Education network abnormal behavior detection method based on intelligent auditing

Abstract

The invention provides an education network abnormal behavior detection method based on intelligent auditing, and the method comprises the steps: obtaining historical communication data between teachers and students, and analyzing the normal frequency range of different teaching stages; aiming at the abnormal communication record, querying a course association relationship between a sender and a receiver through a teacher-student relationship database, establishing a legal communication relationship mapping table between teachers and students, and obtaining a course association verification result; judging whether the abnormal communication behavior belongs to a reasonable teaching requirement or not to obtain an abnormal behavior rationality judgment result; if the abnormal communication behavior does not belong to the reasonable teaching requirement, analyzing mail theme consistency and addressee group abnormity, and determining a risk level of the abnormal communication behavior; and updating an education network abnormal behavior detection mode according to the adaptive parameter adjustment scheme, and generating a dynamic monitoring strategy.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of information technology, and in particular to an education network abnormal behavior detection method based on intelligent audit. BACKGROUND

[0002] The mail communication system in the education network environment carries the important teaching exchange function between teachers and students, and the security and rationality of its communication behavior is directly related to the stable development of education informatization construction. With the continuous expansion of online education, the mail system has become a key infrastructure for maintaining normal teaching order and ensuring information security. The current mail anomaly detection method mainly relies on fixed threshold judgment and static rule matching, and these schemes show obvious shortcomings in the face of the complexity of the education scene. The traditional detection mechanism lacks a deep understanding of the periodic characteristics of teaching, and cannot accurately distinguish between normal teaching demand fluctuations and real abnormal behavior. At the same time, the existing security policy adjustment mechanism is too mechanical, and it is difficult to find a balance point between ensuring system security and maintaining normal communication between teachers and students. The core challenge faced by the education mail system is the accurate assessment of the matching degree of the communication behavior of teachers and students and the teaching demand. The frequency of mail correspondence will show complex time distribution characteristics with course progress, homework submission, examination arrangement and other teaching activities, and simple frequency statistics cannot reflect the rationality of the communication behavior. The complexity of this matching degree assessment further leads to the dynamic adjustment problem of the mail security filtering strategy. When potential abnormalities are detected, how to implement effective security protection measures without affecting normal teacher-student communication needs to consider multiple factors such as the reasonable boundaries of teaching relationships, the teaching relevance of communication content, and time sensitivity. The traditional one-size-fits-all security strategy often hurts normal teaching communication, while too lenient a strategy may overlook real security threats. How to build a detection mechanism that can accurately identify abnormal changes in the communication mode of teachers and students, and dynamically adjust the security filtering strategy according to the teaching interaction demand, ensures the security of the system while maximizing the continuity of normal teacher-student teaching communication, has become a key problem in the security management of the education network mail system. SUMMARY

[0003] The present application provides an education network abnormal behavior detection method based on intelligent audit, mainly including:

[0004] Obtain historical communication data between teachers and students, and analyze the normal frequency range in different teaching stages;

[0005] Use the sliding time window method to monitor the current communication object identity verification and sending frequency distribution, and if the sending frequency distribution in the current time window exceeds the normal frequency range, trigger the behavior mode abnormal early warning, and generate an abnormal communication record;

[0006] For abnormal communication records, the course association relationship of the sender and the receiver is queried through the teacher-student relationship database to establish a legal communication relationship mapping table between teachers and students, and a course correlation verification result is obtained;

[0007] Based on the course correlation verification result, it is analyzed whether the time node of abnormal communication matches the specific teaching task time point, the rationality of the communication behavior is verified through historical interaction mode comparison, and a teaching task relevance evaluation report is obtained;

[0008] It is judged whether the abnormal communication behavior belongs to reasonable teaching needs, and an abnormal behavior rationality determination result is obtained;

[0009] If the abnormal communication behavior belongs to reasonable teaching needs, through teaching calendar matching and task node response verification, the normal frequency range and theme content specification threshold of the current time period are dynamically adjusted, and the adjusted frequency threshold is obtained;

[0010] If the abnormal communication behavior does not belong to reasonable teaching needs, the risk level of the abnormal communication behavior is determined by analyzing the mail subject consistency and the abnormality of the recipient group;

[0011] Analyze the false alarm situation and generate an adaptive parameter adjustment scheme;

[0012] A dynamic monitoring strategy is generated according to the adaptive parameter adjustment scheme.

[0013] Further, the historical communication data between teachers and students is obtained, and the normal frequency range of different teaching stages is analyzed, including:

[0014] Extract the historical mail records of teachers and students, including the sending timestamp and the teacher-student identity identifier, and segment them into teaching stages according to the sending timestamp; For each teaching stage, the daily average sending frequency and the daily average receiving frequency of the teacher-student historical mail records are counted; Based on the daily average sending frequency and the daily average receiving frequency, the frequency mean and the frequency standard deviation of each teaching stage are calculated using a sliding window; According to the frequency mean and the frequency standard deviation, combined with the school period and examination time in the teaching calendar, the normal communication frequency range of different teaching stages is determined.

[0015] Further, the course correlation verification result obtained by querying the course association relationship of the sender and the receiver through the teacher-student relationship database for abnormal communication records, and establishing a legal communication relationship mapping table between teachers and students, includes:

[0016] extracting a sender and a receiver identity from the abnormal communication record; querying teaching information of the sender and elective course information of the receiver through a teacher-student relationship database; matching a course association of the sender and the receiver according to the teaching information and the elective course information, and generating an association type set; constructing a teacher-student legal communication relationship mapping table containing a sender identity, a receiver identity and an association type number based on the association type set; verifying the abnormal communication record through the teacher-student legal communication relationship mapping table, and generating a course association verification result.

[0017] Further, based on the course association verification result, it is judged whether a time node at which the abnormal communication occurs matches a specific teaching task time point, the rationality of the communication behavior is verified through comparison of a historical interaction mode, and a teaching task relevance evaluation report is obtained, including:

[0018] extracting course information from the course association verification result; obtaining a teaching task time node of the course information through a teaching calendar database, including a homework publishing time and a course progress; comparing a timestamp of the abnormal communication record with the teaching task time node, and calculating a time difference value; generating a teaching task relevance evaluation result containing a time association mark and a task type according to the time difference value and the course information, and generating a teaching task relevance evaluation report.

[0019] Further, it is judged whether the abnormal communication behavior belongs to a reasonable teaching requirement, and an abnormal behavior rationality determination result is obtained, including:

[0020] obtaining an association type number, and extracting a time association mark from the teaching task relevance evaluation result; constructing an abnormal communication feature vector based on the association type number and the time association mark; calculating a posterior probability of the abnormal communication feature vector in a homework consultation and homework submission category through a Bayesian classification algorithm; determining a category to which the abnormal communication behavior belongs according to the posterior probability, and generating an abnormal behavior rationality determination result.

[0021] Further, if the abnormal communication behavior belongs to a reasonable teaching requirement, a normal frequency range and a theme content specification threshold value of a current time period are dynamically adjusted through teaching calendar matching and task node response verification, an adjusted frequency threshold value is obtained, including:

[0022] If the abnormal communication behavior is determined to be a reasonable teaching requirement, a reasonable teaching activity type is extracted; a teaching task time node corresponding to the reasonable teaching activity type is queried through a teaching calendar; a daily average frequency of communication records before and after the teaching task time node is counted, and an adjusted normal frequency range is generated.

