Delivery man behavior analysis method and device and storage medium

Abstract

The invention discloses a courier behavior analysis method and device and a storage medium, and relates to the technical field of logistics, and the method comprises the steps: obtaining task records generated when a target courier executes each door-to-door verification task; feature extraction is carried out on each task record to obtain task features, and the task features represent execution attributes and result attributes of the door-to-door verification tasks; constructing a target behavior index of the target courier based on the task features; and based on the target behavior index and a preset baseline index, determining a behavior abnormality level of the target courier. According to the method and the device, the abnormal behavior of the courier executing the door-to-door verification task can be identified, so that the authenticity and compliance of the door-to-door verification task are improved.

Description

Technical Field

[0001] This application relates to the field of logistics technology, and in particular to a method, device and storage medium for analyzing courier behavior. Background Technology

[0002] With the booming development of internet finance, e-commerce, and local life services, numerous business scenarios have generated a large demand for "on-site verification." For example, in the financial services sector, it is necessary to verify customers' addresses and identity information in person; in e-commerce and local life services scenarios, it often involves taking photos of doorplates or outdoor environments. These on-site verification tasks are crucial for ensuring the security and compliance of business operations.

[0003] The delivery personnel are the main implementers of door-to-door verification tasks, and the authenticity and compliance of the verification are directly determined by their behavior. However, current monitoring of door-to-door verification tasks mainly focuses on the sender, recipient, or transport vehicle, concentrating on whether the information of the verified party is true or whether the logistics trajectory is normal, while lacking analysis of the behavior of the delivery personnel undertaking the door-to-door verification task. This leads to inaccurate detection of anomalies in the execution process of door-to-door verification tasks.

[0004] Therefore, how to identify abnormal behavior of couriers performing door-to-door verification tasks in order to improve the authenticity and compliance of these tasks is an urgent problem that needs to be solved. Summary of the Invention

[0005] The main purpose of this application is to provide a method, device and storage medium for analyzing courier behavior, which aims to identify abnormal behavior of couriers performing door-to-door verification tasks, so as to improve the authenticity and compliance of door-to-door verification tasks.

[0006] To achieve the above objectives, this application provides a method for analyzing courier behavior, the method comprising: Obtain the task records generated by the target courier when performing each door-to-door verification task; Feature extraction is performed on each of the task records to obtain task features, wherein the task features characterize the execution attributes and result attributes of the on-site verification task; Based on the task characteristics, construct the target behavior indicators for the target courier; Based on the target behavior indicators and the preset baseline indicators, the abnormality level of the target courier's behavior is determined.

[0007] In one embodiment, the task record includes task review results, task spatiotemporal data, and on-site media data. The step of extracting features from each of the task records to obtain task features includes: Feature extraction is performed on the task review results and spatiotemporal data in each task record to obtain the task-level features of each task record, wherein the task-level features characterize the completion quality of a single on-site verification task. Feature extraction is performed on the spatiotemporal data of each task record to obtain the personal layer features of the target courier, wherein the personal layer features characterize the behavioral trajectory and operational rhythm of the target courier when performing each of the door-to-door verification tasks; Feature extraction is performed on the on-site media data in each of the task records to obtain media layer features, wherein the media layer features characterize the authenticity and compliance of the on-site media data; The task layer features, the personal layer features, and the media layer features are used as task features.

[0008] In one embodiment, the target behavior indicators include temporal behavior indicators and spatial behavior indicators. The temporal behavior indicators include the distribution characteristics of working hours, task interval time, and behavioral differences between holidays and working days. The spatial behavior indicators include location distribution entropy, boundary crossing ratio, and detour frequency.

[0009] In one embodiment, the method further includes: Determine the courier group to which the target courier belongs, and obtain the behavioral indicators of each courier in the courier group. The courier group is divided based on any one of the dimensions of region, shift, or business line. Determine the mean and standard deviation of each behavioral indicator, and use the mean and standard deviation as the baseline indicator.

[0010] In one embodiment, the step of determining the abnormal behavior level of the target courier based on the target behavior indicator and a preset baseline indicator includes: Determine the difference between the target behavior indicator and the mean, and divide the difference by the standard deviation to obtain the standardized deviation value; The standardized deviation value is assigned to a preset first level as the abnormal behavior level of the target courier.

[0011] In one embodiment, the personal layer feature includes movement speed, which is the ratio between the execution location distance and the execution time interval of two sequentially adjacent door-to-door verification tasks; the media layer feature includes fingerprint repetition rate, which is the proportion of overlap between fingerprints uploaded by the target courier when performing each door-to-door verification task. The step of determining the abnormal behavior level of the target courier based on the target behavior indicators and preset baseline indicators includes: Determine the difference between the target behavior indicator and the mean, and divide the difference by the standard deviation to obtain the standardized deviation value; Determine whether the moving speed is greater than a first preset threshold and whether the fingerprint repetition rate is higher than a second preset threshold to obtain the determination result; Based on the judgment result and the standardized deviation value, a first comprehensive evaluation value is determined, and the first comprehensive evaluation value corresponds to a preset second level, which is used as the abnormal behavior level of the target courier.

[0012] In one embodiment, the step of determining the abnormal behavior level of the target courier based on the target behavior indicator and a preset baseline indicator includes: Determine the difference between the target behavior indicator and the mean, and divide the difference by the standard deviation to obtain the standardized deviation value; The task characteristics are input into a preset analysis model, and the behavior of the target courier is analyzed through the preset analysis model to obtain an anomaly evaluation value; A second comprehensive evaluation value is determined based on the abnormal evaluation value and the standardized deviation value. The second comprehensive evaluation value corresponds to a preset third level, which is used as the abnormal behavior level of the target courier.

[0013] In one embodiment, the step of determining the abnormal behavior level of the target courier based on the target behavior indicator and a preset baseline indicator includes: The task characteristics are input into a preset analysis model, and the behavior of the target courier is analyzed through the preset analysis model to obtain an anomaly evaluation value; Based on the abnormal evaluation value, the judgment result, and the standardized deviation value, a third comprehensive evaluation value is determined, and the third comprehensive evaluation value corresponds to a preset fourth level as the abnormal behavior level of the target courier.

[0014] Furthermore, to achieve the above objectives, this application also provides a courier behavior analysis device, the courier behavior analysis device comprising: The acquisition module is used to acquire the task records generated by the target courier when performing each door-to-door verification task; The feature extraction module is used to extract features from each of the task records to obtain task features, wherein the task features characterize the execution attributes and result attributes of the on-site verification task; The indicator construction module is used to construct the target behavior indicators of the target courier based on the task characteristics; The determination module is used to determine the abnormality level of the target courier's behavior based on the target behavior indicators and preset baseline indicators.

[0015] In addition, to achieve the above objectives, this application also proposes an electronic device, the device comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the courier behavior analysis method described above.

[0016] In addition, to achieve the above objectives, this application also provides a storage medium, which is a computer-readable storage medium, on which a program implementing the courier behavior analysis method is stored, and the program implementing the courier behavior analysis method is executed by a processor to implement the steps of the courier behavior analysis method as described above.

[0017] In addition, to achieve the above objectives, this application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the courier behavior analysis method described above.

[0018] This application provides a method for analyzing courier behavior. First, it acquires task records generated by the target courier during each door-to-door verification task, comprehensively and accurately collecting raw data during task execution, providing a solid foundation for subsequent analysis. Next, it extracts features from each task record to obtain task features representing the execution and outcome attributes of the door-to-door verification tasks. This step delves into key information during task execution, making the analysis of each door-to-door verification task more detailed and accurate. Then, based on the task features, it constructs target behavior indicators for the target courier across multiple task dimensions, comprehensively considering the courier's performance in different tasks, avoiding the one-sidedness of single-task analysis, and more comprehensively reflecting the courier's overall behavioral patterns. Finally, it determines the abnormal behavior level of the target courier based on the target behavior indicators and preset baseline indicators. This step accurately identifies abnormal behavior by comparing it with normal behavior standards.

