Online learning anomaly behavior recognition method and system based on spatio-temporal graph neural network

Abstract

The application discloses an online learning abnormal behavior recognition method and system based on a space-time graph neural network, and belongs to the technical field of behavior risk early warning. First, based on the original learning behavior data stream, a dynamic graph snapshot sequence is generated through adaptive time window division to construct a structure flow and attribute flow dual view. The model comprises three core modules: an orthogonal decoupling coding module that independently learns the latent representation of the two types of views to distinguish topological changes and attribute characteristics; a space-time modeling module that uses a neural ordinary differential equation to predict the behavior evolution trend of a learner and fuses the calibrated features retrieved by a dynamic prototype memory network; and an adaptive result attribution module that calculates a comprehensive abnormal score based on the deviation between the prediction and the real representation, dynamically adjusts the threshold value in combination with a statistical distribution, and determines a high-risk object. The method can capture abnormalities such as cross-regional collusion, irregular learning tracks and long-term proxy exams, provide quantitative evidence support, and maintain stable early warning performance in a non-stationary education environment.

Description

Technical Field

[0001] This invention belongs to the field of behavioral risk early warning technology, and in particular relates to an online learning abnormal behavior recognition method and system based on spatiotemporal graph neural networks. Background Technology

[0002] In the digital education ecosystem, identifying abnormal online learning behavior has become a crucial technology for upholding academic integrity and maintaining educational fairness. In large-scale online learning platforms (LMS), learning behaviors are not isolated individual nodes, but rather dynamic, high-dimensional spatiotemporal interconnected structures formed by learners, course resources, and terminal devices. Especially during high-concurrency scenarios such as exam weeks or large-scale online assessments, the sudden increase in learning behavior data leads to significant fluctuations in its topological structure, posing considerable challenges to real-time monitoring. Current detection models struggle to quantify the changing patterns of nonlinear learning trajectories when dealing with complex structural evolution, resulting in unclear boundaries between normal and abnormal behavior. Furthermore, with the exponential growth of the user base, traditional algorithms struggle to balance computational overhead and detection timeliness, easily leading to false negatives and missed positives for highly concealed behavioral deviations. Therefore, there is an urgent need to develop an anomaly detection system that integrates multimodal spatiotemporal features, possesses high-timeliness processing capabilities, and provides interpretable results. This system should comprehensively analyze time-series sequences and changes in network connectivity to accurately identify sudden anomalies and structural abnormalities.

[0003] Anomaly patterns are essentially a special subtopology in dynamic graphs. Therefore, this paper integrates factors such as students, resources, and terminals in online platforms, transforming interactive flows like responses and synchronous collaboration into a dynamic evolution graph. This allows for precise localization of these anomalous behaviors within a specific spatiotemporal scope. This demonstrates that anomaly monitoring in online learning has become a complex task of spatiotemporal anomaly pattern recognition. Compared to static graphs, the challenge of dynamic graph recognition in educational environments lies in the highly concealed nature of anomaly patterns. In academic collusion, a student's or response behavior may exhibit completely normal behavior patterns within a single time segment, but its deviation from the expected path only becomes apparent in a continuously evolving spatiotemporal context.

[0004] Currently, research in this field is broadly divided into two technical approaches. The first relies on shallow learning paradigms, using matrix factorization or statistical metrics to represent learning behavior. This approach has relatively low computational costs, but it struggles to quantify deep nonlinear relationships in complex interactions, thus limiting its ability to detect collusion and cheating. The second approach, which emerged with the development of deep learning technology, utilizes Graph Convolutional Networks (GCNs) or Graph Attention Networks (GATs) to examine the deep connections between student characteristics and learning behavior.

[0005] However, current technologies for identifying honest behavior in dynamic scenarios have several significant flaws. A major bottleneck is insufficient temporal resolution. Many methods rely on fixed time windows for behavior sampling, making it difficult to effectively capture minute operations at the millisecond level. Furthermore, their ability to analyze behavioral patterns weakens under non-uniform time intervals. In real-world teaching data, normal individual learning behavior and potential collaborative cheating patterns within a group can easily be confused in the feature space. Moreover, current algorithms lack effective dynamic differentiation methods, making it extremely difficult to decipher the connections between different behavioral features. This results in ambiguous judgment criteria. When the system flags an anomaly, it often cannot provide traceable time points, behavioral points, or logical connections, significantly hindering the attribution of responsibility in practice. Summary of the Invention

[0006] The purpose of this invention is to solve the problems existing in the prior art and to provide an online learning abnormal behavior recognition method and system based on spatiotemporal graph neural networks.

[0007] To achieve the above-mentioned objectives, the present invention specifically adopts the following technical solution:

[0008] In a first aspect, the present invention provides an online learning-based abnormal behavior recognition method based on a spatiotemporal graph neural network, comprising the following steps:

[0009] S1. Obtain the raw learning behavior data stream collected from the online learning platform and represent it as an interaction event sequence. Then, through an adaptive time window partitioning strategy, convert the interaction event sequence into a dynamic graph snapshot sequence and construct a corresponding structure flow input view and attribute flow input view for each graph snapshot in the graph snapshot sequence.

[0010] S2. Deploy the trained online learning abnormal behavior recognition model to the online learning platform to continuously detect and provide abnormal warnings for learning behaviors on the platform;

[0011] In the online learning abnormal behavior recognition model: First, the structure flow input view and attribute flow input view are independently represented by the orthogonal decoupled coding module to obtain the joint latent representation of each node in each graph snapshot. Next, each time window is mapped to a representative moment, and the joint latent representation of the node is used as the learning state of the node at that representative moment and input into the spatiotemporal modeling module. The behavioral evolution trend of the learner in the continuous time domain is predicted by the neural ordinary differential equation to obtain the expected learning state of the next representative moment. This is then weighted and fused with the calibration features retrieved by the dynamic prototype memory network to obtain the final predicted representation. Finally, in the adaptive result attribution module, the joint latent representation of the next representative moment is used as the real observation representation. Based on the final predicted representation and the real observation representation, the comprehensive abnormal score of the node is calculated and loaded into the time window. Combining the statistical distribution of the comprehensive abnormal score within the time window, the abnormal judgment threshold is adaptively calculated. If the comprehensive abnormal score is greater than the abnormal judgment threshold, the learner represented by the node is considered to have abnormal behavior and is marked as a high-risk object; otherwise, the learner represented by the node is considered not to have abnormal behavior.

[0012] Based on the above scheme, each step can be implemented in the following preferred manner.

[0013] As a preferred embodiment of the first aspect above, in step S1, the interaction event sequence consists of multiple interaction events, and each interaction event consists of an interaction initiation node, an interaction object node, a timestamp of an interaction behavior, and the interaction behavior characteristics carried by that interaction.

[0014] The specific process of converting an interaction event sequence into a graph snapshot sequence using an adaptive time window partitioning strategy is as follows: the time axis corresponding to the interaction event sequence is divided into non-overlapping parts to obtain multiple time windows of unequal length; for each time window, the interaction events within that time window are extracted from the interaction event sequence to form a subset of interaction events and a graph snapshot is constructed. This graph snapshot consists of four parts: the set of nodes participating in the interaction within that time window, the set of edges, the adjacency matrix of the graph snapshot, and the node feature matrix; after traversing each time window, a graph snapshot sequence is formed from all the graph snapshots.

