Method and device for identifying abnormal air ticket proxy object, and computer program product

Abstract

The invention discloses a method and a device for identifying an abnormal air ticket proxy object and a computer program product. Relates to the field of artificial intelligence, and the method comprises the steps: collecting the air ticket agent data of a to-be-recognized air ticket agent object, extracting a plurality of air ticket agent features from the air ticket agent data, and generating a feature vector set based on the plurality of air ticket agent features; inputting the feature vector set into a clustering model to obtain at least one target classification cluster of the feature vector set and a stability index value of the target classification cluster; determining an air ticket proxy object set corresponding to the target classification cluster, determining a target feature of each air ticket proxy object in the air ticket proxy object set in a preset period, and obtaining a target feature set; and determining an identification result of the to-be-identified air ticket proxy object based on the target feature set and the stability index value. Through the method and the device, the problem of inaccurate identification of the abnormal civil aviation air ticket proxy object in related technologies is solved.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence, and more specifically, to a method, apparatus, and computer program product for identifying abnormal ticket agent objects. Background Technology

[0002] In the air transport industry, ticket agents are a crucial link between airlines and passengers. However, with market expansion and intensified competition, some agents engage in abnormal or illegal activities, such as fraudulent bookings, malicious refunds and changes, or ticket hoarding and speculation. This not only disrupts normal market order but may also lead to wasted flight resources and revenue losses. Therefore, timely and accurate identification of abnormal agents is of great significance and practical value for ensuring airline revenue security, improving market management, and optimizing resource allocation.

[0003] Current technologies for identifying abnormal airline ticket agents primarily rely on human experience and simple rule settings. For example, they might simply count the number of tickets issued and refunded by the agent and calculate the ratio, then rely on experience to determine if any violations have occurred. This method struggles to handle the complexity and diversity of agent behavior, easily leading to missed or false positives. As the scale of agency business continues to expand, manual rule-based methods become inefficient when dealing with massive amounts of transaction data and fail to promptly identify potential risks. Furthermore, the statistical methods in these technologies struggle to capture hidden patterns and dynamic changes in agent behavior, failing to match the complexity of the civil aviation market environment, thus limiting the accuracy and stability of the identification results.

[0004] There is currently no effective solution to the problem of inaccurate identification of abnormal civil aviation ticket agents in related technologies. Summary of the Invention

[0005] The main objective of this application is to provide a method, apparatus, and computer program product for identifying abnormal airline ticket agents, so as to solve the problem of inaccurate identification of abnormal airline ticket agents in related technologies.

[0006] To achieve the above objectives, according to one aspect of this application, a method for identifying abnormal ticket agent objects is provided. The method includes: collecting ticket agent data of the ticket agent object to be identified; extracting multiple ticket agent features from the ticket agent data; generating a feature vector set based on the multiple ticket agent features; inputting the feature vector set into a clustering model to obtain at least one target cluster and a stability index value for the target cluster, wherein the clustering model is trained by a density-based hierarchical clustering algorithm; determining the set of ticket agent objects corresponding to the target cluster; determining the target features of each ticket agent object in the set of ticket agent objects within a preset period to obtain a target feature set, wherein the target features include at least one of the following: total number of refunds, total number of reservations, and total number of tickets; and determining the identification result of the ticket agent object to be identified based on the target feature set and the stability index value.

[0007] Optionally, when the target features include total refunds, total reservations, and total number of tickets, the identification result of the ticket agent to be identified based on the target feature set and stability index value includes: for each ticket agent's target features, calculating the ratio of total refunds to total number of tickets to obtain a refund index value, and calculating the ratio of total reservations to total number of tickets to obtain a reservation index value; calculating the average refund index value of the ticket agent set based on the refund index value of each ticket agent, and calculating the average reservation index value of the ticket agent set based on the reservation index value of each ticket agent; if the average refund index value is greater than or equal to the refund threshold, the average reservation index value is less than or equal to the reservation threshold, and the stability index value is greater than or equal to the first stability threshold, the ticket agent to be identified is identified as an abnormal ticket agent; if the refund index value is less than the refund threshold and the stability index value is greater than or equal to the second stability threshold, or if the reservation index value is greater than the reservation threshold and the stability index value is greater than or equal to the second stability threshold, the ticket agent is identified as a ticket agent without abnormalities.

[0008] Optionally, the clustering model is trained as follows: A set of feature vectors for N ticket agents of the target airline within a preset period is obtained, where N is a positive integer; each feature vector set is defined as a data point, and the mutual reachability distance between each pair of the N data points is calculated. A minimum spanning tree is constructed based on the mutual reachability distance, where the minimum spanning tree is a directed acyclic graph connecting the N data points with edges, and the edge weights represent the mutual reachability distances; a hierarchical clustering tree is constructed based on the minimum spanning tree, and multiple clusters are selected from the hierarchical clustering tree using a preset cluster selection method, where each node in the hierarchical clustering tree represents a cluster; the stability index value of the cluster is calculated based on the mutual reachability distance of the data points within each cluster, and the multiple clusters and the stability index value of each cluster are determined as the trained clustering model.

[0009] Optionally, the method further includes: collecting the total number of tickets for each ticket agent object within a preset period at each target period to obtain N total ticket numbers, calculating the mean and standard deviation of the N total ticket numbers; calculating the ratio of the standard deviation to the mean to obtain the coefficient of variation; determining the updated training samples based on the coefficient of variation, training the clustering model based on the updated training samples, and obtaining the updated clustering model.

[0010] Optionally, determining the updated training samples based on the coefficient of variation includes: if the coefficient of variation is less than or equal to the coefficient threshold, determining the feature vector set for each target period within a preset period, resulting in M ​​feature vector sets, where M is a positive integer; for each feature vector in the feature vector set, calculating the average feature vector of the M feature vector sets, constructing the updated feature vector set from all the average feature vectors, and determining the updated feature vector set as the updated training samples.

