Abnormal behavior detection method of customer service and electronic equipment

Abstract

The invention discloses a customer service abnormal behavior detection method and electronic equipment. The method comprises the steps of obtaining real-time interaction data of a customer service seat and a user; obtaining a real-time feature vector according to the real-time interaction data; inputting the real-time feature vector into an abnormal behavior detection model to obtain an abnormal detection result output by the abnormal behavior detection model, the abnormal detection result comprising behavior detection results on a plurality of abnormal types, and the behavior detection result representing whether the customer service seat has an abnormal behavior on a corresponding abnormal type; wherein the abnormal behavior detection model is trained based on a first training sample and a second training sample, the first training sample is used for training the abnormal behavior detection model before the real-time feature vector is input into the abnormal behavior detection model, the second training sample is composed of an abnormal detection result and the real-time feature vector, and the real-time feature vector is input into the abnormal behavior detection model. The second training sample is used for training the abnormal behavior detection model after the abnormal behavior detection model outputs the abnormal detection result.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to a method and electronic device for detecting abnormal behavior of customer service. Background Art

[0002] As an important channel for communication between enterprises and customers, the customer service system is directly related to user experience and customer satisfaction. Therefore, it is crucial to monitor and analyze the quality of the customer service system.

[0003] The quality monitoring of the customer service system is achieved by detecting whether there are abnormal behaviors between customers and customer service agents. However, the traditional manual sampling or regular batch quality inspection methods have the problem of large detection lag, which is difficult to meet users' real-time needs. Summary of the invention

[0004] In view of the above problems, this application provides a customer service abnormal behavior detection method and electronic device to achieve real-time detection of customer service abnormal behavior to avoid detection lag. The specific solution is as follows:

[0005] The first aspect of the present application provides a method for detecting abnormal behavior of customer service, the method comprising:

[0006] Obtain real-time interaction data between customer service agents and users;

[0007] Obtaining a real-time feature vector according to the real-time interaction data;

[0008] Inputting the real-time feature vector into an abnormal behavior detection model to obtain an abnormal detection result output by the abnormal behavior detection model, wherein the abnormal detection result includes: behavior detection results on multiple abnormal types, wherein the behavior detection result indicates whether the customer service agent has abnormal behavior on the corresponding abnormal type;

[0009] The abnormal behavior detection model is trained based on a first training sample and a second training sample, the first training sample is used to train the abnormal behavior detection model before the real-time feature vector is input into the abnormal behavior detection model, the second training sample is composed of the abnormal detection result and the real-time feature vector, and the second training sample is used to train the abnormal behavior detection model after the abnormal behavior detection model outputs the abnormal detection result.

[0010] In a possible implementation, training the abnormal behavior detection model based on the first training sample includes:

[0011] Obtaining a historical feature vector according to the historical interaction data in the first training sample;

[0012] Writing the historical feature vector and the behavior marking result corresponding to the historical feature vector in the first training sample into a first partition in a message queue, the message queue comprising at least a plurality of sample storage partitions, the first partition being determined according to a timestamp when the historical feature vector is written into the message queue;

[0013] When the historical feature vectors and the corresponding behavior marking results written in the message queue reach a first threshold, the detection sub-model corresponding to the processing unit is trained by multiple processing units based on the historical feature vectors and the corresponding behavior marking results stored in the sample storage partition corresponding to the processing unit in the message queue;

[0014] According to the aggregation weight corresponding to each of the detection sub-models, model aggregation is performed on all the detection sub-models to obtain an abnormal behavior detection model.

[0015] In a possible implementation, the message queue further includes a real-time storage partition; wherein, before inputting the real-time feature vector into the abnormal behavior detection model, the method further includes:

[0016] The real-time feature vector is written into the real-time storage partition in the message queue, so that the abnormal behavior detection model processes the real-time feature vector in the real-time storage partition to obtain the abnormality detection result.

[0017] In a possible implementation, the aggregation weight corresponding to each of the detection sub-models is obtained based on the prediction error rate of each of the detection sub-models during the training process using the data in the sample storage partition.

[0018] In a possible implementation, after training the detection sub-model corresponding to the processing unit, the method further includes:

[0019] The historical feature vector and its corresponding behavior marking result used for training the detection sub-model are deleted.

[0020] In a possible implementation, determining the first partition according to the timestamp when the historical feature vector is written into the message queue includes:

[0021] Performing hash value calculation on the timestamp when the historical feature vector is written into the message queue to obtain a target hash value;

[0022] According to the correspondence between the hash value and the sample storage partitions in the message queue, a first partition matching the target hash value is determined among the multiple sample storage partitions.

[0023] In a possible implementation, before training the abnormal behavior detection model based on the second training sample, the method further includes:

[0024] According to the abnormal behavior detection model, the detection sub-model corresponding to each of the processing units is updated.

[0025] In a possible implementation, training the abnormal behavior detection model based on the second training sample includes:

[0026] Writing the second training sample into a second partition in the message queue, where the second partition is determined according to a timestamp of writing the second training sample into the message queue;

[0027] When the second training sample written in the message queue reaches a second threshold, training the detection sub-model corresponding to the processing unit through each processing unit based on the second training sample stored in the sample storage partition corresponding to the processing unit in the message queue;

[0028] According to the aggregation weight corresponding to each of the detection sub-models, model aggregation is performed on all the detection sub-models to obtain an abnormal behavior detection model.

[0029] In a possible implementation, the method further includes:

[0030] respectively detecting the resource usage rate of each of the processing units;

[0031] In response to the resource usage rate of the processing unit satisfying the resource expansion condition, obtaining resource occupancy prediction information of the processing unit using a machine learning model;

[0032] According to the resource occupancy prediction information, resource capacity expansion is performed on at least one processing resource of the processing unit.

[0033] A second aspect of the present application provides a customer service abnormal behavior detection device, comprising:

[0034] A data acquisition unit, used to obtain real-time interaction data between customer service agents and users;

[0035] A feature acquisition unit, used for acquiring a real-time feature vector according to the real-time interaction data;

[0036] A behavior detection unit, used to input the real-time feature vector into an abnormal behavior detection model to obtain an abnormal detection result output by the abnormal behavior detection model, wherein the abnormal detection result includes: behavior detection results on multiple abnormal types, wherein the behavior detection result indicates whether the customer service agent has abnormal behavior on the corresponding abnormal type;

[0037] The abnormal behavior detection model is trained based on a first training sample and a second training sample, the first training sample is used to train the abnormal behavior detection model before the real-time feature vector is input into the abnormal behavior detection model, the second training sample is composed of the abnormal detection result and the real-time feature vector, and the second training sample is used to train the abnormal behavior detection model after the abnormal behavior detection model outputs the abnormal detection result.