[0015] As a preferred embodiment of the first aspect mentioned above, the elements in the adjacency matrix Represents a node With nodes In the The degree of correlation within a time window is calculated by a weighted sum of two parts: the first part being the nodes. With nodes In the The number of interactions within a time window, the second part is the node. With nodes In the A measure of the similarity of interactive content when interacting within a time window;

[0016] The node feature matrix is ​​obtained as follows: For any node, first start from the first... The set of interactive events participated in within a time window is obtained from the subset of interactive events in that time window; then, the features of all interactive behaviors contained in the set of interactive events are statistically aggregated to form the feature vector corresponding to that node, which is used to characterize that node in the first time window. The overall behavior state within a time window; finally, the feature vectors corresponding to all nodes are stacked in node order to form a node feature matrix.

[0017] As a preferred embodiment of the first aspect above, in step S1, for each graph snapshot, the structure flow input view of the graph snapshot is composed of the node set of the graph snapshot and its adjacency matrix, and the attribute flow input view of the graph snapshot is composed of the node set in the graph snapshot and the node feature matrix of the graph snapshot.

[0018] As a preferred embodiment of the first aspect mentioned above, the specific processing flow in the orthogonal decoupling encoding module in step S2 is as follows: For the structure flow input view, the adjacency matrix and the node feature matrix are input into the structure flow encoder. By encoding the topological relationships between nodes, the structural latent representation of the learner in the teaching topological space is extracted, and the structural latent representation matrix of all nodes in each graph snapshot is obtained. For the attribute flow input view, the attribute encoder is used to map the node feature matrix, and the attribute latent representation of the learner in the individual behavior space is extracted, and the attribute latent representation matrix of all nodes in each graph snapshot is obtained. Finally, the two latent representation matrices are concatenated to obtain the joint latent representation of each node in each graph snapshot, forming the joint latent representation matrix of the nodes.

[0019] As a preferred embodiment of the first aspect, the specific processing flow in the dynamic prototype memory network in step S2 is as follows: First, maintain a set of prototype vectors representing normal learning behavior. The prototype vectors are obtained by clustering the joint latent representations of nodes with normal learning behavior. Nodes with normal learning behavior are learners who were not identified as having abnormal learning behavior during the training phase. Then, calculate the correlation score between the expected learning state and each prototype vector through the attention retrieval mechanism, and normalize the correlation score through softmax to obtain the attention weight of the node to each prototype vector. Then, perform a weighted summation of each prototype vector according to the attention weight to generate the calibration feature of the node at the next representative time step.

[0020] As a preferred embodiment of the first aspect mentioned above, in step S2, for any node, its true observation representation is considered as a concatenation of the true structure observation representation and the true attribute observation representation. Correspondingly, the final predicted representation of the node is considered as a concatenation of the predicted structure representation and the predicted attribute representation. Then, the structural dimension anomaly error of the node at the next representative time is the Euclidean distance between the true structure observation representation and the predicted structure representation, and the attribute dimension anomaly error of the node at the next representative time is the Euclidean distance between the true attribute observation representation and the predicted attribute representation. By weighted summing of the two dimension anomaly errors, the comprehensive anomaly score of the node at the next representative time is calculated.

[0021] As a preferred embodiment of the first aspect, in step S2, the method for calculating the anomaly determination threshold is as follows: first, the calculated comprehensive anomaly score is loaded into the time window, the mean and standard deviation of the comprehensive anomaly score distribution of all nodes within the time window are calculated, and the calculated mean and standard deviation are weighted and summed to serve as the anomaly determination threshold for the time window.

[0022] As a preferred embodiment of the first aspect above, in step S2, the total loss function used during the training of the online learning abnormal behavior recognition model is obtained by weighted summation of prediction loss, orthogonal decoupling loss, and memory prototype constraint loss; wherein, the prediction loss is the mean square error between the final predicted representation and the actual observed representation; and the memory prototype constraint loss is the mean square error between the joint latent representation of a node and the prototype vector that is closest to the joint latent representation.

[0023] Secondly, the present invention provides an online learning abnormal behavior recognition system based on a spatiotemporal graph neural network, comprising:

[0024] An abnormal behavior identification module is used to identify abnormal behavior of a target learner according to the online learning abnormal behavior identification method based on spatiotemporal graph neural network as described in any of the above-mentioned first aspect schemes, and to obtain the identification result of whether the target learner has abnormal behavior.

[0025] The abnormal behavior attribution module is used to compare the relative contributions of structural dimension abnormal errors and attribute dimension abnormal errors of target learners exhibiting abnormal behavior: when structural dimension abnormal errors dominate, their attribution label is recorded as suspected academic collusion or group cheating; when attribute dimension abnormal errors dominate, their attribution label is recorded as suspected illegal proxy testing or script abnormality.

[0026] The report output module is used to encapsulate the identification information of target learners with abnormal behavior, their comprehensive abnormal scores, the time of occurrence of abnormal behavior, attribution tags, and related collaborating learner information, generate a structured academic integrity alert report, and push it to the academic affairs administrator terminal to provide quantitative evidence for manual review, teaching intervention, and academic integrity arbitration.

[0027] This invention relies on a spatiotemporal graph neural network framework to form a mechanism that combines feature decoupling and hierarchical dependency modeling, creating dynamic graph snapshots that clearly distinguish behavioral development paths from individual attribute features. Compared with existing technologies, this invention has the following advantages:

[0028] This invention creates an orthogonal decoupling coding module based on dual-stream orthogonal constraints. Given the high degree of heterogeneous information coupling in learning behavior, making effective separation difficult, this invention sets up a dual-channel mechanism in the input layer of the online learning abnormal behavior recognition model. This mechanism includes a structured stream input view focusing on social interactions and IP device sharing trajectories, and an attribute stream input view focusing on answer sequences and score distribution feature shifts. By applying orthogonality constraints, the model is prompted to acquire topological changes and attribute features from various dimensions, thereby ensuring that weak collaborative cheating signals, such as cross-regional covert synchronization operations, can avoid interference from obvious score abrupt changes or normal traffic fluctuations, achieving the goal of accurate detection.

[0029] This invention utilizes neural frequent differential equations to achieve fine-grained learning evolution perception, solving the problem that traditional discrete sampling struggles to capture irregular learning behaviors. This invention transforms the hierarchical propagation of online learning anomaly behavior recognition models from a stack of discrete snapshots into a continuous-time integral process, using neural frequent differential equations to fit the evolution trajectory of the learning state over time. This enables the model to infer arbitrary instantaneous states, accurately capture the true semantics inherent in non-uniform time intervals, and identify sudden anomalies that violate normal cognitive patterns.

[0030] To address the challenges of identifying cold starts and long-term cheating, this invention integrates a dynamic prototype memory network into the online learning abnormal behavior identification model. This network stores the prototype vectors of learners' past normal learning. The model employs a lookup-comparison strategy during judgment, effectively identifying long-term deviation patterns caused by proxy test-taking or automated scripts by comparing the current behavior with the learner's historical stable trajectory.

