CN111382944A - Job behavior risk identification method and device, computer equipment and storage medium - Google Patents
Job behavior risk identification method and device, computer equipment and storage medium Download PDFInfo
- Publication number
- CN111382944A CN111382944A CN202010166185.9A CN202010166185A CN111382944A CN 111382944 A CN111382944 A CN 111382944A CN 202010166185 A CN202010166185 A CN 202010166185A CN 111382944 A CN111382944 A CN 111382944A
- Authority
- CN
- China
- Prior art keywords
- risk
- data
- feature
- characteristic
- behavior
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q10/00—Administration; Management
- G06Q10/06—Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
- G06Q10/063—Operations research, analysis or management
- G06Q10/0635—Risk analysis of enterprise or organisation activities
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
- G06F16/24—Querying
- G06F16/245—Query processing
- G06F16/2458—Special types of queries, e.g. statistical queries, fuzzy queries or distributed queries
- G06F16/2462—Approximate or statistical queries
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q10/00—Administration; Management
- G06Q10/08—Logistics, e.g. warehousing, loading or distribution; Inventory or stock management
- G06Q10/083—Shipping
Landscapes
- Engineering & Computer Science (AREA)
- Business, Economics & Management (AREA)
- Human Resources & Organizations (AREA)
- Physics & Mathematics (AREA)
- Theoretical Computer Science (AREA)
- Economics (AREA)
- Strategic Management (AREA)
- Entrepreneurship & Innovation (AREA)
- General Physics & Mathematics (AREA)
- General Business, Economics & Management (AREA)
- Tourism & Hospitality (AREA)
- Quality & Reliability (AREA)
- Operations Research (AREA)
- Marketing (AREA)
- Development Economics (AREA)
- Probability & Statistics with Applications (AREA)
- Software Systems (AREA)
- Mathematical Physics (AREA)
- Fuzzy Systems (AREA)
- Computational Linguistics (AREA)
- Data Mining & Analysis (AREA)
- Databases & Information Systems (AREA)
- General Engineering & Computer Science (AREA)
- Educational Administration (AREA)
- Game Theory and Decision Science (AREA)
- Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)
Abstract
The application relates to a job behavior risk identification method and device, computer equipment and a storage medium. The method comprises the following steps: acquiring operation data, and extracting characteristic data of the operation data to obtain first characteristic data; performing statistical analysis on the first characteristic data according to the dimensions of the risk objects to obtain second characteristic data, wherein the second characteristic data comprise characteristic data of each behavior characteristic of each risk object; determining an abnormal identification result of each behavior characteristic of each risk object according to the second characteristic data; determining the risk index of each risk object and the risk characteristics of each risk object according to the abnormal identification result; and outputting a risk identification result of each risk object, wherein the risk identification result comprises the risk index of each risk object and the risk characteristics of each risk object. By adopting the method, abnormal data in the operation process can be identified, an enterprise can be helped to find operation behavior risks in time, and abnormal points and risk objects are positioned, so that the enterprise can be helped to control loss.
Description
Technical Field
The present application relates to the field of logistics technologies, and in particular, to a method and an apparatus for identifying risk of job behavior, a computer device, and a storage medium.
Background
With the development of internet technology and big data technology, data has become the basis for operation process monitoring, operation quality control and financial settlement in the field of logistics operation. The data sources are mainly divided into two types, one type is that an operator operates an operating system to manually input data, such as a mail receiving person inputs information of a sender phone, a sender address, a receiver address and the like of a package in a mail receiving link. The second is log record data of operation, such as the information of the completion of the article acquisition determined by scanning the package by an operator, the article acquisition time and the article acquisition personnel recorded by a background.
The mode of managing is carried out to the utilization data, makes the logistics enterprise can accomplish the control to hundreds of millions of operation processes simultaneously on the one hand, has guaranteed the traceable of transportation commodity circulation process. But also creates a greater risk. The risk is mainly reflected in the easy forgeability of the data, i.e. the data recorded by the system may be true or false. Especially for data that may affect financial settlement, it may happen that the operator takes various ways to forge the data in order to obtain more profits. Because the logistics enterprises are not conscious of risk control, the data counterfeiting and profit obtaining behavior has been developed into an industry, and even special software helps to perform data counterfeiting, which causes huge loss to the logistics enterprises. Therefore, how to identify the operation behavior risk in the operation link of the logistics enterprise becomes an urgent problem to be solved.
