A leave system based on face recognition

Abstract

The application relates to the technical field of identity authentication and anomaly detection, and discloses a leave system based on face recognition, which performs the following steps: obtaining leave application data and department historical environment data; performing face living body detection and feature matching to obtain a face matching degree score; extracting environment fingerprint feature vectors corresponding to leave applications of all employees in a department; calculating cross-employee environment fingerprint similarity, generating an environment correlation graph, and identifying a suspicious employee subgroup; calculating fusion anomaly features of each employee subgroup; performing comprehensive fraud evaluation and grading processing on the leave application.

Description

Technical Field

[0001] This invention relates to the field of identity authentication and anomaly detection technology, and more specifically, to a leave application system based on facial recognition. Background Technology

[0002] In the facial recognition-based leave application method, when an employee initiates a leave request through a terminal, the system collects a real-time facial image frame sequence from the terminal's camera, performs liveness detection and facial feature matching, and simultaneously collects environmental context factors such as GPS coordinates, Wi-Fi access point identifiers, and network IP addresses. Each environmental factor is independently compared with the company's office location coordinate database, Wi-Fi whitelist, and historical IP set. The matching scores for each factor are then fused with the facial matching score to output a comprehensive identity credibility score, which determines whether the leave application is allowed to proceed to the approval process. At the individual behavior level, the system generates a personal behavioral profile based on each employee's historical leave records and uses the isolated forest algorithm to detect discrepancies between the current application and the personal behavioral profile, identifying abnormal leave application behavior.

[0003] The above method has the following technical problems: When multiple employees in the same department of a multinational corporation, located in different countries, collaboratively initiate leave applications using the same forgery toolkit, each person uses their real face for facial recognition authentication. Due to the sophistication of the forgery tool, no anomalies are triggered in independent factor comparisons of each individual's terminal environment data. The individual-level fusion scores of face matching and environmental factors all pass the threshold, and no alarms are triggered by individual behavioral profile deviation detection. However, using the same forgery tool leaves common forgery traces in the environmental data of multiple employees. This cross-employee environmental fingerprint similarity is neither within the scope of individual authentication detection based on independent comparison of face recognition and environmental factors, nor within the scope of anomaly detection based on individual behavioral profiles, creating a blind spot for detecting group collaborative forgery. Summary of the Invention

[0004] This invention provides a leave application system based on facial recognition, which solves the technical problem that it is difficult to effectively identify facial forgery and group-collaborative fraud in leave applications.

[0005] This invention discloses a leave application method based on face recognition, comprising: obtaining a leave application request submitted by an employee terminal, synchronously collecting a real-time face image frame sequence and a multi-dimensional environmental data packet of the terminal, and retrieving a set of terminal environmental data packets of the applicant's department within a preset backtracking period from a leave application history database; Liveness detection and facial feature matching are performed on the real-time face image frame sequence to obtain a face matching score; Environmental fingerprint feature vectors are extracted from the terminal environment data packets corresponding to the leave applications of each employee in the department. The cosine similarity between each pair of environmental fingerprint feature vectors of all employees in the department is calculated to generate an environmental fingerprint similarity matrix. Employee pairs with similarity exceeding a preset fingerprint similarity threshold are constructed into an environmental association graph. A community detection algorithm is executed on the environmental association graph to identify employee subgroups with highly similar environmental fingerprints. Calculate the fusion anomaly features for each of the employee subgroups; The face matching score is combined with the fusion anomaly features of the employee subgroup to which the current applicant belongs and input into the comprehensive fraud assessment model. The output includes a three-dimensional anomaly assessment result, which includes individual face authentication credibility, individual environment anomaly, and group collaborative forgery anomaly. The leave application is then classified and processed based on the three-dimensional anomaly assessment result.

[0006] Furthermore, the environmental fingerprint feature vector includes: the network segment prefix of the IP address, the statistical moment feature of the Wi-Fi access point signal strength distribution, and the decimal precision mode of the GPS coordinates; The statistical moment features include the mean, variance, and skewness of the signal strength distribution, and the decimal precision mode of the GPS coordinates refers to the distribution characteristics of the significant number of decimal places and the last digit in the GPS coordinate values. Before combining them into an environmental fingerprint feature vector, each sub-feature is standardized using Z-score.

[0007] Furthermore, the environmental fingerprint feature vector also includes: the deviation between the system time zone and the GPS time zone, and the noise spectrum characteristics of the sensor data; The noise spectrum features of the sensor data are extracted as follows: Fast Fourier Transform is performed on the time series of terminal accelerometer data and gyroscope data respectively. The amplitude spectrum of the transformation result is divided into frequency bands, and the energy ratio of each frequency band is extracted as the spectrum feature component. The components are then spliced ​​together to form a noise spectrum feature vector.

[0008] Furthermore, it also includes performing environmental cross-consistency verification on the terminal's multi-dimensional environmental data packets to obtain an environmental authenticity confidence score, specifically including: The standard time zone identifier is determined based on GPS coordinates and compared with the time zone setting of the terminal system to generate a time zone consistency mark. Based on GPS coordinates, a set of expected Wi-Fi access points in the vicinity, centered on the GPS coordinates and within a preset geographical radius, is retrieved from the global Wi-Fi hotspot geographic distribution database. The degree of overlap between the set of Wi-Fi access points actually scanned by the terminal and the set of expected Wi-Fi access points in the vicinity is calculated using the Jaccard similarity coefficient to obtain a Wi-Fi geographic consistency score. A signal attenuation model analysis is performed on the list of Wi-Fi access point signal strength values. The distance distribution between each access point and the terminal is estimated based on the free space path loss formula. The estimated distance distribution characteristics are then compared with the building layout data at the location of the GPS coordinates to verify spatial rationality and obtain the Wi-Fi signal spatial rationality score. Based on the network IP address, query the IP geolocation database to obtain the IP's geographical coordinates, calculate the geographical distance between the IP's geographical coordinates and GPS coordinates, and obtain the normalized IP and GPS geographical deviation value. The time zone consistency marker, Wi-Fi geographic consistency score, Wi-Fi signal spatial rationality score, and normalized IP and GPS geographic deviation values ​​are combined to form an environmental cross-consistency feature vector, which is then input into a pre-trained environmental forgery detection classifier to obtain an environmental authenticity confidence score. The environmental authenticity confidence score serves as an additional input to the comprehensive fraud assessment model.

[0009] Furthermore, before obtaining the environmental authenticity confidence score, the method further includes: calculating the terminal motion state feature vector based on the terminal acceleration sensor data and gyroscope data, comparing the terminal motion state feature vector with the displacement of GPS coordinates during the acquisition period to obtain a motion state consistency score, and appending the motion state consistency score to the environmental cross-consistency feature vector as an additional input dimension. If the accelerometer and gyroscope data show that the terminal is stationary or in low-speed motion during the data collection period, while the GPS coordinates show a large displacement during the same period, it is determined that there is a contradiction between the motion state and the GPS displacement, and a low motion state consistency score is given.

