Express delivery network fraud behavior mining method and device, equipment and storage medium

Abstract

The invention relates to the technical field of information processing, in particular to an express outlet fraudulent behavior mining method, device and equipment and a storage medium. First comprehensive data and second comprehensive data are integrated, data preprocessing is performed on the integrated data, the preprocessed data are classified, and operation text data, picture data and video data are obtained; key features closely related to fraudulent behaviors are extracted from operation text data, picture data and video data, an intelligent recognition model is obtained through training of the key features, express real-time data are input into the intelligent recognition model to be analyzed, and a website fraudulent behavior analysis result is obtained. The processing measure information is generated according to the website fraudulent behavior analysis result, the fraudulent behavior of the express website can be automatically identified, the corresponding processing measure is automatically generated according to the fraudulent behavior, human intervention misjudgment is reduced, the identification processing efficiency of the fraudulent behavior is improved, enterprise internal management is optimized, consumer rights and interests are protected, and customer satisfaction is improved.

Description

Technical Field

[0001] The present invention relates to the field of information processing technology, and in particular to a method, device, equipment and storage medium for mining fraudulent behavior at express delivery outlets. Background Art

[0002] At present, due to the huge volume of business and numerous outlets in the express delivery industry, fraud often occurs frequently. At the same time, due to the high degree of dispersion and complexity of the express delivery industry, regulatory authorities face great difficulties in implementing supervision, especially for some remote areas or small express delivery outlets. It is difficult for regulatory forces to fully cover and easy to form regulatory blind spots. In addition, some fraudulent behaviors are concealed and difficult to be discovered and handled in a timely manner. With the enhancement of consumers' awareness of protecting their own rights and interests, complaints against fraudulent behaviors in express delivery outlets are increasing. These complaints are reflected through different channels, such as consumer associations, express delivery company customer service, social media, etc. Fraudulent behaviors in express delivery outlets are diverse, including but not limited to private charges, false signatures, deliberate delays in delivery, falsely claiming packages, and refusal to deliver beyond the zone. These behaviors not only damage the rights and interests of consumers, but also affect the overall image of the express delivery industry. Some express delivery companies have deficiencies in internal management and poor supervision of outlets, which leads to violations in some outlets during operation. When facing fraudulent behaviors, consumers find it difficult to safeguard their legitimate rights and interests due to the lack of effective channels and means for rights protection. In addition, when dealing with fraudulent behaviors in express delivery outlets, there is a lack of clear punishment standards, which reduces customer satisfaction. Summary of the invention

[0003] In order to overcome the shortcomings of the prior art, the purpose of the present invention is to provide a method, device, equipment and storage medium for mining fraudulent behavior in express delivery outlets, which can automatically identify fraudulent behavior in express delivery outlets and automatically generate corresponding processing measures based on the fraudulent behavior, reduce human intervention and misjudgment, improve the efficiency of identifying and processing fraudulent behavior, optimize internal management of the enterprise, protect consumer rights and interests, and improve customer satisfaction.

[0004] A first aspect of the present invention provides a method for mining fraudulent behavior in express delivery outlets, comprising: collecting first comprehensive data from an internal data source, the first comprehensive data including order details information, image and video information, financial information and customer complaint records, obtaining second comprehensive data from an external data source, the second comprehensive data including geographic location information, real-time weather conditions and social media user feedback; integrating the first comprehensive data and the second comprehensive data to obtain integrated data, performing data preprocessing on the integrated data to obtain preprocessed data; classifying the preprocessed data to obtain operational text data, picture data and video data, extracting key features closely related to fraudulent behavior from the operational text data, the picture data and the video data; using the key features to train an intelligent recognition model to receive real-time express data uploaded by an outlet terminal; inputting the real-time express data into the intelligent recognition model for analysis to obtain an analysis result of outlet fraudulent behavior, and generating processing measure information according to the analysis result of outlet fraudulent behavior.

[0005] Optionally, in a first implementation manner of the first aspect of the present invention, the first comprehensive data is collected from an internal data source, and the first comprehensive data includes order details information, image and video information, financial information, and customer complaint records; and the second comprehensive data is obtained from an external data source, and the second comprehensive data includes geographic location information, real-time weather conditions, and social media user feedback, including: collecting the first comprehensive data from an internal data source, and the first comprehensive data includes order details information, financial information, customer complaint records, and images and video information shot in key operating areas and processes; obtaining the second comprehensive data from an external data source, and the second comprehensive data includes geographic location information, real-time weather conditions, and social media user feedback; and performing data tagging on the first comprehensive data and the second comprehensive data.

[0006] Optionally, in a second implementation method of the first aspect of the present invention, the first comprehensive data and the second comprehensive data are integrated to obtain integrated data, and the integrated data is preprocessed to obtain preprocessed data, including: integrating the first comprehensive data and the second comprehensive data to obtain integrated data; performing data cleaning on the integrated data to obtain cleaned data; and converting the cleaned data into a standardized format to obtain preprocessed data.

[0007] Optionally, in a third implementation method of the first aspect of the present invention, the pre-processed data is classified to obtain operational text data, picture data and video data, and key features closely related to fraudulent behavior are extracted from the operational text data, the picture data and the video data, including: classifying the pre-processed data to obtain operational text data, picture data and video data; extracting a first key feature closely related to fraudulent behavior from the operational text data, the first key feature including order anomalies, logistics delays and financial data mismatches; extracting a second key feature closely related to fraudulent behavior from the picture data and the video data, the second key feature including changes in personnel behavior and changes in item status; integrating the first key feature and the second key feature to obtain a key feature.

[0008] Optionally, in a fourth implementation method of the first aspect of the present invention, the intelligent recognition model is obtained by training with the key features, and the real-time express data uploaded by the outlet terminal is received, including: selecting a clustering algorithm model, training the clustering algorithm model with the key features, and obtaining an intelligent recognition model; creating a listener, and using the listener to listen to the real-time express information uploaded by the outlet terminal; when the listener listens to the real-time express information, receiving the current real-time express information; parsing the real-time express information to obtain the real-time express data.

