Intelligent detection and interception method and system for abnormal rebate behavior in recruitment scene
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- CHENGDU BLOG TECHNOLOGY CO LTD
- Filing Date
- 2026-03-05
- Publication Date
- 2026-05-26
Smart Images
Figure CN122089261A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the fields of artificial intelligence and risk management technology, specifically to abnormal behavior detection and interception technology in the context of online recruitment rebates. It belongs to the field of recruitment risk control artificial intelligence technology application that combines federated learning, temporal attention mechanism, knowledge graph and reinforcement learning. The method of this invention can be implemented through corresponding systems. Background Technology
[0002] In the rebate business model of the online recruitment industry, platforms usually launch activities such as "interview rebate" and "share rebate" to incentivize users to participate in the construction of the recruitment ecosystem. However, such activities are easily exploited, and rebates can be obtained through abnormal behaviors such as order brushing, malicious fission, and job posting fraud, causing economic losses to the platform and ecological disorder.
[0003] Existing manual rule-based solutions have an accuracy rate of less than 60% in identifying abnormal behavior, a false interception rate of over 15%, and an average rule update cycle of 15 days, making them unable to cope with the rapid evolution of new cheating behaviors such as order brushing and job fraud. Single-model detection solutions, due to their limited dimensions, have an identification rate of less than 50% for malicious fission behaviors across devices and IPs, and the conflict rate of output results from different models is over 20%, which seriously affects the reliability of risk control decisions.
[0004] Existing anomaly detection and interception solutions for recruitment rebate scenarios mostly rely on logical judgments based on manually set features and rules according to expert experience, or on a single anomaly detection model for risk control. These solutions have significant technical shortcomings in practical applications: manually set rules are poorly adaptable to cheating methods, struggle to quickly keep up with evolving abnormal behaviors, and have high maintenance costs with noticeable lag; the outputs of detection models from different dimensions are prone to conflict, lacking an intelligent adaptive fusion mechanism and failing to form a unified and reliable risk decision; and the interception and punishment strategies are static and have fixed hierarchical characteristics, unable to be dynamically adjusted based on the actual impact of abnormal behavior, user history, and the health of the platform ecosystem, easily leading to false positives against legitimate users or tolerance of abnormal behavior.
[0005] Therefore, developing an abnormal rebate behavior detection and interception solution that combines detection accuracy, scenario adaptability, and intelligent decision-making, tailored to the specific characteristics of recruitment rebate scenarios, has become an urgent need in the current risk control field of recruitment platforms. Summary of the Invention
[0006] This invention aims to solve the core technical problems of existing recruitment rebate anomaly detection and interception schemes, such as reliance on manual rules, difficulty in integrating model results, and rigid interception strategies. It provides an intelligent detection and interception method and system for abnormal rebate behavior in recruitment scenarios. The method achieves multi-dimensional accurate identification and hierarchical dynamic interception of abnormal behavior, while the corresponding system completes the implementation and full-process closed-loop optimization of the method. It protects data privacy while achieving dual continuous self-optimization of the method and system, thereby improving the overall prevention and control efficiency of recruitment platform rebate business.
[0007] To achieve the above-mentioned objectives, this invention provides an intelligent detection and interception method and system for abnormal rebate behavior in recruitment scenarios, comprising the following steps:
[0008] Acquire target user behavior sequence data and associated context data in a recruitment rebate scenario; the behavior sequence data includes at least a timestamp, user identifier, and operation type; the context data includes at least job information, device fingerprint, and network address.
[0009] Based on the behavioral sequence data and the context data, a multimodal feature set for multidimensional anomaly detection is constructed through three steps: feature extraction, feature normalization, and feature fusion. The multimodal feature set includes temporal trajectory features, behavioral node features, entity relationship features, and behavioral feedback features. Each feature dimension is independent and complementary to the others, covering the temporal, attribute, association, and feedback dimensions of user behavior in the recruitment rebate scenario.