[0019] Therefore, compared to traditional monitoring methods that focus on the sender, recipient, or transport vehicle as the analysis subject and concentrate on the information of the verification object or the logistics trajectory, this application directly analyzes the behavior of couriers who undertake door-to-door verification tasks. It can promptly detect violations or abnormal behaviors of couriers during the execution of tasks, such as false verification or irregular operating procedures, and then take corresponding measures to correct or prevent them. This effectively improves the accuracy of abnormal detection in the execution process of door-to-door verification tasks and ensures the authenticity and compliance of door-to-door verification tasks from the source. Attached Figure Description

[0020] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0021] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0022] Figure 1 This is a flowchart illustrating the first embodiment of the courier behavior analysis method of this application; Figure 2 This is a schematic diagram of the behavior analysis process involved in an embodiment of the courier behavior analysis method of this application; Figure 3 This is a schematic diagram illustrating the baseline parameter construction process involved in one embodiment of the courier behavior analysis method of this application; Figure 4 This is a schematic diagram of the system architecture involved in an embodiment of the courier behavior analysis method of this application; Figure 5 This is a schematic diagram of the module structure of the courier behavior analysis device in this application; Figure 6 This is a schematic diagram of the hardware operating environment involved in the courier behavior analysis method in this application embodiment.

[0023] The purpose, features, and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0024] It should be understood that the specific embodiments described herein are merely illustrative of the technical solutions of this application and are not intended to limit this application.

[0025] To better understand the technical solution of this application, a detailed description will be provided below in conjunction with the accompanying drawings and specific implementation methods.

[0026] The delivery personnel are the main implementers of door-to-door verification tasks, and the authenticity and compliance of the verification are directly determined by their behavior. However, current monitoring of door-to-door verification tasks mainly focuses on the sender, recipient, or transport vehicle, concentrating on whether the information of the verified party is true or whether the logistics trajectory is normal, while lacking analysis of the behavior of the delivery personnel undertaking the door-to-door verification task. This leads to inaccurate detection of anomalies in the execution process of door-to-door verification tasks.

[0027] Therefore, how to identify abnormal behavior of couriers performing door-to-door verification tasks in order to improve the authenticity and compliance of these tasks is an urgent problem that needs to be solved.

[0028] The main solution of this application is: to obtain task records generated by the target courier when performing each door-to-door verification task; to extract features from each task record to obtain task features, wherein the task features characterize the execution attributes and result attributes of the door-to-door verification task; to construct target behavior indicators for the target courier based on the task features; and to determine the abnormal behavior level of the target courier based on the target behavior indicators and a preset baseline indicator.

[0029] Compared to traditional monitoring methods that focus on the sender, recipient, or transport vehicle as the analysis subject and concentrate on the information of the verification object or the logistics trajectory, this application directly analyzes the behavior of couriers who undertake door-to-door verification tasks. It can promptly detect violations or abnormal behaviors of couriers during the execution of tasks, such as false verification or irregular operating procedures, and then take corresponding measures to correct or prevent them. This effectively improves the accuracy of abnormal detection in the execution of door-to-door verification tasks and ensures the authenticity and compliance of door-to-door verification tasks from the source.

[0030] It should be noted that the executing entity of the method in the various embodiments of the courier behavior analysis method of this application can be a behavior analysis system, or a computing service device with data processing, network communication, and program execution functions, such as a tablet computer, personal computer, mobile phone, etc., or an electronic device capable of realizing the above functions, etc. This embodiment does not specifically limit it. The following uses the behavior analysis system as the executing entity as an example to describe this embodiment and the following embodiments.

[0031] Based on this, this application proposes a courier behavior analysis method according to the first embodiment. Please refer to [link / reference]. Figure 1 The courier behavior analysis method includes steps S10 to S40: Step S10: Obtain the task records generated when the target courier performs each door-to-door verification task; It should be noted that the specific delivery personnel or field staff who perform door-to-door verification tasks and whose behavior requires analysis and evaluation are referred to as target delivery personnel. Door-to-door verification tasks are usually performed by delivery personnel or field staff, and their work covers multiple aspects. On the one hand, they need to verify the address to confirm that the address information provided by the user is accurate, ensuring that the service or business can be delivered precisely; on the other hand, they need to carefully verify the customer's identity by checking their ID documents to verify the authenticity and legality of the customer's identity and prevent identity theft or other violations. In addition, this may also include taking pictures of the doorplate or outdoor environment. Taking pictures of the doorplate can further clarify the specific location information, while taking pictures of the outdoor environment helps to understand the customer's surroundings as a whole, providing a more comprehensive reference for business operations. These door-to-door verification tasks are of vital importance to ensuring the smooth operation of various businesses, maintaining market order, and protecting the legitimate rights and interests of consumers and merchants. Task records are relevant data records generated by target delivery personnel during the execution of various door-to-door verification tasks, covering information from each stage of task execution.

[0032] In one feasible implementation, the behavior analysis system of this application includes a data collection and reporting terminal and a data access gateway. The terminal is deployed on the mobile terminal used by the courier and is used to collect images, videos, timestamps, GPS (Global Positioning System) coordinates, and device information during the door-to-door verification process. It also uploads the verification results, task metadata, and media data of the current door-to-door verification task to the server. The terminal collecting this data has preset permissions, so all data collected during the door-to-door verification process is legal. The data access gateway is used to authenticate, limit, and convert the data from the terminal, and write the task record to a message queue or streaming engine. For example, after the courier completes a door-to-door verification task, the task verification result, task metadata, and collected images or videos are uploaded to the data access gateway. After the data access gateway performs authentication verification and format unification processing, it writes the processed task verification result, task metadata, and media data as a task record into a message queue or streaming framework.

[0033] In this embodiment, the triggering condition for obtaining the target courier's task record can be: the target courier completing a new door-to-door verification task, or the user manually triggering an instruction to perform behavioral analysis on the target courier. Furthermore, it is understood that when performing behavioral analysis on couriers, task records generated within a recent period are typically selected to ensure the timeliness of the courier's behavior, thereby improving the accuracy of the analysis results.

[0034] Step S20: Extract features from each of the task records to obtain the task features of each on-site verification task, wherein the task features characterize the execution attributes and result attributes of the on-site verification task. It's important to note that task characteristics are specific indicators that characterize the execution and outcome attributes of on-site verification tasks. Execution attributes reflect various aspects of the task execution process, such as task execution time, which reflects the time spent by the courier to complete the task and indirectly reflects their work efficiency; and the standardization of the operational process, determining whether the courier follows standard procedures, such as whether they present identification before verification. Outcome attributes directly relate to the quality and effectiveness of task completion, such as the accuracy of verification results, which determines whether the business is compliant and whether customer rights are protected; and the clarity and completeness of the photos taken, affecting the effectiveness of business archiving and subsequent traceability.

[0035] In one feasible embodiment, the behavior analysis system of this application further includes a real-time database and a feature extraction module, used to read task records from the streaming engine, clean and standardize the task records, generate task-level features, personal-level features and media-level features, and write them into the real-time database.

[0036] In this embodiment, the task record includes task review results, task spatiotemporal data, and on-site media data. Step S20 may include: Step S201: Extract features from the task review results and spatiotemporal data in each task record to obtain the task-level features of each task record, wherein the task-level features characterize the completion quality of a single on-site verification task. It should be noted that the task record includes the task review result, task metadata, and on-site media data. The task review result is uploaded by the courier through the terminal, such as pass / fail tags, confidence level, and reason for failure. The task metadata includes task identifier and task spatiotemporal data. The task identifier includes task number, courier number, and device identifier. The task spatiotemporal data includes timestamps (task start time and task end time), GPS coordinates, etc. The on-site media data includes pictures or videos collected by the courier on-site when performing the door-to-door verification task, and fingerprint images of the courier.

[0037] Feature extraction is performed on the task review results and spatiotemporal data of each task record to obtain features characterizing the completion quality of individual tasks (hereinafter referred to as task-level features for distinction). These task-level features, obtained through feature extraction from the task review results and spatiotemporal data in the task records, characterize the completion quality of individual on-site verification tasks, such as whether the task was completed on time and whether the review was passed, serving as important indicators for evaluating task execution effectiveness. It is understood that task-level features are extracted based on each task record as the data foundation, resulting in task-level features for each task record.

