An abnormal state identification method and system of a rental order

Abstract

The application relates to the technical field of lease business risk control and anomaly detection, and provides a lease order anomaly state identification method and system, which comprises the following steps: obtaining full-cycle business data of a lease order, including order attributes, lease object states, user operation behaviors and environment correlation data; preprocessing the data, extracting order state transition features, lease object state features, time sequence behavior features and correlation graph features; performing multi-modal feature alignment and fusion on the features to obtain multi-modal fusion features; inputting the multi-modal fusion features into a pre-trained anomaly state identification model to output an order anomaly state identification result. Through the fusion of multi-source heterogeneous data and multi-modal features, the application realizes real-time and accurate identification of lease order anomaly states, and significantly improves the accuracy and interpretability of risk control identification.

Description

Technical Field

[0001] This application relates to the field of risk control and anomaly detection technology in leasing business, specifically to a method and system for identifying abnormal states of leasing orders. Background Technology

[0002] With the rapid development of the sharing economy and equipment rental business, rental platforms face increasingly complex and diverse business risks, including users placing fake orders to occupy inventory, damage or loss of rented items, overdue returns, and malicious group registration and rentals. Existing technologies typically rely on explicit features such as order amount, rental period, and deposit, combined with simple rule engines for risk identification. However, this rule-based and single-feature-based approach has significant limitations. On the one hand, existing technologies often ignore multi-source heterogeneous data such as the real-time status of rented items (e.g., location trajectory, battery level, signal strength), the temporal patterns of user operation behavior, and environmental correlation data (e.g., consistency between IP and GPS), resulting in a single feature dimension, difficulty in capturing deep-seated abnormal patterns, and a high false negative rate. On the other hand, existing technologies lack state modeling for the entire order lifecycle, making it difficult to effectively identify abnormal state transitions (e.g., items marked as in use but not picked up) or timeouts at specific stages. Furthermore, for complex risks such as group fraud, existing technologies lack the ability to analyze the relationship graph between users, rented items, network addresses, and spatial locations, making it difficult to detect abnormal group registration and equipment sharing patterns. Meanwhile, different types of data (time series, graphs, state sequences) are often simply spliced ​​together, ignoring the dynamic importance of cross-modal data, and the model output lacks interpretability, which is not conducive to manual review and strategy optimization. Summary of the Invention

[0003] To address the shortcomings of existing technologies, such as limited feature dimensions, lack of lifecycle modeling, and weak ability to identify group fraud, this application proposes a method and system for identifying abnormal states of rental orders. This system integrates multi-source data, including order status, leased item sensing data, user behavior data, and correlation graphs, to achieve real-time, accurate identification and early warning of abnormal states in rental orders.

[0004] To achieve the above objectives, this application adopts the following technical solution: A method for identifying abnormal states in rental orders, comprising: Obtain full-cycle business data for rental orders; the full-cycle business data includes order attribute data, leased item status data, user operation behavior data, and environmental correlation data; Preprocess the full-cycle business data to obtain standard order data; Feature extraction is performed on standard order data to obtain order status transition features, leased item status features, temporal behavior features, and correlation graph features; the leased item status features include trajectory feature vectors and parameter statistical feature vectors. Multimodal feature alignment and fusion are performed on order status transition features, leased item status features, temporal behavior features, and association graph features to obtain multimodal fused features; The multimodal fusion features are input into a pre-trained abnormal state recognition model, which outputs the abnormal state recognition results of orders.

[0005] The above solution integrates full-cycle business data and extracts multi-dimensional features, and utilizes multi-modal fusion technology to solve the problem of insufficient single feature recognition capability, thereby improving the accuracy and comprehensiveness of anomaly identification.

[0006] As one implementation method, the acquisition of the order status transition feature includes: Construct an order status change sequence based on the preprocessed order attribute data; The order status change sequence is compared with a predefined legal status transition matrix to obtain features related to illegal jumps; The duration of each state in the order status change sequence is statistically analyzed and compared with a preset duration threshold to obtain abnormal status dwell characteristics. The frequency of occurrence of each state and the number of changes between states in the order status change sequence are statistically analyzed to obtain the statistical characteristics of the status path. By concatenating the illegal transition features, the state dwell anomaly features, and the state path statistical features, we obtain the state transition features.

[0007] The above solution effectively captures abnormal status jumps and timeout phenomena in the order lifecycle by analyzing the legality of the order status change sequence, dwell time, and path statistics.

[0008] As one implementation method, the acquisition of the temporal behavior features includes: Multi-scale window behavior feature statistics were obtained by performing multi-scale window behavior statistics on preprocessed user operation behavior data using the sliding window method. Information entropy and cyclic autocorrelation are calculated on the operation type sequence in the preprocessed user operation behavior data to obtain behavioral pattern characteristics. A Poisson distribution burst detection method is used to detect the number of operations within a preset time in the preprocessed user operation behavior data to obtain burst operation characteristics. Based on the operation timestamps of user operation behavior data, the interval statistics, the number of silent periods, and the total silent duration are calculated to obtain the interval and silent characteristics. By concatenating multi-scale statistical features, behavioral pattern features, sudden operation features, and interval and silence features, temporal behavioral features are obtained.

[0009] The above scheme, through multi-scale statistics, regularity analysis and burst detection, deeply explores the temporal patterns in user operation behavior and improves the accuracy of identifying behavioral anomalies.

[0010] As one implementation method, the acquisition of the association graph features includes: A heterogeneous graph is constructed using multiple types of entity nodes in standard order data as nodes and multiple types of association relationships between these entity nodes as edges; the multiple types of entity nodes include main entity nodes and leased item entity nodes. A graph neural network is used to aggregate neighbor features of the current order-related nodes in the heterogeneous graph to generate node embedding vectors, and the association risk score is calculated based on the node embedding vectors. At least one meta-path is predefined. The number of other main entity nodes connected to the current main entity node through the meta-path and the proportion of blacklisted nodes among them are counted to generate meta-path statistical features. Collect the one-hop neighbor nodes of the current main entity node and the one-hop neighbor nodes of the current leased item entity node, count the number and proportion of blacklist nodes in the neighbor nodes, and generate neighbor anomaly density features. The association risk score, meta-path statistical features, and neighbor anomaly density features are concatenated to obtain the association graph features.

[0011] The above scheme effectively reveals the potential connections between users, leased items, and network locations by constructing a heterogeneous graph and aggregating neighbor information using graph neural networks, thereby enhancing the ability to identify associated risks such as gang fraud.

[0012] As one implementation method, the method for obtaining the associated risk score includes: Using the main entity node and the leased item entity node associated with the current order as the center, extract the subgraph within a preset number of hops; For each node in the subgraph, a preset number of neighboring nodes are sampled, and the feature vectors of the neighboring nodes are merged through an aggregation function. The representation of the current node is updated layer by layer to obtain the embedding vector of the main entity node and the embedding vector of the leased item entity node. The embedding vectors of the main entity nodes and the leased entity nodes are concatenated and then input into a fully connected layer. After nonlinear transformation, the associated risk score is output.

[0013] The above scheme achieves deep aggregation of node features through inductive learning of graph neural networks, thereby improving the accuracy of association risk scoring.

[0014] As one implementation method, the acquisition of the multimodal fusion features includes: Using the key stages preset in the order lifecycle as the time axis, the order status transition features, leased item status features, time-series behavior features, and association graph features are segmented and statistically analyzed according to their respective stages, generating a feature matrix aligned by stage. The feature matrix is ​​subjected to dimensionality standardization and missing value processing to output the standardized feature matrix; An attention mechanism is used to perform cross-modal weighted fusion on each stage in the standardized stage feature matrix to obtain the fusion vector of each stage; The fusion vectors of each stage are input into the sequence encoder in time sequence to extract global fusion features at the order level; the sequence encoder is a bidirectional long short-term memory network or a Transformer coding layer. The global fusion features are reduced in dimensionality and normalized to output multimodal fusion features.

[0015] The above scheme achieves effective fusion of data from different modalities in the time dimension through stage alignment and attention mechanisms, thereby enhancing the expressive power of features.

