Online training anti-cheating system and method based on anomaly event sequence pattern detection

Abstract

This invention discloses an online training anti-cheating system and method based on abnormal event sequence pattern detection, belonging to the field of online education technology, and solving the technical problem that existing anti-cheating systems are prone to misjudgment. The invention includes a data acquisition module for collecting student data; a knowledge structure baseline construction module for classifying and statistically analyzing students' historical answer records; an event sequence generation module for segmenting the examination process to generate event sequences; an atomic abnormal event detection module for traversing, calculating, and labeling each event in the event sequence; a cheating scenario matching module for scanning the event sequence and outputting corresponding cheating suspicion type tags; an intervention response module for automatically triggering graded intervention operations corresponding to the tags; and a manual review module for automatically generating structured review tasks and distributing them to corresponding review terminals. This invention can achieve fine-grained automated identification of highly concealed cheating behaviors, forming a closed loop of tiered intervention and structured manual review.

Description

Technical Field

[0001] This invention relates to the field of online education and examination monitoring technology, specifically to an online training anti-cheating system and method based on abnormal event sequence pattern detection. Background Technology

[0002] In the mandatory online training for three types of water conservancy personnel, the verification of the authenticity of the learning process and the authenticity of the exam answers currently mainly relies on the following technical means.

[0003] Anti-AFK (away from keyboard) detection during the learning process commonly employs single-point verification methods such as timed pop-ups and slider verification, or relies on single-dimensional page focus monitoring and mouse movement frequency statistics. These methods can only detect extreme "completely inactive" states and cannot distinguish between automated AFK scripts that simulate human operation rhythms or reasonable behaviors such as students quickly skipping specific chapters due to prior work experience. Some solutions have begun to collect mouse trajectory data, but most only compare shallow statistics such as trajectory length and click count with fixed thresholds, failing to construct individual baselines from the perspective of temporal correlation and statistical distribution of behavioral sequences, resulting in a persistently high false positive rate.

[0004] Anti-cheating measures in exams primarily rely on IP monitoring, facial recognition, and answer time statistics. IP monitoring and facial recognition are at the identity authentication level and cannot prevent cheating by individuals who have already passed identity verification. Answer time statistics can only detect extreme anomalies such as "instant answers" or "failure to answer within the time limit," lacking the ability to identify anomalies in knowledge structure caused by using high-precision external question banks for proxy answers, or anomalies in difficulty distribution caused by prior knowledge of the original questions. Existing technologies include methods that predict the probability of correct answers for individual questions to detect anomalies, but this is essentially a single-point prediction based on historical answer records, failing to construct a complete profile of an individual's knowledge structure, and therefore unable to capture structural cognitive contradictions such as "getting wrong on strong topics and guessing right on weak topics."

[0005] In existing solutions, monitoring learning engagement, analyzing answering habits, and calculating exam accuracy are typically run as independent modules, lacking a cross-validation engine that encodes multi-dimensional anomalies into event sequences and performs combined pattern mining. When a single-dimensional indicator is at a critical state, it is prone to false negatives; conversely, when signals from various dimensions are simply superimposed, improper weighting can easily lead to false positives. Furthermore, when existing technologies are deemed high-risk, intervention methods are often a blanket ban, lacking tiered intervention and an auditable human-machine collaborative review mechanism. Summary of the Invention

[0006] To address the problems existing in the prior art, this invention provides an online training anti-cheating system and method based on abnormal event sequence pattern detection. Taking into full account the non-uniform knowledge structure of trainees in industries such as water conservancy due to their on-site experience, the system achieves fine-grained automated identification of highly concealed cheating behaviors by modeling and matching abnormal event sequences in three dimensions: learning process engagement, answering habits, and consistency of knowledge structure. This forms a closed loop of gradient intervention and structured manual review.

[0007] An online training anti-cheating system based on abnormal event sequence pattern detection includes:

[0008] Data acquisition module: Used to collect real-time mouse trajectory data, page focus state data, player operation event data, and device gyroscope data of learners through browser interface and / or mobile terminal sensors during the learning phase; and to collect answer operation behavior data of learners during the examination phase, including single question answering time, operation trajectory data, and answer modification data.

[0009] Knowledge Structure Baseline Construction Module: Based on a pre-defined industry knowledge point dual-dimensional tag system, this module classifies and statistically analyzes students' historical answer records to construct a knowledge mastery heatmap reflecting the distribution of individual students' knowledge mastery strengths and weaknesses. The dual-dimensional tag system includes knowledge point type tags and knowledge source tags, where the knowledge source tags include at least "theoretical memorization type" and "practical experience type".

[0010] Event Sequence Generation Module: This module is used to divide the exam process into individual questions at the smallest granularity, generating an event sequence E={e1, e2, ..., e...}. n}, where each event e i It is a multidimensional tuple containing: question number, knowledge point category, knowledge source tag, expected result tag, actual result, answering time, operation trajectory complexity, and whether a modification operation occurred; the expected result tag is automatically generated by the system based on the mastery intensity of the knowledge point corresponding to the question in the knowledge mastery heatmap, including "expected correct" and "expected incorrect";

[0011] Atomic anomaly detection module: used to traverse and calculate each event in the event sequence E. When the calculation result shows that the event meets the preset atomic anomaly judgment conditions, the event is marked as the corresponding atomic anomaly event type. The atomic anomaly event types include weak instantaneous correctness events, strong lag error events, operation mode switching events, and scripted interaction events.

[0012] Cheating scenario matching module: used to scan the event sequence E using a sliding window algorithm. When the combined features of the atomic abnormal events marked in a certain window match the cheating scenario templates pre-stored in the cheating mode feature library at a distance less than a preset threshold, the corresponding cheating suspicion type label is output. The cheating scenario templates include at least the following templates: crash course completion and question bank answering templates, professional exam-taking templates, meticulous cheating templates, and full-chain learning and exam-taking templates.

[0013] Intervention response module: used to automatically trigger graded intervention operations corresponding to the suspected cheating type tag, including at least one of the following: silent deduction of credit hours, pop-up interactive verification, forced reset of course progress, calling the camera module for secondary facial verification, and freezing the account;

[0014] The manual review module is used to automatically generate a structured review task and distribute it to the corresponding review terminal when the confidence level of the system's judgment result is at a preset critical state; receive the judgment input returned by the reviewer through the review terminal, and feed back the review result to the cheating pattern feature library to calibrate the judgment boundary of the cheating scenario matching module.

[0015] Furthermore, the knowledge structure baseline construction module is specifically used for:

[0016] Based on the knowledge point type tags and knowledge source tags, the students' historical answer data is divided into at least four subsets: "Practical experience - correct", "Practical experience - incorrect", "Theoretical memory - correct", and "Theoretical memory - incorrect".

[0017] The accuracy rate, average answering time, and answering stability coefficient of each knowledge point dimension in each subset are calculated separately. The answering stability coefficient reflects the consistency of the student's rhythm when answering a certain knowledge point.

[0018] The accuracy rate, average answer time, and answer stability coefficient are normalized and weighted to generate a heatmap of knowledge mastery with knowledge points on the horizontal axis and mastery intensity on the vertical axis.

[0019] Furthermore, the preset atomic anomaly event determination conditions include:

[0020] Weakness Instantaneous Correct Event: When the expected result is labeled "Expected Error", the actual result is correct, and the response time of the event is lower than the lower quartile of the student's historical average response time, it is marked as a weakness instantaneous correct event.

[0021] Strength Stuttering Error Event: When the expected result is labeled "Expected Correct", the actual result is incorrect, and the response time of the event is higher than the upper quartile of the student's historical average response time, and the complexity of the operation trajectory is higher than the student's normal response trajectory complexity threshold, it is marked as a strength stuttering error event.

