A financial site personnel behavior identification and early warning management system

Abstract

The application discloses a financial network point personnel behavior recognition and early warning management and control system, and belongs to the technical field of artificial intelligence. A video access module collects video streams of each area of the network point in real time, extracts image frames and binds space-time information; an edge preliminary judgment module detects behaviors frame by frame based on a lightweight neural network, filters out suspicious behavior clips based on a confidence threshold, and records behavior categories and occurrence time periods; an intranet checking module retrieves corresponding business records for space-time alignment based on the occurrence time periods, performs semantic determination and false alarm filtering through a financial large language model, outputs behavior determination results and generates risk levels; a management and control iteration module compares early warning results with artificial review verification results, updates the lightweight neural network model and the financial large language model respectively, and forms a closed loop optimization; and the problems of poor real-time performance caused by large computing power demand, high single model false alarm rate and low determination accuracy caused by lack of business data linkage in the prior art are solved.

Description

Technical Field

[0001] This invention relates to the field of artificial intelligence technology, specifically to a system for identifying and monitoring the behavior of personnel in financial outlets. Background Technology

[0002] With the increasing demands for intelligent supervision and compliance risk control in financial outlets, personnel behavior recognition and early warning systems are widely used in key areas such as counters, lobbies, self-service areas, and cash replenishment rooms. Their core architecture involves capturing video footage through cameras, analyzing it using behavior recognition models, and then issuing alerts for violations and abnormal risks. However, existing technologies still have the following prominent problems: Single heavy-duty model inference has high computational overhead and poor real-time performance, making it unsuitable for deployment in low-computing-power environments at the edge of branches; sending all video data directly into complex models for recognition is time-consuming and has high latency, making it difficult to meet real-time early warning requirements and unsuitable for the isolated environment of financial intranets. Single-model recognition has a high false alarm rate and lacks semantic review and error correction mechanisms; relying on a single visual judgment is prone to false alarms, and it is impossible to distinguish between normal business operations and violations. Too many invalid alarms lead to fatigue and oversight by regulatory personnel. The behavior recognition system lacks linkage with business scenarios, resulting in insufficient accuracy in risk assessment. It relies solely on visual features for judgment without combining branch business rules and spatiotemporal constraints for secondary verification, leading to weak identification capabilities for high-risk scenarios such as concealed violations and telecommunications fraud. Summary of the Invention

[0003] The purpose of this invention is to provide a financial branch personnel behavior recognition and early warning control system. This system uses a video access module to collect video streams from various areas of the branch in real time. An edge detection module uses a lightweight neural network to perform real-time behavior detection and filter suspicious behavior segments. An internal network verification module retrieves business records for the corresponding time period and uses a financial big data language model to determine semantic consistency and filter false alarms. A control iteration module updates the visual model and language model based on the comparison between the early warning results and the manual verification results. This system addresses the shortcomings of existing technologies, such as the high computational requirements of pure visual models leading to poor real-time performance, high false alarm rates of single models, and low accuracy due to a lack of business data linkage.

[0004] The objective of this invention can be achieved through the following technical solution: This application provides a financial branch personnel behavior recognition and early warning control system, comprising: The video access module is used to collect multiple video streams from various areas of the network in real time, extract image frames from the video streams, and bind the corresponding area location and timestamp information of the image frames. The edge detection module receives the image frame, performs frame-by-frame behavior detection on the image frame using a preset lightweight neural network model, filters out suspicious behavior segments based on a preset normal behavior threshold, and records the behavior category, normal behavior confidence level and occurrence time of the suspicious behavior segment, as well as the image frames within the occurrence time. The internal network verification module receives the suspicious behavior fragments and their corresponding behavior categories, normal behavior confidence levels, occurrence time periods, and image frames within those periods. Based on the occurrence time period, it combines the behavior categories and normal behavior confidence levels to retrieve relevant business records from branches within the occurrence time period for spatiotemporal alignment. It then performs semantic judgment and false alarm filtering using a preset financial big data language model, outputs the behavior judgment results, and generates corresponding risk levels based on the judgment results. The control and iteration module receives the risk level and executes graded early warning, records the early warning results, compares the early warning results with the verification results, and dynamically optimizes the lightweight neural network model and the financial big language model based on the comparison results. The verification results refer to data obtained through manual review and post-audit, used to characterize the true situation, including the category of true behavior, the judgment result of true behavior, and the level of true risk.

[0005] The beneficial effects of this invention are as follows: This invention uses a video access module and an edge preliminary judgment module for hierarchical processing. It uses a lightweight neural network to complete real-time behavior detection at the local network point and filter suspicious segments according to the confidence threshold. This solves the problems of high computing power requirements and poor real-time performance of pure video analysis and achieves low-latency preliminary screening and computing power sharing. By using the intranet verification module to retrieve the corresponding business records based on the time period of suspicious behavior, and using the financial big data language model to perform semantic consistency verification and false alarm filtering, the problem of high false alarm rate of single visual model and inaccurate judgment due to lack of business data linkage is solved, realizing cross-modal verification of behavior and business. By comparing the early warning results with the manual verification results through the control and iteration module, the visual model is updated with image frames and the language model is updated with scene text and business records, respectively. This solves the problem that static deployment of models cannot optimize itself, and realizes closed-loop iteration of dual models and continuous improvement of system accuracy. Attached Figure Description

[0006] To better understand and implement this application, the technical solution is described in detail below with reference to the accompanying drawings.

[0007] Figure 1 A flowchart illustrating a financial outlet personnel behavior identification and early warning control system provided in this application; Figure 2A business process diagram of a lightweight neural network model for a financial outlet personnel behavior recognition and early warning control system provided in this application; Figure 3 The flowchart of semantic determination and risk classification of a financial big data language model for a financial outlet personnel behavior recognition and early warning control system provided in this application. Detailed Implementation

[0008] To further illustrate the technical means and effects adopted by the present invention to achieve its intended purpose, exemplary embodiments will be described in detail below, examples of which are illustrated in the accompanying drawings. In the following description, when referring to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application.

[0009] The terminology used in this application is for the purpose of describing particular embodiments only and is not intended to be limiting of the application. The singular forms “a,” “the,” and “the” used in this application and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to and includes any or all possible combinations of one or more of the associated listed items.

[0010] The following detailed description of the specific implementation methods, features, and effects of the present invention, in conjunction with the accompanying drawings and preferred embodiments, is provided in detail.