[0009] Optionally, in a fifth implementation method of the first aspect of the present invention, the real-time express data is input into the intelligent recognition model for analysis to obtain an analysis result of outlet fraud behavior, and processing measure information is generated according to the outlet fraud behavior analysis result, including: inputting the real-time express data into the intelligent recognition model for analysis to obtain an analysis result of outlet fraud behavior; calling a preset fraud behavior processing solution comparison table to identify the mapping relationship between the outlet fraud behavior analysis result and the fraud behavior processing solution comparison table; matching the corresponding processing solution in the fraud behavior processing solution comparison table according to the mapping relationship, and generating processing measure information according to the processing solution.

[0010] Optionally, in a sixth implementation method of the first aspect of the present invention, after the real-time express data is input into the intelligent recognition model for analysis to obtain an analysis result of outlet fraud behavior, and processing measure information is generated according to the analysis result of the outlet fraud behavior, it also includes: encrypting the processing measure information using a public key in a preset key pair to obtain encrypted processing measure information; uploading the encrypted processing measure information to the blockchain, and sending the encrypted processing measure information and the private key in the key pair to the outlet terminal; reviewing the outlet fraud behavior analysis result to obtain a review result; and optimizing and adjusting the intelligent recognition model according to the review result.

[0011] The second aspect of the present invention provides a device for mining fraudulent behavior of express delivery outlets, including: a collection and acquisition module, used to collect first comprehensive data from an internal data source, the first comprehensive data including order details information, image and video information, financial information and customer complaint records, and obtain second comprehensive data from an external data source, the second comprehensive data including geographic location information, real-time weather conditions and social media user feedback; an integration and processing module, used to integrate the first comprehensive data and the second comprehensive data to obtain integrated data, and perform data preprocessing on the integrated data to obtain preprocessed data; a classification and extraction module, used to classify the preprocessed data to obtain operational text data, picture data and video data, and extract key features closely related to fraudulent behavior from the operational text data, the picture data and the video data; a training and receiving module, used to train with the key features to obtain an intelligent recognition model, and receive real-time express data uploaded by the outlet terminal; an analysis and generation module, used to input the real-time express data into the intelligent recognition model for analysis, obtain an analysis result of outlet fraud behavior, and generate processing measure information according to the analysis result of outlet fraud behavior.

[0012] Optionally, in a first implementation manner of the second aspect of the present invention, the collection and acquisition module includes: a collection unit, used to collect first comprehensive data from an internal data source, the first comprehensive data including order details information, financial information, customer complaint records, and images and video information shot in key operating areas and processes; an acquisition unit, used to acquire second comprehensive data from an external data source, the second comprehensive data including geographic location information, real-time weather conditions, and social media user feedback; a marking unit, used to perform data marking on the first comprehensive data and the second comprehensive data.

[0013] Optionally, in a second implementation method of the second aspect of the present invention, the integration processing module includes: a first integration unit, used to integrate the first comprehensive data and the second comprehensive data to obtain integrated data; a cleaning unit, used to perform data cleaning on the integrated data to obtain cleaned data; and a conversion unit, used to perform standardized format conversion processing on the cleaned data to obtain preprocessed data.

[0014] Optionally, in a third implementation method of the second aspect of the present invention, the classification and extraction module includes: a classification unit, used to classify the pre-processed data to obtain operational text data, picture data and video data; a first extraction unit, used to extract a first key feature closely related to fraudulent behavior from the operational text data, the first key feature including order anomalies, logistics delays and financial data mismatches; a second extraction unit, used to extract a second key feature closely related to fraudulent behavior from the picture data and the video data, the second key feature including changes in personnel behavior and changes in item status; a second integration unit, used to integrate the first key feature and the second key feature to obtain a key feature.

[0015] Optionally, in a fourth implementation of the second aspect of the present invention, the training receiving module includes: selecting a training unit, used to select a clustering algorithm model, using the key features to train the clustering algorithm model to obtain an intelligent recognition model; creating a monitoring unit, used to create a listener, using the listener to monitor the real-time express information uploaded by the outlet terminal; a receiving unit, used to receive the current real-time express information when the listener monitors the real-time express information; and a parsing unit, used to parse the real-time express information to obtain real-time express data.

[0016] Optionally, in a fifth implementation of the second aspect of the present invention, the analysis generation module includes: an analysis unit, used to input the real-time express data into the intelligent recognition model for analysis to obtain an analysis result of fraud behavior at the outlet; a calling recognition unit, used to call a preset fraud behavior processing solution comparison table to identify the mapping relationship between the fraud behavior analysis result at the outlet and the fraud behavior processing solution comparison table; a matching generation unit, used to match the corresponding processing solution in the fraud behavior processing solution comparison table according to the mapping relationship, and generate processing measure information according to the processing solution.

[0017] Optionally, in a sixth implementation method of the second aspect of the present invention, it also includes: an encryption module, used to encrypt the processing measure information using a public key in a preset key pair to obtain encrypted processing measure information; an upload and sending module, used to upload the encrypted processing measure information to the blockchain, and send the encrypted processing measure information and the private key in the key pair to the branch terminal; a review module, used to review the branch fraud behavior analysis results to obtain review results; an optimization and adjustment module, used to optimize and adjust the intelligent recognition model according to the review results.

[0018] The third aspect of the present invention provides a device for mining fraudulent behavior of express delivery outlets, and the device comprises: a memory and at least one processor, wherein instructions are stored in the memory; at least one of the processors calls the instructions in the memory to enable the device for mining fraudulent behavior of express delivery outlets to execute each step of the method for mining fraudulent behavior of express delivery outlets described above.

[0019] A fourth aspect of the present invention provides a computer-readable storage medium having instructions stored thereon, and when the instructions are executed by a processor, the various steps of any of the above-mentioned methods for mining fraudulent behavior of express delivery outlets are implemented.