[0038] In one feasible implementation, task-level features are constructed based on task review results and task spatiotemporal data. Specifically, task-level features include at least review labels, confidence levels, failure reason categories, image clarity scores, and task execution time lengths, which are used to describe the quality status of a single task.

[0039] Step S202: Extract features from the spatiotemporal data of each task record to obtain the personal layer features of the target courier, wherein the personal layer features characterize the behavioral trajectory and operational rhythm of the target courier when performing each door-to-door verification task; Feature extraction is performed on the spatiotemporal data of each task record to obtain features (hereinafter referred to as personal-level features for distinction) that characterize the behavioral trajectory and operational rhythm of the target courier when performing each door-to-door verification task. These personal-level features are extracted from the spatiotemporal data of the tasks and are primarily used to characterize the behavioral trajectory and operational rhythm of the target courier when performing each door-to-door verification task. The behavioral trajectory reflects the courier's movement path during task execution, while the operational rhythm reflects the time regularity and operational habits of task execution. It is understood that the personal-level features are extracted based on all obtained task records.

[0040] In one feasible implementation, the individual-level features include at least daily / weekly task volume sequences, task interval time distribution, movement speed distribution, location distribution entropy, and clustering results of permanent locations, which are used to characterize the long-term behavior patterns of delivery personnel.

[0041] Step S203: Extract features from the on-site media data in each of the task records to obtain media layer features, wherein the media layer features characterize the authenticity and compliance of the on-site media data; Feature extraction is performed on the on-site media data from each task record to obtain features (hereinafter referred to as media-layer features for distinction) used to characterize the authenticity and compliance of the county-level media data. These media-layer features, obtained through feature extraction from the on-site media data in the task records, can characterize the authenticity and compliance of the on-site media data. For example, they can determine whether photos have been tampered with or whether video content meets regulatory requirements. It can be understood that the extraction of media-layer features is based on all the obtained task records, resulting in the media-layer features of the target courier when performing each door-to-door verification task.

[0042] In one feasible implementation, the real-time database and feature extraction module read task records from the streaming framework and perform fingerprint calculation and feature extraction on the task media data therein. For example, it calculates perceptual hashes (pHash, aHash, dHash) and deep image embedding vectors to obtain media layer features. Specifically, the media layer features include at least the media fingerprint repetition rate, image similarity, shooting angle and composition distribution, and the nearest neighbor matching ratio in the historical image library, which are used for subsequent identification of re-photographing and repeated uploading behaviors.

[0043] Step S204: The task layer features, the personal layer features, and the media layer features are used as task features.

[0044] After the above feature extraction, we obtain a set of task-level features corresponding to each task record, as well as personal-level features and media-level features corresponding to each task record as a whole. The task-level features, personal-level features, and media-level features are used as the feature extraction results, i.e., task features.

[0045] Thus, this application embodiment integrates the audit labels and confidence levels, failure reasons, and other task results with metadata such as time, GPS, and device information, as well as media summaries such as media fingerprints and image embeddings, into a unified database. It then performs feature generation at the task, individual, and media levels, enabling joint modeling of result data, behavioral data, and media evidence. Compared to the approach where each anomaly analysis module is implemented separately by different systems and algorithms, this application embodiment forms a unified data perspective and risk scoring model, achieving the sharing of contextual information between modules and improving the ability to identify complex forgery situations.

[0046] Step S30: Construct the target behavior indicators for the target courier based on the task characteristics; After obtaining the task characteristics, behavioral characteristics of the target courier are constructed across multiple task dimensions (hereinafter referred to as target behavioral indicators for distinction). These behavioral indicators include at least temporal and spatial behavioral indicators. The aforementioned multi-task dimension refers to the fact that the behavioral characteristics are obtained through behavioral analysis of the courier across multiple task dimensions, not solely from a single task.

[0047] In one feasible implementation, the behavior analysis system of this application also includes a courier behavior profiling module, used to establish a long-term behavior profile for each courier in both time and space dimensions. Specifically, by periodically extracting historical data of couriers from a real-time database (i.e., task features generated when performing door-to-door verification tasks in the past), a daily / weekly rhythm model is constructed in the time dimension, and habitat and working radius are constructed based on stop point clustering in the spatial dimension. These features are used as behavioral indicators of couriers.

[0048] In this embodiment, the target behavior indicators include temporal behavior indicators and spatial behavior indicators. The temporal behavior indicators include the distribution characteristics of working hours and task intervals, and the behavioral differences between holidays and working days. The spatial behavior indicators include location distribution entropy, boundary crossing ratio, and detour frequency.

[0049] It's important to note that target behavioral indicators are key elements for comprehensively and accurately depicting the behavioral patterns and characteristics of each deliveryman. These indicators are divided into two main categories: temporal behavioral indicators and spatial behavioral indicators. Temporal behavioral indicators focus on the time dimension, examining the patterns of deliverymen's work behavior across different time scales; spatial behavioral indicators, on the other hand, reflect the spatial activity characteristics of deliverymen within their work area. These two types of indicators complement each other, jointly constructing a complete cognitive framework for understanding deliveryman behavior.

[0050] Specifically, the time-series behavioral indicators aim to reveal the behavioral patterns of couriers in the time dimension, including at least the distribution characteristics of working hours, task intervals, and behavioral differences between holidays and weekdays.

[0051] The system analyzes the workload sequence (xt) of each courier within multiple time windows from a real-time database, using specific time granularities (e.g., 15 minutes or 1 hour). By employing advanced modeling methods such as the Holt-Winters model with seasonal terms or Long Short-Term Memory (LSTM) networks, it deeply analyzes these workload sequences to accurately extract the courier's normal daily / weekly rhythm. This reveals the courier's typical working periods, clearly identifying the workload intensity during morning and evening peak hours. During the morning peak, couriers may face a large number of pickup and delivery tasks, resulting in a high workload; during the evening peak, the workload may be relatively concentrated due to factors such as customers returning home from get off work to receive packages. This analysis provides a clear understanding of the courier's workload at different times of the day.

[0052] Based on the obtained task load sequence of couriers, the system further analyzes the interval time between adjacent tasks. Statistical methods are used to process this interval data, calculating its mean, variance, standard deviation, and other statistical measures to derive the distribution characteristics of task interval times. For example, some couriers may have relatively uniform task interval times, exhibiting a certain regularity; while others may have significantly fluctuating task interval times, reflecting the instability of their work rhythm. These distribution characteristics help to gain a deeper understanding of couriers' work execution rhythm and task arrangement patterns. The system separately collects data on couriers' task load, task type, and task completion time during holidays and weekdays.

[0053] By comparing and analyzing this data, we can clearly see the differences in delivery drivers' behavior between holidays and weekdays. For example, on holidays, delivery drivers may have a relatively smaller workload, but may be involved in more special types of tasks, such as gift deliveries; while on weekdays, the workload may be larger, mainly consisting of regular business deliveries and daily residential deliveries. Furthermore, in terms of work schedules, delivery drivers' hours may be more flexible on holidays, while on weekdays they must follow a more fixed work schedule. These differences reflect the significant impact of different time types on delivery drivers' work behavior.

[0054] In addition, spatial behavior indicators focus on characterizing the activity features of couriers in the spatial dimension, including at least location distribution entropy, boundary crossing rate, and detour frequency.

[0055] The system first extracts stop points based on the GPS information of the deliverymen's historical tasks. These stop points represent the locations where the deliverymen briefly stop during their tasks. Then, using clustering algorithms such as DBSCAN (Density-Based Spatial Clustering of Applications with Noise) and HDBSCAN (Hierarchical Density-Based Spatial Clustering of Applications with Noise), the stop points are clustered into habitats (such as the vicinity of their residence) and main work areas. In this way, the main activity area of ​​the deliverymen can be clearly defined. Based on this, the location distribution entropy is calculated. This metric reflects the concentration of task distribution. If the location distribution entropy is small, it means that the deliverymen's tasks are mainly concentrated in a few areas, and the distribution is relatively concentrated; conversely, if the location distribution entropy is large, it means that the task distribution is relatively dispersed, and the deliverymen need to work over a larger area.