[0023] Further, if the abnormal communication behavior does not belong to the reasonable teaching requirement, the mail subject consistency and the recipient group abnormality are analyzed to determine the risk level of the abnormal communication behavior, including:

[0024] The mail subject and the content of the abnormal communication record are extracted, the number of violation words in the mail subject is counted through keyword matching, the similarity between the content and a teaching communication template is calculated through semantic analysis, and the risk level of the abnormal communication behavior is determined according to the number of violation words and the similarity.

[0025] Further, the risk level of the abnormal communication behavior is determined according to the number of violation words and the similarity, including: the number of violation words is multiplied by a first weight, the inverse of the similarity is multiplied by a second weight, and the sum is generated as a risk score; according to the comparison between the risk score and a preset threshold, it is classified as low risk, medium risk or high risk.

[0026] Further, the false alarm situation is analyzed to generate an adaptive parameter adjustment scheme, including:

[0027] The prediction category and the actual category are extracted from the interception log and the abnormal behavior rationality determination result, the false alarm rate of the prediction category and the actual category is counted, the contribution degree of the time window size and the frequency threshold to the false alarm is analyzed through the decision tree algorithm, and the time window size and the frequency threshold are adjusted according to the contribution degree and the false alarm rate to generate an adaptive parameter adjustment scheme.

[0028] Further, the dynamic monitoring strategy is generated according to the adaptive parameter adjustment scheme, including:

[0029] The detection configuration set is generated according to the parameter configuration file in the adaptive parameter adjustment scheme, the phased detection process automatically switched according to the teaching progress is constructed based on the teaching time node in the detection configuration set, the communication behavior is evaluated in real time through the phased detection process, the parameter configuration, the activation time and the detection result of each stage are recorded, the false alarm times of normal teaching communication and the identification times of real abnormalities are counted, and the dynamic monitoring strategy is generated.

[0030] The technical scheme provided by the embodiment of the application can include the following beneficial effects:

[0031] The application discloses an education network abnormal behavior detection method based on intelligent auditing, and aims at the business problems of communication frequency abnormality, identity verification and behavior rationality judgment in an education scene, fuses teacher-student communication data analysis, course correlation verification and teaching task matching, and constructs a self-adaptive monitoring strategy. BRIEF DESCRIPTION OF DRAWINGS

[0032] Figure 1 A flowchart of the education network abnormal behavior detection method based on intelligent auditing. DETAILED DESCRIPTION

[0033] The technical solutions in the embodiments of the application will be described clearly and in detail below with reference to the drawings in the embodiments of the application. The described embodiments are only some of the embodiments of the application.

[0034] As Figure 1 , the education network abnormal behavior detection method based on intelligent auditing specifically can include the following steps.

[0035] S101, historical communication data between teachers and students is acquired, and normal frequency ranges of different teaching stages are analyzed.

[0036] The teacher-student historical email records are extracted from the educational email system database, including the sending timestamp, sender identity, receiver identity and email subject text. The sender and receiver identities are used to distinguish the teacher-student roles, and the email records are arranged in chronological order. The time interval between each email and the previous related email is calculated to obtain the communication sequence data containing time interval information. The communication sequence data is segmented according to the teaching calendar, which includes the start date of the semester, the midterm exam time, the final exam time and the holiday time. For the email records in each teaching stage, the total number of emails sent by the teacher to the student is divided by the number of days in the stage to obtain the daily average sending frequency of the teacher, and the total number of emails sent by the student to the teacher is divided by the number of days in the stage to obtain the daily average sending frequency of the student. The time difference between each reply email and its corresponding original email is calculated to obtain the reply time interval data. Based on the daily average sending frequency and the reply time interval data of each teaching stage, a sliding window is used to traverse each teaching stage, with a window size of 7 days and a movement of 1 day each time. The sending frequency of all email records in the window is calculated, i.e. the total number of emails in the window divided by 7. The sending frequency values of all windows are accumulated, and the arithmetic mean is calculated as the frequency mean value of the teaching stage. The sum of the squares of the difference between the sending frequency value of each window and the frequency mean value is divided by the total number of windows, and the square root is taken to obtain the frequency standard deviation. According to the frequency mean value and the frequency standard deviation, combined with the teaching stage attribute, the course type, the teacher-student role and the time period distribution within a day, a communication frequency benchmark model based on the teaching calendar is constructed. The model sets the upper limit of the normal frequency range as the historical frequency mean value of the corresponding combination plus 2 times the standard deviation, and the lower limit as the historical frequency mean value minus 2 times the standard deviation, to obtain the normal communication frequency range of different teaching stages.

[0037] Specifically, the teacher-student communication data in the educational email system has significant time distribution characteristics.

[0038] In one possible implementation, when extracting email records from the database, the identity attributes of each user need to be identified. The teacher identity usually includes the teacher's work number, the department to which the teacher belongs and the title information, and the student identity includes the student's ID number, grade and major information. By analyzing the sender and receiver fields in the email header, the teacher-student role attribute of each email can be accurately distinguished. The extraction of email subject text helps to analyze the category of communication content, such as homework submission, question answering and discussion or notice and announcement, etc. The calculation of time interval needs to consider the correlation between emails.

[0039] Specifically, when a student sends an inquiry email, the teacher's reply email forms a corresponding relationship with the original email. By matching the "Re:" identifier in the email subject or the reference relationship, the email conversation chain is identified. The time stamp difference between adjacent emails can reflect the response speed of teacher-student interaction. This time interval information constitutes the basic data for analyzing the communication mode. The segmentation of the teaching calendar directly affects the statistical accuracy of the communication frequency.

[0040] For example, a complete semester includes the beginning of the school year, the regular teaching period, the mid-term examination week, the post-examination adjustment period, and the final review week, etc. The communication characteristics of each stage are obviously different: the initial stage of the school year mainly involves course arrangement and teaching requirements; the communication frequency increases significantly before and after the mid-term examination week, and students consult review highlights and difficult questions; the final stage focuses on homework submission and score inquiry. By grouping the communication data according to these teaching stages, the communication rules in different periods can be accurately captured. The application of the sliding window method makes the frequency calculation more smooth and accurate.

[0041] In one embodiment, the 7-day window starts from the first day of the semester and moves backward day by day. The total number of emails in each window is counted, and divided by 7 to get the daily frequency of the window. This method avoids the accidental influence of single-day data, such as less communication on weekends or sudden increase before exams. By calculating the mean and standard deviation of the frequency of all windows, the typical communication mode parameters of the teaching stage are obtained. The communication frequency benchmark model based on the teaching calendar considers multiple dimensional factors.

[0042] It should be noted that the communication mode of different course types has essential differences: experimental courses have higher communication frequency due to the need for frequent experimental guidance and data discussion; the communication of theoretical courses mainly focuses on homework correction and concept answering; and the communication of practical courses appears at the key nodes of project progress. By setting the upper and lower limits of the frequency range, abnormal communication modes such as long-term non-contact between students and teachers or sudden large number of emails can be identified.

[0043] S102, the sliding time window method is used to monitor the current communication object identity verification and sending frequency distribution, if the sending frequency distribution in the current time window exceeds the normal frequency range, the behavior mode abnormality early warning is triggered, and the abnormal communication record is generated.