[0022] Operation mode switching event: Extract the operation trajectory feature vector and response rhythm feature vector of the event. When the Euclidean distance between the feature vector and the cluster center of the normal behavior cluster in the student's historical behavior baseline exceeds the preset operation mode threshold, it is marked as an operation mode switching event.

[0023] Scripted interactive events: Calculate the variance of the interaction time interval of multiple consecutive events in the event sequence. When the variance is lower than the lower limit of the variance threshold for normal human operation, or the variance of trajectory similarity is lower than the lower limit of the trajectory variance threshold for normal human operation, the corresponding event is marked as a scripted interactive event.

[0024] Furthermore, the cheating scenario templates pre-stored in the cheating scenario matching module are defined based on the combination rules of the atomic anomaly events, specifically including:

[0025] The matching conditions for the intensive course-completion and question bank-assisted answering template are as follows: the total number of instantaneous correct events for the marked weaknesses accounts for more than the first preset threshold in the entire exam event sequence; the variance of the entire exam answering time is lower than the lower limit of the student's historical answering time variance; and the proportion of inactive periods with intervals exceeding the preset time in the student's learning process interaction data for the corresponding course exceeds the second preset threshold; the matching result is output when all three conditions are met.

[0026] The matching conditions for the professional exam-taking template are as follows: the number of marked operation mode switching events exceeds the third preset threshold; and the structural deviation value calculated by the system is lower than the fourth preset threshold, indicating that the distribution of correct and incorrect answers in the exam is basically consistent with the student's knowledge mastery heatmap; when both conditions are met, the matching result is output, and the intervention response module calls the camera module to collect real-time facial images, which are compared and calculated with the pre-stored benchmark facial template; the structural deviation value is an indicator that quantifies the degree of deviation between the distribution of correct / incorrect knowledge points in the student's exam and the expected distribution of strengths and weaknesses reflected in the student's personal knowledge mastery heatmap.

[0027] The matching conditions for the meticulous cheating template are as follows: In the latter half of the event sequence, there exists a continuous subsequence of length not less than N, where each event is marked as a weak point instantaneous correct event, N is a positive integer and not less than 3; and the answering time for each event in the continuous subsequence is lower than the student's average answering time in historical simple questions; when the conditions are met, the matching result is output.

[0028] Full-chain proxy learning and exam template: Includes a first sub-template and a second sub-template; a matching result is output if either sub-template is satisfied; where:

[0029] The matching condition for the first sub-template is: the run test is performed on the actual result sequence in the event sequence, the test result p value is greater than the fifth preset threshold, and the variance of the entire exam answering time is lower than the lower limit of the historical answering time variance of the student.

[0030] The matching condition for the second sub-template is: the structural deviation value calculated by the system exceeds the sixth preset threshold, and the number of marked operation mode switching events exceeds the seventh preset threshold.

[0031] The thresholds involved in the cheating scenario template matching conditions are all based on the statistical distribution characteristics of the student's behavioral data and answer data collected during all normal exams and normal learning processes, and are predetermined through quantile calculation or normal distribution parameter estimation methods.

[0032] Furthermore, the sliding window algorithm used in the cheating scenario matching module employs an adaptive window size mechanism:

[0033] For cheating scenario templates that detect clusters of localized, densely packed abnormal events, a fixed small window is used, with the window size set to 3 to 5 events;

[0034] For cheating scenario templates that detect global statistical features, a global window covering the entire event sequence of the entire exam is used;

[0035] The system fuses and determines the scanning results of different window sizes. If a cheating scenario template is matched under any window size, the corresponding cheating suspicion type label is recorded.

[0036] Furthermore, it also includes a module for dynamically updating cheating scenario templates, used for:

[0037] When a student's exam event sequence is confirmed as a cheating scenario after manual review, and the atomic abnormal event combination pattern of the sequence is not covered by the existing cheating scenario template, the abnormal pattern feature vector of the sequence is extracted.

[0038] After the abnormal pattern feature vectors are processed by an incremental clustering algorithm, they are added as new cheating scenario templates, or the distribution boundary of existing templates in the feature space is updated.

[0039] The dynamic update mechanism enables the cheating pattern feature library to have self-learning capabilities.

[0040] Furthermore, the calculation of the structural deviation value includes:

[0041] For the set of questions answered correctly in this exam, calculate the expected probability distribution of correct answers for the corresponding knowledge point category in the knowledge mastery heatmap. ;

[0042] For the set of questions answered incorrectly in this exam, calculate the expected error probability distribution for the corresponding knowledge point category in the knowledge mastery heatmap. ;

[0043] Using the KL divergence algorithm, calculate Correct distribution in actual exam The first divergence between them, and Distribution of actual exam errors The second divergence between them;

[0044] The weighted sum of the first divergence and the second divergence is taken as the structural deviation value.

[0045] Furthermore, the intervention response module automatically executes a tiered intervention sequence based on the suspected cheating type label and the additional risk quantification value, specifically including:

[0046] Evidence solidification submodule: Before performing any intervention action, automatically record the system timestamp that triggered the intervention, student ID, exam session ID, and current exam progress, and encapsulate the atomic anomaly event sequence fragments that triggered the alarm and the matching results into an immutable audit log and write it into the integrity file database;

[0047] Level 1 Intervention – Silent Correction: When a student is matched with a template for cramming and answering questions using a question bank and the cognitive contradiction level is lower than a preset high-risk threshold, the student's learning process behavior sequence is retrieved to identify the idle time period. The learning time coefficient corresponding to the idle time period is set to zero and deducted from the total effective learning time. At the same time, a "questionable learning engagement" tag with an expiration date is added to the student's integrity profile. The cognitive contradiction level is a composite index derived from the comprehensive knowledge structure deviation value and behavior-process consistency. It is used to amplify the contradiction signal when high behavior consistency is accompanied by high knowledge structure deviation, so as to capture highly concealed cheating patterns where the operator looks like the person but the knowledge structure of the answer is abnormal.

[0048] The second level of intervention—interactive presence verification: When a professional proxy exam template is matched, a non-scriptable industry knowledge challenge pop-up is generated, requiring the trainee to complete interactive selections based on a water conservancy process scenario within a limited time; at the same time, the device's front-facing camera is used to perform facial micro-expression liveness detection, and the exam session is automatically terminated if the verification fails.

[0049] The third level of intervention—forced reset and cross-system punishment: When a meticulous cheating template or a full-chain proxy learning and exam template is matched, or when the second level of intervention fails to verify continuously, the course management interface is called to clear all current course progress records, and a forced make-up study schedule is generated based on the weak knowledge points identified in the knowledge mastery heat map; at the same time, high-risk negative records are written into the student's integrity file and synchronized to the associated continuing education management platform or enterprise human resources system through the data interface.

[0050] Furthermore, the manual review module is specifically used for:

[0051] Automatic generation of review tasks: Structured review tasks will be automatically generated by the task scheduling module when any of the following triggering conditions are met:

[0052] The values ​​of the main judgment indicators output by the cheating scenario matching module fall within the preset critical range.

[0053] The exam data of the same student partially matches two opposing scenarios simultaneously;

[0054] The student's exam performance exceeded the predicted ability across the board, but the amount of the student's historical data was lower than the preset threshold.

[0055] For low-risk samples that the system determines to be normal, a very small percentage will be randomly selected.

[0056] Structured review interface generation: The information to be reviewed is divided into three panes and pushed to the review terminal: The first pane displays the knowledge mastery heatmap and behavioral rhythm characteristics; the second pane visualizes the marked atomic anomaly events in this exam in question number order; the third pane overlays and compares the answer time curve of this exam with the historical baseline curve, and highlights the deviation segments.

[0057] Tiered collaborative review: Review tasks are distributed to different permission pools according to risk level, and double-blind cross-validation is initiated for cases with the highest risk level; the double-blind cross-validation refers to simultaneously distributing the same task to two auditors who are not visible to each other. When the two auditors' judgments are consistent, the result is adopted; when they are inconsistent, it is automatically escalated to a higher-level auditor for final determination.

