Shared power bank abnormal occupation identification method

Abstract

The invention provides a shared power bank abnormal occupancy identification method, which comprises the following steps of: acquiring user operation, equipment state and environment context information in a multi-source manner, fusing and cleaning into a standardized data set, generating a multi-dimensional behavior mode input matrix through feature engineering and data alignment, and capturing a space-time interaction relationship between a user and equipment by using a graph neural network to identify the abnormal occupancy of the shared power bank. Outputting a context-aware behavior portrait; in combination with a time sequence classifier of an attention mechanism, abnormal occupancy probability prediction is realized, and continuous abnormal behaviors are judged according to a dynamic scene threshold value; finally, false alarms are reduced through context rationality verification, accurate feedback processing and model adaptive optimization are triggered for abnormal behaviors, the accuracy and real-time performance of abnormal behavior detection can be improved, and the intelligent level of shared power bank management is enhanced.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of intelligent management of shared power bank equipment, and in particular to a shared power bank abnormal occupation identification method. BACKGROUND

[0002] The continuous development of Internet of Things technology has promoted the large-scale application of shared power banks and other shared equipment in diversified operation scenarios such as retail, transportation hubs, and office buildings. As an important part of smart city and intelligent terminal infrastructure, shared power bank equipment provides convenient services for mobile terminal power supply by allowing users to borrow and return through code scanning. Existing shared power bank management systems generally integrate device networking management, user identity verification, and borrowing and returning record tracking, and their operation and maintenance efficiency and user experience level have been greatly improved, and market demand continues to grow. With the complexity of application scenarios, researchers have gradually explored anomaly detection methods based on data mining and machine learning. For example, some disclosed technical solutions attempt to apply clustering analysis to model user behavior characteristics, or introduce decision trees and other shallow classification methods to identify abnormal patterns. However, in actual application, in order to balance real-time performance and computational overhead, simple threshold determination and rule systems are still the main method. Some recent research on anomaly detection with context awareness has emerged, such as dynamically adjusting some thresholds by fusing time period, borrowing and returning device density, and other scene characteristics, but its intelligence and adaptability are limited, and most of them rely on manual rule templates, and cannot effectively generalize and identify complex and variable scenes and behavior heterogeneity. The current existing technology has a relatively single application scope, and is usually limited to typical scenarios such as high-frequency commuting sites, popular business districts, or limited campus. Its main technical features are: a unified rule base is developed for a single scene feature, and fixed or graded determination standards are configured in combination with historical big data statistics. These methods can achieve high rule hit rates in specific operation scenarios, but when faced with multiple regions and multiple scenes (for example, low-frequency use in office buildings, peak pulse borrowing and returning in subways and airports, and large-scale activity sites with different geographical crowd densities), the applicability and accuracy of the rules decrease significantly. SUMMARY

[0003] The present application provides a shared power bank abnormal occupation identification method to solve the above technical problems.

[0004] The technical solution of the present application is as follows: a shared power bank abnormal occupation identification method, comprising: S1: Collecting user operation sequence data, device state log data, and environmental context information of shared power bank equipment, the environmental context information including timestamp, geographical location label, and crowd density level information; S2: time window division is performed on the user operation sequence, and time sequence statistical features of operation frequency, use duration, return delay and borrow-return interval are extracted based on a sliding window method to generate a behavior feature vector; S3: the behavior feature vector is time-aligned with a corresponding device state log, and environmental context information is fused to construct a multi-dimensional behavior pattern input matrix; S4: the multi-dimensional behavior pattern input matrix is input into a graph neural network model to model the interaction relationship between the user and the device, and a context-aware behavior portrait vector is generated; S5: the behavior portrait vector is input into a time series classifier with an attention mechanism to output a behavior anomaly probability sequence, and a corresponding abnormality judgment threshold template is called from a preset rule library in combination with a current scene label; S6: based on the abnormality probability sequence and the dynamic threshold template, frame-by-frame comparison is performed to determine whether there is a continuous over-threshold behavior segment, and if there is, it is marked as an abnormal occupation behavior candidate segment; S7: context rationality verification is performed on the abnormal occupation behavior candidate segment, historical behavior distribution of geographic location and time period is combined to correct misjudgment segments and generate a final abnormal occupation recognition result; S8: a feedback processing procedure is triggered according to the abnormal occupation recognition result, including pushing alarm information to a management platform, limiting user borrow-return permission or starting an artificial review mechanism; S9: during the execution of the identification procedure, the identification accuracy and the false positive rate are dynamically recorded, and the graph neural network and the classifier model parameters are periodically updated based on newly collected behavior data to realize online optimization of the model.

[0005] The shared power bank abnormal occupation identification method provided by the application has the following beneficial effects: (1) The application constructs a multi-dimensional behavior pattern input matrix of user behavior time sequence features, device state logs and environmental context (time, geographic location, crowd density, etc.), introduces a graph neural network to model the user-device-scene three-way interaction relationship, generates a context-aware behavior portrait, and dynamically adjusts the abnormality judgment threshold according to the scene information (such as crowd density, geographic label), realizes multi-scene adaptive rule calling and fusion. Compared with traditional static rules, the generalization ability of the application is significantly improved, the behavior pattern change in different deployment environments is adapted, and rule conflicts and misjudgments are reduced; (2) The application highly fuses time sequence feature extraction (operation frequency, use time length, return delay, borrow-return interval) and context embedding (geography + people flow + equipment state), utilizes a graph neural network and a time sequence classifier with multi-head attention to deeply capture the space-time dependence of users and equipment, can accurately identify continuous threshold value abnormal behavior segments, and introduces context rationality verification and space-time distribution density comparison in the output stage. The application significantly improves the abnormal detection accuracy of traditional static rules in complex and variable scenes, significantly reduces the false positive rate, greatly improves the recall rate, and greatly enhances the robustness and reliability of abnormal identification; (3) The application realizes automatic upgrading and evolution of the model by continuously comparing the recognition result with the true label through a closed-loop recognition process, dynamically monitoring the recognition accuracy and false positive rate in the confusion matrix, and periodically self-adapting the graph neural network and classifier parameters based on online new sampling behavior data. Compared with the traditional manual maintenance or static updating method of the model, the application greatly reduces the later maintenance cost and maintains the leading performance of the model recognition. BRIEF DESCRIPTION OF DRAWINGS

[0006] Fig. 1 is a flow chart of a shared power bank abnormal occupation identification method of the application; Fig. 2 is a sub-flow chart of a shared power bank abnormal occupation identification method of the application; Fig. 3 is another sub-flow chart of a shared power bank abnormal occupation identification method of the application. DETAILED DESCRIPTION

[0007] In order to make the objects and advantages of the application clearer and more apparent, the application will be further described below in conjunction with embodiments; it should be understood that the specific embodiments described herein are only used to explain the application, and do not limit the protection scope of the application.

[0008] The preferred implementation methods of the application will be described below with reference to the drawings. Those skilled in the art should understand that these implementation methods are only used to explain the technical principles of the application, and are not intended to limit the protection scope of the application.

[0009] As used herein, the singular forms "a," "an," and "the" also include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term "comprising" or "including" or "having" or the like specifies the presence of stated features, integers, steps, operations, components, parts, or combinations thereof, but does not exclude the presence or addition of one or more other features, integers, steps, operations, components, parts, or combinations thereof. At the same time, the term "and / or" used in the specification includes any and all combinations of the related listed items.

