Order abnormal behavior identification method and device based on multi-source data cross validation

Abstract

The invention discloses an order abnormal behavior identification method and device based on multi-source data cross validation, and belongs to the technical field of data processing and risk control. The method aims to solve the problem that the prior art depends on single-dimensional threshold judgment and is low in complex cheating behavior recognition precision. The method comprises the following core steps: acquiring data from a plurality of independent data source systems based on order identifiers and carrying out time alignment; calculating multi-dimensional differences among the systems in space, time and trajectory consistency; normalizing the differences and fusing the differences into a system pair comprehensive score; constructing an inter-system conflict matrix according to the score, and generating an order comprehensive conflict score through weighted aggregation; and finally, determining a risk level according to the score and executing corresponding risk control disposal. The key innovation of the method is that the conflict matrix is introduced to carry out structured modeling on multi-system inconsistency, a track consistency difference index is designed to accurately identify track counterfeiting, and automatic and high-precision hierarchical risk management is realized.

Description

Technical Field

[0001] This invention relates to the field of data processing and risk control technology, specifically to a method and apparatus for identifying abnormal order behavior based on multi-source data cross-validation. Background Technology

[0002] In ride-hailing service platforms, the complete service process information for a single order is recorded across multiple independent business systems. For example, the vehicle's actual travel trajectory is recorded by the GPS system; the passenger's pick-up and drop-off locations and times are recorded by the order system; the platform's order dispatch instructions are recorded by the dispatch system; and the final mileage and duration used for settlement are calculated by the billing system based on its recognized trajectory. Due to clock differences between systems, data transmission delays, network anomalies, and potential fraudulent activities (such as drivers using technical means to virtually locate themselves to accept orders or modify pick-up and drop-off points to inflate fees), different systems may record the same business fact (such as the exact location and time of the "pick-up" event) inconsistently.

[0003] Currently common risk control methods mainly rely on single-dimensional threshold judgments (e.g., only judging whether the GPS-reported location is within a fixed distance of the order location) or inefficient post-event manual spot checks. These methods have significant drawbacks: First, they cannot comprehensively utilize data from multiple systems for cross-validation, and their single-dimensional identification leads to insufficient ability to identify complex fraudulent methods such as virtual trajectories and jump points, resulting in high false positive and false negative rates. Second, risk assessment rules are usually static and rigid, unable to adaptively adjust to changes in business or new fraudulent patterns. Finally, there is a lack of a quantitative and comprehensive evaluation system to objectively reflect the overall abnormal risk level of orders, which is detrimental to the refinement of automated risk control decisions.

[0004] Therefore, there is an urgent need for a technical solution that can automatically integrate multi-system and multi-dimensional data, and achieve high-precision, adaptive anomaly identification through structured quantitative modeling and comprehensive scoring. Summary of the Invention

[0005] To address this, this application provides a method and apparatus for identifying abnormal order behavior based on cross-validation of multi-source data. This method aims to overcome the problems of existing methods that rely on static threshold rules of a single dimension or inefficient manual sampling, which cannot comprehensively utilize multi-source data for cross-validation and quantitative modeling, resulting in low accuracy and poor adaptability in identifying complex abnormal behaviors.

[0006] To achieve the above objectives, this application adopts the following technical solution: Firstly, this application provides a method for identifying abnormal order behavior based on multi-source data cross-validation, including: Obtain the order identifier of the target order; based on the order identifier, obtain relevant data of the target order from at least two independent data source systems; the relevant data of the target order includes at least event location data, time point data, and spatial trajectory sequence data; the data source systems include at least: a location data system, an order system, a scheduling system, and a billing system; The time information contained in the relevant data of the target order is corrected and unified to the same time reference system; Based on the data from a unified time reference system, the difference values ​​between any two independent data source systems on a preset dimension are calculated to obtain a set of difference indicators; the preset dimension includes at least: spatial distance difference calculated based on the location of the event, time offset difference calculated based on the time of the event, and consistency difference calculated based on the service process trajectory; the set of difference indicators includes: spatial distance difference indicator, time difference indicator, and trajectory consistency difference indicator. The difference indicators in the set of difference indicators are normalized respectively, and the results of the normalization are weighted and fused to obtain a comprehensive difference score. The multiple data source systems participating in the verification are sorted, and a square matrix is ​​constructed as the conflict matrix with the number of systems as the order. The i-th row and i-th column of the square matrix correspond to the same data source system, and the element located at the i-th row and j-th column corresponds to the system pair consisting of the i-th system and the j-th system. The value of this element is assigned by the comprehensive difference score of the system pair. Then, the conflict matrix is ​​aggregated and calculated according to the pre-configured weight matrix to generate a comprehensive order conflict score. The comprehensive conflict score is compared with multiple preset risk threshold ranges to determine the risk level of the target order, and risk control actions are performed in accordance with the risk level.

[0007] Furthermore, the calculation process for the consistency difference includes: Obtain the first spatial trajectory sequence of the billing system and the second spatial trajectory sequence of the positioning data system; For each trajectory point in the first spatial trajectory sequence, select the matching point in the second spatial trajectory sequence that is closest in time or has the smallest spatial distance; Calculate the average geographical distance between all matching point pairs as the average offset distance; Calculate the total length of the first spatial trajectory sequence and the second spatial trajectory sequence respectively, and calculate the absolute value of the difference between the two as the total mileage difference; Identify abnormal trajectory segments in the first spatial trajectory sequence and calculate the proportion of the total length of the abnormal trajectory segments to the total length of the first spatial trajectory sequence as the proportion of abnormal velocity segments; The average offset distance, total mileage difference, and abnormal speed segment ratio are respectively input into a preset normalization function for mapping to obtain the corresponding first normalized value, second normalized value, and third normalized value. Using the first normalized value, the second normalized value, and the third normalized value, the conflict score of the consistency difference is obtained according to the preset conflict score formula for consistency difference. The preset formula for calculating the conflict score of consistency differences is as follows: (1) Wherein, S1, S2, and S3 are the first normalized value, the second normalized value, and the third normalized value, respectively. Uniform value, Let be the weight coefficient, and satisfy... .