[0020] In the technical solution of the present invention, the first comprehensive data and the second comprehensive data are integrated, the integrated data are preprocessed, the preprocessed data are classified to obtain operational text data, picture data and video data, key features closely related to fraudulent behavior are extracted from the operational text data, picture data and video data, an intelligent recognition model is obtained by training with the key features, and the real-time express delivery data is input into the intelligent recognition model for analysis to obtain the analysis results of the fraudulent behavior of the outlets, and processing measure information is generated according to the analysis results of the fraudulent behavior of the outlets. The fraudulent behavior of the express delivery outlets can be automatically identified, and corresponding processing measures can be automatically generated according to the fraudulent behavior, thereby reducing human intervention and misjudgment, improving the efficiency of identifying and processing fraudulent behavior, optimizing internal management of the enterprise, protecting consumer rights and interests, and improving customer satisfaction. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 A first flow chart of the method for mining fraudulent behavior at express delivery outlets provided by an embodiment of the present invention;

[0022] Figure 2 A second flow chart of the method for mining fraudulent behavior at express delivery outlets provided by an embodiment of the present invention;

[0023] Figure 3 A third flow chart of the method for mining fraudulent behavior at express delivery outlets provided by an embodiment of the present invention;

[0024] Figure 4 A fourth flow chart of the method for mining fraudulent behavior at express delivery outlets provided by an embodiment of the present invention;

[0025] Figure 5 A schematic diagram of a structure of a device for mining fraudulent behaviors of express delivery outlets provided by an embodiment of the present invention;

[0026] Figure 6 Another structural schematic diagram of the device for mining fraudulent behaviors of express delivery outlets provided by an embodiment of the present invention;

[0027] Figure 7 A schematic diagram of the structure of a device for mining fraudulent behavior at express delivery outlets provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0028] The present invention provides a method, device, equipment and storage medium for mining fraudulent behavior in express delivery outlets, which can automatically identify fraudulent behavior in express delivery outlets and automatically generate corresponding processing measures according to the fraudulent behavior, reduce human intervention and misjudgment, improve the efficiency of identifying and processing fraudulent behavior, optimize internal management of the enterprise, protect consumer rights and interests, and improve customer satisfaction.

[0029] The terms "first", "second", "third", "fourth", etc. (if any) in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "including" or "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0030] For ease of understanding, the specific process of the embodiment of the present invention is described below. Figure 1 An embodiment of the method for mining fraudulent behavior of express delivery outlets in the embodiment of the present invention includes:

[0031] 101. Collecting first comprehensive data from an internal data source, the first comprehensive data including order details information, image and video information, financial information, and customer complaint records, and obtaining second comprehensive data from an external data source, the second comprehensive data including geographic location information, real-time weather conditions, and social media user feedback;

[0032] In this embodiment, first comprehensive data is collected from an internal data source. The first comprehensive data includes order details information, image and video information, financial information, and customer complaint records. Order details information includes order number, customer information, product information, order time, payment method, delivery status, etc. Order details information is the basis for detecting fraud and can identify abnormal transaction patterns, such as frequent small transactions, multiple refunds for the same customer, etc. Image and video information includes images of goods in the warehouse, video surveillance of couriers during delivery, photo records during the delivery process, etc. Through visual data, it is possible to verify whether the appearance and quantity of the package are consistent with the actual delivery note, and identify potential package tampering. Financial information includes payment records, billing information, refund records, and transaction anomaly logs, etc. Financial data can help identify unusual financial activities, such as high-frequency refunds or payment failure records, which are potential fraud indicators. Customer complaint records contain customer complaint information about service quality, damaged goods, non-receipt of goods, etc. Customer complaints can often reflect problems in the service process. If a customer complains frequently, it may indicate improper service or fraud. The second comprehensive data is obtained from external data sources. The second comprehensive data includes geographic location information, real-time weather conditions, and social media user feedback. Geographic location information includes geographic location data of order shipment and delivery, which is obtained by combining GPS and geographic information system (GIS). It helps to verify the authenticity of the order. For example, a customer who frequently places orders in an unusual geographic location may indicate fraud. Real-time weather conditions include weather data when the order is shipped, such as temperature, precipitation, wind speed and other information. Weather conditions can affect the logistics process. For example, bad weather may cause delays, which is particularly important when analyzing complaints and delivery anomalies. Social media user feedback is comments, ratings and shopping experiences shared by users about the company collected from social media platforms, which can provide real-time information about the company's reputation. Negative social media reviews may be related to potential fraud or service problems.

[0033] 102. Integrate the first integrated data and the second integrated data to obtain integrated data, and perform data preprocessing on the integrated data to obtain preprocessed data;

[0034] In this embodiment, a more comprehensive view can be formed by integrating the first comprehensive data and the second comprehensive data. The integrated data will cover all aspects of the order, including order details, financial information, customer feedback and external environmental factors (such as geographic location and weather), which will help to more accurately identify potential fraud. The fields that need to be integrated are formatted in each data source, and the internal and external data are connected using a suitable merging method (such as SQL's JOIN operation, the merge function in Python's Pandas library, etc.), and the order number is used as the primary key for merging to ensure that all relevant information can be gathered in one row, and unnecessary information and irrelevant data (such as internal IDs generated by the system, etc.) are deleted to ensure that the data set contains only fields that are meaningful for analysis. According to the missing value strategy previously processed, the missing data is filled or deleted, and statistical methods (such as Z-score or IQR) are used to detect and process outliers, and the original data is converted into a standard format.

[0035] 103. Classify the preprocessed data to obtain operational text data, image data, and video data, and extract key features closely related to fraudulent behavior from the operational text data, image data, and video data;

[0036] In this embodiment, the preprocessed data is classified to obtain operational text data, image data and video data. The operational text data includes customer comments, product descriptions, transaction records, complaint records, etc. The image data includes images of the warehouse and photo records during the delivery process. The video data includes video surveillance of couriers during delivery. Through natural language processing (NLP) technology, sentiment analysis is performed on customer comments and complaints to identify the correlation between negative emotions (such as anger, disappointment, etc.) and fraudulent behavior. TF-IDF and word embedding (Word Embedding) or topic models (such as LDA) to extract key topics and keywords, identify frequently occurring terms related to fraud, analyze text features such as length, complexity, and sentence structure, identify possible abnormal behaviors, and then extract key features from operational text data, use computer vision technology (such as convolutional neural networks, CNN) to analyze image content, identify whether the product meets the description, check the clarity and exposure of the image, etc. Low-quality images may indicate that the user is trying to hide certain information, which may be related to fraud, compare product images with images of products in the standard library, detect abnormal images (such as modification, splicing, etc.), identify whether there is a risk of fraud, and then extract key features from image data, extract key frames from videos, and analyze these frames to identify possible fraud (such as customer fraud, false promises, etc.), use action recognition technology to analyze customer behavior in the video, identify abnormal behavior patterns (such as deliberate unpacking, false display, etc.), analyze the audio in the video, use speech recognition technology to extract key information, identify possible fraud warnings or dishonest statements, and then extract key features from video data.

