Abnormal behavior detection method and device, equipment and storage medium

Abstract

The invention relates to the technical field of data processing, in particular to an abnormal behavior detection method, device and equipment and a storage medium, and the method comprises the steps: obtaining and preprocessing historical order data, extracting time, space and frequency features from the historical order data, and forming training data; constructing and training an anomaly detection model, and deploying the trained anomaly detection model to detect whether there is an abnormal behavior in the real-time order information; if the abnormality is found, generating early warning information according to a preset early warning rule; according to the method disclosed by the invention, real-time monitoring and analysis of real-time order information are realized by deploying the trained anomaly detection model, so that the risk response speed of a logistics enterprise is improved, and powerful safety guarantee is provided for daily operation of the logistics enterprise; when an abnormal behavior is detected, early warning information is automatically generated, so that logistics enterprises can be helped to take measures in time, economic loss and reputation risk are avoided, and operation efficiency and risk management capability are improved.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to an abnormal behavior detection method, device, equipment and storage medium. Background Art

[0002] Currently, the monitoring and handling of abnormal express delivery behavior mainly relies on manual feedback mechanisms. This reliance has led to a series of significant problems:

[0003] First, since the discovery of abnormal behavior often requires customers to first realize the problem and actively contact customer service, the feedback on abnormal behavior has a significant lag. That is, customers may provide feedback some time after the problem occurs. This means that abnormal behavior has already affected service quality and customer satisfaction before it is discovered and handled. The lag in manual feedback also means that preventive measures cannot be taken in time to reduce losses.

[0004] Secondly, there are situations where no one reports abnormal behavior, that is, some abnormal behaviors may be completely ignored because the customer is not aware of the problem or does not contact customer service in time. This may cause the problem to persist, and the express company cannot take timely measures to resolve it, thereby increasing the risk and uncertainty of express delivery services.

[0005] Due to the lack of real-time monitoring and automated processing mechanisms, express delivery companies find it difficult to detect and deal with abnormal behavior in the early stages. It can be seen that existing technologies still need to be improved and enhanced. Summary of the Invention

[0006] In order to overcome the shortcomings of the existing technology, the purpose of the present invention is to provide an abnormal behavior detection method. By deploying a trained anomaly detection model, it can realize the instant monitoring and analysis of real-time order information, which not only improves the risk response speed of logistics companies, but also provides strong security protection for the daily operations of logistics companies.

[0007] A first aspect of the present invention provides an abnormal behavior detection method, including: obtaining historical order data and preprocessing it to obtain preprocessed historical data; performing feature extraction processing on the preprocessed historical data to obtain historical feature data, wherein the historical feature data includes time features, spatial features, and frequency features; preprocessing the historical feature data to obtain training data; constructing an anomaly detection model, training the anomaly detection model based on the training data, and deploying the trained anomaly detection model; obtaining real-time order information, and using the trained anomaly detection model to detect and judge abnormal behavior in the real-time order information; if abnormal behavior exists, generating warning information based on preset warning rules.

[0008] Optionally, in a first implementation method of the first aspect of the present invention, the obtaining of historical order data and preprocessing thereof to obtain preprocessed historical data includes: obtaining historical order data, the historical order data including multiple historical orders and historical order information corresponding to the historical orders; performing data cleaning processing, time data completion processing, and address data completion processing on the historical order data to obtain first processed data; performing desensitizing processing on the first processed data to obtain second processed data; and using a preselected map API to perform latitude and longitude conversion processing on the second processed data to obtain preprocessed historical data.

[0009] Optionally, in a second implementation method of the first aspect of the present invention, the pre-processed historical data is subjected to feature extraction processing to obtain historical feature data, and the historical feature data includes time features, spatial features and frequency features, including: performing an extraction process on each historical order information in the pre-processed historical data one by one, obtaining the timestamp of each express link and performing calculation processing to obtain the time feature; performing a secondary extraction process on each historical order information in the pre-processed historical data one by one, using a pre-prepared map API to obtain the actual transportation path, and using the Haversine formula to calculate the actual transportation distance to obtain the spatial feature; performing a thrice extraction process on each historical order information in the pre-processed historical data one by one, counting the number of transfers and the number of delivery attempts to obtain the frequency feature; integrating the time feature, spatial feature and frequency feature to obtain the historical feature data.

[0010] Optionally, in a third implementation of the first aspect of the present invention, the historical feature data is preprocessed to obtain training data, including: based on a preset sequence length, the time features included in the historical feature data are organized into a time series, and the organized time series is normalized to obtain adapted time series features; the adapted time series features, spatial features and frequency features are integrated and labeled to obtain input data; the input data is divided according to a preset division ratio to obtain training data, and the training data includes a training set and a test set.

