A method and system for intelligent early warning of abnormal behaviors in bidding

Abstract

The application discloses a kind of intelligent early warning method and system of abnormal behavior of bidding, it is related to data processing and analysis technical field.The method first obtains the whole process data of bidding project, generates suspicious point list after preliminary anomaly detection;Again, with bidder as the starting point of inquiry, cross-project association information is mined, and a dynamic event graph with the target project as the core is constructed to reveal cross-project risk information;Finally, the suspicious point list and cross-project risk information are fused and judged to generate early warning prompt information.The problems that the prior art cannot identify cross-project, cross-time and space deep collusion relationship and the scene adaptation ability is insufficient are solved.

Description

Technical Field

[0001] This invention relates to the field of data processing and analysis technology, specifically to an intelligent early warning method and system for abnormal bidding behavior. Background Technology

[0002] With the widespread adoption of electronic bidding platforms, the preparation, submission, opening, and evaluation of bids have gradually become online, greatly improving transaction efficiency and standardization. However, at the same time, digitalization has also made collusion and bid-rigging more difficult to detect, posing new challenges to bidding supervision.

[0003] Traditional methods for detecting abnormal bidding behavior typically focus on identifying explicit features within a single project, such as the numerical patterns of different bidders' bid prices exhibiting arithmetic progressions or fixed percentage reductions, excessive similarity in technical bid documents, and submission of bids using the same hardware / network identifiers.

[0004] The methods described above are effective in detecting bid-rigging within the same project using simple technical means, but they are ineffective in providing early warnings against professional, cross-regional, and cross-project collusion groups. Existing detection methods only analyze the current project or projects from the same period, and cannot detect the bidder's historical behavior in different projects, regions, and periods. Bid-rigging groups often employ "guerrilla tactics"—rotating bidding companies and cross-combining their participation in different projects. From the perspective of a single project, these behaviors show no obvious abnormalities and cannot be effectively identified. Summary of the Invention

[0005] This invention provides an intelligent early warning method and system for abnormal bidding behavior, in order to solve the problem that existing bidding anomaly detection technologies are insufficient in their ability to uncover implicit correlations and are difficult to identify deep collusion relationships across projects and time periods.

[0006] This invention is achieved through the following technical solution:

[0007] A first aspect of the present invention provides an intelligent early warning method for abnormal bidding behavior, comprising:

[0008] Obtain full-process data for the target project, including bidder information, bid documents, pricing data, and bidder behavior logs;

[0009] Preliminary anomaly detection is performed based on the full-process data, and a list of suspicious points is generated based on the detection results.

[0010] Starting with the bidders of the target project, the system extracts related information from related data sources based on preset multidimensional association rules. The related data sources include the bidders' historical participation in projects.

[0011] Based on the associated information, a dynamic event graph centered on the target project is constructed, and cross-project associated risk information is revealed based on the dynamic event graph.

[0012] The list of suspicious points and the cross-project related risk information are integrated and analyzed to generate early warning information.

[0013] Furthermore, the preliminary anomaly detection based on the entire process data, and the generation of a list of suspicious points based on the detection results, includes:

[0014] The system detects whether the bidding behavior characteristics of different bidders are the same or similar, and records the detected abnormal behaviors, the bidders involved, the type of abnormality, and a summary of evidence in a suspicious list; wherein, the abnormal behaviors include at least one of the following:

[0015] There is a pre-defined numerical pattern among the various bid prices;

[0016] The text similarity of the bid documents from different bidders in the preset key chapters reaches a set threshold;

[0017] The network addresses and / or hardware device identifiers used by different bidders in submitting their bid documents overlap.

[0018] Furthermore, the step of using the bidders of the target project as the starting point for the query, and mining related information from the related data source based on preset multi-dimensional association rules, includes:

[0019] The business registration information of each bidder is extracted as a keyword, and a query is performed in the associated data source to obtain the associated entities and their associated types of the bidder, forming a static candidate set of associations; the association types include equity control relationships and personnel appointment relationships.

[0020] Extract the bidding behavior characteristics of each bidder in the target project, and use the bidding behavior characteristics as query conditions to query similar bidding entities with the same or similar bidding behavior characteristics and their similar behaviors in the bidder's historical projects, forming a candidate set of behavior associations; the similar behaviors include equipment sharing behavior, similar pricing, and similar bidding text;

[0021] The static association candidate set and the behavioral association candidate set are merged and deduplicated to construct an association information set that includes the bidder, the associated entity and its association type, the similar bidding entities and their similar behaviors and source evidence.

[0022] Furthermore, the step of constructing a dynamic event graph centered on the target project based on the associated information includes:

[0023] Using the bidders, related entities, and similar bidding entities in the aforementioned set of related information as graph nodes and the association types as graph edges, a static subgraph reflecting the inherent relationships between entities is established.

[0024] The target project and the historical participating projects are designated as project nodes, the bidders and the similar bidding entities are designated as bidder nodes, the bidding behavior is designated as the bidding relationship edge connecting the project nodes and the bidder nodes, the similar behavior is designated as the behavior relationship edge connecting each bidder node, and the number of joint bids, the distribution of bidding time, and the pricing pattern are labeled on the behavior relationship edge as edge attributes to construct an event subgraph centered on the target project.

[0025] The bidder nodes of the event subgraph are associated and mapped with the graph nodes of the static subgraph to establish cross-layer association edges, thereby generating a dynamic event graph centered on the target project.

[0026] Furthermore, the method of revealing cross-project related risk information based on the dynamic event graph includes:

[0027] Perform graph traversal and topological analysis on the dynamic event graph to extract risk feature subgraphs;

[0028] In the risk characteristic subgraph, bidders whose nodes have direct or indirect links and who have shared bidding behavior in at least two or more historical projects are classified into the same risk group:

[0029] Each risky group is assigned a risk value based on the number of associated paths, the number of joint bids, the similarity of bidding behavior characteristics, and the group size. The identified risky groups, their associated evidence, and the associated risk values ​​are packaged into cross-project associated risk information. The similarity of bidding behavior characteristics is calculated based on at least one of the following: the number of joint bids, the distribution of bidding time, and the pricing pattern on the behavioral relationship edges in the event subgraph.

[0030] The risk feature subgraph includes a dense connection subgraph and an indirect association path subgraph. The dense connection subgraph is a high-density connection structure formed between bidder nodes through shared equipment, shared personnel, or multiple historical joint bidding relationships. The indirect association path subgraph is a connection structure where there is no direct edge between two bidder nodes, but a reachable path is formed through one or more intermediate nodes.

[0031] Furthermore, the process of integrating and analyzing the list of suspicious points and the cross-project related risk information to generate early warning information includes:

[0032] The bidders in the list of suspicious bidders are merged with the bidders involved in the cross-project related risk information to obtain the abnormal bidders;

[0033] Based on the abnormal behavior of the abnormal bidder in the target project and the cross-project related risk information, a structured early warning message containing the risk subject and evidence is generated.