[0031] This invention transforms anomaly determination into a deviation metric of spatiotemporal learning trajectories. By calculating structural dimension deviation and attribute dimension deviation, the model not only provides a comprehensive anomaly score but also clearly shows whether the anomaly originates from spatial topological distortion or temporal attribute mutation, providing intuitive and quantitative evidence support for academic integrity arbitration.

[0032] Furthermore, online exams, a high-frequency interactive scenario, can lead to an imbalance between immediacy and accuracy. This invention employs a dynamic threshold calibration mechanism based on statistical distribution to address the issue of false alarms caused by fixed thresholds in online education scenarios. It dynamically adjusts the anomaly judgment threshold according to the real-time comprehensive anomaly score distribution. Even in the event of sudden educational hotspots or background noise interference, it can still maintain stable alarm support performance, thereby improving the model's stability when dealing with non-stationary educational environments. Attached Figure Description

[0033] Figure 1 This is a flowchart of the method of the present invention;

[0034] Figure 2 This is a framework diagram of the online learning abnormal behavior recognition model of the present invention;

[0035] Figure 3 A flowchart for generating calibration features according to the present invention;

[0036] Figure 4 This is a system block diagram of the present invention;

[0037] Figure 5 This is a schematic diagram of the components of a computer electronic device according to the present invention. Detailed Implementation

[0038] To make the above-mentioned objects, features, and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. Many specific details are set forth in the following description to provide a thorough understanding of the present invention. However, the present invention can be practiced in many other ways different from those described herein, and those skilled in the art can make similar modifications without departing from the spirit of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below. Technical features in the various embodiments of the present invention can be combined accordingly without mutual conflict.

[0039] In the description of this invention, it should be understood that the terms "first" and "second" are used only for descriptive purposes and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Therefore, a feature defined with "first" and "second" may explicitly or implicitly include at least one of those features.

[0040] like Figure 1 As shown, in a preferred embodiment of the present invention, the above-mentioned online learning abnormal behavior recognition method based on spatiotemporal graph neural network includes the following steps S1 to S2. The specific implementation process of each step will be described in detail below.

[0041] S1. Obtain the raw learning behavior data stream collected from the online learning platform and represent it as an interaction event sequence. Then, through an adaptive time window partitioning strategy based on the change of interaction density, convert the interaction event sequence into a dynamic graph snapshot sequence, and construct a corresponding structure flow input view and attribute flow input view for each graph snapshot in the graph snapshot sequence.

[0042] It should be noted that in step S1 of the present invention, the interaction event sequence consists of multiple interaction events, and each interaction event consists of an interaction initiation node, an interaction object node, a timestamp of an interaction behavior, and the interaction behavior characteristics carried by that interaction.

[0043] In this embodiment, the sequence of interactive events can be represented as follows: ,in, This represents an interactive event. This indicates the node that initiated the interaction, which is a learner. This represents an interactive object node, which is a question. This indicates the timestamp of the interaction that occurred. This represents the interactive behavioral characteristics carried by the interaction, including but not limited to information such as average response time, answer text, and text similarity statistics. Through this representation, the present invention can uniformly abstract the discrete log records in an online learning platform into a time-evolving sequence of interactive events.

[0044] It should be noted that in step S1 of this invention, to characterize the non-stationary dynamic characteristics of online learning behavior, this invention introduces an adaptive time window segmentation strategy based on changes in interaction density. Compared with the traditional equal-interval slicing method, this strategy can adaptively adjust the time window length according to the activity level of learning behavior at different stages, thereby better adapting to the complex scenario where high-frequency interactions during exam weeks coexist with low-frequency interactions in daily learning. For example, in an exam scenario, time windows can be segmented at the minute level; in a daily learning scenario, time windows can be segmented at the hour level.

[0045] Specifically, in step S1 of this invention, the process of converting the interaction event sequence into a graph snapshot sequence using an adaptive time window partitioning strategy is as follows: the time axis corresponding to the interaction event sequence is divided into non-overlapping parts to obtain multiple time windows of unequal length; for each time window, the interaction events within the time window are extracted from the interaction event sequence to form a subset of interaction events and a graph snapshot is constructed. The graph snapshot consists of four parts: the set of nodes participating in the interaction within the time window, the set of edges, the adjacency matrix of the graph snapshot, and the node feature matrix; after traversing each time window, a graph snapshot sequence is formed from all the graph snapshots.

[0046] In this embodiment, the first Taking a time window as an example, the subset of interactive events corresponding to that time window can be represented as follows: And construct a graph snapshot based on this. .in, Indicates the first The set of nodes that participate in the interaction within a time window, including The interaction initiation node and interaction object node are covered in the middle; This represents the set of edges formed by interactions between nodes; Snapshot of the diagram The adjacency matrix; This represents the node feature matrix.

[0047] The above adjacency matrix It is used not only to indicate whether a connection exists between two nodes, but also to characterize the overall interaction strength between nodes within the current time window. Specifically, the elements in the adjacency matrix... Represents a node With nodes In the The degree of correlation within a time window, i.e., the nodes With nodes The boundary weights between them. This degree of association not only reflects whether the two have interacted, but also further considers the frequency of interactions and the similarity or suspiciousness of the interaction content. Therefore, The larger the value of , the stronger the node. With nodes The more frequent the interactions and the closer the relationships within this time window, the more attention should be paid to them in subsequent anomaly detection.

[0048] Furthermore, in the actual configuration of step S1 of the present invention, the elements in the adjacency matrix It is composed of two weighted sums, the first part being the nodes. With nodes In the Number of interactions within a time window The second part is the nodes. With nodes In the Similarity measurement of interactive content when interacting within a time window , can be represented as:

[0049]

[0050] in, and These represent the weight coefficients corresponding to different influencing factors. Interactions between two nodes can occur between the two initiating nodes (learners), such as in a discussion between two learners, or between the initiating node and the interacting node, such as when a learner answers a question. Through this method, information reflecting frequency and similarity features in the sequence of interaction events can be uniformly mapped to edge weight information in a graph structure, thereby achieving a quantitative expression of the strength of interactions between nodes.

[0051] Furthermore, in step S1 of this invention, the node feature matrix is ​​obtained as follows: for any node First, start with the first A subset of interactive events within a time window Get the set of interactive events participated in within the time window. Then, statistical aggregation is performed on all interactive behavior features contained in the set of interactive events to form the feature vector corresponding to that node. , used to characterize the node in the , The overall behavioral state within each time window; finally, the feature vectors corresponding to all nodes are stacked in node order to form a node feature matrix. ,in, All are feature vectors of nodes; For a set of nodes The number of nodes in; Indicates transpose; This represents the language's built-in statistical aggregation functions used to perform statistical aggregation on nodes at the 1st rank. The features of all interactive behaviors participated in within a time window are aggregated, and the aggregation results include, but are not limited to, average answering time, text similarity statistics, and interaction frequency.

[0052] In this embodiment, the node feature matrix mainly describes the behavioral attributes of the node itself, while the adjacency matrix mainly describes the strength of the relationship between nodes. Together, they constitute the basic representation of the graph snapshot.

