Employee abnormal behavior detection method and device, electronic equipment and storage medium
By using an isolated forest model to detect employee behavior abnormalities in the bank employee monitoring system, the limitations and privacy protection problems in the existing technology rely on manual judgment are solved, and automated, accurate and timely abnormal behavior detection is achieved, which improves security.
Patent Information
- Application Number
- CN202411924431.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-25
- Publication Date
- 2025-03-18
AI Technical Summary
The existing bank employee monitoring model relies on manual judgment, has limitations and lags, and does not protect employee privacy enough.
By obtaining employee behavior data in the database and inputting it into an anomaly detection model based on an isolated forest model for calculation, anomaly score is generated to determine whether employee behavior is abnormal.
It realizes automated data extraction, reduces the risk of employee privacy leakage, and can accurately and timely detect employee abnormal behaviors, improving security.
Smart Images
Figure CN119646714A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of big data technology, and in particular to a method, device, electronic device and storage medium for detecting abnormal behavior of employees. Background Art
[0002] As assistant managers of the bank's huge funds, bank employees rely on financial resources and face the temptation of strong funds and power. In order to ensure the stable operation of the banking system and protect the rights and interests of customers, banks need to establish a very complete employee monitoring system, and this operational risk monitoring should not be limited to human routine judgment ideas. In addition, the current status of privacy protection is in a stage of rapid change and development. The improvement of laws and regulations, technological progress and the improvement of public awareness are jointly promoting the progress of privacy protection. For banking enterprises, privacy protection is an unremitting responsibility and challenge.
[0003] The existing employee monitoring model ideas of banks mostly rely on human screening results, analyze the violation characteristics with historical violation case examples, and then formulate monitoring model rules, and then match the corresponding suspicious data through manual data extraction. This method relies too much on manual judgment and has great limitations; because the event must occur before management, in the scope of regional banks, there are fewer samples and the monitoring scope has a large lag; manual extraction of employee data also hinders the protection of employee privacy. Summary of the invention
[0004] In view of this, the present application provides a method, device, electronic device and storage medium for detecting abnormal behavior of employees to solve the above problems.
[0005] To achieve the above objectives, this application provides the following technical solutions:
[0006] The first aspect of the present application discloses a method for detecting abnormal behavior of employees, comprising:
[0007] According to a preset time period, the employee's behavior data is obtained from a database; wherein the database is used to store the employee's behavior data;
[0008] The behavior data is input into a pre-built anomaly detection model for operation to obtain an anomaly score of the employee; wherein the anomaly detection model is an isolation forest model built based on the employee behavior sample data;
[0009] If the abnormal score is greater than a preset threshold, it is determined that the employee's behavior is abnormal, and abnormal behavior warning information is generated.
[0010] Optionally, the above method, after obtaining the employee's behavior data from the database, further includes:
[0011] Performing data cleaning on the behavior data to obtain cleaned behavior data;
[0012] Perform feature scaling on the cleaned behavioral data to obtain processed data.
[0013] Optionally, in the above method, the process of constructing the anomaly detection model includes:
[0014] Acquire the employee behavior sample data through a large language model;
[0015] Build an initial model for anomaly detection based on the isolation forest algorithm;
[0016] Optimizing the model parameters of the initial anomaly detection model through grid search;
[0017] The anomaly detection model is trained using the employee behavior sample data to obtain the anomaly detection model.
[0018] Optionally, in the above method, the using the employee behavior sample data to train the anomaly detection model to obtain the anomaly detection model includes:
[0019] Generate N sub-sampling sets based on the employee behavior sample data;
[0020] For each sub-sampling set, build an isolation tree;
[0021] Each isolated tree is merged to generate the anomaly detection model.
[0022] The second aspect of the present application discloses a device for detecting abnormal behavior of employees, comprising:
[0023] An acquisition unit, used to acquire employee behavior data from a database according to a preset time period; wherein the database is used to store employee behavior data;
[0024] A computing unit, used for inputting the behavior data into a pre-built anomaly detection model for computing to obtain an anomaly score of the employee; wherein the anomaly detection model is an isolation forest model constructed based on employee behavior sample data;
[0025] The alarm unit is used to determine that the employee's behavior is abnormal if the abnormal score is greater than a preset threshold value, and generate abnormal behavior alarm information.
[0026] Optionally, the above device further includes:
[0027] A data cleaning unit, used to clean the behavior data to obtain cleaned behavior data;
[0028] The feature processing unit is used to perform feature scaling processing on the cleaned behavior data to obtain processed data.