[0038] A third aspect of the present application provides a computer program product, including computer-readable instructions. When the computer-readable instructions are executed on an electronic device, the electronic device implements the method for detecting abnormal behavior of customer service according to the first aspect or any implementation of the first aspect.

[0039] A fourth aspect of the present application provides an electronic device, comprising at least one processor and a memory connected to the processor, wherein:

[0040] The memory is used to store computer programs;

[0041] The processor is used to execute the computer program so that the electronic device can implement the customer service abnormal behavior detection method of the first aspect or any implementation method of the first aspect.

[0042] A fifth aspect of the present application provides a computer storage medium, which carries one or more computer programs. When the one or more computer programs are executed by an electronic device, the electronic device can implement the method for detecting abnormal behavior of customer service in the above-mentioned first aspect or any implementation of the first aspect.

[0043] By means of the above-mentioned technical scheme, in a method for detecting abnormal behavior of customer service and an electronic device provided by the present application, before using the abnormal detection behavior model for abnormal behavior detection, the first training sample is first used for training, so that the abnormal detection behavior model can output abnormal detection results for the real-time interaction data between the customer service agent and the user, so as to characterize whether there is abnormal behavior in each abnormal type, thereby performing real-time detection of abnormal interaction behavior between the customer service agent and the user to avoid detection lag. During the use of the model, in this embodiment, the output results of the abnormal behavior detection model and the corresponding real-time interaction data can be used to form a new training sample, and the abnormal behavior detection model can be trained again, so that the model is optimized again. While ensuring timely real-time detection of abnormal behavior in the customer service interaction process, the training samples required for the training model can also be saved, thereby further improving the accuracy of abnormal behavior detection by the abnormal behavior detection model. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0045] Figure 1 A flowchart of a method for detecting abnormal behavior of customer service provided in an embodiment of the present application;

[0046] Figure 2 A training diagram of an abnormal behavior detection model in an embodiment of the present application;

[0047] Figure 3 A schematic diagram of a process of training an abnormal behavior detection model based on a first training sample in a customer service abnormal behavior detection method provided in an embodiment of the present application;

[0048] Figure 4 This is an example diagram of a message queue and an abnormal behavior detection model in an embodiment of the present application;

[0049] Figure 5 Another example diagram of a message queue and an abnormal behavior detection model in an embodiment of the present application;

[0050] Figure 6 Another flowchart of a method for detecting abnormal behavior of customer service provided in an embodiment of the present application;

[0051] Figure 7 Another example diagram of a message queue and an abnormal behavior detection model in an embodiment of the present application;

[0052] Figure 8 A partial flow chart of a method for detecting abnormal behavior of customer service provided in an embodiment of the present application;

[0053] Fig. 9 Another example diagram of a message queue and an abnormal behavior detection model in an embodiment of the present application;

[0054] Fig.10 Another partial flow chart of a method for detecting abnormal behavior of customer service provided in an embodiment of the present application;

[0055] Fig.11 A schematic diagram of the structure of a customer service abnormal behavior detection device provided in an embodiment of the present application;

[0056] Fig.12 Another structural schematic diagram of a customer service abnormal behavior detection device provided in an embodiment of the present application;

[0057] Fig.13Another structural schematic diagram of a customer service abnormal behavior detection device provided in an embodiment of the present application;

[0058] Fig.14 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application;

[0059] Fig.15 This is a schematic diagram of the structure of the online customer service abnormal behavior monitoring implementation device proposed in this application;

[0060] Fig.16 This is a flow chart of data processing performed by a data collection unit in the online customer service abnormal behavior monitoring implementation device proposed in this application;

[0061] Fig.17 This is a flowchart for implementing model pre-training in the online customer service abnormal behavior monitoring implementation device proposed in this application;

[0062] Fig.18 This is a workflow diagram of the load balancer in the online customer service abnormal behavior monitoring implementation device proposed in this application. DETAILED DESCRIPTION

[0063] The following describes the embodiments of the present application in conjunction with the drawings in the embodiments of the present application. The terms used in the implementation method section of the present application are only used to explain the specific embodiments of the present application, and are not intended to limit the present application.

[0064] The embodiments of the present application are described below in conjunction with the accompanying drawings. Those skilled in the art will appreciate that, with the development of technology and the emergence of new scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0065] The terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and need not be used to describe a specific order or sequential order. It should be understood that the terms used in this way can be interchangeable under appropriate circumstances, which is only to describe the distinction mode adopted by the objects of the same attributes when describing in the embodiments of the present application. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, so that the process, method, system, product or equipment comprising a series of units need not be limited to those units, but may include other units that are not clearly listed or inherent to these processes, methods, products or equipment.

[0066] Reference Figure 1, is a flow chart of a method for detecting abnormal behavior of customer service provided in an embodiment of the present application, which can be applied to electronic devices capable of data processing, such as computers or servers. The technical solution in this embodiment is mainly used to detect abnormal interaction behaviors between customer service agents and users in real time to avoid detection lag.

[0067] Specifically, the method in this embodiment may include the following steps:

[0068] Step 101: Obtain real-time interaction data between customer service agents and users.

[0069] Among them, real-time interaction data refers to the real-time data of interaction between customer service agents and users in the customer service system. The real-time interaction data may include interaction text, interaction images, interaction emoticons and other information input by the customer service agents and users in the customer service system respectively. It may also include customer service work order information. The customer service work order information may include customer service business serial number, customer service agent's seat number, customer service business type and other information.

[0070] In one implementation, this embodiment can be connected to a customer service server of a customer service system through an independent service or interface, thereby monitoring real-time interaction data such as interaction text and work order information between customer service agents and users.

[0071] It should be noted that in this embodiment, the real-time interaction data is continuously obtained, and the continuously obtained real-time interaction data can be written into the message queue in sequence to facilitate subsequent reading and processing.

[0072] Step 102: Obtain a real-time feature vector according to the real-time interaction data.

[0073] In one implementation, in step 102, the real-time interaction data may first be preprocessed, and the preprocessing may include at least one of denoising, format unification, stop word deletion, word segmentation, and the like, thereby cleaning the real-time interaction data. After the cleaning is completed, the real-time interaction data may be format converted, i.e., feature extraction, thereby obtaining a real-time feature vector.

[0074] In one implementation, the real-time feature vector may be a dense vector. For example, in this embodiment, a word vector calculation tool may be used to convert the words in the real-time interaction data into vectors to obtain a dense vector corresponding to each word, that is, a real-time feature vector.