[0058] Closed-loop feedback of audit results: The event sequence feature vector of the new cheating pattern confirmed by the auditor is updated to the cheating pattern feature library after incremental clustering algorithm; the distribution of judgment indicators of manually amended cases is statistically analyzed periodically, and when the correction rate in the critical interval exceeds the preset threshold, the judgment threshold of the cheating scenario matching module is automatically suggested to be adjusted; at the same time, the judgment bias of each auditor is evaluated based on the consistency of cross-validation results, and the stability of the overall audit scale is ensured through weighted correction.

[0059] Furthermore, the manual review module times and records the entire review process, and the generated review operation records are stored in association with the audit log, forming a complete behavioral traceability chain that includes machine judgment and manual review evidence.

[0060] An online training anti-cheating method based on abnormal event sequence pattern detection includes the following steps:

[0061] Collect behavioral data on students' learning process during the learning phase, as well as their answering behavior data during the examination phase;

[0062] Based on a pre-defined dual-dimensional tagging system for industry knowledge points, the historical answer records of trainees are classified and statistically analyzed to construct a heatmap of knowledge mastery that reflects the distribution of individual knowledge strengths and weaknesses. The dual-dimensional tagging system includes knowledge point type tags and knowledge source tags, wherein the knowledge source tags at least distinguish between theoretical memorization type and practical experience type.

[0063] The examination process is divided into event sequences at the level of a single question. Each event includes a question number, knowledge point category, knowledge source tag, expected result tag, actual result, answering time, and operational characteristic data. The expected result tag is automatically generated based on the mastery intensity of the knowledge point corresponding to the question in the knowledge mastery heatmap.

[0064] Each event in the event sequence is traversed and calculated, and marked according to a variety of preset atomic anomaly event judgment conditions to obtain the marked event sequence;

[0065] The sliding window algorithm is used to scan the marked event sequence, and the combined features of atomic abnormal events within the window are matched with the pre-stored cheating scenario template to output cheating suspicion type labels.

[0066] Automatically execute tiered intervention operations based on the suspected cheating type label.

[0067] Furthermore, the determination of atomic anomaly events and the matching of cheating scenario templates specifically include:

[0068] When the expected result of an event is labeled as expected error, the actual result is correct, and the response time is lower than the lower quartile of the student's historical response time, it is marked as a weak point momentary correct event.

[0069] When the expected result of an event is labeled as expected correct, the actual result is incorrect, the response time is higher than the upper quartile of the student's historical response time, and the complexity of the operation trajectory exceeds the normal threshold, it is marked as a strength lag error event.

[0070] When the distance between the operation feature vector of an event and the cluster center of the normal behavior cluster in the student's historical behavior baseline exceeds the preset operation mode threshold, it is marked as an operation mode switching event.

[0071] When the variance of the interaction interval or the variance of the trajectory similarity of multiple consecutive events are lower than the lower limit of the variance of normal human operation, they are marked as scripted interaction events.

[0072] The tagged event sequences were combined with the following cheating scenario templates for feature matching:

[0073] The template for intensive course completion and question bank answering is as follows: the percentage of correct answers in weak areas exceeds the first preset threshold, the variance of answering time is lower than the historical lower limit, and the percentage of time without operation during the corresponding course learning process exceeds the second preset threshold.

[0074] Professional exam-taking template: The number of operation mode switching events exceeds the third preset threshold, and the knowledge structure deviation value is lower than the fourth preset threshold;

[0075] A meticulous cheating template: In the latter half of the event sequence, there is a cluster of consecutive weak points that are momentarily correct, and the answering time for each event is shorter than the average time for historical easy questions;

[0076] Full-chain proxy learning and exam template: The actual result sequence runs test shows randomness and the duration variance is usually low, or the knowledge structure deviation value exceeds the standard and the number of operation mode switching events exceeds the standard;

[0077] When the marked event sequence meets the matching conditions of any cheating scenario template, the corresponding cheating suspicion type label is output;

[0078] The thresholds involved in the cheating scenario template matching conditions are all determined in advance based on the statistical distribution characteristics of the behavioral data and answer data collected during the student's previous normal exams and normal learning processes, through quantile calculation or normal distribution parameter estimation methods.

[0079] The beneficial effects of this invention include:

[0080] Fine-grained identification of highly concealed cheating patterns: By breaking down the exam process into a sequence of atomic events with expected labels, it can not only detect overall score anomalies, but also accurately locate micro-anomalies such as clusters of instantaneous correct answers in weak areas and stumbling errors in strong areas, thereby effectively identifying complex cheating methods such as knowing the questions in advance and using random scripts to answer on behalf of others.

[0081] Integrating industry experience characteristics to reduce misjudgments: By introducing dual-dimensional tags of theoretical memorization and practical experience-based knowledge sources to construct a personal knowledge heatmap, this approach fully considers the uneven knowledge structure of trainees in industries such as water conservancy due to their work background. This avoids misjudging experienced trainees' normal, leapfrog answers as cheating, while also making it impossible for structural anomalies such as making mistakes on strengths and guessing correctly on weaknesses to hide.

[0082] Three-dimensional cross-validation and scenario template matching: Anomalies in three independent dimensions—learning process engagement, operational habits, and knowledge structure—are uniformly encoded into an event sequence. By combining rules for scenario template matching, the system upgrades from single-indicator alarms to patterned scenario diagnosis, and the output results have interpretable cheating type labels.

[0083] Progressive intervention and non-scriptable verification: Tiered intervention avoids a one-size-fits-all approach. Low-risk students silently have their class hours deducted, medium-risk students are introduced with interactive challenges and liveness detection that combine industry knowledge, and high-risk students are forced to reset and generate a make-up class schedule. The intervention methods themselves are also difficult to script.

[0084] Structured manual review and self-learning closed loop: Manual review is no longer a subjective decision, but an auxiliary judgment based on three-pane comparison and double-blind cross-validation. The review results will then serve as training signals to update the abnormal pattern library and judgment threshold, so that the system's cheating detection capability will continue to evolve with the accumulation of actual cases. Attached Figure Description

[0085] Figure 1 This is a schematic diagram of the overall architecture of an online training anti-cheating system based on abnormal event sequence pattern detection, according to an embodiment of the present invention.

[0086] Figure 2 This is a flowchart illustrating the knowledge structure baseline construction and heatmap generation process involved in embodiments of the present invention.

[0087] Figure 3 This is a flowchart illustrating the cheating scenario matching process based on an adaptive sliding window, as described in an embodiment of the present invention.

[0088] Figure 4 This is a flowchart illustrating the workflow of the manual review module involved in an embodiment of the present invention. Detailed Implementation

[0089] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of the embodiments. Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely represents selected embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.

[0090] The following is in conjunction with the appendix Figure 1 Specific embodiments of the present invention will be described in detail;

[0091] like Figure 1As shown, this embodiment provides an online training anti-cheating system based on abnormal event sequence pattern detection, which is jointly implemented by a computer server and a student client. The functions and roles of each module in the system are clearly defined as follows:

[0092] The data acquisition module 101 is used to collect real-time mouse trajectory data, page focus state data, player operation event data, and device gyroscope data of students through browser interface and / or mobile terminal sensors during the learning phase, and to collect students' answer operation behavior data during the examination phase, including single question answering time, operation trajectory data, and answer modification data; this module provides the raw data source for all subsequent behavior analysis and anomaly detection.

[0093] To avoid network congestion caused by excessive mouse trajectory data, the front-end employs an equidistant sampling strategy (recording mouse coordinates every 50ms) and uses differential encoding to compress the coordinate sequence before reporting it to the server. If the page focus is continuously lost or the inactivity time exceeds a preset threshold (e.g., 5 minutes), the front-end automatically inserts a timestamped "heartbeat" placeholder event to distinguish between real AFK behavior and script-simulated behavior. For PCs that do not support gyroscopes or mobile devices without authorized gyroscopes, the system automatically skips gyroscope data collection and relies solely on general signals such as mouse trajectory and page focus for behavioral analysis, recording a "gyroscope missing" tag in the log for subsequent statistical calibration.