[0010] Referring to Figs. 1-3 As shown in the drawings, a shared power bank abnormal occupation identification method comprises: S1: Collecting user operation sequence data, device state log data and environmental context information of the shared power bank equipment, the environmental context information including timestamp, geographic location label and people flow density level information; S2: Dividing the user operation sequence into time windows, and extracting time sequence statistical features of operation frequency, use time, return delay and borrow-return interval based on the sliding window method to generate a behavior feature vector; S3: Time-aligning the behavior feature vector with the corresponding device state log, and fusing the environmental context information to construct a multi-dimensional behavior pattern input matrix; S4: Inputting the multi-dimensional behavior pattern input matrix into a graph neural network model to model the interaction relationship between the user and the device, and generating a context-aware behavior portrait vector; S5: Inputting the behavior portrait vector into a time series classifier with an attention mechanism to output a behavior anomaly probability sequence, and combining the current scene label to call the corresponding abnormal judgment threshold template from the preset rule library; S6: Based on the abnormal probability sequence and the dynamic threshold template, frame-by-frame comparison is performed to determine whether there is a continuous over-threshold behavior segment, and if there is, it is marked as an abnormal occupation behavior candidate segment; S7: Performing context rationality verification on the abnormal occupation behavior candidate segment, combining the historical behavior distribution of the geographic location and time period to correct the misjudgment segment and generate the final abnormal occupation identification result; S8: Triggering a feedback processing procedure according to the abnormal occupation identification result, including pushing alarm information to the management platform, limiting user borrow-return permission or starting an artificial review mechanism; S9: Dynamically recording the identification accuracy and false positive rate during the execution of the identification process, and periodically updating the graph neural network and classifier model parameters based on newly collected behavior data to realize online optimization of the model.

[0011] The step S1: Collecting user operation sequence data, device state log data and environmental context information of the shared power bank equipment, the environmental context information including timestamp, geographic location label and people flow density level information. Specifically, it comprises: S1.1: Collecting operation logs of the user interaction module deployed on the shared power bank equipment, recording the timestamp, interface response code and operation terminal ID of the user borrow-return operation based on the event-driven mechanism to generate structured user operation sequence data; The interface event listening initialization configuration (parameters: event type code list, response timeout threshold, callback function pointer) is performed on the user interaction module deployed on the shared power bank device, realizing real-time capture and trigger response of the user borrowing and returning operation event; Further, through the timestamp generation algorithm (parameters: coordinated universal time UTC reference, millisecond level precision, device local time zone offset), the accurate time marking of each capture operation is realized, and the operation timestamp sequence synchronized with the device control system time is obtained; Further, through the interface response code analysis function (parameters: protocol version number, response code mapping table, exception code filtering rule), the semantic coding of the operation result is realized, and a structured response code set containing success, failure, timeout and other response states is generated; Further, through the operation terminal identification extraction algorithm (parameters: terminal hardware unique identification number, user account association ID, encryption hash function type), the unique determination of the hardware source information initiating the operation is realized, and the tamper-proof operation terminal ID is generated; Through the structured log generation function, the timestamp sequence, response code set and operation terminal ID are combined in field order to form a standardized user operation event record unit, realizing the standardized structured description of the user borrowing and returning operation process; For example, in the shared power bank device deployed in the mall, the interaction module event listening configuration is to listen to event type code [0x01 (lend out), 0x02 (return)], the response timeout threshold is set to milliseconds, and the callback function pointer is bound to the data writing process. The timestamp generation algorithm uses the UTC reference to calculate the local time by formula, where is set to hours. The interface response code analysis function calls the protocol version number , the response code mapping table defines 0x00 as success, 0x01 as failure, and 0xFF as timeout, and filters all 0xEE exception codes. The operation terminal identification extraction algorithm adopts the terminal hardware unique identification IMEI and the user account ID double factor combination, and obtains the terminal ID with a length of through SHA-256 hash processing. The structured log record format is defined as a three-field combination of [timestamp | response code | terminal ID], for example, [2024-06-15 13:25:31.532 | 0x00 | A94D3...F123], which can be directly used for timestamp alignment with the device state record in the subsequent S1.2 device state analysis link, verifying the consistency of the field data; S1.2: Analyze the running state log output by the embedded controller at the device end, extract device state indicators including device online status, charging port occupancy, battery remaining capacity, and communication signal strength to construct a device state log dataset; Parse and initialize the configuration of the running state log signal of the embedded controller at the device end (parameters: log format descriptor, sampling period threshold, abnormal insertion code filter table), realize the structured semantic mapping of the original state record; Use the state field parsing algorithm (parameters: field separator definition, data type mapping table, packet loss reconstruction rule) to realize the extraction and Boolean coding of the device online status field in the log frame, and obtain the online status flag vector for subsequent occupancy analysis; Further, through the charging port occupancy detection algorithm (parameters: port number index table, occupancy marker bit mapping table, redundant port merging strategy), realize the field decoding of the charging port occupancy and generate the charging port occupancy binary matrix for port utilization calculation; Further, use the battery remaining capacity calculation method (parameters: sampling voltage conversion coefficient, full capacity calibration constant, measurement noise filtering coefficient) to calculate the battery remaining capacity percentage through the following formula : Where, is the real-time sampling voltage of the battery, is the voltage-to-capacity conversion coefficient, is the full capacity nominal value, and the calculation result unit is percentage; Further, use the communication signal strength evaluation algorithm (parameters: RSSI sampling period, signal attenuation model parameters, short-term mean filtering window) to perform noise suppression and quantitative mapping on the signal strength field in the log, generating a signal strength sequence with the dimension of dBm; Through the structured log reorganization function, the online status flag vector, the charging port occupancy binary matrix, the battery remaining capacity percentage sequence, and the signal strength sequence are combined according to the unified timestamp index to form the device state log dataset, realizing the time sequence consistency and structured storage of the state data, providing directly alignable device state input for subsequent S1.3 geographic location label fusion; For example, in a shared power bank device deployed at a station, the embedded controller log format uses JSON structure style, and the sampling period threshold is set to The abnormal insertion code filter table is defined as [0xEE, 0xEF] in milliseconds. The device online state field is parsed using the separator ":" and mapped to a Boolean type 1 indicating online and 0 indicating offline; the charging port number index is 1 to 12, and the binary occupancy matrix is composed of the occupancy flag bit (value = 1 indicates occupancy) of each port; the battery remaining capacity calculation parameter is set , mAh, the actual measured voltage V is calculated by the formula to obtain a capacity percentage = 100%, and the smoothed value is stabilized at ±0.5% after filtering. The communication signal strength field is parsed using an RSSI sampling period ms, and the short-term average window length frames, and the output signal strength fluctuates in the range of -65 dBm to -60 dBm. All parsed outputs are sorted into a unified device state log data set according to the timestamp index, and the log parsing success rate is %, and the data set can be directly used for the next step of fusion processing of geographic location and passenger flow information; S1.3: Obtain the geographic tag information of the device deployment location based on the GPS positioning module, and combine the passenger flow statistical sensor data of the deployment point to generate time-stamped geographic location tags and passenger flow density level information; S1.4: Use a timestamp alignment algorithm to perform multi-source data fusion on user operation sequence data, device state log data, and environmental context information to generate a raw data set with a unified time reference, providing consistent input for subsequent behavior feature extraction; S1.5: Based on data integrity verification rules, perform missing value detection and outlier filtering on the fused raw data set, and use linear interpolation algorithm to fill in the missing items in the time series to generate a cleaned standardized collection data set.