Disclosure of Invention
In view of the above, it is necessary to provide a job behavior risk identification method, apparatus, computer device and storage medium for solving the above technical problems.
A job behavior risk identification method comprises the following steps:
acquiring operation data, and extracting characteristic data of the operation data to obtain first characteristic data;
performing statistical analysis on the first characteristic data according to the dimensions of the risk objects to obtain second characteristic data, wherein the second characteristic data comprise characteristic data of each behavior characteristic of each risk object;
determining an abnormal identification result of each behavior characteristic of each risk object according to the second characteristic data;
determining the risk index of each risk object and the risk characteristics of each risk object according to the abnormal identification result;
and outputting a risk identification result of each risk object, wherein the risk identification result comprises the risk index of each risk object and the risk characteristics of each risk object.
In one embodiment, the acquiring of the job data includes:
acquiring job entry data and operation log data;
and merging and summarizing the operation input data and the operation log data to obtain the operation data.
In one embodiment, the extracting the feature data of the job data to obtain the first feature data includes: extracting key characteristic data of each operation link according to the operation data, wherein the key characteristic data comprises at least one of the following data:
feature data capable of distinguishing a work object, feature data capable of distinguishing a work operator, feature data recording a work device, feature data recording a work time, feature data recording a work place, and feature data recording a work object attribute.
In one embodiment, the behavior characteristics include at least one of a characteristic capable of representing workload and workload change, a characteristic capable of representing operation cost and operation cost change, a characteristic capable of representing attribution, a characteristic capable of representing operation order, and a characteristic of financial settlement basis.
In one embodiment, the determining, according to the second feature data, an abnormality identification result of each behavior feature of each risk object includes:
and respectively calculating the deviation degree of the characteristic data of each behavior feature of each risk object in all the corresponding characteristic data of the same behavior feature to obtain the abnormal recognition result of each behavior feature of each risk object.
In one embodiment, the obtaining the abnormality identification result of each behavior feature of each risk object by calculating the degree of divergence of the feature data of each behavior feature of each risk object in all the corresponding feature data of the same behavior feature respectively includes:
respectively determining an upper quartile, a lower quartile and a quartile interval of characteristic data of each behavior characteristic;
determining a first threshold value of each row characteristic according to the upper quartile and the quartile spacing, and determining a second threshold value of each row characteristic according to the lower quartile and the quartile spacing;
and determining an abnormal identification result of each behavior feature of each risk object according to the first threshold value of each behavior feature, the second threshold value of each behavior feature and the feature data of each behavior feature of each risk object.
In one embodiment, at tka＞Qku+1.5IQRkOr tka＜QkL+1.5IQRkThen, the kth behavior feature of the a-th object is judged as a risk feature, and Q iskL+1.5IQRk≤tka≤Qku+1.5IQRkJudging that the kth behavior characteristic of the a-th object is a non-risk characteristic; wherein Q iskuAnd QkLUpper quartile and lower quartile of feature data representing the kth behavioral feature, IQRkQuartile range, t, of feature data representing the kth behavioral featurekaFeature data representing a kth behavioral feature of the a-th object.
In one embodiment, the determining the risk index of each risk object according to the abnormality identification result includes: and determining the risk index of each risk object according to the number of the risk characteristics of each risk object.
In one embodiment, the operation data is logistics operation data.
In one embodiment, the method further includes: and providing early warning service for the user according to the risk identification result.
A work activity risk identification device, the device comprising:
the operation data acquisition module is used for acquiring operation data;
the operation characteristic extraction module is used for extracting characteristic data of the operation data to obtain first characteristic data;
the characteristic processing module is used for carrying out statistical analysis on the first characteristic data according to the dimensionality of the risk objects to obtain second characteristic data, and the second characteristic data comprises characteristic data of each behavioral characteristic of each risk object;
the risk identification module is used for determining an abnormal identification result of each behavior characteristic of each risk object according to the second characteristic data, and determining a risk index of each risk object and a risk characteristic of each risk object according to the abnormal identification result;
and the result output module is used for outputting the risk identification result of each risk object, and the risk identification result comprises the risk index of each risk object and the risk characteristic of each risk object.