[0010] Furthermore, before performing the community detection algorithm on the environmental association graph, the following steps are also included: Perform time interval correlation analysis on the start time of any two employees in the department's leave record set, count the number of combinations where the absolute value of the time interval between all leave events of each pair of employees falls within a preset short interval range, calculate the ratio of the number of such combinations to the product of the total number of leave events of the two employees, obtain the employee-leave correlation degree, and generate the employee-leave correlation degree matrix. The employee pairs whose correlation with the leave request correlation matrix exceeds the preset leave request correlation threshold are constructed into a leave request behavior correlation graph. The environmental association graph and the leave request behavior association graph are subjected to graph fusion processing to generate a fused association graph. The fusion rule is as follows: for employee pairs that exist in both the environmental association graph and the leave request behavior association graph, the environmental fingerprint similarity and the leave request association degree are weighted and summed to generate a comprehensive association strength as the weight of the corresponding edge in the fused association graph. The weight coefficient of the weighted sum is used to adjust the relative contribution of environmental fingerprint similarity and leave request association degree in the comprehensive association strength. For employee pairs that exist only in the environment association graph, retain their association edges and label them as one-dimensional environment associations; A community detection algorithm is applied to the fused association graph, replacing the community detection results based solely on the environment association graph.

[0011] Furthermore, when calculating the time interval between the start times of two employees' leave requests, the start times of each employee's leave requests are converted to local time according to the standard time zone corresponding to their respective GPS coordinates, and then the time interval is calculated based on the local time.

[0012] Furthermore, the fusion anomaly features include: the average similarity of the environmental fingerprints of the subgroup members, the IP network segment overlap rate of the subgroup members, and the time zone normalized clustering degree; The average similarity of the environmental fingerprints of the subgroup members is the arithmetic mean of the cosine similarity of the environmental fingerprints of all employee pairs within the subgroup. The IP network segment overlap rate of the subgroup members is the ratio of the size of the set of IP network segment prefixes shared by at least two members in the subgroup to the size of the union of the IP network segment prefixes of all members in the subgroup. The time zone normalized clustering degree is the local time standard deviation calculated by converting the leave start time of each member in the subgroup to the local time according to the standard time zone corresponding to their respective GPS coordinates, and then normalizing it to the interval of zero to one. The fusion anomaly features also include a consistency index of leave application types for subgroup members, where the consistency index is the proportion of the most frequent leave application type among all members in the subgroup.

[0013] Furthermore, the comprehensive fraud assessment model includes a shared encoding layer and three independent output branches. The shared encoding layer extracts features from the concatenated input vector. The three independent output branches are the individual face authentication credibility output branch, the individual environment anomaly output branch, and the group collaborative forgery anomaly output branch. Each output branch includes a fully connected layer and a sigmoid activation function, and the output anomaly score ranges from zero to one. The comprehensive fraud assessment model is trained using a multi-task classification loss function. The total loss function is the weighted sum of the binary cross-entropy losses corresponding to the three output branches. The sum of the three loss weight coefficients is one and all are greater than zero. The graded processing includes: when the credibility of individual face authentication is not lower than the preset face credibility threshold, the anomaly of individual environment is lower than the preset anomaly threshold, and the anomaly of group collaborative forgery is lower than the preset group forgery warning threshold, face recognition authentication is passed and the leave application is transferred to the normal approval process; When the abnormality of group collaborative forgery is not lower than the preset group forgery warning threshold, all pending leave applications in the employee subgroup are routed to the security review process, and a group forgery analysis report is generated and pushed to the security management terminal. The group forgery analysis report includes an environmental fingerprint similarity matrix heatmap, a fusion association graph visualization, a cross-regional distribution map of employee subgroup members, and details of cross-consistency verification of each member's environment. When the current applicant does not belong to any identified employee subgroup, the group collaborative forgery anomaly output is zero.

[0014] This invention provides a leave application system based on facial recognition, comprising: The data acquisition module is used to acquire leave application requests submitted by employees' terminals, synchronously collect real-time facial image frame sequences and multi-dimensional environmental data packets from the terminals, and retrieve the set of terminal environmental data packets of the applicant's department within a preset retrospective period from the leave history database. The face authentication module is used to perform liveness detection and face feature matching on the real-time face image frame sequence to obtain a face matching score; The environmental fingerprint extraction module is used to extract environmental fingerprint feature vectors from the terminal environmental data packets corresponding to the leave applications of each employee in the department. The association analysis module is used to calculate the cosine similarity between each pair of environmental fingerprint feature vectors of all employees in the department, generate an environmental fingerprint similarity matrix, construct an environmental association graph for employee pairs with similarity exceeding a preset fingerprint similarity threshold, and perform a community detection algorithm on the environmental association graph to identify employee subgroups with highly similar environmental fingerprints. The subgroup feature calculation module is used to calculate fused abnormal features for each of the employee subgroups. The comprehensive evaluation module is used to input the face matching score and the fusion anomaly features of the employee subgroup to which the current applicant belongs into the comprehensive fraud evaluation model, and output a three-dimensional anomaly evaluation result including individual face authentication credibility, individual environment anomaly, and group collaborative forgery anomaly. The graded processing module is used to grade leave applications based on the three-dimensional anomaly assessment results.

[0015] This invention extracts the environmental fingerprint feature vectors corresponding to leave applications from each employee within a department and calculates the cross-employee environmental fingerprint similarity matrix. This expands the detection perspective from the independent authentication of a single employee to the environmental feature association analysis between multiple employees within a department. It solves the problem of group collaborative forgery detection when employees from the same department across regions collaborate to use the same forgery tools to forge environments, which cannot be detected in individual-level authentication detection. It achieves the technical effect of identifying suspicious employee subgroups that exhibit collaborative characteristics in two dimensions by fusing environmental association graphs and leave behavior association graphs and using community detection algorithms, and eliminating cross-border time zone differences through time zone normalization processing. Attached Figure Description