[0008] Further, identifying abnormal trajectory segments in the first spatial trajectory sequence includes: Based on the spatial coordinates and timestamps of continuous trajectory points in the first spatial trajectory sequence, the instantaneous velocity between every two adjacent trajectory points is calculated to form an instantaneous velocity sequence; Based on the instantaneous velocity sequence and the first spatial trajectory sequence, anomaly detection is performed according to preset anomaly determination rules, and subsequences consisting of continuous trajectory points that satisfy any of the following conditions are marked as abnormal trajectory segments: At least one instantaneous velocity in the subsequence exceeds a preset velocity threshold; Alternatively, the vehicle corresponding to the sub-sequence is determined to be stationary, but the cumulative mileage of the first spatial trajectory sequence within the time interval corresponding to the sub-sequence exceeds a preset mileage threshold; wherein the determination condition for the stationary state is that all instantaneous speeds in the sub-sequence are lower than a first speed threshold and the duration exceeds a first time threshold. Alternatively, there is at least one instantaneous velocity in the subsequence, and the absolute value of the difference between its instantaneous velocity and that of the adjacent trajectory point exceeds a preset mutation threshold; the lengths of all identified abnormal trajectory segments are summed to obtain the total length of the abnormal trajectory segments.

[0009] Further, the step of normalizing the difference indicators in the difference indicator set, and then weighting and fusing the results of the normalization to obtain a comprehensive difference score includes: For the spatial distance difference index, its multiple sub-items are mapped through the fourth normalization function and then subjected to the first weighted fusion to obtain a comprehensive score for the spatial dimension. For the time difference index, its multiple sub-items are mapped through the fifth normalization function and then subjected to a second weighted fusion to obtain a comprehensive score for the time dimension. The trajectory consistency difference index is used as a comprehensive score for the trajectory dimension; The comprehensive scores of spatial dimension, time dimension, and trajectory dimension are combined using a sixth weighted fusion to obtain a comprehensive difference score between data source systems.

[0010] Furthermore, the calculation of the spatial distance difference index includes at least one of the following: Calculate the first distance difference between the location data system and the order system recorded for the boarding event; Calculate the second distance difference between the location data system and the order system recorded for the alighting event; Calculate the third distance difference between the location data system and the billing system for the location of the trajectory start point; Calculate the fourth distance difference between the locations recorded by the scheduling system and the positioning data system for the dispatch event and the boarding event.

[0011] Furthermore, the calculation of the time difference index includes at least one of the following: Calculate the first time difference between the time recorded by the location data system and the order system for the boarding event; Calculate a second time difference between the time recorded by the location data system and the order system for the disembarkation event; Calculate the third time difference between the time recorded by the scheduling system and the location data system for the dispatch event and the boarding event.

[0012] Furthermore, the aggregation calculation of the conflict matrix based on the pre-configured weight matrix to generate a comprehensive order conflict score is achieved through the following formula: (2) in, The order will be scored based on its overall conflict. The first in the conflict matrix Line number The element values ​​of the column, The weight matrix is ​​the first... Line number Column weight values, and The value ranges from 1 to , The number of data source systems participating in the verification.

[0013] Further, the step of comparing the comprehensive conflict score with multiple preset risk threshold ranges to determine the risk level of the target order includes: If the comprehensive conflict score is less than or equal to the first threshold, it is determined to be low risk; If the overall conflict score is greater than the first threshold and less than or equal to the second threshold, it is determined to be of medium risk. If the overall conflict score is greater than the second threshold, it is determined to be high risk.

[0014] Furthermore, the execution of risk control actions linked to this risk level includes: If the order is deemed high-risk, at least one of the following actions will be taken: automatic blocking, manual review, or marking it as an abnormal order. If the risk level is medium, at least one of the following measures will be taken: increasing the sampling rate, delaying settlement, or sending an early warning notice. If the risk is low, proceed with the normal procedure.

[0015] Secondly, this application provides an order anomaly behavior identification system based on multi-source data cross-validation, applied to any of the above-described order anomaly behavior identification methods based on multi-source data cross-validation, characterized in that it includes: The data acquisition module is used to acquire the order identifier of the target order; based on the order identifier, it acquires relevant data of the target order from at least two independent data source systems; the relevant data of the target order includes at least event location data, time point data, and spatial trajectory sequence data; the data source systems include at least: a location data system, an order system, a scheduling system, and a billing system; The time alignment module is used to correct and unify the time information contained in the relevant data of the target order to the same time reference system; The difference calculation module is used to calculate the difference value between any two independent data source systems on a preset dimension based on data from a unified time reference system, and obtain a set of difference indicators. The preset dimension includes at least: spatial distance difference calculated based on the location of the event, time offset difference calculated based on the time of the event, and consistency difference calculated based on the service process trajectory. The set of difference indicators includes: spatial distance difference indicator, time difference indicator, and trajectory consistency difference indicator. The difference fusion module is used to normalize the difference indicators in the difference indicator set, and then perform weighted fusion on the results of the normalization to obtain a comprehensive difference score. The conflict matrix construction and aggregation module is used to sort multiple data source systems participating in the verification and construct a square matrix as the conflict matrix with the number of systems as the order. The i-th row and i-th column of the square matrix correspond to the same data source system, and the element in the i-th row and j-th column corresponds to a system pair consisting of the i-th system and the j-th system. The value of this element is assigned by the comprehensive difference score of that system pair. Furthermore, the conflict matrix is ​​aggregated and calculated according to a pre-configured weight matrix to generate a comprehensive order conflict score. The risk handling module is used to compare the comprehensive conflict score with multiple preset risk threshold ranges to determine the risk level of the target order and execute risk control actions bound to that risk level.