[0075] Step 103: input the real-time feature vector into the abnormal behavior detection model to obtain an abnormal detection result output by the abnormal behavior detection model.

[0076] Among them, the anomaly detection result may include behavior detection results on multiple anomaly types, and the behavior detection result indicates whether the customer service agent has abnormal behavior on the corresponding anomaly type.

[0077] For example, abnormal types can be positive, negative, neutral, and other types, such as insult type, filthy type, violation type, and other abnormal types.

[0078] In one implementation, the abnormal behavior detection model may be a machine learning model built based on a neural network or other architectures. The abnormal behavior detection model may process an input feature vector to output a behavior detection result corresponding to each abnormal type.

[0079] Specifically, the abnormal behavior detection model is trained based on the first training sample and the second training sample, the first training sample is used to train the abnormal behavior detection model before the real-time feature vector is input into the abnormal behavior detection model. The second training sample is composed of the abnormal detection result and the real-time feature vector, and the second training sample is used to train the abnormal behavior detection model after the abnormal behavior detection model outputs the abnormal detection result.

[0080] That is to say, the training of the abnormal behavior detection model is divided into two stages: a pre-training stage based on the first training sample, and a real-time training stage based on the second training sample. Figure 2 As shown in, after the abnormal behavior detection model is initially constructed, pre-training is performed based on the first training sample; the pre-trained abnormal behavior detection model can realize real-time abnormal behavior detection, that is, real-time interaction data is input into the abnormal behavior detection model, so that the abnormal behavior detection model outputs an abnormal detection result; and after the abnormal behavior detection model is put into use, that is, the abnormal detection result is output, as the abnormal behavior detection model is put into use, in this embodiment, the abnormal detection result output by the abnormal behavior detection model and the corresponding real-time feature vector can be used as the second training sample to train the abnormal behavior detection model, that is, as the abnormal behavior detection model is used, the abnormal behavior detection model is trained in real time based on the abnormal detection result output by the abnormal behavior detection model and the corresponding real-time feature vector.

[0081] By means of the above technical scheme, in a method for detecting abnormal behavior of customer service provided in an embodiment of the present application, before using the abnormal detection behavior model to detect abnormal behavior, the first training sample is first used for training, so that the abnormal detection behavior model can output abnormal detection results for the real-time interaction data between the customer service agent and the user, so as to characterize whether there is abnormal behavior in each abnormal type, thereby performing real-time detection of abnormal interaction behavior between the customer service agent and the user to avoid detection lag, and during the use of the model, in this embodiment, the output results of the abnormal behavior detection model and the corresponding real-time interaction data can be used to form a new training sample, and the abnormal behavior detection model can be trained again, so that the model is optimized again, thereby ensuring timely real-time detection of abnormal behavior in the customer service interaction process, while also saving training samples required for the training model, further improving the accuracy of abnormal behavior detection by the abnormal behavior detection model.

[0082] In one implementation, in this embodiment, the abnormal behavior detection model can be trained based on the first training sample in the following manner: Figure 3 As shown in:

[0083] Step 301: Obtain a historical feature vector based on historical interaction data in a first training sample.

[0084] In a specific implementation, in step 301, the historical interaction data in the first training sample may be preprocessed first. The preprocessing may include at least one of denoising, format unification, stop word deletion, word segmentation, and the like. Thus, the historical interaction data may be cleaned. After the cleaning is completed, the historical interaction data may be format converted, i.e., feature extraction may be performed, thereby obtaining a historical feature vector.

[0085] It should be noted that the historical feature vector may be a dense vector. For example, in this embodiment, a word vector calculation tool may be used to convert the words in the historical interaction data into vectors to obtain a dense vector corresponding to each word, that is, a historical feature vector.

[0086] Step 302: Write the historical feature vector and the behavior marking result corresponding to it in the first training sample into the first partition in the message queue.

[0087] The behavior marking result is a marking result of marking the historical feature vector on the abnormal type in the first training sample, and the behavior marking result indicates whether there is abnormal behavior of the corresponding abnormal type in the historical interaction data corresponding to the historical feature vector.

[0088] The message queue includes at least multiple sample storage partitions, such as Figure 4 As shown in , the message queue may contain n sample storage partitions, each of which is marked from 1 to n.

[0089] Specifically, the first partition is determined according to the timestamp when the historical feature vector is written into the message queue. For example, in this embodiment, a hash value calculation can be performed on the timestamp when the historical feature vector is written into the message queue to obtain a target hash value; then, according to the corresponding relationship between the hash value and the sample storage partition in the message queue, the first partition is determined among the multiple sample storage partitions in the message queue.

[0090] Among them, the correspondence between the hash value and the sample storage partition can be understood as: the correspondence between the value range of the hash value and the sample storage partition. For example, each sample storage partition corresponds to a value range. In this embodiment, after the target hash value is calculated, the target value range of the target hash value in the value range corresponding to all sample storage partitions is determined by value matching, thereby determining the sample storage partition corresponding to the target value range as the first partition, that is, the sample storage partition where the historical feature vector and its corresponding behavior marking result are stored. For another example, each sample storage partition corresponds to a partition mark, such as 1 to n. Based on this, in this embodiment, after the target hash value is calculated, the target hash value is modulo the number of sample storage partitions, such as n, and the first partition is determined according to the partition mark corresponding to the numerical value obtained by the modulo, that is, the numerical value obtained by the modulo is used as the partition mark, thereby determining the corresponding first partition.

[0091] Therefore, as the historical feature vectors and their corresponding behavior marking results are written, the data accumulated in the sample storage partition in the message queue continues to increase.

[0092] Step 303: Monitor whether the historical feature vector written in the message queue reaches the first threshold. If the historical feature vector written in the message queue and its corresponding behavior marking result reach the first threshold, execute step 304; if the historical feature vector written in the message queue and its corresponding behavior marking result do not reach the first threshold, continue to monitor whether the historical feature vector written in the message queue reaches the first threshold.

[0093] Among them, the first threshold can be set according to business needs. That is, when the training data that can be used for model training accumulates to the first threshold, model training is performed based on these data, thereby meeting the data volume requirements of model training.

[0094] Step 304: Through multiple processing units, based on the historical feature vectors and their corresponding behavior marking results stored in the sample storage partitions corresponding to the processing units in the message queue, the detection sub-model corresponding to the processing units is trained.