[0011] Example 1, please refer to Figures 1 to 3. This example provides a financial branch personnel behavior recognition and early warning control system, deployed in a financial branch scenario. The branch includes four functional areas: a counter area, a lobby area, a self-service area, and a cash replenishment room. High-definition cameras are installed above each workstation in the counter area; multiple panoramic cameras are deployed in a grid pattern on the ceiling in the lobby area; miniature cameras are installed above each self-service device in the self-service area; and infrared night vision cameras are installed at the entrance and diagonally inside the cash replenishment room. All cameras are connected to a locally deployed edge computing server via network cables. The edge server is equipped with an AI acceleration module and large-capacity memory. An intranet verification server is deployed in the branch's intranet cabinet, equipped with a high-performance processor, large-capacity memory, and a graphics processor, used to run a financial large language model. A control server is also deployed to perform tiered early warning and log storage. The edge server, intranet verification server, and control server are interconnected via a high-speed Ethernet switch and connected to the upper-level management platform via a dedicated line. Furthermore, the system includes a video access module, an edge detection module, an intranet verification module, and a management and control iteration module; The video access module is used to collect multiple video streams from various areas of the network point in real time, extract image frames from the video streams, and bind the area location and timestamp information corresponding to the image frames. The video access module includes: a multi-channel acquisition unit and a spatiotemporal annotation unit. The multi-channel acquisition unit: uses high-definition camera equipment deployed at the counter, lobby, self-service area and cash replenishment room to pull video streams from each camera equipment using a real-time streaming protocol, and maintains a circular buffer in the memory of the edge server. Each camera equipment has a pre-set length of image frame queue to avoid video frame loss and duplicate acquisition, and ensure the consistency of the timing of multi-channel video synchronous acquisition. The spatiotemporal annotation unit extracts image frames from the video stream, binds each image frame to a corresponding device number, monitoring area, and acquisition timestamp, and obtains a millisecond-level timestamp from the system clock for each frame acquired, reads the device number and area code from the configuration file, encapsulates the three into a data frame header and attaches it before the original image data to form a structured data packet, which is pushed to the edge initial judgment module through shared memory to reduce data transmission latency. Example: The multi-channel acquisition unit pulls the video stream from the camera at workstation 1 on the counter. The spatiotemporal annotation unit binds the device number CAM_01, the region code COUNTER, and the current timestamp 10:23:05.123 to each frame, and then encapsulates and pushes it to the edge initial judgment module. Specifically, the video access module solves the problem of isolated multi-source video data and inability to align with business records by acquiring multiple channels in real time and binding them in time and space, and realizes the ability to access video data in a unified manner and index it in time and space across the entire network. Furthermore, the edge preliminary judgment module is used to receive the image frame, perform frame-by-frame behavior detection on the image frame through a preset lightweight neural network model, filter out suspicious behavior segments based on a preset normal behavior threshold, and record the behavior category, normal behavior confidence and occurrence time of the suspicious behavior segment, as well as the image frame within the occurrence time. The edge preliminary judgment module includes: a lightweight detection unit and a behavior filtering unit. The lightweight detection unit performs forward inference on the image frame through a preset lightweight neural network model, outputs the probability vector of each behavior category, and uses the probability value of belonging to the normal behavior category as the confidence level of normal behavior. Specifically, the lightweight neural network model uses a lightweight convolutional neural network based on depthwise separable convolution as the basic detection structure. This structure decomposes the standard convolution into two levels of operations: depthwise convolution and pointwise convolution. While retaining the feature extraction capability, it compresses the number of network parameters and floating-point operations, reduces the computing resources required for model inference, and adapts to the hardware deployment environment of financial branch edge servers with limited computing resources. During the model training phase, historical surveillance videos from multiple financial outlets were collected, covering four business scenarios: counters, lobbies, self-service areas, and cash replenishment rooms. Surveillance image frames with different time periods, lighting conditions, and multiple people's postures were extracted as training samples. Financial security professionals labeled each image frame according to industry compliance standards. The sample behavior categories included normal behavior, leaving the post, playing with mobile phones, handing over items, covering the screen, and entering restricted areas. The definition of the sample behavior category is as follows: Item delivery: When it is detected that the key points of the hand cross the horizontal boundary of the counter (for example, based on the edge of the counter, extending outward beyond a certain proportion, which can be adjusted), and there is a movement trajectory of the item being transferred from the hand to the customer, this behavior needs to be combined with business records during the internal network verification stage to determine whether it is a normal business item delivery or an illegal item delivery. Screen occlusion: When the area where the hand area intersects with the screen area accounts for more than a preset threshold (e.g., 70%) and the duration exceeds a preset duration (e.g., 2 seconds), and there is no corresponding authorized operation record, it is judged as suspicious screen occlusion. Leaving the post: When the displacement of the human body key point exceeds the boundary of the seat area and there are no human body key points in the area for more than a preset time (e.g., 3 seconds). Playing on a mobile phone: When it is detected that the hand is holding a rectangular electronic device (the aspect ratio is consistent with the typical proportion of a mobile phone) and the device is located within a certain range below the face, while the head is in a downward posture for more than a preset time; Intrusion into restricted areas: When a key point of a human body enters a preset restricted area polygon and remains there for more than a preset time (e.g., 1 second). The above thresholds are exemplary configurable parameters, and can be adjusted according to the network environment and security requirements during actual deployment; The training process uses the cross-entropy loss function to quantify the classification error and uses the Adam optimizer to iteratively update the network weights through the backpropagation algorithm until the model converges. After training, the model is converted into the TensorRT inference engine format for edge devices and deployed on the AI ​​acceleration module of the edge server for hardware-level inference acceleration. During the model inference stage, the input single-frame image is preprocessed: scaled to the standard inference size (e.g., 224×224 pixels), and the pixel values ​​are divided by 255 to normalize to the [0,1] interval; the normalized image tensor is fed into the network to perform forward inference, and outputs the probability vector of each preset behavior category; the probability value corresponding to the normal behavior category is defined as the normal behavior confidence; the category corresponding to the maximum probability is taken as the detected behavior category of the image frame; Example: After a certain frame is input into the model, the probability vector output by the model shows that the probability of normal behavior is 0.12, the probability of leaving the post is 0.75, the probability of playing with a mobile phone is 0.03, the probability of handing over an object is 0.05, the probability of obscuring the screen is 0.03, and the probability of entering a restricted area is 0.02. Therefore, the behavior category is "leaving the post", and the confidence value of normal behavior is 0.12. Specifically, the preset normal behavior threshold is set based on the following: statistical distribution analysis of the confidence levels of a large number of labeled normal behavior images is performed, and the 95th percentile is used in combination with the balance point of the false alarm rate and the missed alarm rate measured on site for calibration. The behavior filtering unit compares the confidence level of normal behavior with a preset normal behavior threshold. When the confidence level of multiple consecutive frames is lower than the threshold, it is marked as a suspicious behavior segment, and the start and end timestamps of the suspicious behavior segment and the image frame sequence within the occurrence period are recorded. Specifically, the process of filtering out suspicious behavior segments with confidence levels lower than the preset normal behavior threshold is as follows: The confidence level of normal behavior is monitored frame by frame. A preset judgment window length N and a trigger threshold M within the window are used, where N and M are positive integers and M ≤ N (for example, N = 10, M = 8, and N can be adjusted according to the frame rate of the camera device to maintain a stable window duration). When more than M frames in N consecutive frames have confidence levels lower than the preset threshold, the consecutive frame interval is marked as a suspicious behavior segment. The start and end timestamps of the segment are recorded, the behavior category corresponding to the frame with the lowest confidence level within the segment is recorded, and all image frame sequences within the segment are packaged and sent to the intranet verification module. Example: Assuming a preset normal behavior threshold of 0.3, and the confidence scores of normal behavior for 10 consecutive frames are 0.11, 0.09, 0.12, 0.10, 0.08, 0.13, 0.11, 0.09, 0.12, and 0.10 (all below 0.3), the behavior filtering unit marks the time interval, such as 10:23:05.100 to 10:23:05.580, as a suspicious behavior segment, records the behavior category as "off-duty," and sends the image frame sequence within the segment to the intranet verification module. Specifically, the edge detection module uses a lightweight neural network to detect suspicious segments in real time at the network point and filter them according to the confidence threshold, which solves the problems of high computing power requirements and poor real-time performance of pure video analysis, and realizes low-latency initial screening and computing power sharing. Furthermore, the intranet verification module is used to receive the suspicious behavior fragment and the corresponding behavior category, normal behavior confidence level, occurrence time and image frames within the occurrence time. Based on the occurrence time, combined with the behavior category and normal behavior confidence level, it retrieves relevant business records of the branch within the occurrence time for spatiotemporal alignment, performs semantic judgment and false alarm filtering through a preset financial big data language model, outputs behavior judgment results, and generates corresponding risk levels based on the judgment results. The intranet verification module includes a fragment parsing unit, a business linkage unit, a large model verification unit, and a risk classification unit.