[0012] The step S2: time window division is performed on the user operation sequence, and time series statistical features such as operation frequency, usage duration, return delay, and borrow-return interval are extracted based on the sliding window method to generate a behavior feature vector. Specifically, it includes: S2.1: The user operation sequence data collected is divided into time windows according to the timestamp to form time segments of fixed length for subsequent local statistical analysis of behavior features; The cleaned standardized collection data set is segmented by timestamp sequence (parameters: window length 1-1200 seconds, preferably 600-900 seconds, timestamp sorting mode Asc, boundary overlap ratio) to split the continuous time line into equal length time analysis segments; Further, through the time segment index mapping method (parameters: timestamp hash function type SHA-1, conflict resolution strategy linear probe), the unique binding relationship between the data record and the time segment it is in is realized, and a time segment index table is obtained; Further, the time segment internal event density evaluation algorithm (parameters: event type filter code [0x01, 0x02], density statistical step second) is adopted to realize the generation of the event distribution density matrix of each time segment, and to provide a localized aggregation basis for subsequent behavior statistical feature extraction; Further, through the timestamp boundary correction function (parameters: device clock drift correction value milliseconds, cross-day boundary processing mode WrapAround), the alignment processing of the time segment boundary and the standard time base of the device control system is realized, and a set of time segments after boundary correction is generated; Through time window division processing, the original time series data in the previous step is converted into a fixed-length, boundary-aligned time segment indexed data set, realizing the executable input of local statistical analysis; For example, in a shared power bank device deployed on campus, the window length is configured as 900 seconds, the timestamp sorting mode is Asc, and the boundary overlap ratio is 0.2, that is, the adjacent windows overlap for 180 seconds, which improves the behavior trend capture ability. The hash function of index mapping uses SHA-256, and the conflict resolution strategy uses double hashing method to establish a bidirectional index relationship between the time segment and the event record. The event density evaluation only counts the operation records of type code 0x01 (lend out) and 0x02 (return), and the statistical step is second, the number of rows of the density matrix is the window length divided by the step, and the number of columns is the number of event types. When performing boundary correction, the device clock drift correction value is set to milliseconds, and the windows across midnight are correctly divided into two segments, the first half and the second half, through the WrapAround mode. Under this configuration, the time window division precision reaches the millisecond level, the index mapping conflict rate is less than %, and the time segment index table can be directly called to realize fast traversal in the subsequent S2.2 operation frequency extraction link, significantly shortening the feature calculation time; S2.2: Based on the sliding window mechanism, the user lend and return operation records in each time segment are processed to extract the operation frequency in the unit time window, and the user interaction activity index in the unit time period is obtained; S2.3: Calculate the single use duration of each user in the time window, and count its mean, variance and maximum to construct a user behavior persistence feature vector; S2.4: Statistics on the delay of each return operation relative to the reservation or lending time, calculate the average and maximum delay of the return delay, to form the return behavior abnormality dimension; S2.5: Based on the time interval between consecutive borrowing and returning operations, extract the borrowing and returning interval sequence, and calculate its mean, standard deviation and trend, to construct the user usage regularity feature; S2.6: Standardize the above extracted operation frequency, usage time, return delay and borrowing and returning interval features, generate a unified dimension behavior feature vector as the input of subsequent context perception modeling.

