Student behavior anomaly detection system based on clustering processing

Abstract

The present invention discloses a student behavior anomaly detection system based on clustering processing, including a data acquisition module, a behavior neighborhood set definition module, a behavior density weighted kernel definition module, an initial anomaly score construction module, a cluster center correction module, a two-stage allocation strategy design module, and a student behavior anomaly detection module. The present invention belongs to the field of data processing, and specifically refers to a student behavior anomaly detection system based on clustering processing. This scheme introduces adaptive neighborhood division to avoid misreporting normal marginal student behaviors as anomalies; introduces density trust to solve false alarms of pseudo-high-density behaviors; introduces an abnormal pattern dispersion factor to ensure that anomaly detection is both diverse and non-repetitive; introduces an iterative attenuation reinforcement factor to avoid repeatedly focusing on high-density mainstream behavior groups; based on adaptive neighborhood diffusion, ensures accurate classification of students in the core group; based on the two-stage allocation strategy, gradually refines the behavior boundary to avoid misidentifying isolated noise behaviors as anomalies.

Description

Technical Field

[0001] The present invention relates to the field of data processing, and in particular to a student behavior anomaly detection system based on clustering processing. Background Art

[0002] A student behavior anomaly detection system utilizes data analysis techniques to monitor and analyze student behavior data in real time within a campus environment, thereby promptly detecting and warning of abnormal or potentially risky behavior. This system aims to assist schools in effectively identifying potentially anomalous student activity, ensuring student safety and promoting intelligent campus management. However, typical student behavior anomaly detection systems suffer from inadequate identification of potentially outlier behaviors, poor detection of diverse and heterogeneous anomalies, and high false positive rates. They also suffer from a high degree of misclassification of boundary noise behavior data, making it difficult to adapt to the time-varying nature of student behavior patterns, and reducing the reliability of anomaly detection. Summary of the Invention

[0003] In view of the above situation, in order to overcome the defects of the prior art, the present invention provides a student behavior anomaly detection system based on clustering processing. In view of the problems that the general student behavior anomaly detection system has inappropriate recognition of potential outlier abnormal behaviors, poor detection ability of diverse heterogeneous anomalies, and high false alarm rate, this solution introduces adaptive neighborhood division to avoid misreporting normal marginal student behaviors as abnormalities; by introducing density trust, it can better discover hidden small group anomalies and solve the false alarm of pseudo high-density behavior; by introducing abnormal pattern dispersion factors, it ensures that anomaly detection is both diverse and non-repetitive; thereby improving the accuracy of anomaly detection; in view of the boundary problems of the general student behavior anomaly detection system A large amount of noise behavior data is misclassified, which makes it difficult to adapt to the time-varying characteristics of student behavior patterns and reduces the credibility of anomaly detection. This scheme introduces an iterative attenuation reinforcement factor to avoid repeatedly focusing on high-density mainstream behavior groups in student behavior anomaly detection, ensuring that new abnormal behaviors that appear later are not masked by early mainstream behaviors; based on adaptive neighborhood diffusion, a high-confidence area and a low-false alarm core area are formed for each cluster center to ensure the accurate classification of student samples in the core group; based on a two-stage allocation strategy, the behavior boundaries are gradually refined to avoid misidentifying isolated noise behaviors as anomalies, preventing excessive warnings and not missing potential risks of student abnormal behavior.

[0004] The technical solution adopted by the present invention is as follows: the student behavior anomaly detection system based on clustering processing provided by the present invention includes a data acquisition module, a behavior neighborhood set definition module, a behavior density weighted kernel definition module, an initial anomaly score construction module, a cluster center correction module, a two-stage allocation strategy design module and a student behavior anomaly detection module;

[0005] The data collection module collects student behavior data and constructs a student behavior data set;

[0006] The behavior neighborhood set definition module takes the maximum neighborhood upper limit based on the student behavior dataset, constructs a neighborhood subset, and defines an adaptive neighborhood and a sparse neighborhood;

[0007] The behavioral density weighted kernel definition module obtains the comprehensive density based on the adaptive neighborhood and the sparse neighborhood;

[0008] The initial anomaly score building module obtains the initial anomaly score by calculating the anomaly distance;

[0009] The cluster center correction module selects the cluster center of the student behavior dataset based on the initial anomaly score, and corrects the initial anomaly score with an iterative attenuation factor, thereby correcting the cluster center;

[0010] The two-stage allocation strategy design module performs cluster allocation on student behavior data;

[0011] The student behavior anomaly detection module realizes student behavior anomaly detection based on clustering results.