[0010] The multimodal feature set is input in parallel into two or more pre-trained anomaly detection models to obtain a corresponding number of anomaly probabilities. The anomaly detection model is any combination of a general anomaly detection model based on federated self-supervised learning, a dynamic anomaly detection model based on temporal attention mechanism, an association anomaly detection model based on knowledge graph, and an anomaly interception and evaluation model based on reinforcement learning strategy. The models achieve technical linkage: the general anomaly features output by the federated self-supervised learning model provide the basis for the temporal encoding of the temporal attention mechanism model, the entity association features output by the knowledge graph model supplement the state input of the reinforcement learning strategy model, and the evaluation results of the reinforcement learning strategy model back-optimize the normal behavior sample screening of the federated self-supervised learning model.
[0011] Based on the obtained anomaly probabilities, the initial confidence level of each anomaly detection model is calculated using a consistency test algorithm.
[0012] The obtained anomaly probabilities and their corresponding initial confidence levels are input into the dynamic arbiter. The dynamic arbiter calculates the dynamic weights of each anomaly detection model based on the historical accuracy feedback of each model output and the dispersion of the initial confidence levels of each model. The specific calculation logic of the consistency concentration J in the dynamic arbiter is as follows: H is the information entropy of the initial confidence vector. c'i is the initial confidence level of each model, and N is the number of anomaly detection models involved in the calculation;
[0013] The dynamic weights are used to weight and fuse the probabilities of each anomaly to generate a comprehensive anomaly score for the target user. The calculation method is as follows: , where i = 1 to N, wi is the dynamic weight of the i-th model, and pi is the anomaly probability of the i-th model;
[0014] Based on the predefined risk level range where the comprehensive anomaly score is located, the interception and punishment strategies corresponding to the risk level range are automatically triggered.
[0015] Collect actual effect feedback data after executing the interception and punishment strategy, and use the effect feedback data to incrementally update the anomaly detection model and the dynamic arbitrator involved in the calculation.
[0016] Furthermore, the execution process of the consistency check algorithm is as follows: construct a probability vector P = [p1, p2, ..., pn] from each anomaly probability, where n is the number of anomaly detection models involved in the calculation; calculate the mean μ and standard deviation σ of the probability vector P; and for the anomaly probability pi of the i-th anomaly detection model, calculate its absolute deviation from the mean μ. Based on the relationship between the absolute deviation di and the standard deviation σ, according to Calculate the initial deviation coefficient ci, where exp is the natural exponential function; normalize the initial deviation coefficient ci to obtain the normalized deviation coefficient. The normalized deviation coefficient c'i is used as the initial confidence level of the i-th anomaly detection model. The higher the value of c'i, the more consistent the output of the model is with the consensus of other models.
[0017] Further, the process of the dynamic arbitrator calculating dynamic weights is as follows: Obtain the accuracy feedback vector A = [a1, a2, ..., an] of each anomaly detection model within a historical period, where ai is the historical accuracy of the i-th model and n is the number of anomaly detection models participating in the calculation; obtain the value of J according to the specific calculation logic of the consistency concentration J, and construct a dynamic decay factor α = J, indicating that the higher the current consistency, the greater the trust in the current consensus, and the corresponding decay of the historical performance weight; according to... Calculate the comprehensive reputation score si of the i-th model, and normalize the comprehensive reputation score vector S = [s1, s2, ..., sn] using the softmax function. Use the normalized result as the dynamic weight W = [w1, w2, ..., wn] for each model.
[0018] Furthermore, the training and output process of the general anomaly detection model based on federated self-supervised learning is as follows: Under the federated learning framework, recruitment rebate behavior data from multiple data participants are aggregated, with each participant's data stored locally to ensure data privacy. Locally, each participant performs self-supervised pre-training using a masked behavior sequence reconstruction method adapted to recruitment behavior features and a normal behavior sequence comparison learning method to obtain a local feature extractor. The recruitment behavior feature adaptation method for masked behavior sequence reconstruction involves introducing a differentiated masking strategy based on behavior importance. First, masking weights are set according to behavior type: interview applications and rebate verification are defined as core behaviors and given high weights; job sharing and account login are defined as non-core behaviors and given low weights. Second, the behavior sequences are weighted and randomly sampled based on these weights to determine the masking positions. The overall masking ratio is controlled within a preset range (e.g., 30%-50%), but during sampling, the probability of core behaviors being selected for masking is significantly higher than that of non-core behaviors. Through this strategy, the model is forced to focus more on the contextual relationships of core behaviors when reconstructing sequences, thereby learning more discriminative anomaly features related to recruitment rebates. Mask positions are randomly selected according to a temporal distribution, while retaining the timestamp-related features of the behavioral sequence. The model completes sequence reconstruction by predicting the behavior type, the time interval between behavior occurrences, and the associated job / equipment entity information at the mask positions. The local feature extractor parameters of each participant are aggregated using a federated averaging algorithm to update the global general anomaly detection model, and this global model is distributed to each participant to generate corresponding anomaly probabilities.