[0013] The step S3: time align the behavior feature vector with the corresponding device state log, and fuse the environmental context information, construct a multi-dimensional behavior pattern input matrix. As shown in Fig. 2 Specifically, it includes: S3.1: Perform timestamp alignment processing on the behavior feature vector and device state log, match the time sequence correspondence between the behavior feature and the device state based on the timestamp sequence, to eliminate the time offset difference of heterogeneous data sources, and obtain the time-synchronized behavior-state mapping sequence; S3.2: Based on the time-synchronized behavior-state mapping sequence, use the time window sliding strategy to segment and slice the behavior feature and device state, to construct behavior-state segment pairs, and thus obtain structured behavior-state interaction units; Based on the time-synchronized behavior-state mapping sequence, use the time window sliding strategy (parameters: window length seconds, sliding step seconds, boundary overlap ratio ), realize continuous slicing processing of behavior features and device states, ensure the coverage and smoothness of segment data in time sequence space; Further, through the window-in bidirectional index matching algorithm (parameters: behavior sequence index table type B+ tree, device state index table type SkipList, matching strategy double pointer traversal), realize the one-by-one alignment binding of behavior feature records and device state indicators, and obtain the complete matching mapping matrix of behavior-state segment pairs; Further, using the intra-fragment feature aggregation method (parameters: statistical function set {mean, variance, maximum, minimum}, missing value filling strategy linear interpolation), realize the synchronous aggregation of behavior feature values and device state values in each segment, and generate a multi-dimensional statistical feature vector, to maintain the joint statistical properties of behavior and state in the time window; Further, through the segment boundary consistency verification algorithm (parameters: time drift tolerance milliseconds, timestamp standardization mode UTC+0), to normalize the adjacent segment boundaries and ensure the time continuity between segments and the time base consistency of the device state acquisition system; By segmenting slice processing and feature aggregation matching, the time-synchronized sequence in the previous step is converted into structured behavior-state interaction unit data, which realizes accurate input for subsequent context fusion and multi-dimensional pattern modeling; For example, in a shared power bank system deployed in a shopping mall, the window length is configured as seconds, sliding step seconds, boundary overlap ratio , up to lend and return records can be covered in each window. When using B+ tree behavior index table and SkipList device state index table for bidirectional matching, the matching speed can be maintained at sub-second level response under the scale of million records. In the feature aggregation stage, the mean The calculation formula is: wherein, is the th behavior or state value within the segment, is the total number of records in the segment. In the boundary consistency verification process, the tolerance determination formula is: wherein, is the segment boundary timestamp, is the timestamp recorded by the device control system. The application results show that the segmented behavior-state interaction unit in the subsequent context information fusion model training stage, the accuracy of anomaly recognition is improved by about %, the false negative rate is reduced by %; S3.3: Fuse the behavior-state interaction unit with the corresponding environmental context information, and perform context feature embedding operation based on geographic location label and people flow density level to generate context-enhanced behavior-state fusion vector; On the basis of structured behavior-state interaction unit, the input data includes time-synchronized behavior feature vector, device state index sequence, and corresponding environmental context information, wherein the environmental context information includes geographic location label and people flow density level; Context feature embedding algorithm (parameters: embedding dimension , encoding method One-Hot, position mapping table size ) is used to convert the geographic location label into a numerical vector representation for numerical fusion with behavior-state data; Further, the original density level is converted into an ordered integer value by a human flow density level quantization function (parameters: density level threshold set , , } and an encoding mode Ordinal), and a density encoding vector with the same dimension as other numerical features is obtained; Further, a feature fusion mapping method (parameters: fusion operator type Concatenate, sequence rule {behavior feature → device state → context feature}) is used to realize the sequence splicing of the behavior feature vector, the device state vector and the context embedding vector, and a preliminary multi-modal feature combination vector is generated; Further, a context weight adjustment algorithm (parameters: position weight coefficient , density weight coefficient , and weight normalization mode Sum-to-One) is used to realize the weighted scaling of the context feature part in the preliminary combination vector, and a context intensity adjusted fusion vector is obtained; Further, a feature consistency verification algorithm (parameters: feature number balance tolerance , and missing data completion strategy Mean-Impute) is executed based on the weighted fusion vector to ensure that the dimensions of the fusion result are balanced in statistical characteristics and missing items are completed, and a final context enhanced behavior-state fusion vector is obtained; Through the above context embedding and weighted fusion processing method, the behavior-state interaction unit result of the previous step is converted into a comprehensive vector containing time series behavior, device state and environmental context features, which realizes the comprehensive preservation of scene perception information and provides a semantically complete input for multi-dimensional mode modeling; For example, in the scenario of deploying a shared power bank device in an airport, the geographical position label embedding dimension is configured as , which is encoded by One-Hot and mapped to a dense vector by a position mapping table; the human flow density level is divided into five grades according to sensor statistics, and the specific thresholds are { , , , }, which are encoded as to integers by Ordinal; in the fusion stage, the behavior feature and device state vector dimensions are and respectively, and the context embedding vector dimension is + , and the combination vector with a total dimension of is obtained after splicing. The context weight adjustment coefficients position , density are applied, and the total weight is normalized to , and fill in the missing dimension by mean imputation, so that the dimension missing rate is lower than . After this step, the context-enhanced behavior-state fusion vector specific to the airport scene is generated, which effectively improves the accuracy of subsequent graph neural network in identifying abnormal occupancy in high-density scenes by about %; S3.4: Perform dimension expansion operation on the context-enhanced behavior-state fusion vector, construct multi-dimensional behavior pattern input tensor based on multi-modal feature concatenation strategy, to form structured input data format that can be processed by graph neural network; The input object is the generated context-enhanced behavior-state fusion vector, which contains behavior features, device state features, and context embedding features adjusted by weights, and the dimension is determined by the concatenation result of the previous step; A multi-modal feature concatenation strategy (parameters: concatenation operator type Concatenate, concatenation order rule {time series behavior features → device state features → context features}) is used to realize the vector-level lossless concatenation of various features in the preset order, and a multi-modal preliminary concatenation vector is obtained; Further, through the dimension expansion algorithm (parameters: expansion method sparse zero padding, expansion target dimension , zero padding index distribution mode Uniform), the expansion of the concatenation vector to the target dimension is realized, so that the vector structure of various input samples is consistent with the input dimension of the graph neural network, and the expanded feature vector set is obtained; Further, through the feature channel marker encoding method (parameters: marker bit width , encoding method BinaryFlag), the source identification code is embedded for different feature channels of the expanded vector, so that the graph neural network can identify the feature source during training, and generate an expanded tensor with channel markers; Further, the tensor formatting mapping algorithm (parameters: tensor dimension layout format [Batch, Time, Feature], batch size , time step ) is used to map the expanded vector with channel markers to a three-dimensional tensor structure, so as to facilitate the subsequent heterogeneous graph modeling module to directly call and maintain the temporal correlation of the context; Further, through the tensor consistency inspection logic (parameters: dimension consistency tolerance , missing value completion strategy MeanFill), the format, dimension and numerical integrity of all sample tensors are finally inspected, and a structured multi-dimensional behavior pattern input tensor that can be directly input to the graph neural network is generated; By the above multi-modal feature splicing and dimension expansion strategy, the context enhanced behavior-state fusion vector is converted into an input data format conforming to the processing standard of the graph neural network, realizing the structured expression of multi-source features under the unified space-time reference, and providing high consistency and high availability feature input for subsequent interaction relationship modeling; For example, in the deployment scenario of campus shared power bank, the behavior feature dimension is , the device state dimension is , the context embedding dimension is , and the preliminary spliced vector dimension is . Multi-modal splicing uses the Concatenate operator and performs sparse zero padding expansion to dimensions, where the zero padding position is selected by a Uniform distribution, so that the zero index position of different samples is randomly distributed. Each group of feature channels is assigned bit BinaryFlag identifier, where the behavior feature identifier is 00000001, the device state identifier is 00000010, and the context feature identifier is 00000011. The expanded vector is mapped to a three-dimensional tensor format with Batch=64, Time=10, and the dimension layout is fixed as [Batch, Time, Feature]. During consistency checking, the dimension tolerance is , and the missing value occurrence rate is measured as % and is completed by the MeanFill strategy. The multi-dimensional behavior pattern input tensor generated in this scenario can be directly loaded in the graph neural network training phase, and there is no conflict between the dimensions of the samples, and the model convergence rate is improved by about %, and the abnormal recognition accuracy is improved by about %; S3.5: Perform standardization normalization processing on the multi-dimensional behavior pattern input tensor, and use the Z-score normalization algorithm to compress the numerical range of each dimension feature, to improve the convergence efficiency and generalization ability of the graph neural network training, and obtain the final multi-dimensional behavior pattern input matrix.

