Method and system for detecting abnormal answering behavior of examinee in paperless examination

Abstract

The embodiment of the invention provides a method and a system for detecting an abnormal answer behavior of an examinee in a paperless examination, and belongs to the field of examination safety. The method comprises the following steps: collecting answer time point data of an examinee in a paperless examination process and preprocessing the answer time point data to obtain an answer time point sequence; extracting question-level time point deviation, sequence trend, accumulated trend deviation and key node deviation characteristics based on the answering time point sequence; according to an examination scene, respectively configuring a weight for each feature, and calculating a comprehensive abnormal score of each examinee through weighted fusion; and carrying out abnormal sorting and grading on each examinee, outputting a structured result containing the details of the abnormal examinees and the standardized benchmark, and displaying a benchmark answering mode and the answering track of the abnormal examinees. Abnormal answering rhythm is captured through a time sequence exclusive index, and the suitability of different examination scenes is improved in combination with scenarized weight configuration.

Description

Technical Field

[0001] This invention relates to the field of exam security technology, specifically to a method and system for detecting abnormal answering behavior of examinees in paperless exams. Background Technology

[0002] With the increasing popularity of computerized testing, the traceability of candidates' answers provides a new path for exam security and prevention.

[0003] Current mainstream exam anomaly detection technologies mostly focus on "similarity of answer content" or "single-dimensional time statistics," which have the following core limitations: First, relying solely on "answer option repetition rate" to identify anomalies fails to recognize behaviors that are "not identical but with abnormal answering rhythm" (such as suddenly speeding up / slowing down answering speed, or submission time for specific questions far exceeding the normal range). Second, the use of answering time data remains at the basic statistical level, such as "average time spent on a single question," without fully exploring the "trend characteristics of the time sequence" (such as the continuity of answering rhythm and the distribution pattern of submission time). Third, the use of "equal weighting" or "fixed weighting" when fusing multiple features ignores the differences in the importance of time features under different exam scenarios (such as different question types and different exam durations), resulting in anomaly identification accuracy being limited by the scenario. Summary of the Invention

[0004] The purpose of this invention is to provide a method and system for detecting abnormal answering behavior of candidates in paperless examinations. It captures abnormal answering rhythm through time-series specific indicators and improves the adaptability to different examination scenarios by combining scenario-based weight configuration, thereby solving the problems of insufficient identification of time-series anomalies and poor scenario adaptability of existing technologies.

[0005] To achieve the above objectives, embodiments of the present invention provide a method for detecting abnormal answering behavior of examinees in paperless examinations, comprising: Collect data on the time points of candidates' answers during the paperless examination, and preprocess the data to obtain a sequence of answer time points; Based on the answer time sequence, extract question-level time point deviation features, sequence trend features, cumulative trend deviation features, and key node deviation features to construct a feature vector of the candidate's answer rhythm. Based on the examination scenario, weights are assigned to the deviation characteristics at question-level time points, sequence trends, cumulative trends, and key node deviations, and the comprehensive abnormal score of each candidate is calculated by weighted fusion. Based on each candidate's overall abnormal score, the abnormal candidates are ranked and classified. The output is a structured result containing details of abnormal candidates and standardized benchmarks, and the benchmark answering patterns and the answering trajectories of abnormal candidates are displayed.

[0006] Optionally, data on the time points of candidates' answers during the paperless examination are collected, and the data on the time points of candidates' answers is preprocessed to obtain a sequence of answer time points, including: Extract key fields containing identity identifier, timestamp, and question identifier from the exam system logs; Based on the homogeneity of the examination scenarios, candidates are grouped according to the hierarchy of calculation scope-examination subject-question type, and the interquartile range method is used to remove extreme candidate data within each group; All timestamps are converted into cumulative seconds relative to the start time to eliminate the impact of time deviations due to differences in sessions, subjects, and abnormal exam conditions. Filter and remove invalid data from the candidate's answer time data. The invalid data includes records with timestamps earlier than the start of the exam or later than the end of the exam, records with mismatched identifiers, and records of duplicate submissions. Based on the target candidate data after filtering and removing invalid data, the baseline time point and standard time difference for each question are calculated in groups, and the time points are scaled to a uniform dimension based on the baseline time point and standard time difference to obtain the answer time point sequence.

[0007] Optionally, based on the answer time sequence, extract question-level time point deviation features, sequence trend features, cumulative trend deviation features, and key node deviation features to construct a feature vector of the examinee's answer rhythm, including: Extracting question-level time point deviation features includes: determining the proportion of abnormal time points by calculating the proportion of questions where the normalized time point of the examinee exceeds the preset threshold to the total number of questions, and / or, determining the number of questions where the answer time point exceeds the extreme threshold by counting the number of questions with extreme deviations. Extracting sequence trend features includes: fitting the slope of the candidate's time point sequence through linear regression and calculating its absolute deviation from the standard slope within the group; and / or, calculating the standard deviation of the normalized time points within the window through a sliding window and counting the number of outlier windows; Extracting cumulative trend deviation features includes: using a dynamic time warping algorithm to calculate the shape difference between the candidate's time point sequence and the standard sequence; Extracting key node deviation features includes: calculating the relative deviation between the candidate's submission time for the last question and the standard time point, in order to determine the difference between the candidate's overall answering speed and the standard speed; The question-level time point deviation features include the proportion of abnormal time points and the number of questions with extreme deviations. The sequence trend features include the time point sequence slope deviation and the sliding window standard deviation. The cumulative trend deviation features are based on normalized DTW and focus on the differences in the shape of the time series. The key node deviation features measure the overall answering speed by the proportion of the time point deviation when the candidate answers the last question.