A computer device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, the processor implementing the following steps when executing the computer program:
acquiring operation data, and extracting characteristic data of the operation data to obtain first characteristic data;
performing statistical analysis on the first characteristic data according to the dimensions of the risk objects to obtain second characteristic data, wherein the second characteristic data comprise characteristic data of each behavior characteristic of each risk object;
determining an abnormal identification result of each behavior characteristic of each risk object according to the second characteristic data;
determining the risk index of each risk object and the risk characteristics of each risk object according to the abnormal identification result;
and outputting a risk identification result of each risk object, wherein the risk identification result comprises the risk index of each risk object and the risk characteristics of each risk object.
A computer-readable storage medium, on which a computer program is stored which, when executed by a processor, carries out the steps of:
acquiring operation data, and extracting characteristic data of the operation data to obtain first characteristic data;
performing statistical analysis on the first characteristic data according to the dimensions of the risk objects to obtain second characteristic data, wherein the second characteristic data comprise characteristic data of each behavior characteristic of each risk object;
determining an abnormal identification result of each behavior characteristic of each risk object according to the second characteristic data;
determining the risk index of each risk object and the risk characteristics of each risk object according to the abnormal identification result;
and outputting a risk identification result of each risk object, wherein the risk identification result comprises the risk index of each risk object and the risk characteristics of each risk object.
The operation behavior risk identification method, the operation behavior risk identification device, the computer equipment and the storage medium acquire operation data, perform characteristic data extraction on the operation data to obtain first characteristic data, perform statistical analysis on the first characteristic data according to the dimensionality of a risk object to obtain second characteristic data, wherein the second characteristic data comprises characteristic data of various behavior characteristics of various risk objects, determine an abnormal identification result of various behavior characteristics of various risk objects according to the second characteristic data, determine a risk index of each risk object and a risk characteristic of each risk object according to the abnormal identification result, and output a risk identification result of each risk object. By adopting the scheme, the operation behavior risk in the operation link of some enterprises (such as logistics enterprises) can be identified, abnormal behaviors in the operation process can be identified, the object to which the data recording behavior belongs is subjected to risk assessment, the enterprises can be helped to find the operation behavior risk in time, and abnormal points and risk objects are positioned, so that the enterprises are helped to control loss.
Drawings
FIG. 1 is a diagram of an application environment of a job behavior risk identification methodology in one embodiment;
FIG. 2 is a flowchart illustrating a job behavior risk identification methodology in one embodiment;
FIG. 3 is a flow chart illustrating the step of calculating the degree of divergence in one embodiment;
FIG. 4 is a block diagram showing the structure of a job behavior risk identification apparatus according to an embodiment;
FIG. 5 is a diagram illustrating an internal structure of a computer device according to an embodiment.
Detailed Description
In order to make the objects, technical solutions and advantages of the present application more apparent, the present application is described in further detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the present application and are not intended to limit the present application.
Fig. 1 is a schematic application environment diagram of a job behavior risk identification method according to an exemplary embodiment of the present application. As shown in fig. 1, the work behavior risk identification method is applied to a work behavior risk identification system including a first electronic device 12, a server 14, and a second electronic device 16.
The first electronic device 12 may include a terminal 122 and may further include a database device 124, wherein the terminal 122 may be, but is not limited to, various smartphones, laptops, tablets, personal computers, laptops, smartphones, tablets, and portable wearable devices (e.g., smart glasses, smart watches, etc.), and the database device 124 may be a log database. During operation, the first terminal 102 may run a certain application program, so as to send the collected related data to the server 14 directly or via a certain forwarding device, and the database device 124 may also send the recorded related data to the server 14 directly or via a certain forwarding device.
The server 14 may be implemented as a stand-alone server or as a server cluster comprised of a plurality of servers. Illustrated in fig. 1 is a case including a Hive server cluster 142 and a central server 144, but implementations of the server 14 are not limited thereto. In the operation process, the server 108 may operate a certain application program, obtain job data from data sent by the first electronic device 12, perform feature data extraction on the job data to obtain first feature data, perform statistical analysis on the first feature data according to the dimensions of the risk objects to obtain second feature data, where the second feature data includes feature data of each behavioral feature of each risk object, determine an abnormality identification result of each behavioral feature of each risk object according to the second feature data, determine a risk index of each risk object and a risk feature of each risk object according to the abnormality identification result, and output a risk identification result of each risk object to the second electronic device 16, where the risk identification result includes a risk index of each risk object and a risk feature of each risk object. Therefore, the identification of the operation behavior risks in the operation links of some enterprises (such as logistics enterprises) is realized.