[0011] Optionally, in a fourth implementation manner of the first aspect of the present invention, constructing an anomaly detection model, training the anomaly detection model based on the training data, and deploying the trained anomaly detection model, includes: constructing an XGBoost model, configuring the initial number of decision trees, the maximum depth of the initial decision tree, and the initial learning rate of the XGBoost model, and using the spatial features and frequency features in the training set to train the XGBoost model; constructing a Transformer model, configuring the model dimension, the number of attention heads, and the number of encoder layers of the Transformer model, and training the Transformer model using the adapted timing features in the training set; setting a fully connected layer to concatenate the output of the trained Transformer model and the output of the trained XGBoost model, and using the training set to train the fully connected layer to obtain a trained anomaly detection model; using a test set to test the trained anomaly detection model, and judging whether the preset deployment requirements are met based on the test results; if so, deploying the trained anomaly detection model.

[0012] Optionally, in a fifth implementation of the first aspect of the present invention, the real-time order information is obtained and a trained anomaly detection model is used to detect and judge abnormal behavior of the real-time order information, including: obtaining real-time order information through a Kafka message queue, and performing data cleaning processing on the real-time order information to obtain pre-processed real-time information; performing feature extraction processing on the pre-processed real-time information to obtain real-time time features, real-time spatial features, and real-time frequency features, and based on a preset sequence length, organizing the real-time time features into a real-time time series; inputting the real-time time series, real-time spatial features, and real-time frequency features into the trained anomaly detection model to obtain detection results.

[0013] Optionally, in a sixth implementation of the first aspect of the present invention, if abnormal behavior exists, warning information is generated based on preset warning rules, including: when the detection result indicates the existence of abnormal behavior, abnormal behavior information is obtained, and the abnormal behavior information includes the abnormal behavior type and the abnormal level corresponding to the abnormal behavior type; based on the abnormal behavior information, corresponding preset warning rules are obtained, and the preset warning rules include a preset warning method and a preset warning template; the express number included in the real-time order information is obtained, and the obtained express number and the abnormal behavior information are filled into the warning template to obtain warning information; and a warning instruction is generated based on the warning method and the warning information.

[0014] The second aspect of the present invention provides an abnormal behavior detection device, including: a first processing module, used to obtain historical order data and preprocess it to obtain preprocessed historical data; a feature extraction module, used to perform feature extraction processing on the preprocessed historical data to obtain historical feature data, wherein the historical feature data includes time features, spatial features and frequency features; a second processing module, used to preprocess the historical feature data to obtain training data; a training module, used to construct an anomaly detection model, train the anomaly detection model based on the training data, and deploy the trained anomaly detection model; a detection module, used to obtain real-time order information, and use the trained anomaly detection model to detect and judge abnormal behavior of the real-time order information; an early warning module, used to generate early warning information based on preset early warning rules if abnormal behavior exists.

[0015] Optionally, in a first implementation method of the second aspect of the present invention, the first processing module includes: a first acquisition unit, used to acquire historical order data, the historical order data including multiple historical orders and historical order information corresponding to the historical orders; a first processing unit, used to perform data cleaning processing, time data completion processing, and address data completion processing on the historical order data to obtain first processed data; a desensitizing unit, used to perform desensitizing processing on the first processed data to obtain second processed data; a conversion unit, used to use a preselected map API to perform latitude and longitude conversion processing on the second processed data to obtain preprocessed historical data.

[0016] Optionally, in a second implementation of the second aspect of the present invention, the feature extraction module includes: a first extraction unit, used to perform one-time extraction processing on each historical order information in the pre-processed historical data, obtain the timestamp of each express link and perform calculation processing to obtain time features; a second extraction unit, used to perform two-time extraction processing on each historical order information in the pre-processed historical data, use a pre-made map API to obtain the actual transportation path, and use the Haversine formula to calculate the actual transportation distance to obtain spatial features; a third extraction unit, used to perform three-time extraction processing on each historical order information in the pre-processed historical data, count the number of transfers and the number of delivery attempts, and obtain frequency features; an integration unit, used to integrate time features, spatial features and frequency features to obtain historical feature data.

[0017] Optionally, in a third implementation of the second aspect of the present invention, the second processing module includes: a second processing unit, used to organize the time features included in the historical feature data into a time series based on a preset sequence length, and normalize the organized time series to obtain adapted time series features; a labeling unit, used to integrate the adapted time series features, spatial features and frequency features, and perform labeling to obtain input data; a division unit, used to divide the input data according to a preset division ratio to obtain training data, wherein the training data includes a training set and a test set.

[0018] Optionally, in a fourth implementation of the second aspect of the present invention, the training module includes: a first training unit, used to construct an XGBoost model, configure the initial number of decision trees, the maximum depth of the initial decision tree and the initial learning rate of the XGBoost model, and use the spatial features and frequency features in the training set to train the XGBoost model; a second training unit, used to construct a Transformer model, configure the model dimension, the number of attention heads and the number of encoder layers of the Transformer model, and use the adaptive timing features in the training set to train the Transformer model; a third training unit, used to set the output of the fully connected layer concatenating the trained Transformer model and the output of the trained XGBoost model, and use the training set to train the fully connected layer to obtain a trained anomaly detection model; a testing unit, used to test the trained anomaly detection model using a test set, and determine whether the preset deployment requirements are met according to the test results; a deployment unit, used to deploy the trained anomaly detection model if it is met.

