A deep learning-based student abnormal behavior analysis and early warning method

Abstract

The application discloses a kind of student abnormal behavior analysis and early warning method based on deep learning, specifically related to data analysis technical field;By real-time acquisition and student safety related multi-source behavior data, after standardization processing, input deep learning model extracts high-level behavior characteristics, and further calculates behavior fluctuation degree and situation behavior inconsistency index, generates normalized risk score;Combined with the output result of classification model, the suspected pseudo-normal sample that risk is high but is misjudged as normal is identified, and the model classification boundary is optimized in pertinence by local weighted incremental support vector machine, to significantly improve the identification ability and early warning accuracy of the system to implicit abnormal behavior, enhance the robustness and practicality of model in complex campus behavior scene.

Description

Technical Field

[0001] This invention relates to the field of data analysis technology, specifically to a method for analyzing and warning of abnormal student behavior based on deep learning. Background Technology

[0002] Student abnormal behavior analysis and early warning refers to the systematic analysis of students' daily behavior data to identify abnormal behaviors that may indicate psychological problems, academic difficulties, or safety risks, and to issue early warning information in a timely manner so that schools or relevant personnel can take intervention measures to protect students' physical and mental health and campus safety.

[0003] The existing technology has the following shortcomings:

[0004] In the analysis of abnormal student behavior, some students with psychological risks in the training data exhibit highly "normal" behavioral patterns (such as regular attendance and good grades). These potentially abnormal samples are often mislabeled as normal, causing the classification model to incorrectly include them in the "normal paradigm" during the learning phase. This label contamination makes it difficult for the classifier to effectively identify truly abnormal behavior. Unsupervised methods such as autoencoders may also encode these pseudo-normal behaviors as normal features, thereby significantly reducing the overall classification model's sensitivity to latent risks and its recognition accuracy. Summary of the Invention

[0005] The purpose of this invention is to provide a method for analyzing and warning of abnormal student behavior based on deep learning, so as to overcome the shortcomings of the prior art.

[0006] To achieve the above objectives, the present invention provides the following technical solution: a method for analyzing and issuing early warnings of abnormal student behavior based on deep learning, comprising:

[0007] Real-time collection of multi-source behavioral data related to student safety, and standardization processing of the data for subsequent model input;

[0008] High-level feature extraction of behavioral data is performed based on deep learning models to obtain behavioral representation vectors.

[0009] Further extract potential risk-related feature parameters from the behavior representation vector, including behavior volatility and situational behavior inconsistency index;

[0010] The behavioral volatility and situational behavioral inconsistency index are input into the risk assessment model to analyze potential abnormal behaviors of the current sample, obtain a risk score, and determine whether to issue an early warning.

[0011] The risk score is compared with the discrimination result of the classification model. If the classification result is normal but the risk score exceeds the set threshold, the current sample is marked as a suspected pseudo-normal sample.

[0012] For data labeled as suspected pseudo-normal samples, the classification model is locally optimized and the classification boundary is updated.

[0013] Preferably, the standardization process includes timestamp alignment, behavior encoding mapping, and processing of missing data using linear interpolation, moving average, or time window interpolation.

[0014] Preferably, the deep learning model includes convolutional neural networks, recurrent neural networks, long short-term memory networks (LSTM), and Transformer model structures.

[0015] Preferably, the method for obtaining behavioral volatility is as follows: the behavioral feature vectors obtained from the deep learning model are arranged in chronological order to form a sample set. Where: T is the number of time steps within the behavior time window; d is the dimension of each behavior representation vector; v t Let t be the behavior representation vector at the t-th time point;

[0016] The behavior center vector is calculated using either the Minimum Covariance Determinant or Tyler's M-estimator robust estimation method. Behavioral covariance matrix:

[0017] For each action vector v t The robust Mahalanobis distance calculation expression for the row-centered region is as follows: D t Let BV be the robust Mahalanobis distance at time t. The variance of all Mahalanobis distances within the time window is calculated and used as the behavioral volatility, expressed as: BV = Var(D1, D2, ..., D...). T BV stands for behavioral volatility.