[0053] Through the above steps, a sequence of graph snapshots can be constructed from the original learning behavior data stream. , The length of the image snapshot sequence. Each graph snapshot represents a graph snapshot. However, the relation strength information and node behavior attribute information in the graph snapshots differ significantly semantically. Considering that in online learning scenarios, significant individual attributes such as high scores and stable responses can mask subtle structural anomalies such as answer synchronization and abnormal collaboration, this invention does not directly mix the adjacency matrix and node attributes into a unified encoder. Instead, it constructs a structure stream input view and an attribute stream input view for each graph snapshot, thereby highlighting the different manifestations of structural and attribute anomaly signals in abnormal behaviors during online learning and providing an input basis for subsequent two-stream orthogonal decoupling encoding.

[0054] Furthermore, in step S1 of the present invention, for each graph snapshot, the structure flow input view of the graph snapshot is constituted by the set of nodes of the graph snapshot and its adjacency matrix. The attribute stream input view of the graph snapshot is composed of the set of nodes in the graph snapshot and the node feature matrix of the graph snapshot. .

[0055] Through the aforementioned dual-stream input view construction process, this invention obtains a structure stream input view reflecting the strength of node relationships and an attribute stream input view reflecting the behavioral state of nodes within each time window. The structure stream input view describes the interaction structure and strength between nodes within the current time window. This view primarily reflects the interaction between learners and questions, and between learners themselves, and can be used to capture abnormal patterns with group-related characteristics, such as collaborative answering and synchronous submission. The attribute stream input view describes the behavioral state and attribute characteristics of nodes within the current time window. This view primarily reflects the node's corresponding answering time, text similarity statistics, interaction frequency, and other behavioral attributes, and can be used to capture individual-level abnormal patterns such as abnormal answering rhythm, behavioral mutations, and long-term performance deviations. Based on this, an orthogonal decoupling encoding module for learning behavioral structure and attributes is further used to independently learn representations of the two types of inputs to obtain the latent structural and attribute representations of the nodes.

[0056] S2. Deploy the trained online learning abnormal behavior recognition model to the real-time monitoring module of the online learning platform or the academic affairs review backend to continuously detect and provide abnormal warnings for learning behaviors on the platform;

[0057] In the online learning abnormal behavior recognition model: First, an orthogonal decoupled encoding module for learning behavioral structure and attributes is used to independently learn representations of the structure flow input view and the attribute flow input view, obtaining the joint latent representation of each node in each graph snapshot; then, each time window is mapped to a representative moment, and the joint latent representation of the node is used as the learning state of the node at that representative moment, and input into a spatiotemporal modeling module based on neural differential equations and evolutionary memory, through neural differential equations (Neural... ODEs predict the behavioral evolution trend of learners in the continuous time domain, obtain the expected learning state at the next representative time, and perform weighted fusion with calibration features retrieved by the dynamic prototype memory network to obtain the final predicted representation. Finally, in the adaptive result attribution module, the joint latent representation at the next representative time is used as the true observation representation, and the comprehensive anomaly score of the node is calculated based on the final predicted representation and the true observation representation and loaded into the time window. Combining the statistical distribution of the comprehensive anomaly score within the time window, the anomaly judgment threshold is adaptively calculated. When the comprehensive anomaly score is greater than the anomaly judgment threshold, the learner represented by the node is considered to have abnormal behavior and the learner is marked as a high-risk object; when the comprehensive anomaly score is less than or equal to the anomaly judgment threshold, the learner represented by the node is considered not to have abnormal behavior.

[0058] It should be noted that in step S2, as Figure 2 As shown, this invention proposes an online learning anomaly behavior recognition model, aiming to resolve the dilemma of distinguishing between normal learning collaboration and covert violations in large-scale online learning platforms. The model comprises three main modules: an orthogonal decoupling encoding module, a spatiotemporal modeling module, and an adaptive result attribution module. First, the model performs orthogonal decoupling processing on the structural evolution and attribute fluctuations of dynamic graph snapshots. Orthogonal constraint operators are used to ensure that the model can independently acquire the group social characteristics and individual cognitive characteristics of learners. Addressing the non-uniform distribution of learning behavior over time, the model uses neural frequent differential equations to fit the learning development path of nodes in the continuous time domain. This design overcomes the limitations of traditional discrete snapshots, enabling the model to detect behavioral deviations within a very short period. A dynamic prototype memory network is used to retrieve historical normal learning pattern prototypes. By calculating the distance between the current behavior and the credible behavior prototype, the model's ability to identify long-term and covert cheating patterns is improved. These modules are closely interconnected. Through this deep interconnection, the model can detect abnormal behavior among learners at the spatial level and perceive changes in learning development trajectories on the temporal axis. This achieves highly accurate detection of learning biases and provides a clear basis for subsequent assessment of academic misconduct.

[0059] The following sections will provide a detailed introduction to each module in the online learning abnormal behavior recognition model.

[0060] It should be noted that, in step S2 of this invention, the specific processing flow in the orthogonal decoupling encoding module is as follows: For the structure flow input view, the adjacency matrix and the node feature matrix are input into the structure flow encoder. By encoding the topological relationships between nodes, the structural latent representation of the learner in the teaching topological space is extracted, and the structural latent representation matrix of all nodes in each graph snapshot is obtained. For the attribute flow input view, the attribute encoder is used to map the node feature matrix, and the attribute latent representation of the learner in the individual behavior space is extracted, and the attribute latent representation matrix of all nodes in each graph snapshot is obtained. Finally, the two latent representation matrices are concatenated to obtain the joint latent representation of each node in each graph snapshot, forming the joint latent representation matrix of the nodes.

[0061] In this embodiment, for the structured flow input view, the adjacency matrix and node feature matrix are input into the graph convolutional network, and the neighborhood aggregation operation is used to obtain the first... The structural latent representation matrix of all nodes in a graph snapshot :

[0062]

[0063] in, This represents the dimension of the structural latent representation matrix. This matrix primarily reflects the connection patterns, relative positions, and group interaction characteristics of nodes within the current graph topology, and can be used to characterize abnormal group behaviors such as collaborative responses and synchronous submissions. Furthermore, for any node... Its corresponding structural latent representation is denoted as .

[0064] For the attribute stream input view, a multilayer perceptron or a denoising autoencoder network, or similar structure, is used as the attribute encoder to obtain the first... The latent representation matrix of attributes of all nodes in a graph snapshot :

[0065]

[0066] in, Indicates an attribute encoder; This represents the dimension of the latent attribute representation matrix. This matrix primarily reflects a node's behavioral state, response rhythm, and performance deviation within the current time window. It can be used to characterize individual abnormal behaviors such as abnormal response duration, sudden behavioral changes, and long-term deviations from the learning state. Furthermore, for any node... The corresponding attribute latent representation is denoted as .

[0067] After completing the two-stream encoding, this invention further concatenates the structural latent representation matrix and the attribute latent representation matrix to obtain the node at the _th ... Joint latent representation matrix within each time window :

[0068]

[0069] Furthermore, for any node Its joint potential representation is denoted as:

[0070]

[0071] in, This indicates a vector concatenation operation.