[0016] As one implementation method, the step of inputting multimodal fusion features into a pre-trained abnormal state recognition model includes: The multimodal fusion features are input into the abnormal state recognition model, which is a multi-task learning model. The multi-task learning model shares the underlying representation and branches into a first classification task and a second classification task, respectively outputting the probability distribution of abnormal categories and the probability distribution of abnormal levels. The multi-task learning model is trained using a cost-sensitive loss function, which includes class weights and a Focal Loss term to mitigate the problem of abnormal class imbalance. Temperature scaling calibration is applied to the probability distributions of the anomaly categories and the probability distributions of the anomaly levels, and the optimal decision threshold is searched based on a predefined cost matrix to determine the final anomaly category and the final anomaly level. The contribution of each dimension of the multimodal fusion features to the anomaly category determination is calculated using the gradient attribution method, generating interpretability information. The output includes the order anomaly status identification results, which contain the final anomaly category, final anomaly level, and interpretability information.

[0017] The above scheme addresses the class imbalance problem through multi-task learning and cost-sensitive loss functions, and provides interpretable outputs using gradient attribution, which facilitates manual verification.

[0018] As one implementation method, the preprocessing of full-cycle business data includes: Time alignment is performed on the full-cycle business data based on the timestamp to obtain the time-aligned full-cycle business data. Based on the preset range of values ​​for leased property data, physical constraints are applied to the time-aligned leased property status data to obtain reasonable status data. Based on a preset sampling interval, the time-aligned user operation behavior data is resampled at equal intervals to obtain a user operation behavior sequence. Multidimensional consistency verification and credibility weight calculation are performed on the time-aligned environmental association data to obtain environmental association data with credibility weights; the multidimensional consistency verification includes IP and GPS consistency verification and GPS trajectory rationality verification. The time-aligned order attribute data, reasonable status data, user operation behavior sequences, and environment association data with credibility weights are numerically and normally processed to obtain standard order data.

[0019] The above scheme effectively improves data quality by performing time alignment, physical filtering, and consistency verification on multi-source data, providing a reliable data foundation for subsequent feature extraction.

[0020] As one implementation, the multiple types of entity nodes also include network location nodes and spatial location nodes; the multiple types of association relationships include the access relationship between the main entity node and the network location node, the communication relationship between the leased item entity node and the network location node, and the trajectory relationship between the leased item entity node and the spatial location node.

[0021] The above scheme enriches the structural information of heterogeneous graphs by introducing network location and spatial location nodes and their corresponding relationships, and further enhances the depth of association analysis.

[0022] In addition, this application also provides an abnormal status identification system for rental orders, which is applied to an abnormal status identification method for rental orders as described above, including a data acquisition module, a data preprocessing module, a feature extraction module, a feature fusion module and an abnormal identification module; The data acquisition module is used to acquire full-cycle business data of rental orders; the full-cycle business data includes order attribute data, rental item status data, user operation behavior data, and environmental correlation data. The data preprocessing module is used to preprocess the full-cycle business data to obtain standard order data; The feature extraction module is used to extract features from standard order data to obtain order status transition features, leased item status features, temporal behavior features, and association graph features; the leased item status features include trajectory feature vectors and parameter statistical feature vectors. The feature fusion module is used to perform multimodal feature alignment and fusion on order state transition features, leased item state features, temporal behavior features and association graph features to obtain multimodal fused features; The anomaly recognition module is used to input multimodal fusion features into a pre-trained anomaly state recognition model and output the order anomaly state recognition result.

[0023] The system achieves automated and intelligent identification of abnormal statuses in rental orders through the collaborative work of its various modules, and has the advantages of high processing efficiency and high identification accuracy.

[0024] Beneficial effects: The method and system for identifying abnormal states of rental orders provided in this application have the following beneficial effects: 1. Comprehensive and accurate identification: By integrating order status transition features, leased item status features, time-series behavior features, and association graph features, it overcomes the shortcomings of existing technologies with their single feature dimensions. It can capture abnormal signals from multiple perspectives, significantly improving the accuracy of identifying various abnormal patterns such as overdue, damaged, fake orders, and group fraud.

[0025] 2. Strong real-time performance and scalability: It adopts streaming data processing and inductive graph neural network learning, supports millisecond-level real-time inference, and its modular design makes it easy to flexibly access new data sources or features, adapting to the rapid iteration of business scenarios.

[0026] 3. High interpretability: The gradient attribution method is used to output explanations of the causes of anomalies, clarifying the contribution of each feature dimension to the anomaly judgment, providing a strong basis for risk control personnel's manual review and strategy optimization, and solving the problem of the inability to interpret traditional black box models.

[0027] 4. Good robustness: Through physical constraint filtering, multidimensional consistency verification and cost-sensitive learning, it effectively addresses the problems of data noise and class imbalance, ensuring the stability of the model in complex real-world environments. Attached Figure Description

[0028] Figure 1 A flowchart illustrating an abnormal status identification method for a rental order provided in an embodiment of this application; Figure 2 This application provides a schematic flowchart of steps for preprocessing full-cycle business data in an embodiment of the present application. Figure 3 A flowchart illustrating a multimodal feature alignment and fusion method provided in an embodiment of this application; Figure 4 This is a system architecture diagram of an abnormal status identification system for rental orders provided in an embodiment of this application. Detailed Implementation

[0029] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.

[0030] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the application.

[0031] Example 1: like Figure 1 As shown, this embodiment provides a method for identifying abnormal states of rental orders. This method integrates multi-source heterogeneous data throughout the entire lifecycle of an order and utilizes multimodal feature fusion technology to achieve accurate identification of abnormal states in rental orders. Specifically, it includes the following steps: Step S100: Obtain full-cycle business data for the rental order. The full-cycle business data includes order attribute data, leased item status data, user operation behavior data, and environmental correlation data.

[0032] Specifically, full-cycle business data refers to the collection of all relevant data generated throughout the entire lifecycle of an order, from its creation to its termination. Order attribute data records basic order information, such as order number, user identifier, rental item identifier, order time, payment time, pickup time, due date, and order status change logs. This data forms the backbone of the order's business logic. Rental item status data consists of real-time sensor data reported by IoT devices, including the rental item's geographic coordinates (such as GPS data), speed, remaining battery power, and signal strength, reflecting the physical state of the rental item during the rental period. User operation behavior data records user interactions on the platform, such as timestamps and operation objects for browsing, placing orders, making payments, picking up items, reporting repairs, and returning vehicles, reflecting the user's operational intentions and patterns. Environmental correlation data includes the user's login IP address, device fingerprint, network type, and geographic location information during the operation, used to analyze the authenticity and consistency of the user's operating environment. By acquiring the above multi-source data, this embodiment can construct a comprehensive profile of the order, providing a complete data foundation for subsequent anomaly analysis.

[0033] Step S200: Preprocess the full-cycle business data to obtain standard order data.

[0034] Since the raw data originates from different business systems and IoT devices, it often suffers from issues such as time asynchrony, heterogeneous data formats, noise, or missing values. This step transforms the original heterogeneous data into standardized order data with a unified format, continuous time, and reliable quality through time alignment, physical constraint filtering, resampling, and consistency checks. For example, it aligns rental item status data reported at different frequencies with user behavior data onto a unified timeline, removing outliers that clearly exceed physical limits (such as speeds exceeding physical limits), thereby ensuring the accuracy of subsequent feature extraction.

[0035] Step S300: Extract features from standard order data to obtain order status transition features, leased item status features, temporal behavior features, and association graph features; the leased item status features include trajectory feature vectors and parameter statistical feature vectors.

[0036] This step is the core of the identification process, aiming to extract key information that characterizes abnormal patterns from standard order data. Specifically, order status transition features are used to capture abnormal status jumps (such as unpaid use) and timeout anomalies during the order lifecycle, identifying business process-level risks by analyzing the legality and duration distribution of status change sequences. Leased asset status features focus on physical-level anomaly detection; trajectory feature vectors identify abnormal driving paths by calculating indicators such as movement range, speed changes, and trajectory tortuosity; parametric statistical feature vectors identify equipment malfunctions or fraudulent use by analyzing indicators such as power consumption rate and signal strength changes. Temporal behavior features analyze time-series patterns of user operation behavior, such as sudden changes in operation frequency, abnormal fluctuations in operation patterns, or abnormal distribution of silent periods, thereby identifying machine operation or abnormal user behavior. Association graph features construct a heterogeneous graph between users, leased assets, network locations, and spatial locations, using graph neural networks to uncover potential group fraud or high-risk association nodes. These four types of features complement each other in characterizing the order status from four dimensions: business process, physical state, behavioral pattern, and relationship, effectively avoiding the limitations of a single feature perspective.