[0018] Preferably, the method for obtaining contextual behavior inconsistency is as follows: obtain the current student behavior vector, denoted as... A set of behavioral representation vectors for the same context selected from the group sample: {s1,s2,...,s} m}; Calculate the mean of the set as the expected behavior vector of the group: The contextual behavior inconsistency index is calculated using the following expression: In the formula, CBIR is the situational behavior inconsistency index.

[0019] Preferably, the behavioral volatility and situational behavioral inconsistency index are input into the risk assessment model to analyze potential abnormal behaviors in the current sample, obtain a risk score, and determine whether to issue an early warning. Specifically, this includes:

[0020] The behavioral volatility and situational behavioral inconsistency index are normalized so that they are both between [0,1]. The risk score of the current sample is calculated by weighted averaging the normalized behavioral volatility and situational behavioral inconsistency index.

[0021] Preferably, the risk score of the current sample is compared with a preset risk threshold. If the risk score of the current sample is greater than or equal to the preset risk threshold, an abnormal behavior warning signal is triggered. If the risk score of the current sample is less than the preset risk threshold, no abnormal behavior warning signal is triggered.

[0022] Preferably, the risk score is compared with the classification model's judgment result. If the classification result is normal but the risk score exceeds a set threshold, the current sample is marked as a suspected pseudo-normal sample. Specifically:

[0023] The output of the deep learning behavior classification model is set as: ypred∈{0,1}; where: ypred=0: the classification model determines it as normal behavior; ypred=1: the classification model determines it as abnormal behavior;

[0024] The risk score Rrisk∈[0,1] is calculated by weighted normalized behavioral volatility and situational inconsistency index; a risk threshold θ is set; if the condition ypred=0 and Rrisk>θ is met, the current sample is marked as a suspected pseudo-normal sample.

[0025] Preferably, for data labeled as suspected pseudo-normal samples, the classification model is locally optimized and the classification boundary is updated, specifically including:

[0026] Select suspected pseudo-normal samples from the training set. q Local sample set centered Defining the neighborhood: Using Mahalanobis distance or cosine similarity, select the neighborhood with respect to x. q The k closest samples;

[0027] Introduce a weighting function w for local neighborhood samples. i =exp(-γ·Dist(x) i ,x q ) 2 ); where: w i For sample x i The weights decrease as the distance increases; γ is a parameter that adjusts local sensitivity, γ∈[0.1,10]; Dist is the distance function;

[0028] Train a local classifier using a weighted soft-margin support vector machine on a local sample set;

[0029] Replace the decision boundary of the original classification model in the local region with the boundary parameters output by the local SVM.

[0030] The technical effects and advantages provided by the present invention in the above technical solution are as follows:

[0031] 1. This invention introduces two high-risk features—behavioral volatility and contextual behavior inconsistency index—to construct a multi-dimensional, context-aware student behavior risk assessment mechanism, thus overcoming the problem of misjudging pseudo-normal samples due to label contamination in existing technologies. By normalizing and weightedly fusing risk features to obtain a comprehensive risk score, and combining this score with the output of a classification model for cross-validation, it effectively identifies suspected pseudo-normal samples that appear to have normal behavior but harbor underlying psychological or behavioral risks. This improves the model's ability to perceive and accurately warn of latent abnormal behavior.

[0032] 2. This invention constructs local sample neighborhoods and introduces a weighted incremental support vector machine method to optimize the local boundaries of the classification model for identified pseudo-normal sample regions. This avoids retraining the overall model, reduces computational costs, and enhances the model's adaptability to specific individual behavioral patterns. The overall solution balances accuracy and practicality, making it suitable for intelligent student behavior monitoring systems in scenarios such as universities and educational institutions. It possesses high promotional value and technological advancement. Attached Figure Description

[0033] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this invention. For those skilled in the art, other drawings can be obtained based on these drawings.

[0034] Figure 1 This is a mind map of the method of the present invention. Detailed Implementation

[0035] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0036] For examples, please refer to Figure 1 As shown in this embodiment, a method for analyzing and warning of abnormal student behavior based on deep learning includes:

[0037] Real-time collection of multi-source behavioral data related to student safety, and standardization processing of the data for subsequent model input;

[0038] High-level feature extraction of behavioral data is performed based on deep learning models to obtain behavioral representation vectors.

[0039] Further extract potential risk-related feature parameters from the behavior representation vector, including behavior volatility and situational behavior inconsistency index;

[0040] The behavioral volatility and situational behavioral inconsistency index are input into the risk assessment model to analyze potential abnormal behaviors of the current sample, obtain a risk score, and determine whether to issue an early warning.