[0034] Furthermore, the end-to-end data also includes review process data; the method further includes:

[0035] Extract review anomaly features from the review process data;

[0036] The list of suspicious points, the cross-project related risk information, and the abnormal review characteristics are analyzed collaboratively to output comprehensive early warning information;

[0037] The review process data includes at least one of the following: detailed expert scores, discussion records of the bid evaluation committee, audio and video monitoring texts, and logs of expert browsing of bid documents.

[0038] Furthermore, the extraction of review anomaly features from the review process data of the target project includes at least one of the following:

[0039] The scores of each expert are standardized to identify outliers whose scores for bidders deviate significantly from the mean score, and the degree of their outlier is calculated.

[0040] Natural language processing is used to extract segments of statements that defend, excessively question, or imply the intention to win the bid from the audio and video text of the bidding process;

[0041] Analyze the time distribution of experts browsing various tender documents to identify abnormal browsing behavior.

[0042] A second aspect of the present invention provides an intelligent early warning system for bidding and tendering transaction processes, comprising:

[0043] The data acquisition module is used to acquire full-process data of the target project, including bidder information, bid documents, quotation data, and bidder behavior logs.

[0044] The suspicious point screening module is used to perform preliminary anomaly detection based on the full-process data and generate a list of suspicious points based on the detection results.

[0045] The association mining module is used to mine association information from association data sources based on preset multidimensional association rules, starting with the bidders of the target project; the association data sources include the bidders' historical participation in projects.

[0046] The risk analysis module is used to construct a dynamic event graph centered on the target project based on the associated information, and to reveal cross-project associated risk information based on the dynamic event graph.

[0047] The fusion analysis module is used to perform fusion analysis on the list of suspicious points and the cross-project related risk information to generate early warning information.

[0048] Furthermore, the system also includes a visualization module, which is used to display dynamic event graphs, early warning information, and comprehensive early warning information in a visual form.

[0049] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0050] Starting with the target project bidders, the system mines the related information of the bidders' historical participation in projects and constructs a dynamic event graph. This expands the analytical perspective from a single project to the historical behavior of bidders across projects and regions, breaking down the data barriers of a single project. It can effectively identify the guerrilla-style collusion behavior of bid-rigging gangs that rotate and participate in bids, and solves the problem that existing technologies cannot perceive the historical behavior of bidders.

[0051] By conducting preliminary anomaly detection on the entire project data, obvious abnormal behaviors are discovered. These are then comprehensively analyzed in conjunction with cross-project related risk information to fully and accurately pinpoint the abnormal entities and behaviors, and provide traceable evidence. Attached Figure Description

[0052] To more clearly illustrate the technical solutions of the exemplary embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly described below. It should be understood that the following drawings only show some embodiments of the present invention and should not be considered as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort. In the drawings:

[0053] Figure 1 This is a flowchart of an intelligent early warning method for abnormal bidding behavior according to an embodiment of the present invention;

[0054] Figure 2 This is a flowchart of a method for constructing a dynamic event graph according to an embodiment of the present invention;

[0055] Figure 3 This is a flowchart of a method for revealing cross-project related risk information based on dynamic event graphs according to an embodiment of the present invention;

[0056] Figure 4 This is a flowchart of a method for fusion analysis of abnormal bidding behaviors according to an embodiment of the present invention;

[0057] Figure 5 This is a flowchart of a full-process early warning method for abnormal bidding behavior according to an embodiment of the present invention;

[0058] Figure 6This is a block diagram of an intelligent early warning system for abnormal bidding behavior according to an embodiment of the present invention. Detailed Implementation

[0059] To make the objectives, technical solutions, and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the embodiments and accompanying drawings. The illustrative embodiments and descriptions of the present invention are only used to explain the present invention and are not intended to limit the present invention.

[0060] It should be noted that the terms "comprising" and "having" and any variations thereof in the specification, claims, and accompanying drawings of this invention are intended to cover non-exclusive inclusion, for example, a process, method, system, product, or device that includes a series of steps or units is not necessarily limited to other steps or units inherent in the device.

[0061] The terminology used in the various embodiments of the invention is for the purpose of describing particular embodiments only and is not intended to limit the various embodiments of the invention. As used herein, the singular form is intended to include the plural form as well, unless the context clearly indicates otherwise. Unless otherwise defined, all terms used herein (including technical and scientific terms) have the same meaning as commonly understood by one of ordinary skill in the art to which the various embodiments of the invention pertain. The terms (such as those defined in commonly used dictionaries) are to be interpreted as having the same meaning as in the context of the relevant technical field and are not to be interpreted as having an idealized or overly formal meaning, unless clearly defined in the various embodiments of the invention.

[0062] To address the difficulty of existing technologies in identifying deep-seated collusion relationships across projects and time periods, this invention proposes an intelligent early warning method for abnormal bidding behavior. This method is applicable to bidding activities in various public resource trading fields, including engineering construction, government procurement, property rights transactions, and land transfers. It can be deployed on electronic bidding platforms and public resource trading supervision platforms to achieve real-time monitoring and early warning of abnormal behavior throughout the entire bidding process. The specific embodiments of this invention are described in detail below with reference to the accompanying drawings.

[0063] Please see Figure 1 The intelligent early warning method for abnormal bidding behavior in this embodiment includes the following steps S101~S105.

[0064] S101, obtain full-process data of the target project, including: bidder information, bid documents, quotation data, and bidder behavior logs.

[0065] In this step, the target project can be a project currently in the bidding or evaluation stage, or a completed project requiring post-project quality inspection. The target project can include one or more projects. When issuing intelligent alerts for multiple projects simultaneously, the alert can be issued individually for each project, or the entire process data of multiple projects can be extracted for analysis and alerting.

[0066] The method in this embodiment can be executed through a preset program, electronic device, or intelligent early warning system. The program / device / system achieves real-time or batch collection of data throughout the entire process by connecting to the data interface of the electronic bidding platform database. This data includes bidder information, bid documents, price data, bidder behavior logs, etc., and can also collect review process data according to actual regulatory needs.

[0067] The specific content and function of each data type are as follows:

[0068] Bidder information: This includes all bidders' qualification documents, commercial bids, technical bids, list documents, and metadata, which form the basis for identifying bidders and conducting related information mining.

[0069] Tender documents: including the complete electronic text and formatted files of the tender documents, used to detect the text similarity of documents from different bidders and identify clues of bid rigging;

[0070] Price quotation data: This includes all bidders' bid prices, itemized prices, and the deviation rate between the bid prices and the tender control price, which is used to detect numerical regularities among the bid prices;

[0071] Bidder Behavior Log: This includes digital certificate information generated from the bid documents, hardware / network identifiers such as IP address, MAC address, and dongle serial number of the bid documents submitted, as well as behavioral trajectories and timestamps before and after submission. It is the core data for detecting shared equipment / network and abnormal submission behavior by bidders.

[0072] Review process data includes detailed expert scores, evaluation committee discussion records, audio and video monitoring texts, and expert browsing behavior logs. These data are used to extract dynamic risk characteristics during the review stage and achieve full-process risk and post-event monitoring.

[0073] S102, perform preliminary anomaly detection based on full-process data, and generate a list of suspicious points based on the detection results.