[0095] For example, Figure 4As shown in , each sample storage partition corresponds to a detection sub-model, and each detection sub-model corresponds to a processing unit, which can be a device capable of data processing, such as a central processing unit CPU (Central Processing Unit), a neural network processor NPU (Neural network Processing Unit), or a graphics processor GPU (graphics processing unit). Based on this, the processing unit can use the data in its corresponding sample storage partition (i.e., the historical feature vector and its corresponding behavior labeling result) to train its corresponding detection sub-model, thereby obtaining multiple separately trained detection sub-models.

[0096] It should be noted that before training, the detection sub-model corresponding to each sample storage partition is a model initially constructed in the same way. During training, the sample storage partitions corresponding to the processing units are different, and accordingly, the training data used by each processing unit, such as the historical feature vector and its corresponding behavior labeling results, are different. Accordingly, after training, each detection sub-model learns different data features, and each detection sub-model is different.

[0097] It should be noted that after training the detection sub-model corresponding to the processing unit, the historical feature vectors and their corresponding behavior marking results used to train the detection sub-model can be deleted, thereby reducing the space occupied by the message queue and avoiding repeated training using the same training data.

[0098] Step 305: According to the aggregation weight corresponding to each detection sub-model, all detection sub-models are aggregated to obtain an abnormal behavior detection model.

[0099] Specifically, in this embodiment, a model aggregation tool can be used to perform model aggregation on all detection sub-models according to the aggregation weight corresponding to each detection sub-model to obtain an abnormal behavior detection model.

[0100] In one implementation, the aggregation weight corresponding to each detection sub-model is obtained based on the prediction error rate during the training process of each detection sub-model using the data in the sample storage partition. That is to say, in the present embodiment, during the training process of the detection sub-model corresponding to the processing unit, the abnormal prediction result output by the detection sub-model for processing the historical feature vector is obtained, and based on the behavior marking result corresponding to the historical feature vector, it is determined whether the abnormal prediction result is wrong. Thus, after the detection sub-model is trained using the first training sample, the prediction error rate of each detection sub-model is counted, that is, the ratio of the number of abnormal prediction results to the number of behavioral marking results that are wrong to the number of all abnormal prediction results. Based on this, the aggregation weight corresponding to each detection sub-model is obtained according to the prediction error rate corresponding to each detection sub-model.

[0101] Specifically, in this embodiment, a weight calculation formula can be used to adjust the initial weight corresponding to each detection sub-model according to the prediction error rate corresponding to each detection sub-model to obtain the aggregation weight corresponding to each detection sub-model.

[0102] Based on this, in step 305, the model parameters of all detection sub-models can be aggregated according to the aggregation weight corresponding to each detection sub-model to obtain an aggregated abnormal behavior detection model, such as Figure 4 As shown in , the abnormal behavior detection model has the abnormal behavior detection capabilities of all detection sub-models.

[0103] Based on the above implementation, the message queue can also contain a real-time storage partition, such as Figure 5 As shown in , the n+1th partition in the message queue is a real-time storage partition.

[0104] Based on this, before inputting the real-time feature vector into the abnormal behavior detection model in step 103, the method in this embodiment may further include the following processing, such as Figure 6 As shown in:

[0105] Step 104: write the real-time feature vector into the real-time storage partition in the message queue, so that the abnormal behavior detection model processes the real-time feature vector in the real-time storage partition to obtain an abnormality detection result.

[0106] That is, in step 103, the real-time feature vector in the real-time storage partition in the message queue is input into the abnormal behavior detection model, whereby the abnormal behavior detection model can process the input real-time feature vector to obtain an abnormal detection result.

[0107] It should be noted that after the abnormal behavior detection model outputs the abnormal detection result, the real-time feature vector that has been processed in the real-time storage partition can be deleted so that the real-time storage partition can store the new real-time feature vector that is subsequently acquired, thereby facilitating the abnormal behavior detection model to output a new anomaly detection result for the new real-time feature vector, thereby realizing streaming real-time abnormal behavior detection.

[0108] For example, Figure 5 As shown in , the acquired real-time feature vector is written into the n+1th partition in the message queue, and the real-time feature vector in the n+1th partition is processed by the abnormal behavior detection model to output the abnormal detection result. After that, the processed real-time feature vector in the n+1th partition is deleted so that the subsequent n+1th partition can store new real-time feature vectors.

[0109] In one implementation, in this embodiment, before the abnormal behavior detection model is trained based on the second training sample, the detection sub-model corresponding to each processing unit may be updated according to the abnormal behavior detection model.

[0110] Specifically, Figure 7 As shown in , in this embodiment, the model parameters of the abnormal behavior detection model obtained through model aggregation can be synchronized to each detection sub-model, thereby making each detection sub-model the same as the abnormal behavior detection model.

[0111] Based on this, in this embodiment, the abnormal behavior detection model can be trained based on the second training sample in the following manner: Figure 8 As shown in:

[0112] Step 801: Write a second training sample into a second partition in a message queue.

[0113] Among them, the second partition is determined according to the timestamp when the second training sample is written into the message queue. For example, in this embodiment, a hash value calculation can be performed on the timestamp when the second training sample is written into the message queue to obtain the current hash value; then, according to the correspondence between the hash value and the sample storage partition in the message queue, the second partition is determined in the multiple sample storage partitions in the message queue. Specifically, in this embodiment, after calculating the current hash value, the current value range of the current hash value in the value range corresponding to all sample storage partitions can be determined by value matching, thereby determining the sample storage partition corresponding to the current value range as the second partition, that is, the sample storage partition where the second training sample is stored, such as Fig. 9Alternatively, in this embodiment, after the current hash value is calculated, the current hash value is modulo the number of sample storage partitions, such as n, and the second partition is determined according to the partition mark corresponding to the value obtained by the modulo, that is, the value obtained by the modulo is used as the partition mark, thereby determining the corresponding second partition.

[0114] Therefore, as the abnormal behavior detection model is used, the second training samples are continuously written into the message queue, and the data accumulated in the sample storage partition in the message queue continues to increase.

[0115] Step 802: Monitor whether the second training sample written in the message queue reaches the second threshold. If the second training sample written in the message queue reaches the second threshold, execute step 803; if the second training sample written in the message queue does not reach the second threshold, continue to monitor whether the second training sample written in the message queue reaches the second threshold.

[0116] Among them, the second threshold can be set according to business needs. That is, when the training data that can be used for model training accumulates to the second threshold, model training is performed based on these data, thereby meeting the data volume requirements of model training.

[0117] Step 803: Through each processing unit, based on the second training sample stored in the sample storage partition corresponding to the processing unit in the message queue, the detection sub-model corresponding to the processing unit is trained.

[0118] For example, Fig. 9 As shown in , each processing unit can use the data in its corresponding sample storage partition (ie, the second training sample) to train its corresponding detection sub-model, thereby obtaining a plurality of detection sub-models that have been further optimized.