[0029] Optionally, in the above device, the computing unit includes:
[0030] An acquisition subunit, used for acquiring the employee behavior sample data through a large language model;
[0031] The first construction subunit is used to construct an initial anomaly detection model based on the isolation forest algorithm;
[0032] An optimization subunit, used for optimizing the model parameters of the initial anomaly detection model through grid search;
[0033] The training subunit is used to train the anomaly detection model using the employee behavior sample data to obtain the anomaly detection model.
[0034] Optionally, in the above-mentioned device, the training subunit comprises:
[0035] A generating subunit, used for generating N sub-sampling sets based on the employee behavior sample data;
[0036] The second construction subunit is used to construct an isolation tree for each sub-sampling set;
[0037] The merging subunit is used to merge each isolated tree to generate the anomaly detection model.
[0038] The third aspect of the present application discloses an electronic device, comprising:
[0039] one or more processors;
[0040] a storage device having one or more programs stored thereon;
[0041] When the one or more programs are executed by the one or more processors, the one or more processors implement the method as described in any one of the first aspects of the present invention.
[0042] A fourth aspect of the present application discloses a computer storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the method described in any one of the first aspects of the present invention is implemented.
[0043] It can be seen from the above technical solution that the present application provides a method for detecting abnormal employee behavior, which obtains employee behavior data from a database according to a preset time period; wherein the database is used to store employee behavior data. The behavior data is input into a pre-built anomaly detection model for calculation to obtain the employee's abnormal score; wherein the anomaly detection model is an isolation forest model constructed based on employee behavior sample data. If the abnormal score is greater than a preset threshold, it is judged that the employee's behavior is abnormal, and abnormal behavior alarm information is generated. It can be seen that the method of the present application can realize automated data extraction, reduce the risk of employee privacy leakage, and accurately and timely detect abnormal behavior of employees, greatly improving security. BRIEF DESCRIPTION OF THE DRAWINGS
[0044] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.
[0045] Figure 1 A flowchart of a method for detecting abnormal behavior of employees disclosed in an embodiment of the present application;
[0046] Figure 2 A flowchart of an implementation of the process of building an anomaly detection model in step S102 disclosed in an embodiment of the present application;
[0047] Figure 3 A schematic diagram of a device for detecting abnormal behavior of employees disclosed in an embodiment of the present application;
[0048] Figure 4 A schematic diagram of an electronic device disclosed in an embodiment of the present application. DETAILED DESCRIPTION
[0049] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.
[0050] In this application, the terms "comprises", "comprising" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprising a ..." does not exclude the presence of other identical elements in the process, method, article or device comprising the element.
[0051] Furthermore, in this document, relational terms such as first and second, etc. are used only to distinguish one entity or operation from another entity or operation, but do not necessarily require or imply any such actual relationship or order between these entities or operations.
[0052] The first aspect of the present application provides a method for detecting abnormal behavior of employees, such as Figure 1 As shown, specifically including:
[0053] S101. Obtaining employee behavior data from a database according to a preset time period; wherein the database is used to store employee behavior data.
[0054] It should be noted that according to a preset time period, such as 1 hour, the large language model is used to automatically generate SQL code for extracting employee behavior data according to data acquisition instructions (for example, extracting the total amount of credit card transactions of all employees last month, transaction frequency, merchant category, etc.), and using RPA to connect to the database for database query, connect to the database for database query, and obtain employee behavior data from the database; wherein the database is used to store employee behavior data. After obtaining the employee behavior data, a csv file (a common data format, which is a plain text file with commas as delimiters between fields and line breaks as delimiters between records) can be generated, thereby realizing the extraction of employee behavior data without manual intervention.
[0055] Optionally, in another embodiment of the present application, after executing the above step S101, the following may also be included:
[0056] The behavior data is cleansed to obtain cleansed behavior data.
[0057] Perform feature scaling on the cleaned behavioral data to obtain processed data.
[0058] It should be noted that after obtaining the employee's behavior data, the behavior data is cleaned to deal with missing values, outliers and noise. Missing values can be processed by interpolation, deletion or other methods, and obvious outliers can be preliminarily screened. Then, the cleaned data is subjected to feature scaling, and features that have an impact on anomaly detection are selected, and feature scaling processing, such as standardization and normalization, is performed to reduce the dimension and redundancy of the data.