[0037] Step S400: Perform multimodal feature alignment and fusion on the order state transition features, leased item state features, temporal behavior features and association graph features to obtain multimodal fused features.

[0038] Different types of features have different physical meanings and data distributions, and simple splicing often fails to effectively utilize the complementarity of information from different modalities. This embodiment employs a multimodal feature alignment and fusion strategy, using the key stages of the order lifecycle as the time axis to align features from different modalities, and dynamically adjusts the weights of each modal feature using an attention mechanism, thereby extracting multimodal fused features containing rich semantic information. This process solves the problem of the difficulty in fusing heterogeneous data, enabling the model to comprehensively consider abnormal signals from various aspects.

[0039] Step S500: Input the multimodal fusion features into the pre-trained abnormal state recognition model and output the order abnormal state recognition result.

[0040] The anomaly detection model is a deep learning model trained on a large amount of historical order data. It can learn the distribution differences between normal and abnormal orders in the feature space. After inputting multimodal fusion features into the model, the model calculates the probability that the current order belongs to various anomaly states (such as overdue, damaged, fraudulent orders, theft, etc.) through complex nonlinear transformations, and outputs the final detection result. Through the above steps, this embodiment realizes an end-to-end anomaly detection process from data acquisition, preprocessing, feature extraction, fusion to model recognition, significantly improving the accuracy and robustness of anomaly order recognition in complex leasing scenarios.

[0041] Example 2: This embodiment is a further refinement based on Embodiment 1, mainly focusing on a detailed explanation of the data preprocessing process. In step S200 of Embodiment 1, as... Figure 2 As shown, the preprocessing of full-cycle business data specifically includes the following steps: Step S201: Time-align the full-cycle business data based on the timestamp to obtain time-aligned full-cycle business data.

[0042] Specifically, since order attribute data, leased item status data, user operation behavior data, and environmental correlation data are often reported by different subsystems or IoT devices, their timestamps may suffer from out-of-order issues due to clock asynchrony or network latency. This embodiment uses key events in the order lifecycle (such as "order placement time" and "payment time") as anchors to map all data onto a unified timeline. For example, a 30-second time granularity can be set to merge data within the same time window. For out-of-order data, the system adopts an event time window mechanism, allowing a certain delay tolerance (such as 5 seconds). Late data exceeding this time is marked as delayed or corrected, thereby ensuring the consistency of data timing and laying the foundation for subsequent timing feature extraction.

[0043] Step S202: Based on the preset range of rental data values, perform physical constraint filtering on the time-aligned rental status data to obtain reasonable status data.

[0044] Rental vehicle status data typically includes information such as location, speed, and battery level. This data is inherently constrained by objective laws in the physical world. For example, in a car-sharing scenario, vehicle speed usually cannot exceed a certain physical limit (e.g., 200 km / h), and the battery percentage should be between 0% and 100%. This step identifies and filters data points outside this range using a pre-defined reasonable value range. For instance, if a reported data shows a speed of 500 km / h, it is determined to be sensor noise or an outlier, and is removed or marked as missing, thus preventing abnormal data from interfering with subsequent feature calculations and improving data quality.

[0045] Step S203: Based on a preset sampling interval, the time-aligned user operation behavior data is resampled at equal intervals to obtain a user operation behavior sequence.

[0046] User behavior data typically consists of randomly occurring discrete events with a non-uniform distribution. To facilitate subsequent mathematical statistics and model input, this embodiment employs an equal-interval resampling technique. Specifically, a fixed sampling interval (e.g., 30 seconds) is set, and the frequency or duration of various operations (e.g., clicks, swipes, order placement) within each time slice is counted, transforming the non-uniform discrete event sequence into a uniform dense vector sequence. This processing method effectively fills in behavioral gaps, preserves the frequency information of user operations, and facilitates the capture of long-term behavioral patterns.

[0047] Step S204: Perform multi-dimensional consistency verification and credibility weight calculation on the time-aligned environmental association data to obtain environmental association data with credibility weight; the multi-dimensional consistency verification includes IP and GPS consistency verification and GPS trajectory rationality verification.

[0048] Environmental data is crucial for identifying fraud risks, but it is also susceptible to forgery or location drift. This step uses multi-dimensional cross-validation to assess data credibility. For example, in IP and GPS consistency verification, the system parses the location of the user's login IP and compares it with the geographical location reported by GPS. If the distance between the two exceeds a preset threshold (e.g., different cities), it is considered inconsistent. In GPS trajectory reasonableness verification, the instantaneous speed between two adjacent GPS positioning points is calculated. If this speed exceeds the physical limit of conventional modes of transportation (e.g., walking, driving), it is considered trajectory drift. For data with inconsistencies or drift, the system reduces its credibility weight (e.g., initial weight of 1, multiplied by a decay factor of 0.5 for each inconsistency), thereby reducing the weight of low-quality data in subsequent feature extraction and improving the accuracy of risk identification.

[0049] Step S205 involves performing numerical and normalization processing on the time-aligned order attribute data, reasonable status data, user operation behavior sequences, and environment association data with credibility weights to obtain standard order data.

[0050] Even after the above processing, the data still exhibits heterogeneous formats. This step encodes non-numerical data (such as order status and operation type) numerically, for example, using one-hot encoding or target encoding; and normalizes numerical data (such as battery level and speed), for example, using Z-score standardization to transform it into a standard distribution with a mean of 0 and a variance of 1. Finally, the processed multi-source data is integrated into standardized order data with a unified format and aligned dimensions, facilitating input into the subsequent feature extraction module. Through the above preprocessing workflow, this embodiment effectively solves the problem of inconsistent quality of multi-source heterogeneous data, significantly improving the effectiveness of subsequent feature engineering and model training.

[0051] Example 3: This embodiment is a further refinement based on Embodiment 1, mainly focusing on a detailed explanation of the process for extracting order status transition features. In step S300 of Embodiment 1, feature extraction is performed on standard order data to obtain order status transition features, specifically including the following steps: Step S301: Construct an order status change sequence based on the preprocessed order attribute data.

[0052] Specifically, the order attribute data contains a series of status change logs from order creation to completion. Each log entry records the timestamp of the status change and the status identifier after the change. In this embodiment, these status identifiers are arranged into an ordered sequence, namely the order status change sequence, according to chronological order. For example, the status change sequence of a normal rental order might be: "Order placed → Payment received → Picked up → In use → Returned." This sequence completely depicts the flow path of the order in the business process and is the basis for identifying process anomalies.

[0053] Step S302: Compare the order status change sequence with the predefined legal status transition matrix to obtain illegal jump-related features.

[0054] The legal state transition matrix is ​​a predefined set of state transition rules based on the normal logic of the leasing business. For example, the rules stipulate that the "order placed" state can only transition to "paid" or "cancelled," and cannot directly jump to "in use." The system matches each transition in the current order's state change sequence (e.g., "order placed → in use") against this matrix. If a transition does not exist in the matrix, it is considered an illegal transition. Illegal transition characteristics include the number of illegal transitions, the type of illegal transition code (e.g., "skip payment" is coded as 1, "skip pickup" is coded as 2), and the time point when the illegal transition occurred. By capturing these characteristics, the system can accurately detect the risk of business processes being bypassed or tampered with, such as fraudulent users exploiting system vulnerabilities to directly use the leased item without payment.

[0055] Step S303: Calculate the dwell time of each state in the order status change sequence and compare it with the preset dwell time threshold to obtain the abnormal status dwell characteristics.

[0056] Specifically, the system calculates the duration of an order in each state (e.g., "In Use"), which is the time difference between entering that state and leaving it (or the current time). Preset duration thresholds can be obtained by analyzing a large amount of historical normal order data; for example, the 95th quantile of historical data can be used as the upper limit for normal dwell time. If the dwell time in a certain state exceeds the corresponding threshold, a dwell timeout flag is generated, and the timeout duration or timeout percentage is calculated. For example, if an order remains in the "Paid" state for too long (more than 24 hours) without entering the "Picked Up" state, it may indicate that the user has abandoned the order or that there are other anomalies; if the dwell time in the "In Use" state exceeds the rental period, it directly points to the risk of overdue payment. This feature characterizes the anomalies of order states from a time perspective.

[0057] Step S304: Calculate the frequency of occurrence of each state and the number of changes between states in the order status change sequence to obtain the status path statistical characteristics.