[0074] This step can be performed by a lightweight rule-based model, focusing on detecting explicit anomalies within the target project. It identifies anomalies and generates a list of suspicious activities by detecting whether the bidding behavior characteristics of different bidders are identical or similar. This list includes structured information such as the type of anomaly, the bidders involved, and a summary of the anomaly evidence.

[0075] Specifically, preliminary anomaly detection includes detecting whether the bidding behavior characteristics of different bidders are the same or similar, and recording the detected anomalies, the bidders involved, the anomaly type, and a summary of evidence in a suspicious list. Anomalies include at least one of the following: abnormal pricing, similar bid texts, and abnormal submission behavior.

[0076] The detection methods for various abnormal behaviors are as follows:

[0077] (1) Detection of numerical regularity in bid price: Through numerical analysis, detect whether there is a preset numerical regularity in the bid price of each bidder, such as the presence of arithmetic sequence, geometric sequence, fixed percentage downward / upward fluctuation, constant bid price difference, etc. If such a pre-set numerical regularity exists, it is judged as an abnormal bid price.

[0078] (2) Tender document text similarity detection: Text similarity algorithms (such as cosine similarity, Jaccard similarity) are used to calculate the similarity of the text in the technical bid, commercial bid and other key sections of the tender documents of different bidders. If the similarity reaches the set threshold (such as 70% similarity), it is determined that the document similarity is abnormal.

[0079] (3) Detection of overlapping network / hardware device identifiers: Extract the network address (IP address) and hardware device identifier (MAC address, encryption lock serial number, etc.) of the bid documents submitted by different bidders and compare them. If there is an overlap of network address and / or hardware device identifier, it is determined that the submission behavior is abnormal.

[0080] This step allows for the rapid identification of obviously abnormal bidders and behaviors within the target project, defining the key query scope for subsequent cross-project correlation analysis and improving the efficiency of the analysis.

[0081] Furthermore, preliminary anomaly detection may also include detecting the metadata of the tender documents, detecting the tender submission time, and detecting the information in the qualification documents.

[0082] The tender document metadata detection involves extracting metadata such as creation time, modification time, editing device information, and file format template. If different bidders' tender documents have highly consistent metadata without a reasonable explanation, it is determined to be metadata anomaly. The tender submission time detection involves statistically analyzing the timestamps of each bidder's tender documents. If multiple bidders submit their tender documents within the same time period, and the time interval between submissions is less than a preset threshold, or if the submission times are all close to the tender deadline and there is overlap in the operation trajectory, it is determined to be submission time anomaly. The qualification document information detection involves comparing information such as contact person, contact number, and mailing address in the qualification documents of different bidders. If there is completely consistent or highly similar information without a reasonable explanation, it is determined to be qualification document information anomaly.

[0083] S103 uses the bidders of the target project as the starting point for the query and extracts related information from the related data sources based on preset multi-dimensional association rules.

[0084] This step takes all bidders of the target project identified in step S102 as the core query starting point, mines more related information beyond the target project from the associated data source, and finally constructs a multi-dimensional set of related information.

[0085] Among them, the associated data sources include the bidder's historical participation in projects, which can be accessed in real time through web crawlers or API interfaces. These sources include publicly available information such as the company's official website, public resource trading center, government procurement website, and other bidding project websites. By searching these sources, a historical project database can be formed, and projects in which bidders participate across regions and time periods can be discovered. Based on this project data, it can be determined whether there are any hidden relationships between bidders.

[0086] Multidimensional association rules are a pre-defined set of rules used to define "associations," which can include static entity association rules and dynamic behavioral association rules. Static entity association rules, such as joint shareholding, equity control ratio, and the same person serving as a senior executive / shareholder, are mainly used to discover inherent associations between entities; dynamic behavioral association rules, such as shared equipment, similar quotations, similar bid documents, and joint participation in projects, are mainly used to discover dynamic behavioral associations between entities.

[0087] Furthermore, related data sources can also include publicly available web pages that directly or indirectly reflect the relationships between bidders, such as enterprise credit information disclosure systems, business registration information inquiry websites, legal judgment document websites, and intellectual property announcement websites. Based on preset multi-dimensional association rules, business information (enterprise business information, shareholders, senior executives, historical qualification changes, etc.), historical project participation data (tender announcements of completed projects, announcements of winning bids, key information in tender documents, etc.), and behavioral records (anonymized historical bidding behavior logs, equipment / network identification records, etc.) related to bidders are mined from these related data sources.

[0088] In one specific implementation, the bidders of the target project are used as the starting point for the query. Based on the preset multidimensional association rules, the static association information and behavioral association information of all bidders are mined from the association data source.

[0089] Specifically, the business registration information of each bidder is extracted as keywords, and queries are performed in related data sources (such as the Enterprise Credit Information Disclosure System, Business Registration Information Inquiry Website, Legal Judgment Documents Website, Intellectual Property Announcement Website, etc.) to obtain the bidder's related entities and their related types, forming a static candidate set of related entities.

[0090] The related entities include enterprises, groups, or individuals, and the types of relationships include equity control relationships and personnel employment relationships. Business registration information mining can utilize structured data crawling tools to target and crawl enterprise credit information disclosure systems and business registration information platforms. Using the bidder's name and unified social credit code as search keys, core business registration data such as shareholder information, investment ratios, legal representatives, management personnel, branches, and invested enterprises can be extracted. This data can then be used as search keywords to obtain more static related information from related data sources, forming a static related candidate set.

[0091] Furthermore, through manual methods or by utilizing the information extraction and associative reasoning capabilities of large language models, entity recognition and relation extraction can be performed on crawled unstructured business text information to uncover hidden indirect relationships, such as the same person serving as a senior executive in different companies or cross-shareholding among corporate shareholders. Static relational information can be cleaned and organized to form a static relational candidate set.

[0092] Specifically, the bidding behavior characteristics of each bidder in the target project are extracted, and the bidding behavior characteristics are used as query conditions to query similar bidding entities with the same or similar bidding behavior characteristics and their similar behaviors in the bidder's historical participation projects, forming a candidate set of behavior associations;

[0093] Similar behaviors include equipment sharing, similar pricing, and similar bid documents, and can also include joint bidding. When considering joint bidding, similar bidding entities are all other participants in the bidder's historical projects, thus covering more comprehensive data and recording specific similar behaviors. If the amount of historical project data is too large, the joint bidding feature can be discarded, and only equipment sharing, similar pricing, and similar bid documents can be considered. This involves extracting entities among other participants that exhibit only these similar behavioral characteristics, thereby eliminating a large amount of interfering data.

[0094] By constructing a feature vector library of bidders' bidding behavior and matching it with historical project data, similar behavioral characteristics of other participants can be identified. First, the bidders' bidding behavior characteristics in the target project are quantified into multi-dimensional feature vectors, including price deviation rate, text similarity feature values, device identifier hash values, and submission time features. Then, vector similarity matching algorithms (such as K-nearest neighbors and cosine similarity matching) are used to perform similarity searches in the bidders' historical project behavior feature library, matching similar bidders whose feature vector similarity reaches a set threshold.

