or in part by software, hardware, firmware or any other combination. When implemented by software, the above embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website site, computer, server or data center to another website site, computer, server or data center by wired or wireless (e.g., infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that contains one or more available media sets. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium. The semiconductor medium can be a solid-state hard disk.

[0039] It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0040] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0041] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0042] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0043] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage media include: various media that can store program codes, such as USB flash drives, mobile hard disks, read-only memories (ROM), random access memories (RAM), magnetic disks or optical disks.

[0044] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A signature log audit management system based on artificial intelligence, characterized in that: It includes signature log audit module, signature event independent analysis module, signature event linkage analysis module, and signature event abnormal response module; The signature log audit module: every c time period, count all the signature logs generated by the system within c time period, and obtain the signature log audit value of each signature log; The signature event independent analysis module: obtains the signature event number of each signature log, marks the signature logs with the same signature event number as the same event signature logs, and then obtains the signature independent event management value of each signature event; The signature event linkage analysis module: obtains the signature linkage event management value of each signature event, and determines whether to mark the signature event as an abnormal response event based on the comparison result between the signature linkage event management value and the signature linkage event management boundary value; The signature event abnormal response module determines the abnormal response level of the abnormal response event.

2. According to the artificial intelligence-based signature log audit management system of claim 1, it is characterized in that: The signature log audit value of the signature log is obtained in the following way: obtain each type of information contained in the signature log, obtain the information audit value of each type of information, set the information audit standard value, when the information audit value is greater than or equal to the information audit standard value, mark the type of information as different information, when the information audit value is less than the information audit standard value, do not process it, mark the total number of different information as Rymd, pack all different information into a group, sum the information audit values ​​of the two different information in the same group, obtain the different additional value, set the different information Additional threshold, when the additional value of the difference is greater than or equal to the additional threshold of the difference, the additional number of the difference will be increased by one, when the additional value of the difference is less than the additional threshold of the difference, no processing will be done, and the additional number of the difference will be marked as Mdsk, the difference of the information audit values ​​of the two difference information in the same group will be calculated and the absolute value will be taken to obtain the outstanding value of the difference, and the outstanding threshold of the difference will be set. When the outstanding value of the difference is greater than or equal to the outstanding threshold of the difference, the outstanding number of the difference will be increased by one, when the outstanding value of the difference is less than the outstanding threshold of the difference, no processing will be done, and the outstanding number of the difference will be marked as Pthg, using the formula The signature log audit value Kst of the signature log is obtained, where v1 is the coefficient of the number of difference information, v2 is the coefficient of the additional number of difference, and v3 is the coefficient of the outstanding number of difference.

3. According to the artificial intelligence-based signature log audit management system of claim 2, it is characterized in that: The information audit value of each type of information is obtained in the following manner: obtain the information audit analysis model of each type of information, format each type of information, input each type of formatted information into the corresponding information audit analysis model, and output the information audit value of each type of information.

4. According to the artificial intelligence-based signature log audit management system of claim 1, it is characterized in that: The signature independent event management value of the signature event is obtained in the following way: obtain all the signature logs of the same event of the signature event, obtain the signature log audit value of each signature log of the same event, obtain the log time of each signature log of the same event, sort all the signature logs of the same event in the order of log time, calculate the difference between the signature log audit values ​​of two adjacent signature logs of the same event after sorting and take the absolute value to obtain the audit floating value, sum up all the audit floating values ​​and take the average to obtain the audit floating mean Tadz, set the signature log audit limit, when the signature log audit value is greater than or equal to the signature log audit limit, mark the signature log of the same event as the abnormal signature event log, when the signature log audit value is less than the signature log audit limit, mark the signature log of the same event as the normal signature event log, mark the total number of abnormal signature event logs as Gkrt, mark the total number of normal signature event logs as Sbep, and use the formula The signature independent event value Dsgg of the signature event is obtained, where s1 is the first event coefficient and s2 is the second event coefficient.

5. According to the artificial intelligence-based signature log audit management system of claim 1, it is characterized in that: Construct a signature event spectrum for each signature event, and then obtain the signature linkage event management value of each signature event, and set the signature linkage event management boundary value. The signature linkage event management boundary value is a threshold set by the system. The specific value can be adjusted according to demand. When the signature linkage event management value is greater than the signature linkage event management boundary value, the signature event is marked as an abnormal response event. When the signature linkage event management value is less than or equal to the signature linkage event management boundary value, no processing is performed.

6. According to the artificial intelligence-based signature log audit management system of claim 1, it is characterized in that: The signature linkage management value of the signature event is obtained in the following way: the signature independent management value Dsgg of the signature event, marking the remaining signature events in the signature event spectrum that have event influence lines with the signature event as linkage events, obtaining the linkage influence value YZ of each linkage event, summing up the linkage influence values ​​of all linkage events to obtain the total linkage influence value Zyz, and using the formula Hfs=Dsgg*b1+Zyz*b2 to obtain the signature linkage management value Hfs of the signature event, where b1 is the second signature independent management value coefficient, and b2 is the linkage influence total value coefficient.

7. According to the artificial intelligence-based signature log audit management system of claim 6, it is characterized in that: The linkage impact value of the linkage event is obtained by the following method: obtain the signature independent management value Dsgg of the linkage event, obtain the total number of event influence lines between the signature event and the linkage event, and mark it as AKd, and use the formula The linkage impact value YZ of the linkage event is obtained, where z1 is the independent management value coefficient of the first signature, and z2 is the event influence line quantity coefficient.

8. According to the artificial intelligence-based signature log audit management system of claim 1, it is characterized in that: Determine the abnormal response level of the abnormal response event, specifically: calculate the difference between the signature linkage management value of the abnormal response event and the signature linkage management boundary value to obtain the abnormal response value Bk, the abnormal response value Bk contains multiple ranges, each range of abnormal response values ​​corresponds to an abnormal response level, the range of abnormal response values ​​is (0, B1], (B1, B2], ..., (Bk-1, Bk], the abnormal response level includes abnormal response level 1, abnormal response level 2, ..., abnormal response level k-1, abnormal response level k, the higher the abnormal response level, the greater the abnormal impact of the signature event.

Images