[0016] The application employs the above technical solution and has at least the following beneficial effects: 1. By integrating data from at least four independent systems, including GPS, order, scheduling, and billing, and cross-referencing and cross-verifying data from multiple dimensions such as space, time, and trajectory consistency, the coverage and accuracy of anomaly identification are significantly improved.

[0017] 2. By introducing a conflict matrix to structurally and quantitatively model the inconsistencies between systems, subjective and vague risk judgments are transformed into objective and computable mathematical problems. The output comprehensive conflict score can scientifically reflect the overall abnormal risk level of orders.

[0018] 3. The specially designed "trajectory consistency difference" indicator analyzes the authenticity of the billing trajectory from multiple perspectives, such as average offset distance, total mileage difference, and proportion of abnormal speed segments, effectively solving long-standing pain points in the industry such as "inflated mileage" and "virtual trajectory".

[0019] 4. The entire process can be executed automatically, and flexible strategy configuration can be achieved through parameters such as weight matrix, normalization function and risk threshold. The system can adapt to the changing needs of different business scenarios and supports adaptive optimization based on historical data.

[0020] 5. Based on quantitative comprehensive scoring, multi-level risk assessment is achieved, and differentiated handling actions are triggered (such as automatic calibration, manual review, and marking for release), forming a complete business closed loop from risk perception, quantitative assessment to precise handling, thereby improving the efficiency of risk control operations.

[0021] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and do not limit this application. Attached Figure Description

[0022] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0023] Figure 1 This is a flowchart illustrating an order anomaly behavior identification method based on multi-source data cross-validation, according to an exemplary embodiment. Figure 2 This is a schematic diagram illustrating the components of an order anomaly behavior identification system based on multi-source data cross-validation, according to an exemplary embodiment. Detailed Implementation

[0024] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be described in detail below. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. Based on the embodiments in this application, all other implementation methods obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0025] For specific implementation details, please refer to [link / reference]. Figure 1 , Figure 1 This is a flowchart illustrating an order anomaly behavior identification method based on multi-source data cross-validation, according to an exemplary embodiment. The method includes: S1. Obtain the order identifier of the target order; based on the order identifier, obtain relevant data of the target order from at least two independent data source systems; the relevant data of the target order includes at least event location data, time point data, and spatial trajectory sequence data; the data source systems include at least: a location data system, an order system, a scheduling system, and a billing system; S2. Correct and unify the time information contained in the relevant data of the target order to the same time reference system; S3. Based on the data after the unified time reference system, calculate the difference value between any two independent data source systems in a preset dimension to obtain a set of difference indicators; the preset dimension includes at least: spatial distance difference calculated based on the location of the event, time offset difference calculated based on the time of the event, and consistency difference calculated based on the service process trajectory; the set of difference indicators includes: spatial distance difference indicator, time difference indicator, and trajectory consistency difference indicator. S4. Normalize the difference indicators in the difference indicator set, and then weight and fuse the results of the normalization to obtain a comprehensive difference score. S5. Sort the multiple data source systems participating in the verification, and construct a square matrix as the conflict matrix with the number of systems as the order; wherein the i-th row and i-th column of the square matrix correspond to the same data source system, and the element located at the i-th row and j-th column corresponds to the system pair consisting of the i-th system and the j-th system, and the value of the element is assigned by the comprehensive difference score of the system pair; then, perform aggregation calculation on the conflict matrix according to the pre-configured weight matrix to generate the comprehensive order conflict score; S6. Compare the comprehensive conflict score with multiple preset risk threshold ranges to determine the risk level of the target order, and execute the risk control action bound to the risk level.

[0026] In a specific embodiment, as described in step S1, the data acquisition step is the foundation of the present invention. For each target order to be verified, the system first obtains its unique order identifier ID, and based on this ID, automatically collects all data related to the order fulfillment process from multiple independent data source systems, completing order-level data aggregation.

[0027] Specifically, the data source system and key fields collected should include at least: Location data system (such as GPS system): Collects real-time movement data of the vehicle during the order period, including latitude and longitude coordinates, timestamp, positioning accuracy, speed, etc.

[0028] Order system: Collects business contract data generated or confirmed by passengers, including the latitude and longitude coordinates and text address of the pick-up and drop-off locations, as well as the pick-up and drop-off times.

[0029] Dispatch system: Collects dispatch instruction data generated when the platform assigns orders, including the driver's location (latitude and longitude) at the time of dispatch and the dispatch time.

[0030] Billing system: Collects service process data for billing, including the trajectory point sequence that forms the basis of billing, the coordinates of the start and end points of the trajectory, and the calculated mileage and duration.

[0031] After completing the cross-system data aggregation, the system immediately performs a data integrity check as a preliminary quality control step in the consistency verification process. The check primarily includes: determining whether key fields are missing from the data reported by each system (e.g., GPS data lacking valid latitude and longitude information, or order data lacking a boarding timestamp); and verifying whether data values ​​are obviously invalid or unreasonable (e.g., latitude and longitude coordinates exceeding the service geographic range, or certain timestamps earlier than the order creation time). For any missing or invalid data discovered during the check, the system marks them as "missing dimensions." In subsequent conflict calculations, these dimensions can be handled using a downweighting or skipping strategy, but the marking itself will be recorded as a potential risk indicator for reference during comprehensive evaluation.

[0032] In one embodiment, such as step S2, the timestamp alignment step is crucial for ensuring the comparability of multi-source data. In this embodiment, this step is specifically implemented as follows: First, a unified time base is established. The system pre-defines a unified time base source at the architecture level, such as server time synchronized using the Network Time Protocol (NTP) or the platform's own high-precision service time. All business systems involved in data reporting (such as GPS, order, scheduling, and billing systems) must additionally record a timestamp field corresponding to this unified time base when recording critical events such as boarding and alighting.