[0095] By clustering historical bidding behavior data, entities with similar bidding behaviors can be grouped together to identify potential colluding entities. Simultaneously, by using large-scale models or pattern recognition to analyze unstructured bidding behavior logs, similar behavioral patterns such as equipment sharing, price collusion, and text plagiarism can be identified.

[0096] Finally, the static and behavioral association candidate sets are merged and deduplicated to construct a set of association information containing all bidders, related entities and their association types, similar bidding entities and their similar behaviors, and source evidence. The merging process involves combining the static and behavioral association candidate sets by bidder name to form a preliminary association information set, including information such as bidder, related entity, similar bidding entity, association type, similar behavior, and association basis. The deduplication process uses a dual deduplication rule of entity deduplication and association relationship deduplication to remove duplicates from the preliminary association information set. When the same bidder and the same related entity have the same equity control relationship multiple times, only one record is retained, and the latest information on the association basis is updated.

[0097] Finally, source evidence is added to each piece of related information in the related information set, including the data source platform, query timestamp, and original data link, and added to the related information set to form a corresponding relationship with the association type and similar behavior, ensuring the traceability of the related information.

[0098] The associated information set breaks through the data limitations of a single project, discovering the static subject associations and dynamic behavioral associations of bidders across projects and time and space, providing data support for identifying implicit collusion relationships.

[0099] In public resource trading platforms, projects cover multiple fields such as engineering construction, government procurement, property rights transactions, and land transfers, involving diverse types of entities with increasingly hidden relationships. The evaluation methods, pricing rules, and transaction processes vary significantly across different fields, leading to a high false alarm rate in detection results and hindering direct application. However, the method of this invention uses the bidders of the target project as the starting point for querying, mining historical correlation information of each bidder from related data sources as the basis for analysis. It is not limited to the same platform or field, making it applicable to multiple project types and multi-field scenarios, thus solving application challenges.

[0100] S104. Construct a dynamic event graph centered on the target project based on the associated information, and reveal cross-project associated risk information based on the dynamic event graph.

[0101] This step consists of two sub-steps: constructing a dynamic event graph centered on the target project and revealing cross-project related risk information based on the graph. By using a graph-based approach, multi-dimensional information such as bidders, related entities, historical projects, and bidding behavior are linked to achieve visualization and quantitative analysis of cross-project related risks.

[0102] The nodes of the graph are defined as the target project, bidders, and related entities, similar bidding entities, and projects in which the bidders have historically participated in the related information set. Nodes are categorized and labeled according to entity type and project type. Graph edges are defined as the actual relationships between nodes, including static relationships such as equity control and personnel appointments between entities, and dynamic relationships such as bidding behavior, equipment sharing, and similar pricing between entities and projects. Basic attributes such as relationship type, relationship time, and relationship frequency are labeled on all graph edges. Finally, all nodes are connected to the attributed graph edges according to their relationships, generating a dynamic event graph centered on the target project and radiating to related entities and historical projects.

[0103] A global traversal of the visualized dynamic event graph is performed. By statistically analyzing the correlation of nodes based on correlation type, correlation time, and correlation frequency, clusters of entities with correlation higher than a preset threshold and joint bidding behavior in multiple historical projects are marked as risk entities. Correlation evidence is extracted to form cross-project correlation risk information.

[0104] In a further implementation, a dynamic event graph is established using a hierarchical subgraph structure. The lower-level subgraph focuses on the inherent attribute relationships between market entities, while the upper-level subgraph focuses on the behavioral relationships between projects and entities. This allows for a more comprehensive and accurate revelation of implicit relationships involving cross-project collusion. At the same time, the cross-layer structure significantly improves the interpretability of the graph, enabling regulators to clearly trace whether the source of risk is entity association or behavioral coordination.

[0105] like Figure 2 The diagram shows the flowchart of the method for constructing a hierarchical subgraph structure dynamic event graph, which includes the following sub-steps.

[0106] S201, Establish the lower-level static subgraph: Use the bidders, related entities, and similar bidding entities in the associated information set as graph nodes, and the association type as graph edges to establish a static subgraph.

[0107] The bidders in the associated information set are all bidders of the target project. The associated entities are enterprises, groups or individuals with inherent connections to the bidders, which are retrieved from the associated data source, starting from all bidders of the target project. The association type is the inherent relationship between the bidder and the associated entity, such as equity control relationship or personnel employment relationship.

[0108] The static subgraph reflects the inherent relationships between various market entities and forms the basis for uncovering implicit entity relationships. If the relationship information shows that bidder A of the target project is the holding company of related entity B (which may be the bidder of the target project or an entity outside the target project), then in the static subgraph, A and B are constructed as two nodes, which are connected by a "shareholding control relationship - holding" relationship edge.

[0109] S202, Establish the upper-level event subgraph: Take the target project, the bidders of the target project, the bidders' historical projects, and other bidding entities (similar bidding entities) in the historical projects as graph nodes, and connect each node with bidding behavior and similar behavior as relationship edges to construct an event subgraph centered on the target project.

[0110] In this subgraph, the target project and historically participated projects are designated as project nodes, while the bidders for the target project and similar bidders are designated as bidder nodes. In the event subgraph, project nodes and bidder nodes are connected based on the existence of bidding behavior, forming bidding relationship edges. Bidder nodes are connected based on the existence of similar behaviors (such as shared equipment, similar pricing, similar text, etc.), forming behavioral relationship edges. Similar behaviors such as the number of times they jointly bid, the equipment used, the distribution of bidding time, and pricing patterns are labeled as edge attributes on these behavioral relationship edges.

[0111] Bidding relationship edges represent a bidder's participation in a project's bidding behavior, while behavioral relationship edges represent cross-project behavioral collaboration among bidders. Labeling edge attributes on behavioral relationship edges can provide data support for subsequent risk quantification. For example, if the event subgraph shows that bidder A and bidder C jointly bid in both historical projects X and Y, and their bids consistently maintained a fixed price difference, then although initial anomaly detection did not reveal any significant anomalies in the target project, their bid anomalies in historical projects suggest a potential correlation.

[0112] S203, integrate static subgraphs and event subgraphs to generate a dynamic event graph: map the bidder nodes in the event subgraphs to the graph nodes in the static subgraphs, that is, match the nodes of the same market entity, and establish cross-layer association edges between the matched nodes, integrate the static subgraphs and event subgraphs into a whole, and finally generate a dynamic event graph centered on the target project.

[0113] The dynamic event graph is a dynamically updatable graph that can add nodes, edges, and edge attributes in real time based on new bidding behaviors and new correlation information. It can accurately reflect the combination of static correlations and dynamic behavioral collaborations between market participants. This dynamic event graph can be updated in real time until the target project is completed. After that, the dynamic event graph can be deleted to free up system space. Cross-project correlation risk information analyzed from the dynamic event graph can be stored in the system as a new correlation data source.

[0114] In a further implementation, edge weights are added to all relational edges in the dynamic event graph. These weights are set based on the strength of the relationship. For example, in equity control relationships, the edge weight for wholly owned subsidiaries is greater than that for minority shareholders; in behavioral relationships, the more times there are joint bids and the higher the similarity of bids, the greater the edge weight. By setting these edge weights, the accuracy of risk quantification can be improved in subsequent risk analysis.