[0044] The real-time communication data stream of the current time is acquired, a sliding time window size is set as a preset monitoring duration, the sliding interval is moved forward according to the preset sliding interval, the identity identifier of the sender is extracted for all the mail records in each time window, the legality of the identity of the sender is verified by querying a user authentication database, the mail sending times of each verified sender in the window are counted, and the sending times statistical data of each sender in the current time window are obtained. The sending times statistical data is compared with the corresponding normal frequency range in the communication frequency benchmark model, the corresponding upper limit value and lower limit value of the frequency are extracted from the benchmark model according to the current teaching stage, course type, teacher-student role and time period, the absolute value of the difference between the sending times and the historical average value of the time period is calculated for each sender, and if the sending times exceed the upper limit value of the frequency or are lower than the lower limit value of the frequency, the sender is marked as an abnormal communication object. For the sender marked as an abnormal communication object, the identity information, the start and end time of the abnormal occurrence, the actual sending times, the corresponding normal frequency upper and lower limit values are extracted, the abnormal type is determined as a high-frequency abnormality or a low-frequency abnormality according to the relationship between the actual sending times and the frequency limit value, and the information is combined to form early warning data containing the identity of the abnormal communication object, the abnormal period, the abnormal type and the frequency deviation degree. Based on the information in the early warning data, a structured abnormal communication record is constructed, the record contains the communication object identity, the abnormal start and end time, the actual sending frequency value, the normal frequency range value and the abnormal duration, the abnormal duration is obtained by calculating the number of time windows in which the abnormality occurs continuously in the abnormal period multiplied by the sliding interval, and a complete abnormal communication record is generated.

[0045] Specifically, the sliding time window method plays a key role in monitoring communication behavior.

[0046] Specifically, the time window is like a moving observation frame that continuously scans the mail data stream. When the window size is set to 24 hours, it means that each time the statistics contain all the mails in the last day. The window slides forward once an hour, forming a continuous monitoring coverage. This overlapping monitoring method avoids missing abnormal behaviors that may occur across the boundaries of fixed time periods, especially abnormal communication patterns. The identity verification process involves multiple verification mechanisms.

[0047] In one possible implementation, the system first extracts the email address of the mail sender, and then matches it with the list of legal email addresses in the user authentication database. The authentication database stores the email addresses of all teachers and students, the affiliated departments, the identity categories and other information. The sender record is quickly located by a hash matching algorithm to verify whether it is a legal user in the system. For the email addresses that cannot be matched, domain name verification is performed to check whether they are from the official email domain of the school. This multi-layer verification mechanism effectively prevents external fake emails from interfering with normal communication patterns. The sending times statistics need to consider the relevance and deduplication of the mails.

[0048] For example, the same email might be sent to multiple recipients; therefore, it should be counted as a single send rather than multiple sends in the statistics. Deduplication is performed using the email's unique identifier to ensure statistical accuracy. Within each time window, the system establishes a counter for each verified sender, recording the actual number of emails sent. The comparison process using the communication frequency benchmark model reflects dynamic matching characteristics.

[0049] It should be noted that the benchmark model is a multi-dimensional reference system that includes normal frequency ranges for different teaching stages, course types, teacher and student roles, and time periods. When making comparisons, the teaching stage corresponding to the current moment is first identified, such as final exam week; then the sender's role attributes and the course types involved are determined; finally, the upper and lower frequency limits for the corresponding combinations are extracted.

[0050] For example, the normal sending frequency limit for theoretical course instructors during final exam week might be 15 emails per day, while the limit for lab course instructors might reach 25 emails. Anomalies are detected using threshold comparison.

[0051] Specifically, if a teacher sends 30 emails during the final exam week, exceeding the 25-email limit, the system classifies it as a high-frequency anomaly. Conversely, if a student doesn't send any emails during the assignment submission period, falling below the 2-email minimum, it's considered a low-frequency anomaly. This two-way monitoring mechanism can detect potential account theft and also promptly identify insufficient teacher-student communication. The generation process of abnormal communication records emphasizes the integrity and traceability of information.

[0052] In one embodiment, each anomaly record not only contains basic identity and time information, but also details the specific manifestations of the anomaly. The duration of the anomaly is calculated by accumulating the number of consecutive time windows in which the anomaly occurs. For example, if an account is in a high-frequency sending state for 5 consecutive hours, the duration of the anomaly is recorded as 5 hours.

[0053] S103. For abnormal communication records, query the course association relationship between the sender and receiver through the teacher-student relationship database, establish a legitimate communication relationship mapping table between teachers and students, and obtain the course association verification result.

[0054] The sender identity and the receiver identity are extracted from the abnormal communication record, the teacher identity information of the sender is queried through the teacher-student relationship database, the course list of the teacher, the class number of the teacher as a class monitor and the postgraduate guidance record are obtained, the student identity information of the receiver is queried, the elective course list of the student, the class number to which the student belongs and the tutor information are obtained, and a query result set containing the teaching association information of the teacher and the student is obtained. Cross matching is performed on the data in the query result set. If the course list of the sender contains any course in the elective course list of the receiver, it is marked as a teaching association. If the class number of the sender as a class monitor is the same as the class number to which the receiver belongs, it is marked as a class association. If the sender contains the student number of the receiver in the postgraduate guidance record, it is marked as a guidance association, and the association type set of each pair of teacher and student is obtained. A legal communication relationship mapping table is constructed based on the association type set. The mapping table contains four fields of teacher identification, student identification, association type and association strength. The association strength is calculated by counting the number of association types. When there is one association type, the strength value is 1. When there are two association types, the strength value is 2. When there are three association types, the strength value is 3. A complete teacher-student legal communication relationship mapping table is formed. The teacher-student legal communication relationship mapping table and the sender-receiver pair in the abnormal communication record are matched and verified. If the sender-receiver pair exists in the mapping table, the corresponding association type and association strength value are extracted, and the verification state is marked as valid association. If it does not exist in the mapping table, the verification state is marked as invalid association, and a course association verification result containing the verification state, the association type and the association strength is generated.

[0055] Specifically, the teacher-student relationship database is a core component of the education management system, and stores complete teaching association information.

[0056] In a possible implementation, the database adopts a relational structure and contains multiple data tables such as a teacher information table, a student information table, a course information table, a course selection record table, a class management table and a postgraduate guidance table. The teacher information table records the teacher work number, the name, the affiliated department and other basic information. The course information table contains the course number, the course name, the teaching teacher work number and other fields. The course selection record table associates the student number and the course number to form a course selection relationship network. The identity extraction process of the abnormal communication record involves data analysis and format conversion.

[0057] Specifically, the mailbox address read from the abnormal record needs to be mapped to the specific teacher-student identity. The system matches the work number or the student number in the database through the username part in the mailbox address to determine the real identities of the sender and the receiver. This mapping relationship ensures the accuracy of subsequent queries. The implementation of cross matching embodies the idea of multi-dimensional association verification.

[0058] It should be noted that there may be multiple teaching relationships between teachers and students. A teacher may be a teacher of a student, a class teacher, and a graduation design instructor. The system identifies the teaching relationship between teachers and students by traversing all possible association dimensions.

[0059] For example, when the query finds that the "Data Structure" course of Teacher Zhang appears in the course list of Student Li, the system confirms the existence of a teaching association; if it is also found that Zhang is the class teacher of Class 2021 Computer 3, and Li belongs to this class, then it is confirmed that there is a class association. The quantitative calculation of the association strength reflects the closeness of the teacher-student relationship.