[0033] Secondly, time normalization is performed. Since various business systems may be deployed in different regions or use local time, the system will transform the reported raw time data. Specifically, for the raw timestamp reported by the k-th system... Combined with the time zone information of the system Through a defined time zone conversion function The time is processed and converted to a reference time zone to obtain the normalized time. Their relationship can be expressed as follows: (1) This step eliminates the absolute time difference caused by different time zones.

[0034] Furthermore, in practical implementation, time window correction will be performed. Considering the potential for normal delays in data writing and transmission across different systems, this invention defines flexible, acceptable time windows for different types of events. For example: For boarding events, the boarding time detected by the GPS system and the boarding time recorded by the order system are allowed to differ. Deviation (e.g.) =30 seconds).

[0035] For drop-off events, the drop-off time in the GPS system and the drop-off time in the order system are allowed to differ. Deviation (e.g.) =60 seconds).

[0036] Only when the time difference between paired events exceeds a preset time window for their corresponding event type will the time difference value be considered a valid time difference input for subsequent conflict calculation and matrix construction. This correction mechanism enhances tolerance to reasonable fluctuations, allowing difference analysis to focus more on genuine anomalies.

[0037] In practice, as in steps S3 and S4, based on the order data that has been aligned with the time, the system will perform multi-dimensional and multi-level difference calculations and fusions, as follows: First, calculate the differences in the underlying fields. This includes two types of direct differences: Spatial distance difference: For key spatial locations such as pick-up point, drop-off point, dispatch point, and the start and end points of the billing trajectory, calculate the geographical distance difference between the coordinates recorded by any two independent systems (such as GPS system, order system, dispatch system, and billing system). For example, calculate the distance difference (D1) between the actual pick-up point identified by the GPS system and the pick-up point specified by the passenger in the order system, or calculate the distance difference (D2) between the actual pick-up point identified by the GPS system and the trajectory start point in the billing system, or calculate the distance difference (D3) between the dispatch start point recorded by the dispatch system and the pick-up point recorded by the GPS system. The distance calculation can use the spherical distance formula: (2) in, These are the latitude and longitude coordinates of the two points; This represents a geographic distance calculation function (e.g., the spherical distance formula); the parameters within the parentheses have the following meanings: The first point Latitude; The first point Longitude; The second point Latitude; The second point Longitude.

[0038] Simply put, this formula means: through the input point latitude and longitude and points latitude and longitude, after By calculating the function, we can obtain the actual distance D between these two points on the Earth's surface.

[0039] Time Difference: For key events such as boarding, alighting, and order dispatch, calculate the difference between timestamps recorded by different systems. For example, calculate the time difference (T1) between GPS boarding time and order system boarding time, or calculate the time difference (T2) between GPS boarding time and the relevant time recorded by the billing system.

[0040] Specifically, for key event times such as boarding time and alighting time, the time difference between different systems is calculated:

[0041] in, The boarding time is indicated by the GPS system. The boarding time is indicated by the order system. Similarly, it can be defined

[0042]

[0043]

[0044] The boarding time is indicated by the dispatch system. This indicates the boarding time, which comes from the billing system.

[0045] The above formula is used to represent the time deviation between GPS and billing, dispatching and other systems.

[0046] Next, a depth-based trajectory consistency difference calculation is performed. This is crucial for verifying the authenticity of the billing trajectory in this embodiment. Using the billing system trajectory (first trajectory sequence) as the object to be verified and the GPS trajectory (second trajectory sequence) as the actual driving reference, three quantitative assessments are conducted: Average offset distance calculation: Match billing track points with GPS track points by time or space, and calculate the average geographical distance between all matched point pairs. This is used to assess the overall spatial offset of the billing trajectory.

[0047] In practical implementation, the set of trajectory points of the design fee system within the effective time interval is as follows: (6) The set of corresponding trajectory points collected by the GPS system is (7) For each trajectory point in the billing trajectory Select the matching point from the GPS track point set that is closest in time or has the smallest spatial distance. Calculate the geographical distance between the two and take the average value over all trajectory points to obtain the average offset distance index: (8) in, This is a function for calculating spherical distance or other geographic distances. This metric is used to characterize the overall spatial deviation of the billing trajectory relative to the actual driving trajectory.

[0048] Total mileage difference calculation: Accumulate the total mileage of each billing trajectory. Total mileage of GPS track Calculate their absolute difference (9) is used to identify anomalies such as falsely increased or truncated mileage.

[0049] Abnormal speed segment proportion calculation: Analyze the billing trajectory to identify abnormal segments that do not conform to physical laws or driving common sense (e.g., instantaneous speed exceeding 120 km / h, vehicle remaining stationary but billing mileage increasing, abrupt changes in displacement between adjacent points, etc.). Calculate the proportion of the total length of abnormal segments to the total length of the billing trajectory. .

[0050] Specifically, let the number of abnormal trajectory segments be... The total number of trajectory segments is The proportion of abnormal speed segments is defined as follows: (10) Subsequently, the above three basic indicators , , The preset normalization functions f1, f2, and f3 are mapped to scores S1, S2, and S3 with uniform dimensions, respectively.

[0051] Specifically, for the three types of basic difference indicators mentioned above, normalization processing is performed to map indicators with different dimensions to a unified numerical range, resulting in a normalized difference score: (11) (12) (13) in, , , This is a preset normalization function; the larger the normalized value, the greater the degree of difference.

[0052] Finally, the weighted fusion formula is as follows: (14) (in, Let be the weight coefficient, and satisfy... The weights can be configured or dynamically adjusted based on historical data or business needs. This yields the final trajectory consistency difference score. .

[0053] After calculating the differences in spatial location, time, and trajectory consistency, in order to eliminate the differences in physical dimensions, numerical range, and statistical distribution of different difference indicators, this invention normalizes each type of difference indicator and constructs a comprehensive difference score between systems based on this.