[0119] It should be noted that before further optimization, the detection sub-model corresponding to each sample storage partition is a model synchronized with the abnormal behavior detection model. During training, the sample storage partitions corresponding to each processing unit are different, and accordingly, the second training samples used by each processing unit are different. Accordingly, after further optimization, the data features re-learned by each detection sub-model are different, and each detection sub-model is different.

[0120] It should be noted that after further optimizing the detection sub-model corresponding to the processing unit, the second training sample used to train the detection sub-model can be deleted, thereby reducing the space occupied by the message queue and avoiding repeated training using the same training data.

[0121] Step 804: According to the aggregation weight corresponding to each detection sub-model, all detection sub-models are aggregated to obtain an abnormal behavior detection model.

[0122] Specifically, in this embodiment, a model aggregation tool can be used to perform model aggregation on all detection sub-models according to the aggregation weight corresponding to each detection sub-model to obtain an abnormal behavior detection model.

[0123] In one implementation, the aggregate weight corresponding to each detection sub-model is obtained based on the prediction error rate of each detection sub-model during the training process using the data in the sample storage partition. Specifically, in this embodiment, a weight calculation formula can be used to adjust the initial weight corresponding to each detection sub-model according to the prediction error rate corresponding to each detection sub-model to obtain the aggregate weight corresponding to each detection sub-model.

[0124] Based on this, in step 305, the model parameters of all detection sub-models can be aggregated according to the aggregation weight corresponding to each detection sub-model to obtain an aggregated abnormal behavior detection model, which has the abnormal behavior detection capability of all detection sub-models.

[0125] In one implementation, in this embodiment, the following processing may also be performed: Fig.10 As shown in:

[0126] Step 1001: Detect resource usage of each processing unit respectively.

[0127] The resource utilization rate of the processing unit may include data such as the utilization rate of the processor such as the CPU, the memory utilization rate, and the data throughput.

[0128] Step 1002: In response to the resource utilization rate of the processing unit satisfying the resource expansion condition, the resource occupancy prediction information of the processing unit is obtained using a machine learning model.

[0129] Among them, the resource expansion condition can be: the resource utilization rate exceeds the utilization rate threshold, and the resource expansion condition indicates that the resources of the processing unit may not be sufficient to support the processing unit to train the detection sub-model. Based on this, when the resource utilization rate of the processing unit meets the resource expansion condition, the machine learning model can be used to obtain the resource occupancy prediction information of the processing unit. The resource occupancy prediction information represents the future resource usage trend of the processing unit. For example, the CPU needs to occupy a first value of memory after the future target duration, etc.

[0130] Specifically, the machine learning model can be a long short-term memory network LSTM (Long Short-Term Memory) model. The machine learning model can process the resource usage time series data of the processing unit, that is, the resource usage rate at multiple historical moments, to output resource occupancy prediction information of the processing unit at at least one future moment.

[0131] Step 1003: According to the resource occupancy prediction information, the processing unit is expanded in terms of executing a processing resource.

[0132] The processing resources may include processor resources, memory resources, data throughput resources, etc.

[0133] Specifically, in this embodiment, based on the resource occupancy prediction information, an expansion plan for at least one processing resource of the processing unit can be generated, such as a plan for expanding memory, a plan for expanding the core in the processor, etc.; then, according to the expansion plan, the processing unit is expanded in executing a processing resource, such as expanding the deployment of a corresponding amount of memory for the processing unit, increasing the deployment of a corresponding number of processing cores for the processing unit, etc.

[0134] A method for detecting abnormal behavior of customer service provided in an embodiment of the present application is introduced above. A device for executing the method for detecting abnormal behavior of customer service is introduced below.

[0135] See also Fig.11 , is a schematic diagram of the structure of a customer service abnormal behavior detection device provided in an embodiment of the present application. The device can be applied to electronic devices capable of data processing, such as computers or servers. The technical solution in this embodiment is mainly used to detect abnormal interaction behaviors between customer service agents and users in real time to avoid detection lag.

[0136] Specifically, the device in this embodiment may include the following units:

[0137] The data acquisition unit 1101 is used to obtain real-time interaction data between the customer service agent and the user;

[0138] A feature obtaining unit 1102 is used to obtain a real-time feature vector according to the real-time interaction data;

[0139] The behavior detection unit 1103 is used to input the real-time feature vector into an abnormal behavior detection model to obtain an abnormal detection result output by the abnormal behavior detection model, wherein the abnormal detection result includes: behavior detection results of multiple abnormal types, and the behavior detection result indicates whether the customer service agent has abnormal behavior of the corresponding abnormal type;

[0140] The abnormal behavior detection model is trained based on a first training sample and a second training sample, the first training sample is used to train the abnormal behavior detection model before the real-time feature vector is input into the abnormal behavior detection model, the second training sample is composed of the abnormal detection result and the real-time feature vector, and the second training sample is used to train the abnormal behavior detection model after the abnormal behavior detection model outputs the abnormal detection result.

[0141] By means of the above technical scheme, in an abnormal behavior detection device for customer service provided by an embodiment of the present application, before using the abnormal detection behavior model to perform abnormal behavior detection, the first training sample is first used for training, so that the abnormal detection behavior model can output abnormal detection results for the real-time interaction data between the customer service agent and the user, so as to characterize whether there is abnormal behavior in each abnormal type, thereby performing real-time detection of abnormal interaction behavior between the customer service agent and the user to avoid detection lag, and during the use of the model, in this embodiment, the output results of the abnormal behavior detection model and the corresponding real-time interaction data can be used to form a new training sample, and the abnormal behavior detection model can be trained again, so that the model is optimized again, thereby ensuring timely real-time detection of abnormal behavior in the customer service interaction process, while also saving training samples required for the training model, further improving the accuracy of abnormal behavior detection by the abnormal behavior detection model.

[0142] In one implementation, this embodiment may also include the following units: Fig.12 As shown in:

[0143] The pre-training unit 1104 is configured to train the abnormal behavior detection model based on the first training sample in the following manner:

[0144] According to the historical interaction data in the first training sample, a historical feature vector is obtained; the historical feature vector and the corresponding behavior marking result in the first training sample are written into a first partition in a message queue, the message queue includes at least a plurality of sample storage partitions, and the first partition is determined according to the timestamp when the historical feature vector is written into the message queue; when the historical feature vector and the corresponding behavior marking result written into the message queue reach a first threshold, the detection sub-model corresponding to the processing unit is trained through a plurality of processing units based on the historical feature vector and the corresponding behavior marking result stored in the sample storage partition corresponding to the processing unit in the message queue; according to the aggregation weight corresponding to each of the detection sub-models, all the detection sub-models are model aggregated to obtain an abnormal behavior detection model.