[0012] The segment analysis unit: selects key frames by detecting the motion amplitude and posture changes between image frames in suspicious behavior segments, analyzes the behavior objects and scene elements in the consecutive frames of the key frames based on the time axis sequence, analyzes the action sequence and restores the scene; Specifically, the keyframe selection method in the segment parsing unit is as follows: calculate the optical flow change amplitude and human keypoint displacement between adjacent frames, and pre-set motion threshold and pose threshold; when the optical flow change amplitude of a frame exceeds the motion threshold or the displacement of any keypoint exceeds the pose threshold, it is marked as a candidate keyframe; extract up to 5 frames from all candidate keyframes in chronological order as keyframes; if the number of candidate keyframes is insufficient, extract up to 5 frames from the segment at equal intervals; input these keyframes and several frames before and after them into a scene parser based on a temporal convolutional network, and output structured scene reconstruction text; Furthermore, the process of calculating the optical flow variation amplitude and human body key point displacement between adjacent frames is as follows: A dense optical flow algorithm is used to calculate the optical flow vector and the average value of the modulus is taken as the optical flow variation amplitude; the OpenPose pose estimation algorithm is used to extract the coordinates of human body key points, and the Euclidean distance between the same key point in adjacent frames is calculated as the displacement; for scenarios such as financial branch counters and cash replenishment rooms, when tellers quickly leave their posts, suddenly cover the screen, or hand items to the outside of the counter, the optical flow amplitude will increase significantly. An exemplary motion threshold is set where the average optical flow modulus exceeds 2.5 pixels / frame; simultaneously, a pose estimation algorithm is used to extract human body key points, including shoulder, elbow, wrist, and hand key points, and the Euclidean distance between the same key point in adjacent frames is calculated as the displacement; for violations such as leaving the post, using a mobile phone, or handing items, an exemplary pose threshold is set: a wrist displacement exceeding 30 pixels or an elbow displacement exceeding 40 pixels is considered a pose change. Example: A suspicious segment lasting 2 seconds. Optical flow detection found 4 candidate keyframes. The segment parsing unit extracted all 4 frames and the scene parser output the text: Between 10:23:05 and 10:23:07, the teller picked up an item from under the table with his right hand, passed it over the counter panel, and handed it to the customer. The customer then put it into his bag. The business linkage unit: takes the occurrence time period as a benchmark, combines the behavior category and the confidence level of normal behavior, retrieves the business records within the corresponding time window, counts the historical occurrence frequency of the same behavior category in the same area within the preset time window, analyzes the correlation between the current behavior and the business records, and outputs the historical occurrence frequency and the correlation between the behavior and the business records as a business and device association dataset. To comply with laws and regulations related to financial data security and personal information protection, detailed customer transaction records will not be retrieved. No original transaction details that can identify a specific customer, either alone or in combination with other information, will be accessed, stored, or transmitted. The retrieved business records are limited to the following anonymized aggregated features and desensitized metadata: transaction type tags in the teller's operation log (examples include "cash withdrawal," "transfer," and "account inquiry"), which are desensitized and do not contain customer account numbers, customer names, or transaction amounts; and transaction type frequency vectors obtained in real-time within a preset time window based on the above transaction type tags (examples include [cash withdrawal: 3]). Transfer and remittance:1); access control event type and device status data, where the transaction type frequency vector is processed by differential privacy noise addition before being output to the large model verification unit (the demonstration adopts the Laplace mechanism that satisfies ε-differential privacy and ε=0.5), ensuring that it is impossible to infer the behavior of any single customer through multiple queries. The aggregated feature data retrieved is only allowed to reside in the temporary memory space of the verification process and is released after verification is completed. For aggregated feature data that is determined by the feedback optimization unit to need to be included in the difficult sample pool, it can be stored for a limited period of time and the storage period shall not exceed 90 days and it is only used for iterative training of the financial large language model. Each retrieval operation automatically generates an audit log containing the retrieval timestamp, the set of retrieved fields and the purpose of use. Specifically, in the business linkage unit, the preset time window is dynamically configured based on the branch's business volume (e.g., 30 seconds before and after). There is a natural timing deviation between the video capture terminal timestamp and the business system log timestamp, ranging from milliseconds to seconds. Additionally, there are engineering errors such as acquisition delays from different devices and business input lags. Through a timing-tolerance spatiotemporal alignment mechanism and deviation correction algorithm, a ±2-second fault-tolerant matching interval is defined using the center timestamp of the behavior segment as the benchmark anchor point. If the timestamps of the business logs, access control records, and device status data fall within this interval, they all enter the candidate matching set. A timing smoothing correction algorithm is used to calculate the systematic clock deviation between the video side and the business side by comparing the offset distribution between the actual occurrence time of consecutive behavior segments and the business recording time. A sliding window method is used to correct the delay for each matching pair, eliminating misalignment caused by acquisition delays and input time differences. For discrete records caused by cross-hour and cross-business batches, a nearest-time-series interpolation completion method is further used to complete the missing business fields for the time period, aligning the video behavior data and the branch business data at the sub-second spatiotemporal level (accuracy, for example, controlled within ±1 second). Furthermore, the process of analyzing the correlation between the current behavior and business records is as follows: Behavior expectation vector construction: The preset behavior category set includes six categories: normal behavior, leaving the post, playing with mobile phone, handing over items, covering the screen, and entering a restricted area. The preset transaction type set includes five categories: cash withdrawal, money transfer, account inquiry, access control opening, and device reset. For the currently detected behavior category, the system generates a behavior expectation vector with a dimension equal to the total number of preset transaction types according to the preset behavior transaction type mapping rules. Each component of this vector represents the expected intensity of the behavior for the corresponding transaction type. For the example of the "handing over items" behavior, the mapping rule sets the expected intensity of the cash withdrawal dimension to 1 and the other dimensions to 0, resulting in the behavior expectation vector as [cash withdrawal: 1, money transfer: 0, account inquiry: 0, access control opening: 0, device reset: 0]. Transaction type frequency vector construction: Extract the number of times each transaction type label appears within a preset time window from the retrieved