[0011] Optionally, determining the updated training samples based on the coefficient of variation includes: if the coefficient of variation is less than or equal to a coefficient threshold, determining the feature vector set for each target period within a preset period, obtaining M feature vector sets, and determining the weight of each feature vector set, wherein the weight of the feature vector set of the target period closer to the current time is higher than the weight of the feature vector set of the target period farther from the current time; for each feature vector in the feature vector set, performing a weighted summation of the feature vectors in the M feature vector sets based on the weight of each feature vector set, obtaining the updated feature vector, and using all the updated feature vectors to form the updated feature vector set, and determining the updated feature vector set as the updated training samples.

[0012] Optionally, after obtaining at least one target classification cluster of the feature vector set and the stability index value of the target classification cluster, the method further includes: if the target classification cluster is noise, or if the stability index value is less than or equal to a third stability threshold, determining the ticket agent object to be identified as an object to be reviewed; issuing a prompt message, wherein the prompt message is used to prompt relevant personnel to review whether the object to be reviewed is an abnormal ticket agent object.

[0013] To achieve the above objectives, according to another aspect of this application, an apparatus for identifying abnormal ticket agent objects is provided. The apparatus includes: a collection unit for collecting ticket agent data of the ticket agent object to be identified, extracting multiple ticket agent features from the ticket agent data, and generating a feature vector set based on the multiple ticket agent features; an input unit for inputting the feature vector set into a clustering model to obtain at least one target cluster of the feature vector set and a stability index value of the target cluster, wherein the clustering model is trained by a density-based hierarchical clustering algorithm; a first determining unit for determining the set of ticket agent objects corresponding to the target cluster, determining the target features of each ticket agent object in the set of ticket agent objects within a preset period, and obtaining a target feature set, wherein the target features include at least one of the following: total number of refunds, total number of reservations, and total number of tickets; and a second determining unit for determining the identification result of the ticket agent object to be identified based on the target feature set and the stability index value.

[0014] To achieve the above objectives, according to another aspect of this application, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps of the abnormal ticket agent object identification method described in various embodiments of this application.

[0015] This application employs the following steps: collecting ticket agency data of the ticket agency object to be identified; extracting multiple ticket agency features from the ticket agency data; generating a feature vector set based on the multiple ticket agency features; inputting the feature vector set into a clustering model to obtain at least one target classification cluster and a stability index value for the target classification cluster, wherein the clustering model is trained by a density-based hierarchical clustering algorithm; determining the set of ticket agency objects corresponding to the target classification cluster; determining the target features of each ticket agency object in the set of ticket agency objects within a preset period to obtain a target feature set, wherein the target features include at least one of the following: total number of refunds, total number of reservations, and total number of tickets; determining the identification result of the ticket agency object to be identified based on the target feature set and the stability index value, thus solving the problem of inaccurate identification of abnormal civil aviation ticket agency objects in related technologies. By automatically identifying the features of ticket agency objects through a density-based hierarchical clustering algorithm, generating classification results based on the identified features by the clustering model, and evaluating the stability index value of the classification results (i.e., the target classification cluster), the reliability of the identification results is ensured, thereby improving the accuracy of identifying abnormal civil aviation ticket agency objects. Attached Figure Description

[0016] The accompanying drawings, which form part of this application, are used to provide a further understanding of this application. The illustrative embodiments and descriptions of this application are used to explain this application and do not constitute an undue limitation of this application. In the drawings:

[0017] Figure 1 This is a flowchart of a method for identifying abnormal ticket agent objects according to an embodiment of this application;

[0018] Figure 2 This is a flowchart of an optional method for identifying abnormal ticket agent objects according to an embodiment of this application;

[0019] Figure 3 This is a schematic diagram of an identification device for abnormal ticket agent objects provided according to an embodiment of this application;

[0020] Figure 4 This is a schematic diagram of an electronic device provided according to an embodiment of this application. Detailed Implementation

[0021] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. This application will now be described in detail with reference to the accompanying drawings and embodiments.

[0022] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0023] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate for the embodiments of this application described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0024] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for display, data used for analysis, etc.) involved in this disclosure are all information and data authorized by the user or fully authorized by all parties.

[0025] It should be noted that the information collected is information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data all comply with the relevant laws, regulations and standards of the relevant regions, necessary confidentiality measures have been taken, and they do not violate public order and good morals. Corresponding operation portals are provided for users to choose to authorize or refuse.

[0026] The present invention will now be described in conjunction with preferred embodiments. Figure 1 This is a flowchart of a method for identifying abnormal ticket agent objects according to an embodiment of this application, such as... Figure 1 As shown, the method includes the following steps:

[0027] Step S101: Collect the ticket agent data of the ticket agent object to be identified, extract multiple ticket agent features from the ticket agent data, and generate a feature vector set based on the multiple ticket agent features.

[0028] In step S101, the ticket agent object can be a ticket agent or a ticket agency. The ticket agent data can include: agent information: agent name, agent city, agent registration time, number of complaints against the agent (times / month); information on a single ticket sold by the agent: reservation date, ticketing date, departure date, departure airport, arrival airport, unique ID of the agent, airline, ticket price, final ticket status (ticketing / refund), rescheduling identifier, domestic and international flight identifier, group identifier, cabin class, discount rate, payment method (private, corporate), unique ID of the passenger in the system, and frequent flyer identifier. Missing values ​​and outliers are handled in the following two ways according to the specific situation of each feature: (1) For categorical features, fill in the default value -1, indicating that the feature value is missing or outlier; (2) For numerical features, find a similar sample in the dataset, and then fill in the outlier or missing value with the corresponding feature value of the sample.