[0019] Furthermore, the output process of the dynamic anomaly detection model based on the temporal attention mechanism is as follows: the temporal trajectory features in the behavior sequence data are encoded into temporal embedding vectors, and the general anomaly features output by the federated self-supervised learning model are incorporated as a supplementary dimension of the embedding vectors; the temporal embedding vectors are input into the temporal attention Transformer encoder to calculate the attention weights between behaviors in different time steps, and output a feature representation containing the temporal context; the feature representation containing the temporal context is input into the classification layer, and the corresponding anomaly probability representing the existence of temporal anomalies in the behavior sequence is output.
[0020] Furthermore, the output process of the knowledge graph-based association anomaly detection model is as follows: Based on the context data, a recruitment scenario knowledge graph subgraph is constructed with users, positions, devices, and network addresses as entities and interviews, sharing, and affiliation as relationships; a graph neural network is used to learn node representations of the knowledge graph subgraph to capture deep association features between entities; based on the deep association features, an anomaly node detection algorithm is used to calculate the degree of anomaly of the target user and its associated entities in the knowledge graph, output the corresponding anomaly probability, and synchronize the deep association features to the reinforcement learning strategy model as a supplementary dimension of state input.
[0021] Furthermore, the output process of the anomaly interception evaluation model based on reinforcement learning strategy is as follows: the target user's historical behavior, the context data, the entity association features output by the knowledge graph model, and the predefined interception action space are used as state inputs; the reinforcement learning agent in the anomaly interception evaluation model evaluates the current state according to the policy network; an evaluation value is output as the corresponding anomaly probability, which reflects the long-term expected benefit that can be obtained by performing interception in the current state and indirectly represents the degree of anomaly risk; at the same time, the evaluation value is fed back to the federated self-supervised learning model for weight adjustment of normal behavior samples.
[0022] Furthermore, the process of constructing the multimodal feature set is as follows: extracting operation type sequences and corresponding time intervals from the behavior sequence data to form temporal trajectory features; extracting operation duration, device type, and client information from single behavior data to form behavior node features; extracting user-job matching degree, number of users sharing the device, and IP geographical clustering degree from the context data to form entity relationship features; and extracting past user complaint records and enterprise rebate verification pass rate from historical feedback data to form behavior feedback features.
[0023] Furthermore, the process of incrementally updating using the effect feedback data is as follows: the actual effect feedback data is compared with the generated comprehensive anomaly score to determine whether the detection was a correct interception, a false interception, a missed interception, or a correct release; based on the determination result, labeled data for model training or reward signals for reinforcement learning are generated; using the labeled data or reward signals, the corresponding anomaly detection model is incrementally trained, and the historical accuracy record of the model in the dynamic arbitrator is updated.
[0024] This invention also provides an intelligent detection and interception system for abnormal rebate behavior in recruitment scenarios, including a data acquisition module for communication connection, a multimodal feature construction module, a multi-model selection detection module, a confidence calculation module, a dynamic arbitration module, a hierarchical interception module, and a feedback update module. Each module collaboratively executes the aforementioned intelligent detection and interception method for abnormal rebate behavior in recruitment scenarios. The specific functions of each module are as follows:
[0025] The data acquisition module is used to collect behavioral sequence data and associated context data of target users in recruitment rebate scenarios, and to perform data cleaning and format standardization.