[0115] This step utilizes a method based on dynamic event graphs to reveal cross-project related risk information. Specifically, this involves performing topological analysis and pattern recognition on the dynamic event graphs to extract cross-project related risk information, such as... Figure 3 As shown, it includes the following sub-steps.

[0116] S301, Extract risk feature subgraphs: Use graph traversal algorithms (such as depth-first search and breadth-first search) to perform a full graph traversal of the dynamic event graph, and combine it with topology analysis algorithms to extract risk feature subgraphs.

[0117] Risk feature subgraphs are local subgraphs in the graph that have collusion risk characteristics, including two types: densely connected subgraphs and indirectly related path subgraphs.

[0118] A densely connected subgraph refers to a high-density connection structure formed between bidder nodes through shared equipment, shared personnel, or multiple historical shared bidding relationships. For example, there are behavioral relationship edges between 3 or more bidder nodes, and / or the total edge weight reaches a set threshold.

[0119] An indirect association path subgraph refers to a connection structure where there is no direct edge between two bidder nodes, but a reachable path is formed through one or more intermediate nodes (such as related entities or similar bidding entities). For example, bidder A and bidder C are not directly related, but both have equity control relationships with related entity B, and ACB forms an indirect association path.

[0120] S302, Risk Group Classification: For the extracted risk feature subgraph, set risk group classification rules. For example, bidders that meet the criteria of having direct or indirect related paths between bidder nodes and having shared bidding behavior in at least two or more historical projects are classified as the same risk group.

[0121] The above classification rules take into account both the relationships between the entities and the cross-project behavioral collaboration, which can accurately identify bid-rigging groups that use guerrilla tactics and solve the problem that existing technologies cannot identify cross-project collusion.

[0122] S303, Quantifying Associated Risks: Based on four dimensions—the number of associated paths, the number of joint bids, the similarity of bidding behavior characteristics, and the size of the group—a weighted summation algorithm is used to assign an associated risk value to each risk group. The identified risk groups, their associated evidence, and the associated risk values ​​are packaged into cross-project associated risk information.

[0123] The specific calculation method for the associated risk value can be as follows: Associated Risk Value = ×Number of associated paths+ ×Number of joint bids+ ×Similarity of Bidding Behavior Characteristics+ × Gang size; among them , , , As a weighting coefficient, it can be flexibly configured according to the regulatory focus of different transaction scenarios, and meets the following requirements. .

[0124] The similarity of bidding behavior characteristics can be calculated based on at least one of the following: the number of joint bids, the distribution of bidding time, and the pricing pattern on the behavioral relationship edges in the event subgraph; or a weighted average algorithm can be used to calculate the comprehensive similarity of multi-dimensional behavioral characteristics. Finally, the identified risk groups, the evidence of association between each bidder within the group (such as association paths, joint bidding projects, and similar behavior records), and the association risk values ​​of each group are packaged to form cross-project association risk information. This information is structured data and can be directly used for subsequent fusion analysis.

[0125] Furthermore, after setting edge weights for the edges of the dynamic event graph, these edge weights are integrated into the risk analysis process, with specific applications as follows:

[0126] (1) Optimization of risk feature subgraph extraction: When extracting densely connected subgraphs, the sum of edge weights is used as the judgment indicator instead of the number of edges. Only when the sum of edge weights between nodes reaches the set threshold is it judged as a densely connected subgraph, thus improving the accuracy of risk subgraph extraction.

[0127] (2) Calculation of associated path weight: For each indirect associated path between bidder nodes, calculate the product of the weights of all graph edges on the path as the comprehensive weight of the associated path. Include associated paths with a comprehensive weight greater than a preset threshold in the risk analysis scope and filter out weak associated paths.

[0128] (3) Risk value quantification correction: The edge weight factor is incorporated into the original formula for calculating the associated risk value. The corrected formula is: Associated risk value = × (Number of associated paths × Overall weight of associated paths) + × (Number of joint bids × Average weight of behavior edges) + ×Similarity of Bidding Behavior Characteristics+ ×Group size makes the risk value more closely reflect the actual strength of the association; , , , As a weighting coefficient, it can be flexibly configured according to the regulatory focus of different transaction scenarios, and meets the following requirements. .

[0129] (4) Dynamic update closed loop of graph: The risk quantification results are fed back to the dynamic event graph. For graph edges with risk values ​​higher than the preset threshold, their weights are increased according to the risk level; for weakly related edges with no risk, their weights are reduced, so as to realize the dynamic update of graph edge weights and provide more accurate weight basis for the correlation analysis of other projects in the future.

[0130] S105 integrates and analyzes the list of suspicious points and cross-project related risk information to generate early warning information.

[0131] This step integrates and analyzes the list of suspicious points obtained in S102 and the cross-project related risk information obtained in S104 to generate structured early warning information. The specific process is as follows: Figure 4 As shown, it includes the following sub-steps.

[0132] S401, Identify Abnormal Bidders: Merge the bidders in the suspicious list with those involved in the cross-project related risk information, and remove duplicate entities to obtain the abnormal bidder set. This set represents the sum of bidders in the target project who exhibit abnormal behavior or cross-project collusion risks.

[0133] S402, Generate structured early warning information: Based on the abnormal behavior of abnormal bidders in the target project (from the list of suspicious points) and cross-project related risk information (from the dynamic event graph), generate structured early warning information for each abnormal bidder.

[0134] This information should include at least: the name of the abnormal bidder, the type of abnormal behavior and evidence within the target project, the type of cross-project related risks (such as members of the risky group, the connection path), the associated risk value, and the risk level. The risk level can be classified according to the associated risk value, such as high, medium, and low.

[0135] In one specific implementation, if the overall process data includes review process data, then review anomaly features are extracted from the review process data. These features are then combined with the list of suspicious points, the cross-project related risk information, and the review anomaly features for collaborative analysis, ultimately generating structured comprehensive early warning information to achieve full-process early warning. Specific steps are as follows: Figure 5 As shown.

[0136] S501, Extract Review Anomaly Features: Extract anomaly features from the review process data. This can be achieved using algorithms such as Natural Language Processing (NLP) and statistical analysis. Review anomaly features include at least one of the following:

[0137] Scoring anomaly characteristics: Standardize the scores of each expert, calculate the mean score of all experts for the same bidder, identify outlier experts whose scores deviate significantly from the mean score, and calculate their outlier degree, i.e., the standard deviation multiple of the deviation from the mean.

[0138] Anomaly features in speech: Natural language processing (including text recognition and semantic analysis) is performed on the audio and video monitoring text of the bidding evaluation to extract speech fragments in which experts defend a specific bidder, raise excessive questions about a bidder, or imply their intention to win the bid, as anomaly features in speech;

[0139] Abnormal browsing behavior: Analyze the time distribution of experts browsing each tender document (such as total browsing time and browsing time of each chapter) to identify abnormal browsing behavior, such as an unusually short browsing time for a certain tender document (suggesting that they are already familiar with the content of the tender document) or an unusually long browsing time for a certain tender document (suggesting that they are helping to find scoring points).