[0014] The step S4: inputting the multi-dimensional behavior pattern input matrix into the graph neural network model, modeling the interaction relationship between the user and the device, and generating a context-aware behavior portrait vector. As shown in Fig. 3 , specifically comprising: S4.1: Constructing a heterogeneous graph structure based on the multi-dimensional behavior pattern input matrix, the heterogeneous graph structure containing two types of entity nodes, user nodes and device nodes, and three types of relationship edges, user-device lending and returning operation edges, user-time context association edges, and device-geographic location co-occurrence edges, to form a topological modeling of user and device interaction; The input object is a multi-dimensional behavior pattern input matrix obtained by processing through S3.5, which contains Z-score normalized time-series behavior features, device state features and weighted context embedding features, and meets the input dimension uniformity requirement of the graph neural network; The heterogeneous graph construction algorithm (parameters: node type set {user node, device node}, relationship edge type set {operation edge, time context edge, location co-occurrence edge}) is used to map the various features in the input matrix to corresponding type of graph nodes and their attribute vectors; Further, the node index generation method (parameters: user node ID index table hash mapping capacity , device node ID index table B+ tree) is used to realize the batch binding of user identification and device identification in the input matrix sample to node index, and obtain the node type mapping table; Further, the relationship edge generation algorithm (parameters: operation edge weight calculation method is the mean value normalization of borrowing and lending frequency, and the human flow density threshold set { , , } is used for context edge weight allocation) is used to generate corresponding type of relationship edge set according to the borrowing and lending events, time labels and location labels recorded in the input matrix; Further, the adjacency matrix construction method (parameters: matrix sparse storage format CSR, index compression mode is byte-level encoding) is used to generate a multi-dimensional adjacency matrix containing three types of relationships, where the element value represents the relationship type and weight between nodes, and the formula is defined as: Where is the element value of node to node in the adjacency matrix, is the relationship weight between the two nodes; Further, the attribute dictionary generation algorithm (parameters: attribute encoding mode One-Hot+Dense, vector length ) is used to map each dimension feature in the input matrix to a node attribute vector according to the node type, and form a graph neural network recognizable heterogeneous graph data structure with the adjacency matrix; The standardized multi-dimensional input matrix is converted into a topological structure containing user nodes, device nodes and multiple types of relationship edges by the heterogeneous graph construction algorithm, realizing the structured modeling of user and device interaction patterns, and providing a unified and context-aware graph data basis for subsequent relationship-specific message passing; For example, in the shopping mall scenario configuration, the user node ID range is to , and the device node ID range is to ; operation edge weight is calculated based on average borrow-return frequency in half year and normalized to to ; human flow density context edge is assigned weight based on threshold , , } weight , , ; location co-occurrence edge weight is calculated based on co-occurrence probability of devices in same geotag and time period, the final heterogeneous graph contains user nodes, device nodes, operation edges, time context edges, location co-occurrence edges, the sparsity of adjacency matrix reaches , and the storage space occupied by CSR encoding is about MB. The heterogeneous graph can be directly used for multi-hop neighborhood fusion in the subsequent message passing stage, and the interaction pattern recognition accuracy on the validation set is improved by about %; S4.2: define a relationship-specific message passing function for each type of relationship edge in the heterogeneous graph structure, which includes a linear transformation function based on operation frequency, an exponential decay function based on usage duration, and a segmented threshold function based on human flow density level, to realize relationship-differentiated feature propagation; The input object is the heterogeneous graph structure constructed in step S4.1, which contains two types of entities, user nodes and device nodes, and three types of relationships, operation edges, time context edges, and location co-occurrence edges. The node attribute vector is derived from the normalized results of the multi-dimensional behavior pattern input matrix; The relationship-specific message passing function definition method (parameters: function library type CustomRelFuncs, relationship categories {operation frequency, usage duration, human flow density level}) is used to assign different feature propagation operators to each type of relationship edge to distinguish semantic differences; Further, the linear transformation function based on operation frequency (parameters: weight matrix dimension × , bias vector length ) is used to realize linear combination mapping of operation edge features, and the mapping formula is: where is the operation edge message vector, is the source node feature, and are the weight matrix and bias, respectively; Furthermore, through an exponential decay function based on usage duration (parameter: decay coefficient) Initial amplitude This enables message decay in long-term relationships, ensuring that the message strength of long-term relationship edges decreases over time. Furthermore, a piecewise threshold function based on pedestrian density levels (parameters: threshold set { , , }, corresponding weights { , , }), to set the weights of relational messages under different density conditions; By combining the above three types of relationship-specific message passing functions, the source node features are transformed into a set of relationship-weighted message vectors, providing a highly discriminative relationship feature propagation mechanism for subsequent multi-hop neighborhood information aggregation in multi-layer graph neural networks, and achieving accurate capture of spatiotemporal correlation characteristics. For example, in a heterogeneous graph of an airport scene, the operation frequency weight matrix Initialized as a uniform Xavier distribution, dimension × bias Initialized as a zero vector; parameters of the exponential decay function. = , The number of minutes the equipment was borrowed; the pedestrian density level is mapped from the sensor's measured data to { , , } correspond to weights respectively , , After executing the message passing function, the average magnitude of the message vector on the operation frequency relationship edge increased by approximately %, long-term use of relational edge message amplitude in It decays to its initial value after minutes. The message weight of relationships in high-density scenarios is increased by approximately % compared to low-density scenarios. Application results show that this relation-specific messaging mechanism improves the node embedding separability on the validation set by approximately [number] times. The accuracy of abnormal occupancy detection has been improved by approximately %. % S4.3: Based on the relationship-specific message passing function, perform message aggregation operation of multi-layer graph neural network, perform multi-hop neighborhood information fusion of user nodes and device nodes, and generate fused context-aware node embedding vectors to capture the spatiotemporal correlation characteristics of user behavior; The input object is the set of relationship weighted message vectors obtained after the S4.2 step, which contains the weighted message vectors generated for the three types of relationship edges of operation frequency, usage duration, and passenger flow density, and maintains an index relationship corresponding to the node structure of the heterogeneous graph; The multi-layer graph neural network message aggregation algorithm (parameters: aggregation layer number , aggregation operator type MeanAggregator, and normalization mode Row-wise L2) is used to realize the weighted accumulation of the message vectors from adjacent nodes in each layer of the network and generate the intermediate embedding representation of the current node; Further, the multi-hop neighborhood expansion method (parameters: maximum hop number , and sampling rate ) is used to realize the expansion sampling of each node neighborhood and introduce the message vectors of the second-order neighborhood into the aggregation process to capture the spatio-temporal interaction characteristics across nodes and obtain the expanded neighborhood message set; Further, the relationship type grouping aggregation strategy (parameters: grouping set {operation relationship group, time relationship group, location relationship group}, and group weight normalization mode Softmax) is used to realize the aggregation calculation of the neighborhood messages of different relationship categories respectively, and the group aggregation formula is: wherein is the aggregation vector of the node in the relationship category , is the relationship weight between the neighbor node and , is the neighbor node message vector; Further, the cross-group fusion mechanism (parameters: fusion method weighted summation, weight vector length , and weight initialization mode uniform distribution) is used to realize the fusion of the aggregation vectors of different relationship categories into the global embedding representation of the node and generate the output embedding matrix of the layer network; Further, the inter-layer residual connection method (parameter: residual ratio ) is used to realize the fusion of the deep embedding and the shallow embedding, maintain the basic nature of the low-level features, and enhance the stability and convergence of the network; Through the above multi-layer message aggregation and multi-hop neighborhood fusion strategy, the relationship weighted message vector is converted into a node embedding vector that fuses the context awareness, realizing the capture and representation of the spatio-temporal correlation characteristics of user behavior; For example, in the heterogeneous graph structure in the airport scenario, the aggregation layer number is set to , each layer uses MeanAggregator to average the neighborhood message, and Row-wise L2 mode is used for normalization to ensure the numerical scale of each node embedding is consistent; the maximum hop number of neighborhood expansion is , the sampling rate ensures that a sufficient proportion of nodes in the second-order neighborhood are retained to improve the ability to capture cross-regional behavior; in the relationship category grouping aggregation, the operation relationship group, time relationship group and location relationship group respectively calculate , and based on the Softmax normalized weight, the influence intensity of different neighbors on the node is ensured to be ; the cross-group fusion weight vector is initialized as a uniform distribution , and is adaptively adjusted during the training process, and the residual ratio ensures the effective preservation of shallow features in high-density scenarios. After executing the above aggregation strategy, the intra-class variance of node embedding is reduced by about %, the inter-class distance is improved by about %, and the evaluation of the validation set shows that the accuracy of abnormal occupancy recognition is improved by about %, providing a stable and high-discrimination feature basis for the subsequent scene normalization and attention fusion steps; S4.4: performing scene normalization processing based on geographic location labels and time period labels on the node embedding vector, the normalization processing uses an adaptive scaling factor adjusted by scene parameters to eliminate the statistical bias of user behavior distribution in different deployment scenarios; S4.5: cross-node attention fusion on the normalized node embedding vector, calculating the interaction importance weight between user nodes and device nodes, and generating a context-aware behavior portrait vector based on the interaction importance weight weighted aggregation to represent the comprehensive behavior pattern features of the user in a specific scene.