[0056] The system defines a clearly defined business area, determined based on factors such as the courier company's service area and the courier's job responsibilities. By comparing the courier's assigned location with the business area, the system counts the number of times the assigned location appears outside the business area or is abnormally far from the normal service area, and calculates the ratio of this number to the total number of assigned locations, i.e., the boundary violation rate. A high boundary violation rate indicates that the courier may be working outside the designated area, which could affect service quality and work efficiency, and may even constitute a violation.

[0057] When analyzing the GPS information of delivery personnel's historical tasks, the system plans the shortest path between each task. It then compares the actual route taken by the delivery person with the shortest path. When the actual path length is significantly longer than the shortest path length, it is considered a detour. The number of detours by the delivery person within a certain period is counted to obtain the detour frequency. High-frequency detour patterns, such as abnormally long paths between adjacent tasks, may reflect problems with the delivery person's route planning or abnormal behavior such as deliberately taking detours to obtain extra benefits. By analyzing the detour frequency, abnormal situations in the delivery person's work process can be detected in a timely manner, and corresponding management and optimization can be carried out.

[0058] Step S40: Based on the target behavior indicators and the preset baseline indicators, determine the abnormal behavior level of the target courier.

[0059] It should be noted that pre-set indicators are used to measure whether the target courier's behavior is normal or not (hereinafter referred to as baseline indicators for distinction).

[0060] After obtaining the target courier's target behavioral indicators, the abnormality level of the target courier's behavior is determined based on the difference between the target behavioral indicators and the preset baseline indicators.

[0061] In one feasible implementation, the behavior analysis system of this application further includes a group baseline module, used to statistically analyze baseline parameters such as the mean and variance of the behavioral indicators of each courier in the same region, shift, or business line group. These baseline parameters are the baseline indicators. Thus, based on constructing a spatiotemporal profile of each courier, this embodiment establishes a statistical baseline of rhythm and spatial activity range by comparing it with the group of couriers in the same region and shift. By performing standardization processing such as z-score on individual characteristics, it can identify hidden anomalies that only appear under "overall busy" or "overall sluggish" environments. Compared to traditional anomaly detection methods that use fixed thresholds or individual historical averages as the basis for judgment, this embodiment introduces baseline parameters, enabling the identification of hidden abnormal behaviors that only occur under overall high load or special rhythms.

[0062] For example, such as Figure 2 The diagram shows the behavior analysis process. First, in response to a new door-to-door verification task completion instruction or a user-triggered behavior analysis instruction, the process reads the task characteristics and baseline indicators of each door-to-door verification task executed by the courier in the recent period. Based on the task characteristics, behavior indicators are constructed, and the courier's behavior anomaly level is determined based on the difference between the behavior indicators and the baseline indicators. Based on the anomaly level, the latest door-to-door verification task is evaluated for anomaly.

[0063] Thus, compared to traditional monitoring methods that focus on the sender, recipient, or transport vehicle as the analysis subject and concentrate on the information of the verification object or the logistics trajectory, the embodiments of this application directly analyze the behavior of couriers who undertake door-to-door verification tasks. This can promptly detect violations or abnormal actions by couriers during the execution of tasks, such as false verification or irregular operating procedures, and then take corresponding measures to correct or prevent them. This effectively improves the accuracy of abnormal detection in the execution process of door-to-door verification tasks and ensures the authenticity and compliance of door-to-door verification tasks from the source.

[0064] Based on the first embodiment of this application, in the second embodiment of this application, the content that is the same as or similar to that in the first embodiment described above can be referred to the above description and will not be repeated hereafter. Furthermore, the courier behavior analysis method of this application also includes: Step A10: Determine the courier group to which the target courier belongs, and obtain the behavioral indicators of each courier in the courier group. The courier group is divided based on any one of the following dimensions: region, shift, or business line. Step A20: Determine the mean and standard deviation of each behavioral indicator, and use the mean and standard deviation as the baseline indicator.

[0065] It should be noted that couriers are pre-grouped based on any one of the following: region, shift, or business line. Taking the region dimension as an example, different regions have different factors such as courier volume, customer distribution, and geographical environment. These differences will lead to different work behavior patterns of couriers. Therefore, couriers who conduct door-to-door verification in the same region are grouped into one group.

[0066] The process involves identifying the target courier's group, obtaining individual behavioral indicators for each courier within that group, and calculating the mean and standard deviation of each indicator. It's important to understand that each courier's behavioral indicators include multiple dimensions. For example, temporal behavioral indicators include the distribution characteristics of working hours, task intervals, and behavioral differences between holidays and weekdays; spatial behavioral indicators include location distribution entropy, boundary crossing rate, and detour frequency. Essentially, each courier's behavioral indicators comprise at least six dimensions. Therefore, when calculating the mean and standard deviation, a mean and standard deviation are calculated for each dimension of the behavioral indicator. That is, for the six dimensions of the behavioral indicator, a mean and a standard deviation are calculated separately, resulting in six sets of mean and standard deviation data. Each set of mean and standard deviation corresponds to one dimension of the behavioral indicator. For example, one set of mean and standard deviation is calculated for the working hours dimension, another set for the location distribution entropy dimension, and so on. Finally, the mean and standard deviation of each behavioral indicator are used as baseline indicators. The baseline metrics are consistent with the behavioral metrics in terms of dimensions; that is, each dimension has a corresponding mean and standard deviation as a baseline, which are used for subsequent evaluation and analysis of the target courier's behavior. Baseline parameters may also include quantiles, etc.

[0067] In one feasible implementation, in addition to writing task characteristics into the real-time database, behavioral indicators of each courier and baseline parameters of each group can also be written into the real-time database to form a behavioral data warehouse that can be queried according to multiple dimensions such as courier, region, and time.

[0068] For example, such as Figure 3The diagram illustrates the baseline parameter construction process. First, couriers report task data to the data access gateway via mobile terminals. The data access gateway preprocesses the task data to obtain task records. Based on the task records, task-level features, personal-level features, and media-level features are constructed and saved to the real-time database. The task features corresponding to each courier's historical door-to-door verification tasks are retrieved from the real-time database. Based on these task features, temporal behavior indicators and spatial behavior indicators are constructed, and the two are combined to form individual spatiotemporal behavior indicators. Based on the behavior indicators of each courier in a group divided by region, shift, or business line, the group baseline parameters (i.e., baseline indicators) are determined.

[0069] Thus, this application embodiment accurately divides the target courier group based on dimensions such as region, shift, or business line, and then obtains the behavioral indicators of each courier within the group and calculates the mean and standard deviation as baseline indicators, providing a scientific and reasonable reference standard for subsequent analysis.

[0070] In this embodiment, step S40 may include: Step S401: Determine the difference between the target behavior indicator and the mean, and divide the difference by the standard deviation to obtain the standardized deviation value; For each dimension of the behavioral indicator, the difference between the target behavioral indicator and the mean is calculated. Then, the ratio obtained by dividing the difference by the standard deviation is calculated. This ratio reflects the degree of deviation of the target courier's behavioral indicator from the group average level. Therefore, this ratio is used as the difference between the standardized target behavioral indicator and the group average level, i.e., the standardized deviation value mentioned above.

[0071] In one feasible implementation, the mean of a certain dimension is represented by μ, the standard deviation of that dimension is represented by σ, and the behavioral index of the target courier in that dimension is represented by... The formula for standardizing this behavioral indicator is expressed as:

[0072] Where i represents the current dimension, This represents the standardized deviation value for the current dimension.

[0073] Step S402: The standardized deviation value is assigned to a preset first level as the abnormal behavior level of the target courier.