[0012] Furthermore, the behavior neighborhood set definition module takes the maximum neighborhood upper limit M, which is expressed as: ; For each student sample i, calculate the distance vector V of the M nearest neighbors i , find the index s of the maximum jump i , let the previous s i The nearest neighbor is the adaptive behavior neighborhood CS i , and the rest are sparse behavioral neighborhood FS i ;in, is the size of the student behavior dataset; m is the number of feature dimensions of the student behavior data; Cons is the upper bound of the maximum neighborhood limit.

[0013] Furthermore, the behavior density weighted kernel definition module constructs subset behavior density, which is expressed as: ; ;in, is the average distance between behaviors; N is the neighbor subset, j is the neighbor index; is the Euclidean distance between the behavior data of the i-th student and the behavior data of the j-th student; is the subset behavior density; introduce density trust and define the behavior consistency index , expressed as: ; Density Trust Expressed as: ; Then define the comprehensive behavior density, expressed as:

[0014] ;in, and They are the neighborhood density based on adaptive behavioral neighborhood and sparse behavioral neighborhood respectively; is the comprehensive behavior density of the behavior data of the i-th student.

[0015] Furthermore, the initial anomaly score construction module constructs the initial anomaly score by combining the comprehensive behavior density and relative distance, and introduces the anomaly pattern dispersion factor Make the correction, expressed as: ; ; ;in, is the abnormal distance score; is the comprehensive behavior density of the j-th student behavior data; is the initial abnormality score; is the repulsion strength coefficient; is the behavioral difference attenuation coefficient; is the minimum distance from the i-th student behavior data to the selected cluster center; C is the set of selected cluster centers.

[0016] Furthermore, the cluster center correction module specifically includes the following contents:

[0017] Initialization, all samples , indicating unallocated; ; is the count of selected cluster centers; is the cluster marker;

[0018] Select the individual c with the largest initial anomaly score as the first cluster center and mark it ;

[0019] Construct cluster diffusion area and transform the adaptive neighbor CS of c c All are marked as 1 and added to queue Q, and the K-nearest neighbor majority voting rule is used to spread the cluster;

[0020] Define the iterative attenuation reinforcement factor, when the cluster center At the tth iteration, the iteration weight is defined , expressed as: ; Iterative decay enhancement factor Expressed as: ; ; Calculate the correction decision value, expressed as: ;in, is the control coefficient; is the decay coefficient; T is the current iteration round; is the distance to the nearest cluster center; is the correction decision value;

[0021] Select cluster centers based on corrected decision values , expressed as: ; ; Among them, the cluster diffusion area construction, iterative attenuation reinforcement factor update, and decision value recalculation are repeated until the expected k cluster centers are found.

[0022] Furthermore, the two-stage allocation strategy design module specifically includes:

[0023] The first phase of allocation: Initialize the queue Q, queue the unassigned neighbors of each cluster center and mark them; each time the first element r is taken out of the queue, if r's unassigned neighbors cn satisfy: ; then enter the queue and mark it as the same cluster; until Q is empty; among them, is the Euclidean distance between r and cn; is the average behavioral distance between r and its adaptive behavioral neighbors; is the comprehensive behavior density of the unassigned neighbors cn; is the comprehensive behavior density of the team leader r;

[0024] The second stage is allocation; the confidence of each cluster is calculated by using the neighbor ratio × distance for the remaining student behavior data, and the unassigned ones are gradually allocated; the neighbor attribution matrix is ​​constructed, and the matrix elements Expressed as: ; Degree of belonging Expressed as: ; Calculate weighted attribution , expressed as: ; The secondary allocation step is: calculate the weighted attribution of all unallocated samples, and take the maximum weighted attribution pair (r, c) in the unallocated set US; let ; Update the neighboring attribution, attribution and weighted attribution of samples adjacent to r; Repeat until US is empty; If there are any remaining, they are assigned to the nearest and denser assigned neighbor cluster.