[0019] Optionally, in a fifth implementation of the second aspect of the present invention, the detection module includes: a second acquisition unit, used to obtain real-time order information through a Kafka message queue, and perform data cleaning processing on the real-time order information to obtain preprocessed real-time information; a third processing unit, used to perform feature extraction processing on the preprocessed real-time information to obtain real-time time features, real-time spatial features and real-time frequency features, and based on a preset sequence length, organize the real-time time features into a real-time time series; a detection unit, used to input the real-time time series, real-time spatial features and real-time frequency features into a trained anomaly detection model to obtain detection results.

[0020] Optionally, in a sixth implementation of the second aspect of the present invention, the early warning module includes: a third acquisition unit, for acquiring abnormal behavior information when the detection result indicates the presence of abnormal behavior, the abnormal behavior information including the abnormal behavior type and the abnormal level corresponding to the abnormal behavior type; a fourth acquisition unit, for acquiring corresponding, preset early warning rules based on the abnormal behavior information, the preset early warning rules including a preset early warning method and a preset early warning template; a generation unit, for acquiring the express number included in the real-time order information, filling the acquired express number and the abnormal behavior information into the early warning template to obtain early warning information; an early warning unit, for generating an early warning instruction based on the early warning method and the early warning information.

[0021] A third aspect of the present invention provides an abnormal behavior detection device, which includes: a memory and at least one processor, wherein the memory stores instructions; at least one processor calls the instructions in the memory so that the abnormal behavior detection device performs each step of the abnormal behavior detection method described above.

[0022] A fourth aspect of the present invention provides a computer-readable storage medium having instructions stored thereon, which, when executed by a processor, implement the various steps of any of the above-mentioned abnormal behavior detection methods.

[0023] In the technical solution of the present invention, by acquiring and preprocessing historical order data, time, space and frequency features are extracted from the historical order data to form training data; an anomaly detection model is constructed and trained, and the trained anomaly detection model is deployed to detect whether there is abnormal behavior in real-time order information; if an anomaly is found, an early warning message is generated according to a preset early warning rule; the method disclosed in the present application realizes real-time monitoring and analysis of real-time order information by deploying a trained anomaly detection model, which not only improves the risk response speed of logistics companies, but also provides a strong security guarantee for the daily operation of logistics companies; when abnormal behavior is detected, early warning information is automatically generated, which can help logistics companies take timely measures to avoid economic losses and reputation risks, and improve operational efficiency and risk management capabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 A first flow chart of the abnormal behavior detection method provided by an embodiment of the present invention;

[0025] Figure 2 A second flow chart of the abnormal behavior detection method provided by an embodiment of the present invention;

[0026] Figure 3 A third flow chart of the abnormal behavior detection method provided by an embodiment of the present invention;

[0027] Figure 4 A fourth flow chart of the abnormal behavior detection method provided by an embodiment of the present invention;

[0028] Figure 5 A fifth flow chart of the abnormal behavior detection method provided in an embodiment of the present invention;

[0029] Figure 6 A sixth flow chart of the abnormal behavior detection method provided in an embodiment of the present invention;

[0030] Figure 7 A seventh flow chart of the abnormal behavior detection method provided in an embodiment of the present invention;

[0031] Figure 8 A schematic diagram of the structure of an abnormal behavior detection device provided by an embodiment of the present invention;

[0032] Figure 9 A schematic diagram of the structure of an abnormal behavior detection device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0033] The present invention provides an abnormal behavior detection method, apparatus, device and storage medium. In the present invention, the terms "first", "second", "third", "fourth", etc. (if any) in the description and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "including" or "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0034] For ease of understanding, the specific process of the embodiment of the present invention is described below. Figure 1 An embodiment of the abnormal behavior detection method in the embodiment of the present invention includes:

[0035] 101. Obtain historical order data and preprocess it to obtain preprocessed historical data;

[0036] 102. Perform feature extraction on the pre-processed historical data to obtain historical feature data, where the historical feature data includes time features, spatial features, and frequency features;

[0037] In this embodiment, by preprocessing and feature extraction of historical order data, not only can the surface information in the historical data be fully mined and utilized, but also the deep-seated laws hidden behind the data can be deeply explored; specifically, the extraction of multi-dimensional features such as time features, spatial features, and frequency features provides a comprehensive and accurate data foundation for the subsequent construction of anomaly detection models, ensuring that the input data of the anomaly detection model is both rich and representative.

[0038] 103. Preprocess the historical feature data to obtain training data;

[0039] In this embodiment, the historical feature data is further preprocessed to generate high-quality training data; high-quality training data can not only significantly improve the efficiency and effectiveness of model training, but also effectively avoid model deviations caused by data quality issues.

[0040] 104. Build an anomaly detection model, train the anomaly detection model based on the training data, and deploy the trained anomaly detection model;

[0041] In this embodiment, the trained anomaly detection model is deployed in actual applications to achieve instant monitoring and analysis of real-time order information. When new order information is generated, the anomaly detection model can quickly detect abnormal behavior of the new order information, that is, the real-time order information, and promptly discover and identify potential abnormal orders. This real-time monitoring mechanism not only improves the risk response speed of logistics companies, but also provides strong security guarantees for the daily operations of logistics companies.