[0060] In one embodiment, a single teaching association indicates that there is a basic teaching and communication need between the teacher and the student; while a teacher-student pair with teaching, class, and guidance triple associations has more frequent and diverse communication needs. The incremental value of the association strength from 1 to 3 accurately depicts the difference in the closeness of the relationship. This quantitative method provides a more accurate reference standard for subsequent anomaly determination. The construction process of the legal communication relationship mapping table emphasizes the structured organization of data. The mapping table uses an index structure to speed up queries, and uses the combination of teacher identification and student identification as the primary key to ensure the uniqueness of each teacher-student relationship. The association type field uses a bit mask to store, which facilitates quick judgment of which types of associations exist. This design greatly improves the efficiency of the verification process. The generation of the verification result integrates multiple judgment elements.

[0061] Specifically, when an abnormal communication record shows that a non-teaching teacher frequently sends emails to a specific student, a query of the mapping table shows that there is no teaching association between the two, which is determined to be an invalid association, which may indicate that the account is stolen or other security risks. On the contrary, if the query shows that there are multiple associations between the two and the association strength value is high, the abnormal communication behavior may be due to special teaching needs, such as intensive communication during the final defense guidance period.

[0062] S104, based on the course association verification result, analyze whether the time node of the abnormal communication occurrence matches the specific teaching task time point, verify the rationality of the communication behavior through comparison of historical interaction patterns, and obtain a teaching task relevance evaluation report.

[0063] According to the association type and course information in the course association verification result, the teaching schedule, assignment release record, examination time arrangement and Q&A time period setting of the corresponding course are extracted from the teaching calendar database, all teaching task nodes in a preset time range before and after the time when the abnormal communication occurs are obtained, including the homework deadline, examination start time and Q&A open period, and the teaching task time sequence containing the task type, task time and task content is obtained. Each task time node in the teaching task time sequence is compared with the communication timestamp in the abnormal communication record, the time difference value between the abnormal communication time and the nearest teaching task node is calculated, if the time difference value is less than the preset association time threshold, it is marked that the abnormal communication and the specific teaching task have time association, the task type, task content and time difference value of the association are recorded, and the matching result containing the time association mark and difference value data is formed. Based on the task type and teacher-student identity information in the matching result, the historical communication record of the same teacher-student pair under the same task type is queried from the mail system historical data, the daily average communication frequency, communication time period distribution proportion and average response interval of the historical same period are counted, the frequency value of the current abnormal communication is subtracted from the historical average value and then divided by the historical standard deviation, and the standardized behavior deviation degree value is obtained. According to the behavior deviation degree value, the time association mark and the time difference value in the matching result, in combination with the course association verification result, a teaching task correlation evaluation report is generated, which contains the time association matching result of the abnormal communication and the teaching task, the behavior deviation degree value, the specific teaching task description associated with the deviation degree threshold and the correlation strength identification.

[0064] Specifically, the structure design of the teaching calendar database embodies the time sequence characteristics of teaching activities.

[0065] In a possible implementation manner, the database contains a plurality of association tables, wherein the teaching schedule table records the teaching content and key points of each course according to the week; the assignment release record table stores the assignment title, release time, deadline and assignment requirements; the examination arrangement table contains the examination subject, examination time, examination location and other information; and the Q&A time period table records the fixed Q&A time set by the teacher and the temporary Q&A arrangement. These data tables are associated with each other through the course number, forming a complete teaching activity time axis. The core of time matching lies in identifying the time correlation of communication behavior and teaching task.

[0066] Specifically, when it is detected that a student sends a large number of emails to the teacher at 2 a.m., the system will query the teaching tasks before and after this time point. If it is found that there is a midterm examination of the course at 9 a.m. the next day, the intensive communication at midnight may be the demand for pre-examination Q&A. The calculation of the time difference value adopts the absolute time interval, for example, the communication time is 7 hours away from the start of the examination, which is less than the preset 24-hour association threshold, so it is determined that there is time association. The comparative analysis of the historical communication mode reveals the regularity of teacher-student interaction.

[0067] It should be noted that different types of teaching tasks trigger different communication patterns. Before the homework deadline, students usually focus on asking questions related to the homework, and the communication frequency shows an increasing trend; the demand for answering questions before the exam shows an explosive growth in a short period of time; and the communication during daily teaching is relatively stable. By extracting the communication characteristics in the same scene in the historical data, the correspondence between the task type and the communication mode is established. The standardized behavior deviation degree calculation provides a quantitative evaluation of the degree of abnormality.

[0068] In one embodiment, the historical data shows that a certain teacher sends an average of 10 emails a day before the homework deadline, with a standard deviation of 3. Currently, it is detected that the teacher sent 25 emails in a similar time period. The deviation degree calculation process is as follows: first calculate the difference 25 minus 10 equals 15, then divide by the standard deviation 3, and the deviation degree is 5. This value is far beyond the normal range, indicating a significant behavior anomaly. The generation of the teaching task relevance evaluation report integrates the results of multi-dimensional analysis.

[0069] For example, an abnormal communication record shows that a student named Li sent emails to multiple non-teaching teachers the night before the final exam to ask about the exam content. Through time matching, it is found that these communications indeed occurred on the eve of the exam, and there is a time correlation; but the historical data shows that Li has never contacted these teachers before the exam, and the behavior deviation degree is extremely high; and these teachers have no course relationship with Li. Integrating these factors, the system determines that the communication behavior has very low relevance to normal teaching tasks, and may have the risk of exam cheating. This multi-dimensional verification mechanism effectively distinguishes between the surge of normal teaching needs and real abnormal behavior. By analyzing the communication behavior in the teaching context, it is understood that some seemingly abnormal high-frequency communications are actually reasonable teaching interactions, and at the same time, it can also identify those truly abnormal behaviors that are suspicious at certain time points, mismatched objects, and deviated from historical patterns.

[0070] S105, determining whether the abnormal communication behavior belongs to reasonable teaching needs, obtaining an abnormal behavior rationality determination result.

[0071] The course relevance verification result and the data in the teaching task relevance evaluation report are subjected to feature extraction, including the number of association types, the association strength value, the time association mark, the behavior deviation degree value, and the task type identifier. Meanwhile, the communication frequency, time period distribution, and content keyword features of four types of normal teaching activities, i.e., course consultation, homework submission, score query, and course notification, are extracted from the historical communication records labeled as normal in the mail system, to construct a data set to be classified containing a current abnormal feature vector and four types of normal activity feature templates. For the data set to be classified, the Bayesian classification algorithm is used to calculate the conditional probability of the current abnormal feature vector under each normal teaching activity category. Specifically, the prior probability is calculated by counting the frequency of each feature in different categories, and then the posterior probability of belonging to course consultation, homework submission, score query, or course notification is calculated under the given abnormal feature according to the Bayesian theorem, to obtain the posterior probability values of the four categories. Based on the posterior probability values of the four categories, the activity category corresponding to the maximum posterior probability is selected as the predicted category, and if the maximum posterior probability exceeds a preset confidence threshold, the abnormal communication behavior is classified as the corresponding normal teaching activity; if the four posterior probabilities are all lower than the confidence threshold, the behavior is marked as not belonging to any known normal teaching activity. According to the predicted category and the maximum posterior probability value, an abnormal behavior rationality judgment result is generated, which contains four fields: behavior category judgment, belonging normal activity type, maximum posterior probability value, and rationality identifier. When a normal teaching activity category is successfully matched, the rationality identifier is reasonable, otherwise it is unreasonable, and the abnormal behavior rationality judgment result is obtained.