[0041] The risk score is compared with the discrimination result of the classification model. If the classification result is normal but the risk score exceeds the set threshold, the current sample is marked as a suspected pseudo-normal sample.

[0042] For data labeled as suspected pseudo-normal samples, the classification model is locally optimized and the classification boundary is updated.

[0043] Through the campus information system and smart device interfaces, various types of student behavior data are collected in real time during their time on campus, including but not limited to:

[0044] Class attendance data: from the academic affairs system, sign-in system or classroom camera check-in information, recording students' attendance, lateness, early departure or absence status for each class.

[0045] Dormitory access data: The dormitory access control system records students' daily entry and exit times to determine their daily routines, overnight absences, and other behavioral patterns.

[0046] Since multi-source data comes from different systems, their time granularity and structural format may be inconsistent, so they need to be processed uniformly as follows:

[0047] Timestamp alignment: Align all data to minute-level or hour-level timestamps in order to build a consistent time series.

[0048] Behavioral encoding mapping: Encode behavioral events into standard vector form. For example, classroom status is represented by {attendance = 1, lateness = 0.5, absence = 0}; website access behavior is vectorized by category (learning, entertainment, social, etc.).

[0049] Use linear interpolation, moving average, or time window interpolation to handle missing data; use context rules to remove conflicting data.

[0050] To meet the training requirements of deep learning models, all feature data must be standardized:

[0051] Numerical features, such as dwell time, internet usage time, and spending amount, are processed using Z-score normalization or Min-Max normalization and converted to a range of 0 to 1.

[0052] Categorical features, such as attendance status and website category, are represented using One-Hot encoding or Embedding vectors.

[0053] Time-related features, such as "time to enter and leave the dormitory" and "peak study periods", can be converted into periodic functions (such as sin(t) and cos(t)) to capture the periodicity of time.

[0054] The preprocessed data is organized into a uniform input format according to fixed time windows (e.g., daily, every 3 hours, every class period), for example:

[0055] Time series input dimension: [number of samples × time step × feature dimension], suitable for time series models such as LSTM / Transformer;

[0056] Image input formats (such as monitoring frames) are organized as: [number of samples × image height × width × number of channels], which is suitable for CNN models;

[0057] The multimodal fusion input structure is input to the joint network model through tensor splicing or multi-channel input modules.

[0058] After preprocessing, it prepares for subsequent behavioral volatility, CBIR feature extraction and model training. At the same time, it marks meta-information such as data source, collection time, and preprocessing strategy to facilitate model traceability and result interpretation.

[0059] Based on the type and characteristic structure of student behavior data, an appropriate data-driven model is selected for behavior modeling, including but not limited to:

[0060] Convolutional Neural Networks (CNNs): Used to extract spatial features from image-based data (such as surveillance video frames and heatmaps) and can identify specific behavioral patterns such as walking, sitting, and gathering.

[0061] Recurrent Neural Networks (RNNs) and Long Short-Term Memory Networks (LSTMs): These are used to model long-term dependencies in time-series data and are suitable for processing periodic and time-series data such as attendance, library visits, and internet browsing behavior.

[0062] Transformer model structure: It uses a self-attention mechanism to process long-term sequence data, supports parallel computing, and is suitable for modeling needs that integrate multiple modalities and long-term behavioral trajectories.

[0063] The preprocessed student behavior data is organized into an input format that the model can accept:

[0064] Time series dimension: Set a sliding window (e.g., daily, per lesson) to segment the data over time;

[0065] Feature dimensions: including behavioral characteristics such as attendance status, internet usage frequency, time spent in the library, and time of entry and exit from the dormitory.

[0066] After inputting the input behavior sequence into the deep neural network model, features at different abstract levels are extracted step by step through multiple neural units.

[0067] The intermediate hidden layer automatically learns the implicit structures of student behavior, such as behavioral rhythms, abnormal fluctuations, and cross-time patterns.

[0068] The final representation extracted by the output layer can be regarded as a behavioral representation vector of the student within a certain time period, that is, a high-dimensional feature representation of the behavior, denoted as: v i =f DL (X i ); where v i f represents the behavior representation vector of the i-th student sample. DL X represents a deep learning network model. i Input data for multidimensional behaviors within the corresponding time window.