[0094] The knowledge structure baseline construction module 102 is used to classify and statistically analyze students' historical answer records based on a preset industry knowledge point dual-dimensional tag system, and construct a knowledge mastery heatmap that reflects the distribution of the student's individual knowledge mastery strength and weakness; providing a personalized comparison benchmark for judging the cognitive consistency of exam answers.

[0095] For new trainees with fewer than 30 historical answer records, the system cannot construct a reliable individual knowledge mastery heatmap. In this case, a group baseline substitution strategy is adopted: based on the historical statistical distribution of trainees in the same job category and with the same length of service, an initial knowledge mastery heatmap and operational behavior baseline (including average answering time, trajectory complexity quantiles, etc.) are generated. As the trainee's answer data gradually accumulates (every additional 20 valid records), the system merges the group baseline and individual data with an exponentially decaying weight, eventually transitioning to a fully individualized baseline, achieving a smooth cold start.

[0096] The event sequence generation module 103 is used to segment the examination process into individual questions as the smallest unit and generate event sequences labeled with expected results; it transforms scattered answering behaviors into structured time series data that can be directly processed by the algorithm.

[0097] The atomic anomaly event detection module 104 is used to traverse and calculate each event in the event sequence. Through preset statistical formulas and thresholds, it identifies and marks weak instantaneous correct events, strong lag error events, operation mode switching events, and scripted interaction events. It decomposes complex cheating behaviors into quantifiable atomic anomaly units, providing basic detection elements for pattern matching in cheating scenarios.

[0098] The lower quartile for determining momentary correct events in weak areas, the upper quartile for stumbling errors in strong areas, and the trajectory complexity threshold are all calculated based on the student's clean historical data. After each exam, the system automatically removes exam sessions that have been judged as cheating or confirmed as abnormal by manual review, and recalculates quartiles and cluster centers. Outliers in the historical samples used for baseline calculation that deviate from the mean by more than 3 standard deviations are automatically discarded to prevent historical cheating behavior from contaminating the individual baseline. The variance threshold for "scripted interaction events" is not globally fixed, but is dynamically calculated as the 5th percentile of the variance for each student's normal learning period (the distribution of interaction time intervals in the first 10 exams not marked as abnormal) to accommodate the differences in operating habits among different students.

[0099] The cheating scenario matching module 105 is used to scan the marked event sequence using an adaptive sliding window algorithm. It calculates the distance between the combined features of atomic abnormal events within the window and the cheating scenario templates pre-stored in the cheating mode feature library, and outputs the corresponding cheating suspicion type label. This enables scenario-based diagnosis from isolated abnormal events to those with clear cheating types, improving the interpretability and accuracy of the detection results.

[0100] When the same exam event sequence matches multiple cheating scenario templates simultaneously, such as both "professional exam proxy" and "full-chain study and exam proxy," the system outputs the most severe tag according to the following priority: full-chain study and exam proxy > meticulous cheating > professional exam proxy > cramming for courses and answering questions from a question bank. All matched templates and their matching distances are recorded in the audit log for review by the manual review module. If the matching results are inconsistent under different window sizes, the judgment result of the global window is used as the final output, and "local anomaly clusters" are marked for manual attention.

[0101] The intervention response module 106 is used to automatically execute a tiered intervention sequence based on the suspected cheating type label and the additional risk quantification value. This includes silent deduction of credit hours, pop-up industry knowledge interaction verification, face liveness detection, forced reset of course progress, and cross-system integrity punishment. This forms an automated closed loop from detection to handling, and avoids excessive punishment for minor abnormalities or misjudged objects through tiered intervention.

[0102] For facial micro-expression liveness detection in the second-level intervention, if the student's camera is unavailable or the user refuses authorization, the system automatically downgrades to a dynamic knowledge challenge: three fill-in-the-blank questions are randomly selected from a question bank containing 1000 general knowledge questions, requiring the student to manually type in the answers (copying and pasting are prohibited). The student can continue if they answer all questions correctly. All images and text on the challenge interface are overlaid with a real-time watermark containing the student's ID, session ID, and a hash value of the timestamp to prevent screenshot reuse or automatic answering via OCR scripts. If the downgraded challenge still fails, the exam session is terminated and recorded as "failed second-level intervention." For accounts that trigger the second-level intervention twice consecutively and fail both times, the system directly upgrades to the third-level intervention—forced reset and cross-system penalties.

[0103] The manual review module 107 is used to automatically generate structured review tasks and distribute them to the corresponding review terminals when the system determines that the confidence level is at a critical state or when specific complex conditions are triggered. It receives standardized judgment input from the reviewers and feeds back the review results to the cheating pattern feature library to calibrate the matching templates and judgment boundaries. While giving full play to the efficiency of machines, it introduces controllable manual judgment for cases with ambiguous boundaries or high impact, and realizes the system's continuous self-learning through result feedback.

[0104] To avoid excessive auditing costs associated with double-blind cross-validation, the system only activates double-blind cross-validation for high-risk cases anticipated to trigger account freezing or cross-system penalties, specifically when a "meticulous cheating" or "full-chain proxy learning and exam" template is matched and the structural deviation exceeds 0.8. For general borderline samples, such as those with a confidence level within ±5%, a single-review plus random second-review mechanism is used: first, a junior auditor makes a judgment, and then the system randomly selects 5% of the reviewed tasks and assigns them to another auditor for back-to-back review. If the results are inconsistent, the system automatically submits the case to a senior auditor for final approval. For low-risk sampling samples, a 0.5% sampling rate is used. The samples are first sorted by the model output confidence level, and only the 10% with the lowest confidence level are sent for manual review. The rest are directly archived as "automatically passed," and a note is added to the audit log stating "low-confidence sampling not reviewed."

[0105] The storage system is used to store student historical behavior data, individual behavior baselines, knowledge mastery heatmaps, cheating pattern feature databases, and audit logs, providing data read and write support for each module.

[0106] All collected raw data, including mouse trajectory coordinates, page focus status, gyroscope data, and face images, undergoes anonymization processing on the front end: mouse coordinates are normalized to a [0,1] relative coordinate system; gyroscope data retains only the sign change of angular velocity rather than its precise value; and face images are uploaded only as feature vectors after local liveness detection, without retaining the original image. Data transmission uses TLS 1.3 encryption, and storage uses AES-256 encryption with the encryption key and data access credentials stored separately. Students can apply to delete their personal behavior data and historical baselines at any time in their personal center. Upon receiving a deletion request, the system will completely clear the relevant records within 72 hours and deregister the corresponding heatmap and baseline model.

[0107] The above modules work together to form a complete technical loop, from multi-dimensional data collection, knowledge structure baseline construction, event serialization and atomic anomaly marking, cheating scenario pattern matching, to hierarchical intervention and structured manual review.

[0108] In another embodiment, such as Figure 2 As shown, the workflow of the knowledge structure baseline construction module 102 is as follows: A pre-set two-dimensional tagging system for knowledge points in the water conservancy and hydropower industry is established. Each exam question is labeled with two tags: a knowledge point type tag, such as "cofferdam construction," "flood control and disaster relief," and "safety production regulations"; and a knowledge source tag, which is at least divided into "theoretical memorization type" and "practical experience type." "Theoretical memorization type" knowledge points are mainly acquired through memorizing textbooks, such as the promulgation date of regulations; "practical experience type" knowledge points can be directly mastered through on-site engineering experience, such as the selection of foundation pit drainage schemes.

[0109] Obtain all participants' historical answer records prior to this training, including regular practice and past exams. Perform two-dimensional cross-classification according to the aforementioned two-dimensional tagging system:

[0110] First, based on the knowledge source tags and the answer results, the records are divided into four basic subsets: "Practical experience - correct", "Practical experience - incorrect", "Theoretical memory - correct", and "Theoretical memory - incorrect".