[0058] Besides jumps and duration, the path pattern of status changes is also an important anomaly indicator. This step counts the number of times each status appears in the sequence (e.g., the number of times "cancelled" appears) and the transition count between adjacent statuses. For example, normal orders usually have fewer status changes and a simpler path, while abnormal orders may exhibit frequent status switching (e.g., repeated "place order → cancel → place order") or abnormal rollback paths (e.g., "in use → report for repair → in use"). These statistical characteristics can reflect the stability and intent of user operations, helping to identify abnormal scenarios such as malicious order manipulation or equipment malfunctions.

[0059] Step S305: Concatenate the illegal transition-related features, the state dwell anomaly features, and the state path statistical features to obtain the state transition features.

[0060] Finally, the system concatenates the feature vectors from the three dimensions mentioned above to form a comprehensive state transition feature vector. This vector contains information on business process compliance (illegal jumps), time-dimensional anomaly information (abnormal dwell times), and operational pattern information (path statistics), thus comprehensively characterizing the risk features at the order state transition level and providing high-quality data support for subsequent multimodal fusion and model recognition.

[0061] Example 4: This embodiment is a further refinement based on Embodiment 1, mainly focusing on a detailed explanation of the extraction process of time-series behavioral features. In step S300 of Embodiment 1, feature extraction is performed on standard order data to obtain time-series behavioral features, specifically including the following steps: Step S306: Perform multi-scale window behavior feature statistics on the preprocessed user operation behavior data using the sliding window method to obtain multi-scale statistical features.

[0062] Specifically, user behavior data often exhibits a localized high density and a global sparse distribution over time, making it difficult for single-granularity statistics to comprehensively capture behavioral patterns. This embodiment employs a sliding window technique, setting multiple window sizes, such as short-term windows (e.g., 5 minutes), medium-term windows (e.g., 1 hour), and long-term windows (e.g., 24 hours). Within each window, metrics such as the total number of operations, the diversity of operation types (e.g., the number of non-repeating operation types), and the coefficient of variation of operation frequency are statistically analyzed. Through this multi-scale statistical approach, the system can simultaneously capture both micro-fluctuations and macro-trends in user behavior. For example, a short-term window can identify frequent clicks within a short period, while a long-term window can reflect the user's activity level throughout the day. This multi-granularity feature extraction method effectively avoids information loss at a single time scale, providing richer behavioral details for subsequent models.

[0063] Step S307: Calculate the information entropy and cyclic autocorrelation of the operation type sequence in the preprocessed user operation behavior data to obtain behavioral pattern characteristics.

[0064] Normal users typically exhibit certain habits when operating a rental platform, such as a tendency to perform specific types of operations within specific time periods, resulting in a regularity in their operation sequence. This embodiment quantifies this regularity by calculating the information entropy of the operation type distribution. The formula for calculating information entropy is as follows: ,in This represents the probability of the i-th type of operation occurring. If the information entropy is too low, it indicates that the user's operation type is singular (e.g., repeatedly clicking a single button), potentially suggesting machine script operation. If the information entropy is too high, it indicates that the operation type distribution is extremely random, lacking the preferences of normal users, and may also be an anomaly. Furthermore, this embodiment also calculates the cyclic autocorrelation function at operation time points, identifying whether the behavior exhibits a periodic pattern by finding autocorrelation peaks. For example, normal user operations may show a 24-hour cycle, while abnormal users (such as automated scripts) may exhibit unnatural cycles or complete disorder. Through these two indicators, the system can accurately characterize the regularity of user behavior from both statistical distribution and time period dimensions.

[0065] Step S308: Perform Poisson distribution burst detection on the number of operations within a preset time period in the preprocessed user operation behavior data to obtain burst operation features.

[0066] In the leasing business, malicious attackers or fraud groups often launch a large number of requests in a short period of time, such as bulk order placement or brute-force attacks. This behavior manifests as a sudden surge in the frequency of operations. This embodiment assumes that the number of operations per unit time (e.g., 1 minute) follows a Poisson distribution, and its parameters... This can be estimated based on the user's historical average operation frequency. According to the characteristics of the Poisson distribution, the number of operations normally falls within... The probability within the interval is extremely high. If the number of operations within the current time window significantly exceeds the upper limit of that interval (i.e., If a sudden event occurs, it is considered a sudden action. The system counts the number of sudden actions, their duration, and the maximum sudden intensity (i.e., the magnitude by which it exceeds the threshold). By introducing a Poisson distribution model, this embodiment can adaptively determine sudden anomalies based on the historical behavior baseline of different users, avoiding the drawback of applying a fixed threshold to users with different activity levels in a "one-size-fits-all" manner, and significantly improving the accuracy of sudden behavior detection.

[0067] Step S309: Calculate the interval statistics, number of silent periods, and total silent duration based on the operation timestamps of user operation behavior data to obtain the interval and silent characteristics.

[0068] Besides the timing of operations, the intervals between operations also contain important risk information. This embodiment calculates the time intervals between adjacent operations and statistically analyzes their mean, variance, maximum value, and the proportion of long intervals (e.g., exceeding 1 hour). Specifically, the system focuses on identifying "quiet periods," which are periods of continuous inactivity exceeding a preset duration (e.g., 6 hours). For rental orders, the timing of the quiet period is crucial. For example, if a user enters a quiet period of several hours immediately after placing an order and does not perform any subsequent payment, it may indicate that the order is a false reservation or that the user intends to abandon it. The system counts the number of quiet periods and their total duration, and combines this with the order lifecycle to determine whether the quiet period occurs at a critical business node. By analyzing intervals and quiet characteristics, the system can keenly detect gaps or abnormal pauses in user intent, thereby effectively identifying behaviors such as false orders or malicious inventory hoarding.

[0069] Step S310: Concatenate the multi-scale statistical features, behavioral pattern features, sudden operation features, and interval and silence features to obtain the temporal behavioral features.

[0070] Finally, the system concatenates the feature vectors from the four dimensions mentioned above to form a comprehensive temporal behavior feature vector. This vector covers multiple aspects such as the frequency, regularity, suddenness, and time interval distribution of user behavior, and can comprehensively represent the temporal patterns of user operation behavior. This comprehensive feature can not only identify obvious abnormal behaviors (such as high-frequency attacks), but also capture implicit abnormal patterns (such as regularity loss and abnormal silence), providing highly discriminative behavioral dimension inputs for subsequent multimodal fusion models, effectively improving the ability to identify fraudulent users and machine behavior.

[0071] Example 5: This embodiment is a further refinement based on Embodiment 1, mainly focusing on a detailed explanation of the construction and calculation process of the association graph features. In step S300 of Embodiment 1, feature extraction is performed on the standard order data to obtain the association graph features, specifically including the following steps: Step S311: Using multiple types of entity nodes in the standard order data as nodes and multiple types of association relationships between the entity nodes as edges, construct a heterogeneous graph; the multiple types of entity nodes include main entity nodes and leased item entity nodes.

[0072] Specifically, traditional isomorphic graphs struggle to represent the complex roles and interactions within the rental business. The heterogeneous graph constructed in this embodiment can accommodate different types of entities and semantics. The main entity node typically represents a user in the rental business, but in other embodiments, it can be extended to associated enterprise accounts or operator accounts. The leased item entity node corresponds to the specific leased equipment, such as shared cars or power banks. To more accurately capture environmentally associated risks, the various entity nodes also include network location nodes and spatial location nodes. Network location nodes can be the IP address used for user login or device communication, or they can be refined to the WiFi MAC address or base station cell ID; spatial location nodes are geographic grids created by gridding GPS coordinates, for example, dividing latitude and longitude into 100m x 100m grids. By introducing these two types of environmental nodes, the system can effectively correlate physically dispersed but logically clustered abnormal behaviors (such as organized fraud).

[0073] In constructing edge relationships, this embodiment defines multiple types of associations. These include: access relationships between principal entity nodes and network location nodes, representing users logging into the platform via a specific IP address; communication relationships between leased item entity nodes and network location nodes, representing the network exit point when the device reports data; and trajectory relationships between leased item entity nodes and spatial location nodes, representing the device's movement path in physical space. It should be understood that the above node and edge types are only preferred examples. In practical applications, kinship relationships between "principals" or scheduling relationships between "leased items" can be added according to business needs, thereby further enriching the information content of the graph structure.