business records to form a transaction type frequency vector. The value of each component is the frequency of the transaction type occurring within the time window. For example, if the teller handles 3 cash withdrawals and 1 money transfer within a 30-second window, the frequency vector is [Cash withdrawal: 3, Money transfer: 1, Account inquiry: 0, Access control opening: 0, Device reset: 0]. Cosine similarity calculation: The cosine similarity formula is used to calculate the similarity between the behavior expectation vector and the transaction type frequency vector. The formula is the dot product of the two divided by the product of their magnitudes. The result is the degree of association between the current behavior and the business record. The value range is a continuous value between 0 and 1. The closer the value is to 1, the better the actual transaction frequency distribution matches the behavior expectation. For example: Within 30 seconds before and after the occurrence time, the frequency vector of transaction type was obtained as [Cash withdrawal: 3, Transfer: 1, Account inquiry: 0, Access control opening: 0, Device reset: 0]. The expected behavior vector corresponding to the behavior category "Delivery" was [Cash withdrawal: 1, Transfer: 0, Account inquiry: 0, Access control opening: 0, Device reset: 0]. The calculated cosine similarity score was 0.95, indicating that the behavior is highly correlated with the business. The historical frequency of this behavior in this area over the past 30 days was an average of 8 times per day. The large model verification unit receives the scene reconstruction results and the business and device association dataset, performs semantic judgment and false alarm filtering through a preset financial language model and financial business rules, and outputs the behavior judgment result. The behavior judgment result includes behavior category, occurrence area, historical occurrence frequency, degree of association between behavior and business records, and judgment label used to identify whether the current behavior belongs to normal business operation, invalid false alarm and real violation. Specifically, the financial big language model is a language model pre-trained with financial domain text corpus and then adapted using financial business rule documents. The training process is as follows: an open-source big language model is used as the base model, and through domain adaptation training, it is made capable of understanding financial business rules and verifying semantic consistency. The domain adaptation training adopts an efficient parameter fine-tuning method, and the training data comes from the pairing data of financial branch compliance documents, business operation logs and behavior descriptions, and the pairing data of violation cases and judgment results. Among them, the encoding method of the business rule documents is as follows: the key clauses in the rule documents such as the financial branch security standards and counter business operation procedures are converted into condition-decision pairs, which are used as system instructions in the prompt word template. At the same time, the rule knowledge is integrated into the model parameters by constructing fine-tuning samples. The scenario reconstruction text and the business and device association dataset are structurally concatenated using a preset text template to generate a natural language text description, which is then input into the financial big data language model. The financial big data language model, based on financial business rule documents and through semantic understanding, performs consistency verification between the current behavior and business records: if the behavior description matches the business record and conforms to the financial business rules, a judgment label for normal business operation is output; if the behavior description conflicts with the business record and does not conform to the financial business rules, a judgment label for real violation is output; if the behavior description is abnormal and lacks corresponding business record support, a judgment label for invalid false alarm is output. Example: Input the concatenated text description, and the model outputs a label indicating normal business operation; The risk classification unit receives the behavior judgment result. If the judgment tag is a real violation, it determines and outputs the risk level of the current real violation based on the occurrence area, historical frequency of occurrence, and correlation between the behavior and business records. If the judgment tag is a normal business operation or invalid false alarm, it outputs a no-risk level and saves the judgment log. Specifically, the process of determining the risk level in the risk grading unit is as follows: Query the regional risk mapping table: The preset regional risk mapping table is formulated based on financial security and prevention standards, and assigns a risk value between 0 and 1 to each branch area; for example, the regional risk value corresponding to the cash replenishment room is 0.9, the counter area is 0.6, the self-service area is 0.4, and the lobby is 0.2; query the table according to the actual area where the violation occurred, and output the corresponding regional risk value, denoted as R1; Query the frequency risk mapping table: Statistically analyze the historical frequency of the same behavior category occurring in the same area of ​​the same network point within a preset time window (e.g., the past 30 days), and calculate its mean μ and standard deviation σ; divide the frequency into three intervals: below μ-σ is the low-frequency interval, between μ-σ and μ+σ is the medium-frequency interval, and above μ+σ is the high-frequency interval; the frequency risk mapping table maps the low-frequency interval to the value 0.2, the medium-frequency interval to 0.5, and the high-frequency interval to 0.8; query this table according to the interval to which the current behavior's occurrence frequency belongs, and output the corresponding frequency risk value, denoted as R2; Query the correlation risk mapping table: The correlation between the behavior and business record in the business linkage unit is denoted as S; the correlation degree is divided into three intervals: S below 0.3 is the low correlation interval, S between 0.3 and 0.7 is the medium correlation interval, and S above 0.7 is the high correlation interval; the correlation risk mapping table maps the low correlation interval to the value 0.8, the medium correlation interval to 0.5, and the high correlation interval to 0.2; Query this table according to the correlation interval of the current behavior and output the corresponding correlation risk value, denoted as R3; Weighted fusion and threshold comparison: The comprehensive risk score is calculated using a weighted summation method, with regional risk weighted at 0.4, frequency risk weighted at 0.3, and association risk weighted at 0.3. The calculation formula is as follows: Overall risk score = R1 × 0.4 + R2 × 0.3 + R3 × 0.3 Preset medium-risk and high-risk thresholds. For example, the medium-risk threshold is set to 0.4, and the high-risk threshold is set to 0.7; the judgment rules are as follows: If the overall risk score is greater than or equal to 0.7, a high-risk level is output. If the overall risk score is greater than or equal to 0.4 and less than 0.7, output a medium risk level. If the overall risk score is less than 0.4, output a low risk level; Example: An unauthorized entry into a restricted area occurs in the cash replenishment room. Consulting the regional risk mapping table yields R1 = 0.9. This behavior has never occurred in the past 30 days, placing it in the low-frequency range. Consulting the frequency risk mapping table yields R2 = 0.2. This behavior is unrelated to any business records, S = 0, placing it in the low-correlation range. Consulting the correlation risk mapping table yields R3 = 0.8. Substituting into the formula: Overall Risk Score = 0.9 × 0.4 + 0.2 × 0.3 + 0.8 × 0.3 = 0.36 + 0.06 + 0.24 = 0.66. Since 0.66 is greater than or equal to 0.4 and less than 0.7, the output is a medium risk level. Specifically, the intranet verification module retrieves business