[0008] Optionally, the percentage of abnormal time points can be calculated using the following formula: ; In the formula, This represents the total number of questions. For the normalized time point of question k, To preset an abnormal threshold, This is an indicator function.

[0009] Optionally, the number of extreme deviation items can be calculated using the following formula: ; In the formula, To preset extreme thresholds, For the normalized time point of question k, For indicator functions, This represents the total number of questions.

[0010] Optionally, the slope deviation of the time-point series can be calculated using the following formula: candidate sequence slope Fitting formula: ; The median of the slopes of all candidates in the same group is used as the standard slope. : ; Calculation of slope deviation of time series: ; In the formula, This represents the average of the question numbers in this calculation group. Let n be the mean at normalized time points, and n be the total number of examinees. For the normalized time point of question k, This represents the total number of questions.

[0011] Optionally, the standard deviation of the normalized time points within the window can be calculated using a sliding window: ; Count the number of abnormal windows: ; In the formula, For window size, For the first The mean of normalized time points within each window The standard deviation threshold of the window. For indicator functions, This represents the normalized time point for the k-th question.

[0012] Optionally, the relative deviation between the candidate's submission time for the last question and the standard time point can be calculated using the following formula: ; In the formula, The standard time point for the last question. The relative submission time for the last question. To prevent the denominator from being 0, a minimum value is set.

[0013] Optionally, weights are assigned to question-level time point deviation features, sequence trend features, cumulative trend deviation features, and key node deviation features according to the examination scenario, and a weighted fusion is used to calculate the comprehensive abnormal score for each candidate, including the following formula: ; In the formula, For the first One standardized feature value, The weights are for the corresponding features.

[0014] Secondly, the present invention also provides a system for detecting abnormal answering behavior of examinees in paperless examinations, comprising: The data acquisition unit is used to collect the answer time point data of candidates during the paperless examination, and to preprocess the answer time point data to obtain the answer time point sequence; The feature extraction unit is used to extract question-level time point deviation features, sequence trend features, cumulative trend deviation features, and key node deviation features based on the answer time point sequence, so as to construct a feature vector of the candidate's answer rhythm. The fusion calculation unit is used to assign weights to question-level time point deviation features, sequence trend features, cumulative trend deviation features, and key node deviation features according to the examination scenario, and to calculate the comprehensive abnormal score of each candidate through weighted fusion calculation. The anomaly output unit is used to sort and classify each candidate based on their comprehensive anomaly score, outputting a structured result that includes details of the candidates with anomalies and standardized benchmarks, and displaying the benchmark answering patterns and the answering trajectories of the candidates with anomalies.

[0015] The above technical solution uses the time sequence of candidates' answers as the core data to build a full-process detection system from benchmark standardization to feature extraction, dynamic weighting, and anomaly ranking. It captures anomalies in answer rhythm through time-series-specific indicators and improves the adaptability to different examination scenarios by combining scenario-based weight configuration, thus solving the problems of insufficient identification of time-series anomalies and poor scenario adaptability of existing technologies.

[0016] Other features and advantages of the embodiments of the present invention will be described in detail in the following detailed description section. Attached Figure Description

[0017] The accompanying drawings are provided to further illustrate embodiments of the present invention and form part of the specification. They are used together with the following detailed description to explain the embodiments of the present invention, but do not constitute a limitation thereof. In the drawings: Figure 1 This is a flowchart of a method for detecting abnormal answering behavior of examinees in a paperless examination, provided by an embodiment of the present invention; Figure 2 This is a schematic diagram illustrating the benchmark answering time for a certain group of candidates in a certain examination, provided by an embodiment of the present invention; Figure 3 This is an example of an abnormal examinee A's examination process trajectory diagram provided by an embodiment of the present invention; Figure 4 This is an example of an abnormal candidate B's exam process trajectory diagram provided by an embodiment of the present invention; Figure 5 This is a schematic diagram of the structure of a detection system for abnormal answering behavior of candidates in a paperless examination, provided in an embodiment of the present invention; Figure 6 This is a schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0018] Various embodiments of this disclosure will be described more fully in the following detailed description. This disclosure may have various embodiments, and adjustments and changes may be made therein. However, it should be understood that there is no intention to limit the various embodiments of this disclosure to the specific embodiments disclosed herein, but rather this disclosure should be understood to cover all adjustments, equivalents, and / or alternatives falling within the spirit and scope of the various embodiments of this disclosure.