[0059] S102: Input the behavior data into a pre-built anomaly detection model for calculation to obtain an anomaly score of the employee; wherein the anomaly detection model is an isolation forest model built based on the employee behavior sample data.
[0060] It should be noted that after obtaining the user's behavior data, the behavior data is input into a pre-built anomaly detection model for calculation to obtain the employee's anomaly score. Among them, the anomaly detection model is an isolation forest model constructed based on employee behavior sample data. The core idea of the isolation forest algorithm is to continuously segment data by randomly selecting features and segmentation points until each sample is isolated. Abnormal samples usually require fewer segmentation steps to be isolated, while normal samples require more steps. The degree of abnormality can be measured by calculating the average path length of the sample in all trees. In the isolation forest, the construction process of each tree can be regarded as gradually separating data points through random segmentation in multidimensional space. The path length refers to the number of segmentations required from the root node to the isolation of the data point. The value range of the anomaly score is (0, 1). The closer the score is to 1, the more likely the data point is an abnormal point; the closer the score is to 0, the more likely the data point is a normal point.
[0061] Optionally, in another embodiment of the present application, the construction process of the anomaly detection model in step S102 is implemented as follows: Figure 2 As shown, it may include:
[0062] S201. Obtain employee behavior sample data through a large language model.
[0063] It should be noted that the SQL code for extracting employee behavior data is automatically generated through the large language model, the historical behavior data of each employee is obtained, and employee sample data is generated.
[0064] It should also be noted that the scope and rule data of abnormal behavior can also be obtained through the large language model. For example, if you ask "Common fund violation models in the banking industry", you can get the following answer: "① Credit card cash withdrawal. ② Abnormal fund flow model. ③ High-risk area fund flow model: ...". If you ask "Characteristics of credit card cash withdrawal model", you can get the following answer: "Based on my understanding of banking business, the general characteristics of the credit card cash withdrawal model can be summarized as follows: ① Transaction frequency and amount: Frequent large transactions in a short period of time, especially transactions with non-integer amounts, may indicate that the cardholder is trying to circumvent system monitoring. ② Merchant type: Frequent large-amount consumption at jewelry stores, electronics stores, travel agencies and other goods and service providers that are easy to cash out may indicate cash withdrawal behavior. ③ Transaction time and location: ...". If you ask "What are the specific rules for transaction frequency and amount in the credit card cash withdrawal model", you can get the following answer: "The following points can be regarded as more common rules: ① High-frequency transactions in a short period of time: If a large number of transactions occur in a very short period of time (such as a few minutes to a few hours), this may be regarded as suspicious behavior. Normal daily consumption is unlikely to have such a dense transaction frequency. ② Large transactions: ...".
[0065] S202. Construct an initial anomaly detection model based on the isolation forest algorithm.
[0066] It should be noted that the isolation forest algorithm is particularly suitable for processing big data and high-dimensional problems because it has linear time complexity and does not require any parameters to be set in advance. This makes it very efficient when processing large-scale data sets. In addition, the isolation forest does not rely on indicators such as distance or density, but directly characterizes the degree of alienation of samples, so it performs well in many practical applications. Therefore, the initial model for anomaly detection is constructed based on the isolation forest algorithm.
[0067] S203: Optimize the model parameters of the initial anomaly detection model through grid search.
[0068] It should be noted that the model parameters of the initial anomaly detection model, such as the number of trees, maximum tree depth, subsample size, etc., are optimized by grid search to optimize the performance of the model.
[0069] S204: Train the anomaly detection model using employee behavior sample data to obtain an anomaly detection model.
[0070] It should be noted that the anomaly detection model is trained using the acquired employee behavior sample data to obtain the final anomaly detection model.
[0071] Optionally, in another embodiment of the present application, an implementation of the above step S204 may include:
[0072] N sub-sampling sets are generated based on the employee behavior sample data.
[0073] For each sub-sampling set, an isolation tree is constructed.
[0074] Each isolated tree is merged to generate the anomaly detection model.
[0075] It should be noted that a certain number of samples are first randomly selected from the employee behavior sample data to prepare for tree construction. The size of these sub-sample sets is usually much smaller than the size of the original data set, which can limit the size of the tree and reduce the computational complexity. N can be set according to actual conditions, for example, 100. Then, for each sub-sample set, an isolated tree is constructed, and the process of constructing an isolated tree is recursive. At each node, the algorithm randomly selects a feature and randomly selects a split value between the maximum and minimum values of the feature. Then, the data divides the samples into the left subtree or the right subtree according to this split value. This process will continue until the tree reaches a specified height, the number of samples in the node reaches a certain number, or the selected feature values of all samples are the same value. When all isolated trees are constructed, each isolated tree is merged to form an isolated forest to obtain the anomaly detection model.