[0015] The step S5: inputting the behavior portrait vector into a time series classifier with attention mechanism, outputting a behavior anomaly probability sequence, and combining the current scene label to call the corresponding abnormal judgment threshold template from the preset rule library. Specifically, it includes: S5.1: based on the behavior portrait vector, using a multi-head attention mechanism to perform weighted aggregation of behavior features in the time dimension to enhance the feature expression of key time steps, and obtaining an attention-weighted behavior feature sequence; S5.2: inputting the attention-weighted behavior feature sequence into a bidirectional long short-term memory network (Bi-LSTM) to model the behavior time series dependency relationship, to extract forward and backward context information and generate a time series hidden state vector; The input object is the attention-weighted behavior feature sequence obtained by the S5.1 step processing, and the feature vector of each time step of the sequence already contains key timing information strengthened by the multi-head attention mechanism, with a dimension of The sequence length is preserved in the time axis ; The bidirectional long short-term memory network (Bi-LSTM) modeling method (parameters: forward and backward hidden unit number , number of layers , and cycle dropout ratio ) is adopted to realize bidirectional dependency modeling of the input sequence in the time dimension, and forward hidden state sequence and backward hidden state sequence are generated respectively. Further, through the LSTM unit state update formula (parameters: weight matrix dimension , , activation function , and ), combined with the forward and backward calculation process, the gate state update of each time step is realized. Further, through the bidirectional connection strategy (parameters: concatenation mode Concat and output dimension ), the forward hidden state and the backward hidden state are spliced in the feature dimension to generate a bidirectional timing hidden state vector. Further, the cycle dropout and layer normalization method (parameters: dropout rate and normalization mode LayerNorm) is adopted to regularize the bidirectional hidden state vector, suppress overfitting and stabilize the network training process. Through the above bidirectional long short-term memory network calculation, the attention-weighted behavior feature sequence is converted into a hidden state matrix containing forward and backward timing context, providing high-order feature representation capturing global timing dependency for subsequent classification scoring, and realizing precise timing description of abnormal behavior patterns. For example, in a shopping mall scenario, the input attention-weighted feature sequence length is steps, the feature dimension of each step is , the forward and backward hidden unit numbers of Bi-LSTM are both configured as , the cycle dropout ratio is set to , and the number of layers is . When performing LSTM gate update, the output average value of the input gate is stable at , the average value of the forgetting gate is about , and the average value of the output gate is about , indicating that the network tends to introduce more new inputs and partially forget the historical state in this scenario. After bi-directional concatenation and LayerNorm processing, the generated bi-directional hidden state matrix improves the time series classification accuracy on the validation set by about % compared to the single-direction LSTM, and the recall rate of abnormal occupancy behavior is increased to % or more; S5.3: Based on the time series hidden state vector, a Softmax activation function is used to classify and score each time step to output a behavior anomaly probability sequence, representing the abnormal confidence distribution at each time point; S5.4: Obtain the scene label where the current shared power bank device is located, which includes geographic location label and people flow density level information, to identify the typical operating environment type of the device; S5.5: Based on the scene label, retrieve and call the corresponding abnormal judgment threshold template from the pre-set multi-scene abnormal judgment rule library to match the dynamic abnormal judgment standard in the current scene.

[0016] The step S6: based on the abnormal probability sequence and dynamic threshold template, frame-by-frame comparison is performed to determine whether there is a continuous over-threshold behavior segment, if there is, it is marked as an abnormal occupancy behavior candidate. Specifically, it includes: S6.1: Align the abnormal probability sequence and the dynamic threshold template frame by frame, match the abnormal probability value and the threshold value of each frame based on the timestamp, and construct a frame-by-frame comparison dataset; S6.2: Based on the sliding window mechanism, the windowed slicing processing is performed on the frame-by-frame comparison dataset to capture the abnormal behavior trend features between consecutive frames, and generate an abnormal trend window sequence; For the frame-by-frame comparison dataset processed by S6.1, the input object is the aligned abnormal probability value and the scene adaptive dynamic threshold value pair list based on the timestamp, the sequence length is , and each frame contains abnormal probability component and corresponding threshold .

[0017] The sliding window slicing method (parameters: window length , step length ) is used to realize the fragmentation segmentation of the frame-by-frame comparison dataset while preserving the sequential characteristics of the time series; Further, through the window data index mapping algorithm (parameter: index offset ), the position of each frame in the original sequence is calibrated within the window, and a window data matrix is generated, with dimensions × , containing abnormal probability values and threshold columns; Further, the window data matrix is calculated by a trend feature extraction function, and the trend function is defined as: wherein the molecule is the frame-by-frame difference summation of the anomaly probability value and the corresponding threshold value in the window, is the window length, and the calculation result is the average over-threshold intensity in the window; Further, the sign function is used to determine the positive and negative of the average over-threshold intensity, and is defined as: The determination is used to identify the direction of the anomaly trend in the window; Through the iterative cumulative processing of the window sequence, the average over-threshold intensity and the direction label of each window are combined to form an anomaly trend window sequence, realizing the feature input of the continuous frame anomaly trend; For example, in an airport scene, the length of the frame-by-frame comparison data set is , the window length is frames, and the step length is frames. For the third window, the anomaly probability value sequence is , the corresponding threshold value sequence is , the difference value sequence is obtained by subtraction, and the average is taken to obtain , and the sign function output is , indicating that there is a positive anomaly trend in the window. After processing all the windows, the anomaly trend window sequence of the airport scene contains 9 continuous positive anomaly segments, providing input for the over-threshold judgment logic of S6.3, realizing the trend detection for long-time device occupation; S6.3: Perform over-threshold judgment logic on the anomaly trend window sequence, identify whether there is a continuous over-threshold segment in the window based on Boolean logic operation, and generate a preliminary anomaly label sequence; S6.4: Apply a morphological filtering algorithm to the preliminary anomaly label sequence for noise suppression processing to remove isolated mislabeled segments, and obtain a structured abnormal behavior candidate segment sequence; S6.5: Based on the behavior duration and anomaly probability intensity, weight the score of the structured abnormal behavior candidate segment to generate an abnormal occupation behavior candidate segment label result.

[0018] The step S7: performs context rationality verification on the abnormal occupation behavior candidate segment, combines the historical behavior distribution of the geographical location and the time period, corrects the misjudgment segment, and generates a final abnormal occupation identification result. Specifically, it includes: ​​​​S7.1: Based on the timestamps and geographic location tags of candidate segments of abnormal occupancy behavior, retrieve the statistical distribution of user behavior within the corresponding spatiotemporal unit from the historical behavior database to obtain a benchmark of typical behavior patterns in this scenario; S7.2: Perform probability density estimation on the typical behavior pattern benchmark obtained from the retrieval, and generate behavior distribution density functions in the time and space dimensions to quantify the normal range of behavior in the current candidate segment's environment; S7.3: Map the time span and geographical location information of the candidate segments of abnormal occupancy behavior to the behavior distribution density function, calculate its membership index in the normal behavior space, and evaluate the degree of deviation between the candidate segments and the normal behavior pattern. The input data includes the behavioral distribution density functions in the time and spatial dimensions generated by step S7.2, as well as the time span and geographical location information of the candidate segments of abnormal occupancy behavior; Using a time mapping method (parameter: start time of time span) End time This enables the location marking of candidate segments for abnormal occupancy behavior in the time dimension; Furthermore, through a spatial mapping algorithm (parameters: geographic location tag ID, location coordinates) This enables the spatial identification of candidate segments and maps the location to the corresponding spatial distribution density function index unit. Furthermore, a two-dimensional density sampling method is adopted (parameter: time sampling interval). Spatial grid size ), in the time window of the mapping location Within this matrix, cross-sampling is performed on the density functions in the time and spatial dimensions to obtain the local normal density value matrix. ; Furthermore, the membership degree calculation formula, based on the principle of fuzzy sets, is defined as follows: in, As a membership index, This represents the local normal density value. This represents the number of sampling points; Furthermore, through the deviation calculation method (parameter: statistical value of actual behavior of candidate segment), Normal density expected value This quantifies the difference between the candidate segment behavior distribution and the normal pattern, and the formula is defined as: in, This is a deviation index; The time span and geographical location mapping results are converted into quantitative indicators required for context rationality verification by the membership and deviation degree joint evaluation algorithm, and the deviation degree of the candidate segment from the normal behavior pattern is evaluated. For example, in a shopping mall scenario, an abnormal occupancy candidate segment has a time span of to , a geographical location label ID of , and a position coordinate of . After mapping to the historical behavior distribution density function, the time dimension sampling interval is , the space grid size is , and the mean value of the matrix is obtained. According to the membership formula, the is calculated. The actual average occupancy time of the candidate segment is , the normal mode expectation value is , and the deviation degree is calculated by substituting the deviation degree formula. The deviation degree and membership degree jointly present a result higher than the correction threshold, thereby entering the context logic screening and abnormal confidence decay processing flow in S7.4. In the verification experiment, this method can reduce the false positive rate in the shopping mall scenario by about , and improve the matching degree of the abnormal occupancy recognition result and the actual behavior; S7.4: Compare the membership index with the preset context correction threshold, identify abnormal candidate segments that do not conform to the context logic, and decay the abnormal confidence of these candidate segments to reduce the false positive probability; S7.5: Perform logic fusion and time alignment on the abnormal candidate segments after decay processing, combine the continuity constraint rule and the context consistency criterion, and generate the final abnormal occupancy behavior recognition result vector.