[0025] Furthermore, the student behavior anomaly detection module sets a minimum cluster size threshold based on the clustering results of the student behavior data set, marks clusters with a cluster size lower than the minimum cluster size threshold as candidate anomaly clusters, calculates the corrected decision value of the student behavior data for all candidate anomaly clusters, takes the quantile threshold, marks the student behavior data with a corrected decision value higher than the quantile threshold as anomaly, and issues an early warning to management personnel.

[0026] The beneficial effects achieved by the present invention using the above scheme are as follows:

[0027] (1) Aiming at the problems of improper recognition of potential outlier abnormal behaviors, poor detection ability of diverse and heterogeneous anomalies, and high false alarm rate in general student behavior anomaly detection systems, this scheme introduces adaptive neighborhood division to avoid misreporting normal marginal student behaviors as abnormalities; by introducing density trust, it can better discover hidden small group anomalies and solve the false alarm of pseudo high-density behaviors; by introducing abnormal pattern dispersion factors, it ensures that anomaly detection is both diverse and non-repetitive, thereby improving the accuracy of anomaly detection.

[0028] (2) In view of the problem that a large amount of boundary noise behavior data is misclassified in general student behavior anomaly detection systems, making it difficult to adapt to the time-varying characteristics of student behavior patterns and reducing the credibility of anomaly detection, this scheme introduces an iterative attenuation reinforcement factor to avoid repeatedly focusing on high-density mainstream behavior groups in student behavior anomaly detection, ensuring that new abnormal behaviors that appear later are not masked by early mainstream behaviors; based on adaptive neighborhood diffusion, a high-confidence area and a low-false-alarm core area are formed for each behavior center to ensure accurate classification of student samples in the core group; based on a two-stage allocation strategy, the behavior boundary is gradually refined to avoid misidentifying isolated noise behaviors as abnormalities, preventing excessive warnings and not missing potential student abnormal behavior risks. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1 This is a flow chart of the student behavior anomaly detection system based on clustering processing provided by the present invention.

[0030] The accompanying drawings are used to provide further understanding of the present invention and constitute a part of the specification. They are used to explain the present invention together with the embodiments of the present invention and do not constitute a limitation of the present invention. DETAILED DESCRIPTION

[0031] The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments; based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0032] In the description of the present invention, it should be understood that terms such as "upper", "lower", "front", "back", "left", "right", "top", "bottom", "inside" and "outside" indicating directions or positional relationships are based on the directions or positional relationships shown in the accompanying drawings. They are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific direction, be constructed and operated in a specific direction. Therefore, they should not be understood as limiting the present invention.

[0033] Example 1, see Figure 1The student behavior anomaly detection system based on clustering processing provided by the present invention includes a data acquisition module, a behavior neighborhood set definition module, a behavior density weighted kernel definition module, an initial anomaly score construction module, a cluster center correction module, a two-stage allocation strategy design module and a student behavior anomaly detection module;

[0034] The data collection module collects student behavior data and constructs a student behavior data set; and sends the data to the behavior neighborhood set definition module;

[0035] The behavior neighborhood set definition module takes the maximum neighborhood upper limit based on the student behavior data set, constructs a neighborhood subset, and defines an adaptive neighborhood and a sparse neighborhood; and sends the data to the behavior density weighted kernel definition module;

[0036] The behavior density weighted kernel definition module obtains the comprehensive density based on the adaptive neighborhood and the sparse neighborhood; and sends the data to the initial anomaly score construction module;

[0037] The initial anomaly score construction module obtains the initial anomaly score by calculating the anomaly distance; and sends the data to the cluster center correction module;

[0038] The cluster center correction module selects the cluster center of the student behavior data set based on the initial anomaly score, and corrects the initial anomaly score with an iterative attenuation factor, thereby correcting the cluster center; and sends the data to the two-stage allocation strategy design module;

[0039] The two-stage allocation strategy design module performs cluster allocation on the student behavior data; and sends the data to the student behavior anomaly detection module;

[0040] The student behavior anomaly detection module realizes student behavior anomaly detection based on clustering results.