[0029] Because the features contain non-numeric special symbols, such as weekends and holidays, while the model actually needs numerical features, these data are converted into numerical form for encoding, facilitating later algorithm calculations. If the feature values ​​are comparable, they are converted into numerical values ​​based on their relative magnitudes, completing the quantization encoding process. If the feature values ​​are not comparable, and the number of feature categories is not too large, one-hot encoding is used. Afterwards, feature derivation is performed. Based on agent data and the ticket data sold by agents, groups are formed along the agent dimension, and feature derivation is implemented for subsequent clustering model calculations.

[0030] After feature derivation, the features of the ticket agent participating in model training can include: the agent's total turnover in the past three months; the total number of tickets sold by the agent in the past three months (including ticketing, refunds, and changes); the total number of reservations processed by the agent in the past three months; the total number of tickets issued by the agent in the past three months; the total number of refunds by the agent in the past three months; the total amount of tickets issued by the agent in the past three months; the total amount of refunds by the agent in the past three months; the percentage of the total number of tickets issued by the agent in the past three months out of the total number of tickets; the percentage of the total number of refunds by the agent in the past three months out of the total number of tickets; the percentage of the total number of reservations by the agent in the past three months out of the total number of tickets issued; the agent's operating hours; the percentage of the total number of tickets sold by the agent in the past three months from the city where the agent operates (one of the departure and arrival airports of the ticket is the same as the agent's city); and the different airlines on which the agent issued tickets in the past three months. The following data is considered: the number of airlines; the percentage of tickets issued by the agent in each cabin class (first class, business class, economy class) over the past three months; the average discount of tickets issued by the agent over the past three months; the percentage of frequent flyer tickets issued by the agent over the past three months; the percentage of group tickets issued by the agent over the past three months; the percentage of domestic / international tickets issued by the agent over the past three months; the number of different flight segments sold by the agent over the past three months (departure airport - arrival airport to determine a unique flight segment); the average time interval between booking time and ticketing time for the agent over the past three months; the percentage of tickets issued by the agent using different payment methods over the past three months; the number of agents who purchased tickets multiple times (more than five times) using the same passenger ID over the past three months; and the total number of complaints against the agent over the past three months. A feature vector set is generated by combining multiple ticket agent features.

[0031] Step S102: Input the feature vector set into the clustering model to obtain at least one target cluster of the feature vector set and the stability index value of the target cluster. The clustering model is trained by a density-based hierarchical clustering algorithm.

[0032] In step S102, in the scenario of agent risk level classification, agent behavior data has the following characteristics: high dimensionality: it simultaneously includes multiple different features such as ticketing, ticket refund, seat reservation, and agent's own situation; many noise points: some agents have very low business volume or occasional abnormal behavior, which will interfere with the overall clustering effect of traditional clustering models; complex cluster structure: the agent group may have uneven size and significant differences in density (a small number of high-risk agents vs. a large number of normal agents); the number of clusters cannot be determined in advance: although the agent risk level is divided into high, medium and low categories in this case, the number of clusters cannot be determined in advance, and traditional clustering algorithms (K-means, K-clustering) are not applicable. Based on the above agent data characteristics, this embodiment selects the HDBSCAN (Density-Based Hierarchical Clustering) clustering model as the training model, which has the following characteristics and advantages: No need to preset the number of clusters: The HDBSCAN algorithm can automatically determine the optimal cluster structure according to the data distribution, which is suitable for scenarios with unknown number of categories; Density-based cluster partitioning: The HDBSCAN algorithm performs cluster partitioning based on density, which is effective for agent data distributions with high dimensionality and high complexity; Abnormal agents with small turnover will be identified as noise rather than being forcibly classified, and noise can be labeled separately; It can calculate the stability score of categories in clusters, which can reflect the persistence and credibility of different clusters, making it easy to interpret and verify.

[0033] A clustering model trained using a density-based hierarchical declassification algorithm is used to classify the feature vector set of the ticket agent objects to be identified, resulting in at least one target cluster. All points in each target cluster represent a group of ticket agent objects with similar features. Each cluster has a stability index value to represent the quality or reliability of the cluster.

[0034] Step S103: Determine the set of ticket agent objects corresponding to the target classification cluster, determine the target features of each ticket agent object in the set of ticket agent objects within a preset period, and obtain the target feature set, wherein the target features include at least one of the following: total number of refunds, total number of reservations, and total number of tickets.

[0035] In step S103, the preset period can be three months. Based on the target classification clusters output by the clustering model, the members corresponding to the data points in the target classification clusters are identified to obtain a set of ticket agent objects. For the set of ticket agent objects, target feature values ​​within the preset period are calculated, including but not limited to: Total refunds: The total number of all refund events within the preset period, reflecting the agent's refund frequency or customer satisfaction. Total bookings: The total number of bookings processed by the agent within the period, measuring their business activity and booking efficiency. Total number of tickets: The total number of tickets sold by the agent within this period, reflecting their sales ability and market share.

[0036] Step S104: Determine the identification result of the ticket agent object to be identified based on the target feature set and stability index value.

[0037] In step S104, the reliability and effectiveness of each target cluster are evaluated based on the stability index value output by the clustering model. Clusters with higher stability index values ​​indicate more accurate classification results. For the ticket agent to be identified, its target cluster is confirmed. The agent is mapped to the cluster with the most representative features. Using the target feature set, the characteristics of the agent in each cluster, such as the total number of refunds, total number of reservations, and total number of tickets within a preset period, are analyzed to characterize the differences in the agent's performance at the business level, such as which agents tend to have high sales but high refund rates, and which agents have stable reservation numbers. Combining the stability index value and the target feature performance, the agent is comprehensively evaluated to determine the final identification result. The identification result may include the agent's risk level and whether it is an abnormal agent.