[0072] It should be noted that, in step S2 of this invention, after obtaining the joint latent representation of the nodes, this invention further constructs a spatiotemporal modeling module based on neural differential equations and evolutionary memory. Specifically, this invention will... Each time window is mapped to a representative moment. and the nodes obtained from the aforementioned process The joint potential representation considers the node's learning state at that representative time. Considering that online learning behavior exhibits characteristics of non-uniform sampling, sudden changes, and long-term evolution over time, this invention employs neural ordinary differential equations to model the evolution of node learning states in the continuous time domain, expressed as follows:

[0073]

[0074] in, The parameterized nonlinear evolution function is implemented by a deep neural network; This represents the learnable parameters of the evolution function; For nodes At any moment The learning status on; To The differential; For time The differential.

[0075] At a given node At the representative moment After the learning state is established, the above differential equation is solved using a numerical integrator to obtain the node at the next representative time. Expected learning state :

[0076]

[0077] In practical implementation, the fourth-order Runge-Kutta method can be used to approximate the solution of this integral process. Subsequently, to enhance the model's ability to represent long-term normal learning patterns, this invention utilizes a dynamic prototype memory network to retrieve prototype information from historical normal learning patterns that most closely matches the current expected learning state. This involves retrieving calibration features and using these features to calibrate the expected learning state, thereby forming the learner's final predicted representation for the next representative time step.

[0078] Specifically, in the dynamic prototype memory network, the specific processing flow is as follows: First, a set of prototype vectors representing normal learning behavior is maintained. These prototype vectors are obtained by clustering the joint latent representations of nodes exhibiting normal learning behavior. These nodes are learners who were not identified as having abnormal learning behavior during the training phase. Then, an attention retrieval mechanism is used to calculate the correlation score between the expected learning state and each prototype vector, and... The relevance scores are normalized to obtain the attention weights of the nodes to each prototype vector. Then, the prototype vectors are weighted and summed according to the attention weights to generate the calibration features of the nodes at the next representative time.

[0079] In this embodiment, there are a total of Let there be a prototype vector, denoted as . , For the first One prototype vector, , The feature dimensions are consistent with the joint latent representation. These prototype vectors can be extracted from the joint latent representation set of historical normal learning behavior nodes, and several cluster centers are obtained using clustering methods as initial prototype vectors. During model training, the prototype vectors are dynamically updated in conjunction with the current batch of normal learning behavior nodes, so that they continuously represent the typical patterns of normal learning behavior at different stages.

[0080] like Figure 3 As shown, for node At the next representative moment To determine the expected learning state, this invention calculates the correlation score between the target vector and each prototype vector using an attention retrieval mechanism:

[0081]

[0082] in, Represents a node The expected learning state and the first Correlation score between prototype vectors; This represents the smoothing coefficient, used to adjust the sharpness of the attention distribution; This represents the cosine similarity calculation function. After obtaining the relevance scores corresponding to each prototype, this embodiment further... Normalization yields nodes Attention weights for each prototype vector:

[0083]

[0084] in, Represents a node For the Attention weights for each prototype vector; This indicates a node. The expected learning state and the first The correlation score between the prototype vectors.

[0085] Finally, the prototype vectors are weighted and summed according to the attention weights to generate nodes. At the next representative moment calibration features :

[0086]

[0087] This calibration feature can be understood as a weighted combination of historical normal learning representations that are closest to the current predicted state, used to reflect the stable behavior patterns that nodes are more likely to exhibit under normal learning trajectories.

[0088] Based on this, in order to simultaneously preserve the continuous evolution trend of nodes within the current time period and information on long-term normal learning patterns, this invention performs a weighted fusion of the expected learning state predicted by the neural ordinary differential equation and the calibration features retrieved from the memory network to obtain the final predicted representation. It includes both time-series prediction information derived continuously from the current state and stable behavior reference information calibrated through historical normal prototypes. The weighted fusion process can be represented as:

[0089]

[0090] in, This represents the fusion weighting coefficient, used to balance the contributions between short-term continuous evolutionary trends and long-term normal learning prototypes.

[0091] After obtaining the final predicted representation, the present invention will combine the potential representation. As a node At the next representative moment True observations The results are compared with the aforementioned final prediction, and the structural dimension deviation and attribute dimension deviation are calculated respectively, thereby obtaining the comprehensive anomaly score of the node.

[0092] Specifically, since the aforementioned orthogonal decoupling coding module has decomposed the node representation into a structural latent representation and an attribute latent representation, this invention further utilizes this decoupling characteristic to perform multidimensional judgment and attribution analysis on node anomalies. For any node Its actual observation indicates It can be regarded as a representation of the actual structure observation. Compared with the observation of true attributes The resulting structure is formed by piecing together elements; correspondingly, the final predicted representation of this node is... It can also be viewed as a representation of the predictive structure. With predictive attribute representation Formed by splicing. To characterize the degree of deviation of nodes from interactive topological relationships, this invention defines nodes... At any moment The structural dimension anomaly error is the Euclidean distance between the observed true structural representation and the predicted structural representation, i.e. The larger the error, the more significant the deviation between the interaction pattern of nodes within the current time window and their historical continuous evolution trend, indicating a greater likelihood of group-related abnormal behaviors such as collaborative responses and synchronous submissions. To characterize the degree of deviation of nodes in their individual behavioral states, this invention defines nodes... At any moment The attribute dimension anomaly error is the Euclidean distance between the true attribute observation representation and the predicted attribute representation, i.e.: The larger the error, the more significant the deviation between the node's behavior attributes within the current time window and its predicted normal learning state. This means that there is a greater likelihood of individual behavioral anomalies such as sudden changes in answering rhythm, abnormal pauses, script-based AFK, illegal proxy testing, or abnormal account use.

[0093] After obtaining the structural dimension anomaly error and the attribute dimension anomaly error respectively, this invention uses a weighted summation method to calculate the node error. At the next representative moment Overall abnormality score:

[0094]

[0095] in, and Let represent the weight coefficients corresponding to the structural dimension anomaly error and the attribute dimension anomaly error, respectively, and satisfy the following:

[0096]

[0097] The above comprehensive abnormal score Used to measure nodes The overall deviation from its normal learning and evolutionary trajectory within the current time window. A higher overall anomaly score indicates a more significant deviation between the learner's current actual behavior and the state predicted by the model based on normal evolutionary patterns, thus suggesting a higher probability of abnormal behavior at that node in the current time period.