[0041] Example 2, see Figure 1 This embodiment is based on the above embodiment. The data collection module collects student behavior data; the student behavior data includes the average number of steps per day, library study time, campus network access data, online study time, campus card consumption record, number of absences, and book borrowing data; based on the unique hot encoding and normalization processing, the student behavior data set is obtained. Specifically, for the book borrowing data, for each student sample, if there is a book borrowing, the category position is 1, otherwise it is 0; for other numerical data, the maximum and minimum normalization processing is performed, and each numerical feature is mapped. The original value x of the d-dimensional feature of the i-th student is id , the standardized value for ; Among them, min(x d ) and max(x d) are to take the minimum and maximum values ​​of all students in the features respectively; get the final value of each dimension of each student, and then get the student behavior dataset.

[0042] Example 3, see Figure 1 This embodiment is based on the above embodiment. In the behavior neighborhood set definition module, in the student behavior space, ordinary regular behavior samples tend to cluster into large dense clusters, while a few abnormal behaviors are sparsely distributed. Directly taking only the nearest neighbor density will overestimate the neighborhood density in the sparse area and misjudge it as normal. Therefore, the weighted contribution of adaptive neighborhood behaviors is also considered to correct local deviations. The maximum neighborhood upper limit M is taken, expressed as: ; For each student sample i, calculate the distance vector V of the M nearest neighbors i , find the index s of the maximum jump i , let the previous s i The nearest neighbor is the adaptive behavior neighborhood CS i , and the rest are sparse behavioral neighborhood FS i ;in, is the size of the student behavior dataset; m is the number of feature dimensions of the student behavior data; Cons is the upper bound of the maximum neighborhood limit.

[0043] Example 4, see Figure 1 This embodiment is based on the above embodiment. The behavior density weighted kernel definition module constructs the subset behavior density, which is expressed as: ; ;in, is the average distance between behaviors; N is the neighbor subset, j is the neighbor index; is the Euclidean distance between the behavior data of the i-th student and the behavior data of the j-th student; It is the subset behavior density; introducing density trust, in the student group behavior analysis, some student behavior groups may appear to have a high behavior aggregation, which seems to be very dense, but in fact their internal structure is loose, and they are not truly regular behavior pattern clusters. By introducing density trust to consider the uniformity of neighbor distance distribution, this type of seemingly high-density but loosely structured cluster can be effectively suppressed, reducing false positives; defining the behavior consistency index , expressed as: ; Density Trust Expressed as: ; Then define the comprehensive behavior density, expressed as:

[0044] ;in, and They are the neighborhood density based on adaptive behavioral neighborhood and sparse behavioral neighborhood respectively; is the comprehensive behavior density of the i-th student behavior data; it takes into account both regular group behavior and extreme abnormal behavior: distant neighbors may contain a small number of samples with the same abnormality, avoiding ignoring a few anomalies in a simple adaptive neighborhood; it reduces the false high-density misjudgment of isolated anomalies and improves the recognition accuracy of most normal behaviors.

[0045] Example 5, see Figure 1 This embodiment is based on the above embodiment. The initial anomaly score construction module constructs the initial anomaly score by combining the comprehensive behavior density and relative distance for the case where normal behavior clusters are close to each other and the abnormal samples have a large minimum distance from all high-density points, and introduces the abnormal pattern dispersion factor. Correction is made to suppress the selection of abnormal pattern cluster centers that are close to each other, and to improve the sensitivity of detection to different types of abnormal behavior, which can be expressed as: ; ; ;in, is the abnormal distance score; is the comprehensive behavior density of the j-th student behavior data; is the initial abnormality score; is the repulsion strength coefficient; is the behavioral difference attenuation coefficient; is the minimum distance from the i-th student behavior data to the selected cluster center; C is the set of selected cluster centers.