[0072] Specifically, the feature extraction process needs to capture the essential features of the communication behavior from multiple dimensions.

[0073] In one possible implementation, the number of association types reflects the complexity of the teacher-student relationship, such as a certain teacher-student relationship having three roles of teaching, class monitoring, and thesis guidance, with the number of association types being 3; the association strength value quantifies the closeness of the relationship; the time association mark indicates whether the communication occurs near a key teaching node; and the behavior deviation degree value represents the difference between the current behavior and the historical pattern. These features together constitute a multi-dimensional vector describing the abnormal communication. The feature templates of normal teaching activities are constructed based on statistical analysis of a large amount of historical data.

[0074] Specifically, the homework consultation type of communication usually contains inquiry keywords such as "ask", "how to understand", "concept", and the occurrence time is mostly concentrated between after class and 10 o'clock at night, and the length of single email is moderate; the homework submission type of communication is characterized by containing attachments and the title containing words such as "homework" and "submission", and the time is concentrated within 48 hours before the deadline; the score query type of communication mostly appears within one week after the exam and contains keywords such as "score" and "points"; the course notification type is initiated by the teacher and contains words such as "notification" and "arrangement" and is usually mass-sent to multiple students. The application of the Bayesian classification algorithm embodies the advantage of probability reasoning.

[0075] It should be noted that the algorithm is based on Bayes' theorem, which calculates the posterior probability through known prior probability and conditional probability. In this scenario, the prior probability refers to the proportion of each type of legitimate teaching activity in all communications, such as homework consultation accounting for 40%, homework submission accounting for 30%, score query accounting for 20%, and course notification accounting for 10%. The conditional probability describes the likelihood of a specific feature appearing under a certain type of activity, such as the probability of the "ask" keyword appearing in the homework consultation type being 0.8. The calculation process of the posterior probability takes into account the influence of multiple features.

[0076] For example, an abnormal communication occurs one day before the homework deadline, contains the "homework" keyword, has attachments, and the sender is a student who has enrolled in the course. Calculate the probability that this communication belongs to the homework submission type: first get the prior probability of homework submission 0.3, then multiply the conditional probability of each feature, such as the time feature matching probability 0.9, the keyword matching probability 0.95, the existence of attachments probability 0.85, and the identity matching probability 1.0, and after normalization, the posterior probability is about 0.82. The setting of the credibility threshold affects the accuracy and coverage of the classification.

[0077] In one embodiment, the threshold is set to 0.6, which means that only when the maximum posterior probability exceeds 60%, the system considers the classification result reliable. If the four posterior probabilities calculated for a certain abnormal communication are 0.15, 0.25, 0.20, and 0.10, the maximum value is only 0.25, which is far below the threshold, indicating that this communication behavior does not conform to any known legitimate teaching activity pattern and is likely to be a real abnormal behavior. The generation of the rationality determination result provides clear guidance for subsequent processing. By classifying complex communication behaviors into specific teaching activity types or determining them as abnormal, it can distinguish between real threats that need to be focused on and normal teaching interactions, avoiding misjudgment of reasonable teaching needs while ensuring effective identification of abnormal behaviors.

[0078] S106, if the abnormal communication behavior belongs to a reasonable teaching demand, the normal frequency range and the theme content specification threshold of the current time period are dynamically adjusted through teaching calendar matching and task node response verification, and the adjusted frequency threshold is obtained.

[0079] If the abnormal communication behavior is determined to be a reasonable teaching requirement, the specific teaching activity type, occurrence time, and communication content corresponding to the communication are obtained, the teaching task nodes in the current time period are queried from the teaching calendar, including the course progress, assignment deadline, and examination arrangement of the time period, the time correspondence and content relevance of the reasonable teaching requirement and the task nodes are verified, and the node verification result containing the task type and time deviation is obtained. Based on the node verification result, all communication records determined to be reasonable within a preset time window before and after the task node are counted, the daily communication frequency of these records is calculated as a new frequency value, and keywords with a frequency of occurrence exceeding a preset threshold in the communication content are extracted. The new frequency value and the mean value of the original normal frequency range are added according to a preset weight ratio to obtain the fused frequency mean value and the expanded keyword set. The normal frequency range of the current time period is recalculated according to the fused frequency mean value, the frequency distribution of all reasonable communications is counted to calculate a new standard deviation, the frequency mean value plus a preset multiple of the standard deviation is taken as a new upper limit, and the frequency mean value minus a preset multiple of the standard deviation is taken as a new lower limit. At the same time, the expanded keyword set is taken as the theme feature of the teaching activity type to form the updated frequency range and theme feature. The updated frequency range and theme feature are written into the communication frequency benchmark model corresponding to the time period and the teaching activity type, replacing the original frequency upper and lower limit values and the theme keyword list, completing the dynamic update of the model parameters, and obtaining the adjusted frequency threshold that adapts to the current teaching actual demand.

[0080] Specifically, the core of the dynamic adjustment mechanism is to identify a reasonable surge in teaching requirements and update the benchmark parameters accordingly.

[0081] In one possible implementation, when the final review week is approaching, the number of emails in which students inquire about past exam questions and review focuses will increase dramatically. After detecting this frequency anomaly, it is confirmed through the determination process that it is a reasonable teaching requirement rather than a malicious behavior. This determination is based on multiple dimensions: the time is highly consistent with the approaching final exam, the content contains keywords such as "review" and "exam point", and the sender is a student who has enrolled in the course. The node verification process ensures the accuracy of the adjustment.

[0082] Specifically, the system extracts from the teaching calendar that the final exam is scheduled for December 25, and the high-frequency communication detected currently occurs between December 20 and 23. The time deviation is only 2-5 days, which fully conforms to the normal rules of pre-exam Q&A. At the same time, the email content is directly related to the examination subjects, such as "Data Structure Final Exam Key Chapters", "Algorithm Complexity Analysis Key Points", etc., and the content relevance is fully verified. The weighted fusion of frequency parameters reflects the balance between historical experience and current reality.

[0083] It should be noted that the original benchmark model has a daily average communication frequency limit of 15 at the end of the review week, but this time the statistics found that the reasonable daily communication frequency reached 22. Using a weight of 0.7 to retain the historical average and a weight of 0.3 to include new data, the calculation process is: 15 multiplied by 0.7 plus 22 multiplied by 0.3, resulting in a new frequency average of about 17. This gradual adjustment avoids dramatic fluctuations in parameters caused by individual special cases. The expansion of the keyword set reflects the evolution of teaching content.

[0084] For example, the original theme features include "homework" and "experiment" and other regular teaching vocabulary. Through this analysis, it was found that new words such as "online Q&A", "recording playback", and "electronic textbook" frequently appear. The appearance of these new words is closely related to the digital transformation of teaching mode, and the system includes them in the theme feature library, so that future similar communications will not be misjudged as abnormal. Recalculation of the standard deviation ensures the reasonableness of the threshold range.