[0019] The step S8: Trigger the feedback processing flow according to the abnormal occupancy recognition result, including pushing alarm information to the management platform, limiting user borrowing and returning permissions, or starting the manual review mechanism. Specifically, it includes: S8.1: Based on the behavior label and timestamp information in the abnormal occupancy recognition result, generate a structured alarm data packet, which includes user identification, device number, abnormal type label, occurrence timestamp and behavior duration, for standardized data pushing to the management platform; S8.2: Perform communication protocol encapsulation processing on the structured alarm data packet, use the message queue mechanism based on the MQTT protocol to push the encapsulated alarm data to the cloud management platform, to realize real-time notification and centralized monitoring of abnormal events; S8.3: Based on the user identification and the abnormal level label, the corresponding credit evaluation model parameters are retrieved from the user permission database, and combined with the preset permission control rules, the user borrowing and returning permission adjustment instructions are generated to dynamically limit or suspend the device use permission of the abnormal user; The input data includes user identification information and abnormal level labels in the abnormal occupation recognition result, and the execution object is the credit evaluation model parameters and the permission control rule set stored in the user permission database; The user information retrieval method (parameters: user identification ) is used to realize the credit evaluation model parameter positioning function based on the unique user ID; Further, through the abnormal level label mapping algorithm (parameters: abnormal level , level-weight mapping table), the parameterization conversion of abnormal level to model risk factor is realized, and the risk weighted value is obtained; Further, through the credit score calculation formula, the original credit score is coupled with the risk weighted value, and the formula is defined as: Among them, is the adjusted credit score. Through the formula, the dynamic deduction of the user credit score by the abnormal level is realized; Further, through the permission rule matching algorithm (parameters: adjusted credit score , preset rule threshold ), the binding of user behavior risk and permission limit strategy is realized, and the permission adjustment type label (limit or suspend) is generated; Further, the instruction generation method (parameters: adjustment type label, device number ) is used to bind the above adjustment type label and the target device based on the permission control communication protocol to form a structured borrowing and returning permission adjustment instruction data packet; Through the permission rule matching and instruction generation link, the credit deduction result of the previous step is converted into executable permission control data, realizing the dynamic limitation and suspension of the abnormal user device use permission; For example, in the shared power bank business circle operation scene, the abnormal occupation recognition result shows that the user ID is , and the abnormal level is . The credit evaluation model basic score of the user is retrieved from the user permission database . The risk weighted value corresponding to in the abnormal level mapping table is , and the credit score calculation formula is obtained = Points. Based on the restriction thresholds set in the access control rule set. The user's rating is below the threshold, triggering the "suspend borrowing and returning" policy. The system generates a bound device number. The pause command data packet is subsequently encrypted and verified for integrity before being used to enforce physical layer access control on the device. In this scenario, testing showed that this strategy can reduce the probability of abnormal user access events by approximately [percentage missing]. And significantly improve equipment turnover rate; S8.4: Perform digital signature and integrity verification on the permission adjustment command, adopt an encryption mechanism based on RSA algorithm to generate an encrypted permission control command frame, and send it to the corresponding shared power bank terminal device through the device communication interface to realize physical layer permission control; S8.5: When the abnormal occupancy behavior identification result meets the manual review triggering condition, a review request dataset is generated based on the behavior profile vector and context-aware information. The review request dataset includes the original behavior sequence data, feature vector, judgment probability and scene label, and is pushed to the manual review queue to start the manual intervention process.

[0020] Step S9: During the recognition process, the recognition accuracy and false alarm rate are dynamically recorded, and the graph neural network and classifier model parameters are periodically updated based on newly collected behavioral data to achieve online model optimization. Specifically, this includes: S9.1: Compare the abnormal occupancy identification results output in the identification process with the real label data, and calculate the identification accuracy, false alarm rate and false negative rate based on the confusion matrix to quantify the current identification performance of the model; S9.2: Based on the recognition accuracy and false alarm rate indicators, and combined with the preset model update trigger threshold, determine whether the online model update conditions are met. If they are met, generate a model update instruction signal to start the subsequent model parameter optimization process. S9.3: In response to the model update instruction signal, extract the user operation sequence, device status log and environmental context information collected in the most recent period from the data storage module to form an incremental training dataset, which is used as the data input for model optimization; S9.4: Perform feature extraction and multi-dimensional behavior pattern modeling on the incremental training dataset to generate an updated graph neural network input matrix, and fine-tune and optimize the node embedding parameters in the graph neural network based on the gradient descent algorithm to improve the accuracy of behavior profile generation. S9.5: Input the updated graph neural network output behavior profile vector into a temporal classifier with an attention mechanism, and retrain the attention weight parameters and classification decision boundary in the classifier based on incremental labeled data to enhance the model's ability to generalize and recognize behavior patterns in multiple scenarios. S9.6: After completing the model parameter update, the optimized graph neural network and the classifier model version are written to the model repository and loaded into the behavior analysis judgment module through the model deployment module to replace the old model and continuously improve the overall abnormal identification accuracy and scene adaptability of the system.

[0021] The technical solutions of the present application have been described in combination with the preferred embodiments shown in the drawings, but it is easy for those skilled in the art to understand that the protection scope of the present application is obviously not limited to these specific embodiments. Those skilled in the art can make equivalent changes or replacements to the related technical features without departing from the principles of the present application, and the technical solutions after these changes or replacements will fall within the protection scope of the present application.

[0022] The above description is only the preferred embodiments of the present application and is not intended to limit the present application; for those skilled in the art, the present application can have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and rules of the present application shall be included within the protection scope of the present application.