[0140] S502, Multi-dimensional Collaborative Analysis: The risk fusion engine takes the list of suspicious points, cross-project related risk information, and review anomaly characteristics as inputs to perform multi-dimensional collaborative analysis and output comprehensive early warning information.

[0141] The risk fusion engine is an analysis model based on rules and quantitative scoring. It has various judgment rules set up inside, such as risk coupling rules, risk addition rules, and risk clarification rules.

[0142] Risk Coupling Rule: If an abnormal bidder in the list of suspicious points / cross-project related risk information has corresponding outlier expert ratings, biased comments, or other abnormal review characteristics during the review stage, and the outlier expert has a potential connection with the bidder (such as geographical connection, personnel connection, or appearance in the dynamic event graph), then the risk level of the bidder will be increased.

[0143] New risk rules: If a bidder in a target project that is not listed in the list of suspicious points or identified as a risk group shows a collaborative scoring pattern among multiple experts during the review stage, or exhibits other abnormal review characteristics, then the bidder will be added as an abnormal bidder, and cross-project correlation analysis will be triggered in reverse.

[0144] Risk clarification rules: If a bidder listed in the list of suspicious points / cross-project related risk information is found to have objective and consistent scores from all experts during the review stage, with no biased comments or abnormal browsing behavior, then the risk level of that bidder will be appropriately reduced, and the warning information will include a note stating "No abnormalities were found during the review process".

[0145] Among them, the cross-project correlation analysis triggered by the new risk rules is a supplement and enhancement to the original cross-project correlation information mining and analysis process. When the risk fusion engine identifies a new abnormal bidder (not appearing in the suspicious list or the original cross-project correlation risk information) during the review stage, it takes the new abnormal bidder as an independent query starting point. Based on the preset multi-dimensional correlation rules, it conducts full-dimensional mining of the new abnormal bidder's business information and historical bidding behavior characteristics, supplements and constructs its correlation information set, and adds the nodes, related entity nodes, and related graph edges / attributes of the new abnormal bidder to the constructed dynamic event graph, realizing real-time expansion of the graph. The updated dynamic event graph is then re-traversed, topologically analyzed, and risk grouped, quantifying the correlation risk value of the new abnormal bidder.

[0146] The cross-project related risk information obtained from incremental analysis is integrated with the abnormal characteristics of the review to update the comprehensive early warning information, and the risk information of newly added abnormal bidders is included in the final early warning result.

[0147] This implementation method triggers cross-project correlation analysis by adding abnormal bidders, enabling two-way interaction and iterative optimization of correlation information mining and review risk monitoring for new risk clues discovered during the review stage. It addresses the issues of missed detections in the initial screening and correlation analysis during the bidding process, and the inability to trace new risks during the review stage. By mutually corroborating incremental cross-project correlation information with abnormal review characteristics, it provides dual evidence for the risk assessment of newly added abnormal bidders, enhancing the credibility of the early warning results.

[0148] Furthermore, the risk fusion engine's judgment rules and the weights of each risk dimension can be configured according to different transaction scenarios such as engineering construction and government procurement. For example, engineering construction projects focus on abnormalities in quotations and technical bid documents, while government procurement projects focus on abnormalities in the scoring during the review stage. This configurability improves the system's scenario adaptability.

[0149] Output comprehensive early warning information: Based on the collaborative analysis results of the risk fusion engine, comprehensive early warning information is output. This information, in addition to the basic early warning information, adds risk characteristics and evidence from the review stage, forming a complete evidence chain from the bidding stage to the review stage. It also includes dynamic adjustment results of risk levels, information on newly added abnormal bidders, etc., providing regulatory authorities with a more comprehensive and accurate basis for risk early warning.

[0150] Furthermore, a visual evidence chain is generated based on comprehensive early warning information, including a visual display of dynamic event graphs, a timeline display of abnormal behavior, and a display of the correlation of multi-dimensional evidence. Regulatory personnel can intuitively view all risk evidence and correlations of abnormal bidders through a visual interface.

[0151] Based on the same inventive concept, embodiments of the present invention also propose an intelligent early warning system for bidding and tendering transaction processes, such as... Figure 6 As shown, it includes:

[0152] The data acquisition module 601 is used to acquire the full-process data of the target project, including bidder information, bid documents, quotation data and bidder behavior logs.

[0153] The suspicious point screening module 602 is used to perform preliminary anomaly detection based on the full-process data and generate a list of suspicious points based on the detection results.

[0154] The association mining module 603 is used to mine association information from the association data source based on the bidder of the target project as the starting point of the query and a preset multidimensional association rule. The association data source includes the bidder's historical participation in projects.

[0155] Risk analysis module 604 is used to construct a dynamic event graph centered on the target project based on the correlation information, and to reveal cross-project related risk information based on the dynamic event graph;

[0156] The fusion analysis module 605 is used to perform fusion analysis on the list of suspicious points and the cross-project related risk information to generate early warning information.

[0157] The above modules are collaborative and interconnected hardware / software modules that can be deployed on hardware devices such as servers and cloud computing platforms to realize all the functions of the intelligent early warning method for abnormal bidding behavior.

[0158] The data acquisition module 601 interfaces with the databases of electronic bidding platforms, regulatory platforms, etc., to achieve real-time / batch collection of data throughout the entire process of the target project. The data acquisition module 601 can also collect data from the review process of the target project as needed, and perform anonymization, cleaning, and standardization on the collected data to provide a high-quality data source for subsequent analysis.

[0159] The Suspicious Point Screening Module 602 incorporates a lightweight rule-based model, including algorithms for detecting patterns in bid prices, text similarity, and overlapping device / network identifiers. This allows for the rapid identification of obvious anomalies and bidders within the target project. Its detection content specifically includes at least one of the following:

[0160] To detect whether there is a pre-set numerical pattern among the various bid prices;

[0161] Detect whether the text similarity of different bidders' bid documents in preset key sections reaches a set threshold;

[0162] Detect whether there is any overlap in the network addresses and / or hardware device identifiers used by different bidders in submitting their bid documents.

[0163] The suspicious point screening module 602 records the detected abnormal behaviors, the bidders involved, the type of abnormality, and the summary of evidence to the suspicious point list.

[0164] The association mining module 603 incorporates algorithms such as keyword query, fuzzy matching, and data deduplication, enabling the construction of static association candidate sets and behavioral association candidate sets, and merging them to generate a set of association information.

[0165] Furthermore, the association mining module 603 extracts the business registration information of each bidder as keywords, executes queries in the associated data source to obtain the bidder's associated entities and their associated types (equity control relationship, personnel appointment relationship), forming a static association candidate set; it extracts the bidding behavior characteristics of each bidder in the target project, uses the bidding behavior characteristics as query conditions, and queries similar bidding entities and their similar behaviors (equipment sharing behavior, similar pricing and similar bidding text) with the same or similar bidding behavior characteristics in the bidder's historical participation projects, forming a behavior association candidate set; then it merges and deduplicates the static association candidate set and the behavior association candidate set to construct an association information set containing bidders, associated entities and their associated types, similar bidding entities and their similar behaviors, and source evidence.