[0016] Figure 1 This is a flowchart of a leave application method based on face recognition provided in an embodiment of the present invention; Figure 2 This is a schematic diagram comparing various indicators of cross-verification of the environment for 6 employees provided in an embodiment of the present invention; Figure 3 This is a schematic diagram of the original sub-feature distribution of environmental fingerprints of 6 employees provided in an embodiment of the present invention; Figure 4 This is a schematic diagram of the heatmap of the environmental fingerprint similarity matrix of employee subgroup SG-07 provided in an embodiment of the present invention; Figure 5 This is a schematic diagram of the decomposition of comprehensive correlation strength (environmental dimension and behavioral dimension) of some employees provided in an embodiment of the present invention; Figure 6 This is a schematic diagram of the radar replacement bar chart of the normalized value of the fused anomaly feature of the subgroup SG-07 provided in the embodiment of the present invention; Figure 7 This is a schematic diagram comparing the three-dimensional fraud assessment results of six employees provided in an embodiment of the present invention; Figure 8 This is a schematic diagram of a scatter plot comparing face matching degree and environmental authenticity confidence degree provided in an embodiment of the present invention; Figure 9 This is a schematic diagram of the timeline distribution (local time) of leave application submissions provided in an embodiment of the present invention. Detailed Implementation

[0017] At least one embodiment of the present invention discloses a leave application method based on facial recognition, such as... Figure 1 As shown, it includes the following steps: Step 1: Obtain leave application data and departmental historical environmental data; The system acquires leave application requests submitted by employees' terminals, and simultaneously collects real-time facial image frame sequences captured by the terminal's camera, as well as multi-dimensional environmental data packets from the terminal. The environmental data packets include GPS coordinates, Wi-Fi access point identifiers and a list of signal strength values ​​for each access point, network IP addresses, and terminal system time zone settings. The system extracts the applicant's department identifier from the leave application request, and based on the department identifier, retrieves the set of terminal environmental data packets and the set of leave records corresponding to all leave applications from that department within a preset retrospective period from the leave history database.

[0018] It should be noted that the aforementioned terminal multidimensional environment data packet may also include terminal accelerometer data and gyroscope data, which are used in subsequent steps to verify the consistency between the terminal's motion state and GPS displacement.

[0019] It should be noted that the aforementioned preset retrospective period refers to a fixed time window that traces back from the current leave application time. For example, it could be the most recent 30 calendar days or the most recent 60 calendar days, or it could be determined based on the company's leave frequency statistics as the shortest retrospective period containing at least a preset number of leave records.

[0020] The following is an example of an application of the present invention, such as... Figure 2-9 As shown, the implementation process is as follows: A multinational technology group (hereinafter referred to as "the Group") has several multinational teams under its global R&D department. The "Asia-Pacific-Europe Collaboration Team" has eight members distributed across different countries. On the morning of March 12, 20XX, the system received leave requests from six employees of this collaboration team (employee numbers EMP031, EMP047, EMP052, EMP068, EMP075, and EMP089) within approximately 40 minutes. Starting with EMP031's request, the system simultaneously collected data packets from their terminal environment and retrieved all leave request records for the collaboration team from the leave history database for the past 30 calendar days, finding a total of 47 historical leave records.

[0021] Table 1. Data Collection Status of Terminal Environment for Current Batch of Leave Applications

[0022] Step 2: Perform face liveness detection and face feature matching to obtain a face matching score; Liveness detection is performed on a real-time sequence of face image frames. After successful liveness detection, face feature encoding is performed on the face image frames to generate face feature embedding vectors. The cosine similarity between the face feature embedding vectors and the registered face feature templates of the employee in the employee registration face feature template library is calculated to obtain the face matching score. ,in The range of values ​​is .

[0023] It should be noted that the above-mentioned liveness detection refers to performing dynamic texture analysis and illumination response consistency verification on multiple consecutive frames of face images to distinguish real faces from non-liveness attack media such as photos, videos, or 3D masks.

[0024] In this embodiment of the application, in order to perform more granular forgery detection on terminal environment data at the individual level, in addition to obtaining the face matching score, the following steps are also included: performing environmental cross-consistency verification on the terminal multidimensional environment data packet to obtain an environment authenticity confidence score. Specifically, it includes the following sub-steps: Step 201: Determine the standard time zone identifier based on GPS coordinates and compare it with the time zone setting of the terminal system to generate a time zone consistency mark. If they match If they are inconsistent, then .

[0025] Step 202: Based on GPS coordinates, retrieve the set of expected Wi-Fi access points in the vicinity of the global Wi-Fi hotspot geographic distribution database, centered on the GPS coordinates and within a preset geographic radius. Use the Jaccard similarity coefficient to calculate the degree of overlap between the set of Wi-Fi access points actually scanned by the terminal and the set of expected Wi-Fi access points in the vicinity, and obtain the Wi-Fi geographic consistency score. The calculation formula is: ; in, This refers to the set of Wi-Fi access points actually scanned by the terminal. This is the set of expected Wi-Fi access points in the vicinity, obtained based on GPS coordinates.

[0026] Step 203: Perform signal attenuation model analysis on the Wi-Fi access point signal strength value list, estimate the distance distribution between each access point and the terminal based on the free space path loss formula, and verify the spatial rationality of the estimated distance distribution characteristics with the building layout data at the GPS coordinate location to obtain the Wi-Fi signal spatial rationality score. .

[0027] Furthermore, the aforementioned free-space path loss formula estimates the propagation path loss based on the difference between the access point's transmit power and the terminal's received signal strength, thereby calculating the physical distance between the access point and the terminal. The estimated distances of each access point are compared with the building layout data at their GPS coordinates. If the estimated distance matches the actual spatial distribution of buildings, a higher Wi-Fi signal spatial reasonableness score is given. If there is a significant discrepancy between the estimated distance and the building spatial distribution (e.g., the estimated access point is located in a large open area outside a building but the signal strength is abnormally high), a lower Wi-Fi signal spatial reasonableness score is given. The range of values ​​is .

[0028] Step 204: Based on the network IP address, query the IP geolocation database to obtain the IP's geographical coordinates, calculate the geographical distance between the IP's geographical coordinates and the GPS coordinates, and obtain the IP and GPS geographical deviation value. It should be noted that, and , Since the units of measurement are different, to eliminate the influence of the difference in units of measurement on the subsequent classifier input, before assembling the above indicators into a feature vector, the units of measurement are... Mapping to decimal scaling normalization The interval, making the IP and GPS geographic deviation values ​​and , Maintain consistency in dimensions.

[0029] Step 205: Mark the time zone consistency Wi-Fi geographic consistency score Wi-Fi signal spatial rationality score Normalized IP and GPS geographic deviation values The environmental cross-consistency feature vector is used as input to a pre-trained environmental forgery detection classifier to obtain the environmental authenticity confidence score. ,in The range of values ​​is The larger the value, the higher the probability that the environmental data is the real environment.

[0030] It should be noted that the above-mentioned environmental forgery detection classifier uses labeled real environmental data samples and forged environmental data samples as training data, environmental cross-consistency feature vectors as input, and confidence scores representing the probability of the authenticity of environmental data as output. It is trained using a binary classification cross-entropy loss function and optimized using the Adam optimization algorithm.