[0054] Specifically, for the same order's boarding and alighting related data in different systems, the differences are divided into the following three categories: Spatial distance difference index: used to describe the spatial location deviation between pick-up points, drop-off points, dispatch points, and trajectory start and end points recorded by different systems; Temporal difference index: used to describe the deviation between the times of key events such as pick-up time, drop-off time, and dispatch time recorded by different systems; Trajectory consistency difference index: used to describe the degree of consistency between the billing system trajectory and the actual GPS-collected trajectory. These three types of differences correspond to different physical meanings and require independent normalization and fusion methods for processing.

[0055] For the normalization of spatial distance differences, specifically, let the set of spatial distance difference indicators be: (15) Among them, each It represents the distance difference between two systems at a certain spatial location field.

[0056] Each spatial distance difference index was normalized to obtain a normalized distance difference score: (16) in, This is a preset distance normalization function used to map the original distance differences to a uniform numerical range. The larger the value, the more significant the spatial location difference.

[0057] Based on normalization, multiple spatial distance difference scores can be weighted and fused to form a comprehensive spatial distance difference score at the order level: (17) in, These are the weighting coefficients corresponding to differences in spatial distance.

[0058] For time difference normalization, let the set of time difference indicators be: (18) Among them, each It represents the time deviation between two systems on the same event.

[0059] Each time difference index was normalized to obtain a normalized time difference score: (19) in, This is a preset time normalization function.

[0060] Furthermore, multiple time difference scores are weighted and fused to form a comprehensive time difference score at the order level: (20) in, These are the weighting coefficients for the corresponding time differences.

[0061] For trajectory consistency difference scoring, trajectory consistency difference scoring Derived from the aforementioned trajectory consistency difference calculation steps, it is used to characterize the overall consistency between the billing system trajectory and the actual GPS trajectory.

[0062] Specifically, this score comprehensively reflects multiple factors such as trajectory spatial offset, mileage difference, and the proportion of abnormal trajectory segments. In this step, it is used as an independent difference indicator to directly participate in the subsequent comprehensive difference score calculation.

[0063] Furthermore, after normalizing and classifying the differences in spatial distance, time, and trajectory consistency, the scores for these three types of differences are weighted and fused across categories to obtain a comprehensive difference score between the systems: (twenty one) in: , , These are the weighting coefficients for the corresponding difference categories; The weighting coefficients satisfy ; The weighting coefficients can be configured or dynamically adjusted based on historical data statistics, system credibility, or business needs.

[0064] The comprehensive difference score The larger the value, the higher the degree of comprehensive conflict between the corresponding system pairs in the spatial, temporal, and trajectory dimensions.

[0065] Furthermore, for different system pairs, their corresponding comprehensive difference scores are calculated, and these scores are used as the quantitative results of inter-system conflict and input into the subsequent conflict matrix construction steps.

[0066] As in step S5, after completing the system difference normalization and system-to-system comprehensive difference score calculation, a conflict matrix is ​​constructed to structurally model the conflict relationship between the same order in multiple systems.

[0067] For the same order, the set of systems to participate in the consistency verification is determined as follows: (twenty two) The system set includes at least two or more of the following: GPS system, order system, scheduling system, and billing system.

[0068] Based on the aforementioned set of systems, construct an inter-system conflict matrix C of order k × k: (twenty three) in: The rows and columns of the conflict matrix correspond to different systems in the system set, respectively; The diagonal elements are set to zero, indicating that there is no conflict between the same system and itself; off-diagonal elements system representation With the system The system-wide comprehensive difference score between the two levels.

[0069] In one embodiment, the system performs a comprehensive difference score for each level. The results are obtained by cross-category weighted fusion of the normalized results of the corresponding system pairs in terms of spatial distance difference, temporal difference and trajectory consistency difference, and are used to characterize the degree of local conflict between the system pairs.

[0070] In another embodiment, the conflict matrix is ​​a symmetric matrix that satisfies Alternatively, an asymmetric conflict matrix can be constructed based on the differences in system credibility.

[0071] Using the above method, an order-level inter-system conflict matrix is ​​generated for each order, and the conflict matrix is ​​used as an intermediate result to input into the subsequent matrix-level aggregation step.

[0072] After the inter-system conflict matrix is ​​constructed, the local conflict results of different system pairs are further aggregated at the matrix level based on the conflict matrix to obtain a comprehensive conflict score that reflects the overall consistency level of the order.

[0073] Therefore, a weight matrix with the same dimensions as the conflict matrix is ​​constructed. : (twenty four) In the weight matrix, the element W_{i,j} represents the importance of the conflict result between system S_i and system S_j in the overall evaluation. The weight can be configured or dynamically adjusted according to system credibility, historical risk hit rate or business strategy.

[0074] Based on the conflict matrix and weight matrix, calculate the order-level comprehensive conflict score: (25) The comprehensive conflict score is used to characterize the overall conflict level of the same order under multi-system, multi-dimensional data consistency verification. The higher the score value, the higher the possibility that the order is abnormal.

[0075] Specifically, the system predefines several key anomaly patterns and their corresponding feature vectors: False pick-up point characteristics: When there are significant conflicts in spatial location and event time between the GPS system and the order system, billing system, etc., within an order, it may point to a false pick-up point. The system extracts a comprehensive score based on spatial distance differences. Overall score based on time difference The eigenvectors formed , When the values ​​of each component in the vector are significantly higher than their respective preset thresholds, it is marked as a suspected "false boarding point".

[0076] Virtual Location Order Acceptance Feature: This mode focuses on the authenticity of the driver's location during the order acceptance process. The system mainly extracts the conflict score between the dispatch system and the GPS system as a feature. For example, it can use a specific distance difference score calculated from the dispatch point and the actual GPS vehicle location, or directly use the comprehensive difference score corresponding to the two in the conflict matrix. When this feature value is significantly large, it indicates that there may be an anomaly in the virtual location of the order acceptance position.