records by indexing the time period in which the event occurred, and uses a financial big data language model to perform semantic consistency verification and false alarm filtering. This solves the problems of high false alarm rate of single visual models and inaccurate judgment due to lack of business data linkage, and realizes cross-modal verification of behavior and business. Furthermore, the control iteration module is used to receive the risk level and execute graded early warning, record the early warning results, compare the early warning results with the verification results, and dynamically optimize the lightweight neural network model and the financial big data language model based on the comparison results; the control iteration module includes a graded early warning unit, a feedback optimization unit, and a log retention unit; The graded early warning unit receives the risk level; if the risk level is high, medium, or low, it executes graded push notifications and pop-up reminders according to a preset early warning strategy; if the risk level is no risk, it does not execute any early warning action. Specifically, in the tiered early warning unit, the preset early warning strategy sets different push targets, display methods, and response time requirements according to the risk level to achieve tiered differentiated management: for high-risk levels, a red pop-up is pushed to the branch manager, security department, and monitoring center simultaneously, and an audible and visual alarm is triggered; for medium-risk levels, a yellow pop-up is pushed only to the on-duty security officer; for low-risk levels, a scrolling notification is displayed in the status bar at the bottom of the monitoring client. Example: High-risk level triggers a red pop-up window and audible and visual alarm; medium-risk level pushes a yellow pop-up window; low-risk level scrolling prompts. The feedback optimization unit: obtains the verification results after the early warning is executed, compares the behavior category and risk level in the early warning results with the verification results one by one, counts the samples with inconsistent comparisons, extracts the corresponding image frames, scene reconstruction text and business records of the samples, updates the model parameters of the lightweight neural network model based on the real behavior categories in the image frames and verification results; and updates the model parameters of the financial big data language model using the scene reconstruction text, business records and real behavior judgment results in the verification results. Specifically, the verification results are data used to characterize the actual situation, obtained through manual review or post-audit, including the actual behavior category, the actual behavior judgment result, and the actual risk level. Each video stream is processed in real time, and when suspicious behavior is detected, the risk level is output immediately and a tiered warning is triggered. The video access module, edge preliminary judgment module, and intranet verification module operate continuously. During daily business off-peak hours (e.g., early morning), the system retrieves all warning records from the previous day and their corresponding key image frames, scene reconstruction text, and business records. After manual review, each record is compared, and inconsistent samples are counted. When the number of inconsistent samples reaches a preset update threshold (e.g., 500), an offline model update is triggered. After the update, the new model is deployed to the edge server and the intranet verification server, and the system begins using the new model in the next detection cycle. Furthermore, the feedback optimization unit performs offline comparison during the daily early morning off-peak business period: it compares the behavior category and risk level in the warning result with the corresponding field in the verification result one by one, and counts the samples that are inconsistent; it saves the image frames, scene restoration text and desensitized business metadata corresponding to the inconsistent samples to form a difficult sample pool. When the number of samples in the hard sample pool reaches a preset update threshold, the model is updated. This threshold can be set according to the balance between the sample accumulation rate and the model update frequency in actual deployment. For example, 500 samples are used. Optionally, the feedback optimization unit performs standardized preprocessing on the accumulated samples to complete sample deduplication, noise filtering and data regularization, remove invalid samples with blurry images, abnormal acquisition and invalid annotation, and retain differential samples with correction value to ensure the data purity and data quality of the training dataset. For lightweight neural network models, parameters are adjusted based on processed image samples and real behavior categories to correct network weight parameters, optimize the model's ability to identify and judge easily confused behaviors, and adapt to complex monitoring scenarios at network points. For the financial big language model, the text reasoning logic is optimized by using the real judgment results, the semantic association rules between business data and behavioral description are corrected, and the semantic discrimination accuracy of the model for financial business scenarios is improved. Example: On a certain day, 5 difficult samples were found during the comparison, 3 of which were false alarms of leaving the post (the visual model judged a brief departure as suspicious, but the business record showed that the teller was authorized to hand over the goods), and 2 were missed reports of handing over items; the feedback optimization unit stored the corresponding image frames and scene text into the difficult sample pool; after accumulating 500 samples, the model was updated, and the false alarm rate decreased by 2 percentage points in the following week after the update; The log retention unit is used to record the warning results, the verification results after the warning is executed, and the parameter update records during the dynamic optimization process. Specifically, in the log retention unit, each record is stored in encrypted and desensitized form, including a unique event identifier, timestamp, occurrence area, behavior category, system judgment label, system risk level, manual review label, reviewer identifier, model version number, and update status, to meet the compliance requirements for financial audit traceability. Specifically, the control iteration module compares the early warning results with the manual review and verification results one by one and updates the visual model and language model respectively, which solves the problem that static deployment of models cannot optimize itself, and realizes dual-model closed-loop iteration and continuous improvement of system accuracy. Specifically, this embodiment achieves real-time acquisition and spatiotemporal annotation of multiple video streams across the entire network through the video access module. The edge detection module uses a lightweight neural network to perform low-latency behavior detection and suspicious segment screening locally at the network. The internal network verification module uses the behavior occurrence time as an index to link business records and uses a financial big data language model for semantic consistency judgment and false alarm filtering. The control iteration module updates the visual model and language model based on manual verification results, forming a complete closed loop of acquisition, initial screening, verification, classification, early warning, feedback, and optimization. This solves three major defects in existing technologies: high computational requirements of pure visual models leading to poor real-time performance, high false alarm rate of single models, and low judgment accuracy due to lack of business data linkage. It achieves accurate identification of personnel behavior at financial network outlets, low false alarm early warning, and continuous self-evolution, significantly improving the security control level and operational efficiency of financial business outlets.