[0111] Then, within each basic subset, the answer records are further subdivided into specific knowledge point dimensions based on the knowledge point type label. For example, in the "Practical Experience - Correct" subset, all correct answers to questions related to "cofferdam construction" are grouped together, while those related to "flood control and disaster relief" are grouped into another group, and so on.

[0112] For each specific knowledge point dimension of each basic subset, calculate three basic metrics:

[0113] Accuracy rate: The percentage of correct answers to questions related to this knowledge point out of the total number of questions answered;

[0114] Average answering time: The arithmetic mean of the time taken to answer each question for this knowledge point;

[0115] Answer stability coefficient: defined as the normalized value of the ratio of the variance of answer time to the average answer time, which is 1 minus the answer time variance. It reflects the consistency of the student's rhythm when answering this knowledge point.

[0116] Next, the values ​​extracted from different subsets of these three indicators are normalized and mapped to the [0,1] interval. Then, a weighted fusion formula is used to generate a comprehensive mastery strength value. The weights can be set based on experience; for example, accuracy rate is weighted at 0.5, average time is weighted at 0.3 (shorter time usually indicates greater proficiency and requires inverse normalization), and stability is weighted at 0.2. Finally, a knowledge mastery heatmap is formed with knowledge points on the horizontal axis and mastery strength value on the vertical axis. This heatmap represents the student's baseline knowledge structure before this exam.

[0117] In another embodiment, during the examination, the data acquisition module 101 records the student's interactive behavior on each question in real time. After the examination or during real-time streaming processing, the event sequence generation module 103 divides the answering process into event sequences at the level of individual questions; see flowchart. Figure 3 .

[0118] Each event e i The multidimensional tuple structure is defined as follows:

[0119] Question Number: A unique identifier for this question.

[0120] Knowledge point category: The knowledge point type tag corresponding to this question.

[0121] Knowledge source tags: "Theoretical memorization type" or "Practical experience type".

[0122] Expected Result Label: This label is automatically determined by the system based on the student's mastery level of the knowledge point in their personal knowledge heatmap. If the mastery level is higher than the threshold (e.g., 0.6), "Expected Correct" is generated; otherwise, "Expected Incorrect" is generated.

[0123] Actual result: Correct or Incorrect.

[0124] Answering time: The time interval from when the question is displayed to when it is finally submitted.

[0125] Operation trajectory complexity: It is quantified by calculating the tortuosity of the mouse movement path (the ratio of the total path length to the straight-line distance between the start and end points) and the number of pause points, and the value is normalized to [0,1].

[0126] Whether a modification operation occurred: Boolean value, records whether the options were changed during the question-answering process.

[0127] Generate an event sequence E={e1, e2, …, en After that, the atomic anomaly event detection module 104 performs a check on each event e. i Perform traversal calculations and labeling.

[0128] In this embodiment, the specific calculations for determining the four types of atomic anomalies are as follows:

[0129] Weakness instantaneous correct event: When the expected result is labeled "expected error" but the actual result is correct, and e i If the response time is less than the lower quartile (25th percentile) of the student's total historical response time, then the event is marked as a weak point instantaneous correct event.

[0130] Strengths Stuttering Error Event: When the expected result is labeled "Expected Correct", the actual result is incorrect, and the answering time is greater than the upper quartile (75th percentile) of the historical answering time, and the operation trajectory complexity exceeds 1.5 standard deviations of the average trajectory complexity of the student in similar questions, it is marked as a strengths stuttering error event.

[0131] Operation mode switching event: The module has a pre-built baseline clustering model of the learner's behavior. During the learning process, unsupervised clustering has been used to classify the learner's answer operation features into clusters such as normal behavior and slightly fluctuating behavior. For the current event e... i The vector composed of the operation trajectory features and the response rhythm features is extracted. The response rhythm features are the number of clicks per unit time. The Euclidean distance between the student and the cluster center of the normal behavior cluster is calculated. If the distance is greater than the preset operation mode threshold, it is marked as an operation mode switching event. The operation mode threshold is a 3σ boundary based on the distribution of normal cluster data.

[0132] Scripted Interaction Events: The time intervals of interaction events throughout the entire event sequence or learning process are statistically analyzed. If the variance of the interaction time intervals of M consecutive events is lower than the 5th percentile of the variance of normal human operation (M=10 here), or the variance of the point-to-point path similarity of the mouse trajectory is lower than the lower limit of the trajectory variance threshold of normal human operation, it indicates that the operation is highly regular. Then, the corresponding event segment is marked as a scripted interaction event.

[0133] In another embodiment, to more clearly demonstrate the above-mentioned testing process, a 10-question mock exam of a water conservancy personnel trainee, "Trainee A," is used as an example for step-by-step deduction, as shown in Table 1 below. Trainee A's personal historical answer data shows that he is a technician with 10 years of experience in cofferdam construction. In his knowledge heatmap, the mastery intensity of practical experience-based knowledge points such as "cofferdam construction" and "flood control and emergency rescue" is between 0.75 and 0.90 (expected correct), while the mastery intensity of theoretical memorization-based knowledge points related to "safety production regulations" is only 0.25 to 0.40 (expected incorrect). The lower quartile of his historical answering time is 8 seconds, and the upper quartile is 35 seconds.

[0134] Table 1. Results of a 10-question mock exam for a water conservancy personnel trainee, "Trainee A".

[0135]

[0136] The atomic anomaly detection module 104 traverses the sequence and performs the following judgments:

[0137] Question 1: Expected correct, result correct, duration 12 seconds (within the normal range of 8-35 seconds), no abnormalities.

[0138] Question 2: Expected error, incorrect result, duration 45 seconds (>35 seconds above the quartile). However, errors in practical experience-based strengths are normal. Due to the long time commitment and modifications, the trajectory complexity needs to be considered. The trajectory complexity of this question is 0.78, exceeding student A's average of 0.50 + 1.5σ (σ = 0.10, threshold = 0.65) for similar theoretical memorization questions. Therefore, it is marked as a strength-based stuttering error event. However, note that questions with "expected errors" are not typically considered strengths. Therefore, the check condition is: only correct expectations apply to the strength-based stuttering error flag. Thus, question 2 is not flagged.

[0139] Question 3: Normal.

[0140] Question 4: Expected error, correct result, duration 5 seconds (< 8-second lower quartile), marked as a weak point instantaneous correct event.

[0141] Question 5: Expected error, correct result, duration 6 seconds (<8 seconds), marked as a weak point momentary correct event.

[0142] Question 6: Expected error, correct result, duration 4 seconds (<8 seconds), marked as a weak instantaneous correct event.

[0143] Question 7: Expected correct, result incorrect, duration 52 seconds (>35 seconds), trajectory complexity 0.85 (exceeds the average complexity of this student's practical experience-based questions 0.30+1.5σ=0.45), marked as a strong performance stuttering error event.

[0144] Question 8: Normal.

[0145] Question 9: Expected error, result error, duration 40 seconds, trajectory complexity 0.72, but because it is an expected error question, even if it takes a long time, it does not meet the strong lag error condition, so it is not marked.

[0146] Question 10: Expected correct, result incorrect, duration 55 seconds (>35 seconds), trajectory complexity 0.88 (exceeding the threshold of 0.45), marked as a strong performance stuttering error event.

[0147] Final labeling results: Questions 4, 5, and 6 were identified as momentary correct answers in weak areas; Questions 7 and 10 were identified as errors due to lag in strong areas. These labels will be passed to the cheating scenario matching module for pattern combination analysis.

[0148] In another embodiment, the cheating scenario matching module 105 pre-stores multiple cheating scenario templates, each template being a set of logical rules regarding combinations of atomic anomaly events and global statistics. The module uses an adaptive sliding window to scan the marked event sequence, such as... Figure 3 As shown.