[0019] In the following, the terms “comprising” or “may include”, which may be used in various embodiments of this disclosure, indicate the presence of the disclosed functions or operations and do not limit the addition of one or more functions or operations. Furthermore, as used in various embodiments of this disclosure, the terms “comprising,” “having,” and their cognates are intended only to indicate a specific feature, number, step, operation, or combination of the foregoing and should not be construed as primarily excluding the presence of one or more other features, numbers, steps, operations, or combinations of the foregoing, or the possibility of adding one or more features, numbers, steps, operations, or combinations of the foregoing.

[0020] In various embodiments of this disclosure, the expression "or" or "at least one of A and / or B" includes any combination or all combinations of the words listed simultaneously. For example, the expression "A or B" or "at least one of A and / or B" may include A, may include B, or may include both A and B.

[0021] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0022] See Figure 1 The diagram shows a flowchart of a method for detecting abnormal answering behavior of examinees in a paperless examination, according to a specific embodiment, including the following execution steps: Step 100: Collect the answer time data of candidates during the paperless examination, and preprocess the answer time data to obtain the answer time sequence.

[0023] Specifically, when executing step 100, the following steps can be performed: S1000: Extract key fields containing identity identifier, timestamp, and question identifier from the examination system log.

[0024] In one specific implementation, basic data is collected during the examination process, with the core data source being structured log files generated by the computerized examination system. Key fields to be extracted include an "identity identifier field," a "time point field," and a "question identifier field." The identity identifier field contains the candidate's admission ticket number and exam paper code, used to locate the target candidate and the target exam paper. The time point field includes the system timestamp after the candidate finally confirms their answers, used to calculate relevant time parameters for answering. The question identifier field contains question numbers (original question number and randomized question number), used to establish the "candidate-question" association.

[0025] S1001: Based on the homogeneity of the examination scenario, candidates are grouped according to the hierarchy of calculation scope-examination subject-question type, and the interquartile range method is used to remove extreme candidate data within the group.

[0026] In one specific implementation, nationwide large-scale examinations are often characterized by long duration, numerous subjects, and wide scope. Based on the homogeneity of the examination scenarios, candidates are grouped according to a hierarchy of "calculation scope – examination subject – question type" to ensure that the answering environment and question characteristics of candidates within the same group are consistent. The grouping expression is as follows: ; in, Group the candidates to be calculated. For the calculation range, For exam subjects, For question type, for The specific candidates in the group can be expanded or narrowed to the same province, city, test center, or test room, depending on actual needs. Subsequent calculations and feature extractions will be based on the group.

[0027] In one specific implementation, extreme values ​​are both a characteristic and a bias in terms of test takers' responses. For characteristics, extreme values ​​require extra attention; for benchmark calculations, they need to be excluded. To avoid the impact of extreme values ​​on the accuracy of the benchmark, the interquartile range (IQR) method is used to eliminate test takers within each group. First, the quartiles of the submission times for all test takers on a given question within each group are calculated. (Lower quartile) (Upper quartile), then calculate the interquartile range: ; The above formula, after sorting the candidates' answering times in ascending order, shows that 25% of the candidates' answering times... 75% of the test takers' answer time , To reflect the dispersion of the data subject (the middle 50% of test takers), a threshold range for extreme values ​​was finally set: ; The extreme value threshold range covers approximately 99.3% of the normal data within the group (based on the statistical regularity of continuous data). Data outside this range are considered outliers, far removed from the main data set. Candidates outside this range are treated as extreme data and differentiated accordingly.

[0028] S1002: Convert all timestamps to cumulative seconds relative to the start time of the exam to eliminate the impact of time deviations due to differences in sessions, subjects, and abnormal exam conditions.

[0029] Specifically, to eliminate the impact of differences in session number, subject, and time deviations in abnormal examination situations, all timestamps will be uniformly converted to "cumulative seconds after the start of the examination," using the following conversion formula: ; in, This is the converted relative time (seconds after the start of the exam). The timestamp to be converted This indicates the start time of the corresponding exam session.

[0030] S1003: Filter and remove invalid data from the candidate's answer time data, wherein the invalid data includes records with timestamps earlier than the start of the exam or later than the end of the exam, records with mismatched identifiers, and records of duplicate submissions.

[0031] Specifically, the collected data and time-point information are filtered to remove invalid and abnormal data, ensuring the validity of the collected data. Anomaly removal includes: time validity filtering, identifier validity filtering, and duplicate data filtering.

[0032] Among them, the time validity screening for exclusion includes: ; The timestamp is earlier than the exam start time. ; The timestamp is later than the total exam duration. The total exam duration is preset, such as 120 minutes = 7200 seconds; The validity screening removes records where the test paper type does not match the target test paper code, or where the question code length does not meet the preset rules, ensuring that the features extracted at the same time are from the same test paper and the same type of question; the duplicate data screening targets duplicate records of the same candidate and the same question, retaining the data from the last submission time, and deduplicating through candidate and question code uniqueness verification.