[0076] S103: If the abnormality score is greater than a preset threshold, it is determined that the employee's behavior is abnormal, and abnormal behavior warning information is generated.
[0077] It should be noted that since the value range of the anomaly score is (0, 1), the closer the score is to 1, the more likely the data point is an anomaly; the closer the score is to 0, the more likely the data point is a normal point. Therefore, the threshold is set to 0.7, which can also be set according to actual conditions. When the anomaly score output by the anomaly detection model is greater than 0.7, it is determined that the employee's behavior is abnormal, and the employee's behavior data is analyzed to generate abnormal behavior alarm information and issue an alarm in time. If the anomaly score output by the anomaly detection model is not greater than 0.7, it is considered that the employee has no abnormal behavior.
[0078] An embodiment of the present application provides a method for detecting abnormal employee behavior, which obtains employee behavior data from a database according to a preset time period; wherein the database is used to store employee behavior data. The behavior data is input into a pre-constructed anomaly detection model for calculation to obtain an abnormal score for the employee; wherein the anomaly detection model is an isolation forest model constructed based on employee behavior sample data. If the abnormal score is greater than a preset threshold, it is determined that the employee's behavior is abnormal, and abnormal behavior alarm information is generated. It can be seen that the method of the present application can realize automated data extraction, reduce the risk of employee privacy leakage, and accurately and timely detect abnormal behavior of employees, greatly improving security.
[0079] Another embodiment of the present application also discloses a device for detecting abnormal behavior of employees, such as Figure 3 As shown, specifically including:
[0080] The acquisition unit 301 is used to acquire employee behavior data from a database according to a preset time period; wherein the database is used to store employee behavior data.
[0081] The operation unit 302 is used to input the behavior data into a pre-built anomaly detection model for operation to obtain the anomaly score of the employee; wherein the anomaly detection model is an isolation forest model constructed based on the employee behavior sample data.
[0082] The alarm unit 303 is used to determine that the employee's behavior is abnormal if the abnormal score is greater than a preset threshold, and generate abnormal behavior alarm information.
[0083] In this embodiment, the specific execution process of the acquisition unit 301, the calculation unit 302, and the alarm unit 303 can be found in the corresponding Figure 1 The content of the method embodiment will not be repeated here.
[0084] An embodiment of the present application provides a device for detecting abnormal employee behavior, wherein an acquisition unit 301 acquires employee behavior data from a database according to a preset time period; wherein the database is used to store employee behavior data. An operation unit 302 inputs the behavior data into a pre-constructed anomaly detection model for operation to obtain an abnormal score for the employee; wherein the anomaly detection model is an isolation forest model constructed based on employee behavior sample data. If the abnormal score is greater than a preset threshold, the alarm unit 303 determines that the employee's behavior is abnormal and generates abnormal behavior alarm information. It can be seen that the method of the present application can realize automated data extraction, reduce the risk of employee privacy leakage, and accurately and timely detect abnormal behavior of employees, greatly improving security.
[0085] Optionally, in another embodiment of the present application, the above-mentioned employee abnormal behavior detection device further includes:
[0086] The data cleaning unit is used to clean the behavior data to obtain cleaned behavior data.
[0087] The feature processing unit is used to perform feature scaling processing on the cleaned behavior data to obtain processed data.
[0088] In this embodiment, the specific execution process of the data cleaning unit and the feature processing unit can refer to the corresponding method embodiment content above, which will not be repeated here.
[0089] Optionally, in another embodiment of the present application, an implementation of the operation unit 302 includes:
[0090] The acquisition subunit is used to acquire the employee behavior sample data through a large language model.
[0091] The first construction subunit is used to construct an initial anomaly detection model based on the isolation forest algorithm.
[0092] The optimization subunit is used to optimize the model parameters of the initial anomaly detection model through grid search.
[0093] The training subunit is used to train the anomaly detection model using the employee behavior sample data to obtain the anomaly detection model.
[0094] In this embodiment, the specific execution process of the acquisition subunit, the first construction subunit, the optimization subunit and the training subunit can be found in the corresponding Figure 2 The content of the method embodiment will not be repeated here.