The second electronic device 16 may comprise a personal computer 162, a notebook computer 164, etc., and in practice, the second electronic device 16 may obviously also comprise the following types of electronic devices: smart phones, tablets, and portable wearable devices (e.g., smart glasses, smart watches, etc.). In operation, second electronic device 16 may run an application to receive and present the risk identification results for each risk object sent by server 14.
The communication between the first electronic device 12, the server 14, and the second electronic device 16 may be based on a network connection between the three, which may include various types of wired or wireless networks. In an embodiment, the network may include a bluetooth, WIFI, ZigBee, or other near field communication network. In another embodiment, the Network may include a Public Switched Telephone Network (PSTN) and telecommunications networks such as the Internet. Of course, the network may also include both near field communication networks and remote communication networks.
In one embodiment, as shown in fig. 2, a job behavior risk identification method is provided, which is described by taking the method as an example applied to the server in fig. 1, and includes the following steps:
step 202, acquiring job data;
specifically, the operation data recorded in a scattered manner may be merged and summarized according to the operation flow, and the collected data of each key link of the operation process may be recorded and stored periodically (for example, every day) or in real time. The collected data may include job entry data and oplog data. The operation input data generally refers to data manually input by an operator operating an operation system, such as information of a sender phone, a sender address, a receiver address and the like input by a receiver in a package receiving link. The operation log data generally refers to log record data of operation, such as information of a piece collecting time, a piece collecting person and the like recorded by a background when an operator scans a package to determine that the piece collecting is completed. The terminal may be provided with an operating system, and an operator may manually enter relevant data into the operating system, and the operating system may also record operation log data, and the terminal may periodically or aperiodically (for example, in time) transmit the job entry data and the operation log data to the server, and the server receives the job entry data and the operation log data transmitted by the terminal. Further, the server may also acquire one or more of job entry data and operation log data from other devices, for example, the operation log data may be acquired from a log database device.
And step 204, extracting characteristic data of the operation data to obtain first characteristic data.
Specifically, feature data of key features of each operation link can be extracted from the operation data, the extracted feature data is used as the first feature data, and the key features can be selected according to actual conditions. The job data may also be data during the job of different types of enterprises, for example, data during the job of a logistics enterprise (logistics job data). But is not limited to data during the operation of the logistics enterprise.
And step 206, performing statistical analysis on the first characteristic data according to the dimensions of the risk objects to obtain second characteristic data, wherein the second characteristic data comprises characteristic data of each behavior characteristic of each risk object.
Here, the risk object may be selected according to actual needs, and may be, for example, a courier website or a courier.
Specifically, the first feature data may be processed according to a dimension of the risk object, so that the processed feature may meet a preset requirement, where the preset requirement may include one or more of a workload and a workload change, an operation cost and an operation cost change, an attribution relationship, an operation order, and a financial settlement basis, and the type and the number of the preset requirement may not be limited thereto. Wherein the processing of the first characteristic data may include one or more of cleansing, aggregating, and transforming of the data. Finally, feature data for the working process, i.e. second feature data, may be obtained, for example, each risk object corresponds to a risk behavior feature sequence, for example:
Sa＝{t1a,t2a,t3a,...,tka} (1)
wherein S isaA signature sequence representing an a-th risk object; t is tkaFeature data representing a kth behavioral feature of an a-th risk object.
And step 208, determining an abnormal identification result of each behavior feature of each risk object according to the second feature data.
Here, the anomaly identification result is used to characterize whether an anomaly exists in the corresponding behavior feature.
And step 210, determining the risk index of each risk object and the risk characteristics of each risk object according to the abnormal identification result.
Specifically, the abnormal recognition results of the behavioral characteristics of the same risk object may be summarized to obtain the risk index of each risk object, and the behavioral characteristics of each risk object having an abnormality may be used as the risk characteristics of the corresponding risk object. The summary may be to count the number of behavior features with abnormality in each behavior feature of the same risk object.