[0069] Further extract potential risk-related feature parameters from the behavioral representation vector, including behavioral volatility and contextual behavioral inconsistency index, specifically including:

[0070] Behavioral volatility is used to quantify the stability and variation of various behaviors of students within a certain time window, in order to determine whether their behavioral patterns are in an abnormal fluctuation state.

[0071] The method for obtaining behavioral volatility is as follows: behavioral feature vectors obtained from the deep learning model are arranged in chronological order to form a sample set. Where: T is the number of time steps within the behavior time window; d is the dimension of each behavior representation vector; v t Let be the behavior representation vector at time point t.

[0072] Robust estimation methods such as Minimum Covariance Determinant (MCD) or Tyler's M-estimator are used to calculate: Behavior center vector (robust mean): Behavioral covariance matrix (robust covariance):

[0073] For each action vector v t The robust Mahalanobis distance calculation expression for the row-centered region is as follows: D tLet BV be the robust Mahalanobis distance at time t. The variance of all Mahalanobis distances within the time window is calculated and used as the behavioral volatility, expressed as: BV = Var(D1, D2, ..., D...). T BV stands for behavioral volatility.

[0074] The greater the behavioral fluctuation, the more drastic and unstable the student's behavioral patterns change within the observation window. This may indicate sudden, irregular, or high-risk behaviors, such as emotional instability, disordered sleep patterns, or sudden absences. These are usually considered signals of increased potential abnormal risks.

[0075] Lower behavioral volatility indicates a highly stable behavioral pattern, but it does not always represent normal behavior. If the behavior remains low in volatility for a long period but deviates significantly from the norm of most students (such as persistent isolation or abnormal sleep patterns), it may be a hidden potential risk, especially common in "pseudo-normal" samples.

[0076] The Situational Behavior Inconsistency Index is used to measure whether students’ behavior deviates significantly from the expected pattern of similar student groups in a specific situation (such as exam week or holidays), and to identify behaviors that appear “normal” but are abnormal in the context.

[0077] The current student behavior vector is denoted as This represents behavioral characteristics in a specific context (e.g., the third day of exam week). It is a set of behavioral representation vectors selected from a group sample for the same context (students of the same grade and major during exam week): {s1, s2, ..., s...} m}; Calculate the mean of the set as the expected behavior vector of the group: The contextual behavior inconsistency index is calculated using the following expression: In the formula, CBIR is the situational behavior inconsistency index, which represents the degree of difference between student behavior and that in similar environments.

[0078] A higher CBIR indicates that the student's behavior pattern in the current situation deviates significantly from the group's average behavior. Specifically, it indicates abnormally low frequency of behavior during periods of high activity (such as exam preparation week) and sustained high frequency of activity during periods of low frequency (such as holidays). This suggests that the student's behavior deviates from the expected trajectory of the group and may be due to: fluctuations in psychological state (such as avoidance or interpersonal isolation); or a tendency to lose control of behavior (such as excessive internet use or truancy). Therefore, a higher CBIR usually means a higher potential risk of abnormality and is particularly suitable for detecting hidden problems of "abnormal behavior without rule violations".

[0079] A smaller CBIR indicates that the student's behavior is highly consistent with the group trend in a specific context; it is usually regarded as "social" and "regular" behavior, but caution is needed: some "pseudo-normal" samples may deliberately imitate group behavior to cover up abnormal states.

[0080] The behavioral volatility and situational behavioral inconsistency index are input into the risk assessment model to analyze potential abnormal behaviors in the current sample, obtain a risk score, and determine whether to issue an early warning. Specifically, this includes:

[0081] The behavioral volatility and situational behavioral inconsistency index are normalized so that they are both between [0,1]. The risk score of the current sample is calculated by weighted averaging the normalized behavioral volatility and situational behavioral inconsistency index.

[0082] The risk score of the current sample is compared with a preset risk threshold. If the risk score of the current sample is greater than or equal to the preset risk threshold, an abnormal behavior warning signal is triggered. If the risk score of the current sample is less than the preset risk threshold, no abnormal behavior warning signal is triggered.