[0145] The real-time training unit 1105 is used to train the abnormal behavior detection model based on the second training sample.

[0146] Based on the above implementation, the message queue also includes a real-time storage partition; wherein, before the behavior detection unit 1103 inputs the real-time feature vector into the abnormal behavior detection model, it is also used to: write the real-time feature vector into the real-time storage partition in the message queue, so that the abnormal behavior detection model processes the real-time feature vector in the real-time storage partition to obtain the abnormal detection result.

[0147] In one implementation, the aggregation weight corresponding to each of the detection sub-models is obtained based on the prediction error rate of each of the detection sub-models during the training process using the data in the sample storage partition.

[0148] In one implementation, after the pre-training unit 1104 trains the detection sub-model corresponding to the processing unit, it is also used to: delete the historical feature vector used to train the detection sub-model and its corresponding behavior marking result.

[0149] In one implementation, when the pre-training unit 1104 determines the first partition based on the timestamp when the historical feature vector is written to the message queue, it is specifically used to: perform a hash value calculation on the timestamp when the historical feature vector is written to the message queue to obtain a target hash value; and determine the first partition that matches the target hash value among the multiple sample storage partitions based on the correspondence between the hash value and the sample storage partitions in the message queue.

[0150] In one implementation, before the real-time training unit 1105 trains the abnormal behavior detection model based on the second training sample, it is also used to: update the detection sub-model corresponding to each of the processing units according to the abnormal behavior detection model.

[0151] Based on the above implementation, the real-time training unit 1105 is specifically used to: write the second training sample into the second partition in the message queue, and the second partition is determined according to the timestamp when the second training sample is written into the message queue; when the second training sample written into the message queue reaches a second threshold, through each of the processing units, based on the second training sample stored in the sample storage partition corresponding to the processing unit in the message queue, the detection sub-model corresponding to the processing unit is trained; according to the aggregation weight corresponding to each of the detection sub-models, all the detection sub-models are model aggregated to obtain an abnormal behavior detection model.

[0152] In one implementation, the device in this embodiment may further include the following units: Fig.13 As shown in:

[0153] The resource expansion unit 1106 is used to respectively detect the resource utilization rate of each of the processing units; in response to the resource utilization rate of the processing unit satisfying the resource expansion condition, obtain the resource occupancy prediction information of the processing unit by using a machine learning model; and according to the resource occupancy prediction information, perform resource expansion on the processing unit in executing a processing resource.

[0154] It should be noted that the specific implementation method of each unit in this embodiment can refer to the corresponding content in the previous text and will not be described in detail here.

[0155] refer to Fig.14 , is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application, and the electronic device may include the following structure:

[0156] Memory 1401, used to store computer programs and data generated by the execution of the computer programs;

[0157] The processor 1402 is configured to execute the computer program to implement:

[0158] Obtain real-time interaction data between customer service agents and users;

[0159] Obtaining a real-time feature vector according to the real-time interaction data;

[0160] Inputting the real-time feature vector into an abnormal behavior detection model to obtain an abnormal detection result output by the abnormal behavior detection model, wherein the abnormal detection result includes: behavior detection results of multiple abnormal types, wherein the behavior detection result indicates whether the customer service agent has abnormal behavior of the corresponding abnormal type;

[0161] The abnormal behavior detection model is trained based on a first training sample and a second training sample, the first training sample is used to train the abnormal behavior detection model before the real-time feature vector is input into the abnormal behavior detection model, the second training sample is composed of the abnormal detection result and the real-time feature vector, and the second training sample is used to train the abnormal behavior detection model after the abnormal behavior detection model outputs the abnormal detection result.

[0162] By means of the above technical scheme, in an electronic device provided by an embodiment of the present application, before using the abnormal detection behavior model to perform abnormal behavior detection, the first training sample is first used for training, so that the abnormal detection behavior model can output abnormal detection results for the real-time interaction data between the customer service agent and the user, so as to characterize whether there is abnormal behavior in each abnormal type, thereby performing real-time detection of abnormal interaction behavior between the customer service agent and the user to avoid detection lag. During the use of the model, in this embodiment, the output results of the abnormal behavior detection model and the corresponding real-time interaction data can be used to form a new training sample, and the abnormal behavior detection model can be trained again, so that the model is optimized again. While ensuring timely real-time detection of abnormal behavior in the customer service interaction process, the training samples required for the training model can also be saved, thereby further improving the accuracy of abnormal behavior detection by the abnormal behavior detection model.

[0163] Also provided in an embodiment of the present application is a computer program product including computer-readable instructions. When the computer-readable instructions are executed on an electronic device, the electronic device implements any customer service abnormal behavior detection method provided in an embodiment of the present application.

[0164] A computer-readable storage medium is also provided in an embodiment of the present application. The storage medium carries one or more computer programs. When the one or more computer programs are executed by an electronic device, the electronic device can implement any customer service abnormal behavior detection method provided in an embodiment of the present application.

[0165] Taking the quality inspection scenario of the customer service system of a financial enterprise as an example, the technical solution of this application is illustrated below:

[0166] First, the challenges that traditional quality inspection methods currently face in corporate practice are as follows:

[0167] First, feedback is delayed. Traditional quality inspection is usually carried out at T+1, which makes it impossible to provide real-time warning of customer service issues during the service. Once a service error or customer complaint occurs, it cannot be corrected in time, affecting the customer experience.

[0168] Second, the amount of data that needs to be processed is huge. For large enterprises or companies with active services, there may be tens of thousands of conversations per day. The length of each conversation can range from a few minutes to dozens of minutes depending on user needs. To improve the efficiency and accuracy of quality inspection, companies need to find more efficient data processing solutions.

[0169] Third, the scoring rules lack adaptability and flexibility. Many quality inspection strategies adopt static rules, which are difficult to adapt to the complex and changing business environment, resulting in the prediction model or alarm mechanism becoming outdated.

[0170] In order to solve the above problems, this application introduces emerging technologies such as streaming data processing, message queues, and intelligent models to monitor and evaluate customer service quality in real time during customer service conversations. It also uses conversation text as input to allow the online learning model (i.e., the abnormal behavior detection model mentioned above, hereinafter referred to as the model) to adjust the scoring strategy according to the new business in real time, thereby bringing innovative changes to the company's online customer service capabilities.