[0077] Trajectory fraud characteristics: The core of this model lies in analyzing the rationality of the billing trajectory itself and its consistency with the order. The system extracts two key indicators to form a feature vector: one is the trajectory consistency difference score. The first is used to quantify the overall deviation between the billing trajectory and the actual GPS trajectory; the second is the spatial distance difference between the start / end point of the billing trajectory and the order's pick-up / drop-off points. If the value is significantly larger than expected, and the start and end points of the billing trajectory do not match the agreed pick-up and drop-off points of the order, then it is extracted as a strong "trajectory fraud" feature vector.

[0078] The extracted feature vectors will serve as structured and quantifiable inputs to downstream rule engines or risk identification models, driving more refined and interpretable risk assessment and classification, thereby enabling precise targeting of different cheating methods.

[0079] As described in step S6, this step, based on the aforementioned calculated system comprehensive difference score, trajectory consistency difference index, etc., uses a hierarchical judgment method to ultimately drive differentiated risk control actions and form a self-optimizing closed loop. The specific implementation is as follows: First, a multi-level risk assessment is conducted. This assessment combines specific rules with a comprehensive score: Rule-based suspicion determination: The system pre-sets a series of specific anomaly identification rules. For example, if the difference between the pick-up point recorded by the GPS system and the order system is greater than threshold A, and the difference between the relevant indicators recorded by the GPS system and the billing system is greater than threshold B, then the order is marked as "suspected fake pick-up point"; if the distance between the dispatch point in the dispatch system and the actual pick-up point in the GPS is abnormal, then it is marked as "suspected virtual location order acceptance"; if the starting point of the billing trajectory does not match the pick-up point in the order system significantly, then it is marked as "suspected trajectory fraud".

[0080] Risk classification based on comprehensive scoring: Simultaneously, the system will also assign a comprehensive conflict score to the order. Mapped to a preset risk level. For example, setting a low-risk threshold. and high risk threshold ,when When, it is judged as low risk; when When, it is judged as medium risk; when At that time, it is judged as high risk. Different levels will trigger follow-up handling procedures with varying degrees of strictness.

[0081] Subsequently, risk control measures are implemented in accordance with the risk level, forming a closed-loop management system: For high-risk orders, the system performs automatic processing, such as calibrating abnormal pick-up and drop-off points based on multi-source data, or automatically adjusting the billing mileage and cost.

[0082] For orders with medium risk, the system initiates semi-automatic processing, pushing them to the manual review queue and providing key difference indicators and system correction suggestions. Reviewers can adopt these suggestions with one click, greatly improving efficiency.

[0083] In addition, all confirmed abnormal orders are recorded in the audit log for case analysis and rule optimization. The system also builds risk profiles for drivers or passengers with frequent abnormalities, serving as a basis for implementing differentiated spot checks or activity restrictions.

[0084] Furthermore, to continuously combat new cheating methods, the system supports self-learning of key parameters. Based on the accuracy feedback of historical judgment results, the model automatically optimizes and updates various thresholds (such as A, B, ...) periodically. , ) and weights (such as W) ij (λ1,λ2,λ3), thereby enabling continuous iteration and evolution of risk control strategies.

[0085] Through the complete process of "judgment-handling-feedback-optimization" described above, this invention realizes an intelligent risk control closed loop from accurate risk identification to effective business intervention, and then to system self-enhancement.

[0086] Please see Figure 2 This embodiment provides an order anomaly behavior identification system based on multi-source data cross-validation for implementing the aforementioned method embodiments. The system is deployed on a server in a software, hardware, or a combination of both. It communicates with various business systems through preset interfaces. Internally, it adopts a modular design, with each module working collaboratively to complete automated risk identification. The system mainly includes the following modules: Data Acquisition Module 10: This module is the system's data entry point. It is responsible for concurrently collecting full-dimensional fulfillment data of the order from at least two independent data source systems (in this embodiment, at least including a location data system, an order system, a scheduling system, and a billing system) based on the unique identifier of the input target order. The acquired data at least covers event location data (such as latitude and longitude coordinates), time point data (such as event timestamps), and spatial trajectory sequence data.

[0087] Time Alignment Module 20: This module receives raw data from the data acquisition module. Its core function is to resolve the inconsistency of time bases among multiple data sources. The module internally presets a unified time base (such as the NTP server time in the UTC time zone) and, through time zone conversion, time window correction, and other processes, corrects and unifies the time information reported by all business systems to the same time reference system, laying the foundation for subsequent accurate comparison.

[0088] Difference Calculation Module 30: This module performs multi-dimensional difference quantification analysis based on time-aligned data. It has built-in multiple calculation units capable of calculating the difference values ​​between any two data source systems across three preset dimensions. Spatial distance difference unit: Calculates the geographical distance difference between spatial location pairs such as GPS pick-up point and order pick-up point.

[0089] Time Difference Unit: Calculates the difference between event time pairs such as GPS pick-up time and order pick-up time.

[0090] Track Consistency Difference Unit: This is a key sub-module that specifically calculates the degree of consistency between the billing system track and the GPS track, and conducts a comprehensive evaluation through sub-indicators such as average offset distance, total mileage difference, and proportion of abnormal speed segments.

[0091] Difference Fusion Module 40: This module standardizes and fuses the various raw difference indicators output by the difference calculation module. First, it normalizes different types of indicators, such as spatial and temporal indicators, to eliminate the influence of dimensions. Then, it uses a two-level weighted fusion strategy: first, it performs intra-class fusion on indicators of the same type (such as fusing multiple spatial distance differences), and then it performs inter-class fusion on the comprehensive scores of spatial, temporal, and trajectory indicators. Finally, it outputs a comprehensive difference score for system pairs to characterize the overall degree of inconsistency between any two systems.