[0074] Step S312: Use a graph neural network to aggregate neighbor features of the current order-related nodes in the heterogeneous graph, generate node embedding vectors, and calculate the association risk score based on the node embedding vectors.

[0075] This is the core step in feature extraction from the graph, aiming to leverage the powerful representation learning capabilities of Graph Neural Networks (GNNs) to transform high-dimensional, sparse graph structure information into low-dimensional, dense vector representations. This embodiment preferably employs the GraphSAGE (Graph Sample and Aggregate) algorithm, the specific implementation process of which is as follows: First, taking the main entity node and the leased item entity node associated with the current order as the center, extract the subgraph within a preset hop count range. The preset hop count is usually set to 2 hops, which can cover both directly associated neighbors (such as the IP address used by the user and the locations the device has passed through) and second-order neighbors (such as other users sharing the same IP address), thereby capturing a wider range of association information while avoiding the introduction of too much noise.

[0076] Secondly, for each node in the subgraph, a preset number of neighboring nodes are sampled, and the feature vectors of the neighboring nodes are merged using an aggregation function. The representation of the current node is updated layer by layer to obtain the embedding vector of the main entity node and the embedding vector of the leased entity. Since the number of neighboring nodes in real business scenarios may be very large, directly processing all neighbors would lead to an explosion in computation. Therefore, GraphSAGE introduces a sampling strategy, such as setting a maximum of 10 neighbors to be sampled for each node. If there are not enough neighbors, zero vectors are filled in; if there are too many neighbors, random sampling is used. The choice of aggregation function determines how to fuse neighbor information. This embodiment can use mean aggregation, max pooling aggregation, or LSTM aggregation. Taking mean aggregation as an example, it averages the feature vectors of neighboring nodes and then concatenates them with the feature vector of the current node itself. After updating through a nonlinear activation function, this process simulates the physical mechanism that "the average state of the surrounding environment affects the current node." Through layer-by-layer propagation, the representation of the node gradually integrates local and global topological information.

[0077] Finally, the embedding vectors of the main entity node and the leased item entity node are concatenated and input into a fully connected layer. After nonlinear transformation, an association risk score is output. This score is a probability value between 0 and 1; the higher the value, the greater the likelihood that the entity and device associated with the order are in a high-risk neighborhood in the graph structure. For example, if a user node is found through sampling aggregation to have most of its neighboring nodes as blacklisted users, or if its associated device nodes frequently appear in high-risk areas, then the generated embedding vector will have obvious abnormal characteristics, and the final output association risk score will be significantly higher. This graph neural network-based calculation method, compared to traditional rule matching, can automatically discover hidden complex association patterns and effectively identify group fraud.

[0078] Step S313: Predefine at least one meta-path, count the number of other main entity nodes connected to the current main entity node through the meta-path and the proportion of blacklist nodes among them, and generate meta-path statistical features.

[0079] Metapaths are composite path patterns connecting two types of nodes, possessing specific semantic meanings. This embodiment predefines multiple metapaths, such as "Subject-Network Location-Subject" (User-IP-User), which represents different users logging in through the same IP address. If this path connects a large number of other subjects with a high proportion of blacklisted nodes, it suggests the risk of group cheating or proxy IP attacks. Another example is "Subject-Leased Item-Spatial Location-Leased Item-Subject" (User-Device-Location-Device-User), which represents different users using devices passing through the same geographical location, and can be used to identify abnormal clustering behavior within a specific area. The system statistically analyzes the number of other subjects connected to the current subject through each metapath, the proportion of blacklisted nodes, and the diversity of path instances, concatenating these statistical values ​​to form metapath statistical features. This feature supplements the higher-order semantic information that GNN aggregation might miss at the macro-topological level.

[0080] Step S314: Collect the one-hop neighbor nodes of the current main entity node and the one-hop neighbor nodes of the current leased entity node, count the number and proportion of blacklist nodes among the neighbor nodes, and generate the neighbor abnormal density feature.

[0081] This step focuses on the direct transmission of risk. A one-hop neighbor is a node directly connected to the current node, representing the closest relationship. For example, a current user's one-hop neighbors include all devices they have used and all IPs they have logged into; a current device's one-hop neighbors include all users who have used that device. The system directly counts the number and proportion of nodes marked as "blacklisted" or "high-risk" among these one-hop neighbors. If more than 50% of a user's one-hop neighbors are blacklisted users, or if a device has been used by multiple blacklisted users, then the neighbor anomaly density characteristic value for that order will be significantly higher. This feature intuitively reflects the "one is influenced by one's surroundings" risk transmission effect, providing an explicit risk criterion for the model.

[0082] Step S315: The association risk score, meta-path statistical features and neighbor anomaly density features are concatenated to obtain the association graph features.

[0083] Finally, the system concatenates the features from the three dimensions mentioned above into vectors. The association risk score provides an implicit risk assessment based on deep learning, the meta-path statistical features provide high-order association information based on semantic paths, and the neighbor anomaly density features provide explicit risk indicators based on direct associations. These three elements complement each other, forming a comprehensive and three-dimensional association graph feature vector that accurately characterizes the potential risks of orders from the perspective of association relationships, effectively solving the problem that traditional methods struggle to identify organized fraud and hidden associations.

[0084] Example 6: This embodiment is a further refinement based on Embodiment 1, mainly focusing on a detailed explanation of the multimodal feature alignment and fusion process. In step S400 of Embodiment 1, multimodal feature alignment and fusion are performed on order state transition features, leased item state features, temporal behavior features, and association graph features to obtain multimodal fused features, such as... Figure 3 As shown, the specific steps include: Step S401: Using the preset key stages in the order lifecycle as the time axis, the order status transition features, leased item status features, time-series behavior features, and association graph features are segmented and statistically analyzed according to their respective stages to generate a feature matrix aligned by stage.

[0085] Specifically, features of different modalities are often misaligned on time scales. For example, order status transition features are discrete sequences based on status change events, leased item status features are high-frequency continuous sequences reported by sensors, and correlation graph features are static statistical features throughout the entire lifecycle. Simply concatenating vectors directly can lead to temporal semantic misalignment, making it difficult for the model to learn the correlations between features of different modalities within a specific stage. This embodiment introduces a "stage alignment" mechanism to divide the order lifecycle into several key stages, such as the order placement stage, payment stage, pickup stage, usage stage, and return stage. It should be understood that the division of key stages can be flexibly adjusted according to specific business scenarios; for example, a "repair stage" or "renewal stage" can be added in a long-term rental scenario. The system maps various features to their corresponding stages according to timestamps. For order status transition features, the duration of status dwell and transition flags within each stage are extracted; for leased item status features, statistics such as average speed and power consumption rate within each stage are calculated; for time-series behavior features, the frequency of operations and burst flags within each stage are statistically analyzed; for association graph features, due to their global nature, they can be reused within each stage or dynamically updated in conjunction with the stage context. Through the above processing, the originally asynchronous multi-source heterogeneous features are transformed into a structured feature matrix aligned to each stage, providing a unified temporal semantic foundation for subsequent fusion.

[0086] Step S402: Perform dimensionality standardization and missing value processing on the feature matrix to output the standardized feature matrix.

[0087] Because the dimensions and units of features differ significantly across modalities—for example, trajectory features might be tens of dimensions, while state features might only be a few dimensions—directly inputting them into the model would lead to high-dimensional features dominating low-dimensional features. This embodiment standardizes the feature matrix for each stage, for example, using Z-score standardization to transform the values ​​of each dimension into a standard distribution with a mean of 0 and a variance of 1. Simultaneously, to address potential feature omissions in certain stages (e.g., when there is no rental item trajectory data in the "order placement stage"), the system employs a missing value imputation and flag mechanism. Specifically, for numerical missing values, they are filled with 0 or the historical mean of the feature; simultaneously, a binary missing value flag is generated, set to 1 to indicate the feature is missing, and set to 0 to indicate it is normal. This approach preserves data integrity while explicitly informing the model which information is missing, avoiding misjudgments of missing values ​​and improving the model's robustness in scenarios with incomplete data.

[0088] Step S403: Use an attention mechanism to perform cross-modal weighted fusion on each stage in the standardized stage feature matrix to obtain the fusion vector of each stage.