[0046] By performing the above operations, this solution introduces adaptive neighborhood division to address the problems of general student behavior anomaly detection systems, such as improper identification of potential outlier abnormal behaviors, poor detection capabilities of diverse and heterogeneous anomalies, and high false alarm rates. This avoids misreporting normal marginal student behaviors as abnormalities; by introducing density trust, it better discovers hidden small group anomalies and solves false alarms of pseudo-high-density behaviors; by introducing anomaly pattern dispersion factors, it ensures that anomaly detection is both diverse and non-repetitive, thereby improving the accuracy of anomaly detection.

[0047] Example 6, see Figure 1 This embodiment is based on the above embodiment. The redundant risk cluster elimination mechanism design module is to evaluate the inactivity of each cluster only after no new risk cluster is generated for T consecutive iterations; if the growth is insufficient, it will be eliminated, but at least two risk classifications will always be retained; it is expressed as: if ,in, is the number of student samples in the jth cluster at the tTth iteration; is the total number of risk clusters at the tth iteration; then the risk clusters are eliminated; invalid risk categories are cleaned up in time to avoid interference from zombie clusters.

[0048] Example 7, see Figure 1This embodiment is based on the above embodiment. After selecting each cluster center, the cluster center correction module uses an iterative attenuation enhancement factor to dynamically reduce the decision value that has been covered by the cluster diffusion area, giving priority to finding the next truly sparse cluster center and avoiding ignoring abnormal cluster centers. At the same time, it dynamically captures the evolution of behavior patterns to prevent early cluster centers from having too strong an impact on subsequent cluster center selections. It also pays more attention to abnormal patterns that have emerged recently. The specific process includes:

[0049] The cluster center correction module specifically includes the following contents:

[0050] Initialization, all samples , indicating unallocated; ; is the count of selected cluster centers; is the cluster marker;

[0051] Select the individual c with the largest initial anomaly score as the first cluster center and mark it ;

[0052] Construct cluster diffusion area and transform the adaptive neighbor CS of c c All are marked as 1 and added to queue Q, and the K-nearest neighbor majority voting rule is used to spread the cluster;

[0053] Define the iterative attenuation reinforcement factor, when the cluster center At the tth iteration, the iteration weight is defined , expressed as: ; Iterative decay enhancement factor Expressed as: ; ; Calculate the correction decision value, expressed as: ;in, is the control coefficient; is the decay coefficient; T is the current iteration round; is the distance to the nearest cluster center; is the correction decision value;

[0054] Select cluster centers based on corrected decision values , expressed as: ; Among them, the cluster diffusion area construction, iterative attenuation reinforcement factor update, and decision value recalculation are repeated until the expected k cluster centers are found; sparse abnormal behavior clusters are highlighted, and the abnormal patterns are more likely to be selected after correction; dynamic anti-interference, regular neighbors of the marked cluster centers no longer compete, effectively avoiding redundancy within the cluster.

[0055] Example 8, see Figure 1Based on the above embodiment, this embodiment uses a two-stage allocation strategy design module to quickly classify the possible similar behaviors that are most closely related to the selected cluster center into corresponding clusters to form a high-confidence zone. Specifically, it includes:

[0056] The first phase of allocation: Initialize the queue Q, queue the unassigned neighbors of each cluster center and mark them; each time the first element r is taken out of the queue, if r's unassigned neighbors cn satisfy: ; then enter the queue and mark it as the same cluster; until Q is empty; among them, is the Euclidean distance between r and cn; is the average behavioral distance between r and its adaptive behavioral neighbors; is the comprehensive behavior density of the unassigned neighbors cn; is the comprehensive behavior density of the team leader r;

[0057] The second stage is allocation; the confidence of each cluster is calculated by using the neighbor ratio × distance for the remaining student behavior data, and the unassigned ones are gradually allocated; the neighbor attribution matrix is ​​constructed, and the matrix elements Expressed as: ; Degree of belonging Expressed as: ; Calculate weighted attribution , expressed as: ; The secondary allocation step is: calculate the weighted attribution of all unallocated samples, and take the maximum weighted attribution pair (r, c) in the unallocated set US; let ; Update the neighboring attribution, attribution and weighted attribution of samples adjacent to r; Repeat until US is empty; If there are any remaining, they are assigned to the nearest and denser assigned neighbor cluster;

[0058] Refine the attribution by first firmly dividing the high-confidence area and then gradually filling in the edge samples; balance the abnormal and normal, and prevent isolated noise from entering by the proportion of neighbors; the distance index penalizes excessive behavior.