[0037] 104. Use key features to train an intelligent recognition model and receive real-time express delivery data uploaded by the outlet terminals;

[0038] In this embodiment, according to the characteristics and objectives of the data, a suitable machine learning model is selected, the extracted feature set is divided into a training set and a validation set, the training set is used to train the model, the model parameters are continuously updated through the back propagation algorithm, the performance of the model on the validation set is monitored, the model effect is evaluated using indicators such as accuracy, recall, and F1-score, the model performance is optimized through hyperparameter tuning (such as grid search, random search), the stability and generalization ability of the model are evaluated using a cross-validation method, and the model performs well on unseen data. A system interface is designed to receive the express data uploaded by the outlet terminal in real time to ensure that the data can flow into the system in time for processing, so as to use technologies such as API or message queues (such as Kafka) to achieve real-time data transmission, and the received express data is preprocessed, including cleaning, conversion, and feature extraction, to ensure that the data format is consistent with the model input.

[0039] 105. Input the real-time express delivery data into the intelligent recognition model for analysis to obtain the analysis results of the outlet fraud behavior, and generate processing measures information based on the analysis results of the outlet fraud behavior;

[0040] In this embodiment, the preprocessed data is converted into the input format required by the model, and batch inference is performed in the model to improve real-time processing efficiency. The model generates a fraud risk score (such as a floating value between 0 and 1) for each express record. The higher the score, the greater the fraud risk. The express record is classified as "normal", "suspicious" or "fraudulent" by setting a threshold (such as a risk score greater than 0.7 is suspicious), and the results of the fraud behavior analysis of the outlets are obtained, and the processing measures information is generated according to the results of the fraud behavior analysis of the outlets.

[0041] In an embodiment of the present invention, the first comprehensive data and the second comprehensive data are integrated, the integrated data are preprocessed, and the preprocessed data are classified to obtain operational text data, picture data, and video data, and key features closely related to fraudulent behavior are extracted from the operational text data, picture data, and video data. An intelligent recognition model is obtained by training with the key features, and the real-time express delivery data is input into the intelligent recognition model for analysis to obtain an analysis result of the fraudulent behavior at the outlets. Processing measure information is generated based on the analysis result of the fraudulent behavior at the outlets, and fraudulent behavior at the express delivery outlets can be automatically identified, and corresponding processing measures can be automatically generated based on the fraudulent behavior, thereby reducing human intervention and misjudgment, improving the efficiency of identifying and processing fraudulent behavior, optimizing internal enterprise management, protecting consumer rights, and improving customer satisfaction.

[0042] See also Figure 2 The second embodiment of the method for mining fraudulent behavior of express delivery outlets in the embodiment of the present invention includes:

[0043] 201. Collecting first comprehensive data from internal data sources, the first comprehensive data including order details information, financial information, customer complaint records, and image and video information captured in key operating areas and processes;

[0044] In this embodiment, order details are collected from the order management system, financial information is collected from the financial management system, customer complaint records are collected from the customer service system, and image and video information are collected from acquisition systems such as surveillance cameras and operators' mobile devices.

[0045] 202. Obtain second comprehensive data from an external data source, where the second comprehensive data includes geographic location information, real-time weather conditions, and social media user feedback;

[0046] In this embodiment, map service APIs (such as Google Maps API, Baidu Maps API, etc.) are used to obtain location data, regional boundaries and geographic feature data are obtained from open source geographic information systems (GIS), meteorological service APIs (such as OpenWeatherMap, WeatherAPI, National Meteorological Administration, etc.) are used to obtain real-time weather data, and historical meteorological data can be used as a supplement to facilitate trend analysis. Social media APIs (such as Twitter API, Facebook Graph API, Instagram API, etc.) are used to extract relevant user feedback data, and discussions about specific keywords or topics are collected through social media monitoring tools (such as Hootsuite, Brandwatch, etc.).

[0047] 203. Mark the first comprehensive data and the second comprehensive data;

[0048] In this embodiment, data is classified according to its characteristics (such as "positive", "negative", and "neutral"), attribute labels are added to the data (such as "clear weather", "high user satisfaction"), text data is marked in a fine-grained manner, keywords, topics, and sentiment tendencies are extracted, the time characteristics of the data are marked to facilitate time series analysis, regional characteristics are marked according to the user's geographic location, social media user feedback is marked, keywords and sentiment scores are extracted, time and location information are marked, labels are added to real-time weather data (such as "heavy rain", "sunny", "cooling", etc.), and user feedback is associated.

[0049] 204. Integrate the first integrated data and the second integrated data to obtain integrated data;

[0050] In this embodiment, the formats of the two data sets are ensured to be consistent, such as date format, data type, unit, etc., and the first integrated data and the second integrated data are integrated through a common field.

[0051] 205. Perform data cleaning on the integrated data to obtain cleaned data;

[0052] In this embodiment, a data analysis tool is used to detect missing values, process the missing values, use the tool to identify duplicate values ​​in the data set, delete duplicate values, identify outliers, and choose to delete or replace outliers according to business rules to obtain cleaned data.

[0053] 206. Perform standardized format conversion processing on the cleaned data to obtain pre-processed data;

[0054] In this embodiment, the data types are unified to ensure that the data types of all fields are consistent with expectations, the date formats are unified to ensure that all date fields use the same format to facilitate time series analysis, the string formats are unified to ensure the consistency of string data, including removing spaces, converting uppercase and lowercase, etc., converting categorical variables to categorical types and unifying category names, and formatting numerical data to ensure that the representation of numerical data is consistent, including decimal places, thousands separators, etc.

[0055] 207. Classify the preprocessed data to obtain operational text data, image data, and video data;

[0056] In this embodiment, the data is classified according to its format and file extension, and regular expressions or string matching are used to classify the data to obtain operational text data, picture data, and video data.

[0057] 208. Extract the first key features closely related to fraudulent behavior from the operational text data. The first key features include order anomalies, logistics delays, and financial data mismatches.

[0058] In this embodiment, order anomaly refers to abnormal conditions in order information, such as an order amount that is too high or an abnormal order frequency, etc. Logistics delay refers to a situation in which the delivery time exceeds the normal range in the logistics information of an order. Financial data mismatch refers to a situation in which the financial information related to the order (such as payment information and refund information) is inconsistent. The first key feature closely related to fraud is extracted from the operational text data, a threshold is set, abnormal order amount or abnormal order frequency is identified, the difference between the actual logistics delivery time and the expected delivery time is calculated, it is determined whether there is a delay, the payment status and refund information are compared, orders with inconsistent financial data are identified, and the extracted features are summarized into a new data structure.