[0031] In this embodiment of the application, in order to further improve the ability of environmental cross-consistency verification to detect physical state forgery, the following sub-steps may be included before step 205: calculating the terminal motion state feature vector based on terminal accelerometer data and gyroscope data, comparing the terminal motion state feature vector with the displacement of GPS coordinates during the acquisition period to obtain a motion state consistency score. and will It is added to the environmental cross-consistency feature vector as an additional input dimension.

[0032] Furthermore, the specific method for the above consistency comparison is as follows: if the accelerometer and gyroscope data show that the terminal is stationary or in low-speed motion during the data acquisition period, while the GPS coordinates show a large displacement during the same period, then it is determined that there is a contradiction between the motion state and the GPS displacement, and a lower score is given. Score; if the motion state matches the GPS displacement trend, a higher score will be awarded. Fraction, The range of values ​​is .

[0033] The cross-validation process is demonstrated using EMP031 as an example. The GPS coordinates of EMP031 (22.5431, 114.0579) correspond to a standard time zone of UTC+8, which is consistent with the terminal system's time zone setting of UTC+8. The system retrieves the set of expected access points around the given coordinates from a global Wi-Fi hotspot geographic distribution database. It includes 12 known hotspot identifiers; the EMP031 terminal actually scanned 7 access points ( ), among which There are only 2 overlapping access points, 5 non-overlapping actual access points, and 10 non-overlapping expected access points. Therefore: ; This score is significantly low, indicating insufficient matching between the actual scanned Wi-Fi hotspots and the surrounding hotspot database of the GPS-claimed locations. Furthermore, signal attenuation model analysis shows that the signal strength values ​​of the seven Wi-Fi access points on the EMP031 are all concentrated in an extremely narrow range of -55dBm to -58dBm, which is inconsistent with the natural discrete distribution of signal strength in real-world environments due to spatial distance differences. The IP address was rated 0.21. The IP geolocation database shows that IP address 185.220.101.43 belongs to the European exit node of a VPN service provider (coordinates approximately 50.1°N, 8.7°E), with a geographical distance of approximately 9,300 km from the coordinates claimed by GPS. (After normalization...) Based on four indicators, the environmental falsification detection classifier outputs... This indicates that the probability of the terminal's environmental data being a real environment is extremely low.

[0034] Table 26 Results of Cross-Conformity Verification of Employee Environment

[0035] Despite the 6 employees All values ​​are low, but because the GPS coordinates of the employees are claimed to be located in different countries, their time zone consistency is questionable. All are 1 (the GPS simulator is precisely configured with the system time zone matching the target's geographical location), and each employee's Individually, none of the results were below the company's set individual environment anomaly alarm threshold of 0.15. Therefore, the individual-level environment verification did not trigger an interception, and all six employees passed the face liveness detection with satisfactory face matching scores. All are between 0.91 and 0.96.

[0036] Step 3: Extract the environmental fingerprint feature vector corresponding to each employee's leave application within the department; For each record in the department's environmental data packet set, an environmental fingerprint feature vector is extracted. This vector includes: the IP address's network segment prefix, the statistical moment characteristics of the Wi-Fi access point's signal strength distribution, and the decimal precision pattern of the GPS coordinates. The statistical moment characteristics include the mean, variance, and skewness of the signal strength distribution, while the decimal precision pattern of the GPS coordinates refers to the number of significant digits and the distribution characteristics of the last digit in the decimal part of the GPS coordinate values. The same environmental fingerprint feature vector extraction operation is performed on the terminal's multidimensional environmental data packet for the current leave application.

[0037] It should be noted that the numerical ranges and dimensions of the above sub-features differ. To eliminate the impact of these dimensional differences on the cosine similarity calculation, each sub-feature is standardized using Z-score before being combined into an environmental fingerprint feature vector, so that each feature dimension has the same numerical scale.

[0038] It should be noted that the network segment prefix of the IP address mentioned above refers to the first few bits of the IP address. For example, for an IPv4 address, it could be the first 24 bits (i.e., the first three bytes), used to identify the network segment to which the IP address belongs. When the network traffic of employee terminals using the same VPN service passes through the same VPN exit node, their IP address network segment prefixes will be consistent.

[0039] It should be noted that the statistical moment characteristics of the Wi-Fi access point signal strength distribution described above are used to characterize the statistical properties of the Wi-Fi signal environment. The Wi-Fi access point signal strength distributions collected by terminals using the same virtual Wi-Fi hotspot generator exhibit similar statistical moment characteristics because the virtual signals generated by the same virtual Wi-Fi hotspot generator follow the same signal strength allocation strategy.

[0040] It should be noted that the decimal precision mode of the GPS coordinates described above is used to characterize the precision features of GPS positioning data. When different GPS simulators generate fake coordinates, the distribution of the significant digits and the last digit of the decimal part of the values ​​is affected by the simulator's internal precision settings and random number generation strategy. Terminals using the same GPS simulator will exhibit a consistent distribution pattern in this feature dimension, thus forming common traces of forgery that can be detected.

[0041] In this embodiment, to capture more multi-dimensional traces of environmental forgery tools, the environmental fingerprint feature vector may further include: the deviation between the system time zone and the GPS time zone, and the noise spectrum characteristics of the sensor data. The deviation between the system time zone and the GPS time zone refers to the difference between the time zone set by the terminal system and the standard time zone calculated based on GPS coordinates. The noise spectrum characteristics of the sensor data refer to the frequency domain distribution characteristics extracted after performing a Fast Fourier Transform on the terminal's accelerometer and gyroscope data, used to characterize the noise patterns in the sensor data.

[0042] Furthermore, the noise spectrum characteristics of the aforementioned sensor data are extracted as follows: Fast Fourier Transform is performed on the time series of accelerometer and gyroscope data respectively. The amplitude spectrum of the transform results is divided into frequency bands, and the energy proportion of each frequency band is extracted as the spectral feature component. These components are then concatenated to form a noise spectrum feature vector. Real sensor data exhibits a natural energy distribution across frequency bands due to random disturbances in the physical environment. However, sensor data generated by simulators exhibits an abnormal regularity in its spectral distribution due to the use of a fixed noise model. Terminals using the same simulator show highly similar distribution patterns in the noise spectrum characteristics of their sensor data.