[0166] Furthermore, the risk analysis module 604 incorporates a graph construction module and a risk analysis module. The built-in graph construction module includes a static subgraph construction submodule, an event subgraph construction submodule, and a subgraph association mapping submodule. The static subgraph construction submodule uses bidders, related entities, and similar bidding entities in the related information set as graph nodes, and association types as graph edges, to build a static subgraph reflecting the inherent relationships between entities. The event subgraph construction submodule uses the target project and historically participated projects as project nodes, bidders and similar bidding entities as bidder nodes, and bidding behavior as the bidding relationship edges connecting project nodes and bidder nodes. Similar behavior is used as the behavior relationship edges connecting each bidder node, and the edges are labeled with common bidding frequency, bidding time distribution, and pricing patterns as edge attributes, constructing an event subgraph centered on the target project. The subgraph association mapping submodule maps the bidder nodes of the event subgraph to the graph nodes of the static subgraph, establishing cross-layer association edges and generating a dynamic event graph centered on the target project.

[0167] The risk analysis module includes graph traversal and topology analysis algorithms, risk group segmentation algorithms, and risk quantification algorithms, which can realize functions such as risk feature subgraph extraction, risk group identification, and related risk value calculation.

[0168] Graph traversal and topology analysis algorithms are used to perform graph traversal and topology analysis on the dynamic event graph to extract risk feature subgraphs. These risk feature subgraphs include densely connected subgraphs and indirectly related path subgraphs. Densely connected subgraphs are high-density connection structures formed between bidder nodes through shared equipment, shared personnel, or multiple historical shared bidding relationships. Indirectly related path subgraphs are connection structures where there are no direct edges between two bidder nodes, but a reachable path is formed through one or more intermediate nodes.

[0169] The risk group segmentation algorithm classifies bidders in the risk feature subgraph who meet the following criteria: there is a direct or indirect link between their nodes, and they have shared bidding behavior in at least two or more historical projects.

[0170] The risk quantification algorithm calculates the similarity of bidding behavior features based on at least one of the following: the number of joint bids, the distribution of bidding time, and the pricing pattern on the behavioral relationship edges in the event subgraph. It then assigns a related risk value to each risky group based on the number of associated paths, the number of joint bids, the similarity of bidding behavior features, and the group size.

[0171] Finally, the risk analysis module packages the identified risk groups, their associated evidence, and associated risk values ​​into cross-project associated risk information.

[0172] The integrated analysis module 605 incorporates natural language processing and statistical analysis algorithms to extract abnormal review features. It also features a risk fusion engine to achieve integrated analysis of suspicious point lists and cross-project related risk information, as well as multi-dimensional collaborative analysis of suspicious point lists, cross-project related risk information, and abnormal review features. Ultimately, it outputs structured early warning information and / or comprehensive early warning information.

[0173] The fusion analysis module 605 performs fusion analysis on the list of suspicious points and the cross-project related risk information to generate early warning information. Specifically, it includes: merging the bidders in the list of suspicious points with the bidders involved in the cross-project related risk information to obtain abnormal bidders; and generating structured early warning information containing risk subjects and evidence based on the abnormal behavior of abnormal bidders in the target project and the cross-project related risk information.

[0174] Furthermore, the integrated analysis module 605 also extracts review anomaly features from the review process data of the target project, conducts collaborative analysis on the list of suspicious points, cross-project related risk information and review anomaly features, and outputs comprehensive early warning information. The extracted review anomaly features and their extraction methods include at least one of the following: (1) standardizing the scores of each expert, identifying outliers whose scores for bidders deviate significantly from the mean score, and calculating their degree of outlier; (2) performing natural language processing on the audio and video text of the bid evaluation, extracting speech fragments that defend, excessively question or imply the intention to win the bid; analyzing the time distribution of experts browsing each bid document, and identifying abnormal browsing behavior.

[0175] Furthermore, the risk fusion engine is an analysis model based on rules and quantitative scoring. It has various judgment rules set up inside, such as risk coupling rules, risk addition rules, and risk clarification rules. For specific rule settings, please refer to the aforementioned embodiments, which will not be repeated here.

[0176] Furthermore, the system may also include a visualization module and a rule configuration module. The visualization module displays dynamic event graphs, early warning information, and comprehensive early warning information in a visual format, including graph visualizations, data tables, and evidence chain timelines, enhancing the user experience for regulators. The rule configuration module allows for flexible configuration of preset rules, weight coefficients, and thresholds in each module. For example, it allows adjusting text similarity thresholds, weight coefficients for calculating associated risk values, and the judgment rules of the risk fusion engine, enabling the system to adapt to different public resource transaction scenarios.

[0177] Embodiments of the present invention also provide an electronic device comprising a processor and a memory, wherein the number of processors may be one or more. The memory, as a computer-readable storage medium, can be used to store software programs, computer-executable programs, and modules. The processor executes various functional applications and data processing of the electronic device by running the software programs, instructions, and modules stored in the memory, thereby realizing the intelligent early warning method for abnormal bidding behavior according to any of the above embodiments of the present invention.

[0178] The memory may primarily comprise a program storage area and a data storage area. The program storage area may store the operating system and at least one application program required for a given function; the data storage area may store data created based on terminal usage. Furthermore, the memory may include high-speed random access memory (RAM) and non-volatile memory, such as at least one disk storage device, flash memory, or other non-volatile solid-state storage device. In some instances, the memory may further include memory remotely located relative to the processor, which can be connected to the electronic device via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks (LANs), mobile communication networks, and combinations thereof.

[0179] Embodiments of the present invention also provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the intelligent early warning method for abnormal bidding behavior according to any embodiment of the present invention.

[0180] The computer storage medium of this invention can be any combination of one or more computer-readable media. A computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. A computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of computer-readable storage media (a non-exhaustive list) include: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this invention, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0181] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, capable of sending, propagating, or transmitting programs for use by or in connection with an instruction execution system, apparatus, or device.

[0182] Embodiments of the present invention also provide a computer program product that, when run on a computer, causes the computer to execute the intelligent early warning method for abnormal bidding behavior according to any of the above embodiments of the present invention.

[0183] The above embodiments are merely preferred embodiments of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the appended claims.