[0098] Through the aforementioned continuous-time evolution prediction, dynamic prototype retrieval, and state fusion process, the final predicted representation of a node at the next representative time can be obtained. This prediction, combined with the actual observation representation at that time, allows for fine-grained decomposition of node anomaly deviations, thereby achieving multi-dimensional anomaly detection and attribution output. Considering the concept drift phenomenon in online learning platforms, such as a significant increase in overall activity during exam weeks or changes in the collective answering rhythm during specific course phases, using a fixed threshold for anomaly detection can easily lead to false positives or false negatives. Therefore, this invention introduces a dynamic threshold calibration mechanism in the adaptive result attribution module. Specifically, the calculated comprehensive anomaly score is first loaded into a time window, and the mean of the comprehensive anomaly score distribution of all nodes within that time window is calculated. with standard deviation The calculated mean and standard deviation are weighted and summed to serve as the anomaly detection threshold for that time window. :

[0099]

[0100] in, This represents the risk coefficient, used to adjust the model's sensitivity to abnormal behavior. For any node... If its comprehensive abnormal score meets If the condition is met, it is considered that the node has not shown significant abnormalities within the time window, and subsequent interaction behavior will continue to be monitored; if the condition is met... If so, it is determined that the node has an abnormal risk within that time window.

[0101] Additionally, it should be noted that in the training of the online learning abnormal behavior recognition model, in order to enable the constructed model to accurately learn the spatiotemporal evolution patterns of normal learning behavior and improve its ability to distinguish abnormal behavior, this invention uses historical learning behavior data streams for end-to-end training. The training data comes from existing historical learning behavior logs, exercise answer records, and exam interaction records within the platform.

[0102] The total loss function used in training the online learning abnormal behavior recognition model is obtained by weighted summation of prediction loss, orthogonal decoupling loss, and memory prototype constraint loss; wherein, the prediction loss is the mean square error between the final predicted representation and the true observed representation; and the memory prototype constraint loss is the mean square error between the joint latent representation of a node and the prototype vector that is closest to the joint latent representation.

[0103] In this embodiment, in order to constrain the evolution of the model's normal learning behavior in the continuous time domain, the present invention defines a prediction loss. The mean square error between the final predicted representation and the actual observed representation is expressed as:

[0104]

[0105] in, This represents the set of nodes participating in the computation in the current training batch. Represents a set of nodes The number of nodes in; The square of the L2 norm. This predictive loss is used to encourage the model to learn normal nodes from... arrive The stable evolution pattern makes the abnormal nodes more prominent in prediction bias.

[0106] In this embodiment, to ensure that the structural latent representation and the attribute latent representation are as semantically independent as possible, and to reduce the masking effect of significant individual attributes on weak structural anomalies, this invention introduces orthogonal decoupling loss during training. For the ... Each time window, its orthogonal constraint loss Defined as:

[0107]

[0108] in, Indicates the first The structural latent representation matrix of all nodes within a time window This represents the corresponding latent representation matrix of attributes. Denotes the Frobenius norm; This indicates transpose. To accommodate the training process with multiple time windows, this invention extends the orthogonal constraint loss to an orthogonal decoupling loss:

[0109]

[0110] This orthogonal decoupling loss minimizes the correlation between the structural latent representation and the attribute latent representation, thereby enabling the two types of representations to carry relational information and behavioral information, respectively.

[0111] In this embodiment, to ensure that the prototype vectors in the dynamic prototype memory network can stably represent historical normal learning patterns, the present invention further introduces a memory prototype constraint loss. For nodes At any moment The joint potential representation is given by the present invention, whereby the prototype vector closest to this joint potential representation is denoted as... Then the memory prototype constraint loss can be defined as:

[0112]

[0113]

[0114] in, The index of the prototype vector most similar to the joint latent representation of the node; Indicates that returning makes The largest prototype vector index. The above loss is used to constrain the joint latent representation corresponding to normal learning behavior to be as close as possible to the center of its corresponding prototype vector, so that the prototype vectors can more compactly and stably represent the normal learning pattern, providing a reliable foundation for subsequent prototype retrieval and state calibration.

[0115] To achieve joint optimization of the spatiotemporal evolution of learning behavior, the decoupling of structure-attribute semantics, and the memory of normal learning prototypes, this invention constructs the following total loss function:

[0116]

[0117] in, and To balance the contributions of different loss terms, hyperparameters are used to control the weights of orthogonal decoupling loss and memory prototype constraint loss in the total loss function. By minimizing the joint loss function, the model can simultaneously learn the normal evolution of nodes in the continuous time domain, the semantic separation relationship between structural and attribute representations, and the prototype distribution characteristics of historical normal learning behaviors.

[0118] For model optimization during training, this invention first initializes the parameters of the structured flow encoder, the attribute flow encoder, the evolution function parameters of the neural differential equation, and the prototype vectors in the dynamic prototype memory network. For the continuous-time evolution part, a time-based backpropagation method is used for gradient solving, and the adjoint state method is used for gradient backpropagation in the neural differential equation to reduce memory consumption during long-sequence training. Subsequently, the Adam optimizer is used to iteratively update all learnable parameters of the model. In each training round, the dynamic graph snapshot sequence obtained by dividing the historical interaction log is fed into the model in chronological order to sequentially complete the two-stream orthogonal decoupling encoding, continuous-time evolution prediction, prototype retrieval and calibration, and anomaly bias calculation, and the model parameters are updated according to the total loss function. The above process is repeated until the loss function converges or the preset number of training rounds is reached, resulting in a trained model that can be used for online learning of abnormal behavior recognition.

[0119] The present invention will now demonstrate the application effect of the online learning abnormal behavior recognition method based on spatiotemporal graph neural network described in S1~S2 of the above embodiments on a specific dataset through a specific example, so as to facilitate understanding of the essence of the present invention.

[0120] Example

[0121] The specific implementation process of the online learning abnormal behavior recognition method based on spatiotemporal graph neural network used in this embodiment is as described above and will not be repeated here.

[0122] To verify the technical achievements of the method of this invention in a real educational environment, this embodiment relies on the operational data of an online learning management system to create a dynamic graph snapshot dataset for academic integrity detection. This dataset contains the learning interactions of many core courses in a semester. In the dynamic graph snapshot, nodes cover the student, teaching videos, online quizzes, courseware materials, and the terminal device used for login; it displays the student's interactions with resources, between students and devices, and among students, and includes specific time stamps, such as answer submission, material search, delayed forum communication, real-time synchronous collaboration, and sharing of multiple accounts and devices.

[0123] To simulate real academic misconduct, the dataset was annotated by experts and associated with typical behavioral characteristics, thus containing many hidden abnormal patterns: First, group collaboration and synchronized answers are characteristics of academic collusion; second, sudden changes in the pace of answering questions and interruptions in cognitive trajectory are characteristics of illegal proxy exams or ghostwriting; third, high-frequency repetition and non-human logical interaction are characteristics of automated course-completion scripts.

[0124] In the field of anomaly detection, AUC (Area Under Curve) is a commonly used evaluation metric. The closer the AUC value is to 1, the higher the accuracy of the model in identifying violations in online learning. This invention compares the proposed method with currently popular dynamic graph detection algorithms on the self-made dataset mentioned above, and the results are shown in Table 1.

[0125] Table 1. Performance Comparison of Different Methods

[0126] Experimental results show that the method of the present invention has a significant improvement in performance compared with the benchmark method in real learning scenarios. This is mainly because after adopting the neural constant differential equation, the model can fit the very irregular time change trend of students during learning, which effectively solves the problem of the interruption of behavioral logic caused by traditional equal interval sampling. In this way, it can accurately grasp the almost microsecond-level collaborative anomalies during the exam.