[0042] 105. Obtain real-time order information and use the trained anomaly detection model to detect and judge abnormal behavior in the real-time order information;

[0043] 106. If there is abnormal behavior, generate warning information based on the preset warning rules;

[0044] In this embodiment, when the anomaly detection model detects abnormal behavior, it will automatically generate and promptly push warning information based on preset warning rules; these warning information not only contains detailed information about the abnormal order, but may also include preliminary response suggestions to help companies quickly take effective measures to stop losses in a timely manner, avoid or reduce potential economic losses and reputation risks; by setting up a risk warning mechanism, the operational efficiency and risk management capabilities of logistics companies have been significantly improved, laying a solid foundation for the long-term and stable development of logistics companies.

[0045] The present application discloses a method for detecting abnormal behavior, which obtains and preprocesses historical order data, extracts time, space and frequency features from the historical order data, and forms training data; constructs and trains an anomaly detection model, and deploys the trained anomaly detection model to detect whether there is abnormal behavior in real-time order information; if an anomaly is found, generates warning information according to preset warning rules; the method disclosed in the present application, by deploying the trained anomaly detection model, realizes real-time monitoring and analysis of real-time order information, which not only improves the risk response speed of logistics companies, but also provides strong security protection for the daily operations of logistics companies; when abnormal behavior is detected, warning information is automatically generated, which can help logistics companies take timely measures to avoid economic losses and reputation risks, and improve operational efficiency and risk management capabilities.

[0046] See also Figure 2 The second embodiment of the abnormal behavior detection method in the embodiment of the present invention includes:

[0047] 201. Acquire historical order data, where the historical order data includes multiple historical orders and historical order information corresponding to the historical orders;

[0048] 202. Perform data cleaning, time data completion, and address data completion on the historical order data to obtain first processed data;

[0049] In this embodiment, the data cleaning process includes duplicate record processing and invalid data processing. For duplicate records, the database query statement is used, with the express order number as the primary key, to retrieve all duplicate express records and delete them; invalid data includes invalid time data and invalid address data. For invalid time data, if the time format is incorrect, regular expressions are used to match the standard time format; for invalid address data, the validity of the address is judged by calling the preset map API. If the address item is judged to be invalid, a deletion operation is taken or subsequent completion processing is performed.

[0050] In this embodiment, when the time data of historical order data is completed, if the time of a record in any historical order information is missing, the time of the previous and next records of the express number is first obtained. Assuming that the express records are arranged in chronological order, if the receipt time of the current record is missing, the missing receipt time can be calculated by linear interpolation based on the receipt time of the previous record and the transit time of the next record to complete the time data completion.

[0051] In this embodiment, when completing address data for historical order data, fuzzy matching can be performed with the address database within the logistics company to find possible correct addresses to achieve address completion, or a prefix tree can be built based on the historical address database to achieve automatic address completion.

[0052] 203. Perform desensitization processing on the first processed data to obtain second processed data;

[0053] In this embodiment, the first processed data to be desensitized includes name and phone number. For name desensitization, a replacement method can be used to replace the middle character of the user's name with a specific symbol (such as ""); for phone number desensitization, a hash algorithm such as MD5 or SHA-256 can be used to encrypt the phone number; by desensitizing the first processed data, user privacy can be protected and sensitive information leakage can be prevented.

[0054] 204. Using a preselected map API to perform longitude and latitude conversion processing on the second processed data to obtain preprocessed historical data;

[0055] In this embodiment, a preselected map API is used to perform longitude and latitude conversion on the second processed data. Specifically, the address information in the historical order information is encapsulated in the format required by the map API, an HTTP request is sent to the map API server, the returned longitude and latitude coordinate data is received, and after parsing, it is stored in the database and associated with the historical order information.

[0056] See also Figure 3 A third embodiment of the abnormal behavior detection method according to the present invention includes:

[0057] 301. Extract each historical order information in the pre-processed historical data one by one, obtain the timestamp of each express link and perform calculation processing to obtain the time feature;

[0058] In this embodiment, the timestamp of each express link of each historical order information is obtained through database query, such as the collection time, the first transit time, the delivery time, etc., and then the time interval between each express link is calculated, and the total transportation time is calculated to obtain the time characteristics.

[0059] 302. Perform secondary extraction processing on each historical order information in the pre-processed historical data one by one, use the pre-prepared map API to obtain the actual transportation path, and use the Haversine formula to calculate the actual transportation distance to obtain the spatial characteristics;

[0060] In this embodiment, the map API is called to obtain the actual transportation distance through the longitude and latitude of each node in the transportation track in the historical order information, and the Haversine formula is used to calculate the transportation distance between each node and the total transportation distance.

[0061] 303. Extract each historical order information in the pre-processed historical data three times, count the number of transfers and delivery attempts, and obtain frequency features;

[0062] In this embodiment, the number of transfers is determined by querying the express records in the historical order information and counting the number of transfer links. For example, the number of records with the status of "transit" is counted in the database; then, the number of updates of the express delivery status in the historical order information is recorded. When the delivery status is "delivery failed, retry", the number of delivery attempts is counted by 1.