[0033] S1004: Based on the target candidate data after filtering and removing invalid data, calculate the baseline time point and standard time difference for each question in groups, and scale the time points to a uniform dimension based on the baseline time point and standard time difference to obtain the answer time point sequence.

[0034] Specifically, to eliminate the impact of differences in time units between different questions, the submission times of test takers are normalized using the following formula: ; in, For the normalized time points, This is the converted relative time (seconds after the start of the exam). As a standard time point, The standard deviation is the standard time point. This is added as a local minimum to the denominator to prevent it from being zero. The normalized data exhibits a normal distribution trend, which facilitates subsequent feature calculations and comparisons.

[0035] In some implementations, to reflect the baseline or mean characteristics of candidates' responses after stratification and grouping, this application employs a method for calculating the baseline response time for each candidate group. For the filtered valid candidate data, the "baseline time point" and "standard time difference" for each question are calculated for each group, serving as the benchmark for subsequent anomaly detection. The median is used as the baseline time point for stronger resistance to extreme values. ; The formula for calculating the standard deviation at a given time point is as follows: ; In the formula, n is the number of valid candidates in the group. Let be the relative submission time of the i-th candidate.

[0036] Step 101: Based on the answer time sequence, extract question-level time deviation features, sequence trend features, cumulative trend deviation features, and key node deviation features to construct a feature vector of the candidate's answer rhythm.

[0037] The question-level time point deviation features include the proportion of abnormal time points and the number of questions with extreme deviations. The sequence trend features include the time point sequence slope deviation and the sliding window standard deviation. The cumulative trend deviation features are based on normalized DTW and focus on the differences in the shape of the time series. The key node deviation features measure the overall answering speed by the proportion of the time point deviation when the candidate answers the last question.

[0038] Specifically, when executing step 101, the following steps can be performed: S1010: Extracting question-level time point deviation features includes: determining the proportion of abnormal time points by calculating the percentage of questions where the normalized time point of the examinee exceeds the preset threshold to the total number of questions, and / or, counting the number of questions where the answer time point exceeds the extreme threshold to determine the number of extreme deviation questions.

[0039] Specifically, the percentage of abnormal time points is calculated using the following formula: ; In the formula, This represents the total number of questions. For the normalized time point of question k, The preset abnormal threshold (default 1.5) is used. This is an indicator function (returns 1 if the condition is met, otherwise returns 0). The percentage of questions submitted at abnormal times reflects the overall deviation between the candidate's submission time for each question and the standard benchmark.

[0040] Calculate the number of extreme deviation items using the following formula: ; In the formula, The preset extreme threshold (default 1.5 minutes) is used. For the normalized time point of question k, For indicator functions, This represents the total number of questions. Extreme deviation question characteristics are used to locate specific questions that deviate significantly from the normal pace, aiding in anomaly tracing.

[0041] S1011: Extracting sequence trend features includes: fitting the slope of the candidate's time point sequence through linear regression and calculating its absolute deviation from the standard slope within the group; and / or, calculating the standard deviation of the normalized time points within the window through a sliding window and counting the number of outlier windows.

[0042] Specifically, the slope deviation of the time-point series is calculated using the following formula: candidate sequence slope Fitting formula: ; The median of the slopes of all candidates in the same group is used as the standard slope. : ; Calculation of slope deviation of time series: ; In the formula, This represents the average of the question numbers in this calculation group. Let n be the mean at normalized time points, and n be the total number of examinees. For the normalized time point of question k, This represents the total number of questions.

[0043] The slope deviation characteristics of time point series can capture abnormalities in the overall rhythm trend of the test taker's answer (such as a sudden acceleration or deceleration of the rhythm trend).

[0044] For multiple consecutive questions, a fixed-size sliding window (e.g., 5 questions) can be set. The standard deviation of normalized time points within the window is calculated, and the number of outlier windows is counted to capture sudden changes in the test-taker's local answering rhythm. This serves as a characteristic to identify sudden changes in answering rhythm caused by unexpected events (e.g., receiving external answers) during the answering process. The calculation first calculates the standard deviation within the window: ; Count the number of abnormal windows: ; In the formula, For window size, For the first The mean of normalized time points within each window The standard deviation threshold of the window. For indicator functions, This represents the normalized time point for the k-th question.

[0045] The sliding window standard deviation feature captures sudden changes in the local rhythm of test takers' answers.

[0046] S1012: Extracting cumulative trend deviation features includes: using a dynamic time warping algorithm to calculate the shape difference between the candidate's time point sequence and the standard sequence.

[0047] Specifically, Dynamic Time Warping (DWT) is used to calculate the shape difference between the candidate's time point sequence and the standard sequence to eliminate the influence of overall speed. The core of the cumulative trend deviation feature is to capture the trend shape difference between the candidate's answer time point sequence and the standard sequence, rather than the absolute time value difference.