[0127] To further explore the contribution of each innovative module of the present invention to the final performance, an ablation study was conducted in this embodiment, and the experimental results are shown in Table 2.

[0128] Table 2. Ablation Experiment Results of the Innovative Module

[0129] The orthogonal decoupling coding module has the following positive effects: after applying orthogonality constraints, the model becomes more stable and reliable in identifying hidden anomalies. This shows that the module can effectively obtain the abnormal connection signals hidden behind high-scoring data. Even if some members perform well, if there is potential group cooperation fraud, it can be accurately identified.

[0130] The spatiotemporal modeling module has the following positive effects: by relying on decoupling, continuous time extrapolation and historical prototype vector retrieval, the recognition accuracy is further optimized. This module can effectively identify instantaneous quiz behaviors that contradict the learner's long-term stable profile by using continuous trajectory fitting.

[0131] When performing actual tests on a self-made dataset, this invention can automatically generate a quantitative attribution report based on the contribution ratio of structural dimension anomalies to attribute dimension anomalies, breaking through the limitation of deep learning as a black box. Once it detects that a group of students exhibits a dominance of structural dimension anomalies, this invention will consider it as potential academic collusion and attribute it accordingly. Analysis shows that such anomalies often involve numerous accounts with geographically dispersed distributions, but with highly overlapping spatiotemporal logic in answering questions. When this invention's method identifies attribute dimension anomalies as significantly larger than structural dimension anomalies, it will issue an alert for individual behavioral anomalies. Analysis indicates that this anomaly manifests as abnormal changes in answering speed and mastery of knowledge points within a short period, significantly deviating from the student's previous learning path.

[0132] In summary, the method of this invention treats anomaly detection as a quantitative evaluation problem of learners deviating from their own development path within the teaching timeline and knowledge logic system. In specific implementation, it first processes irregular sampling sequences of data, efficiently obtaining the temporal properties of operational changes within a time slice. Based on this, the invention further identifies individual behavioral characteristics and group interaction patterns to suppress the mutual influence between features. In the detection stage, a visualized, structured academic integrity alert report is automatically generated. This report covers important information such as key time nodes, relevant nodes, and deviation measurement values. Leveraging the spatiotemporal modeling methods and interpretable output mechanism mentioned above, this invention not only optimizes the accuracy of anomaly detection but also enhances the objectivity and credibility of the judgment criteria, providing a feasible technical approach to safeguarding academic integrity in the educational environment.

[0133] It should also be noted that the online learning abnormal behavior recognition method based on spatiotemporal graph neural networks in the above embodiments can essentially be executed by a computer program or module. Therefore, similarly, based on the same inventive concept, another preferred embodiment of the present invention also provides an online learning abnormal behavior recognition system based on spatiotemporal graph neural networks, corresponding to the online learning abnormal behavior recognition method based on spatiotemporal graph neural networks provided in the above embodiments, such as... Figure 4 As shown, it includes:

[0134] The abnormal behavior identification module is used to identify abnormal behavior of the target learner according to the online learning abnormal behavior identification method based on spatiotemporal graph neural network as described in the above embodiments, and to obtain the identification result of whether the target learner has abnormal behavior.

[0135] The abnormal behavior attribution module is used to compare the relative contributions of structural dimension abnormal errors and attribute dimension abnormal errors of target learners exhibiting abnormal behavior: when structural dimension abnormal errors dominate, their attribution label is recorded as suspected academic collusion or group cheating; when attribute dimension abnormal errors dominate, their attribution label is recorded as suspected illegal proxy testing or script abnormality.

[0136] The report output module is used to encapsulate the identification information of the target learner with abnormal behavior, their comprehensive abnormal score, the time of occurrence of the abnormal behavior, the attribution label, and related collaborator information, generate a structured academic integrity alert report, and push it to the academic affairs administrator terminal.

[0137] It is understood that the online learning abnormal behavior recognition method based on spatiotemporal graph neural networks described in S1-S2 above can essentially be implemented by a computer program. Therefore, based on the same inventive concept, another preferred embodiment of the present invention also provides a computer program product corresponding to the online learning abnormal behavior recognition method based on spatiotemporal graph neural networks provided in the above embodiments. This product includes a computer program / instruction, which, when executed by a processor, can implement the online learning abnormal behavior recognition method based on spatiotemporal graph neural networks as described in the above embodiments.

[0138] Similarly, based on the same inventive concept, another preferred embodiment of the present invention also provides a computer electronic device corresponding to the online learning abnormal behavior recognition method based on spatiotemporal graph neural networks provided in the above embodiments, such as... Figure 5 As shown, it includes a memory and a processor;

[0139] The memory is used to store computer programs;

[0140] The processor is configured to implement the online learning abnormal behavior recognition method based on spatiotemporal graph neural network in the above embodiments when executing the computer program.

[0141] Furthermore, the logical instructions in the aforementioned memory can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention.

[0142] Therefore, based on the same inventive concept, another preferred embodiment of the present invention also provides a computer-readable storage medium corresponding to the online learning abnormal behavior recognition method based on spatiotemporal graph neural network provided in the above embodiments. The storage medium stores a computer program, which, when executed by a processor, can realize the online learning abnormal behavior recognition method based on spatiotemporal graph neural network in the above embodiments.

[0143] Specifically, in the computer-readable storage medium of the above three embodiments, the stored computer program is executed by a processor, which can perform the aforementioned steps S1 to S2.

[0144] It is understood that the aforementioned storage media may include random access memory (RAM) or non-volatile memory (NVM), such as at least one disk storage device. Furthermore, the storage media may also be various media capable of storing program code, such as USB flash drives, external hard drives, magnetic disks, or optical discs.

[0145] It is understood that the processors mentioned above can be general-purpose processors, including central processing units (CPUs), network processors (NPs), etc.; they can also be digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0146] It should also be noted that those skilled in the art will understand that, for the sake of convenience and brevity, the specific working process of the system described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here. In the embodiments provided in this application, the division of steps or modules in the system and method is merely a logical functional division, and there may be other division methods in actual implementation. For example, multiple modules or steps may be combined or integrated together, and a module or step may also be split.

[0147] The embodiments described above are merely preferred embodiments of the present invention and are not intended to limit the invention. Those skilled in the art can make various changes and modifications without departing from the spirit and scope of the invention. Therefore, all technical solutions obtained through equivalent substitution or transformation fall within the protection scope of the present invention.