[0063] 304. Integrate time features, space features and frequency features to obtain historical feature data.

[0064] See also Figure 4 The fourth embodiment of the abnormal behavior detection method in the embodiment of the present invention includes:

[0065] 401. Based on a preset sequence length, the time features included in the historical feature data are sorted into a time series, and the sorted time series is normalized to obtain an adaptive time series feature;

[0066] In this embodiment, in order for the Transformer model to effectively process time features, the time features need to be organized into sequences of fixed length. For example, the collection time, various transfer times, and delivery time are arranged in order into a time series. The constructed time series is then normalized using the minimum-maximum normalization method to map the time values to the [0, 1] interval.

[0067] 402. Adjust and match the temporal features, spatial features, and frequency features, and perform labeling to obtain input data.

[0068] In this embodiment, the spatial features and frequency features are structured data and can be directly used as input to the XGBoost model; normal samples in the input data are marked as 0 and abnormal samples are marked as 1 to complete the labeling process of the input data.

[0069] 403. Divide the input data according to a preset division ratio to obtain training data, where the training data includes a training set and a test set.

[0070] In this embodiment, the input data may be divided into a 70% training set and a 30% test set, and the train_test_split function in the scikit-learn library may be used for the division to ensure randomness and balance of the division.

[0071] See also Figure 5 The fifth embodiment of the abnormal behavior detection method in the embodiment of the present invention includes:

[0072] 501. Build an XGBoost model, configure the initial number of decision trees, the maximum depth of the initial decision tree, and the initial learning rate of the XGBoost model, and train the XGBoost model using the spatial features and frequency features in the training set;

[0073] In this embodiment, XGBoost is an ensemble learning algorithm based on a decision tree and is good at processing structured data.

[0074] 502. Build the Transformer model, configure the model dimensions, number of attention heads, and number of encoder layers of the Transformer model, and train the Transformer model using the adapted temporal features in the training set;

[0075] In this embodiment, the Transformer model mainly uses its self-attention mechanism to capture long-term dependencies in time series; the Transformer model includes multiple encoder layers, each of which consists of a multi-head attention mechanism and a feedforward neural network.

[0076] In this embodiment, for the XGBoost model, the structured data in the training set, i.e., the spatial features and frequency features, are used for training, and the performance of the XGBoost model is evaluated through cross-validation to select the optimal model parameters; for the Transformer model, the time series data in the training set, i.e., the adapted time series features, are used for training, and the loss function and accuracy of the model are monitored during the training process.

[0077] 503. Setting a fully connected layer to concatenate the output of the trained Transformer model and the output of the trained XGBoost model, and using the training set to train the fully connected layer to obtain a trained anomaly detection model;

[0078] In this embodiment, the output of the XGBoost model (a scalar value representing the possibility of anomaly) and the output of the Transformer model (a feature vector) are spliced together in series to form a new feature vector; a fully connected layer is added to the formed feature vector, and the added fully connected layer is trained to learn how to combine the outputs of the two models to obtain the final abnormal behavior detection result; specifically, the outputs of the trained XGBoost model and the Transformer model are spliced according to the aforementioned fusion structure design, and then input into the fully connected layer for training; during the training process, the back propagation algorithm is used to update the parameters of the fully connected layer to minimize the loss function between the predicted results and the true labels.

[0079] 504. Use the test set to test the trained anomaly detection model, and determine whether it meets the preset deployment requirements based on the test results;

[0080] In this embodiment, the fused model, i.e., the anomaly detection model, is evaluated using test set data. The main evaluation indicators include accuracy, precision, recall, and F1 value. The calculated evaluation indicators are compared with the preset deployment requirements. If the evaluation indicators meet or exceed the preset requirements, the model can be considered to meet the deployment conditions. If the evaluation indicators do not meet the preset requirements, the model needs to be further optimized or adjusted to improve its performance.

[0081] 505. If satisfied, deploy the trained anomaly detection model.

[0082] See also Figure 6 The sixth embodiment of the abnormal behavior detection method in the embodiments of the present invention includes:

[0083] 601. Obtain real-time order information through the Kafka message queue, and perform data cleaning on the real-time order information to obtain pre-processed real-time information;

[0084] In this embodiment, data completion processing, desensitization processing and longitude and latitude conversion processing are performed on the real-time order information to obtain pre-processed real-time information.

[0085] 602. Perform feature extraction on the pre-processed real-time information to obtain real-time time features, real-time spatial features, and real-time frequency features, and organize the real-time time features into a real-time time series based on a preset sequence length;

[0086] In this embodiment, by performing feature extraction on the pre-processed real-time information and organizing the real-time time features into real-time time series, not only the timeliness of data processing is improved, but also subsequent analysis and prediction work can more accurately capture the temporal dynamic changes in the data, providing solid data support for the decision-making process; in addition, by combining spatial features and frequency features, the distribution patterns and trends of real-time data can be more comprehensively grasped, thereby further enhancing the efficiency of information processing and application.