[0038] The method for identifying abnormal airline ticket agents provided in this application collects airline ticket agent data of the airline ticket agent to be identified, extracts multiple airline ticket agent features from the data, and generates a feature vector set based on these features. The feature vector set is then input into a clustering model to obtain at least one target cluster and a stability index value for the target cluster. The clustering model is trained using a density-based hierarchical clustering algorithm. The method determines the set of airline ticket agents corresponding to the target cluster, and identifies the target features of each airline ticket agent within the set within a preset period, resulting in a target feature set. The target features include at least one of the following: total refunds, total reservations, and total number of tickets. Based on the target feature set and the stability index value, the method determines the identification result of the airline ticket agent to be identified, thus solving the problem of inaccurate identification of abnormal airline ticket agents in related technologies. By automatically identifying the features of airline ticket agents using a density-based hierarchical clustering algorithm, and generating classification results based on the identified features using a clustering model, the reliability of the identification results is ensured by evaluating the stability index value of the classification results, i.e., the target cluster, thereby improving the accuracy of identifying abnormal airline ticket agents.

[0039] The identification result can be determined based on the refund index value, reservation index value, and stability index value. Optionally, in the method for identifying abnormal ticket agent objects provided in this application embodiment, when the target features include the total number of refunds, the total number of reservations, and the total number of tickets, determining the identification result of the ticket agent object to be identified based on the target feature set and the stability index value includes: for each ticket agent object's target features, calculating the ratio of the total number of refunds to the total number of tickets to obtain the refund index value; calculating the ratio of the total number of reservations to the total number of tickets to obtain the reservation index value; and calculating the average refund rate of the ticket agent object set based on the refund index value of each ticket agent object. The ticket indicator value is calculated based on the average reservation indicator value of the set of ticket agent objects. If the average refund indicator value is greater than or equal to the refund threshold, the average reservation indicator value is less than or equal to the reservation threshold, and the stability indicator value is greater than or equal to the first stability threshold, the ticket agent object to be identified is determined to be an abnormal ticket agent object. If the refund indicator value is less than the refund threshold and the stability indicator value is greater than or equal to the second stability threshold, or if the reservation indicator value is greater than the reservation threshold and the stability indicator value is greater than or equal to the second stability threshold, the ticket agent object is determined to be a normal ticket agent object.

[0040] In some embodiments, the ratio of the total number of refunds to the total number of tickets within a preset period is calculated to obtain the refund index value. This reflects the refund frequency of the agency; a high refund index value indicates that the agency is facing customer relationship management or service quality issues. The ratio of the total number of reservations to the total number of tickets within the preset period is calculated to obtain the reservation index. This characterizes the booking efficiency and customer attractiveness of the agency. A low reservation index value indicates that the agency has problems in the booking process or a weak customer base. To classify agencies into abnormal and normal categories, refund thresholds and reservation thresholds are set. These thresholds can be determined based on historical data, industry standards, and business objectives to ensure the rationality and effectiveness of the identification results.

[0041] If the average refund metric value of the agent object set is greater than or equal to the refund threshold, and the average reservation metric value is less than or equal to the reservation threshold, while the stability metric value of the clustering model is greater than or equal to the first stability threshold, then the agent objects in this set will be marked as abnormal ticket agent objects. Conversely, if the refund metric value is lower than the refund threshold, and the stability metric value of its cluster is greater than or equal to the second stability threshold, or its reservation metric value is higher than the reservation threshold, and the stability metric values ​​are also met, then the agent object is determined to be a normal ticket agent object. The thresholds vary depending on the flight season.

[0042] This embodiment achieves automatic mapping from clusters to risk levels (high / medium / low / pending confirmation) by statistically analyzing the risk characteristics of clusters (such as ticket issuance rate, refund rate, sales volatility, etc.) and introducing rules for result analysis. It has high interpretability, facilitating understanding and use by business personnel and related practitioners. The stability assessment value output by HDBSCA provides a quantitative basis for the reliability of the clustering results. Clusters with high stability can be directly mapped to specific risk levels, while clusters with low stability are added to the monitoring directory to avoid misjudgment.

[0043] To more accurately identify abnormal ticket agents, a clustering model needs to be trained. Optionally, in the method for identifying abnormal ticket agents provided in this application embodiment, the clustering model is trained in the following way: A set of feature vectors of N ticket agents of the target airline within a preset period is obtained, where N is a positive integer; each feature vector set is defined as a data point, and the mutual reachability distance between each pair of the N data points is calculated. A minimum spanning tree is constructed based on the mutual reachability distance, where the minimum spanning tree is a directed acyclic graph connecting the N data points through edges, and the weight of the edges represents the mutual reachability distance; a hierarchical clustering tree is constructed based on the minimum spanning tree, and multiple clusters are selected from the hierarchical clustering tree using a preset cluster selection method, where each node in the hierarchical clustering tree represents a cluster; the stability index value of the cluster is calculated based on the mutual reachability distance of the data points within each cluster, and the multiple clusters and the stability index value of each cluster are determined as the trained clustering model.

[0044] In some embodiments, the input samples used to train the model are a set of feature vectors of airline ticket agents after feature engineering:

[0045] ;

[0046] Where n is the number of ticket agent objects after statistics, and d is the feature dimension. Each element in the set represents a point in the clustering model. First, density reachability is calculated, defining the core distance for each point x, which is the distance from that point to its k-th nearest neighbor: Based on core distance, the mutual reachable distance between two points x and y is defined as follows:

[0047] ;

[0048] Constructing the Minimum Spanning Tree (MST): Using the distances between all vertices as edge weights, construct a weighted complete graph and extract its minimum spanning tree. Next, construct a hierarchical clustering tree: progressively divide the MST from the previous step according to distance thresholds, forming a hierarchical clustering structure from dense to sparse. Then, perform cluster stability analysis: calculate the stability index value for each candidate cluster.