Claims

1. A method for identifying abnormal occupancy of shared power banks, characterized in that, Includes the following steps: S1: Collect user operation sequence data, device status log data, and environmental context information of the shared power bank device. The environmental context information includes timestamps, geographic location tags, and crowd density level information. S2: Divide the user operation sequence into time windows, and extract the time-series statistical features of operation frequency, usage duration, return delay and borrowing / returning interval based on the sliding window method to generate a behavioral feature vector; S3: Align the behavior feature vector with the corresponding device status log in time, and fuse the environmental context information to construct a multi-dimensional behavior pattern input matrix; S4: Input the multi-dimensional behavior pattern into the graph neural network model to model the interaction relationship between the user and the device, and generate a context-aware behavior profile vector. S5: Input the behavior profile vector into a temporal classifier with an attention mechanism, output a sequence of abnormal behavior probabilities, and call the corresponding abnormal judgment threshold template from the preset rule base in combination with the current scene label. S6: Based on the abnormal probability sequence and the dynamic threshold template, perform frame-by-frame comparison to determine whether there are continuous over-threshold behavior segments. If so, mark them as candidate segments of abnormal occupancy behavior. S7: Perform contextual rationality verification on the candidate segments of the abnormal occupancy behavior, combine the historical behavior distribution of geographical location and time period, correct the misjudged segments and generate the final abnormal occupancy identification result.

2. The method for identifying abnormal occupancy of shared power banks according to claim 1, characterized in that, The process following step S7 also includes: S8: Trigger a feedback processing flow based on the final abnormal occupancy identification result, including pushing alarm information to the management platform, restricting user borrowing and returning permissions, or initiating a manual review mechanism; S9: Dynamically record the recognition accuracy and false alarm rate during the recognition process, and periodically update the graph neural network and classifier model parameters based on newly collected behavioral data.

3. The method for identifying abnormal occupancy of shared power banks according to claim 1, characterized in that, Step S1 specifically includes: The operation logs of the user interaction module deployed on the shared power bank device are collected. Based on the event-driven mechanism, the timestamps of the user's borrowing and returning operations, the interface response codes and the operation terminal IDs are recorded to generate structured user operation sequence data. The device status log output by the embedded controller is parsed to extract device status indicators and construct a device status log dataset. The geographic tag information of the device deployment location is obtained based on the GPS positioning module, and combined with the passenger flow statistics sensor data of the deployment point, a geographic location tag and passenger flow density level information synchronized with the timestamp are generated. A timestamp alignment algorithm is used to fuse user operation sequence data, device status log data and environmental context information from multiple sources to generate a raw data set with a unified time base. Based on the data integrity verification rules, missing value detection and outlier filtering are performed on the original data set with a unified time base. A linear interpolation algorithm is used to fill in the missing items in the time series, generating a cleaned and standardized collection dataset.

4. The method for identifying abnormal occupancy of shared power banks according to claim 3, characterized in that, The device status indicators include device online status, charging port occupancy, remaining battery capacity, and communication signal strength.

5. The method for identifying abnormal occupancy of shared power banks according to claim 1, characterized in that, Step S2 specifically includes: The collected user operation sequence data is divided into time windows according to timestamps to form time segments of fixed length. Based on the sliding window mechanism, the user borrowing and returning operation records in each time segment are traversed and processed to extract the operation frequency within a unit time window and obtain the user interaction activity index within a unit time period. Calculate the duration of each user's single use within a time window, and calculate its mean, variance, and maximum value to construct a feature vector of user behavior persistence. The delay of each return operation relative to the reservation or borrowing time is statistically analyzed, and the average and maximum delay values ​​of the return are calculated to form a dimension for measuring the abnormality of return behavior. Based on the time interval between consecutive borrowing and returning operations, the borrowing and returning interval sequence is extracted, and its mean, standard deviation and trend are calculated to construct the regularity characteristics of user usage. The user interaction activity index within the unit time period, the user behavior persistence feature vector, the return behavior anomaly measurement dimension, and the user usage regularity feature are standardized to generate a behavior feature vector with unified dimensions.

6. The method for identifying abnormal occupancy of shared power banks according to claim 1, characterized in that, Step S3 specifically includes: Perform timestamp alignment processing on the behavior feature vector and the device status log, and match the temporal correspondence between the behavior features and the device status based on the timestamp sequence to obtain a time-synchronized behavior-state mapping sequence; Based on the time-synchronized behavior-state mapping sequence, a time window sliding strategy is used to segment the behavior features and device states into segments, constructing behavior-state segment pairs, thereby obtaining structured behavior-state interaction units. The behavior-state interaction unit is fused with the corresponding environmental context information, and a context feature embedding operation is performed based on the geographic location tag and the crowd density level to generate a context-enhanced behavior-state fusion vector; Perform a dimension expansion operation on the context-enhanced behavior-state fusion vector to construct a multi-dimensional behavior pattern input tensor based on a multi-modal feature concatenation strategy; The multidimensional behavior pattern input tensor is normalized and standardized, and the numerical range of each dimension feature is compressed to obtain the final multidimensional behavior pattern input matrix.

7. The method for identifying abnormal occupancy of shared power banks according to claim 6, characterized in that, In step S3, when fusing contextual features, the geographic location label adopts the One-Hot encoding method, the pedestrian density level is mapped to ordered integer values ​​according to the threshold of each scene, and the semantic expression of contextual information in the behavior profile is complete through feature weighted fusion and missing completion.

8. The method for identifying abnormal occupancy of shared power banks according to claim 1, characterized in that, Step S4 specifically includes: A heterogeneous graph structure is constructed based on a multidimensional behavior pattern input matrix. The heterogeneous graph structure includes two types of entity nodes: user nodes and device nodes, as well as three types of relational edges: user-device borrowing and returning operation edges, user-time context association edges, and device-geographical location co-occurrence edges. For each type of relation edge in the heterogeneous graph structure, a relation-specific message passing function is defined. The message passing function includes a linear transformation function based on operation frequency, an exponential decay function based on usage duration, and a piecewise threshold function based on pedestrian density level. Based on relationship-specific message passing functions, message aggregation operations of multi-layer graph neural networks are performed to fuse multi-hop neighborhood information between user nodes and device nodes, generating fused context-aware node embedding vectors. The node embedding vector is subjected to scene normalization processing based on geographic location label and time period label. The normalization processing adopts an adaptive scaling factor that adjusts scene parameters. Cross-node attention fusion is performed on the normalized node embedding vectors to calculate the interaction importance weights between user nodes and device nodes, and context-aware behavior profile vectors are generated by weighted aggregation based on the interaction importance weights.

9. A method for identifying abnormal occupancy of shared power banks according to claim 1, characterized in that, Step S5 specifically includes: Based on the behavior profile vector, a multi-head attention mechanism is used to weight and aggregate the behavior features in the time dimension to obtain an attention-weighted behavior feature sequence. The attention-weighted behavioral feature sequence is input into a bidirectional long short-term memory network to model the temporal dependency of behavior, extract forward and backward context information, and generate a temporal hidden state vector. Based on the temporal hidden state vector, the Softmax activation function is used to classify and score each time step, and the abnormal behavior probability sequence is output to represent the abnormal confidence distribution at each time point. Obtain the scene tag of the current shared power bank device. The scene tag includes a geographical location tag and a pedestrian density level information, which are used to identify the typical operating environment type of the device. Based on the scene tags, the corresponding anomaly judgment threshold template is retrieved and called from the preset multi-scene anomaly judgment rule library to match the dynamic anomaly judgment standard under the current scene.

10. A method for identifying abnormal occupancy of shared power banks according to claim 1, characterized in that, In step S7, the contextual rationality verification includes retrieving typical behavior distributions from the historical database based on the time-space labels of the abnormal segment, performing probability density estimation, and determining whether to correct or attenuate the identification results of the abnormal candidate segment through the joint threshold of membership degree and deviation degree.

Images