[0059] 209. Extracting a second key feature closely related to fraudulent behavior from the image data and the video data, the second key feature including changes in personnel behavior and changes in item status;

[0060] In this embodiment, the change of personnel behavior refers to the identification of abnormal behavior patterns of personnel in video surveillance or pictures. By analyzing the changes in personnel behavior, possible fraudulent behaviors are identified, such as unusual purchasing behaviors, abnormal entry and exit scenes, etc. The change of object status refers to the identification of the change of object status during the monitoring process, and the tracking of the change of object status during transportation or storage, so as to timely discover potential fraudulent activities, such as damage or loss of objects. Computer vision technologies, such as motion detection, behavior recognition, target tracking, etc., are used to analyze the changes in personnel behavior in the scene. Through image processing and object detection technology, the change of object status is monitored. For example, convolutional neural network (CNN) is used for object detection and classification, and then the second key feature closely related to fraudulent behavior is extracted from the image data and video data. After the features of personnel behavior changes and object status changes are extracted, they can be integrated into a new data structure.

[0061] 210. Integrate the first key feature and the second key feature to obtain a key feature;

[0062] In this embodiment, a unified data structure is designed to store integrated feature information, the first key feature and the second key feature are integrated, and the integrated information is used to generate new features. For example, if a person is found to have frequent entry and exit behavior, check whether there is any change in the status of the item within the same time period, or whether the payment is abnormal.

[0063] In the embodiment of the present invention, by collecting comprehensive data from internal and external data sources, the process covers information from multiple aspects and ensures a multi-dimensional analysis of fraudulent behavior. This comprehensive data collection helps to form more accurate insights and reduce the risk of missing key factors. The systematic processing of steps such as data labeling, cleaning, standardization and classification ensures the quality and consistency of data, laying a solid foundation for subsequent analysis. This structured method reduces human errors in the data processing process and improves the availability of data. By analyzing operational text data, image data and video data, key features closely related to fraudulent behavior can be extracted. This targeted feature extraction improves the sensitivity and accuracy of the model in fraud detection. The integration of the first and second key features provides a richer information dimension, which helps to improve the recognition and prediction effects. Such integration can enhance the predictive ability of the model and make it more practical. The design of the process allows the continuous introduction of new data and features in subsequent operations, so that the fraud detection system can be continuously optimized as the environment changes and maintain its effectiveness and adaptability. Through in-depth analysis and integrated data, it can provide stronger support for decision-making, help the operation team quickly identify potential fraud risks, and thus take corresponding measures to improve operational efficiency and customer satisfaction.

[0064] See also Figure 3 The third embodiment of the method for mining fraudulent behavior of express delivery outlets in the embodiment of the present invention includes:

[0065] 301. Select a clustering algorithm model, and use key features to train the clustering algorithm model to obtain an intelligent recognition model;

[0066] In this embodiment, a clustering algorithm model is selected, key features are divided into a training set and a validation set, and the model is trained using the training set to obtain an intelligent recognition model.

[0067] 302. Create a listener, and use the listener to monitor the real-time express information uploaded by the network terminal;

[0068] In this embodiment, a listener is created and designed to be modular. An event-driven architecture is used to achieve efficient real-time data processing. An API interface is created for the branch terminal in a RESTful or GraphQL style for the terminal to send express information. The listener is used to monitor the real-time express information uploaded by the branch terminal.

[0069] 303. When the listener listens to the real-time express information, it receives the current real-time express information;

[0070] In this embodiment, the routing function of the framework such as Flask is used to listen to the received request to ensure that the interface is available and can respond quickly. When the listener listens to the real-time express information, the current real-time express information is received. After receiving the data, the verification rules are defined to ensure the integrity and correctness of the data. The verification function is called during the data processing process. If the verification fails, the error information is recorded and an error response is returned.

[0071] 304. Analyze the real-time express information to obtain real-time express data;

[0072] In this embodiment, the structure and format of the express information are clarified, the required fields are extracted from the received JSON data, the extracted data fields are mapped to specific variables or data structures according to business needs, and the format of certain fields is converted, for example, the timestamp is converted into a readable format, or the status field is converted into an enumeration type, so as to realize the parsing of the express real-time information and obtain the express real-time data.

[0073] 305. Input the real-time express delivery data into the intelligent recognition model for analysis to obtain the results of the fraud behavior analysis of the outlets;

[0074] In this embodiment, new real-time express delivery data is input into the trained model for predictive analysis. The model outputs possible fraudulent behavior. Through the importance analysis of the model, it is understood which features have the greatest impact on the prediction of fraudulent behavior. Combined with business logic, possible fraudulent behavior patterns are analyzed (such as frequent changes in delivery addresses, abnormal delivery times, etc.) to obtain the results of the fraud behavior analysis of the outlets.

[0075] 306. Calling a preset fraud behavior processing solution comparison table to identify the mapping relationship between the branch fraud behavior analysis result and the fraud behavior processing solution comparison table;

[0076] In this embodiment, common fraud types are identified based on business needs and historical data, a comparison table structure is designed, and a mapping relationship between the branch fraud analysis results and the fraud processing solution comparison table is identified.

[0077] 307. Match the corresponding processing scheme in the fraud processing scheme comparison table according to the mapping relationship, and generate processing measure information according to the processing scheme;

[0078] In this embodiment, according to the fraud behavior type of the branch fraud behavior analysis results, a mapping algorithm is used to find the corresponding processing plan in the comparison table. For each identified fraud behavior, its type and trigger condition are extracted. In the comparison table, the fraud behavior type is searched and the identification conditions are matched. If the identification conditions are met, the corresponding processing plan is found. Once mapped to the processing plan, the detailed information of the plan is extracted, and the processing measure information is generated according to the processing plan.

[0079] In the embodiment of the present invention, the process ensures immediate monitoring and response to fraudulent behavior by monitoring express information in real time and quickly parsing data. This rapid response capability can effectively reduce potential losses. The clustering algorithm model is used to train key features, and complex fraud behavior patterns can be intelligently identified and analyzed, thereby improving the accuracy and reliability of detection. The entire process establishes a systematic chain from data collection to decision execution, ensuring close connection between each link, making the information flow efficient and smooth. By calling the preset fraud behavior processing solution comparison table, the system can flexibly match the corresponding processing solution according to different fraud behavior types, enhancing the adaptability and pertinence of the processing. The automated process reduces the need for manual intervention, thereby reducing the risk caused by human error and improving the accuracy of the overall operation.