[0049] ;

[0050] Where C represents a cluster, and p represents a point within the cluster. Let represent the density level when point p joins cluster C, and let represent the density level when point p leaves cluster C. The larger the value, the greater the contribution of point p to the stability of cluster C. Density parameter level: Defines the density measure of a point in the clustering process; the smaller the distance, the higher the density. The larger it is, the formula is as follows:

[0051] ;

[0052] It should be noted that the following parameters need to be set in the HDBSCAN model: min_cluster_size: the minimum size of the cluster, used to limit the minimum number of agents; min_samples: controls the strictness of noise identification; the larger the value, the more noise points there are; metric: the distance calculation method, commonly used methods include Euclidean distance, Manhattan distance, and cosine similarity; cluster_selection_method: the default is EMO (Extraction Method for Outliers). The HDBSCAN model outputs the following results: ClusterLabels: the labels of the agents after clustering; points marked as -1 are considered noise points; MembershipProbability: indicates the certainty that each agent belongs to its cluster, ranging from [0, 1]. Low probability values ​​mean that the agent is in an marginal state and has uncertainty risk; ClusterStabilityScore: reflects the reliability of the cluster, i.e., the stability index value. After experimental debugging, the final parameters of the HDBSCAN clustering model are shown in Table 1.

[0053] Table 1

[0054]

[0055] In the evaluation phase of the HDBSCAN clustering model, traditional clustering evaluation metrics (such as silhouette coefficient) are unsuitable for evaluating the HDBSCAN clustering model for the following reasons: Conventional clustering metrics assume convex and uniform cluster distribution, which is incompatible with HDBSCAN's arbitrary cluster shapes and varying densities; conventional metrics require each point to belong to a cluster, failing to address noise points identified in the HDBSCAN model; conventional metrics only evaluate static partitions, failing to reflect the hierarchical structure and cluster stability of HDBSCAN; and HDBSCAN aims to identify reliable clusters while allowing for noise, whereas traditional metrics focus on overall partitioning, leading to inconsistent evaluation objectives. Therefore, based on these reasons, this embodiment uses cluster stability analysis as the metric for evaluating the HDBSCAN clustering model.

[0056] This embodiment employs the HDBSCAN clustering model, which can automatically discover different risk patterns within a group of agents without requiring a pre-defined number of clusters. HDBSCAN has a natural ability to identify and eliminate noise points. The model can simultaneously capture both small-scale but high-risk agent groups and large-scale normal agent groups, improving the accuracy of risk stratification.

[0057] To ensure the accuracy of the clustering model classification, it needs to be updated regularly. Optionally, in the method for identifying abnormal ticket agent objects provided in this application embodiment, the method further includes: collecting the total number of tickets for each ticket agent object within a preset period every target period to obtain N total ticket numbers, calculating the mean and standard deviation of the N total ticket numbers; calculating the ratio of the standard deviation to the mean to obtain the coefficient of variation; determining the updated training samples based on the coefficient of variation, and training the clustering model based on the updated training samples to obtain the updated clustering model.

[0058] In some embodiments, the target period can be one month. The clustering model in this embodiment is automatically updated monthly, using the agent's business characteristics over the past three months as the model input samples. Considering that agent behavior may fluctuate over time, to balance data stability and timeliness, the following feature-weighted update strategy is used: Calculation of the coefficient of variation (CV) of total tickets sold: For each agent, calculate the CV of the total number of tickets sold (tickets issued, refunds, and reschedules) for each of the past three months:

[0059] ;

[0060] in, This represents the standard deviation of the agent's total ticket sales over the past three months. This is the average of the total number of tickets sold by the agent over the past three months.

[0061] This embodiment, by regularly updating the clustering model, can not only capture the long-term trend of the business volume of the proxy object, but also quickly respond to short-term fluctuations, ensuring the accuracy and timeliness of the model.

[0062] Optionally, in the method for identifying abnormal ticket agent objects provided in this application embodiment, determining the updated training samples based on the coefficient of variation includes: when the coefficient of variation is less than or equal to the coefficient threshold, determining the feature vector set for each target period within a preset period to obtain M feature vector sets, where M is a positive integer; for each feature vector in the feature vector set, calculating the average feature vector of the M feature vector sets, and constructing the updated feature vector set from all the average feature vectors, and determining the updated feature vector set as the updated training samples.

[0063] In some embodiments, a threshold D for the coefficient of variation is pre-set. If CV ≤ D, it indicates that the agent's fluctuations over the past three months are small; conversely, larger fluctuations indicate stronger representativeness of recent data, which should be assigned higher weight. If CV ≤ D, each feature in the feature engineering step is calculated using an equal-weighted average, i.e.:

[0064] ;

[0065] in, It is the feature vector set of the most recent third month. It is the feature vector set of the second most recent month. It is the set of feature vectors for the most recent month.

[0066] This embodiment introduces a time-weighted strategy based on the coefficient of variation (CV), which can automatically adjust the weighting of data from the past three months according to the fluctuation of agent business characteristics over the three-month period. This strategy achieves a dynamic balance between stability and timeliness, providing a solid data foundation for subsequent automatic model updates.

[0067] Optionally, in the method for identifying abnormal ticket agent objects provided in this application embodiment, determining the updated training samples based on the coefficient of variation includes: when the coefficient of variation is less than or equal to a coefficient threshold, determining the feature vector set for each target period within a preset period to obtain M feature vector sets, and determining the weight of each feature vector set, wherein the weight of the feature vector set of the target period closer to the current time is higher than the weight of the feature vector set of the target period farther from the current time; for each feature vector in the feature vector set, performing a weighted summation of the feature vectors in the M feature vector sets based on the weight of each feature vector set to obtain an updated feature vector, and using all the updated feature vectors to form an updated feature vector set, and determining the updated feature vector set as the updated training samples.

[0068] In some embodiments, if CV > D, then each feature in the feature engineering step is calculated using an incrementally weighted approach, with the most recent month's data having the highest weight, followed by the previous month, and the earliest month having the lowest weight, i.e.:

[0069] ;

[0070] in, + + =1.