[0085] In one embodiment, the 50 records of reasonable communication collected show that the daily frequency distribution ranges from 12 to 28. The standard deviation of these data is about 4.5, and according to the 2 standard deviation range, the new frequency limit is 17 plus 9 equal to 26, and the lower limit is 17 minus 9 equal to 8. Compared with the original range of 10-15, the new range better adapts to the actual needs of the end-of-term review. The updating process of the model parameters ensures the adaptive ability of the system. The communication frequency benchmark model uses a key-value pair structure for storage, with the key being a combination of time period and activity type, and the value being the corresponding parameter set. When updating, locate the "end-of-term review week - homework consultation" record, update the frequency range from "10-15" to "8-26", and add new words such as "online Q&A" to the theme keyword list. This incremental updating method not only preserves the stability of the model, but also improves the adaptability to new teaching modes, effectively reducing the probability of misreporting reasonable teaching activities as abnormal.

[0086] S107, if the abnormal communication behavior does not belong to the reasonable teaching demand, analyze the consistency of the mail subject and the abnormality of the recipient group to determine the risk level of the abnormal communication behavior.

[0087] If abnormal communication behavior does not fall under reasonable teaching needs, the email subject, body, sending time, and recipient list are extracted. These are then matched against the email system's built-in list of prohibited words, and the number of matched prohibited words is counted. Simultaneously, natural language processing methods are used to calculate the cosine similarity between the email content and a normal teaching communication template as semantic relevance. The sending time is analyzed to determine if it falls within the non-teaching period (midnight to 6 AM). The ratio of recipients to the number of students enrolled in the course is calculated, yielding feature data including the number of prohibited words, semantic relevance, time period identifier, and recipient ratio. A risk score is calculated based on this feature data. The number of prohibited words is multiplied by a preset weighting coefficient, the inverse of the semantic relevance is multiplied by another weighting coefficient, a fixed score is added if the time period identifier is outside the teaching period, and another fixed score is added if the recipient ratio exceeds a preset threshold. The sum of these values ​​yields a total risk score. If the total score is below a first threshold, it is considered low risk; between the first and second thresholds, medium risk; and above the second threshold, high risk. Differentiated processing is implemented based on risk level. For low-risk emails, they are stored in a cache queue with the most recent teaching task time recorded, and sent at that time triggered by a timer. For medium-risk emails, the email content is automatically compared with the teaching communication specification template to calculate compliance. If the compliance exceeds the preset standard, it is allowed; otherwise, it is marked for review. For high-risk emails, the sending process is terminated directly, and a processing record containing a timestamp, sender identifier, target quantity, and risk score is generated. The processing records for each risk level are uniformly written to the email monitoring log. The record fields include processing time, communication identifier, risk level, processing method, sender account, and final status. At the same time, the sender's abnormal behavior count is accumulated. When the count exceeds the preset limit, the sending permission of the account is automatically restricted, thus completing the automated hierarchical handling of abnormal communications at different risk levels.

[0088] Specifically, the construction of the list of prohibited words reflects the special requirements of the educational environment.

[0089] In one possible implementation, the vocabulary includes multiple categories: business promotion terms such as "

[0090] The system categorizes emails by terms such as "essay writing service," "ghostwriter," and "guaranteed pass," as well as exam cheating-related terms like "answers," "leaked questions," and "internal materials," and other inappropriate content. Each term has a corresponding severity weight; for example, "essay writing service" has a weight of 10, while "internal review materials" has a weight of 5. This tiered system ensures that the system can distinguish between violations of varying severity. Semantic relevance is calculated using cosine similarity to assess the normality of the email content.

[0091] Specifically, a corpus of normal teaching communications is pre-established, containing email samples of typical scenarios such as course consultation, homework submission, academic discussion, etc. When analyzing an email, the system vectorizes its content and then calculates the cosine value with each type of normal template. If the content of a certain email is "providing final exam answers, with preferential price", its similarity with the normal teaching template is close to 0, indicating that the content deviates seriously from the normal teaching category. Time period analysis reveals the behavioral characteristics of abnormal communications.

[0092] It should be noted that normal teacher-student communication is mainly concentrated in the daytime and before 10 pm at night, while a large number of email sending in the early morning period often implies an automated tool or malicious behavior. A day is divided into multiple time periods, and the period from 0 to 6 am is marked as an abnormal period, and the communications in this period will increase the risk score. This time feature, combined with other risk factors, can more accurately identify abnormal behavior. The calculation of the recipient ratio reflects the identification logic of bulk sending behavior.

[0093] For example, if the number of students enrolled in a certain course is 50, and it is detected that the number of recipients of an email reaches 200, the recipient ratio is 4, far exceeding the normal range. This anomaly usually means that the sender has obtained the email list of multiple classes or even the entire school, and may conduct large-scale illegal information dissemination. Through this indicator, bulk sending abnormal behavior can be effectively identified. The comprehensive calculation process of the risk score reflects the idea of multi-dimensional evaluation.

[0094] In one embodiment, a certain email contains 3 illegal words, each with a weight of 5, for a total of 15 points; the semantic relevance is 0.1, the reciprocal is 10, multiplied by the weight coefficient 0.5 to get 5 points; the sending time is 3 am, adding 10 points; the recipient ratio is 2.5, which exceeds the threshold of 2, adding 5 points, for a total of 35 points. If the low-risk threshold is 10 points and the medium-risk threshold is 25 points, the email is determined to be high-risk. The differentiated processing mechanism ensures the accuracy of the system response. Delayed sending of low-risk emails avoids affecting normal but inopportune communications, such as a student sending an email immediately after completing homework at night, which is delayed by the system to the next morning when the teacher is at work. Automatic compliance checks for medium-risk emails quickly filter through template matching, reducing manual intervention. High-risk emails are immediately intercepted, protecting the purity of the educational environment. The abnormal behavior counting mechanism enables cumulative management of repeat violators. Each abnormal behavior will leave a record on the sender's account, and when a certain account accumulates 5 high-risk behaviors or 15 medium-risk behaviors within 30 days, its sending permission will be downgraded and it will need to pass identity re-verification to restore.

[0095] S108, input the interception log, teacher-student identity consistency verification result, recipient group rationality feedback and abnormal behavior rationality determination result, analyze the false positive and false negative situation through machine learning algorithm, output the optimized time series analysis parameter, and obtain the adaptive parameter adjustment scheme.

[0096] Collect the processing records in the interception log, the teacher-student identity consistency verification result, the recipient group rationality feedback data and the abnormal behavior rationality determination result, arrange these data in chronological order, extract the determination category, the actual category, the feature parameter and the processing result of each record, wherein the actual category is determined by tracking the subsequent communication behavior and teaching activity record, and a historical data set containing the corresponding relationship between the predicted label and the actual label is constructed. Based on the historical data set, the difference between the predicted label and the actual label is counted, the false positive rate is calculated by dividing the number of misjudging normal communication as abnormal by the total number of normal communication, the false negative rate is calculated by dividing the number of unrecognizable abnormal communication by the total number of actual abnormal communication, the contribution degree of each feature parameter to misjudgment is analyzed by using decision tree algorithm, including time window size, frequency threshold, keyword weight and semantic similarity threshold, and the parameter influence degree sequence arranged from high to low is obtained. According to the parameter influence degree sequence and the misjudgment rate data, the corresponding parameters are adjusted, if the false positive rate exceeds the preset upper limit, the time window size is increased and the frequency threshold is increased, if the false negative rate exceeds the preset upper limit, the sliding interval is shortened and the semantic similarity threshold is reduced, and the prior probability distribution and the conditional probability matrix of the Bayesian classification are updated based on the newly collected normal teaching activity samples, so that the classification benchmark is more suitable for the actual teaching scene. The updated time window size, sliding interval, frequency threshold boundary, prior probability distribution, conditional probability matrix and feature weight are configured and integrated into a parameter configuration file, the current parameter version number, update timestamp and specific values of each parameter are recorded, and an adaptive parameter adjustment scheme containing a complete parameter set is formed.