[0026] The multimodal feature construction module is used to extract and construct a multimodal feature set consisting of temporal trajectory features, behavioral node features, entity relationship features, and behavioral feedback features from the cleaned data;
[0027] The multi-model selection and detection module has built-in a general anomaly detection model based on federated self-supervised learning, a dynamic anomaly detection model based on temporal attention mechanism, an association anomaly detection model based on knowledge graph, and an anomaly interception and evaluation model based on reinforcement learning strategy. It supports arbitrary combination selection and parallel invocation of two or more models, realizes technical linkage between multiple models, reconstruction of mask behavior sequences and adaptation of recruitment behavior features, and outputs the corresponding number of anomaly probabilities.
[0028] The confidence calculation module is used to calculate the initial confidence level of the selected anomaly detection model using a consistency check algorithm.
[0029] The dynamic arbitration module has a built-in logic for calculating the consistency concentration J, which is used to obtain the model's historical accuracy, calculate dynamic weights, and perform weighted fusion of various anomaly probabilities to generate a comprehensive anomaly score for the target user.
[0030] The tiered interception module is used to predefine risk level ranges and automatically trigger corresponding interception and penalty strategies based on the range in which the comprehensive anomaly score falls.
[0031] The feedback update module is used to collect feedback data on the actual effects of the interception and punishment strategies after they are implemented, to perform incremental training on the selected anomaly detection model, and to update the historical accuracy records of the model in the dynamic arbitration module.
[0032] Furthermore, the multi-model selection and detection module is also equipped with a model selection unit and a technology linkage unit. The model selection unit is used to receive model combination instructions configured manually or automatically matched by the system to select and call two or more anomaly detection models. The technology linkage unit is used to realize feature interoperability and reverse optimization of results among the models. Specifically, it synchronizes the general anomaly features of the federated self-supervised learning model to the temporal attention mechanism model, synchronizes the entity association features of the knowledge graph model to the reinforcement learning strategy model, and feeds back the interception benefit evaluation results of the reinforcement learning strategy model to the federated self-supervised learning model.
[0033] Furthermore, the multi-model selection detection module is also equipped with a federated self-supervised learning adaptation unit, which is used to adapt the mask behavior sequence reconstruction to the recruitment behavior features, execute an importance-based weighted masking strategy according to the importance of the core behaviors in the recruitment rebate scenario, and retain the temporal correlation features of the behavior sequence to complete the mask sequence reconstruction.
[0034] Furthermore, the dynamic arbitration module also includes a concentration calculation unit, used to calculate the concentration according to... The logical computational consistency concentration J is given by H, where H is the information entropy of the initial confidence vector. c'i represents the initial confidence level of each model, and N represents the number of selected anomaly detection models.
[0035] This invention achieves fully intelligent detection and interception of abnormal behavior in recruitment rebate scenarios by constructing a multimodal anomaly detection and dynamic arbitration closed loop that integrates federated self-supervised learning, temporal attention mechanisms, knowledge graphs, and reinforcement learning. Compared with existing technologies, it has the following core beneficial effects:
[0036] This system solves the problem of model result conflict fusion by fusing current output consistency and historical accuracy through a dynamic arbitrator. It calculates dynamic weights to intelligently weight anomaly probabilities and supports arbitrary combinations of two or more models, adapting to the risk control needs of different recruitment scenarios and improving the reliability and flexibility of risk decision-making. It achieves technical synergy and scenario-based adaptation between models, breaking the dimensional limitations of single models. The masked behavior sequence reconstruction of the federated self-supervised learning model performs hierarchical adaptation for core recruitment behaviors. Feature interoperability and reverse optimization of results are achieved between models, significantly improving the accuracy of identifying specific anomalies such as fraudulent orders, malicious fission, and job posting fraud. A "detection-interception-feedback" mechanism is constructed. The fully closed-loop "update" system uses feedback data from the actual effects of interception strategies to incrementally update the detection model and dynamic arbitrator, enabling the system to continuously self-optimize and adapt to evolving cheating methods, reducing manual maintenance costs. Based on a federated learning framework, it achieves multi-party data aggregation, with each party's data retained locally. This improves the model's generalization ability while effectively protecting the data privacy and security of the recruitment platform and users. It implements tiered dynamic interception, triggering matching interception and penalty strategies based on comprehensive anomaly scores, avoiding false positives or condoning issues caused by static strategies. Balancing strict risk control with user experience, it significantly improves the overall prevention efficiency and scenario adaptability of the recruitment platform's rebate business. Attached Figure Description
[0037] Figure 1 This is an overall flowchart of the method of the present invention; Detailed Implementation
[0038] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. The embodiments are only used to explain the present invention and do not constitute a limitation on the scope of protection of the present invention.