[0043] The system performs a unified environmental fingerprint feature vector extraction operation on the terminal environment data packets currently requested by 6 employees and 47 historical records of their collaboration groups within the past 30 days. Taking EMP031 as an example: its IP address 185.220.101.43 has a network segment prefix (first 24 bits) of 185.220.101; the Wi-Fi access point signal strength list is [-55, -56, -57, -55, -58, -56, -57] dBm, with a mean of -56.29 dBm, a variance of 0.90, and a skewness close to 0 (highly symmetrical), exhibiting typical evenly spaced distribution characteristics of virtual hotspot generators; the GPS coordinates 22.5431 have 4 significant decimal places, ending with a 1, and the longitude 114.0579 ends with a 9, which highly matches the distribution of the last digits of the coordinates generated by the GPS simulator in the historical records. After performing Z-score standardization on each sub-feature, the vectors are concatenated to form the employee's environmental fingerprint feature vector.

[0044] Table 3. Results of original sub-feature extraction of environmental fingerprints from 6 employees in the current batch.

[0045] It can be observed that the IP network prefixes of the six employees are exactly the same (all 185.220.101), the variance of their Wi-Fi signals is concentrated in a very narrow range of 0.88 to 0.97, the skewness is close to 0, the decimal places of their GPS coordinates are all 4, and the distribution entropy of the last digit is all below 0.45. These common features, after Z-score standardization, will present highly similar numerical distributions in the corresponding dimensions of the environmental fingerprint feature vector, laying the foundation for subsequent cosine similarity calculation.

[0046] Step 4: Calculate cross-employee environmental fingerprint similarity, generate an environmental association graph, and identify suspicious employee subgroups; For the environmental fingerprint feature vectors of all employees within the department (including the current applicant), cosine similarity is used to calculate the pairwise similarity, generating an environmental fingerprint similarity matrix. , where matrix elements Indicates employees With employees The cosine similarity between environmental fingerprint feature vectors, with values ​​ranging from 1 to 2. If the environmental fingerprint similarity exceeds a preset fingerprint similarity threshold... Employees are used as environmental fingerprints to construct an environmental association graph. In the environmental association graph, the nodes represent employees, and the edges represent environmental fingerprint similarity exceeding [a certain threshold]. The relationships between employees are defined by the edge weights, which are the corresponding cosine similarity values. The range of values ​​is .

[0047] Environmental Relationship Diagram The community detection algorithm is executed to identify closely related employee subgroups in the environment association graph. Each employee subgroup contains several employees with highly similar environmental fingerprints.

[0048] It should be noted that the input to the community detection algorithm described above is a weighted undirected graph, and the output is the subgroup partitioning result of the nodes. For example, the Louvain algorithm can be used to perform hierarchical community partitioning of nodes in the graph by iteratively optimizing the modularity index.

[0049] In this embodiment of the application, in order to integrate the correlation information of the behavioral dimension to improve the accuracy of employee subgroup identification, the following steps are included before performing community detection on the environmental correlation graph: Step 401: Perform time interval correlation analysis on employee leave events in the department's leave record set. Calculate the absolute value of the time interval between the start times of any two employees' leave requests within the department. Statistically analyze the distribution of time intervals between all leave events for each employee pair within the backtracking period. Identify high-frequency employee pairs whose time intervals are concentrated within a preset short interval range, and generate an employee pair leave correlation matrix. .

[0050] Specifically, for employees within the department With employees , set up employees The set of leave start times within the retrospective period is: ,staff The set of leave start times is Then the employee's Leave of absence relevance Defined as: in and The number of combinations where the absolute value of the time interval falls within the preset short interval range among all time interval combinations is equal to the number of combinations where the absolute value of the time interval falls within the preset short interval range. and The ratio of the product of the total number of leave requests, i.e.: ; in, For employees The start time of a certain leave request, For employees The start time of a certain leave request, A preset short interval threshold is used to define the maximum allowable interval between two leave requests that are considered to be approximately synchronous in time. and For employees and employees The total number of leave requests within the retrospective period. The range of values ​​is .

[0051] Furthermore, the above The value should be determined based on the actual time granularity of the leave application submitted by the company. For example, when the leave application uses hours as the smallest time unit... It can be set to a fixed duration in hours to ensure that leave applications initiated at approximately the same time can be correctly included in the statistics.

[0052] Step 402: Analyze the employee-leave relationship matrix Employee pairs with a correlation degree exceeding a preset leave request correlation threshold are used as edges for leave request behavior association. A leave request behavior association graph is generated using a graph clustering algorithm. The preset leave-related threshold ranges from [value range missing]. .

[0053] Step 403: Create an environmental association diagram. Correlation diagram with leave request behavior Perform graph fusion processing to generate a fused association graph. The fusion rule is: for elements that simultaneously exist in the environment association graph... Correlation diagram with leave request behavior Employees in Environmental fingerprint similarity Correlation with leave time Perform a weighted summation to generate the overall correlation strength. The weight of the corresponding edge in the fusion association graph is calculated using the following formula: ; in, This is the environmental dimension weighting coefficient, with a value range of [value range missing]. This is used to adjust the relative contribution of environmental fingerprint similarity and leave time correlation to the overall correlation strength; for fingerprints that only exist in the environmental correlation graph... For employee pairs, retain their associated edges and label them as unidimensional environmental associations.

[0054] It should be noted that, Calculated using cosine similarity, with values ​​ranging from [value range missing]. ; The value is calculated using the above ratio formula, and the range of values ​​is the same. Since the two have the same dimensions, they can be directly weighted and summed.

[0055] Step 404: Merge the correlation graph The community detection algorithm is implemented to replace community detection results based solely on the environmental association graph, and to identify employee subgroups that are closely related in both the environmental and behavioral dimensions.

[0056] In this embodiment of the application, in order to eliminate the interference of cross-national time zone differences on the correlation analysis of leave time, the following processing is also included when calculating the time interval between the leave start times of two employees in step 401: converting the leave start time of each employee to the local time according to the standard time zone corresponding to their respective GPS coordinates, and then calculating the time interval based on the local time. This time zone normalization process enables leave behaviors that are synchronous in different time zones but in their respective local times to be correctly correlated.

[0057] Taking the calculation of the correlation between leave requests for EMP031 and EMP047 as an example, the system converts the start time of each person's leave request within the retrospective period to their local time according to their respective GPS coordinates' standard time zones (UTC+8 for EMP031, UTC+1 for EMP047). Statistics show that EMP031 has a total of [number missing] leave requests in the past 30 days. This leave request record, EMP047 has Each leave request record, set After comparing each case, there are 4 pairs of leave requests where the local time difference between the two individuals is no more than 1 hour. Therefore: ; This value exceeds the preset leave request association threshold of 0.12, therefore a leave request association edge exists between EMP031 and EMP047. The system performs the same calculation for all employees within the collaboration group and uses... Construct an environmental association graph for the threshold A leave request behavior association graph was constructed using a preset leave request association threshold of 0.12. .Pick Taking EMP031 and EMP047 as examples, the overall correlation strength is calculated as follows: ; Table 46 shows the results of association strength calculations for some employee pairs.