[0048] First, the time series is normalized. Based on the relative submission time of the candidate's last question, the relative submission times of all questions are scaled to the [0,1] interval, retaining only the trend shape information. ; in, For the normalized time point of question k, The relative submission time for problem k is... The relative submission time of the last question was used as the benchmark for normalization to ensure that the endpoints of all candidate sequences were aligned. The normalized candidate sequence is as follows: ; in, For the number of questions, the standard normalized sequence is: ; Calculate path weights: ; in, For the candidate sequence number One element, For the standard sequence number The element quantifies the candidate sequence. The element and the standard sequence Local differences of each element.

[0049] Construct the cumulative distance matrix: ; The boundary conditions are as follows: ; in The distance difference of an empty sequence is considered to be 0. The difference between a non-empty sequence and an empty sequence is considered to be infinite. The final DWT distance is calculated as follows: ; The smaller the DTW value, the more similar the trend shape of the candidate's sequence to the standard sequence; the larger the value, the more significant the trend difference. This feature compensates for the limitations of single-question bias features and can capture answering behaviors where "the time for a single question is normal, but the overall rhythm is abnormal."

[0050] S1013: Extracting key node deviation features includes: calculating the relative deviation between the candidate's submission time for the last question and the standard time point, in order to determine the difference between the candidate's overall answering speed and the standard speed.

[0051] Specifically, the relative deviation between the candidate's submission time for the last question and the standard time point is calculated using the following formula: ; In the formula, The standard time point for the last question. The relative submission time for the last question. To prevent the denominator from being 0, a minimum value is set.

[0052] The key node deviation characteristics can reflect the difference between the candidate's overall answering speed and the standard speed.

[0053] Step 102: Assign weights to question-level time point deviation features, sequence trend features, cumulative trend deviation features, and key node deviation features according to the examination scenario, and calculate the comprehensive abnormal score of each candidate through weighted fusion.

[0054] Specifically, before performing step 102, the calculated feature results are standardized to eliminate dimensional differences. Min-Max standardization is used to scale all feature values ​​to the [0,1] interval. The scaling formula is as follows: ; in, These are the standardized eigenvalues. These are the original eigenvalues. This is the minimum value of the feature. This is the maximum value of the feature. In special cases, if the maximum and minimum values ​​of a feature are equal (without fluctuation), then the feature value is uniformly set to 0.5.

[0055] In some implementations, weight templates are set according to the exam scenario (number of questions, distribution of question types), and custom adjustments are also supported. The weight configuration must meet the normalization condition (the sum of all weights is 1). The weight configuration is selected based on the actual exam situation. For example: when the number of objective questions is generally small (≤50 questions): abnormal time percentage (0.3), slope deviation (0.2), sliding window standard deviation (0.25), normalized DTW (0.15), and last question deviation percentage (0.1); when the number of objective questions is large (>60 questions): abnormal time point percentage (0.25), slope deviation (0.25), sliding window standard deviation (0.3), normalized DTW (0.1), and last question deviation percentage (0.1).

[0056] Specifically, when performing step 102, the following formula is used for calculation: ; In the formula, For the first One standardized feature value, The weights are for the corresponding features.

[0057] Step 103: Based on each candidate's comprehensive abnormal score, sort and classify each candidate's abnormalities, output a structured result containing details of abnormal candidates and standardized benchmarks, and display the benchmark answering pattern and the answering trajectory of abnormal candidates.

[0058] In one specific implementation, candidates are sorted in descending order based on their comprehensive abnormal scores to generate a ranking of abnormal candidates. A three-level abnormality check is then set up based on the scores and actual exam performance, for example: high-risk abnormality. ≥0.95, requires urgent verification; medium-risk abnormality 0.8≤ <0.95 indicates a need for close monitoring; low-risk anomalies are indicated by 0.5 ≤ <0.8, targeted review, the abnormal level makes it easier for exam organizers to prioritize the verification of candidates with high abnormality.

[0059] In one specific implementation, details of outlier test takers are summarized, and other information, including test taker ID, overall outlier score, original and standardized values ​​of each feature, and outlier level, is formatted as a CSV file for easy subsequent analysis and archiving. A standardized benchmark report is output for each group, along with the baseline time points for answering questions within each calculation group. Additionally, baseline data such as baseline time difference and baseline slope, as well as statistical distribution of outlier test takers across groups, can be output to provide data support for exam quality assessment.

[0060] For example, see Figure 2As shown, with time on the horizontal axis and question number on the vertical axis, the baseline answering time within the group is displayed. A scatter plot is used to visually present the baseline answering submission time within the calculation group based on the candidates' answering behavior. The chart can clearly show the candidates' behavioral trajectory during the exam.

[0061] See Figure 3 , Figure 4 As shown, for candidates with a high degree of abnormality, a complete examination process trajectory is plotted separately with the question number as the vertical axis and time as the horizontal axis. This includes the login, viewing, submission, answering, and modification information of the exam papers, making it easier to check and locate abnormalities.

[0062] In this embodiment, by systematically analyzing the time sequence of candidates' answers and using dynamic weighted fusion of multi-dimensional features, high-precision, scenario-adaptive automated detection of various complex and hidden abnormal answering behaviors in computerized examinations is achieved, providing a clear and interpretable basis for the final decision.