[0083] The risk score is compared with the classification model's result. If the classification result is normal but the risk score exceeds a set threshold, the current sample is marked as a suspected pseudo-normal sample. Specifically:

[0084] The output of the deep learning behavior classification model is set as: ypred∈{0,1}; where: ypred=0: the classification model determines it as normal behavior; ypred=1: the classification model determines it as abnormal behavior.

[0085] The risk score Rrisk∈[0,1] is calculated by weighted normalized behavioral volatility and contextual inconsistency index; the risk threshold is set as θ∈(0,1), with a recommended value such as θ=0.7, which can be adjusted according to the validation set.

[0086] If the conditions are met: ypred=0 and Rrisk>θ, then the current sample is marked as: suspected pseudo-normal sample.

[0087] Individuals marked as suspected pseudo-normal samples may be judged as "normal" by the model, but their combined behavioral fluctuations and situational deviations indicate a high potential risk of abnormality; this label can serve as a key target for subsequent manual review.

[0088] For data labeled as suspected pseudo-normal samples, the classification model is locally optimized and the classification boundary is updated, specifically including:

[0089] Select suspected pseudo-normal samples from the training set. q Local sample set centered The neighborhood can be defined as follows:

[0090] Using Mahalanobis distance or cosine similarity, select the similarity with x. q The k closest samples.

[0091] Introduce a weighting function w for local neighborhood samples. i =exp(-γ·Dist(x) i ,x q ) 2 );in:

[0092] w i For sample x i The weight of the distance decreases as the distance increases.

[0093] γ is a parameter for adjusting local sensitivity, γ∈[0.1,10];

[0094] Dist is a distance function, and common distance functions include Euclidean distance, Mahalanobis distance, etc.

[0095] A local classifier is trained using a weighted soft-margin support vector machine on a local sample set. The optimization objective is to make samples that are closer to suspected pseudo-normal points have a greater impact on the model.

[0096] Replace the decision boundary of the original classification model in the local region with the boundary parameters output by the local SVM: if it is a deep neural network, the boundary is introduced through soft label reconstruction or local distillation; if it is a modular structure model, the corresponding local classifier can be replaced.

[0097] The local optimization results are fused with the global model output; consistency regularization terms or confidence guidance mechanisms are used to avoid local boundary "drift" from affecting global performance.

[0098] In this embodiment, real-time collection and standardization of students' multi-source behavioral data are performed. A high-level behavioral representation vector is extracted using a deep learning model, and two potential risk features, behavioral volatility and contextual behavioral inconsistency index, are further calculated. After normalization, these features are weighted and fused to generate a comprehensive risk score. This risk score is compared with the output of the classification model. If the model judges the behavior as normal but the risk score exceeds the threshold, it is marked as a suspected pseudo-normal sample. A locally weighted incremental support vector machine is then used to locally optimize and update the classification model's boundaries, thereby effectively improving the model's ability to identify real abnormal behaviors, especially latent high-risk samples, and enhancing the system's accuracy and robustness.

[0099] The above formulas are all dimensionless calculations. The formulas are derived from software simulations based on a large amount of collected data to obtain the most recent real-world results. The preset parameters in the formulas are set by those skilled in the art according to the actual situation.

[0100] The above embodiments can be implemented, in whole or in part, by software, hardware, firmware, or any other combination thereof. When implemented using software, the above embodiments can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more sets of available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium. A semiconductor medium can be a solid-state drive.

[0101] It should be understood that the term "and / or" in this document is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, and B alone, where A and B can be singular or plural. Additionally, the character " / " in this document generally indicates an "or" relationship between the preceding and following related objects, but it may also indicate an "and / or" relationship; please refer to the context for specific understanding. Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0102] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application.

Claims

1. A method for analyzing and issuing early warnings of abnormal student behavior based on deep learning, characterized in that: include: Real-time collection of multi-source behavioral data related to student safety, and standardization processing of the data for subsequent model input; High-level feature extraction of behavioral data is performed based on deep learning models to obtain behavioral representation vectors. Further extract potential risk-related feature parameters from the behavior representation vector, including behavior volatility and situational behavior inconsistency index; The behavioral volatility and situational behavioral inconsistency index are input into the risk assessment model to analyze potential abnormal behaviors of the current sample, obtain a risk score, and determine whether to issue an early warning. The risk score is compared with the discrimination result of the classification model. If the classification result is normal but the risk score exceeds the set threshold, the current sample is marked as a suspected pseudo-normal sample. For data labeled as suspected pseudo-normal samples, the classification model is locally optimized and the classification boundary is updated.