[0087] 603. Input the real-time time series, real-time spatial features, and real-time frequency features into the trained anomaly detection model to obtain a detection result.

[0088] See also Figure 7 The seventh embodiment of the abnormal behavior detection method in the embodiments of the present invention includes:

[0089] 701. When the detection result indicates that abnormal behavior exists, obtain abnormal behavior information, where the abnormal behavior information includes the abnormal behavior type and the abnormality level corresponding to the abnormal behavior type;

[0090] In this embodiment, first, data is captured and analyzed in real time through an anomaly detection model. Once abnormal behavior is detected, an exception handling mechanism is immediately triggered. Next, in the exception handling mechanism, one or more abnormal behavior types are defined. These types should cover all possible abnormal situations, such as path deviation, timeliness anomalies, multiple delivery failures, etc. Then, for each abnormal behavior type, one or more abnormal levels are set. The abnormality levels can be divided according to factors such as the severity of the abnormality and the scope of impact. For example, when the actual path distance is greater than 150% of the theoretical distance, the warning level is defined as high risk. When the same courier fails to be delivered twice, the warning level is defined as medium risk. When a specific type of abnormal behavior is detected, the type corresponding to the abnormal behavior is automatically determined, and the abnormality level of the abnormal behavior is evaluated and determined according to preset rules or algorithms. Finally, the abnormal behavior information, including the abnormal behavior type and the abnormality level corresponding to the abnormal behavior type, is recorded in a log or database for subsequent analysis, processing and auditing.

[0091] 702. Acquire corresponding preset warning rules based on the abnormal behavior information, wherein the preset warning rules include a preset warning method and a preset warning template;

[0092] In this embodiment, the warning method can be a text message warning or a system pop-up window warning, and a corresponding warning template is obtained according to the warning method and abnormal behavior information.

[0093] 703. Obtain the express delivery number included in the real-time order information, and enter the obtained express delivery number and the abnormal behavior information into the warning template to obtain warning information;

[0094] In this embodiment, the extracted express delivery number and the detected abnormal behavior information are filled into a predefined warning template. The warning template should contain fields such as the express delivery number, abnormal behavior type and description. Based on this information, clear and concise warning information is generated to facilitate relevant personnel to quickly understand the order abnormality.

[0095] 704. Generate a warning instruction based on the warning method and the warning information.

[0096] In this embodiment, the generated warning instruction includes key information such as sending method, time, recipient, warning information and possible impact; by generating the warning instruction, relevant personnel can take timely response measures to deal with order abnormalities.

[0097] The above describes the abnormal behavior detection method in the embodiment of the present invention. The following describes the abnormal behavior detection device in the embodiment of the present invention. Figure 8 In one embodiment of the present invention, an abnormal behavior detection device includes:

[0098] The first processing module 801 is used to obtain historical order data and preprocess it to obtain preprocessed historical data; the feature extraction module 802 is used to perform feature extraction processing on the preprocessed historical data to obtain historical feature data, and the historical feature data includes time features, spatial features and frequency features; the second processing module 803 is used to preprocess the historical feature data to obtain training data; the training module 804 is used to build an anomaly detection model, train the anomaly detection model based on the training data, and deploy the trained anomaly detection model; the detection module 805 is used to obtain real-time order information, and use the trained anomaly detection model to detect and judge abnormal behavior in the real-time order information; the early warning module 806 is used to generate early warning information based on preset early warning rules if abnormal behavior exists.

[0099] In this embodiment, the first processing module 801 includes: a first acquisition unit 8011, used to acquire historical order data, wherein the historical order data includes multiple historical orders and historical order information corresponding to the historical orders; a first processing unit 8012, used to perform data cleaning processing, time data completion processing, and address data completion processing on the historical order data to obtain first processed data; a desensitizing unit 8013, used to perform desensitizing processing on the first processed data to obtain second processed data; a conversion unit 8014, used to use a preselected map API to perform latitude and longitude conversion processing on the second processed data to obtain preprocessed historical data.

[0100] In this embodiment, the feature extraction module 802 includes: a first extraction unit 8021, which is used to perform an extraction process on each historical order information in the pre-processed historical data one by one, obtain the timestamp of each express link and perform calculation processing to obtain the time feature; a second extraction unit 8022, which is used to perform a secondary extraction process on each historical order information in the pre-processed historical data one by one, use a pre-prepared map API to obtain the actual transportation path, and use the Haversine formula to calculate the actual transportation distance to obtain the spatial feature; a third extraction unit 8023, which is used to perform a three-time extraction process on each historical order information in the pre-processed historical data one by one, count the number of transfers and the number of delivery attempts, and obtain the frequency feature; an integration unit 8024, which is used to integrate the time feature, spatial feature and frequency feature to obtain historical feature data.

[0101] In this embodiment, the second processing module 803 includes: a second processing unit 8031, which is used to organize the time features included in the historical feature data into a time series based on a preset sequence length, and normalize the organized time series to obtain adapted time series features; a labeling unit 8032, which is used to integrate the adapted time series features, spatial features and frequency features, and perform labeling processing to obtain input data; a division unit 8033, which is used to divide the input data according to a preset division ratio to obtain training data, wherein the training data includes a training set and a test set.