[0149] Let's continue using student A's sequence as an example to illustrate the matching process. Supplementary learning process data for student A: During the learning period of the corresponding video course "Safety Production Regulations," the page focus was lost for 68% of the time, and there was no operation for 62% of the time; in the "Cofferdam Construction" chapter, the student's engagement was normal, with focus loss occurring only 5%.

[0150] The cheating scenario templates and their matching logic are as follows:

[0151] Templates for intensive course completion and question bank answering:

[0152] Condition A: The percentage of instantaneously correct events for weak items in the entire sequence is >30%. Student A had a total of 10 questions, with 3 instantaneously correct events for weak items (questions 4, 5, and 6), accounting for 30%, which just reached the threshold.

[0153] Condition B: The variance of the total answering time is lower than the historical lower limit of the student's variance. Student A's historical lower limit of variance is 120 (seconds²). The variance of the answering time for this 10 questions is calculated as follows: mean = (12+45+9+5+6+4+52+10+40+55) / 10 = 23.8 seconds, variance = Σ(time - 23.8)² / 10 ≈ 462.6, which is greater than the historical lower limit of 120, and therefore does not meet condition B.

[0154] Condition C: The percentage of time without any practical application during the corresponding course learning process is >50%. The percentage of time without practical application in the chapters on safety production regulations is 62%, thus meeting Condition C.

[0155] This template was not matched because condition B was not met.

[0156] 1. Professional exam-taking template:

[0157] Condition A: The proportion of operation mode switching events is >15%. No operation mode switching events were detected in the above sequence (Student A's answer rhythm and trajectory are within the normal cluster range), so it is not a match.

[0158] 2. A meticulously prepared cheating template (knowing the questions in advance):

[0159] Condition: Within the latter 50% of the event sequence (i.e., the interval from question 6 to question 10), there exists a continuous subsequence of weak-item instantaneously correct events of length not less than 3. Student A's weak-item instantaneously correct events are concentrated in questions 4-6, with question 6 belonging to the beginning of the latter 50%. However, questions 4-6 as a whole span both the first and second halves of the sequence, and within the second half, only question 6 is a single weak-item instantaneously correct event, failing to form a cluster of more than 3 consecutive questions in the second half, thus resulting in a mismatch.

[0160] 3. Full-chain proxy learning and exam template:

[0161] Sub-template 1 (Script-based random question answering):

[0162] A runs test was performed on the actual result sequence (results for questions 1-10: correct, incorrect, correct, correct, correct, correct, incorrect, correct, incorrect, incorrect). The number of correct runs was 3 (question 1 alone, questions 3-6 consecutively, question 8 alone), and the number of incorrect runs was 3 (questions 2, 7, and 9-10). The total number of runs was 6. At a significance level of 0.05, the critical value for the runs test for 10 samples was 2 at the lower limit and 9 at the upper limit. Within the interval, the p-value ≈ 0.67 > 0.05, therefore the randomness hypothesis could not be rejected.

[0163] Furthermore, the variance of response time of 462.6 is greater than the historical lower limit of 120, so the condition is not met.

[0164] Sub-template 2 (Exam taken by someone else and knowledge mismatch):

[0165] Structural Deviation Value: The module calculates the KL divergence between the expected and actual distributions. Expected Correct Probability Distribution The accuracy rate was concentrated on practical experience-based knowledge points (cofferdam construction 0.85, flood control and emergency rescue 0.80), while the expected accuracy rate for theoretical memorization-based knowledge points was only 0.25%. The actual correct answer distribution was as follows: 1 out of 3 questions on cofferdam construction (33%), 2 out of 2 questions on flood control and emergency rescue (100%), and 3 out of 5 questions on safety production regulations (60%). The calculation shows a large divergence, with the deviation value exceeding the threshold, thus satisfying the condition.

[0166] Number of operation mode switching events: Not detected, not met.

[0167] Therefore, although student A did not directly trigger any current cheating scenario template, their performance showed some abnormalities. Their percentage of correct answers in their weak areas was just at the critical threshold, and their engagement in the learning process was low. Therefore, the system will assign them to the "Attention" level and accumulate integrity profile tags.

[0168] To demonstrate the success rate of the cheating scenario template, another virtual "student B" is created, whose answers are entirely scripted. Student B's historical heatmap is similar to Student A's, but during the exam, the sequence of 10 questions is randomly distributed, the variance in answer time is extremely low (only 0.3 seconds²), and there is no interaction throughout the learning process. Atomic anomaly detection marks all 1-10 questions as scripted interactive events and mixed weakness / strength anomalies. The full-chain proxy learning and exam-taking sub-template simultaneously satisfies two conditions: a runs test p-value > 0.05 and a time variance below the historical lower limit. The system outputs the label "Full-chain proxy learning and exam-taking - scripted random answering".

[0169] In another embodiment, a method for calculating structural bias values ​​is involved in cheating scenario matching. The module first derives the expected distribution from the knowledge heatmap: for each knowledge point category in the exam, based on the mastery strength value in the heatmap, the probability of strength > 0.6 is taken as the expected correct probability, and these are summarized to obtain the expected correct distribution. ; corresponding expected error distribution Then from 1- The result is obtained after normalization.

[0170] The actual correct distribution P_real represents the proportion of questions answered correctly across all knowledge categories; the actual error distribution... This represents the proportion of incorrect answers across different knowledge categories. Using the Kullback-Leibler divergence formula: First divergence:

[0171]

[0172] Second divergence:

[0173]

[0174] Structural deviation value:

[0175]

[0176] Where α is the weighting coefficient, which can be 0.5.

[0177] When extreme structural contradictions occur, such as "all weak points are correct while all strong points are wrong", both divergence values ​​will increase sharply, causing the structural deviation value to significantly exceed the threshold.

[0178] In another embodiment, after obtaining the suspected cheating label and the associated quantitative risk values ​​such as structural deviation value and cognitive contradiction degree, the intervention response module 106 first activates the evidence solidification submodule: automatically records the system timestamp, student ID, and session ID, and packages the atomic abnormal event fragment that triggered the alarm, the matched template and its matching distance, generates an immutable audit log through hash digest and digital signature, and stores it in the integrity file database.

[0179] Subsequent three-level progressive intervention is then carried out as follows:

[0180] First-level intervention - silent correction: applicable to the situation of suddenly swiping courses with a low degree of cognitive contradiction. The module extracts the non-operation periods in the learning process, calls the learning hour calculation interface, sets the learning hour coefficients of these periods to zero, and deducts them from the total valid learning hours. Only the updated valid learning hours are displayed at the front end without pop-up windows. At the same time, add a low-weight label of "Doubts about learning engagement" with a validity period of 30 days to the student integrity profile; if there is an abnormality again within the validity period, the risk will be automatically upgraded.

[0181] Second-level intervention - interactive presence verification: applicable to scenarios with professional exam cheating templates and an excessive hanging-up rate. The system pops up an unscriptable challenge based on industry knowledge, such as "Select the on-site photos that belong to the gate installation process from the following four pictures". The option pictures are from the actual engineering picture library and need to be completed within 20 seconds; at the same time, the system calls the browser or APP camera interface to start the live detection SDK, and requires the student to complete a combination of actions such as nodding and blinking according to random prompts. The algorithm analyzes the video frames in real time for face comparison and live body judgment. If the knowledge challenge is answered incorrectly or the face comparison and live body detection fail, the exam session will be automatically terminated and a second-level abnormal record will be generated.

[0182] Third-level intervention - forced reset and cross-system punishment: applicable to elaborate cheating, full-chain proxy learning and exam cheating, or continuous failure in the second-level verification. The module clears all the progress of the student's current course through the course management API. At the same time, according to the weak knowledge points identified by the personal knowledge heat map (such as "theoretical memory type" knowledge points with a mastery intensity <0.3), an automatic compulsory supplementary learning schedule is compiled. The student can only obtain the exam qualification again after completing these courses in sequence and passing the subsection quizzes. In addition, record this high-risk abnormal event with a high weight in the student's permanent integrity file and push it to the enterprise human resources system or government supervision platform through the pre-configured data interface to achieve cross-system linkage punishment.