[0074] After obtaining the standardized deviation value for each dimension, the standardized deviation values ​​for each dimension are weighted and summed to obtain a sum. Based on this sum, the level corresponding to the range of the sum (hereinafter referred to as the first level for distinction) is matched from a pre-constructed mapping table between anomaly score ranges and anomaly levels. The first level is then used as the target courier's behavioral anomaly level. It's important that different dimensions of behavioral indicators may have varying degrees of importance in assessing courier behavioral anomalies. For example, the task intensity during work hours in time-series behavioral indicators may have a greater impact on overall behavioral anomalies, while the frequency of detours in spatial behavioral indicators has a relatively smaller impact. The aforementioned mapping table between anomaly score ranges and anomaly levels is based on extensive historical data, expert experience, and the needs of practical application scenarios. By analyzing and summarizing courier behavior under different anomaly score ranges in historical data, and combining expert judgment criteria for different degrees of behavioral anomalies, the sum is divided into different intervals, and each interval corresponds to a specific anomaly level, such as normal, slightly abnormal, moderately abnormal, and severely abnormal.

[0075] Thus, in this embodiment, the difference between the target behavioral indicator and the mean is calculated and divided by the standard deviation to obtain the standardized deviation value. This value eliminates the influence of differences in the dimensions and dispersion of different behavioral indicators, objectively reflecting the degree of deviation of the target courier's behavioral indicator from the group average level. Finally, the standardized deviation value is assigned to a preset first level to determine the behavioral anomaly level. This method, based on multi-dimensional group data and standardized processing, can comprehensively and accurately assess the behavioral anomalies of the target courier, providing a powerful and reliable decision-making basis for express delivery companies to promptly detect abnormal behavior, rationally allocate resources, optimize management strategies, and improve service quality, thereby helping to improve the efficiency and stability of express delivery operations.

[0076] Based on the first and second embodiments of this application, in the third embodiment of this application, the content that is the same as or similar to the first and second embodiments described above can be referred to the above description and will not be repeated hereafter. On this basis, the personal layer feature includes movement speed, which refers to the ratio between the execution location distance and the execution time interval of two sequentially adjacent door-to-door verification tasks; the media layer feature includes fingerprint repetition rate, which is the overlap ratio between the fingerprints uploaded by the target courier when performing each door-to-door verification task; step S40 may include: Step B10: Determine the difference between the target behavior indicator and the mean, and divide the difference by the standard deviation to obtain the standardized deviation value; Step B20: Determine whether the moving speed is greater than a first preset threshold and whether the fingerprint repetition rate is higher than a second preset threshold, and obtain the determination result; It's important to note that the movement speed in the personal layer features refers to the ratio of the distance between the execution locations of two sequentially adjacent door-to-door verification tasks to the execution time interval. For example, if a courier travels to two different door-to-door verification locations A and B in sequence, the spatial distance between A and B is the execution location distance, and the time taken to travel from A to B is the execution time interval. Dividing the location distance by the time interval gives the movement speed as defined here. This definition more accurately reflects the courier's movement in actual business scenarios, considering that actual routes may not be straight, and better aligns with actual business needs. The fingerprint repetition rate in the media layer features refers to the proportion of overlap between fingerprints uploaded by the target courier when performing various door-to-door verification tasks. Here, fingerprints can be feature identifiers from media files such as images and videos. By comparing and analyzing these fingerprints, the repetition rate is calculated. For example, if a courier uploads multiple door-to-door verification-related images within a certain time frame, the fingerprints of these images are extracted and compared. If some images share the same fingerprints, the proportion of images with the same fingerprints to the total number of uploaded images is the fingerprint repetition rate. Fingerprint repetition rate can be used to determine whether a courier is engaging in abnormal behavior such as re-photographing or repeatedly uploading images. A pre-set threshold (hereinafter referred to as the first preset threshold) is used to determine whether the courier's movement speed is abnormal. When the target courier's movement speed exceeds the first preset threshold, their movement speed is considered abnormal. Similarly, a pre-set threshold (hereinafter referred to as the second preset threshold) is used to determine whether the fingerprint repetition rate is abnormal. When the fingerprint repetition rate is higher than this threshold, the courier is suspected of engaging in abnormal behavior such as re-photographing or repeatedly uploading images.

[0077] Calculate the standardized deviation value, and determine whether the moving speed is greater than the first preset threshold and whether the fingerprint repetition rate is higher than the second preset threshold to obtain the judgment result.

[0078] In one feasible implementation, the behavior analysis system of this application further includes a rule engine. The rule engine is used to encode abnormal situations that are strongly constrained and easily explained in business operations, such as speed anomalies, time anomalies, location jumps, and fingerprint duplication anomalies. Specifically, if the theoretical movement speed v between two adjacent tasks exceeds the set maximum speed v_max, it is judged as a speed anomaly; if the interval Δt between consecutive tasks is continuously less than the threshold τ_t, and the spatial locations of the tasks are far apart, it is suspected that there is a fake door-to-door visit or batch backfilling; if the GPS distance between adjacent tasks is greater than the threshold τ_d and the time difference is insufficient to support normal movement, it is judged as a location anomaly; if the media fingerprint duplication rate uploaded by the same courier exceeds the threshold τ_hash within a certain time window, it is suspected that there is a re-photographing or duplicate uploading.

[0079] It is important to note that the aforementioned methods for determining speed anomalies, time anomalies, and location jump anomalies can essentially be summarized as the determination of movement speed anomalies. In practical applications, the first preset threshold is not a single value, but rather includes multiple different values. These different values ​​correspond to the judgment criteria for different types of anomalies, such as speed anomalies, time anomalies, and location jumps. By conducting multi-dimensional analysis and judgment of the core indicator of movement speed, the rule engine can more comprehensively and accurately identify various abnormal behaviors that couriers may exhibit during business operations, providing reliable and effective anomaly detection basis for the behavior analysis system, thereby improving the intelligence level and risk control capabilities of the entire express delivery business management.

[0080] Step B30: Based on the judgment result and the standardized deviation value, determine the first comprehensive evaluation value, and use the first comprehensive evaluation value corresponding to the preset second level as the abnormal behavior level of the target courier.

[0081] The system determines whether the moving speed exceeds a first preset threshold and whether the fingerprint repetition rate exceeds a second preset threshold, obtaining corresponding judgment results. These two judgment results reflect potential anomalies of the target courier from different dimensions. Then, based on the above judgment results and standardized deviation values, a comprehensive evaluation is performed to calculate a comprehensive evaluation value (hereinafter referred to as the first comprehensive evaluation value for distinction). The first comprehensive evaluation value integrates information from multiple key indicators, enabling a more accurate measurement of the degree of abnormal behavior of the target courier. Finally, the first comprehensive evaluation value is assigned to a preset level (hereinafter referred to as the second level for distinction), thereby determining the level of abnormal behavior of the target courier. The entire process is logically clear, progressing step by step from data acquisition to final level determination, progressively and deeply analyzing the abnormal behavior of the target courier.

[0082] In one feasible implementation, after completing the step of dividing the difference of the target behavior indicators by the standard deviation to obtain the standardized deviation value, it is determined whether the moving speed is greater than a first preset threshold and whether the fingerprint repetition rate is higher than a second preset threshold, and the corresponding judgment results are obtained. Then, based on these judgment results and the standardized deviation value, a first comprehensive evaluation value is determined, specifically using a weighted summation method. Different weights are assigned to the results of whether the moving speed is greater than the first preset threshold, whether the fingerprint repetition rate is higher than the second preset threshold, and the standardized deviation value. Each judgment result and the standardized deviation value are multiplied by their corresponding weights and then summed to obtain the first comprehensive evaluation value. Then, in the mapping relationship table between abnormal score range and abnormal level, the level (second level) corresponding to the range of the first comprehensive evaluation value is determined as the abnormal behavior level of the target courier.

[0083] In this embodiment, step S40 may include: Step C10: Determine the difference between the target behavior indicator and the mean, and divide the difference by the standard deviation to obtain the standardized deviation value; Step C20: Input the task features into a preset analysis model, and analyze the behavior of the target courier through the preset analysis model to obtain an anomaly evaluation value; It should be noted that the embodiments of this application use a specific statistical learning model as the preset analysis model, specifically Isolation Forest, One-Class SVM, or other single-class anomaly detection models. Such models take multidimensional standardized features as input, and their core function is to learn the distribution pattern of normal behavior. They can capture complex high-dimensional feature combination patterns, such as identifying complex situations where temporal rhythm deviation and spatial activity range anomalies occur simultaneously. Then, for each task or short time window, an anomaly score A is output. The value range of the anomaly score A is [0,1], which is used to quantify the degree of anomaly in the task behavior.