And 212, outputting a risk identification result of each risk object, wherein the risk identification result comprises a risk index of each risk object and a risk characteristic of each risk object.
Specifically, the risk identification result of each risk object may be output to a corresponding terminal (or user), and the risk identification result may further include a risk feature detail of each risk object, where data related to the risk feature detail may be acquired from the first feature data or the job data.
The job behavior risk identification method includes the steps of obtaining job data, extracting feature data of the job data to obtain first feature data, performing statistical analysis on the first feature data according to dimensions of risk objects to obtain second feature data, determining abnormal identification results of the various behavior features of the risk objects according to the second feature data, determining risk indexes of the risk objects and risk features of the risk objects according to the abnormal identification results, and outputting the risk identification results of the risk objects. By adopting the scheme, the identification of the operation behavior risk in the operation link of some enterprises (such as logistics enterprises) is realized, abnormal data in the operation process can be identified, the risk evaluation is carried out on the object to which the data recording behavior belongs, the enterprises are helped to find the operation behavior risk in time, and the abnormal point and the risk object are positioned, so that the enterprises are helped to control the loss. Meanwhile, the enterprise can monitor the risk object in real time through the scheme of the embodiment, so that the mode that the risk object can be found only when the risk loss is large or other people report is changed, and active discovery and real-time monitoring of the risk are realized. Meanwhile, by recognizing abnormal behaviors in the operation process in advance and outputting corresponding risk links, risk prompts can be provided for users (such as inspectors), the mode that risk analysis can only be performed through manual analysis is changed, automatic monitoring and analysis of the system are realized, monitoring cost can be reduced, and full-link monitoring of the operation links is realized.
In one embodiment, the step of acquiring the job data may include the steps of: acquiring job entry data and operation log data; and merging and summarizing the job entry data and the operation log data to obtain the job data.
For example, for logistics operation data, operation entry data and operation log data recorded in a scattered manner can be merged and summarized by taking an express bill number as a primary key according to an operation flow. In this embodiment, on the one hand, the operation entry data and the operation log data recorded in a scattered manner are concentrated, and the concentrated data are merged and summarized, so that convenience can be brought to subsequent feature data extraction, feature data processing and the like, and the efficiency of whole operation risk identification is further improved.
In one embodiment, the step of extracting the feature data from the job data to obtain the first feature data may include the steps of: extracting key characteristic data of each operation link according to the operation data, wherein the key characteristic data comprises at least one of the following data:
A) characteristic data capable of distinguishing the operation object, such as a parcel number, an express bill number, and the like;
B) characteristic data of an operation operator can be distinguished, such as an operator account number, a mobile phone number, a name and the like;
C) recording characteristic data of the working equipment, such as the equipment number of the handheld equipment, the equipment number of a mobile phone and the like;
D) recording characteristic data of the operation time, such as package pickup time, receiving time and the like;
E) recording characteristic data of a working place, such as a GPS address, a receiving address and the like;
F) characteristic data of the attributes of the job object, such as package type, transportation type, etc., for example, is recorded.
The method preferably extracts characteristic data of each operation link, such as A), B), C), D), E), F) and the like, so that the coverage of risk monitoring can be improved.
In one embodiment, the behavior feature includes one or more of the following features:
H) characteristics of workload and workload change can be reflected, such as a workload ring ratio increase rate;
I) the characteristic capable of representing the operation cost and the operation cost change can be the time cost, and the characteristic capable of representing the operation cost and the operation cost change can be the ring ratio increase rate of the operation time;
J) the characteristic of the attribution relationship can be embodied, wherein the attribution relationship can be the relationship between an express point and a superior distribution point, between a courier and the express point, between the express point and a city and the like;
K) the characteristic of the operation sequence can be embodied, wherein the operation sequence refers to the sequence of operation once;
l) can feature a financial settlement basis, which here can be a weight or a shipping area.
Among them, the above-mentioned behavior characteristics H) -L) are all preferable to improve the coverage of risk monitoring.
In one embodiment, the step of determining the abnormality identification result of each behavior feature of each risk object according to the second feature data may include the steps of: and respectively calculating the deviation degree of the characteristic data of each behavior feature of each risk object in all the corresponding characteristic data of the same behavior feature to obtain the abnormal recognition result of each behavior feature of each risk object.