[0183] The calculation of the cognitive contradiction degree is carried out in the detection stage of atomic abnormal events, and micro-abnormalities are identified from two dimensions: answering operation behavior and knowledge structure. On this basis, a behavior-process consistency coefficient is introduced to measure the matching relationship between the answering operation habits of the student in this exam and the degree of concentration in the corresponding course learning process. This coefficient is used as a supplementary dimension in the subsequent matching of cheating scenarios and the triggering judgment of manual review in coordination with the knowledge structure deviation value. Specifically, the calculation of this coefficient is synthesized by weighting two components:

[0184] (1) Learning process engagement component: calculated based on behavioral data of the learning stage. Extract the learning process behavior sequence of the student in the corresponding course chapter of this exam, and count the percentage of page focus loss time, the percentage of no operation time, the frequency of player pause, and other indicators. After normalization, the weighted fusion is used to obtain an engagement value in the range [0,1], where 1 represents high focus throughout the process.

[0185] (2) Answering behavior consistency component: calculated based on operational behavior data during the examination phase. The operational trajectory feature vector and answering rhythm feature vector of each question in this examination are extracted, and the average Euclidean distance between them and the cluster center of normal behavior in the student's historical behavior baseline is calculated. After normalization, it is mapped to the interval [0,1], where 1 indicates that the examination operation is completely consistent with the student's historical habits.

[0186] Behavior-process consistency coefficient = γ × learning process engagement component + (1-γ) × answer behavior consistency component, where γ is the weighting coefficient, which is 0.5 by default.

[0187] This coefficient, together with the structural deviation value, constitutes the cognitive contradiction index: Cognitive Contradiction = α × Behavior-Process Consistency Coefficient × Structural Deviation Value + β × Structural Deviation Value. Where α is the contradiction amplification coefficient (ranging from 1.5 to 3.0), and β is the basic deviation weight. This index is used as one of the main judgment indicators in the trigger condition determination of the manual review module.

[0188] In another embodiment, such as Figure 4 As shown, the manual review module 107 intervenes when the system confidence level is insufficient. The triggering conditions include: the cognitive contradiction degree of the main judgment indicator falls within the ±5% critical range of the set threshold; the same student's data matches the contradictory features of scenario A and scenario B at the same time; high risk but the student's historical data volume is less than 30 records; and sampling inspection is carried out on samples judged as normal at a rate of 0.5%.

[0189] Once triggered, the task scheduling module automatically generates a structured review task and pushes it to the administrator's review terminal.

[0190] The review interface is designed with a three-pane comparison display:

[0191] Pane 1: Student knowledge heatmap and summary of historical operation rhythm.

[0192] Pane 2: A Gantt chart of the event sequence for this exam, where marked atomic anomalies are highlighted with red dots, showing the question number and anomaly type.

[0193] Window 3: Overlay curve chart. The blue line is the historical answering time curve, and the red line is the current exam time curve. Abnormal deviation intervals are automatically colored.

[0194] Auditors need to answer standardized questions, such as "Is there a reasonable explanation for the learning progress in highlighting the abnormal event segment?", rather than giving a vague judgment of "whether it is cheating". The entire operation process is timed and recorded.

[0195] The system employs a tiered collaborative review process: medium-risk borderline samples enter the primary review pool; high-risk conflicting samples enter the advanced expert review pool; for the highest-risk situations anticipated to trigger account freezing, the task automatically enters a double-blind cross-validation process, simultaneously sending it to two reviewers who are unaware of each other's identities. The system only adopts the result if the two reviewers agree, for example, both deem it "abnormal and inexplicable" or both deem it "explanatory"; otherwise, it is automatically submitted to a third, higher-level final decision administrator.

[0196] The results of manual review not only address the current case but also create a closed-loop feedback loop: when an auditor identifies a new variant of a cheating pattern, its feature vector is updated to the cheating pattern feature library using an incremental clustering algorithm, becoming a new matching sub-template; the system periodically analyzes cases that have been manually corrected, and when the correction rate near a certain threshold exceeds a preset value, it automatically sends a threshold adjustment suggestion to the administrator; simultaneously, data from double-blind cross-validation can analyze the bias of each auditor's judgment (too strict or too lenient), and correct their judgments using a weighted algorithm to ensure the consistency of overall audit standards. Audit operation records and audit logs are stored together, forming a complete, traceable behavioral chain that includes both machine judgments and human evidence.

[0197] Specifically, updating the cheating pattern feature library includes: when manual review confirms that a student's exam event sequence constitutes cheating, and the matching distance between the atomic anomaly event combination pattern triggered by this sequence and all templates in the existing cheating pattern feature library is greater than a preset threshold, it indicates that the existing templates have failed to effectively cover this cheating variant. In this case, the labeled atomic anomaly event type combinations, temporal interval distribution, and global statistical features of the sequence are extracted to form an anomaly pattern feature vector. This feature vector is used as a new sample input to an incremental clustering algorithm. The algorithm determines the appropriate feature vector based on its distance from the cluster centers of existing templates in the feature library: if the distance to the nearest template center is less than a merging threshold, the cluster center and boundary parameters of the template are updated using a weighted average; if the distance is greater than a new threshold, a new cheating scenario template is created in the feature library, with its initial matching rules automatically generated from the atomic anomaly event combination pattern of the feature vector. Through this mechanism, the cheating pattern feature library can continuously incorporate newly discovered cheating variants without requiring a full retraining. As confirmed cases accumulate, the number of templates and matching accuracy increase simultaneously, enabling the system to have online self-learning capabilities.

[0198] In another embodiment, an online training anti-cheating method based on anomaly event sequence pattern detection includes the following steps:

[0199] Collect behavioral data on students' learning process during the learning phase, as well as their answering behavior data during the examination phase;

[0200] Based on a pre-defined dual-dimensional tagging system for industry knowledge points, the historical answer records of trainees are classified and statistically analyzed to construct a heatmap of knowledge mastery that reflects the distribution of individual knowledge strengths and weaknesses. The dual-dimensional tagging system includes knowledge point type tags and knowledge source tags, wherein the knowledge source tags at least distinguish between theoretical memorization type and practical experience type.

[0201] The examination process is divided into event sequences at the level of a single question. Each event includes a question number, knowledge point category, knowledge source tag, expected result tag, actual result, answering time, and operational characteristic data. The expected result tag is automatically generated based on the mastery intensity of the knowledge point corresponding to the question in the knowledge mastery heatmap.

[0202] Each event in the event sequence is traversed and calculated, and marked according to a variety of preset atomic anomaly event judgment conditions to obtain the marked event sequence;

[0203] When the expected result of an event is labeled as expected error, the actual result is correct, and the response time is lower than the lower quartile of the student's historical response time, it is marked as a weak point momentary correct event.

[0204] When the expected result of an event is labeled as expected correct, the actual result is incorrect, the response time is higher than the upper quartile of the student's historical response time, and the complexity of the operation trajectory exceeds the normal threshold, it is marked as a strength lag error event.

[0205] When the distance between the operation feature vector of an event and the cluster center of the normal behavior cluster in the student's historical behavior baseline exceeds the preset operation mode threshold, it is marked as an operation mode switching event.

[0206] When the variance of the interaction interval or the variance of the trajectory similarity of multiple consecutive events are lower than the lower limit of the variance of normal human operation, they are marked as scripted interaction events.

[0207] The sliding window algorithm is used to scan the marked event sequence, and the combined features of atomic abnormal events within the window are matched with the pre-stored cheating scenario template to output cheating suspicion type labels.