[0089] Traditional feature fusion methods typically employ simple vector concatenation or weighted averaging, assuming that all modal features contribute equally or with fixed weights to the final decision. However, in real-world business scenarios, the importance of features across different stages varies dynamically. For example, in the "payment stage," order status transition features (e.g., payment success) and temporal behavior features (e.g., suddenness of payment operations) may be more critical; while in the "usage stage," leased item status features (e.g., trajectory anomalies) and association graph features (e.g., whether the equipment has entered a high-risk area) dominate. To address this issue, this embodiment introduces an attention mechanism. Specifically, for a feature matrix at a given stage, the system decomposes it into order status feature vectors, leased item status feature vectors, temporal behavior feature vectors, and association graph feature vectors, and calculates the weight coefficient for each modality using a learnable attention network. This weight coefficient reflects the importance of that modality feature for anomaly identification at the current stage. Subsequently, the system performs a weighted summation of the feature vectors from each modality based on the calculated weight coefficients to obtain the fusion vector for that stage. Through the attention mechanism, the model can adaptively focus on the most critical feature modalities at the current stage, effectively capturing the dynamic importance of cross-modal features and significantly improving the effectiveness of feature fusion.

[0090] Step S404: Input the fusion vectors of each stage into the sequence encoder in time order to extract global fusion features at the order level; the sequence encoder is a bidirectional long short-term memory network or a Transformer coding layer.

[0091] After stage fusion, an order is represented as a sequence of fused vectors, which contains temporal evolution information of the order from start to finish. To extract global features at the order level, this embodiment uses a sequence encoder to encode the fused vector sequence. Preferably, the sequence encoder can employ a bidirectional long short-term memory (Bi-LSTM) network. Bi-LSTM can simultaneously capture forward and backward temporal dependencies. For example, trajectory anomalies in the "usage stage" may be causally related to operational delays in the "pickup stage," and Bi-LSTM can effectively model such long-distance dependencies. As another optional implementation, the sequence encoder can also employ a Transformer encoding layer. Based on a self-attention mechanism, Transformer can process sequence data in parallel and effectively capture the correlation between any two stages in the sequence, especially with higher computational efficiency when processing long sequences. The system inputs the fused vectors of each stage into the sequence encoder in temporal order, and takes the output of the last time step of the encoder or the average pooling of the outputs of all time steps as the global fused feature at the order level. This process transforms the variable-length stage sequence into a fixed-length global feature vector. This vector not only contains local anomaly information of each stage, but also integrates the temporal evolution patterns between stages, thus enabling a more comprehensive characterization of the overall risk status of the order.

[0092] Step S405: Dimensionality reduction and normalization are performed on the global fusion features to output multimodal fusion features.

[0093] The global fusion features output by sequence encoders typically have high dimensionality and may contain redundant information. To reduce computational complexity and prevent overfitting, this embodiment uses a fully connected layer to reduce the dimensionality of the global fusion features, for example, from 128 to 64. Subsequently, L2 normalization is applied to the dimensionality-reduced features, mapping them to a unit hypersphere. This makes the features of different orders comparable in the feature space, facilitating distance measurement or probability calculation in subsequent anomaly detection models. The final output multimodal fusion feature is a compact, dense vector rich in semantic information. It integrates multi-dimensional risk information such as order status, physical state, behavioral patterns, and relationships, laying a solid foundation for high-precision anomaly detection.

[0094] Example 7: This embodiment is a further refinement based on Embodiment 1, mainly focusing on a detailed explanation of the training and inference process of the abnormal state recognition model. In step S500 of Embodiment 1, the multimodal fusion features are input into the pre-trained abnormal state recognition model, specifically including the following steps: Step S501: Input the multimodal fusion features into the abnormal state recognition model. The abnormal state recognition model is a multi-task learning model. The multi-task learning model shares the underlying representation and branches into a first classification task and a second classification task, respectively outputting the probability distribution of abnormal categories and the probability distribution of abnormal levels.

[0095] Specifically, traditional single-task models typically output only one label, making it difficult to simultaneously handle the identification of anomaly categories (such as fraud and damage) and the assessment of risk levels (such as high-risk and high-concern). This embodiment employs a multi-task learning architecture, designing a network structure with a shared bottom layer and two bifurcated top layers. The shared bottom layer, typically composed of several fully connected layers, is responsible for extracting general risk representations from the input multimodal fusion features; the bifurcated top layers perform specialized learning for different tasks. The first classification task identifies specific anomaly categories, such as overdue, damage, fraudulent orders, and theft, outputting probability distributions for each category; the second classification task assesses the urgency of the risk, such as normal, high-concern, warning, and high-risk, outputting probability distributions for each level. The advantage of this architecture is that the shared bottom layer can leverage the data complementarity of the two tasks to learn more robust feature representations, avoiding the overfitting problem that may occur with single tasks. Simultaneously, it can output multi-dimensional risk discrimination results in a single inference, significantly improving the system's operational efficiency.

[0096] Step S502: Train the multi-task learning model using a cost-sensitive loss function, which includes class weights and a Focal Loss term to alleviate the problem of abnormal class imbalance.

[0097] In real-world leasing scenarios, the number of abnormal orders is typically far less than that of normal orders, resulting in a severe class imbalance. If the standard cross-entropy loss function is used, the model tends to predict the more numerous normal classes, leading to missed detections of abnormal classes. To address this issue, this embodiment introduces a cost-sensitive loss function. First, class weights are set in the loss function, assigning higher weights to abnormal classes with fewer samples (e.g., weights calculated as 1 / sqrt(frequency)), making the model focus more on minority class samples during training. Second, a Focal Loss term is introduced. Its core idea is to reduce the loss contribution of easily classified samples, allowing the model to focus on difficult-to-classify samples. For example, for an easily classified normal sample, the standard cross-entropy loss might be low, but after Focal Loss modulation, its loss value will be further reduced, allowing the model to concentrate its optimization efforts on those boundary samples with ambiguous features and difficult discrimination. Through this dual adjustment mechanism, the model can maintain high sensitivity to abnormal samples even when facing imbalanced datasets.

[0098] Step S503: Perform temperature scaling calibration on the probability distribution of the anomaly category and the probability distribution of the anomaly level, and search for the optimal decision threshold based on the predefined cost matrix to determine the final anomaly category and the final anomaly level.

[0099] The probability distribution output by deep learning models often suffers from overconfidence or underconfidence, meaning the output probability values ​​do not accurately reflect the likelihood of a sample belonging to a particular category. To improve the accuracy of probability estimation, this embodiment employs a temperature scaling technique for calibration. Specifically, after model training, a scalar parameter, temperature T, is learned on the validation set. By adjusting the value of logits divided by T, the probability distribution is calibrated to approximate the true distribution. The calibrated probability values ​​are more meaningful and can provide a reliable basis for subsequent decision-making.

[0100] In the decision-making phase, the traditional approach is to directly select the category with the highest probability as the prediction result. However, in risk control scenarios, the cost of missing anomalies (false negatives) is usually much higher than the cost of false positives. For example, missing a fraudulent order may lead to asset loss, while falsely reporting a normal order only requires manual review. Therefore, this embodiment predefines a cost matrix to clarify the cost weights of different error types. Based on the calibrated probability distribution, the system iterates through and searches for the optimal decision threshold to minimize the total expected cost. For example, when the probability of an anomaly category exceeds 0.6 (instead of the default 0.5), it is judged as an anomaly, thereby balancing the cost of false positives while ensuring recall and maximizing decision-making efficiency.

[0101] Step S504: Calculate the contribution of each dimension of the multimodal fusion features to the anomaly category determination using the gradient attribution method, and generate interpretability information.

[0102] To address the unexplainable "black box" nature of traditional deep learning models and enhance risk control personnel's trust in model decisions, this embodiment introduces a gradient attribution method. Specifically, after the model outputs a prediction result, the system calculates the gradient of the output category relative to the input features. The absolute value of the gradient reflects the degree of influence of that feature dimension on the prediction result. The system backpropagates the gradient to the original feature layer, calculating the contribution score of each original feature (such as trajectory tortuosity, operation frequency, and associated risk score). For example, if an order is judged as having "theft risk," gradient attribution might show that "trajectory features" contribute 45% and "association graph features" contribute 30%. Based on this, the system generates natural language explanatory text, such as "This order is judged as high-risk, mainly because of abnormal driving trajectory (contribution 45%) and the associated IP address previously appearing on a blacklist (contribution 30%)." This interpretable information not only helps risk control personnel quickly locate the cause of anomalies but also assists in troubleshooting when the model makes a misjudgment, achieving a leap from "black box" identification to "white box" identification.