For example, the degree of deviation of the kth behavior feature of the a-th risk object from all feature data of the kth behavior feature (i.e., feature data of the kth behavior feature of each risk object) may be calculated to obtain an abnormality recognition result of the kth behavior feature of the a-th risk object, that is, a recognition result representing whether there is an abnormality.
In this embodiment, whether each behavior feature of each risk object is abnormal is determined by calculating the degree of dissimilarity, and the algorithm is simple and easy to implement and has high accuracy.
In one embodiment, as shown in fig. 3, the step of obtaining the abnormality identification result of each behavior feature of each risk object by calculating the degree of deviation of the feature data of each behavior feature of each risk object in all the corresponding feature data of the same behavior feature may include the following steps:
step 302, respectively determining an upper quartile, a lower quartile and a quartile distance of characteristic data of each behavior characteristic;
specifically, assuming that m risk objects are included, the feature data of the current behavior feature may be determined first, for example, if the current behavior feature is the kth behavior feature, the feature data of the current behavior feature is the feature data of the kth behavior feature of the 1 st risk object, the feature data of the kth behavior feature of the 2 nd risk object, the feature data of the kth behavior feature of the 3 rd risk object, … …, and the feature data of the kth behavior feature of the mth risk object. And respectively calculating the upper quartile, the lower quartile and the quartile interval of the characteristic data of the current behavior characteristic according to the characteristic data of the current behavior characteristic. And selecting the next behavior feature (for example, the (k + 1) th behavior feature) as the current behavior feature, and repeating the calculation until the calculation of the upper quartile, the lower quartile and the quartile interval of the feature data of each behavior feature is completed.
304, determining a first threshold value of each behavior feature according to the upper quartile and the quartile interval, and determining a second threshold value of each behavior feature according to the lower quartile and the quartile interval;
specifically, the upper quartile and the quartile range of the feature data of the current behavior feature may be weighted and summed to obtain a first threshold of the current behavior feature, and then the lower quartile and the quartile range of the feature data of the current behavior feature may be weighted and summed to obtain a second threshold of the current behavior feature, where a weight of the weighted and summed may be set according to actual needs. And selecting the next behavior feature as the current behavior feature, and repeating the weighted summation process until the calculation of the first threshold value and the second threshold value of each behavior feature is completed.
Step 306, determining an abnormal recognition result of each behavioral characteristic of each risk object according to the first threshold value of each behavioral characteristic, the second threshold value of each behavioral characteristic, and the characteristic data of each behavioral characteristic of each risk object.
Specifically, the feature data of each behavior feature of each risk object may be compared with a corresponding first threshold and a corresponding second threshold of the behavior feature, respectively, and if the feature data of the current behavior feature of the current risk object is greater than the corresponding first threshold or smaller than the corresponding second threshold, determining that the current behavior feature of the current risk object is abnormal, that is, determining that the current behavior feature of the current risk object is a risk feature, if the feature data of the current behavior feature of the current risk object is between the second threshold and the first threshold (including the case that the feature data of the current behavior feature of the current risk object is equal to the second threshold or the first threshold), and judging that the current behavior characteristic of the current risk object is not abnormal, namely judging that the current behavior characteristic of the current risk object is a non-risk characteristic.
In one embodiment, at tka＞Qku+1.5IQRkOr tka＜QkL+1.5IQRkThen, the kth behavior feature of the a-th object is judged as a risk feature, and Q iskL+1.5IQRk≤tka≤Qku+1.5IQRkJudging that the kth behavior characteristic of the a-th object is a non-risk characteristic; wherein Q iskuAnd QkLUpper quartile and lower quartile of feature data representing the kth behavioral feature, IQRkQuartile range, t, of feature data representing the kth behavioral featurekaFeature data representing a kth behavioral feature of the a-th object.
Here, Qku+1.5IQRkCorresponding to the first threshold value, QkL+1.5IQRkCorresponding to the second threshold value described above.
The scheme in the embodiment is adopted to determine whether the behavior characteristics of each risk object are risk characteristics or non-risk characteristics, only comparison between data is needed, and the method is easy to implement and high in accuracy.