[0102] In this embodiment, the training module 804 includes: a first training unit 8041, which is used to construct an XGBoost model, configure the initial number of decision trees, the maximum depth of the initial decision tree, and the initial learning rate of the XGBoost model, and use the spatial features and frequency features in the training set to train the XGBoost model; a second training unit 8042, which is used to construct a Transformer model, configure the model dimension, the number of attention heads, and the number of encoder layers of the Transformer model, and use the adaptive timing features in the training set to train the Transformer model; a third training unit 8043, which is used to set the output of the fully connected layer concatenating the trained Transformer model and the output of the trained XGBoost model, and use the training set to train the fully connected layer to obtain a trained anomaly detection model; a testing unit 8044, which is used to test the trained anomaly detection model using a test set, and determine whether the preset deployment requirements are met according to the test results; a deployment unit 8045, which is used to deploy the trained anomaly detection model if the requirements are met.

[0103] In this embodiment, the detection module 805 includes: a second acquisition unit 8051, which is used to obtain real-time order information through a Kafka message queue and perform data cleaning processing on the real-time order information to obtain pre-processed real-time information; a third processing unit 8052, which is used to perform feature extraction processing on the pre-processed real-time information to obtain real-time time features, real-time spatial features, and real-time frequency features, and organize the real-time time features into a real-time time series based on a preset sequence length; a detection unit 8053, which is used to input the real-time time series, real-time spatial features, and real-time frequency features into a trained anomaly detection model to obtain detection results.

[0104] In this embodiment, the early warning module 806 includes: a third acquisition unit 8061, which is used to obtain abnormal behavior information when the detection result indicates the presence of abnormal behavior, and the abnormal behavior information includes the abnormal behavior type and the abnormal level corresponding to the abnormal behavior type; a fourth acquisition unit 8062, which is used to obtain the corresponding, preset early warning rules based on the abnormal behavior information, and the preset early warning rules include a preset early warning method and a preset early warning template; a generation unit 8063, which is used to obtain the express number included in the real-time order information, fill the obtained express number and the abnormal behavior information into the early warning template to obtain early warning information; an early warning unit 8064, which is used to generate an early warning instruction based on the early warning method and the early warning information.

[0105] Based on the same idea as the method in the above embodiment, the device provided in this application can implement the method in the above embodiment.

[0106] above Figure 8 The abnormal behavior detection apparatus in the embodiment of the present invention is described in detail from the perspective of modular functional entities. The abnormal behavior detection device in the embodiment of the present invention is described in detail from the perspective of hardware processing.

[0107] Figure 9 FIG2 is a schematic diagram of the structure of an abnormal behavior detection device provided in an embodiment of the present invention. The abnormal behavior detection device 900 may vary significantly due to different configurations or performance. The device may include one or more processors (central processing units, CPUs) 910 (e.g., one or more processors), a memory 920, and one or more storage media 930 (e.g., one or more mass storage devices) storing applications 933 or data 932. The memory 920 and storage medium 930 may be either transient or persistent storage. The program stored in the storage medium 930 may include one or more modules (not shown), each of which may include a series of instruction operations on the abnormal behavior detection device 900. Furthermore, the processor 910 may be configured to communicate with the storage medium 930, and execute the series of instruction operations in the storage medium 930 on the abnormal behavior detection device 900 to implement the steps of the abnormal behavior detection method provided in the above-mentioned method embodiments.

[0108] The abnormal behavior detection device 900 may further include one or more power supplies 940, one or more wired or wireless network interfaces 950, one or more input and output interfaces 960, and / or one or more operating systems 931, such as Windows Server, Mac OS X, Unix, Linux, FreeBSD, etc. It will be understood by those skilled in the art that Figure 9The structure of the abnormal behavior detection device shown does not constitute a limitation on the abnormal behavior detection device, and may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently.

[0109] The present invention also provides a computer-readable storage medium, which may be a non-volatile computer-readable storage medium or a volatile computer-readable storage medium. The computer-readable storage medium stores instructions, which, when executed on a computer, cause the computer to execute the steps of the abnormal behavior detection method.

[0110] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the above-described systems, devices, and units can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0111] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), magnetic disk or optical disk, etc., various media that can store program code.

[0112] Finally, it should be noted that the above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art will be able to modify the technical solutions described in the aforementioned embodiments or substitute equivalents for some of the technical features. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention shall be included within the scope of protection of the present invention.

Claims

1. A method for detecting abnormal behavior, characterized in that: include: Obtain historical order data and preprocess it to obtain preprocessed historical data; Performing feature extraction processing on the pre-processed historical data to obtain historical feature data, wherein the historical feature data includes time features, spatial features, and frequency features; Preprocess historical feature data to obtain training data; Building an anomaly detection model, training the anomaly detection model based on the training data, and deploying the trained anomaly detection model; Obtain real-time order information and use the trained anomaly detection model to detect and judge abnormal behavior in the real-time order information; If there is abnormal behavior, an early warning message is generated based on the preset early warning rules.