[0103] Step S505: Output the order anomaly status identification result, which includes the final anomaly category, final anomaly level, and interpretability information.

[0104] Finally, the system integrates and outputs the judgment results obtained from the above steps. The output not only includes specific anomaly category labels such as "overdue" and "damaged" and risk levels such as "high risk" and "attention," but also comes with an intuitive and interpretable report. This structured output can be directly connected to the risk control decision-making system or manual review platform, providing a comprehensive and reliable basis for subsequent handling measures (such as blocking orders, manual review, and sending alerts).

[0105] Example 8: like Figure 4 As shown, this embodiment provides an abnormal status identification system 600 for rental orders. This system is used to implement the method described in any one of embodiments 1 to 7 above. The system adopts a modular architecture design, and through the collaborative work of various functional modules, it achieves automated and intelligent identification of abnormal statuses in rental orders. Specifically, the system includes a data acquisition module 601, a data preprocessing module 602, a feature extraction module 603, a feature fusion module 604, and an abnormality identification module 605.

[0106] The data acquisition module 601 is used to acquire full-cycle business data of rental orders; the full-cycle business data includes order attribute data, rental item status data, user operation behavior data, and environmental correlation data.

[0107] This module, serving as the system's input, is responsible for interfacing with external business databases, IoT device interfaces, and log systems. Specifically, the data acquisition module can subscribe to the order system's message queue in real time via API to obtain order attribute data; receive status data reported by sensors on leased equipment via IoT protocols (such as MQTT); collect user operation behavior data on the client through embedded logs; and obtain environmental data such as user IP addresses and GPS locations through the network layer. This module's design ensures real-time access to multi-source heterogeneous data, providing a raw data foundation for subsequent analysis.

[0108] The data preprocessing module 602 is used to preprocess the full-cycle business data to obtain standard order data.

[0109] The data preprocessing module is connected to the data acquisition module and receives the raw business data. This module integrates a time alignment unit, a physical constraint filtering unit, a resampling unit, and a consistency verification unit, which are used to perform the operations described in Example 2, such as time alignment, physical constraint filtering, equal-interval resampling, and multi-dimensional consistency verification. Through the data preprocessing module, the system can remove noise and outliers from the raw data, solve the problem of time asynchrony between multi-source data, and transform unstructured raw data into standardized order data with a unified format and reliable quality, thereby significantly improving the accuracy of subsequent feature calculations.

[0110] The feature extraction module 603 is used to extract features from standard order data to obtain order status transition features, leased item status features, time-series behavior features, and association graph features; the leased item status features include trajectory feature vectors and parameter statistical feature vectors.

[0111] The feature extraction module receives standard order data output from the data preprocessing module and is the core computational unit for risk identification in the system. This module internally comprises multiple parallel feature engineering sub-modules: a state feature extraction sub-module for constructing state change sequences and identifying illegal transitions (corresponding to steps in Example 3); a behavior feature extraction sub-module for calculating multi-scale statistics and burst detection (corresponding to steps in Example 4); and a graph feature extraction sub-module for constructing heterogeneous graphs and calculating association risk scores (corresponding to steps in Example 5). Through this parallel feature extraction architecture, the system can comprehensively characterize order risk features from four dimensions: business processes, physical states, user behavior, and relationships, avoiding the limitations of a single perspective.

[0112] The feature fusion module 604 is used to perform multimodal feature alignment and fusion on order state transition features, leased item state features, temporal behavior features and association graph features to obtain multimodal fused features.

[0113] The feature fusion module receives four types of feature vectors output by the feature extraction module. This module is configured with a stage alignment unit and an attention fusion unit to execute the stage alignment strategy and cross-modal weighted fusion described in Example 6. Specifically, the feature fusion module aligns features from different modalities using the key stages of the order lifecycle as the timeline, dynamically allocates feature weights using an attention mechanism, and finally outputs a fused feature vector containing global semantic information through a sequence encoder. This module solves the problem of effectively fusing heterogeneous features, enabling the system to comprehensively consider risk signals from various aspects.

[0114] The anomaly recognition module 605 is used to input multimodal fusion features into a pre-trained anomaly state recognition model and output the order anomaly state recognition result.

[0115] The anomaly identification module is the system's decision output, internally deploying an anomaly state identification model trained on a large amount of historical data. This model employs the multi-task learning architecture described in Example 7, capable of simultaneously outputting anomaly category and anomaly level. The anomaly identification module also integrates a gradient attribution unit for generating interpretability information. When the feature fusion module inputs multimodal fusion features, the anomaly identification module performs forward inference calculations, outputting an identification result containing the final anomaly category, final anomaly level, and interpretability information. This result can be directly pushed to the risk control decision platform, triggering corresponding early warning or blocking measures.

[0116] Through the system architecture described above, this embodiment achieves end-to-end automated processing from data access, cleaning, feature engineering to model inference. Data transmission between modules occurs via standard interfaces, resulting in low coupling and facilitating independent upgrades or replacements. For example, when business scenarios expand, only a new feature submodule needs to be added to the feature extraction module without altering the overall architecture, thus ensuring high scalability and maintainability of the system.

[0117] Example 9: To more intuitively demonstrate the practical application effect of the technical solution of this application, this embodiment takes a car-sharing rental scenario as an example to explain in detail the specific implementation process of the rental order abnormal status identification method. In this scenario, the rental object is specifically a shared car, and the user completes the entire process of placing an order, picking up the car, driving, and returning the car through a mobile terminal APP.

[0118] Specifically, in a particular order case, user A booked a shared car through the app at 11:00 PM. The system first performs a data acquisition step, collecting full-cycle business data for the order in real time. This includes order attribute data recording user A's account information, booking time, and vehicle ID; rental vehicle status data reported in real time via the vehicle's T-BOX, including GPS location, speed, remaining battery power, and vehicle signal strength; user behavior data recording the user's clickstream, page dwell time, and operation timestamps on the app; and environmental data including the user's IP address, device fingerprint, and geographical location during operation. The system performs time alignment and preprocessing on this multi-source data, removing noise caused by GPS signal drift and resampling the non-uniform user behavior sequence into an evenly spaced time series, forming standard order data.

[0119] During the feature extraction phase, the system extracted multi-dimensional anomaly signals from standard order data. First, regarding the rental vehicle's status characteristics, the system calculated the vehicle's driving trajectory features. Normally, user A should drive the vehicle from the pick-up point to the destination. However, the trajectory feature vector showed that the vehicle frequently traveled back and forth on remote roads in the suburbs between 11:30 PM and 1:00 AM, with an extremely zigzag trajectory and frequent rapid accelerations and decelerations within a short period, significantly inconsistent with normal commuting or daily travel patterns. Second, regarding temporal behavioral characteristics, the system discovered significant anomalies in user A's behavior during the vehicle return process through multi-scale statistical analysis. Normal users typically click the "return" button immediately upon arriving at their destination, but this user, after arriving at the parking spot at 1:10 AM, did not return the vehicle immediately, but waited for a full 3 hours, finally returning it at 4:10 AM. This abnormal period of silence was accurately captured by the interval and silence feature vector. Finally, regarding the features of the association graph, the system constructed a heterogeneous graph including users, vehicles, IP addresses, and spatial locations. By aggregating neighbor node information using the GraphSAGE algorithm, the system discovered that the IP address used by user A for login had been accessed by multiple different high-risk accounts in the past 24 hours, and these accounts were all involved in complaints about lost or damaged vehicles. This significantly increased association risk score indicates a potential risk of organized fraud in this order.

[0120] Subsequently, the system performs multimodal feature alignment and fusion on the extracted rental item status features, temporal behavior features, and association graph features. Using the key stages of the order lifecycle (order placement, vehicle pickup, driving, and return) as the timeline, the system segments and aligns the features of different modalities. In the "return stage," the attention mechanism assigns higher weights to temporal behavior features (abnormal silent period) and association graph features (high-risk IP association), generating multimodal fusion features containing rich abnormal semantics.