[0097] Specifically, the construction of the historical data set embodies the basis of the system self-learning.

[0098] In a possible implementation, each interception record contains rich context information. When a mail sent at midnight is determined as high-risk and intercepted, the subsequent behavior of the sender will be continuously tracked. If it is found that the mail is actually a normal submission after the student completes the experiment report, the system will record the comparison between "predicted label: high-risk abnormality" and "actual label: normal teaching activity". The accumulation of such comparison data provides valuable training samples for subsequent parameter optimization. The determination of the actual category relies on a multi-dimensional verification mechanism.

[0099] Specifically, the system analyzes the subsequent teaching activity records to determine whether the previous interception is accurate.

[0100] For example, a certain email is blocked because it contains the keyword "answer", but it is later found that it is a reference answer to a homework problem sent by a teacher, and the sending time coincides with the homework correction period, and the recipients are all students enrolled in the course. Through the verification of these associated information, the system can accurately identify that this is a false positive, and the case is included in the training data. The calculation of false positive rate and false negative rate reveals the accuracy of the system's decision.

[0101] It should be noted that false positives will cause inconvenience to normal teaching activities, while false negatives may allow real abnormal behavior to pass. In a certain statistical period, the system processed a total of 1000 emails, of which 800 were normal emails and 200 were abnormal emails. If the system misjudges 50 normal emails as abnormal, the false positive rate is 50 divided by 800, about 6.25%; if 30 abnormal emails are not identified, the false negative rate is 30 divided by 200, i.e. 15%. These indicators directly reflect the performance of the system. The decision tree algorithm plays a key role in parameter influence degree analysis. The algorithm identifies the key factors that lead to misjudgment by constructing a tree-like decision structure.

[0102] For example, analysis finds that too small time window setting is the main reason for false positives, because a short time window cannot capture the complete teaching activity period; while too high semantic similarity threshold is the main cause of false negatives, because some new abnormal behaviors are expressed in a similar way to normal emails. By quantifying the contribution of each parameter to misjudgment, the system can be optimized in a targeted manner. The process of dynamic adjustment of parameters reflects the adaptive ability of the system.

[0103] In one embodiment, when the false positive rate reaches 10%, the system expands the time window from 24 hours to 48 hours, allowing for a more comprehensive observation period for students' behavior of sending homework after midnight; at the same time, the frequency threshold is increased from 10 per hour to 15, giving greater tolerance to intensive counseling during the end-of-term review period. Correspondingly, when the false negative rate is high, the semantic similarity threshold is reduced from 0.8 to 0.6, improving the ability to identify abnormal emails disguised as normal content. Version management of parameter configuration files ensures the traceability of the adjustment process. Each parameter update generates a new version number, such as from V1.0 to V1.1, with detailed information such as the timestamp "2024-12-2010:30:45", the change "time window: 24h→48h", etc. This mechanism not only facilitates the tracing of historical configurations, but also allows for quick rollback when new version parameters are found to be ineffective.

[0104] S109、According to the adaptive parameter adjustment scheme, update the education network abnormal behavior detection mode to generate a dynamic monitoring strategy.

[0105] According to the parameter configuration file in the adaptive parameter adjustment scheme, the updated time window size, frequency threshold boundary and feature weight configuration are read, these parameters are imported into the configuration table of the abnormal behavior detection module, and the course arrangement table, examination time list and homework deadline list in the future preset period are extracted from the teaching calendar database to obtain a detection configuration set that integrates the optimized parameters and teaching time nodes. Based on the teaching time nodes in the detection configuration set, three different stages of examination week, homework submission period and daily teaching period are identified, the monitoring interval is shortened to a preset proportion of the original interval for the examination week, the upper limit of the normal communication frequency is increased to a preset multiple of the original value, and high-frequency teaching words are extracted from historical data of the same period to supplement the keyword whitelist, thereby forming a differentiated monitoring parameter group corresponding to the teaching stage. The differentiated monitoring parameter group is deployed in the real-time detection process, the distance between the current date and the teaching time node is compared, the parameter settings of the corresponding stage are automatically activated, including the adjusted monitoring interval, the expanded frequency threshold range, the updated keyword list and the extended time window size, and a phased detection process that automatically switches with the teaching progress is constructed. The communication behavior is evaluated in real time through the phased detection process, the parameter configuration, activation time and detection result of each stage are recorded, the false alarm times of normal teaching communication and the identification times of real anomalies are counted, a dynamic monitoring strategy document containing stage identification, parameter setting and performance index is generated, and communication management that balances teaching needs and security protection is realized.

[0106] Specifically, the construction of the detection configuration set embodies the deep integration of parameter optimization and teaching reality.

[0107] In a possible implementation, the parameter configuration file contains various values optimized through machine learning, such as adjusting the time window from 24 hours to 36 hours, which is based on the analysis of historical data that students often complete homework at night and send it before the next morning. The teaching calendar database provides accurate time anchors, such as the final examination week from December 25 to January 5 and the review week from December 10 to 20. After integrating these two types of data, the system can predict the communication feature changes in different periods. The identification of the teaching stage involves the comprehensive judgment of multiple time nodes.

[0108] Specifically, the system determines the stage by calculating the distance between the current date and each key time point. When it is detected that there are 7 days left before the final examination, the system automatically marks the current stage as "examination week"; when the homework deadline of a course is within 48 hours, the "homework submission period" mode is activated. This stage identification is not a simple time division, but considers the superposition effect of multiple teaching activities, such as the final examination week may also be the homework submission peak period of multiple courses. The setting of differentiated monitoring parameters is based on the in-depth understanding of the communication features of different teaching stages.

[0109] It should be noted that during exam week, the frequency of communication between teachers and students increases significantly, with a surge in emails from students inquiring about review focus and requesting past exam papers. The system has shortened the monitoring interval from the usual 60 minutes to 20 minutes to ensure timely detection of anomalies; at the same time, the normal frequency limit has been increased from 10 emails per day to 30 emails to avoid misclassifying legitimate Q&A requests as abnormal. The keyword whitelist has also been updated accordingly, adding "review outline" and other keywords.

[0110] Frequently used terms include "exam point summary" and "Q&A session." The automatic switching mechanism for the phased testing process ensures the continuity and adaptability of monitoring.

[0111] In one embodiment, the system maintains a state machine that calculates the time difference with each teaching node in real time based on the current date. Three days before the exam week, the state machine automatically triggers a parameter switch, loading a preset exam week parameter set; after the exam, it automatically reverts to the normal parameters. This switch requires no manual intervention and is completed automatically based entirely on the time logic of the teaching calendar. The dynamic updating of the keyword whitelist reflects the evolution of the teaching content.

[0112] For example, analysis of historical data revealed that programming courses often included a large number of entries containing "..." at the end of the semester.