[0063] In one embodiment, the detailed implementation process of the method for detecting abnormal answering behavior of candidates in a paperless examination provided by this application is as follows. This embodiment is further optimized and expanded based on the above embodiments.

[0064] This application achieves precise anomaly detection and scenario adaptation through three major innovations: hierarchical standardized benchmark construction, extraction of multiple time features, and weighted fusion mechanism. The core objective is to construct a precise and configurable anomaly detection mechanism by deeply mining the characteristic patterns of candidates' answer time sequence. Specifically, it implements the following functions: 1. Data collection and standardized processing of answer time points; 2. Feature extraction of answer time sequence; 3. Dynamic weighted fusion and anomaly sorting; 4. Output of anomaly results, benchmark results, and visualization assistance.

[0065] The data collection and standardization process for answer times involves collecting "core time information" for each question in the computerized exam. All timestamps are recorded as "cumulative seconds since the start of the exam" to avoid the influence of time zone differences or system time deviations. Invalid data (such as records where the question was received before the start of the exam or the final submission time was later than the end of the exam) is filtered out to ensure data validity. Breaking through the limitations of the traditional "global mean benchmark," a "hierarchical standardized benchmark" is constructed.

[0066] For the normalized time-point sequence, the feature extraction of answer time point sequence is designed with four types of exclusive features: question-level time point deviation features (proportion of abnormal time points, number of questions with extreme deviations), sequence trend features (slope deviation of time point sequence, standard deviation of sliding window), cumulative trend deviation (normalized DTW, focusing on differences in the shape of time series), and key node deviation (proportion of deviation of the last question time point, measuring the overall answering speed), to comprehensively capture abnormal answering rhythm.

[0067] Dynamic weighted fusion and anomaly ranking are employed, standardizing various features to scale multiple indicators to the same dimension. A weighted summation is then performed: a comprehensive deviation score is calculated based on the weights. The comprehensive anomaly score is calculated and sorted in descending order of score, with higher scores indicating greater differences from standard candidates.

[0068] The results output and visualization-assisted generation consist of two core files: 1. Abnormal candidate details table and 2. Standardized benchmark report, which support subsequent analysis and archiving.

[0069] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0070] like Figure 5 As shown, the following is an embodiment of the detection system for abnormal answering behavior of candidates in paperless examinations provided by this disclosure. It belongs to the same inventive concept as the detection methods for abnormal answering behavior of candidates in paperless examinations in the above embodiments. For details not described in detail in the embodiments of the detection system for abnormal answering behavior of candidates in paperless examinations, please refer to the embodiments of the detection methods for abnormal answering behavior of candidates in paperless examinations described above.

[0071] A system for detecting abnormal test-taker behavior in paperless examinations includes: The data acquisition unit is used to collect the answer time point data of candidates during the paperless examination, and to preprocess the answer time point data to obtain the answer time point sequence; The feature extraction unit is used to extract question-level time point deviation features, sequence trend features, cumulative trend deviation features, and key node deviation features based on the answer time point sequence, so as to construct a feature vector of the candidate's answer rhythm. The fusion calculation unit is used to assign weights to question-level time point deviation features, sequence trend features, cumulative trend deviation features, and key node deviation features according to the examination scenario, and to calculate the comprehensive abnormal score of each candidate through weighted fusion calculation. The anomaly output unit is used to sort and classify each candidate based on their comprehensive anomaly score, outputting a structured result that includes details of the candidates with anomalies and standardized benchmarks, and displaying the benchmark answering patterns and the answering trajectories of the candidates with anomalies.

[0072] Figure 6 This is a schematic diagram of the hardware structure of an electronic device that implements various embodiments of the present invention.

[0073] The method for detecting abnormal answering behavior of examinees in paperless examinations provided in this application embodiment can be applied to electronic devices. Those skilled in the art will understand that the electronic device structure involved in the embodiments of this invention does not constitute a limitation on the electronic device. An electronic device may include more or fewer components than illustrated, or combine certain components, or have different component arrangements. In the embodiments of this invention, the electronic device includes, but is not limited to, laptop computers, desktop computers, workbenches, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the embodiments of this application described and / or claimed herein.

[0074] Electronic devices may include processors, external memory interfaces, internal memory, universal serial bus (USB) interfaces, charging management modules, power management modules, batteries, wireless communication modules, audio modules, speakers, microphones, sensor modules, buttons, cameras, displays, and SIM card interfaces, etc.

[0075] It is understood that the structures illustrated in the embodiments of this application do not constitute a specific limitation on the electronic device. In other embodiments of this application, the electronic device may include more or fewer components than illustrated, or combine some components, or split some components, or have different component arrangements. The illustrated components may be implemented in hardware, software, or a combination of software and hardware.

[0076] A processor may include one or more processing units, such as: a central processing unit (CPU), an application processor (AP), a modem processor, a graphics processing unit (GPU), an image signal processor (ISP), a controller, memory, a video codec, a digital signal processor (DSP), a baseband processor, and / or a neural network processing unit (NPU). Different processing units may be independent devices or integrated into one or more processors.