[0039] This embodiment provides an intelligent detection and interception method and system for abnormal rebate behavior in recruitment scenarios. It is applied to the risk control of "interview rebates" and "sharing rebates" services on recruitment websites. The method completes the logic design for detecting and intercepting abnormal behavior, and the various functional modules of the system work together to execute the method, achieving accurate detection and dynamic interception of abnormal behaviors such as order-brushing, malicious referrals, and job posting fraud. The specific implementation process is as follows:
[0040] The data acquisition module collects behavioral sequence data and associated contextual data of target users in the recruitment rebate scenario. The behavioral sequence data includes core fields such as timestamp, user identifier, and operation type; the contextual data includes job attributes, user device fingerprint, network address, user historical rebate records, etc., and completes data cleaning and format standardization.
[0041] The multimodal feature construction module extracts and constructs a multimodal feature set from the cleaned data. It extracts operation type sequences and corresponding time intervals from the behavior sequence data to form time-series trajectory features. It extracts operation duration, device type, and client information from single behavior data to form behavior node features. It extracts user-job matching degree, number of users sharing the device, and IP geographic clustering degree from the context data to form entity relationship features. It extracts past user complaint records and enterprise rebate verification pass rate from historical feedback data to form behavior feedback features.
[0042] This implementation combines three anomaly detection models. A multi-model selection and detection module inputs multimodal feature sets in parallel into a pre-trained model, enabling inter-model technical synergy and outputting corresponding anomaly probabilities. Local data from a collaborative recruitment platform is aggregated within a federated learning framework. Self-supervised pre-training is performed using masked behavior sequence reconstruction adapted to recruitment behavior features, outputting a general anomaly probability. This general anomaly feature is then synchronized to a temporal attention mechanism model. Temporal trajectory features are encoded into temporal embedding vectors and integrated with the general anomaly feature. A temporal attention Transformer encoder calculates time-step attention weights, outputting temporal anomaly probabilities. A recruitment knowledge graph subgraph is constructed with users, positions, devices, and IPs as entities. A graph neural network captures deep-level entity association features, outputting association anomaly probabilities. These entity association features are then synchronized to a federated self-supervised learning model for sample selection and optimization.
[0043] The confidence calculation module calculates the initial confidence of each model using a consistency test algorithm. It constructs a probability vector from each anomaly probability, calculates the mean and standard deviation of the probability vector, calculates the absolute deviation of the anomaly probability of each model from the mean, calculates the initial deviation coefficient based on the relationship between the absolute deviation and the standard deviation, and normalizes the initial deviation coefficient to obtain the initial confidence of each model. The higher the initial confidence value, the more consistent the output of the model is with the consensus of other models.
[0044] The dynamic arbitration module combines the model's historical accuracy and initial confidence to calculate dynamic weights, obtains the accuracy feedback vector of each model within its historical period, calculates the information entropy and consistency concentration J of the initial confidence vector, constructs a dynamic decay factor α=J, calculates the comprehensive reputation score of each model, and normalizes the comprehensive reputation score using the softmax function. The normalization result is the dynamic weight of each model.
[0045] The comprehensive anomaly score of the target user is calculated based on the dynamic weights and anomaly probabilities. According to the preset calculation formula, the dynamic weights of each model are multiplied by their corresponding anomaly probabilities and then summed to obtain the comprehensive anomaly score of the target user.