[0059] By performing the above operations, in order to address the problem that general student behavior anomaly detection systems have a large number of misclassified boundary noise behavior data, are difficult to adapt to the time-varying characteristics of student behavior patterns, and reduce the credibility of anomaly detection, this scheme introduces an iterative attenuation reinforcement factor to avoid repeatedly focusing on high-density mainstream behavior groups in student behavior anomaly detection, ensuring that new abnormal behaviors that appear later are not masked by early mainstream behaviors; based on adaptive neighborhood diffusion, a high-confidence area and a low-false-alarm core area are formed for each cluster center to ensure accurate classification of student samples within the core group; based on a two-stage allocation strategy, the behavior boundaries are gradually refined to avoid misidentifying isolated noise behaviors as anomalies, preventing excessive warnings while not missing potential student abnormal behavior risks.

[0060] Example 9, see Figure 1This embodiment is based on the above embodiment. The student behavior anomaly detection module sets a minimum cluster size threshold based on the clustering results of the student behavior data set, and marks clusters with a cluster size lower than the minimum cluster size threshold as candidate abnormal clusters. For all candidate abnormal clusters, the corrected decision value of the student behavior data is calculated, and the quantile threshold is taken. The student behavior data with a corrected decision value higher than the quantile threshold is marked as abnormal, and an early warning is issued to the management personnel.

[0061] While the embodiments of the present invention have been shown and described, it will be apparent to those skilled in the art that various changes, modifications, substitutions, and alterations can be made to the embodiments without departing from the principles and spirit of the invention.

[0062] The present invention and its embodiments are described above. This description is not restrictive. The drawings show only one embodiment of the present invention, and the actual structure is not limited thereto. In short, if a person skilled in the art is inspired by this and, without departing from the purpose of the present invention, designs structures and embodiments similar to this technical solution without inventiveness, they shall fall within the scope of protection of the present invention.

Claims

1. A student behavior anomaly detection system based on clustering processing, characterized by: The system includes a data acquisition module, a behavior neighborhood set definition module, a behavior density weighted kernel definition module, an initial anomaly score construction module, a cluster center correction module, a two-stage allocation strategy design module, and a student behavior anomaly detection module; The data collection module collects student behavior data and constructs a student behavior data set; The behavior neighborhood set definition module takes the maximum neighborhood upper limit based on the student behavior dataset, constructs a neighborhood subset, and defines an adaptive neighborhood and a sparse neighborhood; The behavior density weighted kernel definition module obtains the comprehensive behavior density based on the adaptive neighborhood and the sparse neighborhood; The initial anomaly score building module obtains the initial anomaly score by calculating the anomaly distance; The cluster center correction module selects the cluster center of the student behavior dataset based on the initial anomaly score, and corrects the initial anomaly score with an iterative attenuation factor, thereby correcting the cluster center; The two-stage allocation strategy design module performs cluster allocation on student behavior data; The student behavior anomaly detection module realizes student behavior anomaly detection based on clustering results; The initial anomaly score construction module constructs the initial anomaly score by combining the comprehensive behavior density and relative distance, and introduces the anomaly pattern dispersion factor Make the correction, expressed as: ; ; ;in, is the abnormal distance score; is the comprehensive behavior density of the j-th student behavior data; is the comprehensive behavior density of the behavior data of the i-th student; is the Euclidean distance between the behavior data of the i-th student and the behavior data of the j-th student; is the initial abnormality score; is the repulsion strength coefficient; is the behavioral difference attenuation coefficient; is the minimum distance from the i-th student behavior data to the selected cluster center; C is the set of selected cluster centers.