In one embodiment, when the kth behavior feature of the a-th object is a risk feature, the risk value of the kth behavior feature of the a-th object may be determined as a first numerical value, and when the kth behavior feature of the a-th object is a non-risk feature, the risk value of the kth behavior feature of the a-th object may be determined as a second numerical value. The magnitudes of the first numerical value and the second numerical value may be set according to actual needs, and generally, the first numerical value may be set to 1 and the second numerical value may be set to 0. The risk index of the a-th object may be determined by summing the risk values of the individual behavioral characteristics of the a-th object. Specifically, the expression (1) can be expressed by
Wherein, Risk _ indexaRepresenting the risk index of the a-th risk object. PtkaRepresenting a risk value representing a kth behavioral characteristic of an a-th risk object.
The risk index determined by the scheme of the embodiment can reflect the degree of dissimilarity of the corresponding risk object in all risk objects, and the risk index is used as a basis for judging whether the corresponding risk object has risks, so that the accuracy of a risk identification result can be improved.
In one embodiment, the step of determining the risk index of each risk object according to the abnormality identification result may include the steps of: and determining the risk index of each risk object according to the number of the risk characteristics of each risk object.
Specifically, the number of risk features of each risk object may be used as the risk index of the corresponding risk object, for example, if there are w risk features in the a-th risk object, the risk index is w, so that the data is more intuitive, and how many risk features exist in the corresponding risk object can be intuitively understood through the risk index.
In one embodiment, the early warning service can be further provided for the user according to the risk identification result. Specifically, the risk index of each risk object may be compared with a preset alarm threshold, and whether an alarm notification is sent to a corresponding user is determined according to a comparison result, the size of the alarm threshold may be set according to actual needs, different alarm thresholds may also be set for different risk objects, the same risk object may also set multiple different alarm thresholds, the multiple different alarm thresholds may be used to distinguish the risk level of the same risk object, for example, the alarm thresholds are respectively 3 and 8, when the risk index of a risk object is less than 3, the risk object is a risk-free object, when the risk index of a risk object is between 3 and 8 (including 3 and 8), the risk object is a low risk object, and when the risk index of a risk object is greater than 8, the risk object is a high risk object.
An application example of the job behavior risk identification method is provided below. In the application embodiment, the operation behavior risk identification method is applied to operation behavior risk identification of logistics operation, and an express delivery network is taken as an example of a risk identification object. The job behavior risk identification method in the application embodiment is implemented by taking the example that a Hive server cluster and a central server provide computing services, and comprises the following processes:
1) according to the operation flow, the operation data recorded dispersedly is merged and summarized, and the acquired data of the key links in the operation process is recorded and stored every day.
In a risk identification scheme taking an express delivery network as a risk identification object, operation data of links such as receiving, distribution, transportation and distribution can be collected and stored in a Hive server.
2) The feature data of the key features of each operation link is extracted, and the feature data specifically comprises various feature data such as a) to F).
In the risk identification scheme using the express delivery site as the risk identification object, data such as the time of receipt, the location of receipt (for example, GPS (Global Positioning System) data), the recipient, the device code, the sender name telephone of the package, the recipient address telephone of the package, and the routing information of the package at the time of operation of the express delivery site may be collected and stored in the hive server.
3) The extracted feature data are processed according to the dimensionality of the risk object, if risk identification is carried out on express delivery points, the features are processed according to the dimensionality of the express delivery points, and the processed features meet the following requirements:
(1) the workload and the workload change can be reflected;
(2) the operation cost and the change of the operation cost can be reflected;
(3) the affiliation can be embodied;
(4) the operation sequence can be embodied;
(5) a financial settlement basis;
in the risk identification scheme taking an express delivery network as a risk identification object, the extracted data can be processed by a feature processing algorithm into the network codes, the work volume ratio increase rate, the work volume of a receiver on the same day, the maximum number of the packages sent on the same call, the number of the places where the account logs in the handheld device, the average work duration of the received packages, the maximum package building number, the maximum number of the packages sent on the same call, the number of the packages sent on the same call in the time before the delivery time, the number of the packages with empty routes, the average in-transit duration of the packages and the like.
4) And calculating the abnormal condition of each behavior characteristic of each risk object according to the processed characteristics, evaluating whether each characteristic is abnormal or not according to the calculation result, and finally giving the risk index of each risk object according to the evaluation result.