[0046] The tiered interception module predefines risk level ranges, corresponding to low risk, medium risk, and high risk, with different handling strategies for different risk levels. If a target user's overall anomaly score falls into the high-risk range, the system automatically triggers the interception strategy, freezing the user's interview rebate for this interview and restricting their job sharing and rebate application functions for a certain period.
[0047] The feedback update module collects feedback data on the actual effect of the interception strategy. After the platform verifies that the detection is a correct interception, it generates labeled data based on the result, performs incremental learning training on each anomaly detection model, and updates the historical accuracy records of each model in the dynamic arbitration module to achieve system self-optimization.
[0048] Through the above steps, this invention achieves a complete closed loop for detecting abnormal recruitment rebate behavior from multiple dimensions, intelligent fusion decision-making, to precise interception, and possesses self-optimization capabilities, effectively improving the accuracy, adaptability, and automation level of the risk control system.
[0049] Each module of the system of the present invention is a logical functional module. In practical applications, it can be implemented by hardware, software or a combination of hardware and software. Each module can be integrated on a single server or distributed across multiple network servers. Those skilled in the art can flexibly configure it according to actual needs.
[0050] The above description is only a preferred embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the concept and principles of the present invention should be included within the scope of protection of the present invention.
[0051] Each module of the system of the present invention is a logical functional module. In practical applications, it can be implemented by hardware, software or a combination of hardware and software. Each module can be integrated on a single server or distributed across multiple network servers. Those skilled in the art can flexibly configure it according to actual needs.
[0052] The above description is only a preferred embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the concept and principles of the present invention should be included within the scope of protection of the present invention.
Claims
1. A method for intelligent detection and interception of abnormal rebate behavior in a recruitment scenario, characterized in that, Includes the following steps: S1. Obtain target user behavior sequence data and associated context data in the recruitment rebate scenario; The behavioral sequence data includes at least a timestamp, user identifier, and operation type; the context data includes at least job information, device fingerprint, and network address. S2. Based on the behavior sequence data and the context data, construct a multimodal feature set consisting of temporal trajectory features, behavior node features, entity relationship features, and behavior feedback features; S3. Input the multimodal feature set into two or more pre-trained anomaly detection models in parallel to obtain the corresponding number of anomaly probabilities. The anomaly detection model is any combination of a general anomaly detection model based on federated self-supervised learning, a dynamic anomaly detection model based on temporal attention mechanism, an association anomaly detection model based on knowledge graph, and an anomaly interception and evaluation model based on reinforcement learning strategy. The models achieve technical linkage: the general anomaly features output by the federated self-supervised learning model provide the encoding basis for the temporal attention mechanism model, the entity association features output by the knowledge graph model supplement the state input dimension for the reinforcement learning strategy model, and the evaluation results of the reinforcement learning strategy model back-optimize the normal behavior sample screening of the federated self-supervised learning model. S4. Calculate the initial confidence level of each model based on the probability of each anomaly using a consistency test algorithm; S5. Input each anomaly probability and its initial confidence level into the dynamic arbiter. The dynamic arbiter calculates dynamic weights based on the model's historical accuracy and the dispersion of the initial confidence level. The calculation logic for the consistency concentration J is as follows: H is the information entropy of the initial confidence vector and c'i is the initial confidence level of each model, and N is the number of anomaly detection models involved in the calculation; S6. Utilize dynamic weights to weight and fuse the probabilities of each anomaly, generating a comprehensive anomaly score for the target user. The calculation method is as follows: wi is the dynamic weight of the i-th model, and pi is the anomaly probability of the i-th model; S7. Based on the predefined risk level range of the comprehensive anomaly score, automatically trigger the corresponding interception and punishment strategies; S8. Collect feedback data on the actual effect after the interception strategy is executed, and use the data to incrementally update the anomaly detection model and dynamic arbitrator involved in the calculation.
2. The method according to claim 1 (dependent claim), characterized in that, The execution process of the consistency check algorithm in step S4 is as follows: S41. Construct a probability vector P = [p1, p2, ..., pn] from the probabilities of each anomaly, where n is the number of anomaly detection models involved in the calculation; S42. Calculate the mean μ and standard deviation σ of the probability vector P, and calculate the absolute deviation for the outlier probability pi of the i-th model. ; S43, Press Calculate the initial deviation coefficient ci, normalize ci to obtain the normalized deviation coefficient c'i, and use c'i as the initial confidence level of the model.