[0077] The processor can serve as the nerve center and command center of an electronic device. The controller can generate operation control signals based on the instruction opcode and timing signals to control the fetching and execution of instructions.

[0078] The processor may also include memory for storing instructions and data. In some embodiments, the memory in the processor is a cache memory. This memory can store instructions or data that the processor has just used or that are used repeatedly. If the processor needs to use the instruction or data again, it can retrieve it directly from this memory. This avoids repeated accesses, reduces processor latency, and thus improves system efficiency.

[0079] An external storage interface (ESI) can be used to connect external memory cards, such as microSD cards, to expand the storage capacity of electronic devices. The external memory card communicates with the processor through the ESI to perform data storage functions, such as saving music and video files on the external memory card.

[0080] Internal memory can be used to store computer executable program code, which includes instructions. The processor executes various functional applications and data processing of electronic devices by running the instructions stored in internal memory. Internal memory can include a program storage area and a data storage area. Internal memory can include high-speed random access memory, and can also include non-volatile memory, such as at least one disk storage device, flash memory device, universal flash storage (UFS), etc.

[0081] Wireless communication functionality in electronic devices can be achieved through antennas, wireless communication modules, modem processors, and baseband processors.

[0082] Wireless communication modules can provide solutions for wireless communication applications in electronic devices, including wireless local area networks (WLANs) (such as wireless fidelity (Wi-Fi) networks), Bluetooth (BT), global navigation satellite system (GNSS), frequency modulation (FM), near field communication (NFC), and infrared (IR) technologies.

[0083] Electronic devices can implement audio functions through audio modules, speakers, receivers, microphones, headphone jacks, and application processors.

[0084] Electronic devices can achieve shooting functions through ISPs, cameras, video codecs, GPUs, displays, and application processors.

[0085] Electronic devices can achieve display functions through GPUs, displays, and application processors.

[0086] A GPU is a microprocessor for image processing, connected to the display screen and application processor. GPUs are used to perform mathematical and geometric calculations for graphics rendering. A processor may include one or more GPUs, which execute program instructions to generate or modify display information.

[0087] A display screen is used to display images, videos, etc. A display screen includes a display panel.

[0088] The storage medium provided in this application stores a program product capable of detecting abnormal answering behavior of candidates in paperless examinations.

[0089] The method for detecting abnormal answering behavior of candidates in paperless examinations includes: collecting answering time point data of candidates during the paperless examination, and preprocessing the answering time point data to obtain an answering time point sequence; based on the answering time point sequence, extracting question-level time point deviation features, sequence trend features, cumulative trend deviation features, and key node deviation features to construct a feature vector of the candidate's answering rhythm; assigning weights to question-level time point deviation features, sequence trend features, cumulative trend deviation features, and key node deviation features according to the examination scenario, and calculating the comprehensive abnormal score of each candidate through weighted fusion; ranking and classifying each candidate based on their comprehensive abnormal score, outputting a structured result containing details of abnormal candidates and standardized benchmarks, and displaying the benchmark answering pattern and the answering trajectory of abnormal candidates.

[0090] In some possible implementations, the subject matter of this disclosure, namely, "Method and System for Detecting Abnormal Answering Behavior of Examinees in Paperless Examinations," can be implemented as a program product comprising program code. When the program product is run on a terminal device, the program code is used to cause the terminal device to perform the steps described in the "Exemplary Methods" section of this specification according to various exemplary embodiments of this disclosure.

[0091] The storage medium disclosed herein may be any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples (a non-exhaustive list) of readable storage media include: an electrical connection having one or more wires, a portable disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof.

[0092] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for detecting abnormal answering behavior of examinees in paperless examinations, characterized in that, include: Collect data on the time points of candidates' answers during the paperless examination, and preprocess the data to obtain a sequence of answer time points; Based on the answer time sequence, extract question-level time point deviation features, sequence trend features, cumulative trend deviation features, and key node deviation features to construct a feature vector of the candidate's answer rhythm. Based on the examination scenario, weights are assigned to the deviation characteristics at question-level time points, sequence trends, cumulative trends, and key node deviations, and the comprehensive abnormal score of each candidate is calculated by weighted fusion. Based on each candidate's overall abnormal score, the abnormal candidates are ranked and classified. The output is a structured result containing details of abnormal candidates and standardized benchmarks, and the benchmark answering patterns and the answering trajectories of abnormal candidates are displayed.

2. The method for detecting abnormal answering behavior of examinees in paperless examinations according to claim 1, characterized in that, Data on the time points of candidates' answers during the paperless examination is collected, and the data is preprocessed to obtain a sequence of answer time points, including: Extract key fields containing identity identifier, timestamp, and question identifier from the exam system logs; Based on the homogeneity of the examination scenarios, candidates are grouped according to the hierarchy of calculation scope-examination subject-question type, and the interquartile range method is used to remove extreme candidate data within the group; All timestamps are converted into cumulative seconds relative to the start time to eliminate the impact of time deviations due to differences in sessions, subjects, and abnormal exam conditions. Filter and remove invalid data from the candidate's answer time data. The invalid data includes records with timestamps earlier than the start of the exam or later than the end of the exam, records with mismatched identifiers, and records of duplicate submissions. Based on the target candidate data after filtering and removing invalid data, the baseline time point and standard time difference for each question are calculated in groups, and the time points are scaled to a uniform dimension based on the baseline time point and standard time difference to obtain the answer time point sequence.