Claims

1. A method for intelligent early warning of abnormal bidding behavior, characterized in that, include: Obtain full-process data for the target project, including bidder information, bid documents, pricing data, and bidder behavior logs; Preliminary anomaly detection is performed based on the full-process data, and a list of suspicious points is generated based on the detection results. Starting with all bidders of the target project, and based on preset multidimensional association rules, association information is mined from the association data source. The association data source includes the bidder's historical participation in projects; the association information includes similar bidding entities and their similar behaviors that have the same or similar bidding behavior characteristics as the bidder in the historical participation projects. Based on the associated information, a dynamic event graph centered on the target project is constructed, and cross-project associated risk information is revealed based on the dynamic event graph. The dynamic event graph uses the target project and the historical participating projects as project nodes, the bidder and the similar bidding entities as bidder nodes, and the actual relationship between nodes as graph edges. The graph edges include bidding relationship edges representing bidding behavior between the project node and the bidder node, and behavioral relationship edges representing similar behaviors between the bidder nodes, with association type, association time, and association frequency as edge attributes; The bidders in the list of suspicious bidders are merged with the bidders involved in the cross-project related risk information to obtain the abnormal bidders; Based on the abnormal behavior of the abnormal bidder in the target project and the cross-project related risk information, a structured early warning message containing the risk subject and evidence is generated; If the full-process data includes review process data, then review anomaly features are extracted from the review process data. The review anomaly features include at least one of rating anomaly features, speech anomaly features, and browsing behavior anomaly features. The list of suspicious points, the cross-project related risk information, and the abnormal review characteristics are analyzed collaboratively to output comprehensive early warning information; If multiple experts present a collaborative scoring pattern during the review stage, or if a new abnormal bidder with other review anomalies is identified, cross-project correlation analysis is triggered: the new abnormal bidder is used as an independent query starting point. Based on preset multi-dimensional correlation rules, the business information and historical bidding behavior characteristics of the new abnormal bidder are fully mined to supplement and construct its correlation information set. The nodes, related entity nodes, and related graph edges and attributes of the new abnormal bidder are added to the constructed dynamic event graph to achieve real-time expansion of the graph. The updated dynamic event graph is then re-traversed, topologically analyzed, and risk groups are divided to quantify the correlation risk value of the new abnormal bidder. The cross-project related risk information obtained from incremental analysis is integrated with the abnormal characteristics of the review to update the comprehensive early warning information, and the risk information of newly added abnormal bidders is included in the final early warning result.

2. The intelligent early warning method for abnormal bidding behavior according to claim 1, characterized in that, The preliminary anomaly detection based on the full-process data, and the generation of a list of suspicious points based on the detection results, include: The system detects whether the bidding behavior characteristics of different bidders are the same or similar, and records the detected abnormal behaviors, the bidders involved, the type of abnormality, and a summary of evidence in a suspicious list; wherein, the abnormal behavior includes at least one of the following: There is a pre-defined numerical pattern among the various bid prices; The text similarity of the bid documents from different bidders in the preset key sections reaches a set threshold; The network addresses and / or hardware device identifiers used by different bidders in submitting their bid documents overlap.

3. The intelligent early warning method for abnormal bidding behavior according to claim 1, characterized in that, The query starts with all bidders of the target project and, based on preset multidimensional association rules, mines association information from association data sources, including: The business registration information of each bidder is extracted as a keyword, and a query is performed in the associated data source to obtain the associated entities and their associated types of the bidder, forming a static candidate set of associations; the association types include equity control relationships and personnel appointment relationships. Extract the bidding behavior characteristics of each bidder in the target project, and use the bidding behavior characteristics as query conditions to query similar bidding entities with the same or similar bidding behavior characteristics and their similar behaviors in the historical projects participated in, forming a candidate set of behavior associations; the similar behaviors include equipment sharing behavior, similar pricing and similar bidding text; The static association candidate set and the behavioral association candidate set are merged and deduplicated to construct an association information set that includes the bidder, the associated entity and its association type, the similar bidding entities and their similar behaviors and source evidence.

4. The intelligent early warning method for abnormal bidding behavior according to claim 3, characterized in that, The step of constructing a dynamic event graph centered on the target project based on the associated information includes: Using the bidders, related entities, and similar bidding entities in the aforementioned set of related information as graph nodes and the association types as graph edges, a static subgraph reflecting the inherent relationships between entities is established. The target project and the historical participating projects are designated as project nodes, the bidders and the similar bidding entities are designated as bidder nodes, the bidding behavior is designated as the bidding relationship edge connecting the project nodes and the bidder nodes, the similar behavior is designated as the behavior relationship edge connecting each bidder node, and the number of joint bids, the distribution of bidding time, and the pricing pattern are labeled on the behavior relationship edge as edge attributes to construct an event subgraph centered on the target project. The bidder nodes of the event subgraph are associated and mapped with the graph nodes of the static subgraph to establish cross-layer association edges, thereby generating a dynamic event graph centered on the target project.

5. The intelligent early warning method for abnormal bidding behavior according to claim 4, characterized in that, The method of revealing cross-project related risk information based on the dynamic event graph includes: The dynamic event graph is traversed and topologically analyzed to extract risk feature subgraphs. Bidders in the risk feature subgraphs who meet the following criteria—direct or indirect links between their nodes and who have engaged in joint bidding in at least two or more historical projects—are grouped into the same risk group. Based on the number of associated paths, the number of joint bids, the similarity of bidding behavior characteristics, and the size of the group, an associated risk value is assigned to each of the risk groups. The identified risk groups, their associated evidence, and the associated risk values ​​are packaged into cross-project associated risk information. The similarity of bidding behavior features is calculated based on at least one of the following: the number of joint bids, the distribution of bidding time, and the pricing pattern on the behavioral relationship edges in the event subgraph; wherein, the risk feature subgraph includes a densely connected subgraph and an indirectly related path subgraph; The dense connection subgraph is a high-density connection structure formed between bidder nodes through shared equipment, shared personnel, or multiple historical joint bidding relationships. The indirect association path subgraph is a connection structure where there is no direct edge between two bidder nodes, but a reachable path is formed through one or more intermediate nodes.

6. The intelligent early warning method for abnormal bidding behavior according to claim 1, characterized in that, The review process data includes at least one of the following: detailed expert scores, discussion records of the bid evaluation committee, audio and video monitoring texts, and logs of expert browsing of bid documents.

7. The intelligent early warning method for abnormal bidding behavior according to claim 6, characterized in that, The extraction of review anomaly features from review process data includes at least one of the following: The scores of each expert are standardized to identify outliers whose scores for bidders deviate significantly from the mean score, and the degree of their outlier is calculated. Natural language processing is used to extract segments of statements that defend, excessively question, or imply the intention to win the bid from the audio and video text of the bid evaluation; the time distribution of experts browsing each bid document is analyzed to identify abnormal browsing behavior.

8. An intelligent early warning system for bidding and tendering transaction processes, characterized in that, The system is used to execute the intelligent early warning method for abnormal bidding behavior as described in any one of claims 1-7, including: The data acquisition module is used to acquire full-process data of the target project, including bidder information, bid documents, quotation data, and bidder behavior logs. The suspicious point screening module is used to perform preliminary anomaly detection based on the full-process data and generate a list of suspicious points based on the detection results. The association mining module is used to mine association information from association data sources based on preset multidimensional association rules, starting from all bidders of the target project; the association data sources include the bidders' historical participation in projects. The risk analysis module is used to construct a dynamic event graph centered on the target project based on the associated information, and to reveal cross-project associated risk information based on the dynamic event graph. The fusion analysis module is used to perform fusion analysis on the list of suspicious points and the cross-project related risk information to generate early warning information.

9. The intelligent early warning system for the bidding and tendering transaction process according to claim 8, characterized in that, The system also includes a visualization module, which is used to display dynamic event graphs, early warning information, and comprehensive early warning information in a visual form.

Images