[0080] See also Figure 4 The fourth embodiment of the method for mining fraudulent behavior of express delivery outlets in the embodiment of the present invention includes:

[0081] 401. Encrypt the processing measure information using the public key in the preset key pair to obtain encrypted processing measure information;

[0082] In this embodiment, a suitable encryption algorithm is selected, such as RSA, ECC (elliptic curve cryptography), etc., and the processing measure information is converted into a format suitable for encryption, such as a string format. The string is encrypted using the selected encryption algorithm and public key to obtain the processing measure encrypted information.

[0083] 402. Upload the encrypted information of the processing measures to the blockchain, and send the encrypted information of the processing measures and the private key in the key pair to the branch terminal;

[0084] In this embodiment, a suitable blockchain platform is selected, such as Ethereum, Hyperledger Fabric, etc., a smart contract is developed to handle the storage and retrieval of encrypted information, the blockchain SDK or API (such as Web3.js, ethers.js, etc.) is used to connect to the blockchain network, the storage function of the smart contract is called, the processing measure encrypted information is written to the blockchain, the transaction is generated and sent to the blockchain network, the transaction status is monitored, the transaction is successful and confirmed to be recorded in the blockchain, a symmetric encryption algorithm (such as AES) is used to encrypt the private key, and an information package is created, including the encrypted processing measure information and the encrypted private key, and the information package is sent to the branch terminal using a secure communication protocol (such as HTTPS, TLS). After the branch terminal receives the information package, the private key is first decrypted, and then the decrypted private key is used to decrypt the processing measure encrypted information.

[0085] 403. Review the analysis results of the fraudulent behavior of the outlets and obtain the review results;

[0086] In this embodiment, the standards and indicators for review are clearly defined, such as the recognition rate of fraudulent activities, the false positive rate of misidentification, and the evidence and supporting data required for review. Different data sources are used to cross-validate the results of the branch fraud behavior analysis, and the results of multiple data sets are compared to discover potential errors or omissions. For suspicious transactions or activities, a detailed retrospective analysis is conducted to trace their historical data, check related transaction records, customer behavior and its abnormal patterns, review the results of the branch fraud behavior analysis, obtain the review results, and organize the findings and conclusions in the review process, including confirmed fraudulent behavior, misidentified cases and related data support.

[0087] 404. Optimize and adjust the intelligent recognition model according to the review results;

[0088] In this embodiment, a detailed review report is prepared to analyze the false positive (normal transactions mistakenly identified as fraud) and false negative (real fraud transactions not identified) cases found during the review process, identify specific error patterns, determine the common characteristics of these errors, understand the causes of misjudgment, check whether the data distribution during the review period has changed, such as whether new types of fraud have appeared or whether legal transaction patterns have changed, analyze the impact of external factors on data characteristics, calculate the key performance indicators (KPIs) of the model, such as accuracy, recall, F1-score, etc., through the review results, confirm which indicators have not met expectations, pay special attention to the gap between recognition rate and error rate, and based on the review results, eliminate poorly performing features, retain and increase features that are more recognizable for fraudulent behavior, and use grid search or random search and other methods to adjust the hyperparameters of the intelligent recognition model to improve the performance and stability of the model and achieve optimization adjustment of the intelligent recognition model.

[0089] In the embodiment of the present invention, the processing measure information is encrypted with a public key to ensure the security and confidentiality of the data when it is uploaded to the blockchain, effectively prevent data tampering and unauthorized access, and store the processing measure information on the blockchain to ensure the immutability and transparency of the information, so that all operation records are traceable, thereby enhancing trust and compliance. By reviewing the analysis results of fraudulent behavior at outlets, the accuracy of the analysis results is ensured, which helps to improve the quality of decision-making and reduce the risk of misjudgment. The intelligent recognition model is optimized and adjusted based on the review results to form a closed-loop feedback mechanism, which continuously improves the performance and adaptability of the model, thereby enhancing the intelligence level of the overall system. Through encryption and review measures, potential security risks and decision-making risks are reduced, ensuring the safety and robustness of business operations.

[0090] The above describes the method for mining fraudulent behavior of express delivery outlets in the embodiment of the present invention. The following describes the device for mining fraudulent behavior of express delivery outlets in the embodiment of the present invention. Figure 5 In one embodiment of the present invention, an apparatus for mining fraudulent behaviors of express delivery outlets includes:

[0091] The collection and acquisition module 501 is used to collect first comprehensive data from internal data sources, the first comprehensive data including order details information, image and video information, financial information and customer complaint records, and obtain second comprehensive data from external data sources, the second comprehensive data including geographic location information, real-time weather conditions and social media user feedback;

[0092] An integration processing module 502 is used to integrate the first integrated data and the second integrated data to obtain integrated data, and perform data preprocessing on the integrated data to obtain preprocessed data;

[0093] The classification and extraction module 503 is used to classify the pre-processed data to obtain operation text data, picture data and video data, and extract key features closely related to fraudulent behavior from the operation text data, picture data and video data;

[0094] The training receiving module 504 is used to obtain an intelligent recognition model by training key features and receive real-time express delivery data uploaded by the outlet terminal;

[0095] The analysis generation module 505 is used to input the real-time express delivery data into the intelligent recognition model for analysis, obtain the analysis results of the network fraud behavior, and generate processing measures information based on the analysis results of the network fraud behavior.

[0096] In this embodiment, the first comprehensive data and the second comprehensive data are integrated, the integrated data are preprocessed, and the preprocessed data are classified to obtain operational text data, picture data and video data, and key features closely related to fraudulent behavior are extracted from the operational text data, picture data and video data. The key features are used to train an intelligent recognition model, and the real-time express delivery data is input into the intelligent recognition model for analysis to obtain the analysis results of the fraudulent behavior of the outlets. According to the analysis results of the fraudulent behavior of the outlets, processing measure information is generated, which can automatically identify the fraudulent behavior of the express delivery outlets, and automatically generate corresponding processing measures according to the fraudulent behavior, thereby reducing human intervention and misjudgment, improving the efficiency of identifying and processing fraudulent behavior, optimizing internal management of the enterprise, protecting the rights and interests of consumers, and improving customer satisfaction.