[0208] The tagged event sequences were combined with the following cheating scenario templates for feature matching:

[0209] The template for intensive course completion and question bank answering is as follows: the percentage of correct answers in weak areas exceeds the first preset threshold, the variance of answering time is lower than the historical lower limit, and the percentage of time without operation during the corresponding course learning process exceeds the second preset threshold.

[0210] Professional exam-taking template: The number of operation mode switching events exceeds the third preset threshold, and the knowledge structure deviation value is lower than the fourth preset threshold;

[0211] A meticulous cheating template: In the latter half of the event sequence, there is a cluster of consecutive weak points that are momentarily correct, and the answering time for each event is shorter than the average time for historical easy questions;

[0212] Full-chain proxy learning and exam template: The actual result sequence runs test shows randomness and the duration variance is usually low, or the knowledge structure deviation value exceeds the standard and the number of operation mode switching events exceeds the standard;

[0213] When the marked event sequence meets the matching conditions of any cheating scenario template, the corresponding cheating suspicion type label is output;

[0214] The thresholds involved in the matching conditions of each cheating scenario template are all determined in advance based on the statistical distribution characteristics of the behavioral data and answer data collected during the student's previous normal exams and normal learning processes, through quantile calculation or normal distribution parameter estimation methods.

[0215] Automatically execute tiered intervention operations based on the suspected cheating type label.

[0216] The embodiments described above merely illustrate specific implementation methods of this application, and while the descriptions are detailed and specific, they should not be construed as limiting the scope of protection of this application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the technical solution of this application, and these modifications and improvements all fall within the scope of protection of this application.

Claims

1. An online training anti-cheating system based on abnormal event sequence pattern detection, characterized in that, include: The data acquisition module is used to collect behavioral data of students during the learning and examination phases. The knowledge structure baseline construction module is used to analyze students' historical answer records based on the industry knowledge point tag system and construct a knowledge mastery heatmap that reflects the distribution of individual knowledge mastery strengths and weaknesses. The event sequence generation module is used to divide the examination process into event sequences at the granularity of individual questions, and generate expected result labels for each event based on the knowledge mastery heatmap. The atomic anomaly event detection module is used to perform traversal calculations and marking for each event in the event sequence according to a variety of preset atomic anomaly event judgment conditions; The cheating scenario matching module is used to scan the marked event sequence using a sliding window algorithm, match the combined features of atomic abnormal events within the window with the pre-stored cheating scenario template, and output a cheating suspicion type label. The intervention response module is used to automatically perform tiered intervention operations based on the suspected cheating type label; The manual review module is used to generate structured review tasks and distribute them to the review terminal when the confidence level of the system's judgment result is at a preset critical state. It also receives the review judgment input and feeds back the results to the cheating pattern feature library.

2. The system according to claim 1, characterized in that, The industry knowledge point tagging system is a two-dimensional tagging system that includes knowledge point type tags and knowledge source tags. The knowledge source tags at least distinguish between theoretical memorization type and practical experience type. The knowledge mastery heatmap is generated by cross-classifying historical answer records based on the two-dimensional tags and calculating the mastery intensity index of each knowledge point dimension.

3. The system according to claim 1, characterized in that, The criteria for determining atomic anomalies include at least the following: Weakness instantaneous correct event: The expected result is labeled as expected error, the actual result is correct, and the response time is lower than the lower quartile of the student's historical response time; Strength-related stuttering error events: The expected result is labeled as expected correct, but the actual result is incorrect, and the answering time is higher than the upper quartile of the student's historical answering time, and the complexity of the operation trajectory is higher than the threshold of the normal answering trajectory; Operation modality switching event: The distance between the response operation feature vector and the cluster center of the normal behavior cluster in the student's historical behavior baseline exceeds the preset operation modality threshold; Scripted interactive events: The variance of the interaction time interval of multiple consecutive events is lower than the lower limit of the variance of normal human operation, or the variance of trajectory similarity is lower than the lower limit of the variance of normal human operation trajectory.

4. The system according to claim 3, characterized in that, The cheating scenario template includes at least the following: The template for intensive course review and question bank answering is as follows: The proportion of instantaneous correct events in the weak areas in the entire exam event sequence exceeds the first preset threshold, the variance of the entire exam answering time is lower than the lower limit of the historical answering time variance of the student, and the proportion of the corresponding course learning process without operation exceeds the second preset threshold. Professional exam-taking template: The number of operation mode switching events exceeds the third preset threshold, and the knowledge structure deviation value is lower than the fourth preset threshold; after matching, the intervention response module calls the camera to collect real-time facial images and compares them with the benchmark template; A meticulous cheating template: In the latter half of the event sequence, there exists a continuous subsequence of length not less than N, where each event is a momentary correct answer to a weak point, and the answering time for each event is lower than the student's average answering time for simple history questions. Full-chain proxy learning and exam template: includes a first sub-template and a second sub-template, and matching is achieved if either one is met; the first sub-template is that the actual result sequence run test value is greater than the fifth preset threshold and the variance of the answering time is lower than the historical lower limit; the second sub-template is that the knowledge structure deviation value exceeds the sixth preset threshold and the number of operation mode switching events exceeds the seventh preset threshold. Each threshold involved is determined in advance based on the statistical distribution characteristics of the behavioral and answer data collected during the student's previous normal exams and learning processes, through quantile calculation or normal distribution parameter estimation methods.

5. The system according to claim 1, characterized in that, The tiered intervention operations include: Level 1, silently deducting study hours during the idle period and adding an integrity tag; Level 2, popping up an industry knowledge interaction challenge and calling the camera for liveness detection; Level 3, forcibly resetting the course progress, generating a make-up study schedule based on the knowledge heatmap, and synchronizing high-risk records to an external management platform.

6. The system according to claim 1, characterized in that, The triggering conditions for the manual review module include: the judgment indicator falling into the critical range, the same student's data matching multiple opposing scenarios at the same time, high-risk cases with low historical data volume, and normal sample sampling; double-blind cross-validation is used for the highest risk level tasks, with two reviewers making independent judgments. If the results are consistent, the results are adopted; if they are inconsistent, the review level is upgraded.

7. The system according to claim 1, characterized in that, The cheating scenario matching module adopts an adaptive sliding window: a small window is used for local dense anomaly detection, and a window covering the entire sequence is used for global statistical feature detection. The results of multi-window scanning are fused for judgment.

8. The system according to claim 1, characterized in that, It also includes a dynamic update module, which is used to extract the pattern feature vector when the abnormal event combination pattern confirmed by manual review is not covered by the existing template, and add it as a new template or update the boundary of the existing template through an incremental clustering algorithm, so that the cheating pattern feature library has self-learning ability.

9. An online training anti-cheating method based on abnormal event sequence pattern detection, characterized in that, Includes the following steps: Collect behavioral data on students' learning process during the learning phase, as well as their answering behavior data during the examination phase; Based on a pre-set dual-dimensional tagging system for industry knowledge points, the historical answer records of trainees are classified and statistically analyzed to construct a heat map of knowledge mastery that reflects the distribution of individual knowledge strengths and weaknesses. The dual-dimensional tagging system includes knowledge point type tags and knowledge source tags, wherein the knowledge source tags at least distinguish between theoretical memorization type and practical experience type. The examination process is divided into event sequences at the level of a single question. Each event includes question number, knowledge point category, knowledge source tag, expected result tag, actual result, answering time, and operational characteristic data. The expected result label is automatically generated based on the mastery level of the knowledge point corresponding to the question in the knowledge mastery heatmap. Each event in the event sequence is traversed and calculated, and marked according to a variety of preset atomic anomaly event judgment conditions to obtain the marked event sequence; The sliding window algorithm is used to scan the marked event sequence, and the combined features of atomic abnormal events within the window are matched with the pre-stored cheating scenario template to output cheating suspicion type labels. Automatically execute tiered intervention operations based on the suspected cheating type label.

Images