[0058] For the fusion association graph After executing the Louvain community detection algorithm, EMP031, EMP047, EMP052, EMP068, EMP075, and EMP089 were identified as the same high-density employee subgroup, and the subgroup number was SG-07.

[0059] Step 5: Calculate the fusion anomaly characteristics of each employee subgroup; For each identified employee subgroup, a fusion anomaly feature is calculated. The fusion anomaly feature includes the average similarity of the environmental fingerprints of the subgroup members. IP network segment overlap rate of subgroup members Time zone normalized clustering .

[0060] Average similarity of environmental fingerprints of subgroup members The calculation method is as follows: take the arithmetic mean of the cosine similarity of the environmental fingerprints of all employee pairs within the subgroup, with a value range of [value range missing]. .

[0061] IP network segment overlap rate of subgroup members The calculation formula is: ; in, This is the set of IP network prefixes shared by at least two members within a subgroup. It is the union of the IP network prefixes of all members within the subgroup. The range of values ​​is .

[0062] Time zone normalized clustering The calculation method is as follows: after converting the leave start time of each member in the subgroup to the local time according to the standard time zone corresponding to their respective GPS coordinates, the standard deviation of the local time is calculated. The smaller the value, the more concentrated the leave requests of the subgroup members are in their respective local time.

[0063] It should be noted that the IP network segment overlap rate mentioned above is used to quantify the concentration of network exits among subgroup members. When multiple employees use the same VPN service provider, their network traffic passes through the same or adjacent exit nodes, resulting in a high degree of overlap in IP network segment prefixes.

[0064] It should be noted that, , The range of values ​​is time zone normalized clustering The standard deviation is defined as the time unit. To eliminate the impact of dimensional differences on the input of the comprehensive fraud assessment model, the time zone normalization clustering is applied before fusing anomalous features into the input vector. Mapping to decimal scaling normalization Interval, to normalize the clustering of time zones and , Maintain consistency in dimensions.

[0065] In this embodiment of the application, in order to more comprehensively characterize the behavioral consistency features of the employee subgroup, the fusion of abnormal features may also include a consistency index of the leave types of subgroup members. The calculation method is as follows: count the types of leave requests (such as personal leave, sick leave, annual leave, etc.) of all members in the subgroup, and calculate the proportion of the most frequent leave type in the subgroup as the consistency index. The range of values ​​is .

[0066] For subgroup SG-07, the system calculates its fusion anomaly characteristics as follows. The subgroup contains... The mean cosine similarity of the environmental fingerprints for each employee pair is: ; The IP addresses of all six employees share the prefix 185.220.101, therefore , Therefore:

[0067] After converting the leave start times of the six employees to their respective local times according to their GPS coordinates' standard time zones, the local times are 09:07, 09:19, 09:28, 09:35, 09:41, and 09:48 (all local times). The time standard deviation is... The time interval, after normalization, is 0.08 (extremely low, indicating a high degree of local time concentration). All six employees requested personal leave. .

[0068] Table 5 Summary of Fusion Anomalies in Subgroup SG-07

[0069] Step 6: Perform a comprehensive fraud assessment and classify leave applications for appropriate processing. Face matching score The model integrates the fusion anomaly features of the current applicant's employee subgroup as input to a comprehensive fraud assessment model, outputting a three-dimensional anomaly assessment result. This result includes the credibility of individual facial recognition authentication. Individual environmental anomaly Collaborative forgery of anomalies with groups .

[0070] Furthermore, the aforementioned comprehensive fraud assessment model uses labeled normal leave application samples and abnormal leave application samples containing group-collaborative forgery labels as training data, and uses the concatenated vector of individual authentication features and employee subgroup fusion abnormal features as input, with individual face authentication credibility as the input. Individual environmental anomaly Collaborative forgery of anomalies with groups The model outputs three dimensions of anomaly scores and trains using a multi-task classification loss function. Each task branch corresponds to a binary classification cross-entropy loss, and the total loss is a weighted sum of the losses from each task. The optimization strategy is the Adam optimization algorithm. Specifically, the comprehensive fraud assessment model includes a shared encoding layer and three independent output branches. The shared encoding layer extracts features from the concatenated input vector. The three independent output branches are the individual face authentication credibility output branch, the individual environment anomaly output branch, and the group collaborative forgery anomaly output branch. Each output branch contains a fully connected layer and a sigmoid activation function, and the output value ranges from [value missing]. Anomaly score. Total loss function. The weighted sum of the losses for the three task branches: ; in, , , These represent the binary cross-entropy losses corresponding to the output branches for individual face authentication credibility, individual environment anomaly, and group collaborative forgery anomaly, respectively. , , The loss weight coefficients for each task branch satisfy the following conditions: and When the current applicant does not belong to any identified employee subgroup, the group-collaborative forgery anomaly is considered. The output is zero.

[0071] Based on the 3D anomaly assessment results, a tiered processing method is adopted: This method is used to assess the credibility of individual face authentication. Not lower than the preset face trust threshold and individual environment anomaly degree The abnormality is lower than the preset environmental anomaly threshold and the degree of group collaborative forgery is abnormal. When the level is below the preset threshold for group forgery warning, facial recognition authentication is performed and the leave application is transferred to the normal approval process; when the abnormality of group collaborative forgery is high... When the threshold for group spoofing warning is not lower than the preset threshold, all pending leave applications within that employee's subgroup will be routed to the security review process. The preset face trust threshold, preset environment anomaly threshold, and preset group spoofing warning threshold all have a range of values. .

[0072] In this embodiment of the application, the input to the comprehensive fraud assessment model in step 6 may further include an environmental authenticity confidence score. This leads to an abnormality in the individual's environment. The assessment also considers the results of environmental cross-consistency verification, thereby providing a more accurate basis for judging environmental forgery at the individual level.

[0073] In this embodiment of the application, in order to provide interpretable analytical basis to the security management end, when the anomaly degree of group collaborative forgery is... When the threshold for group forgery warning is not lower than the preset threshold, the following steps are also included: generating a group forgery analysis report, which includes an environmental fingerprint similarity matrix heatmap, a fusion association diagram visualization, a cross-regional distribution map of employee subgroup members, and details of cross-consistency verification of each member's environment, and pushing the group forgery analysis report to the security management terminal.

[0074] The system will use the individual feature vector of EMP031 ( , The fusion anomaly feature vector of the subgroup SG-07 () , , Normalized value: 0.08 The concatenated data is then input into the comprehensive fraud assessment model. During model training, the data is... , , ,satisfy The three-dimensional evaluation results of EMP031 output by the Sigmoid activation layers of the model's three output branches are as follows: Individual face authentication credibility. (Face recognition has high credibility because it uses real faces), individual environmental anomaly. (High degree of individual environmental anomaly) (This increases the output of this branch), and the group's collaborative forgery of anomalies. (The group-coordinated forgery has a high degree of anomaly, driven by the high consistency of the subgroup SG-07).