3. The method according to claim 1 (dependent claim), characterized in that, The process of calculating dynamic weights by the dynamic arbitrator in step S5 is as follows: S51. Obtain the accuracy feedback vector A = [a1, a2, ..., an] for each model in the historical period, calculate the consistency concentration J according to the logic of claim 1, and construct the dynamic decay factor α = J; S52, according to Calculate the overall reputation score si for each model, normalize si using the softmax function, and the normalization result is the dynamic weight of each model.
4. The method according to claim 1 (dependent claim), characterized in that, During the training process of the general anomaly detection model based on federated self-supervised learning, the method for adapting the masked behavior sequence reconstruction to recruitment behavior features is as follows: A differentiated masking strategy based on behavior importance is introduced during the masked behavior sequence reconstruction process. First, masking weights are set according to behavior type: interview applications and rebate verification are defined as core behaviors and assigned high weights; Job sharing and account login are defined as non-core behaviors and assigned low weight. Next, weighted random sampling is performed on the behavior sequence based on these weights to determine the mask positions. The overall mask ratio is controlled within a preset range (e.g., 30%-50%), but during sampling, core behaviors are selected for masking with a significantly higher probability than non-core behaviors. Through this strategy, the model is forced to focus more on the contextual relationships of core behaviors when reconstructing the sequence, thereby learning more discriminative abnormal features related to recruitment rebates. This ratio range is based on statistical analysis and model training validation of over 100,000 actual behavior data points in recruitment rebate scenarios, and is considered the optimal ratio range for sequence reconstruction. The mask positions are randomly selected chronologically while retaining the timestamp association features of the behavior sequence. Sequence reconstruction is completed by predicting the behavior type, time interval, and associated entity information at the mask positions.
5. The method according to claim 1 (dependent claim), characterized in that, The incremental update process described in step S8 is as follows: the actual effect feedback data is compared with the comprehensive anomaly score to determine whether it is a correct interception, a false interception, a missed interception, or a correct release. Based on the determination result, labeled data or reinforcement learning reward signals are generated for incremental model training and updating the historical accuracy record of the model in the dynamic arbitrator.
6. An intelligent detection and interception system for abnormal rebate behavior in recruitment scenarios (independent claim), wherein each module is a physically or logically independent functional unit, which can be implemented by hardware, software or a combination of hardware and software, and supports distributed deployment or integrated deployment, characterized in that, This includes a data acquisition module that enables real-time data interaction and feature synchronization via wired or wireless communication; a multimodal feature construction module; a multi-model selection and detection module; a confidence calculation module; a dynamic arbitration module; a hierarchical interception module; and a feedback update module. Each module collaboratively executes the method described in any one of claims 1-5, and the core function of each module is: in: Data acquisition module: used to collect and standardize user behavior sequence data and context data; Multimodal feature construction module: used to construct temporal trajectory features, behavioral node features, entity relationship features, and behavioral feedback features; Multi-model selection and detection module: Used for parallel operation of federated self-supervised learning models, temporal attention models, knowledge graph models, and reinforcement learning models. Supports arbitrary combination selection of two or more models, either manually configured or automatically matched by the system. Through technical linkage, it enables the output of general anomaly features from federated self-supervised learning models, the supplementation of temporal encoding from temporal attention models, the input of entity association features from knowledge graph models, and the interception and evaluation feedback from reinforcement learning models. Confidence calculation module: used to calculate the initial confidence of the model using a consistency test algorithm; Dynamic arbitration module: used to calculate dynamic weights based on the model's historical accuracy and initial confidence, and to weight and fuse anomaly probabilities; Tiered interception module: used to trigger tiered interception strategies based on comprehensive anomaly scores; Feedback Update Module: Used to collect feedback on actual results and drive incremental updates to the model; Each module is connected via wired or wireless communication to achieve real-time data interaction and feature synchronization.