[0092] Conflict Matrix Construction and Aggregation Module 50: This module is the core of the quantitative modeling of this system. It receives the comprehensive difference score of all system pairs and performs the following operations: Constructing the conflict matrix: Sort the k data source systems participating in the verification and construct a k-order square matrix. The i-th row and i-th column correspond to the same system, and the element in the i-th row and j-th column (i≠j) is assigned the comprehensive difference score of the system pair formed by the i-th system and the j-th system.

[0093] Aggregate order total score calculation: Based on a pre-configured weight matrix of the same order as the conflict matrix, perform a weighted summation of all elements in the conflict matrix (e.g., using a formula).

[0094] (Calculation) to generate an overall order conflict score that represents the overall risk level of the order.

[0095] Risk Handling Module 60: This module is the system's decision-making and execution terminal. It receives the comprehensive conflict score of an order and compares it with a preset risk threshold range, automatically determining whether the order belongs to a high-risk, medium-risk, or low-risk level. Subsequently, the module triggers risk control actions associated with that level, such as automatically calibrating high-risk orders, sending medium-risk orders for manual review, or releasing low-risk orders normally, thus forming a complete closed loop from risk identification to business handling.

[0096] The above modules are connected in sequence, and the data flows from front to back. Together, they realize the full-process automation from multi-source data collection, quantitative difference analysis, conflict model construction to intelligent risk handling, forming a complete and self-consistent order abnormal behavior identification system.

[0097] It is understood that the same or similar parts in the above embodiments can be referred to each other, and the contents not described in detail in some embodiments can be referred to the same or similar contents in other embodiments.

[0098] It should be noted that in the description of this application, the terms "first," "second," etc., are used for descriptive purposes only and should not be construed as indicating or implying relative importance. Furthermore, in the description of this application, unless otherwise stated, "multiple" or "more" means at least two.

[0099] It should be understood that when an element is referred to as "fixed to" or "set on" another element, it may be directly on the other element or may have an intervening element present at the same time; when an element is referred to as "connected to" another element, it may be directly connected to the other element or may have an intervening element present at the same time. In addition, the term "connected" as used herein may include wireless connections; the word "and / or" used includes any unit and all combinations of one or more of the associated listed items.

[0100] Any process or method description in the flowchart or otherwise herein can be understood as: representing a module, segment, or portion of code comprising one or more executable instructions for implementing a particular logical function or process, and the scope of the preferred embodiments of this application includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the function involved, as should be understood by those skilled in the art to which embodiments of this application pertain.

[0101] It should be understood that various parts of this application can be implemented using hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented using software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0102] Those skilled in the art will understand that all or part of the steps of the methods in the above embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, the program includes one or a combination of the steps of the method embodiments.

[0103] Furthermore, the functional units in the various embodiments of this application can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into a module. The integrated module can be implemented in hardware or as a software functional module. If the integrated module is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium.

[0104] The storage media mentioned above can be read-only memory, disk, or optical disk, etc.

[0105] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of this application. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0106] Although embodiments of this application have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting this application. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments within the scope of this application.

Claims

1. A method for identifying abnormal order behavior based on multi-source data cross-validation, characterized in that, include: Obtain the order identifier of the target order; Based on the order identifier, relevant data of the target order are obtained from at least two independent data source systems; The relevant data for the target order includes at least event location data, time point data, and spatial trajectory sequence data; The data source system includes at least: a location data system, an order system, a scheduling system, and a billing system; The time information contained in the relevant data of the target order is corrected and unified to the same time reference system; Based on the data from a unified time reference system, the difference values ​​between any two independent data source systems on a preset dimension are calculated to obtain a set of difference indicators; the preset dimension includes at least: spatial distance difference calculated based on the location of the event, time offset difference calculated based on the time of the event, and consistency difference calculated based on the service process trajectory; the set of difference indicators includes: spatial distance difference indicator, time difference indicator, and trajectory consistency difference indicator. The difference indicators in the set of difference indicators are normalized respectively, and the results of the normalization are weighted and fused to obtain a comprehensive difference score. The multiple data source systems participating in the verification are sorted, and a square matrix is ​​constructed as the conflict matrix with the number of systems as the order. The i-th row and i-th column of the square matrix correspond to the same data source system, and the element located at the i-th row and j-th column corresponds to the system pair consisting of the i-th system and the j-th system. The value of this element is assigned by the comprehensive difference score of the system pair. Then, the conflict matrix is ​​aggregated and calculated according to the pre-configured weight matrix to generate a comprehensive order conflict score. The comprehensive conflict score is compared with multiple preset risk threshold ranges to determine the risk level of the target order, and risk control actions are performed in accordance with the risk level.

2. The method according to claim 1, characterized in that, The calculation process for the consistency difference includes: Obtain the first spatial trajectory sequence of the billing system and the second spatial trajectory sequence of the positioning data system; For each trajectory point in the first spatial trajectory sequence, select the matching point in the second spatial trajectory sequence that is closest in time or has the smallest spatial distance; Calculate the average geographical distance between all matching point pairs as the average offset distance; Calculate the total length of the first spatial trajectory sequence and the second spatial trajectory sequence respectively, and calculate the absolute value of the difference between the two as the total mileage difference; Identify abnormal trajectory segments in the first spatial trajectory sequence and calculate the proportion of the total length of the abnormal trajectory segments to the total length of the first spatial trajectory sequence as the proportion of abnormal velocity segments; The average offset distance, total mileage difference, and abnormal speed segment ratio are respectively input into a preset normalization function for mapping to obtain the corresponding first normalized value, second normalized value, and third normalized value. Using the first normalized value, the second normalized value, and the third normalized value, the conflict score of the consistency difference is obtained according to the preset conflict score formula for consistency difference. The preset formula for calculating the conflict score of consistency differences is as follows: （1） Wherein, S1, S2, and S3 are the first normalized value, the second normalized value, and the third normalized value, respectively. Uniform value, Let be the weight coefficient, and satisfy... .