[0071] This embodiment inputs the processed features into the HDBSCAN clustering model for automatic training, which is performed monthly to obtain a new clustering model and update the most recent risk level of each agent. A time-weighted strategy based on the coefficient of variation (CV) is introduced, which automatically adjusts the weighting of the data from the past three months according to the fluctuation of the agent's business characteristics over the three-month period. This strategy achieves a dynamic balance between stability and timeliness, providing a solid data foundation for subsequent automatic model updates.

[0072] For ticket agent objects with low stability index values ​​or identified as noise, a prompt message is issued to remind manual review. Optionally, in the method for identifying abnormal ticket agent objects provided in this application embodiment, after obtaining at least one target classification cluster of the feature vector set and the stability index value of the target classification cluster, the method further includes: if the target classification cluster is noise, or if the stability index value is less than or equal to a third stability threshold, determining the ticket agent object to be identified as an object to be reviewed; issuing a prompt message, wherein the prompt message is used to remind relevant personnel to review whether the object to be reviewed is an abnormal ticket agent object.

[0073] In some embodiments, agent categories that simultaneously meet the following rules are marked as agents to be identified: a. noise identified by the HDBSCAN clustering model; b. cluster stability index value ≤ third stability threshold. The threshold varies for different flight seasons. After screening out noisy agents and low-stability agents and marking them, they enter the subsequent observation stage for continuous monitoring or manual review.

[0074] This embodiment incorporates human judgment into the automatic clustering algorithm, enhancing the model's accuracy and flexibility in identifying complex or rare anomalous behaviors. By marking proxy objects in low-stability or noisy clusters as pending audits, potentially high-risk proxies can be identified earlier, allowing for timely measures to avoid financial losses or damage to brand image. Simultaneously, resource allocation is optimized, reducing the likelihood of misjudging legitimate proxies.

[0075] According to another embodiment of this application, an optional method for identifying abnormal ticket agent objects is also provided. Figure 2 This is a flowchart of an optional method for identifying abnormal ticket agent objects provided according to an embodiment of this application. For example... Figure 2 As shown, the method includes: data acquisition: collecting relevant data on civil aviation ticket agents; feature engineering: performing data preprocessing, feature construction, and training set generation on the data; model selection: selecting the HDBSCAN clustering model as the algorithm model for classifying agent risk levels based on the risk level distribution of civil aviation ticket agents; model training: setting parameters, training the model, and tuning parameters to obtain the final optimal clustering model; result evaluation: evaluating the clustering results after clustering to ensure the stability of the classification; result analysis: mapping the risk level of automatically generated clusters by analyzing the data characteristics and anomaly indicators of each cluster to ensure the rationality of the risk classification corresponding to each cluster; model update: updating the clustering model using a sliding window mechanism to dynamically identify and update different agent categories based on the temporal changes in agent business behavior.

[0076] This embodiment presents an optional method for identifying abnormal ticket agents. Tailored to the specific business scenarios of civil aviation ticket agents, it categorizes agents into high, medium, and low risk levels based on ticket volume, reservation volume, and related business behavior characteristics, enabling direct risk level determination. This method can be used for risk control strategy formulation and real-time anomaly warning. Secondly, it employs the HDBSCAN unsupervised clustering method, automatically identifying potential risk patterns without relying on large amounts of labeled data, reducing data preparation costs and improving the interpretability of model results. This facilitates understanding, verification, and strategy optimization by risk control personnel. Thirdly, by introducing a sliding time window, it can capture the dynamic changes in agent behavior across different time periods, enabling real-time updates and tracking of risk levels, thus allowing for rapid response to the emergence of abnormal behavior. Combining industry relevance, dynamism, and interpretability, this method provides an efficient and reliable technical means for agent risk management in the civil aviation industry, demonstrating significant operability and practical value in real-world applications.

[0077] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0078] This application also provides a device for identifying abnormal ticket agent objects. It should be noted that this device can be used to execute the method for identifying abnormal ticket agent objects provided in this application. The following describes the device for identifying abnormal ticket agent objects provided in this application.

[0079] Figure 3This is a schematic diagram of an identification device for abnormal ticket agent objects provided according to an embodiment of this application. Figure 3 As shown, the device includes:

[0080] The acquisition unit 301 is used to acquire the ticket agent data of the ticket agent object to be identified, extract multiple ticket agent features from the ticket agent data, and generate a feature vector set based on the multiple ticket agent features;

[0081] Input unit 302 is used to input the feature vector set into the clustering model to obtain at least one target cluster of the feature vector set and the stability index value of the target cluster, wherein the clustering model is trained by a density-based hierarchical clustering algorithm;

[0082] The first determining unit 303 is used to determine the set of ticket agent objects corresponding to the target classification cluster, determine the target features of each ticket agent object in the set of ticket agent objects within a preset period, and obtain a set of target features, wherein the target features include at least one of the following: total number of refunds, total number of reservations, and total number of tickets;

[0083] The second determining unit 304 is used to determine the identification result of the ticket agent object to be identified based on the target feature set and stability index value.

[0084] The abnormal ticket agent object identification device provided in this application embodiment collects ticket agent data of the ticket agent object to be identified by the acquisition unit 301, extracts multiple ticket agent features from the ticket agent data, and generates a feature vector set based on the multiple ticket agent features; the input unit 302 inputs the feature vector set into a clustering model to obtain at least one target classification cluster of the feature vector set and a stability index value of the target classification cluster, wherein the clustering model is trained by a density-based hierarchical clustering algorithm; the first determination unit 303 determines the set of ticket agent objects corresponding to the target classification cluster, and determines the status of each ticket agent object in the set within a preset period. The target features are obtained by obtaining a set of target features, wherein the target features include at least one of the following: total number of refunds, total number of reservations, and total number of tickets; the second determining unit 304 determines the identification result of the ticket agent object to be identified based on the set of target features and the stability index value, which solves the problem of inaccurate identification of abnormal civil aviation ticket agents in related technologies. The characteristics of the ticket agent object are automatically identified by a density-based hierarchical clustering algorithm, and the clustering model generates a classification result based on the identified features. By evaluating the stability index value of the classification result, i.e., the target classification cluster, the reliability of the identification result is ensured, thereby improving the accuracy of identifying abnormal civil aviation ticket agents.