[0013] Example 2 This embodiment provides a financial branch personnel behavior recognition and early warning control system. Compared with Embodiment 1, the core difference of this embodiment is that: for financial branches with large fluctuations in business volume, the branches are located in commercial centers, near schools, or in transportation hubs. The transaction density of their counter areas and self-service areas can differ by tens of times between peak hours (such as lunchtime and holidays) and off-peak hours (such as late at night); during peak hours, personnel movements are frequent and business interactions are intensive, while during off-peak hours, occasional movements are relatively rare. Fixed parameters are prone to missed or false alarms. The system includes a video access module, an edge preliminary judgment module, an intranet verification module, and a control iteration module. The modules are interconnected and work together to execute the personnel behavior recognition and early warning control process. The video access module is used to collect multiple video streams from various areas of the network site in real time, extract image frames from the video streams, and bind the corresponding area location and timestamp information of the image frames; the video access module includes a multi-channel acquisition unit and a spatiotemporal annotation unit; The multi-channel acquisition unit acquires real-time monitoring video streams from various areas simultaneously using high-definition cameras deployed at the counters, lobby, self-service area, and cash replenishment room. It uses a real-time streaming protocol to pull video streams from each camera and maintains a circular buffer in the edge server's memory. Each camera has a pre-set length of image frame queue to ensure the consistency of the timing of multi-channel video synchronous acquisition. The spatiotemporal annotation unit extracts image frames from the video stream, binds each image frame to a corresponding device number, monitoring area, and acquisition timestamp, and sends it to the edge preliminary judgment module. For each frame acquired, the millisecond-level timestamp is obtained from the system clock, the device number and area code are read from the configuration file, and the three are encapsulated into a data frame header and attached to the original image data to form a structured data packet, which is pushed to the edge preliminary judgment module through shared memory. The edge detection module receives the image frames, performs frame-by-frame behavior detection on the image frames using a preset lightweight neural network model, filters out suspicious behavior segments based on a preset normal behavior threshold, and records the behavior category, normal behavior confidence level, and occurrence time of the suspicious behavior segments, as well as the image frames within the occurrence time. The edge detection module includes a lightweight detection unit and a behavior filtering unit. The lightweight detection unit performs frame-by-frame behavior detection on the received image frames using a preset lightweight neural network model, identifies the behavior category, and outputs the behavior category and the confidence level of normal behavior. The lightweight neural network model is a lightweight convolutional neural network based on depthwise separable convolution. It is trained using image frames labeled with behavior categories from historical videos of financial branch surveillance as training samples and trained through a backpropagation algorithm. During inference, the input image frames are forward-propagated to obtain probability vectors for each category. The probability value of the normal behavior category is used as the confidence level of normal behavior, and the category corresponding to the maximum probability value is taken as the detected behavior category. The behavior screening unit employs a dynamic adaptive threshold adjustment strategy. The behavior screening unit maintains a historical confidence queue, recording the confidence values ​​of all behaviors judged as normal within a past statistical period (e.g., one day). After each statistical period, the behavior screening unit calculates the mean μ and standard deviation σ of this queue, dynamically adjusting the preset normal behavior threshold to μ - σ. After adjustment, the historical queue is cleared, and the next statistical period begins. Specifically, the behavior filtering unit calculates the confidence level of normal behavior frame by frame. When the confidence level of consecutive frames exceeding the preset minimum number of consecutive frames (e.g., 10 frames) is lower than the dynamically adjusted preset threshold, the consecutive frame interval is marked as a suspicious behavior segment. The start frame timestamp, end frame timestamp, and behavior category corresponding to the frame with the lowest built-in confidence level in the segment are recorded. All image frame sequences in the segment are packaged and sent to the intranet verification module. Example: During a normal workday, the average confidence level of a certain branch is 0.35, the standard deviation is 0.05, and the dynamic threshold is 0.30. The next day, due to cloudy weather, the image contrast decreases, and the average confidence level drops to 0.28, the standard deviation is 0.04, and the dynamic threshold is automatically lowered to 0.24. If the confidence levels of 12 consecutive frames are 0.11, 0.09, 0.12, etc., all below 0.24, then they are marked as suspicious behavior segments. The intranet verification module receives the suspicious behavior fragments and their corresponding behavior categories, normal behavior confidence levels, occurrence time periods, and image frames within those periods. Using the occurrence time period as a baseline, and combining the behavior categories and normal behavior confidence levels, it retrieves relevant business records from branches within the occurrence time period for spatiotemporal alignment. It then performs semantic judgment and false alarm filtering using a pre-set financial big data language model, outputs the behavior judgment result, and generates a corresponding risk level based on the judgment result. The intranet verification module includes a fragment parsing unit, a business linkage unit, a big data model verification unit, and a risk grading unit. The segment parsing unit receives the suspicious behavior segment and its corresponding behavior category, normal behavior confidence level, occurrence time period, and corresponding image frame. It selects keyframes by detecting motion amplitude and pose changes between image frames in the suspicious behavior segment. Based on the timeline, it analyzes the behavior objects and scene elements in consecutive frames of the keyframes, parses the action sequence, and performs scene reconstruction. The keyframe selection method is as follows: calculate the optical flow change amplitude and human keypoint displacement between adjacent frames, and pre-set motion and pose thresholds; when the optical flow change amplitude of a frame exceeds the motion threshold or the displacement of any keypoint exceeds the pose threshold, it is marked as a candidate keyframe; extract up to 5 frames from all candidate keyframes in chronological order as keyframes; if the number of candidate keyframes is insufficient, extract up to 5 frames from the segment at equal intervals; input these keyframes and several frames before and after them into a scene parser based on a temporal convolutional network, and output structured scene reconstruction text. The business linkage unit uses the occurrence time period as a benchmark, and combines the behavior category and the confidence level of normal behavior to retrieve the business records within the corresponding time window. The business records include transaction type tags in the teller's operation log, transaction type frequency vectors obtained in real time based on the transaction type tags, access control status, and device status data. The transaction type tags in the teller's operation log are anonymized and do not contain customer accounts or transaction amounts. The transaction type frequency vector is an anonymized aggregated feature. This embodiment adopts a business volume adaptive time window: the number of transactions T in the current time period (e.g., the past 1 hour) is obtained from the branch's core business system. A baseline number of transactions T0 and a baseline time window width W0 are preset. The dynamic window width W = W0 × (T0 / max(T, 1)) is limited to a minimum and a maximum value (e.g., a minimum of 10 seconds and a maximum of 120 seconds). The business linkage unit retrieves business records within this dynamic window, counts the historical occurrence frequency of the same behavior category in the same area within the preset time window (e.g., the past 30 days), maps the currently detected behavior category to a behavior expectation vector, calculates the correlation between the behavior expectation vector and the transaction type frequency vector using cosine similarity, and outputs the historical occurrence frequency and correlation as a business and device association dataset. Example: Preset T0 = 30 transactions / hour, W0 = 30 seconds; if the current hourly transaction count is 60 transactions, then W = 15 seconds; if it is 10 transactions, then W = 90 seconds; The large model verification unit receives the scene reconstruction results and the business and device association dataset. Using a pre-set financial language model and financial business rules, it performs semantic judgment and false alarm filtering, outputting behavior judgment results. These results include behavior category, occurrence area, historical frequency, correlation between the behavior and business records, and judgment labels used to identify normal business operations, invalid false alarms, or genuine violations. The financial language model is a language model pre-trained with financial domain text corpus and trained using financial business rule documents for domain adaptation. The scene reconstruction text and the business and device association dataset are concatenated using text templates to generate a natural language description, which is then input into the model for consistency verification. The risk grading unit receives the behavior judgment result. If the judgment tag is a real violation, the risk level is determined based on the occurrence area, historical occurrence frequency, and correlation degree. If it is a normal business operation or an invalid false alarm, the risk level is output as no risk. The process of determining the risk level includes: outputting the regional risk value by querying the regional risk mapping relationship table, outputting the frequency risk value by querying the frequency risk mapping relationship table, outputting the correlation risk value by querying the correlation risk mapping relationship table, and comparing the weighted fusion with the preset medium risk threshold and high risk threshold to output high, medium, and low risk levels. The control iteration module is used to receive the risk level and execute graded early warning, record the early warning results, compare the early warning results with the verification results, and dynamically optimize the lightweight neural network model and the financial big data model based on the comparison results; the control iteration module includes a graded early warning unit, a feedback optimization unit, and a log retention unit. The graded early warning unit receives the risk level. If it is high risk, medium risk, or low risk, it executes graded push notifications and pop-up reminders through a preset early warning strategy. If there is no risk, no early warning is executed. For high-risk levels, a red pop-up is pushed to the branch manager, security department, and monitoring center, and an audible and visual alarm is triggered. For medium-risk levels, a yellow pop-up is pushed to the on-duty security officer. For low-risk levels, a scrolling notification appears in the status bar at the bottom of the monitoring client. The feedback optimization unit acquires verification results (including real behavior categories, real behavior judgment results, and real risk levels) obtained through manual review or post-audit. It compares the behavior categories and risk levels in the warning results with the verification results one by one, counts inconsistent samples, and extracts the corresponding image frames, scene reconstruction text, and business records. When the number of inconsistent samples reaches a preset update threshold (500 for example), the model is updated: the lightweight neural network model is updated based on the image frames and real behavior categories; the financial big language model is updated based on the scene reconstruction text, business records, and real behavior judgment results. The log retention unit records the warning results, verification results, and parameter update records during the dynamic optimization process. Each record includes a unique event identifier, timestamp, occurrence area, behavior category, system judgment label, system risk level, manual review label, reviewer identifier, model version number, and update status.