[0075] The company set a preset threshold of 0.75 for group fraud warnings, EMP031. This triggered a group forgery alert. The system routed all pending leave applications from the six employees in subgroup SG-07 to the security review process, and simultaneously generated a group forgery analysis report and pushed it to the security management terminal.

[0076] Table 6. Comprehensive Fraud Assessment Results and Handling Decisions for Each Member of Subgroup SG-07

[0077] After receiving the group forgery analysis report, the security management terminal can visually observe the high similarity clusters among the six employees through the environmental fingerprint similarity matrix heatmap, visually confirm the dense connection structure of subgroup SG-07 through the fusion association graph, and discover a large deviation between the GPS claimed location and the actual geographical location of the network exit by comparing the cross-regional distribution map of the employee subgroup members with the IP address of each member. This provides complete and interpretable analytical basis to support subsequent security verification decisions.

[0078] This implementation method, based on facial recognition-based leave application authentication, addresses the blind spot in detecting forgery in collaborative group environments by extracting environmental fingerprint feature vectors corresponding to leave applications from each employee within a department and calculating a cross-employee environmental fingerprint similarity matrix. This expands the detection perspective from independent authentication by a single employee to the analysis of environmental feature correlations among multiple employees within a department. Since employee terminals using the same forgery toolkit inevitably leave common forgery traces in dimensions such as IP network segment prefixes, statistical moment characteristics of Wi-Fi access point signal strength distribution, and GPS coordinate decimal precision patterns, the cosine similarity calculation between environmental fingerprint feature vectors can quantitatively discover cross-employee environmental data consistency that is imperceptible at the individual-level authentication level.

[0079] Furthermore, by integrating the environmental and behavioral association graphs and using a community detection algorithm, the association information of both the environmental and behavioral dimensions is combined. This allows for the identification of employee subgroups that exhibit collaborative characteristics in both dimensions, even if the association in a single dimension does not reach the alarm threshold. This overcomes the limitation of insufficient sensitivity in single-dimensional detection. Time zone normalization is used to convert each employee's leave time to their local time according to the standard time zone corresponding to their GPS coordinates before calculating clustering. This eliminates the interference of cross-border time zone differences on leave time association analysis, enabling the correct association of collaborative behaviors where employees in different time zones simultaneously initiate leave requests in their respective local times.

[0080] Therefore, this implementation method solves the problem of group collaborative forgery detection, which cannot be detected in individual-level face recognition authentication and individual behavior profile detection, by using three-dimensional evaluation and hierarchical processing of individual face authentication credibility, individual environment anomaly degree, and group collaborative forgery anomaly degree, without affecting the normal face recognition leave application process.

[0081] The embodiments of the present invention have been described above. However, the embodiments are not limited to the specific implementation methods described above. The specific implementation methods described above are merely illustrative and not restrictive. Those skilled in the art can make more equivalent embodiments under the guidance of the present embodiments, and all of them are within the protection scope of the present embodiments.

Claims

1. A leave application method based on facial recognition, characterized in that, Includes the following steps: The system obtains leave application requests submitted by employees' terminals, synchronously collects real-time facial image frame sequences and multi-dimensional environmental data packets from the terminals, and retrieves the set of terminal environmental data packets of the applicant's department within a preset retrospective period from the leave history database. Liveness detection and facial feature matching are performed on the real-time face image frame sequence to obtain a face matching score; Environmental fingerprint feature vectors are extracted from the terminal environment data packets corresponding to the leave applications of each employee in the department. The cosine similarity between each pair of environmental fingerprint feature vectors of all employees in the department is calculated to generate an environmental fingerprint similarity matrix. Employee pairs with similarity exceeding a preset fingerprint similarity threshold are constructed into an environmental association graph. A community detection algorithm is executed on the environmental association graph to identify employee subgroups with highly similar environmental fingerprints. Calculate the fusion anomaly features for each of the employee subgroups; The face matching score is combined with the fusion anomaly features of the employee subgroup to which the current applicant belongs and input into the comprehensive fraud assessment model. The output includes a three-dimensional anomaly assessment result, which includes individual face authentication credibility, individual environment anomaly, and group collaborative forgery anomaly. The leave application is then classified and processed based on the three-dimensional anomaly assessment result.

2. The leave application method based on face recognition according to claim 1, characterized in that, The environmental fingerprint feature vector includes: the network segment prefix of the IP address, the statistical moment features of the Wi-Fi access point signal strength distribution, and the decimal precision mode of the GPS coordinates; The statistical moment features include the mean, variance, and skewness of the signal strength distribution, and the decimal precision mode of the GPS coordinates refers to the distribution characteristics of the significant number of decimal places and the last digit in the GPS coordinate values. Before combining them into an environmental fingerprint feature vector, each sub-feature is standardized using Z-score.

3. The leave application method based on face recognition according to claim 2, characterized in that, The environmental fingerprint feature vector also includes: the deviation between the system time zone and the GPS time zone, and the noise spectrum characteristics of the sensor data; The noise spectrum features of the sensor data are extracted as follows: Fast Fourier Transform is performed on the time series of terminal accelerometer data and gyroscope data respectively. The amplitude spectrum of the transformation result is divided into frequency bands, and the energy ratio of each frequency band is extracted as the spectrum feature component. The components are then spliced ​​together to form a noise spectrum feature vector.

4. The leave application method based on face recognition according to claim 1, characterized in that, It also includes performing environmental cross-consistency verification on the terminal's multi-dimensional environment data packets to obtain an environmental authenticity confidence score, specifically including: The standard time zone identifier is determined based on GPS coordinates and compared with the time zone setting of the terminal system to generate a time zone consistency mark. Based on GPS coordinates, a set of expected Wi-Fi access points in the vicinity, centered on the GPS coordinates and within a preset geographical radius, is retrieved from the global Wi-Fi hotspot geographic distribution database. The degree of overlap between the set of Wi-Fi access points actually scanned by the terminal and the set of expected Wi-Fi access points in the vicinity is calculated using the Jaccard similarity coefficient to obtain a Wi-Fi geographic consistency score. A signal attenuation model analysis is performed on the list of Wi-Fi access point signal strength values. The distance distribution between each access point and the terminal is estimated based on the free space path loss formula. The estimated distance distribution characteristics are then compared with the building layout data at the location of the GPS coordinates to verify spatial rationality and obtain the Wi-Fi signal spatial rationality score. Based on the network IP address, query the IP geolocation database to obtain the IP's geographical coordinates, calculate the geographical distance between the IP's geographical coordinates and GPS coordinates, and obtain the normalized IP and GPS geographical deviation value. The time zone consistency marker, Wi-Fi geographic consistency score, Wi-Fi signal spatial rationality score, and normalized IP and GPS geographic deviation values ​​are combined to form an environmental cross-consistency feature vector, which is then input into a pre-trained environmental forgery detection classifier to obtain an environmental authenticity confidence score. The environmental authenticity confidence score serves as an additional input to the comprehensive fraud assessment model.