3. The method for detecting abnormal answering behavior of examinees in paperless examinations according to claim 1, characterized in that, Based on the answer time sequence, question-level time point deviation features, sequence trend features, cumulative trend deviation features, and key node deviation features are extracted to construct a feature vector of the candidate's answer rhythm, including: Extracting question-level time point deviation features includes: determining the proportion of abnormal time points by calculating the proportion of questions where the normalized time point of the examinee exceeds the preset threshold to the total number of questions, and / or, determining the number of questions where the answer time point exceeds the extreme threshold by counting the number of questions with extreme deviations. Extracting sequence trend features includes: fitting the slope of the candidate's time point sequence through linear regression and calculating its absolute deviation from the standard slope within the group; and / or, calculating the standard deviation of the normalized time points within the window through a sliding window and counting the number of outlier windows; Extracting cumulative trend deviation features includes: using a dynamic time warping algorithm to calculate the shape difference between the candidate's time point sequence and the standard sequence; Extracting key node deviation features includes: calculating the relative deviation between the candidate's submission time for the last question and the standard time point, in order to determine the difference between the candidate's overall answering speed and the standard speed; The question-level time point deviation features include the proportion of abnormal time points and the number of questions with extreme deviations. The sequence trend features include the time point sequence slope deviation and the sliding window standard deviation. The cumulative trend deviation features are based on normalized DTW and focus on the differences in the shape of the time series. The key node deviation features measure the overall answering speed by the proportion of the time point deviation when the candidate answers the last question.

4. The method for detecting abnormal answering behavior of examinees in paperless examinations according to claim 3, characterized in that, The percentage of abnormal time points is calculated using the following formula: ； In the formula, This represents the total number of questions. For the normalized time point of question k, To preset the abnormal threshold, This is an indicator function.

5. The method for detecting abnormal answering behavior of examinees in paperless examinations according to claim 3, characterized in that, The number of extreme deviation items can be calculated using the following formula: ； In the formula, To preset extreme thresholds, For the normalized time point of question k, For indicator functions, This represents the total number of questions.

6. The method for detecting abnormal answering behavior of examinees in paperless examinations according to claim 3, characterized in that, Calculate the slope deviation of the time point series using the following formula: candidate sequence slope Fitting formula: ； The median of the slopes of all candidates in the same group is used as the standard slope. : ； Calculation of slope deviation of time series: ； In the formula, This represents the average of the question numbers in this calculation group. Let n be the mean at normalized time points, and n be the total number of examinees. For the normalized time point of question k, This represents the total number of questions.

7. The method for detecting abnormal answering behavior of examinees in paperless examinations according to claim 3, characterized in that, Calculate the standard deviation of normalized time points within the sliding window: ； Count the number of abnormal windows: ； In the formula, For window size, For the first The mean of normalized time points within each window The standard deviation threshold of the window. For indicator functions, This represents the normalized time point for the k-th question.

8. The method for detecting abnormal answering behavior of examinees in paperless examinations according to claim 3, characterized in that, The relative deviation between the candidate's submission time for the last question and the standard time point is calculated using the following formula: ； In the formula, The standard time point for the last question. The relative submission time for the last question. To prevent the denominator from being 0, a minimum value is set.

9. The method for detecting abnormal answering behavior of examinees in paperless examinations according to claim 1, characterized in that, Based on the examination scenario, weights are assigned to the deviation characteristics at question-level time points, sequence trends, cumulative trends, and key node deviations. A weighted fusion is then used to calculate each candidate's comprehensive anomaly score, calculated using the following formula: ； In the formula, For the first One standardized feature value, The weights are for the corresponding features.

10. A system for detecting abnormal answering behavior of examinees in paperless examinations, characterized in that, include: The data acquisition unit is used to collect the answer time point data of candidates during the paperless examination, and to preprocess the answer time point data to obtain the answer time point sequence; The feature extraction unit is used to extract question-level time point deviation features, sequence trend features, cumulative trend deviation features, and key node deviation features based on the answer time point sequence, so as to construct a feature vector of the candidate's answer rhythm. The fusion calculation unit is used to assign weights to question-level time point deviation features, sequence trend features, cumulative trend deviation features, and key node deviation features according to the examination scenario, and to calculate the comprehensive abnormal score of each candidate through weighted fusion calculation. The anomaly output unit is used to sort and classify each candidate based on their comprehensive anomaly score, outputting a structured result that includes details of the candidates with anomalies and standardized benchmarks, and displaying the benchmark answering patterns and the answering trajectories of the candidates with anomalies.

Images