[0014] This embodiment enables the system to adapt to changes in behavioral characteristics under different time periods and business loads by dynamically adjusting the normal behavior threshold and time window width. It maintains sensitivity during peak periods and suppresses invalid false alarms during off-peak periods, solving the problem of insufficient adaptability of fixed parameters in scenarios with drastic fluctuations in business volume. This further improves the robustness and deployment flexibility of the system under different operating environments.

[0015] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention in any way. Although the present invention has been disclosed above with reference to preferred embodiments, it is not intended to limit the present invention. Any person skilled in the art can make some modifications or alterations to the above-disclosed technical content to create equivalent embodiments without departing from the scope of the present invention. Any simple modifications, equivalent changes and alterations made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the scope of the present invention.

Claims

1. A financial site staff behavior identification and early warning management system, characterized in that, include: The video access module is used to collect multiple video streams from various areas of the network in real time, extract image frames from the video streams, and bind the corresponding area location and timestamp information of the image frames. The edge detection module receives the image frame, performs frame-by-frame behavior detection on the image frame using a preset lightweight neural network model, filters out suspicious behavior segments based on a preset normal behavior threshold, and records the behavior category, normal behavior confidence level and occurrence time of the suspicious behavior segment, as well as the image frames within the occurrence time. The internal network verification module receives the suspicious behavior fragments and their corresponding behavior categories, normal behavior confidence levels, occurrence time periods, and image frames within those periods. Using the occurrence time period as a baseline, and combining the behavior categories and normal behavior confidence levels, it retrieves relevant business records from branches within the occurrence time period for spatiotemporal alignment. It then performs semantic judgment and false alarm filtering using a pre-set financial language model, outputs the behavior judgment result, and generates a corresponding risk level based on the judgment result. The business records are anonymized business operation type tags and aggregated frequency features, and do not contain transaction details that can identify customer identities. The control and iteration module receives the risk level and executes graded early warning, records the early warning results, compares the early warning results with the verification results, and dynamically optimizes the lightweight neural network model and the financial big language model based on the comparison results. The verification results refer to data obtained through manual review and post-audit, used to characterize the true situation, including the category of true behavior, the judgment result of true behavior, and the level of true risk. 2.The financial site personnel behavior identification and early warning management system according to claim 1, characterized in that, The video access module includes: The multi-channel acquisition unit uses high-definition cameras deployed in the counter, lobby, self-service area and cash replenishment room to pull video streams using a real-time streaming protocol, and maintains a circular buffer and image frame queue in the memory of the edge server to synchronously acquire real-time monitoring video streams in each area; The spatiotemporal annotation unit extracts image frames from the video stream, binds each image frame to a corresponding device number, monitoring area, and millisecond-level timestamp, encapsulates it into a data frame header, and pushes it to the edge preliminary judgment module via shared memory. 3.The financial site personnel behavior identification and early warning management system according to claim 1, characterized in that, The edge preliminary judgment module includes: The lightweight detection unit performs forward inference on the image frame through a preset lightweight neural network model, outputs the probability vector of each behavior category, and uses the probability value of belonging to the normal behavior category as the confidence level of normal behavior. The behavior filtering unit compares the confidence level of normal behavior with a preset normal behavior threshold. When the confidence level of multiple consecutive frames is lower than the threshold, suspicious behavior segments are marked, and the start and end timestamps of the suspicious behavior segments and the image frame sequence within the occurrence period are recorded.