[0085] Optionally, in the abnormal ticket agent object identification device provided in this application embodiment, the second determining unit 304 includes: a first calculation module, used to calculate the ratio of the total number of refunds to the total number of tickets for each ticket agent object's target characteristics to obtain a refund index value, and calculate the ratio of the total number of reservations to the total number of tickets to obtain a reservation index value; a second calculation module, used to calculate the average refund index value of the ticket agent object set based on the refund index value of each ticket agent object, and calculate the average reservation index value of the ticket agent object set based on the reservation index value of each ticket agent object; a first determining module, used to determine the ticket agent object to be identified as an abnormal ticket agent object when the average refund index value is greater than or equal to the refund threshold, the average reservation index value is less than or equal to the reservation threshold, and the stability index value is greater than or equal to the first stability threshold; a second determining module, used to determine the ticket agent object as a normal ticket agent object when the refund index value is less than the refund threshold and the stability index value is greater than or equal to the second stability threshold, or when the reservation index value is greater than the reservation threshold and the stability index value is greater than or equal to the second stability threshold.

[0086] Optionally, in the abnormal ticket agent object identification device provided in this application embodiment, the clustering model is trained in the following manner: A set of feature vectors of N ticket agents of the target airline within a preset period is obtained, where N is a positive integer; each feature vector set is defined as a data point, and the mutual reachability distance between each pair of the N data points is calculated. A minimum spanning tree is constructed based on the mutual reachability distance, where the minimum spanning tree is a directed acyclic graph connecting the N data points through edges, and the weight of the edges represents the mutual reachability distance; a hierarchical clustering tree is constructed based on the minimum spanning tree, and multiple classification clusters are selected from the hierarchical clustering tree using a preset cluster selection method, where each node in the hierarchical clustering tree represents a cluster; the stability index value of the classification cluster is calculated based on the mutual reachability distance of the data points within each classification cluster, and the multiple classification clusters and the stability index value of each classification cluster are determined as the trained clustering model.

[0087] Optionally, in the abnormal ticket agent object identification device provided in the embodiments of this application, the device further includes: a first calculation unit, used to collect the total number of tickets for each ticket agent object within a preset period at every target period, to obtain N total ticket numbers, and to calculate the mean and standard deviation of the N total ticket numbers; a second calculation unit, used to calculate the ratio of the standard deviation to the mean, to obtain the coefficient of variation; and a training unit, used to determine the updated training samples based on the coefficient of variation, and to train a clustering model based on the updated training samples, to obtain the updated clustering model.

[0088] Optionally, in the abnormal ticket agent object identification device provided in this application embodiment, the training unit includes: a third determining module, used to determine the feature vector set of each target period within a preset period when the coefficient of variation is less than or equal to the coefficient threshold, to obtain M feature vector sets, where M is a positive integer; and a third calculation module, used to calculate the average feature vector of the M feature vector sets for each feature vector in the feature vector sets, to form an updated feature vector set by all the average feature vectors, and to determine the updated feature vector set as the updated training sample.

[0089] Optionally, in the abnormal ticket agent object identification device provided in this application embodiment, the training unit includes: a fourth determining module, used to determine the feature vector set of each target period within a preset period when the coefficient of variation is less than or equal to the coefficient threshold, to obtain M feature vector sets, and to determine the weight of each feature vector set, wherein the weight of the feature vector set of the target period closer to the current time is higher than the weight of the feature vector set of the target period farther from the current time; and a summing module, used to perform weighted summation of the feature vectors in the M feature vector sets based on the weight of each feature vector set for each feature vector in the feature vector set, to obtain an updated feature vector, and to form an updated feature vector set by all the updated feature vectors, and to determine the updated feature vector set as the updated training sample.

[0090] Optionally, in the abnormal ticket agent object identification device provided in the embodiments of this application, the device further includes: a third determining unit, used to determine the ticket agent object to be identified as an object to be reviewed when the target classification cluster is noise, or when the stability index value is less than or equal to a third stability threshold; and a prompting unit, used to issue a prompting message, wherein the prompting message is used to prompt relevant personnel to review whether the object to be reviewed is an abnormal ticket agent object.

[0091] The device for identifying abnormal ticket agents includes a processor and a memory. The aforementioned acquisition unit 301, input unit 302, first determination unit 303, and second determination unit 304 are all stored in the memory as program units. The processor executes the aforementioned program units stored in the memory to achieve the corresponding functions.

[0092] The processor contains a kernel, which retrieves the corresponding program units from memory. One or more kernels can be configured, and adjusting kernel parameters can improve the accuracy of identifying abnormal airline ticket agents.

[0093] The memory may include non-permanent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0094] This invention provides a computer-readable storage medium storing a program that, when executed by a processor, implements a method for identifying abnormal ticket agent objects.

[0095] This invention provides a processor for running a program, wherein the program executes a method for identifying abnormal ticket agent objects during runtime.

[0096] Figure 4 This is a schematic diagram of an electronic device provided according to an embodiment of this application. For example... Figure 4 As shown, electronic device 401 includes a processor, a memory, and a program stored in the memory and executable on the processor. When the processor executes the program, it implements the following steps: a method for identifying abnormal ticket agent objects. The device in this document can be a server, PC, PAD, mobile phone, etc.

[0097] This application also provides a computer program product that, when executed on a data processing device, is suitable for executing a program with the following initialization steps: a method for identifying abnormal ticket agent objects.