3. The method according to claim 2, characterized in that, The identification of abnormal trajectory segments in the first spatial trajectory sequence includes: Based on the spatial coordinates and timestamps of continuous trajectory points in the first spatial trajectory sequence, the instantaneous velocity between every two adjacent trajectory points is calculated to form an instantaneous velocity sequence; Based on the instantaneous velocity sequence and the first spatial trajectory sequence, anomaly detection is performed according to preset anomaly determination rules, and subsequences consisting of continuous trajectory points that satisfy any of the following conditions are marked as abnormal trajectory segments: At least one instantaneous velocity in the subsequence exceeds a preset velocity threshold; Alternatively, the vehicle corresponding to the sub-sequence is determined to be stationary, but the cumulative mileage of the first spatial trajectory sequence within the time interval corresponding to the sub-sequence exceeds a preset mileage threshold; wherein the determination condition for the stationary state is that all instantaneous speeds in the sub-sequence are lower than a first speed threshold and the duration exceeds a first time threshold. Alternatively, there is at least one instantaneous velocity in the subsequence, the absolute value of the difference between its instantaneous velocity and that of the adjacent trajectory point exceeds a preset mutation threshold; the lengths of all identified abnormal trajectory segments are summed to obtain the total length of the abnormal trajectory segments.

4. The method according to claim 1, characterized in that, The step involves normalizing the difference indicators in the set of difference indicators, and then weighting and fusing the results of the normalization to obtain a comprehensive difference score, including: For the spatial distance difference index, its multiple sub-items are mapped through the fourth normalization function and then subjected to the first weighted fusion to obtain a comprehensive score for the spatial dimension. For the time difference index, its multiple sub-items are mapped through the fifth normalization function and then subjected to a second weighted fusion to obtain a comprehensive score for the time dimension. The trajectory consistency difference index is used as a comprehensive score for the trajectory dimension; The comprehensive scores of spatial dimension, time dimension, and trajectory dimension are combined using a sixth weighted fusion to obtain a comprehensive difference score between data source systems.

5. The method according to claim 1, characterized in that, The calculation of the spatial distance difference index includes at least one of the following: Calculate the first distance difference between the location data system and the order system recorded for the boarding event; Calculate the second distance difference between the location data system and the order system recorded for the alighting event; Calculate the third distance difference between the location data system and the billing system for the location of the trajectory start point; Calculate the fourth distance difference between the locations recorded by the scheduling system and the positioning data system for the dispatch event and the boarding event.

6. The method according to claim 1, characterized in that, The calculation of the time difference index includes at least one of the following: Calculate the first time difference between the time recorded by the location data system and the order system for the boarding event; Calculate a second time difference between the time recorded by the location data system and the order system for the disembarkation event; Calculate the third time difference between the time recorded by the scheduling system and the location data system for the dispatch event and the boarding event.

7. The method according to claim 1, characterized in that, The step of aggregating and calculating the conflict matrix based on the pre-configured weight matrix to generate a comprehensive order conflict score is achieved through the following formula: (2) in, The order will be scored based on its overall conflict. The first in the conflict matrix Line number The element values ​​of the column, The weight matrix is ​​the first... Line number Column weight values, and The value ranges from 1 to , The number of data source systems participating in the verification.

8. The method according to claim 1, characterized in that, The step of comparing the comprehensive conflict score with multiple preset risk threshold ranges to determine the risk level of the target order includes: If the comprehensive conflict score is less than or equal to the first threshold, it is determined to be low risk; If the overall conflict score is greater than the first threshold and less than or equal to the second threshold, it is determined to be of medium risk. If the overall conflict score is greater than the second threshold, it is determined to be high risk.

9. The method according to claim 8, characterized in that, The risk control actions to be performed in accordance with this risk level include: If the order is deemed high-risk, at least one of the following actions will be taken: automatic blocking, manual review, or marking it as an abnormal order. If the risk level is medium, at least one of the following measures will be taken: increasing the sampling rate, delaying settlement, or sending an early warning notice. If the risk is low, proceed with the normal procedure.

10. A system for identifying abnormal order behavior based on multi-source data cross-validation, applied to the method for identifying abnormal order behavior based on multi-source data cross-validation as described in any one of claims 1-9, characterized in that, include: The data acquisition module is used to obtain the order identifier of the target order; Based on the order identifier, relevant data of the target order are obtained from at least two independent data source systems; The relevant data for the target order includes at least event location data, time point data, and spatial trajectory sequence data; The data source system includes at least: a location data system, an order system, a scheduling system, and a billing system; The time alignment module is used to correct and unify the time information contained in the relevant data of the target order to the same time reference system; The difference calculation module is used to calculate the difference value between any two independent data source systems on a preset dimension based on data from a unified time reference system, and obtain a set of difference indicators. The preset dimension includes at least: spatial distance difference calculated based on the location of the event, time offset difference calculated based on the time of the event, and consistency difference calculated based on the service process trajectory. The set of difference indicators includes: spatial distance difference indicator, time difference indicator, and trajectory consistency difference indicator. The difference fusion module is used to normalize the difference indicators in the difference indicator set, and then perform weighted fusion on the results of the normalization to obtain a comprehensive difference score. The conflict matrix construction and aggregation module is used to sort multiple data source systems participating in the verification and construct a square matrix as the conflict matrix with the number of systems as the order. The i-th row and i-th column of the square matrix correspond to the same data source system, and the element in the i-th row and j-th column corresponds to a system pair consisting of the i-th system and the j-th system. The value of this element is assigned by the comprehensive difference score of that system pair. Furthermore, the conflict matrix is ​​aggregated and calculated according to a pre-configured weight matrix to generate a comprehensive order conflict score. The risk handling module is used to compare the comprehensive conflict score with multiple preset risk threshold ranges to determine the risk level of the target order and execute risk control actions bound to that risk level.

Images