[0113] Emails related to "code debugging" and "program errors" are handled by the system, while theoretical courses focus on "conceptual understanding" and "formula derivation." Technical terms specific to these courses are whitelisted to prevent misjudgments based on their technical jargon. A dynamic monitoring strategy document provides data support for continuous improvement. This document details the parameter configurations for each stage, such as a 30-minute monitoring interval, a maximum frequency of 25 emails, and a 48-hour time window during review weeks. It also records the detection performance under these configurations, such as a false positive rate reduced to 3% and a false negative rate kept below 5%. By comparing performance metrics across different stages, the most effective parameter adjustments are identified, providing a basis for the next round of optimization.

[0114] The above are only some preferred embodiments of the present invention, but the present invention is not limited thereto, and many improvements and modifications can be made. Any improvements and modifications made based on the basic principles of the present invention should be considered to fall within the protection scope of the present invention.

Claims

1. A method for detecting abnormal behavior of an educational network based on intelligent auditing, characterized in that, The method includes: Acquire historical communication data between teachers and students, and analyze the normal frequency range at different teaching stages; The sliding time window method is used to monitor the authentication and sending frequency distribution of the current communication object. If the sending frequency distribution exceeds the normal frequency range within the current time window, an abnormal behavior pattern warning is triggered and an abnormal communication record is generated. For abnormal communication records, the course association relationship between the sender and receiver is queried through the teacher-student relationship database to establish a legitimate communication relationship mapping table between teachers and students, and the course association verification result is obtained. Based on the course relevance verification results, we analyze whether the time points of abnormal communication match the time points of specific teaching tasks, and verify the rationality of communication behavior by comparing historical interaction patterns to obtain a teaching task relevance assessment report. Determine whether abnormal communication behavior constitutes a reasonable teaching need, and obtain the result of the reasonableness judgment of abnormal behavior; If the abnormal communication behavior is a reasonable teaching need, the normal frequency range and the standard threshold of the topic content for the current time period are dynamically adjusted by matching the teaching calendar and verifying the response of the task node, so as to obtain the adjusted frequency threshold. If abnormal communication behavior does not fall under reasonable teaching needs, analyze the consistency of email subject lines and the abnormal recipient groups to determine the risk level of abnormal communication behavior; Analyze false alarms and generate an adaptive parameter adjustment scheme; A dynamic monitoring strategy is generated based on the adaptive parameter adjustment scheme.

2. The method of claim 1, wherein the method further comprises: The acquisition of historical communication data between teachers and students, and the analysis of normal frequency ranges at different teaching stages, includes: Extract historical email records from teachers and students, including sending timestamps and teacher / student identification, and segment them into teaching stages according to the sending timestamps. For each teaching stage, calculate the average daily sending frequency and average daily receiving frequency of the historical email records from teachers and students. Based on the average daily sending frequency and average daily receiving frequency, use a sliding window to calculate the frequency mean and frequency standard deviation for each teaching stage. Based on the frequency mean and frequency standard deviation, and in conjunction with the semester and exam dates in the teaching calendar, determine the normal communication frequency range for different teaching stages.

3. The method of claim 1, wherein the method further comprises: For abnormal communication records, the method involves querying the course association relationship between the sender and receiver through the teacher-student relationship database, establishing a legitimate communication relationship mapping table between teachers and students, and obtaining the course association verification result, including: Extract sender and receiver identifiers from the abnormal communication records; query the sender's teaching information and the receiver's elective course information from the teacher-student relationship database; match the course associations of the sender and receiver based on the teaching information and elective course information to generate a set of association types; construct a teacher-student legitimate communication relationship mapping table containing sender identifiers, receiver identifiers, and the number of association types based on the set of association types; verify the abnormal communication records through the teacher-student legitimate communication relationship mapping table to generate a course association verification result.

4. The method of claim 1, wherein the method further comprises: Based on the course relevance verification results, the analysis checks whether the time points of abnormal communication occurrences match the time points of specific teaching tasks. The rationality of the communication behavior is verified through comparison with historical interaction patterns, resulting in a teaching task relevance assessment report, including: Extract course information from the course relevance verification results; obtain the teaching task time nodes of the course information through the teaching calendar database, including the assignment release time and course progress; compare the timestamp of the abnormal communication record with the teaching task time nodes and calculate the time difference; generate a teaching task relevance assessment result containing time association markers and task types based on the time difference and the course information, and generate a teaching task relevance assessment report.

5. The method as claimed in claim 1, wherein the method is based on intelligent audit for detecting abnormal behavior of the educational network. The process of determining whether abnormal communication behavior falls within a reasonable teaching requirement, and obtaining a result determining the reasonableness of the abnormal behavior, includes: Obtain the number of association types and extract time association markers from the teaching task relevance assessment results; construct an abnormal communication feature vector based on the number of association types and the time association markers; calculate the posterior probability of the abnormal communication feature vector under the categories of course consultation and homework submission using a Bayesian classification algorithm; determine the category to which the abnormal communication behavior belongs based on the posterior probability and generate a result for determining the rationality of the abnormal behavior.

6. The method of claim 1, wherein the method further comprises: If the abnormal communication behavior is within a reasonable teaching requirement, the normal frequency range and the standard threshold for the topic content of the current time period are dynamically adjusted through teaching calendar matching and task node response verification to obtain the adjusted frequency threshold, including: If abnormal communication behavior is determined to be a reasonable teaching need, the reasonable teaching activity type is extracted; the teaching task time node corresponding to the reasonable teaching activity type is queried through the teaching calendar; the average daily frequency of communication records before and after the teaching task time node is calculated, and the adjusted normal frequency range is generated.

7. The method of claim 1, wherein the method further comprises: If the abnormal communication behavior does not fall under reasonable teaching needs, the consistency of email subject lines and the abnormal recipient group will be analyzed to determine the risk level of the abnormal communication behavior, including: Extract the email subject and body content of the abnormal communication records; count the number of prohibited words in the email subject through keyword matching; calculate the similarity between the body content and the teaching communication template using semantic analysis; determine the risk level of the abnormal communication behavior based on the number of prohibited words and the similarity.

8. The method of claim 1, wherein the method further comprises: The step of determining the risk level of abnormal communication behavior based on the number of illegal words and the similarity includes: multiplying the number of illegal words by a first weight, multiplying the reciprocal of the similarity by a second weight, and summing them to generate a risk score; and classifying the risk score as low risk, medium risk, or high risk based on a comparison with a preset threshold.

9. The method of claim 1, wherein the method further comprises: The analysis of false alarms and the generation of an adaptive parameter adjustment scheme include: Extract predicted and actual categories from interception logs and abnormal behavior rationality judgment results; calculate the false alarm rate of the predicted and actual categories; analyze the contribution of time window size and frequency threshold to false alarms using a decision tree algorithm; adjust the time window size and frequency threshold based on the contribution and false alarm rate to generate an adaptive parameter adjustment scheme.

10. The method of claim 1, wherein the method further comprises: The process of generating a dynamic monitoring strategy based on an adaptive parameter adjustment scheme includes: A detection configuration set is generated based on the parameter configuration file in the adaptive parameter adjustment scheme; a phased detection process that automatically switches with the teaching progress is constructed based on the teaching time nodes in the detection configuration set; the communication behavior is evaluated in real time through the phased detection process, the parameter configuration, activation time and detection results of each stage are recorded, the number of false alarms and the number of real anomalies identified in normal teaching communication are statistically analyzed, and a dynamic monitoring strategy is generated.

Images