[0097] See also Figure 6 Another embodiment of the express delivery outlet fraud mining device in the embodiment of the present invention includes:

[0098] The collection and acquisition module 501 is used to collect first comprehensive data from internal data sources, the first comprehensive data including order details information, image and video information, financial information and customer complaint records, and obtain second comprehensive data from external data sources, the second comprehensive data including geographic location information, real-time weather conditions and social media user feedback;

[0099] An integration processing module 502 is used to integrate the first integrated data and the second integrated data to obtain integrated data, and perform data preprocessing on the integrated data to obtain preprocessed data;

[0100] The classification and extraction module 503 is used to classify the pre-processed data to obtain operation text data, picture data and video data, and extract key features closely related to fraudulent behavior from the operation text data, picture data and video data;

[0101] The training receiving module 504 is used to obtain an intelligent recognition model by training key features and receive real-time express delivery data uploaded by the outlet terminal;

[0102] The analysis generation module 505 is used to input the real-time express delivery data into the intelligent recognition model for analysis, obtain the analysis results of the outlet fraud behavior, and generate the processing measure information according to the analysis results of the outlet fraud behavior;

[0103] In this embodiment, the collection and acquisition module 501 includes: a collection unit 5011, which is used to collect first comprehensive data from an internal data source, and the first comprehensive data includes order details information, financial information, customer complaint records, and images and video information shot in key operating areas and processes; an acquisition unit 5012, which is used to acquire second comprehensive data from an external data source, and the second comprehensive data includes geographic location information, real-time weather conditions, and social media user feedback; a marking unit 5013, which is used to mark the first comprehensive data and the second comprehensive data.

[0104] In this embodiment, the integration processing module 502 includes: a first integration unit 5021, which is used to integrate the first integrated data and the second integrated data to obtain integrated data; a cleaning unit 5022, which is used to clean the integrated data to obtain cleaned data; and a conversion unit 5023, which is used to convert the cleaned data into a standardized format to obtain preprocessed data.

[0105] In this embodiment, the classification and extraction module 503 includes: a classification unit 5031, which is used to classify the pre-processed data to obtain operational text data, image data and video data; a first extraction unit 5032, which is used to extract a first key feature closely related to fraudulent behavior from the operational text data, and the first key feature includes order anomalies, logistics delays and financial data mismatches; a second extraction unit 5033, which is used to extract a second key feature closely related to fraudulent behavior from the image data and video data, and the second key feature includes changes in personnel behavior and changes in item status; a second integration unit 5034, which is used to integrate the first key feature and the second key feature to obtain a key feature.

[0106] In this embodiment, the training receiving module 504 includes: selecting a training unit 5041, which is used to select a clustering algorithm model, and use key features to train the clustering algorithm model to obtain an intelligent recognition model; creating a monitoring unit 5042, which is used to create a listener, and use the listener to monitor the real-time express information uploaded by the branch terminal; a receiving unit 5043, which is used to receive the current real-time express information when the listener monitors the real-time express information; and a parsing unit 5044, which is used to parse the real-time express information to obtain real-time express data.

[0107] In this embodiment, the analysis generation module 505 includes: an analysis unit 5051, which is used to input the real-time express delivery data into the intelligent recognition model for analysis to obtain the branch fraud behavior analysis results; a call recognition unit 5052, which is used to call the preset fraud behavior processing solution comparison table to identify the mapping relationship between the branch fraud behavior analysis results and the fraud behavior processing solution comparison table; a matching generation unit 5053, which is used to match the corresponding processing solution in the fraud behavior processing solution comparison table according to the mapping relationship, and generate processing measure information according to the processing solution.

[0108] In this embodiment, it also includes: an encryption module 506, which is used to encrypt the processing measure information using the public key in the preset key pair to obtain the processing measure encrypted information; an upload and sending module 507, which is used to upload the processing measure encrypted information to the blockchain, and send the processing measure encrypted information and the private key in the key pair to the branch terminal; a review module 508, which is used to review the branch fraud behavior analysis results to obtain the review results; an optimization and adjustment module 509, which is used to optimize and adjust the intelligent recognition model according to the review results.

[0109] above Figure 5 and Figure 6 The express delivery point fraud behavior mining device in the embodiment of the present invention is described in detail from the perspective of modular functional entities. The express delivery point fraud behavior mining device in the embodiment of the present invention is described in detail from the perspective of hardware processing.

[0110] Figure 7 6 is a schematic diagram of the structure of a device for mining fraudulent behaviors of express delivery outlets provided by an embodiment of the present invention. The device 600 for mining fraudulent behaviors of express delivery outlets may have relatively large differences due to different configurations or performances, and may include one or more processors (central processing units, CPU) 610 (for example, one or more processors) and a memory 620, and one or more storage media 630 (for example, one or more mass storage devices) storing application programs 633 or data 632. Among them, the memory 620 and the storage medium 630 may be short-term storage or permanent storage. The program stored in the storage medium 630 may include one or more modules (not shown in the figure), and each module may include a series of instruction operations in the device 600 for mining fraudulent behaviors of express delivery outlets. Furthermore, the processor 610 may be configured to communicate with the storage medium 630, and execute a series of instruction operations in the storage medium 630 on the device 600 for mining fraudulent behaviors of express delivery outlets, so as to implement the steps of the method for mining fraudulent behaviors of express delivery outlets provided by the above-mentioned method embodiments.

[0111] The express delivery outlet fraud mining device 600 may also include one or more power supplies 640, one or more wired or wireless network interfaces 650, one or more input and output interfaces 660, and / or one or more operating systems 631, such as Windows Serve, Mac OS X, Unix, Linux, FreeBSD, etc. It will be appreciated by those skilled in the art that Figure 7 The structure of the express delivery outlet fraud mining device shown does not constitute a limitation on the express delivery outlet fraud mining device, and may include more or fewer components than shown in the figure, or a combination of certain components, or a different arrangement of components.

[0112] The present invention also provides a computer-readable storage medium, which may be a non-volatile computer-readable storage medium or a volatile computer-readable storage medium. Instructions are stored in the computer-readable storage medium. When the instructions are executed on a computer, the computer executes the steps of a method for mining fraudulent behavior of express delivery outlets.