2. The abnormal behavior detection method according to claim 1, characterized in that: The acquiring and preprocessing of historical order data to obtain preprocessed historical data includes: Acquire historical order data, where the historical order data includes multiple historical orders and historical order information corresponding to the historical orders; Performing data cleaning, time data completion, and address data completion on the historical order data to obtain first processed data; Performing desensitization processing on the first processed data to obtain second processed data; The second processed data is converted into longitude and latitude using a preselected map API to obtain preprocessed historical data.

3. The abnormal behavior detection method according to claim 2, characterized in that: The feature extraction process is performed on the pre-processed historical data to obtain historical feature data, wherein the historical feature data includes time features, spatial features and frequency features, including: Extract each historical order information in the pre-processed historical data one by one, obtain the timestamp of each express link and perform calculations to obtain the time feature; Perform secondary extraction on each historical order information in the pre-processed historical data one by one, use the pre-defined map API to obtain the actual transportation path, and use the Haversine formula to calculate the actual transportation distance to obtain spatial features; Extract each historical order information in the preprocessed historical data three times, count the number of transfers and delivery attempts, and obtain frequency features; Integrate time features, space features and frequency features to obtain historical feature data.

4. The abnormal behavior detection method according to claim 1, characterized in that: The preprocessing of the historical feature data to obtain training data includes: Based on the preset sequence length, the time features included in the historical feature data are sorted into a time series, and the sorted time series are normalized to obtain the adapted time series features; Fit the temporal features, spatial features, and frequency features, and perform labeling to obtain input data; The input data is divided and processed according to a preset division ratio to obtain training data, which includes a training set and a test set.

5. The abnormal behavior detection method according to claim 4, characterized in that: The constructing of the anomaly detection model, training the anomaly detection model based on the training data, and deploying the trained anomaly detection model includes: Build an XGBoost model, configure the initial number of decision trees, the maximum depth of the initial decision tree, and the initial learning rate of the XGBoost model, and train the XGBoost model using the spatial features and frequency features in the training set; Build a Transformer model, configure the model dimensions, number of attention heads, and number of encoder layers of the Transformer model, and train the Transformer model using the adapted temporal features in the training set; A fully connected layer is set to concatenate the output of the trained Transformer model and the output of the trained XGBoost model, and the fully connected layer is trained using the training set to obtain a trained anomaly detection model; Use the test set to test the trained anomaly detection model and determine whether it meets the preset deployment requirements based on the test results. If satisfied, the trained anomaly detection model is deployed.

6. The abnormal behavior detection method according to claim 1, characterized in that: The step of obtaining real-time order information and detecting and judging abnormal behavior of the real-time order information using a trained anomaly detection model includes: Obtain real-time order information through the Kafka message queue, and perform data cleaning on the real-time order information to obtain pre-processed real-time information; Perform feature extraction on the pre-processed real-time information to obtain real-time time features, real-time spatial features, and real-time frequency features, and organize the real-time time features into real-time time series based on a preset sequence length; The real-time time series, real-time spatial features, and real-time frequency features are input into the trained anomaly detection model to obtain the detection results.

7. The abnormal behavior detection method according to claim 6, characterized in that: If there is abnormal behavior, an early warning message is generated based on the preset early warning rules, including: When the detection result indicates that abnormal behavior exists, abnormal behavior information is obtained, wherein the abnormal behavior information includes the abnormal behavior type and the abnormality level corresponding to the abnormal behavior type; Acquire corresponding, preset warning rules based on abnormal behavior information, wherein the preset warning rules include a preset warning method and a preset warning template; Obtaining the express delivery number included in the real-time order information, and filling the obtained express delivery number and the abnormal behavior information into the warning template to obtain warning information; A warning instruction is generated based on the warning method and the warning information.

8. An abnormal behavior detection device, characterized in that: include: The first processing module is used to obtain historical order data and preprocess it to obtain preprocessed historical data; A feature extraction module is used to perform feature extraction processing on the pre-processed historical data to obtain historical feature data, wherein the historical feature data includes time features, spatial features and frequency features; The second processing module is used to pre-process the historical feature data to obtain training data; A training module, configured to build an anomaly detection model, train the anomaly detection model based on the training data, and deploy the trained anomaly detection model; The detection module is used to obtain real-time order information and use the trained anomaly detection model to detect abnormal behavior in real-time order information; The early warning module is used to generate early warning information based on preset early warning rules if there is abnormal behavior.

9. An abnormal behavior detection device, characterized in that: The abnormal behavior detection device includes: a memory and at least one processor, wherein the memory stores instructions; At least one of the processors calls the instructions in the memory to enable the abnormal behavior detection device to perform each step of the abnormal behavior detection method according to any one of claims 1 to 7.

10. A computer-readable storage medium having instructions stored thereon, characterized in that: When the instructions are executed by a processor, the steps of the abnormal behavior detection method according to any one of claims 1 to 7 are implemented.

Images