[0121] Finally, the system inputs the multimodal fusion features into a pre-trained anomaly recognition model. The model employs a multi-task learning architecture, simultaneously outputting anomaly category probability distributions and anomaly level probability distributions. The model, trained with a cost-sensitive loss function, accurately identifies the order as belonging to the "theft risk" category, with a risk level determined to be "high-risk." Simultaneously, the system generates interpretability information through a gradient attribution method, explicitly stating: "This order is judged as having a high-risk theft risk, primarily based on the following: the associated IP address has high-risk association records (contribution 40%), the driving trajectory is abnormally remote and tortuous (contribution 35%), and the return operation involves an abnormally long period of silence (contribution 25%)." Based on the above identification results, the risk control system immediately triggered a high-level warning, automatically locked the vehicle, and notified risk control personnel for manual review. As can be seen from this embodiment, the method provided in this application can effectively integrate multi-source heterogeneous data, accurately identify complex leasing anomaly scenarios, and provide strong support for risk control decisions through interpretable reports, significantly improving the risk prevention and control capabilities of leasing businesses.

[0122] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for identifying abnormal states of rental orders, characterized in that, include: Obtain full-cycle business data for lease orders; The full-cycle business data includes order attribute data, leased item status data, user operation behavior data, and environmental correlation data; Preprocess the full-cycle business data to obtain standard order data; Feature extraction was performed on standard order data to obtain order status transition features, leased item status features, temporal behavior features, and association graph features; The status characteristics of the leased object include trajectory feature vectors and parameter statistical feature vectors; Multimodal feature alignment and fusion are performed on order status transition features, leased item status features, temporal behavior features, and association graph features to obtain multimodal fused features; The multimodal fusion features are input into a pre-trained abnormal state recognition model, which outputs the abnormal state recognition results of orders.

2. The method for identifying abnormal states of rental orders according to claim 1, characterized in that, The methods for obtaining the order status transition features include: Construct an order status change sequence based on the preprocessed order attribute data; The order status change sequence is compared with a predefined legal status transition matrix to obtain features related to illegal jumps; The duration of each state in the order status change sequence is statistically analyzed and compared with a preset duration threshold to obtain abnormal status dwell characteristics. The frequency of occurrence of each state and the number of changes between states in the order status change sequence are statistically analyzed to obtain the statistical characteristics of the status path. By concatenating the illegal transition features, the state dwell anomaly features, and the state path statistical features, we obtain the state transition features.

3. The method for identifying abnormal states of rental orders according to claim 1, characterized in that, The methods for obtaining the temporal behavior features include: Multi-scale window behavior feature statistics were obtained by performing multi-scale window behavior statistics on preprocessed user operation behavior data using the sliding window method. Information entropy and cyclic autocorrelation are calculated on the operation type sequence in the preprocessed user operation behavior data to obtain behavioral pattern characteristics. A Poisson distribution burst detection method is used to detect the number of operations within a preset time in the preprocessed user operation behavior data to obtain burst operation characteristics. Based on the operation timestamps of user operation behavior data, the interval statistics, the number of silent periods, and the total silent duration are calculated to obtain the interval and silent characteristics. By concatenating multi-scale statistical features, behavioral pattern features, sudden operation features, and interval and silence features, temporal behavioral features are obtained.

4. The method for identifying abnormal states of rental orders according to claim 1, characterized in that, The methods for obtaining the features of the association graph include: A heterogeneous graph is constructed using multiple types of entity nodes in standard order data as nodes and multiple types of association relationships between these entity nodes as edges; the multiple types of entity nodes include main entity nodes and leased item entity nodes. A graph neural network is used to aggregate neighbor features of the current order-related nodes in the heterogeneous graph to generate node embedding vectors, and the association risk score is calculated based on the node embedding vectors. At least one meta-path is predefined. The number of other main entity nodes connected to the current main entity node through the meta-path and the proportion of blacklisted nodes among them are counted to generate meta-path statistical features. Collect the one-hop neighbor nodes of the current main entity node and the one-hop neighbor nodes of the current leased item entity node, count the number and proportion of blacklist nodes in the neighbor nodes, and generate neighbor anomaly density features. The association risk score, meta-path statistical features, and neighbor anomaly density features are concatenated to obtain the association graph features.

5. The method for identifying abnormal states of rental orders according to claim 4, characterized in that, The methods for obtaining the associated risk score include: Using the main entity node and the leased item entity node associated with the current order as the center, extract the subgraph within a preset number of hops; For each node in the subgraph, a preset number of neighboring nodes are sampled, and the feature vectors of the neighboring nodes are merged through an aggregation function. The representation of the current node is updated layer by layer to obtain the embedding vector of the main entity node and the embedding vector of the leased item entity node. The embedding vectors of the main entity nodes and the leased entity nodes are concatenated and then input into a fully connected layer. After nonlinear transformation, the associated risk score is output.

6. The method for identifying abnormal states of rental orders according to claim 1, characterized in that, The methods for obtaining the multimodal fusion features include: Using the key stages preset in the order lifecycle as the time axis, the order status transition features, leased item status features, time-series behavior features, and association graph features are segmented and statistically analyzed according to their respective stages, generating a feature matrix aligned by stage. The feature matrix is ​​subjected to dimensionality standardization and missing value processing to output the standardized feature matrix; An attention mechanism is used to perform cross-modal weighted fusion on each stage in the standardized stage feature matrix to obtain the fusion vector of each stage; The fusion vectors of each stage are input into the sequence encoder in time sequence to extract global fusion features at the order level; the sequence encoder is a bidirectional long short-term memory network or a Transformer coding layer. The global fusion features are reduced in dimensionality and normalized to output multimodal fusion features.

7. The method for identifying abnormal states of rental orders according to claim 1, characterized in that, The method of inputting multimodal fusion features into a pre-trained abnormal state recognition model includes: The multimodal fusion features are input into the abnormal state recognition model, which is a multi-task learning model. The multi-task learning model shares the underlying representation and branches into a first classification task and a second classification task, respectively outputting the probability distribution of abnormal categories and the probability distribution of abnormal levels. The multi-task learning model is trained using a cost-sensitive loss function, which includes class weights and a Focal Loss term to mitigate the problem of abnormal class imbalance. Temperature scaling calibration is applied to the probability distributions of the anomaly categories and the probability distributions of the anomaly levels, and the optimal decision threshold is searched based on a predefined cost matrix to determine the final anomaly category and the final anomaly level. The contribution of each dimension of the multimodal fusion features to the anomaly category determination is calculated using the gradient attribution method, generating interpretability information. The output includes the order anomaly status identification results, which contain the final anomaly category, final anomaly level, and interpretability information.

8. The method for identifying abnormal states of rental orders according to claim 1, characterized in that, The preprocessing of full-cycle business data includes: Time alignment is performed on the full-cycle business data based on the timestamp to obtain the time-aligned full-cycle business data. Based on the preset range of values ​​for leased property data, physical constraints are applied to the time-aligned leased property status data to obtain reasonable status data. Based on a preset sampling interval, the time-aligned user operation behavior data is resampled at equal intervals to obtain a user operation behavior sequence. Multidimensional consistency verification and credibility weight calculation are performed on the time-aligned environmental association data to obtain environmental association data with credibility weights; the multidimensional consistency verification includes IP and GPS consistency verification and GPS trajectory rationality verification. The time-aligned order attribute data, reasonable status data, user operation behavior sequences, and environment association data with credibility weights are numerically and normally processed to obtain standard order data.

9. The method for identifying abnormal states of rental orders according to claim 4, characterized in that, The various types of entity nodes also include network location nodes and spatial location nodes; the various types of associations include the access relationship between the main entity node and the network location node, the communication relationship between the leased item entity node and the network location node, and the trajectory relationship between the leased item entity node and the spatial location node.

10. An abnormal status identification system for rental orders, applied to the abnormal status identification method for rental orders as described in any one of claims 1 to 9, characterized in that, It includes a data acquisition module, a data preprocessing module, a feature extraction module, a feature fusion module, and an anomaly detection module; The data acquisition module is used to acquire full-cycle business data of rental orders; the full-cycle business data includes order attribute data, rental item status data, user operation behavior data, and environmental correlation data. The data preprocessing module is used to preprocess the full-cycle business data to obtain standard order data; The feature extraction module is used to extract features from standard order data to obtain order status transition features, leased item status features, temporal behavior features, and association graph features; The status characteristics of the leased object include trajectory feature vectors and parameter statistical feature vectors; The feature fusion module is used to perform multimodal feature alignment and fusion on order state transition features, leased item state features, temporal behavior features and association graph features to obtain multimodal fused features; The anomaly recognition module is used to input multimodal fusion features into a pre-trained anomaly state recognition model and output the order anomaly state recognition result.

Images