Claims

1. An online learning-based abnormal behavior recognition method based on spatiotemporal graph neural networks, characterized in that, Includes the following steps: S1. Obtain the raw learning behavior data stream collected from the online learning platform and represent it as an interaction event sequence. Then, through an adaptive time window partitioning strategy, convert the interaction event sequence into a dynamic graph snapshot sequence and construct a corresponding structure flow input view and attribute flow input view for each graph snapshot in the graph snapshot sequence. S2. Deploy the trained online learning abnormal behavior recognition model to the online learning platform to continuously detect and provide early warnings of abnormal learning behaviors on the platform; In the online learning abnormal behavior recognition model: An orthogonal decoupled coding module performs independent representation learning on the structure flow input view and attribute flow input view, obtaining the joint latent representation of each node in each graph snapshot. Each time window is mapped to a representative moment, and the joint latent representation of the node is used as the learning state of the node at that representative moment and input into the spatiotemporal modeling module. A neural constant differential equation is used to predict the learner's behavioral evolution trend in the continuous time domain, obtaining the expected learning state for the next representative moment. This state is then weighted and fused with calibration features retrieved by the dynamic prototype memory network to obtain the final predicted representation. In the adaptive result attribution module, the joint latent representation of the next representative moment is used as the true observation representation. Based on the final predicted representation and the true observation representation, the node's comprehensive abnormality score is calculated and loaded into the time window. Combining the statistical distribution of the comprehensive abnormality score within the time window, if the comprehensive abnormality score is greater than the adaptively calculated abnormality judgment threshold, the learner represented by that node is considered to have abnormal behavior and is marked as a high-risk object; otherwise, the learner represented by that node is considered not to have abnormal behavior.

2. The online learning anomaly behavior recognition method based on the spatio-temporal graph neural network according to claim 1, wherein, In S1, the sequence of interactive events consists of multiple interactive events. Each interactive event consists of an interactive initiating node, an interactive object node, a timestamp of an interactive behavior, and the interactive behavior characteristics carried by that interaction. The specific process of converting an interaction event sequence into a graph snapshot sequence using an adaptive time window partitioning strategy is as follows: the time axis corresponding to the interaction event sequence is divided into non-overlapping parts to obtain multiple time windows of unequal length; for each time window, the interaction events within that time window are extracted from the interaction event sequence to form a subset of interaction events and a graph snapshot is constructed. This graph snapshot consists of four parts: the set of nodes participating in the interaction within that time window, the set of edges, the adjacency matrix of the graph snapshot, and the node feature matrix; after traversing each time window, a graph snapshot sequence is formed from all the graph snapshots.

3. The online learning abnormal behavior recognition method based on spatiotemporal graph neural networks as described in claim 2, characterized in that, Elements in the adjacency matrix Represents a node With nodes In the The degree of correlation within a time window is calculated by a weighted sum of two parts: the first part being the nodes. With nodes In the The number of interactions within a time window, the second part is the node. With nodes In the A measure of the similarity of interactive content when interacting within a time window; The node feature matrix is ​​obtained as follows: For any node, first start from the first... The set of interactive events participated in within a time window is obtained from the subset of interactive events in that time window; then, the features of all interactive behaviors contained in the set of interactive events are statistically aggregated to form the feature vector corresponding to that node, which is used to characterize that node in the first time window. The overall behavior state within a time window; finally, the feature vectors corresponding to all nodes are stacked in node order to form a node feature matrix.

4. The online learning anomaly behavior recognition method based on the spatio-temporal graph neural network according to claim 2, wherein, In S1, for each graph snapshot, the structure flow input view of the graph snapshot is composed of the set of nodes in the graph snapshot and its adjacency matrix, and the attribute flow input view of the graph snapshot is composed of the set of nodes in the graph snapshot and the node feature matrix of the graph snapshot.

5. The online learning anomaly behavior recognition method based on the spatio-temporal graph neural network according to claim 2, wherein, In S2, the specific processing flow in the orthogonal decoupling encoding module is as follows: For the structure flow input view, the adjacency matrix and node feature matrix are input into the structure flow encoder. By encoding the topological relationships between nodes, the structural latent representation of the learner in the teaching topological space is extracted, and the structural latent representation matrix of all nodes in each graph snapshot is obtained. For the attribute flow input view, the attribute encoder is used to map the node feature matrix, extract the attribute latent representation of the learner in the individual behavior space, and obtain the attribute latent representation matrix of all nodes in each graph snapshot. Finally, the two latent representation matrices are concatenated to obtain the joint latent representation of each node in each graph snapshot, forming the joint latent representation matrix of the nodes.

6. The online learning anomaly behavior recognition method based on the spatio-temporal graph neural network according to claim 1, wherein, In S2, the specific processing flow in the dynamic prototype memory network is as follows: First, maintain a set of prototype vectors representing normal learning behavior. The prototype vectors are obtained by clustering the joint latent representation of nodes with normal learning behavior. Nodes with normal learning behavior are learners who were not identified as having abnormal learning behavior during the training phase. Then, calculate the correlation score between the expected learning state and each prototype vector through the attention retrieval mechanism, and normalize the correlation score through softmax to obtain the attention weight of the node to each prototype vector. Then, perform a weighted summation of each prototype vector according to the attention weight to generate the calibration feature of the node at the next representative time step.

7. The online learning anomaly behavior recognition method based on the spatio-temporal graph neural network according to claim 1, wherein, In S2, for any node, its true observation representation is considered as the concatenation of the true structure observation representation and the true attribute observation representation. Correspondingly, the final predicted representation of the node is considered as the concatenation of the predicted structure representation and the predicted attribute representation. Then, the structural dimension anomaly error of the node at the next representative time is the Euclidean distance between the true structure observation representation and the predicted structure representation, and the attribute dimension anomaly error of the node at the next representative time is the Euclidean distance between the true attribute observation representation and the predicted attribute representation. By weighted summing of the two dimension anomaly errors, the comprehensive anomaly score of the node at the next representative time is calculated.

8. The online learning abnormal behavior recognition method based on spatiotemporal graph neural network as described in claim 1, characterized in that, In S2, the method for calculating the anomaly judgment threshold is as follows: First, the calculated comprehensive anomaly score is loaded into the time window. The mean and standard deviation of the comprehensive anomaly score distribution of all nodes within the time window are calculated. The calculated mean and standard deviation are weighted and summed to serve as the anomaly judgment threshold for the time window.

9. The online learning anomaly behavior recognition method based on the spatio-temporal graph neural network according to claim 1, wherein, In S2, the total loss function used during the training of the online learning abnormal behavior recognition model is obtained by weighted summation of prediction loss, orthogonal decoupling loss, and memory prototype constraint loss; wherein, the prediction loss is the mean square error between the final predicted representation and the true observed representation; and the memory prototype constraint loss is the mean square error between the joint latent representation of a node and the prototype vector that is closest to the joint latent representation.

10. A spatio-temporal graph neural network based online learning abnormal behavior recognition method system, characterized in that, include: An abnormal behavior identification module is used to identify abnormal behavior of a target learner according to the online learning abnormal behavior identification method based on spatiotemporal graph neural network as described in any one of claims 1 to 9, and to obtain the identification result of whether the target learner has abnormal behavior. The abnormal behavior attribution module is used to compare the relative contributions of structural dimension abnormal errors and attribute dimension abnormal errors of target learners exhibiting abnormal behavior: when structural dimension abnormal errors dominate, their attribution label is recorded as suspected academic collusion or group cheating; when attribute dimension abnormal errors dominate, their attribution label is recorded as suspected illegal proxy testing or script abnormality. The report output module is used to encapsulate the identification information of the target learner with abnormal behavior, their comprehensive abnormal score, the time of occurrence of the abnormal behavior, the attribution label, and related collaborator information, generate a structured academic integrity alert report, and push it to the academic affairs administrator terminal.

Images