[0095] Optionally, in another embodiment of the present application, an implementation of the training subunit includes:
[0096] A generating subunit is used to generate N sub-sampling sets based on the employee behavior sample data.
[0097] The second construction subunit is used to construct an isolation tree for each sub-sampling set.
[0098] The merging subunit is used to merge each isolated tree to generate the anomaly detection model.
[0099] In this embodiment, the specific execution process of the generating subunit, the second constructing subunit and the second constructing subunit can refer to the corresponding method embodiment content mentioned above, which will not be repeated here.
[0100] Another embodiment of the present application further provides an electronic device, such as Figure 4 As shown, specifically including:
[0101] One or more processors 401 .
[0102] The storage device 402 stores one or more programs.
[0103] When one or more programs are executed by one or more processors 401 , the one or more processors 401 implement any one of the methods in the above embodiments.
[0104] Another embodiment of the present application further provides a computer storage medium on which a computer program is stored, wherein when the computer program is executed by a processor, any one of the methods in the above embodiments is implemented.
[0105] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can refer to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system or system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can refer to the partial description of the method embodiment. The system and system embodiments described above are merely schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without creative work.
[0106] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.
[0107] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.
Claims
1. A method for detecting abnormal behavior of employees, characterized in that: include: According to a preset time period, the employee's behavior data is obtained from a database; wherein the database is used to store the employee's behavior data; The behavior data is input into a pre-built anomaly detection model for operation to obtain an anomaly score of the employee; wherein the anomaly detection model is an isolation forest model built based on the employee behavior sample data; If the abnormal score is greater than a preset threshold, it is determined that the employee's behavior is abnormal, and abnormal behavior warning information is generated.
2. The method according to claim 1, characterized in that After obtaining the employee's behavior data from the database, the method further includes: Performing data cleaning on the behavior data to obtain cleaned behavior data; Perform feature scaling on the cleaned behavioral data to obtain processed data.
3. The method according to claim 1, characterized in that: The construction process of the anomaly detection model includes: Acquire the employee behavior sample data through a large language model; Build an initial model for anomaly detection based on the isolation forest algorithm; Optimizing the model parameters of the initial anomaly detection model through grid search; The anomaly detection model is trained using the employee behavior sample data to obtain the anomaly detection model.
4. The method according to claim 1, characterized in that: The using the employee behavior sample data to train the anomaly detection model to obtain the anomaly detection model includes: Generate N sub-sampling sets based on the employee behavior sample data; For each sub-sampling set, build an isolation tree; Each isolated tree is merged to generate the anomaly detection model.
5. A device for detecting abnormal behavior of employees, characterized in that: include: An acquisition unit, used to acquire employee behavior data from a database according to a preset time period; wherein the database is used to store employee behavior data; A computing unit, used for inputting the behavior data into a pre-built anomaly detection model for computing to obtain an anomaly score of the employee; wherein the anomaly detection model is an isolation forest model constructed based on employee behavior sample data; The alarm unit is used to determine that the employee's behavior is abnormal if the abnormal score is greater than a preset threshold value, and generate abnormal behavior alarm information.
6. The device according to claim 5, characterized in that Also includes: A data cleaning unit, used to clean the behavior data to obtain cleaned behavior data; The feature processing unit is used to perform feature scaling processing on the cleaned behavior data to obtain processed data.
7. The device according to claim 5, characterized in that The computing unit comprises: An acquisition subunit, used for acquiring the employee behavior sample data through a large language model; The first construction subunit is used to construct an initial anomaly detection model based on the isolation forest algorithm; An optimization subunit, used for optimizing the model parameters of the initial anomaly detection model through grid search; The training subunit is used to train the anomaly detection model using the employee behavior sample data to obtain the anomaly detection model.
8. The device according to claim 5, characterized in that The training subunit comprises: A generating subunit, used for generating N sub-sampling sets based on the employee behavior sample data; The second construction subunit is used to construct an isolation tree for each sub-sampling set; The merging subunit is used to merge each isolated tree to generate the anomaly detection model.
9. An electronic device, characterized in that: include: one or more processors; a storage device having one or more programs stored thereon; When the one or more programs are executed by the one or more processors, the one or more processors are enabled to implement the method according to any one of claims 1 to 4.
10. A computer storage medium, characterized in that: A computer program is stored thereon, wherein when the computer program is executed by a processor, the method according to any one of claims 1 to 4 is implemented.