[0084] The standardized deviation value is calculated, and the task features are input into the preset analysis model. The preset analysis model analyzes the behavior of the target courier based on the normal behavior distribution it has learned, and the resulting evaluation value (hereinafter referred to as the abnormal evaluation value for distinction) is used to indicate the degree of abnormality of the target courier's behavior relative to normal behavior.

[0085] Step C30: Determine a second comprehensive evaluation value based on the abnormal evaluation value and the standardized deviation value, and use the second comprehensive evaluation value to correspond to a preset third level as the abnormal behavior level of the target courier.

[0086] Based on the obtained abnormal evaluation value and the previously calculated standardized deviation value, a comprehensive evaluation value (hereinafter referred to as the second comprehensive evaluation value for distinction) is determined through a specific calculation method. Then, according to the correspondence between the second comprehensive evaluation value and the preset level (hereinafter referred to as the third level for distinction), the abnormal behavior level of the target courier is determined as the corresponding third level, thereby achieving an accurate judgment on the degree of abnormal behavior of the target courier.

[0087] In one feasible implementation, after obtaining the abnormal evaluation value, the second comprehensive evaluation value is determined by weighted summation or other reasonable calculation methods in combination with the previously calculated standardized deviation value; then, in the mapping relationship table between abnormal score range and abnormal level, the level (second level) corresponding to the range of the second comprehensive evaluation value is determined as the abnormal behavior level of the target courier.

[0088] In this embodiment, step S40 may include: Step D10: Input the task features into the preset analysis model, and analyze the behavior of the target courier through the preset analysis model to obtain an anomaly evaluation value; Step D20: Based on the abnormal evaluation value, the judgment result, and the standardized deviation value, determine the third comprehensive evaluation value, and assign the third comprehensive evaluation value to the preset fourth level as the abnormal behavior level of the target courier.

[0089] After obtaining the judgment result output by the rule engine, the comprehensive evaluation value (hereinafter referred to as the third comprehensive evaluation value for distinction) is determined by combining the abnormal evaluation value output by the preset analysis model and the standardized deviation value obtained based on the baseline parameters. The third comprehensive evaluation value corresponds to the preset level (hereinafter referred to as the fourth level for distinction) as the abnormal behavior level of the target courier.

[0090] In one feasible implementation, the standardized deviation value, the judgment result and the abnormal evaluation value are weighted and summed to obtain the third comprehensive evaluation value. Then, in the mapping relationship table between the abnormal score range and the abnormal level, the level (third level) corresponding to the range of the third comprehensive evaluation value is determined as the abnormal behavior level of the target courier.

[0091] In another feasible embodiment, the behavior analysis system of this application further includes an anomaly detection engine module, which is used to read the relevant features of the target courier and group from the database in real time when a new task arrives or a behavior analysis instruction is received, and calculate the risk score by combining the rule engine, single-class anomaly detection model and media vector nearest neighbor retrieval. Specifically, for each uploaded image or keyframe extracted from a video, this invention calculates its deep image embedding vector and uses a vector retrieval engine (such as a FAISS-based nearest neighbor index) to find the K most similar samples in the historical image library. If the repetition ratio of the same courier or the same address in the nearest neighbor samples exceeds the threshold τ_knn, it can be determined as a suspected re-photographed or mass-reused image, and the media nearest neighbor score NearDup∈[0,1] is output. Further, a comprehensive risk scoring function is constructed by weighted fusion of the three scores, for example: Risk=η1*A+η2*Rule+η3*NearDup, where η1, η2, and η3 are configurable weights or weights obtained through model training. Risk is a comprehensive evaluation value. Based on the magnitude of Risk, tasks or couriers are marked with different risk levels (such as high, medium, and low), corresponding to different early warning strategies and subsequent handling procedures.

[0092] Thus, this application's embodiment expands the detection of media re-photographing and repeated uploading from the determination of the authenticity of a single image to a signal in a behavioral sequence. By combining spatiotemporal features such as location jumps, task intervals, and speed anomalies with the review results, and fusing them through a unified risk scoring function, it can identify complex forgery patterns such as "route detours + batch reuse of images".

[0093] Furthermore, in one feasible embodiment, the behavior analysis system of this application also includes an early warning and operation module, a model management and self-learning module, and a privacy and compliance module. The early warning and operation module is used to push alarms to the operation platform and risk control system according to the risk level, and generate evidence packages containing trajectories, similar images, timelines, etc., for manual review and subsequent processing. The model management and self-learning module is used to receive the results of manual review, label false positives and false negatives, drive threshold optimization, model retraining and deployment, and record version change information. The privacy and compliance module is used to uniformly manage storage policies and access control, control the retention time of original media, hash or obfuscate location information and device fingerprints, and provide audit logs.

[0094] For example, such as Figure 4 The diagram shows the system architecture. The behavior analysis system of this application communicates with both the courier's mobile terminal and the early warning and operation platform. The system includes a data access gateway, a real-time feature extraction module, a real-time database and behavior repository, a behavior profiling and group baseline module, an anomaly detection engine module, a model management and self-learning module, and a privacy and compliance module. The specific process is as follows: The courier triggers a task completion instruction on their mobile terminal, uploading the task record to the data access gateway; the real-time feature extraction module extracts features from the task record to obtain task features, and based on these features, obtains behavior indicators; the privacy and compliance module performs privacy protection processing on the task features and behavior indicators, saving the processed task features to the real-time database and the processed behavior indicators to the behavior repository; then, the behavior profiling and group baseline module generates a behavior profile and baseline parameters based on the behavior indicators; then, the anomaly detection engine module determines the courier's behavior anomaly level; finally, based on the anomaly level, an alarm and cause feedback are issued on the early warning and operation platform, and the model management and self-learning module performs adaptive updates.

[0095] Specifically, when a courier's abnormal behavior exceeds a high-risk threshold, an alert is pushed to the operations dashboard and risk control system via Webhook, message queues, etc., and an evidence package is generated. This evidence package includes at least: a timeline and location trajectory visualization of the courier's recent tasks; comparison of suspected copied or repeatedly uploaded images; the anomaly type triggered by the rule engine and its corresponding indicator value; and the scores of the statistical learning model and nearest neighbor retrieval. Then, operations or risk control personnel review the alert based on the evidence package, marking it as a confirmed anomaly or a false alarm. The system writes the review results back to the real-time database and records the associated feature vector and model score. The model management and self-learning module periodically extracts samples with review marks from the database and updates the following: automatically adjusting the Risk stratification threshold and parameters such as τ_t, τ_d, and τ_hash in the rule engine based on the false positive and false negative ratios; retraining or incrementally training the single-class anomaly detection model using new samples; evaluating the performance of different model versions, and selecting the optimal version for online deployment. Through the aforementioned closed loop, this application can be continuously optimized in the actual business environment and gradually adapt to changes in business strategies and behavioral patterns.

[0096] Thus, this application embodiment not only provides anomaly scoring, but also provides real-time early warning, operation dashboard display, evidence package generation, and manual review feedback mechanism. Through online iterative updates of thresholds and model parameters, the system becomes more accurate the longer it is used in actual business, thereby improving long-term maintenance efficiency.

[0097] Furthermore, considering the sensitivity of courier trajectories and door-to-door verification media, this application's embodiments employ privacy-friendly designs in the system architecture, including optional storage of original media, location information obfuscation and K-anonymity, device fingerprint hashing, and access control and auditing. Specifically, optional storage of original media means the system supports retaining original images or videos only for a short period (e.g., 7 days), after which only fingerprints and embedded vectors are retained to meet subsequent risk control requirements; location information obfuscation and K-anonymity involve spatial rasterization or noise addition to the trajectory data, making it difficult to reconstruct a specific address from any single trajectory, achieving K-anonymity-level privacy protection; device fingerprint hashing involves irreversibly hashing sensitive fields such as device ID and SIM card information to avoid direct association with real-world identities; and access control and auditing involve fine-grained control and tracking of access to sensitive data through unified permission management and audit logs, reducing the risk of internal misuse.