2. The student behavior anomaly detection system based on clustering processing according to claim 1 is characterized by: The behavior neighborhood set definition module takes the maximum neighborhood upper limit M, which is expressed as: ; For each student sample i, calculate the distance vector V of the M nearest neighbors i , find the index s of the maximum jump i , let the previous s i The nearest neighbor is the adaptive behavior neighborhood CS i , and the rest are sparse behavioral neighborhood FS i ;in, is the size of the student behavior dataset; m is the number of feature dimensions of the student behavior data; Cons is the upper bound of the maximum neighborhood limit.

3. The student behavior anomaly detection system based on clustering processing according to claim 2 is characterized by: The behavior density weighted kernel definition module constructs subset behavior density, which is expressed as: ; ;in, is the average distance between behaviors; N is the neighbor subset, j is the neighbor index; is the subset behavior density; introduce density trust and define the behavior consistency index , expressed as: ; Density Trust Expressed as: ; Then define the comprehensive behavior density, expressed as: ;in, and They are the neighborhood densities based on adaptive behavioral neighborhood and sparse behavioral neighborhood, respectively.

4. The student behavior anomaly detection system based on clustering processing according to claim 3 is characterized by: The cluster center correction module specifically includes the following contents: Initialization, all samples , indicating unallocated; ; is the count of selected cluster centers; is the cluster marker; Select the individual c with the largest initial anomaly score as the first cluster center and mark it ; Construct cluster diffusion area and transform the adaptive neighbor CS of c c All are marked as 1 and added to queue Q, and the K-nearest neighbor majority voting rule is used to spread the cluster; Define the iterative attenuation reinforcement factor, when the cluster center At the tth iteration, the iteration weight is defined , expressed as: ; Iterative decay enhancement factor Expressed as: ; ; Calculate the corrected decision value, expressed as: ;in, is the control coefficient; is the decay coefficient; T is the current iteration round; is the distance to the nearest cluster center; is the correction decision value; Select cluster centers based on corrected decision values , expressed as: ; ; Among them, the cluster diffusion area construction, iterative attenuation reinforcement factor update, and decision value recalculation are repeated until the expected k cluster centers are found.

5. The student behavior anomaly detection system based on clustering processing according to claim 4 is characterized in that: The two-stage allocation strategy design module specifically includes: The first phase of allocation: Initialize the queue Q, queue the unassigned neighbors of each cluster center and mark them; each time the first element r is taken out of the queue, if r's unassigned neighbors cn satisfy: ; then enter the queue and mark it as the same cluster; until Q is empty; among them, is the Euclidean distance between r and cn; is the average behavioral distance between r and its adaptive behavioral neighbors; is the comprehensive behavior density of the unassigned neighbors cn; is the comprehensive behavior density of the team leader r; The second stage is allocation; the confidence of each cluster is calculated by using the neighbor ratio × distance for the remaining student behavior data, and the unassigned ones are gradually allocated; the neighbor attribution matrix is ​​constructed, and the matrix elements Expressed as: ; Degree of belonging Expressed as: ; Calculate weighted attribution , expressed as: ; The secondary allocation step is: calculate the weighted attribution of all unallocated samples, and take the maximum weighted attribution pair (r, c) in the unallocated set US; let ; Update the neighboring attribution, attribution and weighted attribution of samples adjacent to r; Repeat until US is empty; If there are any remaining, they are assigned to the nearest and denser assigned neighbor cluster.

6. The student behavior anomaly detection system based on clustering processing according to claim 5 is characterized by: The student behavior anomaly detection module sets a minimum cluster size threshold based on the clustering results of the student behavior data set, marks clusters with a cluster size lower than the minimum cluster size threshold as candidate anomaly clusters, calculates the corrected decision value of the student behavior data for all candidate anomaly clusters, takes the quantile threshold, marks the student behavior data with a corrected decision value higher than the quantile threshold as anomaly, and issues an early warning to management personnel.

Images