[0171] In the specific implementation, in order to achieve real-time quality inspection of conversations between customers of the financial banking center and online customer service agents, this application proposes an online customer service abnormal behavior monitoring device based on streaming processing technology and online learning models, which supports real-time monitoring of conversations between customers of the remote banking center and online customer service agents, so as to achieve real-time evaluation of customer service personnel's language expression, service quality, and problem-solving ability, timely discover and correct errors in the customer service conversation process, and improve the quality of customer service.

[0172] like Fig.15 As shown, it is a structural diagram of the online customer service abnormal behavior monitoring implementation device proposed in this application. The device is mainly composed of a data acquisition unit and a model training unit. The data acquisition unit consists of modules such as a data source access device, a data preprocessor and a feature extractor, and the model training unit consists of modules such as a distributed trainer, a model storage device, a model aggregator and a load balancer. The conversation text and related work order data are input into the device in real time and the results are output to the downstream early warning system. The output of the model is a label for a multi-classification task, including a variety of behavior types belonging to positive, negative and neutral, so that the downstream early warning system can judge whether there are bad behaviors such as insults, harassment, and sales in the customer service conversation through the customer service emotions, and give timely feedback to them.

[0173] like Fig.16 As shown, it is a flow chart of data processing by a data acquisition unit. The data acquisition unit in the device proposed in this application mainly includes a data source access device, a data preprocessor and a feature extractor. The processing flow includes the following implementation steps:

[0174] Step 1601: Data source access.

[0175] Among them, the conversation text and corresponding work order information from the online customer service are monitored through an independent service and written into the message queue.

[0176] Step 1602: Data preprocessing. Use the streaming processing component to access the message queue, consume the incoming data, perform operations such as denoising, format unification, delete stop words, and segment words on the data, and clean the input text. The cleaned data stream is input into the downstream processing flow.

[0177] Step 1603: Feature extraction. Convert the upstream preprocessed text into a form that can be understood by the machine learning model, that is, extract useful information. Use the Word2Vec model to convert each word in the upstream text into a dense vector to facilitate subsequent model training.

[0178] Step 1604: Push to message queue: Push the stream-processed data to the downstream message queue.

[0179] Furthermore, the processing flow of the model training unit of the device proposed in the present application includes two stages: model pre-training and real-time data training. Model pre-training is training on a large training set before it is put into use. The main purpose is to enable the model to have better performance and better adaptability in the initial stage. Real-time data training allows the pre-trained model to adjust parameters by itself in the continuously input data stream. In both stages of training, Online Stochastic Gradient Descent (Online SGD) can be used as a sub-online model, and AdaBoost is used to aggregate the sub-models to obtain the final prediction results.

[0180] like Fig.17 As shown in the figure, the implementation process of model pre-training includes the following implementation steps:

[0181] Step 1701: Initialize model parameters such as model weights and load the model into cache.

[0182] Step 1702: Divide the message queue into partitions 1 to n and partition n+1. After the upstream training data preprocessing is completed, the corresponding hash value h is calculated by the timestamp of the message (i.e., the timestamp of writing to the message queue), and the partition to be written is determined according to the hash value. The dense vector and work order information after preprocessing the training data are written into partition h%n.

[0183] Step 1703: Based on the time window mechanism of the streaming processing framework, when the specified number (i.e., the first threshold or the second threshold) of training batch data is consumed, subtasks 1 to n perform model training respectively. After the training is completed, the model is saved in the cache of the model storage.

[0184] Step 1704: Update and normalize the aggregate weight according to the AdaBoost weight calculation formula, the prediction error rate, and the previous weight (ie, the initial weight).

[0185] Step 1705: Load the model (trained model) in the master node of the streaming cluster, which can be used to obtain the corresponding results.

[0186] Step 1706: The data to be predicted is written into partition n+1 of the message queue (refer to step 1702 to write into the corresponding partition), and the prediction result is obtained by the aggregation model in the model aggregator.

[0187] It should be noted that in this process, the distributed trainer is responsible for model training, the model memory is responsible for saving and loading the model through the cache, the model aggregator is responsible for the result aggregation of the model and the redistribution of the integrated parameters (i.e., the aggregation weight), and the load balancer is responsible for providing a more balanced resource scheduling mechanism for the streaming computing framework. The real-time data training stage is basically the same as the pre-training stage, except that the real-time data training is not prepared training data, but learning in the real-time input data stream, that is, the training data in partitions 1 to n is the prediction result of the last batch of data of the predicted data. Due to frequent training, it may be necessary to frequently load the model into the memory, thereby bringing certain challenges to the resource load of the system, and AdaBoost is more suitable for batch training. This application utilizes the window characteristics of streaming processing, and only when the consumption data reaches the window setting threshold will model training be performed. When the preset window calculation threshold in the streaming data framework is not reached, the input data stream directly obtains the prediction result of the integrated learning at the master node, and outputs the prediction result to the downstream early warning system.

[0188] In order to optimize the performance and resource utilization efficiency of data stream applications, this application also integrates a load balancer based on resource elastic scheduling and automatic expansion to meet the performance requirements of distributed training. Fig.18 As shown in the figure, the workflow of the load balancer is as follows:

[0189] Step 1801: Resource usage monitoring: real-time acquisition of the current node's CPU usage, memory usage, data throughput and other data (ie, the resource utilization mentioned above).

[0190] Step 1802: Performance indicator setting: According to the job requirements, set the resource usage threshold by yourself. When the resource usage rate reaches the set threshold, predict the required resources and make decisions on capacity expansion and reduction.

[0191] Step 1803: When the monitored indicator exceeds the threshold, execute step 1804;

[0192] Step 1804: Resource demand prediction: Use the pre-trained LSTM model and the time series data of resource usage to predict the future resource usage trend;

[0193] Step 1805: Expansion decision: Determine the expansion plan based on the prediction results.

[0194] Step 1806: Decision execution: Make resource adjustments based on previous monitoring data, prediction results, and set thresholds. Specifically, you can issue expansion or reduction commands to the underlying resources through the resource management interface, and dynamically adjust the parallelism of the job.

[0195] For the load balancer implemented above, a correct analysis should be made on its state consistency, high availability, task migration, etc. for each expansion and contraction to ensure that the job can be implemented normally in the dynamic resource allocation.

[0196] In summary, this application has the following advantages:

[0197] (1) This application adopts a training model method based on online learning, so that the Online SGD model used can learn the conversation text information in the process of processing conversation data without retraining the model. This can ensure the real-time update of the model and save the resources and storage required for retraining the model.