[0098] Thus, this application embodiment supports storing only media features and de-identified location information, without storing the original video or precise trajectory, and further reduces the risk of privacy leakage through technologies such as hashing and K-anonymity, making it easier to comply with data minimization and privacy protection compliance requirements while meeting risk control needs.

[0099] For example, taking a courier X's door-to-door verification task as an example, in the data input (terminal collection) stage, courier X performs a door-to-door verification task within a specific time period. The terminal device reports data such as task number, planned delivery time, user address coordinates, trajectory data (GPS point sequence), on-site photos, device ID, and positioning accuracy. A raw reporting record thus enters the data access module. In the unified database storage and data verification stage, the system performs data formatting, removes invalid trajectory points, verifies media integrity, and verifies the validity of the task number. After processing, a cleaned trajectory sequence and verified media are obtained, and the structured data is then written into the real-time database. In the feature generation and behavior profile construction stage, the system generates multi-layered features based on the above data. For task-level features, these include distance deviation, actual dwell time, and total task time. For personal profile features, the system calculates the standardized deviation value for this task based on the average distance deviation and standard deviation of courier X over a recent period (significant deviation indicates an anomaly). The media vector feature involves encoding photos into a specific-dimensional vector and calculating its similarity to photos from another task. These features are written into the behavioral profile feature library. When conducting anomaly detection (rule, model, and media detection fusion), the system calculates scores for each of the three sub-modules. In the rule engine, based on preset rules, indicators such as distance deviation and dwell time are judged and scored. The statistical model inputs include distance deviation, dwell time, and individual profiles, and outputs anomaly scores and maps scores through a specific model. In media reuse detection, photo similarity is compared with a threshold to obtain a risk score. Risk fusion and anomaly level determination are performed, and the scores from the rule engine, statistical model, and media reuse detection are weighted according to a weighting strategy to obtain a total risk score. The system determines whether the task has risk anomalies and their types based on threshold ranges, and outputs the anomaly type and risk level. During the early warning notification and closed-loop processing phase, the system generates alarm records and pushes them to the manual review interface. After the reviewer confirms the task is abnormal, the system writes back the review results for subsequent model adaptive optimization, ultimately completing the anomaly identification for this task and updating the subsequent model training data.

[0100] In summary, the embodiments of this application realize multi-source integrated modeling of courier behavior in door-to-door verification services, anomaly detection under the group baseline, joint analysis of media anti-fraud and spatiotemporal behavior, and privacy-friendly early warning closed loop. While improving the ability to identify abnormal behaviors such as proxy shooting, fake door-to-door delivery, and mass fraud, it also takes into account the compliance requirements and engineering feasibility in actual business scenarios.

[0101] This application also provides a courier behavior analysis device. Please refer to... Figure 5 The courier behavior analysis device includes: Module 10 is used to acquire task records generated by the target courier when performing each door-to-door verification task; The feature extraction module 20 is used to extract features from each of the task records to obtain task features, wherein the task features characterize the execution attributes and result attributes of the on-site verification task. The indicator construction module 30 is used to construct the target behavior indicators of the target courier based on the task characteristics; The determination module 40 is used to determine the abnormality level of the target courier's behavior based on the target behavior indicators and the preset baseline indicators.

[0102] Optionally, the task record includes task review results, task spatiotemporal data, and on-site media data, and the feature extraction module 20 is further used for: Feature extraction is performed on the task review results and spatiotemporal data in each task record to obtain the task-level features of each task record, wherein the task-level features characterize the completion quality of a single on-site verification task. Feature extraction is performed on the spatiotemporal data of each task record to obtain the personal layer features of the target courier, wherein the personal layer features characterize the behavioral trajectory and operational rhythm of the target courier when performing each of the door-to-door verification tasks; Feature extraction is performed on the on-site media data in each of the task records to obtain media layer features, wherein the media layer features characterize the authenticity and compliance of the on-site media data; The task layer features, the personal layer features, and the media layer features are used as task features.

[0103] Optionally, the target behavior indicators include temporal behavior indicators and spatial behavior indicators. The temporal behavior indicators include the distribution characteristics of working hours and task intervals, and the behavioral differences between holidays and working days. The spatial behavior indicators include location distribution entropy, boundary crossing ratio, and detour frequency.

[0104] Optionally, the courier behavior analysis device further includes a baseline construction module, which is used for: Determine the courier group to which the target courier belongs, and obtain the behavioral indicators of each courier in the courier group. The courier group is divided based on any one of the dimensions of region, shift, or business line. Determine the mean and standard deviation of each behavioral indicator, and use the mean and standard deviation as the baseline indicator.

[0105] Optionally, the determination module 40 is further configured to: Determine the difference between the target behavior indicator and the mean, and divide the difference by the standard deviation to obtain the standardized deviation value; The standardized deviation value is assigned to a preset first level as the abnormal behavior level of the target courier.

[0106] Optionally, the personal layer features include movement speed, which is the ratio between the execution location distance and the execution time interval of two sequentially adjacent door-to-door verification tasks; the media layer features include fingerprint repetition rate, which is the proportion of overlap between fingerprints uploaded by the target courier when performing each door-to-door verification task. The determination module 40 is also used for: Determine the difference between the target behavior indicator and the mean, and divide the difference by the standard deviation to obtain the standardized deviation value; Determine whether the moving speed is greater than a first preset threshold and whether the fingerprint repetition rate is higher than a second preset threshold to obtain the determination result; Based on the judgment result and the standardized deviation value, a first comprehensive evaluation value is determined, and the first comprehensive evaluation value corresponds to a preset second level, which is used as the abnormal behavior level of the target courier.

[0107] Optionally, the determination module 40 is further configured to: Determine the difference between the target behavior indicator and the mean, and divide the difference by the standard deviation to obtain the standardized deviation value; The task characteristics are input into a preset analysis model, and the behavior of the target courier is analyzed through the preset analysis model to obtain an anomaly evaluation value; A second comprehensive evaluation value is determined based on the abnormal evaluation value and the standardized deviation value. The second comprehensive evaluation value corresponds to a preset third level, which is used as the abnormal behavior level of the target courier.

[0108] Optionally, the determination module 40 is further configured to: The task characteristics are input into a preset analysis model, and the behavior of the target courier is analyzed through the preset analysis model to obtain an anomaly evaluation value; Based on the abnormal evaluation value, the judgment result, and the standardized deviation value, a third comprehensive evaluation value is determined, and the third comprehensive evaluation value corresponds to a preset fourth level as the abnormal behavior level of the target courier.

[0109] The courier behavior analysis device provided in this application, employing the courier behavior analysis method described in the above embodiments, can solve the technical problem of how to identify abnormal behavior of couriers performing door-to-door verification tasks, thereby improving the authenticity and compliance of these tasks. Compared with the prior art, the beneficial effects of the courier behavior analysis device provided in this application are the same as those of the courier behavior analysis method provided in the above embodiments, and other technical features in the courier behavior analysis device are the same as those disclosed in the methods of the above embodiments, and will not be repeated here.

[0110] This application provides an electronic device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform the courier behavior analysis method in Embodiment 1 above.

[0111] The following is for reference. Figure 6 The diagram illustrates a structural schematic of an electronic device suitable for implementing embodiments of this application. The electronic devices in these embodiments may include, but are not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), in-vehicle terminals (e.g., in-vehicle navigation terminals), and fixed terminals such as digital TVs and desktop computers. Figure 6 The electronic device shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments of this application.

[0112] like Figure 6As shown, the electronic device may include a processing unit 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory 1002 or a program loaded from a storage device 1003 into a random access memory 1004. The random access memory 1004 also stores various programs and data required for the operation of the electronic device. The processing unit 1001, the read-only memory 1002, and the random access memory 1004 are interconnected via a bus 1005. An input / output interface 1006 is also connected to the bus. Typically, the following systems can be connected to the input / output interface 1006: input devices 1007 including, for example, touchscreens, touchpads, keyboards, mice, image sensors, microphones, accelerometers, gyroscopes, etc.; output devices 1008 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 1003 including, for example, magnetic tapes, hard disks, etc.; and communication devices 1009. The communication device 1009 allows the electronic device to communicate wirelessly or wiredly with other devices to exchange data. Although the diagrams show electronic devices with various systems, it should be understood that it is not required to implement or have all of the systems shown. More or fewer systems may be implemented alternatively.