2. The method for analyzing and warning of abnormal student behavior based on deep learning according to claim 1, characterized in that: The standardization process includes timestamp alignment, behavior encoding mapping, and handling of missing data using linear interpolation, moving average, or time window interpolation.

3. The method for analyzing and warning of abnormal student behavior based on deep learning according to claim 1, characterized in that: The deep learning models include convolutional neural networks, recurrent neural networks, long short-term memory networks (LSTM), and Transformer model structures.

4. The method for analyzing and warning of abnormal student behavior based on deep learning according to claim 1, characterized in that: The method for obtaining behavioral volatility is as follows: behavioral feature vectors obtained from the deep learning model are arranged in chronological order to form a sample set. Where: T is the number of time steps within the behavior time window; d is the dimension of each behavior representation vector. Let t be the behavior representation vector at the t-th time point; The behavior center vector is calculated using either the Minimum Covariance Determinant or Tyler's M-estimator robust estimation method. Behavioral covariance matrix: ; For each behavior vector The robust Mahalanobis distance calculation expression for the row-centered region is as follows: ; Given the robust Mahalanobis distance at time t, calculate the set of Mahalanobis distances within the time window. The variance of this variance, as a measure of behavioral volatility, is expressed as: BV stands for behavioral volatility.

5. The method for analyzing and warning of abnormal student behavior based on deep learning according to claim 4, characterized in that: Contextual behavior inconsistency refers to the method of obtaining the current student behavior vector, denoted as: Select a set of behavioral representation vectors for the same context from the group sample: ; Calculate the mean of the set as the expected behavior vector of the group: The contextual behavior inconsistency index is calculated using the following expression: In the formula, This is the situational behavior inconsistency index.

6. The method for analyzing and warning of abnormal student behavior based on deep learning according to claim 5, characterized in that: The behavioral volatility and situational behavioral inconsistency index are input into the risk assessment model to analyze potential abnormal behaviors in the current sample, obtain a risk score, and determine whether to issue an early warning. Specifically, this includes: The behavioral volatility and situational behavioral inconsistency index are normalized so that they are both between [0,1]. The risk score of the current sample is calculated by weighted averaging the normalized behavioral volatility and situational behavioral inconsistency index.

7. The method for analyzing and warning of abnormal student behavior based on deep learning according to claim 6, characterized in that: The risk score of the current sample is compared with the preset risk threshold. If the risk score of the current sample is greater than or equal to the preset risk threshold, an abnormal behavior warning signal is triggered. If the risk score of the current sample is less than the preset risk threshold, the abnormal behavior warning signal will not be triggered.

8. The method for analyzing and warning of abnormal student behavior based on deep learning according to claim 7, characterized in that: The risk score is compared with the classification model's result. If the classification result is normal but the risk score exceeds a set threshold, the current sample is marked as a suspected pseudo-normal sample. Specifically: The output of the deep learning behavior classification model is set as: ypred∈{0,1}; where: ypred=0: the classification model determines it as normal behavior; ypred=1: the classification model determines it as abnormal behavior; The risk score Rrisk∈[0,1] is calculated by weighted normalized behavioral volatility and contextual inconsistency index; a risk threshold θ is set; if the condition ypred=0 and Rrisk>θ is met, the current sample is marked as a suspected pseudo-normal sample.

9. The method for analyzing and warning of abnormal student behavior based on deep learning according to claim 8, characterized in that: For data labeled as suspected pseudo-normal samples, the classification model is locally optimized and the classification boundary is updated, specifically including: Samples suspected to be abnormal were selected from the training set. Local sample set centered Define the neighborhood: using Mahalanobis distance or cosine similarity, select the neighborhood with... The k closest samples; Introduce a weighting function for local neighborhood samples: ;in: For the sample The weights decrease as the distance increases; γ is a parameter that adjusts local sensitivity, γ∈[0.1,10]; It is a distance function; Train a local classifier using a weighted soft-margin support vector machine on a local sample set; Replace the decision boundary of the original classification model in the local region with the boundary parameters output by the local SVM.

Images