[0113] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the above-described system, device, or unit can refer to the corresponding process in the aforementioned method embodiment and will not be repeated here.

[0114] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk and other media that can store program codes.

[0115] Finally, it should be noted that the above description is only a preferred example of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art can still modify the technical solutions described in the aforementioned embodiments or replace some of the technical features therein by equivalents. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A method for mining fraudulent behavior of express delivery outlets, characterized in that: include: Collecting first comprehensive data from internal data sources, the first comprehensive data including order details, image and video information, financial information, and customer complaint records, and obtaining second comprehensive data from external data sources, the second comprehensive data including geographic location information, real-time weather conditions, and social media user feedback; Integrate the first integrated data and the second integrated data to obtain integrated data, and perform data preprocessing on the integrated data to obtain preprocessed data; Classifying the preprocessed data to obtain operational text data, image data, and video data, and extracting key features closely related to fraudulent behavior from the operational text data, the image data, and the video data; The key features are used to train an intelligent recognition model to receive real-time express delivery data uploaded by the outlet terminals; The real-time express delivery data is input into the intelligent recognition model for analysis to obtain the analysis results of the branch fraud behavior, and the processing measure information is generated according to the analysis results of the branch fraud behavior.

2. The method for mining fraudulent behaviors of express delivery outlets according to claim 1, characterized in that: The first comprehensive data is collected from the internal data source, and the first comprehensive data includes order details, image and video information, financial information, and customer complaint records; the second comprehensive data is obtained from the external data source, and the second comprehensive data includes geographic location information, real-time weather conditions, and social media user feedback, including: Collecting first comprehensive data from internal data sources, the first comprehensive data including order details, financial information, customer complaint records, and image and video information captured in key operational areas and processes; Acquire second comprehensive data from an external data source, wherein the second comprehensive data includes geographic location information, real-time weather conditions, and social media user feedback; Data labeling is performed on the first integrated data and the second integrated data.

3. The method for mining fraudulent behaviors of express delivery outlets according to claim 1, characterized in that: The step of integrating the first integrated data and the second integrated data to obtain integrated data, and performing data preprocessing on the integrated data to obtain preprocessed data includes: Integrate the first integrated data and the second integrated data to obtain integrated data; Performing data cleaning on the integrated data to obtain cleaned data; The cleaned data is converted into a standardized format to obtain preprocessed data.

4. The method for mining fraudulent behaviors of express delivery outlets according to claim 1, characterized in that: The pre-processed data is classified to obtain operational text data, image data and video data, and key features closely related to fraudulent behavior are extracted from the operational text data, the image data and the video data, including: Classifying the preprocessed data to obtain operational text data, image data, and video data; extracting first key features closely related to fraudulent behavior from the operational text data, wherein the first key features include order anomalies, logistics delays, and financial data mismatches; Extracting a second key feature closely related to fraudulent behavior from the image data and the video data, the second key feature including a change in a person's behavior and a change in an object's state; The first key feature and the second key feature are integrated to obtain a key feature.

5. The method for mining fraudulent behaviors of express delivery outlets according to claim 1, characterized in that: The intelligent recognition model is obtained by training the key features, and the real-time express delivery data uploaded by the network terminal is received, including: Selecting a clustering algorithm model, and using the key features to train the clustering algorithm model to obtain an intelligent recognition model; Create a listener, and use the listener to monitor the real-time express information uploaded by the network terminal; When the listener listens to the express real-time information, it receives the current express real-time information; The real-time express information is parsed to obtain real-time express data.

6. The method for mining fraudulent behaviors of express delivery outlets according to claim 1, characterized in that: The real-time express delivery data is input into the intelligent recognition model for analysis to obtain the analysis result of the outlet fraud behavior, and the processing measure information is generated according to the analysis result of the outlet fraud behavior, including: Input the real-time express delivery data into the intelligent recognition model for analysis to obtain the results of the fraud behavior analysis of the outlets; Calling a preset fraud behavior processing solution comparison table to identify the mapping relationship between the fraud behavior analysis result of the outlet and the fraud behavior processing solution comparison table; The corresponding processing scheme in the fraud processing scheme comparison table is matched according to the mapping relationship, and processing measure information is generated according to the processing scheme.

7. The method for mining fraudulent behaviors of express delivery outlets according to claim 1, characterized in that: After inputting the real-time express delivery data into the intelligent recognition model for analysis to obtain the outlet fraud behavior analysis result, and generating the processing measure information according to the outlet fraud behavior analysis result, the method further includes: Using a public key in a preset key pair to encrypt the processing measure information to obtain processing measure encrypted information; Uploading the encrypted information of the processing measures to the blockchain, and sending the encrypted information of the processing measures and the private key in the key pair to the network point terminal; Reviewing the analysis results of the fraudulent behavior of the outlets to obtain review results; The intelligent recognition model is optimized and adjusted according to the review results.

8. A device for mining fraudulent behaviors of express delivery outlets, characterized in that: include: A collection and acquisition module, configured to collect first comprehensive data from an internal data source, the first comprehensive data including order details, image and video information, financial information, and customer complaint records, and to acquire second comprehensive data from an external data source, the second comprehensive data including geographic location information, real-time weather conditions, and social media user feedback; An integration processing module, used for integrating the first integrated data and the second integrated data to obtain integrated data, and performing data preprocessing on the integrated data to obtain preprocessed data; A classification and extraction module, used to classify the pre-processed data to obtain operational text data, image data and video data, and extract key features closely related to fraudulent behavior from the operational text data, the image data and the video data; A training receiving module, used to train an intelligent recognition model using the key features and receive real-time express delivery data uploaded by the outlet terminal; The analysis generation module is used to input the real-time express delivery data into the intelligent recognition model for analysis, obtain the analysis results of the branch fraud behavior, and generate processing measures information according to the analysis results of the branch fraud behavior.

9. A device for mining fraudulent behaviors at express delivery outlets, characterized in that: The express delivery outlet fraud mining device comprises: a memory and at least one processor, wherein the memory stores instructions; At least one of the processors calls the instructions in the memory to enable the express delivery point fraud behavior mining device to execute each step of the express delivery point fraud behavior mining method as described in any one of claims 1-7.

10. A computer-readable storage medium having instructions stored thereon, characterized in that: When the instructions are executed by the processor, the various steps of the method for mining fraudulent behavior of express delivery outlets as described in any one of claims 1-7 are implemented.

Images