[0113] Specifically, according to the embodiments disclosed in this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device, or installed from storage device 1003, or installed from read-only memory 1002. When the computer program is executed by processing device 1001, it performs the functions defined in the methods of the embodiments disclosed in this application.

[0114] The electronic device provided in this application, employing the courier behavior analysis method in the above embodiments, can solve the technical problem of how to identify abnormal behavior of couriers performing door-to-door verification tasks, thereby improving the authenticity and compliance of door-to-door verification tasks. Compared with the prior art, the beneficial effects of the electronic device provided in this application are the same as those of the courier behavior analysis method provided in the above embodiments, and other technical features of this electronic device are the same as those disclosed in the method of the previous embodiment, and will not be repeated here.

[0115] It should be understood that the various parts disclosed in this application can be implemented using hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics can be combined in any suitable manner in one or more embodiments or examples.

[0116] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0117] This application provides a computer-readable storage medium having computer-readable program instructions (i.e., a computer program) stored thereon, the computer-readable program instructions being used to execute the courier behavior analysis method in the above embodiments.

[0118] The computer-readable storage medium provided in this application may be, for example, a USB flash drive, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems or devices, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system or device. The program code contained on the computer-readable storage medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination thereof.

[0119] The aforementioned computer-readable storage medium may be included in an electronic device or may exist independently without being assembled into an electronic device.

[0120] The aforementioned computer-readable storage medium carries one or more programs. When the aforementioned one or more programs are executed by an electronic device, the electronic device causes the electronic device to: acquire task records generated when the target courier performs each door-to-door verification task; extract features from each of the task records to obtain task features, wherein the task features characterize the execution attributes and result attributes of the door-to-door verification task; construct target behavior indicators for the target courier based on the task features; and determine the abnormal behavior level of the target courier based on the target behavior indicators and a preset baseline indicator.

[0121] Computer program code for performing the operations of this application can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a Local Area Network (LAN) or a Wide Area Network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0122] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0123] The modules described in the embodiments of this application can be implemented in software or hardware. The names of the modules do not necessarily limit the functionality of the unit itself.

[0124] The readable storage medium provided in this application is a computer-readable storage medium that stores computer-readable program instructions (i.e., a computer program) for executing the above-described courier behavior analysis method. This solves the technical problem of how to identify abnormal behavior of couriers performing door-to-door verification tasks, thereby improving the authenticity and compliance of these tasks. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided in this application are the same as those of the courier behavior analysis method provided in the above embodiments, and will not be elaborated upon here.

[0125] This application provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the courier behavior analysis method described above.

[0126] The computer program product provided in this application can identify abnormal behavior of couriers performing door-to-door verification tasks, thereby improving the authenticity and compliance of these tasks. Compared with existing technologies, the beneficial effects of the computer program product provided in this application are the same as those of the courier behavior analysis method provided in the above embodiments, and will not be elaborated upon here.

[0127] The above are merely preferred embodiments of this application and do not limit the patent scope of this application. Any equivalent structural or procedural transformations made using the content of this application's specification and drawings, or direct or indirect applications in other related technical fields, are similarly included within the patent scope of this application.

Claims

1. A method for analyzing courier behavior, characterized in that, The method for analyzing courier behavior includes: Obtain the task records generated by the target courier when performing each door-to-door verification task; Feature extraction is performed on each of the task records to obtain task features, wherein the task features characterize the execution attributes and result attributes of the on-site verification task; Based on the task characteristics, construct the target behavior indicators for the target courier; Based on the target behavior indicators and the preset baseline indicators, the abnormality level of the target courier's behavior is determined.

2. The courier behavior analysis method as described in claim 1, characterized in that, The task records include task review results, task spatiotemporal data, and on-site media data. The step of extracting features from each of the task records to obtain task features includes: Feature extraction is performed on the task review results and spatiotemporal data in each task record to obtain the task-level features of each task record, wherein the task-level features characterize the completion quality of a single on-site verification task. Feature extraction is performed on the spatiotemporal data of each task record to obtain the personal layer features of the target courier, wherein the personal layer features characterize the behavioral trajectory and operational rhythm of the target courier when performing each of the door-to-door verification tasks; Feature extraction is performed on the on-site media data in each of the task records to obtain media layer features, wherein the media layer features characterize the authenticity and compliance of the on-site media data; The task layer features, the personal layer features, and the media layer features are used as task features.

3. The courier behavior analysis method as described in claim 1, characterized in that, The target behavior indicators include temporal behavior indicators and spatial behavior indicators. The temporal behavior indicators include the distribution characteristics of working hours and task intervals, as well as the behavioral differences between holidays and working days. The spatial behavior indicators include location distribution entropy, boundary crossing ratio, and detour frequency.

4. The courier behavior analysis method as described in claim 2, characterized in that, The method further includes: Determine the courier group to which the target courier belongs, and obtain the behavioral indicators of each courier in the courier group. The courier group is divided based on any one of the dimensions of region, shift, or business line. Determine the mean and standard deviation of each behavioral indicator, and use the mean and standard deviation as the baseline indicator.

5. The courier behavior analysis method as described in claim 4, characterized in that, The step of determining the abnormal behavior level of the target courier based on the target behavior indicators and preset baseline indicators includes: Determine the difference between the target behavior indicator and the mean, and divide the difference by the standard deviation to obtain the standardized deviation value; The standardized deviation value is assigned to a preset first level as the abnormal behavior level of the target courier.

6. The courier behavior analysis method as described in claim 4, characterized in that, The personal layer features include movement speed, which is the ratio of the distance between the execution locations of two sequentially adjacent door-to-door verification tasks to the execution time interval. The media layer features include fingerprint repetition rate, which is the proportion of overlap between the fingerprints uploaded by the target courier when performing each door-to-door verification task. The step of determining the abnormal behavior level of the target courier based on the target behavior indicators and preset baseline indicators includes: Determine the difference between the target behavior indicator and the mean, and divide the difference by the standard deviation to obtain the standardized deviation value; Determine whether the moving speed is greater than a first preset threshold and whether the fingerprint repetition rate is higher than a second preset threshold to obtain the determination result; Based on the judgment result and the standardized deviation value, a first comprehensive evaluation value is determined, and the first comprehensive evaluation value corresponds to a preset second level, which is used as the abnormal behavior level of the target courier.

7. The courier behavior analysis method as described in claim 4, characterized in that, The step of determining the abnormal behavior level of the target courier based on the target behavior indicators and preset baseline indicators includes: Determine the difference between the target behavior indicator and the mean, and divide the difference by the standard deviation to obtain the standardized deviation value; The task characteristics are input into a preset analysis model, and the behavior of the target courier is analyzed through the preset analysis model to obtain an anomaly evaluation value; A second comprehensive evaluation value is determined based on the abnormal evaluation value and the standardized deviation value. The second comprehensive evaluation value corresponds to a preset third level, which is used as the abnormal behavior level of the target courier.

8. The courier behavior analysis method as described in claim 6, characterized in that, The step of determining the abnormal behavior level of the target courier based on the target behavior indicators and preset baseline indicators includes: The task characteristics are input into a preset analysis model, and the behavior of the target courier is analyzed through the preset analysis model to obtain an anomaly evaluation value; Based on the abnormal evaluation value, the judgment result, and the standardized deviation value, a third comprehensive evaluation value is determined, and the third comprehensive evaluation value corresponds to a preset fourth level as the abnormal behavior level of the target courier.

9. An electronic device, characterized in that, The electronic device includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the courier behavior analysis method as described in any one of claims 1 to 8.

10. A storage medium, characterized in that, The storage medium is a computer-readable storage medium, and a computer program is stored on the computer-readable storage medium. When the computer program is executed by a processor, it implements the steps of the courier behavior analysis method as described in any one of claims 1 to 8.

Images