[0198] (2) This application adopts a distributed ensemble learning solution based on streaming processing, trains multiple sub-models in sub-nodes, and redistributes weights and calculates results of the sub-models in the master node of the cluster in the manner of AdaBoost, making it possible to integrate weak learners into strong models. This fully utilizes the training capabilities of the distributed cluster and the low latency and high throughput characteristics of the streaming processing framework, allowing the present invention to continuously update models and output results in big data scenarios.

[0199] It should also be noted that the device embodiments described above are merely schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed over multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. In addition, in the drawings of the device embodiments provided by the present application, the connection relationship between the modules indicates that there is a communication connection between them, which may be specifically implemented as one or more communication buses or signal lines.

[0200] Through the description of the above implementation mode, the technicians in the field can clearly understand that the present application can be implemented by means of software plus necessary general hardware, and of course, it can also be implemented by special hardware including special integrated circuits, special CPUs, special memories, special components, etc. In general, all functions completed by computer programs can be easily implemented by corresponding hardware, and the specific hardware structure used to implement the same function can also be various, such as analog circuits, digital circuits or special circuits. However, for the present application, software program implementation is a better implementation mode in more cases. Based on such an understanding, the technical solution of the present application is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a readable storage medium, such as a computer floppy disk, a U disk, a mobile hard disk, a ROM, a RAM, a magnetic disk or an optical disk, etc., including a number of instructions to enable a computer device (which can be a personal computer, a training device, or a network device, etc.) to execute the methods described in each embodiment of the present application.

[0201] In the above embodiments, all or part of the embodiments may be implemented by software, hardware, firmware or any combination thereof. When implemented by software, all or part of the embodiments may be implemented in the form of a computer program product.

[0202] The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from a website site, a computer, a training device, or a data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, training device, or data center. The computer-readable storage medium may be any available medium that a computer can store or a data storage device such as a training device, a data center, etc. that includes one or more available media integrations. The available medium may be a magnetic medium, (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive (SSD)), etc.

Claims

1. A method for detecting abnormal behavior of customer service, characterized in that: The method comprises: Obtain real-time interaction data between customer service agents and users; Obtaining a real-time feature vector according to the real-time interaction data; Inputting the real-time feature vector into an abnormal behavior detection model to obtain an abnormal detection result output by the abnormal behavior detection model, wherein the abnormal detection result includes: behavior detection results on multiple abnormal types, wherein the behavior detection result indicates whether the customer service agent has abnormal behavior on the corresponding abnormal type; The abnormal behavior detection model is trained based on a first training sample and a second training sample, the first training sample is used to train the abnormal behavior detection model before the real-time feature vector is input into the abnormal behavior detection model, the second training sample is composed of the abnormal detection result and the real-time feature vector, and the second training sample is used to train the abnormal behavior detection model after the abnormal behavior detection model outputs the abnormal detection result.

2. The method according to claim 1, characterized in that Training the abnormal behavior detection model based on the first training sample includes: Obtaining a historical feature vector according to the historical interaction data in the first training sample; Writing the historical feature vector and the behavior marking result corresponding to the historical feature vector in the first training sample into a first partition in a message queue, the message queue comprising at least a plurality of sample storage partitions, the first partition being determined according to a timestamp when the historical feature vector is written into the message queue; When the historical feature vectors and the corresponding behavior marking results written in the message queue reach a first threshold, the detection sub-model corresponding to the processing unit is trained by multiple processing units based on the historical feature vectors and the corresponding behavior marking results stored in the sample storage partition corresponding to the processing unit in the message queue; According to the aggregation weight corresponding to each of the detection sub-models, model aggregation is performed on all the detection sub-models to obtain an abnormal behavior detection model.

3. The method according to claim 2, characterized in that The message queue also includes a real-time storage partition; wherein, before inputting the real-time feature vector into the abnormal behavior detection model, the method further includes: The real-time feature vector is written into the real-time storage partition in the message queue, so that the abnormal behavior detection model processes the real-time feature vector in the real-time storage partition to obtain the abnormality detection result.

4. The method according to claim 2, characterized in that: The aggregation weight corresponding to each detection sub-model is obtained based on the prediction error rate of each detection sub-model during the training process using the data in the sample storage partition.

5. The method according to claim 2, characterized in that: After training the detection sub-model corresponding to the processing unit, the method further includes: The historical feature vector and its corresponding behavior marking result used for training the detection sub-model are deleted.

6. The method according to claim 2, characterized in that Determining the first partition according to the timestamp of writing the historical feature vector into the message queue includes: Performing hash value calculation on the timestamp when the historical feature vector is written into the message queue to obtain a target hash value; According to the correspondence between the hash value and the sample storage partitions in the message queue, a first partition matching the target hash value is determined among the multiple sample storage partitions.

7. The method according to claim 2, characterized in that: Before training the abnormal behavior detection model based on the second training sample, the method further includes: According to the abnormal behavior detection model, the detection sub-model corresponding to each of the processing units is updated.

8. The method according to claim 2 or 7, characterized in that: Training the abnormal behavior detection model based on the second training sample includes: Writing the second training sample into a second partition in the message queue, where the second partition is determined according to a timestamp of writing the second training sample into the message queue; When the second training sample written in the message queue reaches a second threshold, training the detection sub-model corresponding to the processing unit through each processing unit based on the second training sample stored in the sample storage partition corresponding to the processing unit in the message queue; According to the aggregation weight corresponding to each of the detection sub-models, model aggregation is performed on all the detection sub-models to obtain an abnormal behavior detection model.

9. The method according to claim 2, characterized in that: The method further comprises: respectively detecting the resource usage rate of each of the processing units; In response to the resource usage rate of the processing unit satisfying the resource expansion condition, obtaining resource occupancy prediction information of the processing unit using a machine learning model; According to the resource occupancy prediction information, resource capacity expansion is performed on at least one processing resource of the processing unit.

10. An electronic device, characterized in that: include: A memory, used to store a computer program and data generated by the execution of the computer program; A processor, configured to execute the computer program to implement: Obtain real-time interaction data between customer service agents and users; Obtaining a real-time feature vector according to the real-time interaction data; Inputting the real-time feature vector into an abnormal behavior detection model to obtain an abnormal detection result output by the abnormal behavior detection model, wherein the abnormal detection result includes: behavior detection results of multiple abnormal types, wherein the behavior detection result indicates whether the customer service agent has abnormal behavior of the corresponding abnormal type; The abnormal behavior detection model is trained based on a first training sample and a second training sample, the first training sample is used to train the abnormal behavior detection model before the real-time feature vector is input into the abnormal behavior detection model, the second training sample is composed of the abnormal detection result and the real-time feature vector, and the second training sample is used to train the abnormal behavior detection model after the abnormal behavior detection model outputs the abnormal detection result.

Images