[0098] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0099] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0100] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0101] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0102] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0103] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0104] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0105] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0106] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0107] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A method for identifying abnormal ticket agent objects, characterized in that, include: Collect ticket agent data of the ticket agent object to be identified, extract multiple ticket agent features from the ticket agent data, and generate a feature vector set based on the multiple ticket agent features; The feature vector set is input into a clustering model to obtain at least one target cluster of the feature vector set and a stability index value of the target cluster, wherein the clustering model is trained by a density-based hierarchical clustering algorithm; Determine the set of ticket agent objects corresponding to the target classification cluster, determine the target features of each ticket agent object in the set of ticket agent objects within a preset period, and obtain a set of target features, wherein the target features include at least one of the following: total number of ticket refunds, total number of seat reservations, and total number of tickets; The identification result of the ticket agent to be identified is determined based on the target feature set and the stability index value.

2. The method according to claim 1, characterized in that, When the target features include the total number of refunds, the total number of reservations, and the total number of tickets, the identification result of the ticket agent to be identified based on the target feature set and the stability index value includes: For each ticket agent's target characteristics, calculate the ratio of the total number of refunds to the total number of tickets to obtain the refund index value; calculate the ratio of the total number of reservations to the total number of tickets to obtain the reservation index value. Calculate the average refund index value of the set of ticket agents based on the refund index value of each ticket agent, and calculate the average reservation index value of the set of ticket agents based on the reservation index value of each ticket agent. If the average refund index value is greater than or equal to the refund threshold, the average reservation index value is less than or equal to the reservation threshold, and the stability index value is greater than or equal to the first stability threshold, the ticket agent to be identified is determined to be an abnormal ticket agent. If the refund indicator value is less than the refund threshold and the stability indicator value is greater than or equal to the second stability threshold, or if the reservation indicator value is greater than the reservation threshold and the stability indicator value is greater than or equal to the second stability threshold, the ticket agent object is determined to be a ticket agent object without abnormalities.

3. The method according to claim 1, characterized in that, The clustering model is trained in the following way: Obtain the feature vector set of N ticket agent objects of the target airline within the preset period, where N is a positive integer; Each feature vector set is defined as a data point. The mutual reachability distance between each pair of N data points is calculated. A minimum spanning tree is constructed based on the mutual reachability distance. The minimum spanning tree is a directed acyclic graph that connects the N data points through edges. The weight of the edge represents the mutual reachability distance. A hierarchical clustering tree is constructed based on the minimum spanning tree. Multiple classification clusters are selected from the hierarchical clustering tree using a preset cluster selection method. Each node in the hierarchical clustering tree represents a cluster. The stability index value of the classification cluster is calculated based on the mutual reachability distance of data points within each classification cluster, and the multiple classification clusters and the stability index value of each classification cluster are determined as the trained clustering model.

4. The method according to any one of claims 1-3, characterized in that, The method further includes: Every target period, the total number of tickets for each ticket agent object within the preset period is collected to obtain N total ticket counts, and the mean and standard deviation of the N total ticket counts are calculated; The coefficient of variation is obtained by calculating the ratio of the standard deviation to the mean. The updated training samples are determined based on the coefficient of variation, and the clustering model is trained based on the updated training samples to obtain the updated clustering model.

5. The method according to claim 4, characterized in that, The updated training samples are determined based on the coefficient of variation, including: When the coefficient of variation is less than or equal to the coefficient threshold, the feature vector set for each target period within the preset period is determined, resulting in M ​​feature vector sets, where M is a positive integer; For each feature vector in the feature vector set, calculate the average feature vector of the M feature vector sets, and construct an updated feature vector set from all the average feature vectors. The updated feature vector set is then determined as the updated training sample.

6. The method according to claim 4, characterized in that, The updated training samples are determined based on the coefficient of variation, including: When the coefficient of variation is less than or equal to the coefficient threshold, the feature vector set of each target period within the preset period is determined to obtain M feature vector sets, and the weight of each feature vector set is determined, wherein the weight of the feature vector set of the target period closer to the current time is higher than the weight of the feature vector set of the target period farther from the current time. For each feature vector in the feature vector set, the feature vectors in the M feature vector sets are weighted and summed based on the weights of each feature vector set to obtain an updated feature vector. All the updated feature vectors constitute an updated feature vector set, and the updated feature vector set is determined as the updated training sample.

7. The method according to claim 1, characterized in that, After obtaining at least one target classification cluster of the feature vector set and the stability index value of the target classification cluster, the method further includes: If the target classification cluster is noise, or if the stability index value is less than or equal to the third stability threshold, the ticket agent object to be identified will be determined as an object to be reviewed. A notification message is issued, which is used to prompt relevant personnel to verify whether the object to be verified is an abnormal ticket agent.

8. A device for identifying abnormal ticket agent objects, characterized in that, include: The acquisition unit is used to acquire ticket agent data of the ticket agent object to be identified, extract multiple ticket agent features from the ticket agent data, and generate a feature vector set based on the multiple ticket agent features; An input unit is used to input the feature vector set into a clustering model to obtain at least one target cluster of the feature vector set and a stability index value of the target cluster, wherein the clustering model is trained by a density-based hierarchical clustering algorithm; The first determining unit is used to determine the set of ticket agent objects corresponding to the target classification cluster, determine the target features of each ticket agent object in the set of ticket agent objects within a preset period, and obtain a set of target features, wherein the target features include at least one of the following: total number of refunds, total number of reservations, and total number of tickets; The second determining unit is used to determine the identification result of the ticket agent object to be identified based on the target feature set and the stability index value.

9. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the method for identifying abnormal ticket agent objects as described in any one of claims 1 to 7.

10. An electronic device, characterized in that, It includes one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement the method for identifying abnormal ticket agent objects as described in any one of claims 1 to 7.

Images