4. The financial site staff behavior identification and early warning management system according to claim 3, characterized in that, The lightweight detection unit performs forward inference on image frames using a preset lightweight neural network model, including: The lightweight neural network model is a lightweight convolutional neural network based on depthwise separable convolution, trained by the backpropagation algorithm. It uses image frames covering the counter, lobby, self-service area and cash replenishment room in the historical video of financial outlet monitoring as training samples, and labels each image frame with a corresponding preset behavior category. The received image frame is input into the lightweight neural network model, and the probability value of each preset behavior category corresponding to the image frame is calculated by the forward propagation algorithm. The probability value of belonging to the normal behavior category is used as the normal behavior confidence, the behavior category with the highest probability value is used as the detected behavior category, and the behavior category and normal behavior confidence are output. The preset behavior categories include at least: normal behavior as well as leaving one's post, playing on a mobile phone, handing over items, covering the screen, and entering a restricted area.

5. The financial site staff behavior identification and early warning management system according to claim 1, characterized in that, The intranet verification module includes: The segment analysis unit selects key frames by detecting the motion amplitude and posture changes between image frames in suspicious behavior segments, analyzes the behavior objects and scene elements in consecutive frames of the key frames based on the time axis sequence, analyzes the action sequence and performs scene reconstruction; The business linkage unit uses the occurrence time period as a benchmark to retrieve business records within the corresponding time window. These business records include: transaction type tags in the teller's operation log, transaction type aggregation frequency features obtained in real-time based on the transaction type tags, access control status, and device status data. The transaction type tags in the teller's operation log are anonymized and do not contain customer accounts or transaction amounts; the transaction type frequency aggregation features are anonymized data. The unit statistically analyzes the historical frequency of the same behavior category in the same area within a preset time window and calculates the correlation between behavior and business records using cosine similarity, outputting a business-device association dataset. The large model verification unit receives the scene reconstruction results and the business and device association dataset, performs semantic judgment and false alarm filtering through a preset financial big language model and financial business rules, and outputs the behavior judgment result. The behavior determination results include: behavior category, occurrence area, historical occurrence frequency, correlation between behavior and business records, and a determination label used to identify whether the current behavior belongs to normal business operation, invalid false alarm, or real violation. The risk grading unit receives the behavior judgment result. If the judgment label is a real violation, it determines and outputs the risk level of the current real violation based on the occurrence area, historical frequency of occurrence, and correlation between the behavior and business records. If the judgment label is a normal business operation or invalid false alarm, it outputs a no-risk level and saves the judgment log.

6. The financial site staff behavior identification and early warning management system according to claim 1, characterized in that, The specific method for analyzing the behavioral objects and scene elements in consecutive frames of the keyframes based on the timeline sequence, parsing the action timing, and reconstructing the scene includes: Calculate the optical flow variation amplitude and human key point displacement between adjacent image frames, and preset motion threshold and pose threshold; When the change in optical flow exceeds the motion threshold, the current image frame is marked as a candidate keyframe; when the displacement of human keypoints exceeds the pose threshold, the current image frame is marked as a candidate keyframe. Candidate keyframes are extracted from suspicious behavior segments in chronological order. If the number of candidate keyframes is less than the preset total number of keyframes, frames are extracted at equal time intervals on the timeline of the segment to bring the total number of keyframes to the preset number. The keyframe sequence is obtained after sorting by time. The keyframe sequence is input into a temporal convolutional network, which outputs structured scene reconstruction text.

7. The financial site staff behavior identification and early warning management system according to claim 5, characterized in that, The large model verification unit performs semantic judgment and false alarm filtering through a pre-set financial language model combined with financial business rules, including: The financial language model is a language model obtained by pre-training with financial domain text corpus and performing domain adaptation training using financial business rule documents. The scenario reconstruction text and the business and device association dataset are structurally concatenated using a preset text template to generate a natural language text description, which is then input into the financial big data language model. The financial big data language model, based on financial business rule documents, performs consistency verification between the current behavior and business records through semantic understanding. If the behavior description matches the business record and complies with financial business rules, a judgment label for normal business operation will be output; if the behavior description conflicts with the business record and does not comply with financial business rules, a judgment label for genuine violation will be output; if the behavior description is abnormal and lacks corresponding business record support, a judgment label for invalid false alarm will be output.

8. The financial site staff behavior identification and early warning management system according to claim 5, characterized in that, The process of determining and outputting the risk level of the current actual violation includes: By querying the regions where the actual violations occurred and a preset regional risk mapping table, the corresponding regional risk values ​​are output; by querying the historical frequency of occurrence and a preset frequency risk mapping table, the corresponding frequency risk values ​​are output; by querying the correlation between the actual violations and business records and a preset correlation risk mapping table, the corresponding correlation risk values ​​are output. The regional risk value, frequency risk value, and associated risk value are weighted and fused to obtain a comprehensive risk score; The comprehensive risk score is compared with preset high-risk and medium-risk thresholds: if the comprehensive risk score is greater than or equal to the high-risk threshold, a high-risk level is output; if the comprehensive risk score is greater than or equal to the medium-risk threshold but less than the high-risk threshold, a medium-risk level is output; if the comprehensive risk score is less than the medium-risk threshold, a low-risk level is output.

9. The financial site staff behavior identification and early warning management system according to claim 1, characterized in that, The control iteration module includes: The tiered early warning unit receives the risk level. If the risk level is high, medium, or low, it executes tiered push notifications and pop-up reminders according to a preset early warning strategy. If the risk level is no risk, it does not execute any early warning action. The feedback optimization unit obtains the verification results after the early warning is executed, compares the behavior category and risk level in the early warning results with the verification results one by one, counts the samples with inconsistent comparisons, extracts the corresponding image frames, scene reconstruction text and business records for the samples, updates the model parameters of the lightweight neural network model based on the real behavior categories in the image frames and verification results, and updates the model parameters of the financial big data language model based on the scene reconstruction text, business records and real behavior judgment results in the verification results. The log retention unit is used to record the warning results, the verification results after the warning is executed, and the parameter update records during the dynamic optimization process.

Images