5. The leave application method based on face recognition according to claim 4, characterized in that, Before obtaining the environmental authenticity confidence score, the method further includes: calculating the terminal motion state feature vector based on terminal acceleration sensor data and gyroscope data, comparing the terminal motion state feature vector with the displacement of GPS coordinates during the acquisition period to obtain a motion state consistency score, and appending the motion state consistency score to the environmental cross-consistency feature vector as an additional input dimension. If the accelerometer and gyroscope data show that the terminal is stationary or in low-speed motion during the data collection period, while the GPS coordinates show a large displacement during the same period, it is determined that there is a contradiction between the motion state and the GPS displacement, and a low motion state consistency score is given.

6. The leave application method based on face recognition according to claim 1, characterized in that, Before performing the community detection algorithm on the environmental association graph, the following steps are also included: Perform time interval correlation analysis on the start time of any two employees in the department's leave record set, count the number of combinations where the absolute value of the time interval between all leave events of each pair of employees falls within a preset short interval range, calculate the ratio of the number of such combinations to the product of the total number of leave events of the two employees, obtain the employee-leave correlation degree, and generate the employee-leave correlation degree matrix. The employee pairs whose correlation with the leave request correlation matrix exceeds the preset leave request correlation threshold are constructed into a leave request behavior correlation graph. The environmental association graph and the leave request behavior association graph are subjected to graph fusion processing to generate a fused association graph. The fusion rule is as follows: for employee pairs that exist in both the environmental association graph and the leave request behavior association graph, the environmental fingerprint similarity and the leave request association degree are weighted and summed to generate a comprehensive association strength as the weight of the corresponding edge in the fused association graph. The weight coefficient of the weighted sum is used to adjust the relative contribution of environmental fingerprint similarity and leave request association degree in the comprehensive association strength. For employee pairs that exist only in the environment association graph, retain their association edges and label them as one-dimensional environment associations; A community detection algorithm is applied to the fused association graph, replacing the community detection results based solely on the environment association graph.

7. The leave application method based on face recognition according to claim 6, characterized in that, When calculating the time interval between the start times of two employees' leave requests, the start times of each employee's leave requests are converted to local time according to the standard time zone corresponding to their respective GPS coordinates, and then the time interval is calculated based on the local time.

8. The leave application method based on face recognition according to claim 1, characterized in that, The fusion anomaly features include: the average similarity of the environmental fingerprints of the subgroup members, the IP network segment overlap rate of the subgroup members, and the time zone normalized clustering degree; The average similarity of the environmental fingerprints of the subgroup members is the arithmetic mean of the cosine similarity of the environmental fingerprints of all employee pairs within the subgroup. The IP network segment overlap rate of the subgroup members is the ratio of the size of the set of IP network segment prefixes shared by at least two members in the subgroup to the size of the union of the IP network segment prefixes of all members in the subgroup. The time zone normalized clustering degree is the local time standard deviation calculated by converting the leave start time of each member in the subgroup to the local time according to the standard time zone corresponding to their respective GPS coordinates, and then normalizing it to the interval of zero to one. The fusion anomaly features also include a consistency index of leave application types for subgroup members, where the consistency index is the proportion of the most frequent leave application type among all members in the subgroup.

9. The leave application method based on face recognition according to claim 1, characterized in that, The comprehensive fraud assessment model includes a shared coding layer and three independent output branches. The shared coding layer extracts features from the concatenated input vector. The three independent output branches are the individual face authentication credibility output branch, the individual environment anomaly output branch, and the group collaborative forgery anomaly output branch. Each output branch includes a fully connected layer and a sigmoid activation function, and the output anomaly score ranges from zero to one. The comprehensive fraud assessment model is trained using a multi-task classification loss function. The total loss function is the weighted sum of the binary cross-entropy losses corresponding to the three output branches. The sum of the three loss weight coefficients is one and all are greater than zero. The graded processing includes: when the credibility of individual face authentication is not lower than the preset face credibility threshold, the anomaly of individual environment is lower than the preset anomaly threshold, and the anomaly of group collaborative forgery is lower than the preset group forgery warning threshold, face recognition authentication is passed and the leave application is transferred to the normal approval process; When the abnormality of group collaborative forgery is not lower than the preset group forgery warning threshold, all pending leave applications in the employee subgroup are routed to the security review process, and a group forgery analysis report is generated and pushed to the security management terminal. The group forgery analysis report includes an environmental fingerprint similarity matrix heatmap, a fusion association graph visualization, a cross-regional distribution map of employee subgroup members, and details of cross-consistency verification of each member's environment. When the current applicant does not belong to any identified employee subgroup, the group collaborative forgery anomaly output is zero.

10. A leave application system based on facial recognition, used to execute the leave application method based on facial recognition as described in any one of claims 1 to 9, characterized in that, include: The data acquisition module is used to acquire leave application requests submitted by employees' terminals, synchronously collect real-time facial image frame sequences and multi-dimensional environmental data packets from the terminals, and retrieve the set of terminal environmental data packets of the applicant's department within a preset retrospective period from the leave history database. The face authentication module is used to perform liveness detection and face feature matching on the real-time face image frame sequence to obtain a face matching score; The environmental fingerprint extraction module is used to extract environmental fingerprint feature vectors from the terminal environmental data packets corresponding to the leave applications of each employee in the department. The association analysis module is used to calculate the cosine similarity between each pair of environmental fingerprint feature vectors of all employees in the department, generate an environmental fingerprint similarity matrix, construct an environmental association graph for employee pairs with similarity exceeding a preset fingerprint similarity threshold, and perform a community detection algorithm on the environmental association graph to identify employee subgroups with highly similar environmental fingerprints. The subgroup feature calculation module is used to calculate fused abnormal features for each of the employee subgroups. The comprehensive evaluation module is used to input the face matching score and the fusion anomaly features of the employee subgroup to which the current applicant belongs into the comprehensive fraud evaluation model, and output a three-dimensional anomaly evaluation result including individual face authentication credibility, individual environment anomaly, and group collaborative forgery anomaly. The graded processing module is used to grade leave applications based on the three-dimensional anomaly assessment results.

Images