In a risk identification scheme taking an express delivery network point as a risk identification object, the operation risk in an operation link can be obtained through a risk identification algorithm. The user may find a reason based on the job risk. For example, if the number of single-day mails of a part of mail users of the express delivery network is abnormal, the user can determine whether the business volume is increased by forging a false order in order to complete a business target and obtain a business volume subsidy based on the abnormal number of single-day mails. For another example, if there is a problem that job accounts of some network sites appear in a plurality of regions. Based on the fact that the express delivery network points are communicated with each other, the user can determine whether the packages collected by the network points with poor bill fee policies belong to the network points with good policies or not, and therefore the expense of bill fee is reduced.
5) And displaying the final calculation result through a page, for example, displaying the final calculation result to an inspection department, wherein the displayed content has the risk index, the risk characteristics and the risk characteristic details of each risk object. The user can directly find the reason of risk generation according to the result, so that analysis and investigation are performed in a targeted manner.
In the embodiment, the real-time monitoring of the risk objects is provided for the inspection department, the high-risk objects are early warned in time, the mode that the risk objects can be found only when the risk loss is large or other people report is changed, and the active discovery and real monitoring of the risk are realized. Meanwhile, the abnormal behavior in the operation process is recognized in advance through a risk recognition algorithm, corresponding risk links are output, risk prompts are provided for inspectors, the mode that risk analysis can only be carried out through manual analysis is changed, and automatic monitoring and analysis of the system are achieved. In addition, the risk identification algorithm is used for identifying the key operation behaviors, so that the problems that the risk monitoring is difficult to cover comprehensively and the monitoring cost is high can be solved, and the full link monitoring of the operation link can be realized.
It should be understood that although the various steps in the flow charts of fig. 2-3 are shown in order as indicated by the arrows, the steps are not necessarily performed in order as indicated by the arrows. The steps are not performed in the exact order shown and described, and may be performed in other orders, unless explicitly stated otherwise. Moreover, at least some of the steps in fig. 2-3 may include multiple sub-steps or multiple stages that are not necessarily performed at the same time, but may be performed at different times, and the order of performance of the sub-steps or stages is not necessarily sequential, but may be performed in turn or alternating with other steps or at least some of the sub-steps or stages of other steps.
In one embodiment, as shown in fig. 4, there is provided a work activity risk identification device including: a job data acquisition module 402, a job feature extraction module 404, a feature processing module 406, a risk identification module 408, and a result output module 410, wherein:
a job data acquisition module 402 for acquiring job data;
a job feature extraction module 404, configured to perform feature data extraction on job data to obtain first feature data;
the feature processing module 406 is configured to perform statistical analysis on the first feature data according to the dimensions of the risk objects to obtain second feature data, where the second feature data includes feature data of each behavioral feature of each risk object;
the risk identification module 408 is configured to determine an abnormal identification result of each behavior feature of each risk object according to the second feature data, and determine a risk index of each risk object and a risk feature of each risk object according to the abnormal identification result;
and a result output module 410, configured to output a risk identification result of each risk object, where the risk identification result includes a risk index of each risk object and a risk characteristic of each risk object.
When the method is applied to a Hive server cluster and a central server, the job data acquisition module 402 may be deployed in the Hive server cluster, and the job feature extraction module 404, the feature processing module 406, the risk identification module 408, and the result output module 410 may be deployed in the central server.
In one embodiment, the job data obtaining module 402 may obtain job entry data and operation log data, and combine and summarize the job entry data and the operation log data to obtain job data.
In one embodiment, the job feature extraction module 404 may extract key feature data of each job link according to the job data, where the key feature data includes at least one of the following: feature data capable of distinguishing a work object, feature data capable of distinguishing a work operator, feature data recording a work device, feature data recording a work time, feature data recording a work place, and feature data recording a work object attribute.
In one embodiment, the behavior characteristics include at least one of a characteristic capable of representing workload and workload change, a characteristic capable of representing operation cost and operation cost change, a characteristic capable of representing attribution, a characteristic capable of representing operation order, and a characteristic of financial settlement basis.
In one embodiment, the determining, according to the second feature data, an abnormality identification result of each behavior feature of each risk object includes:
and respectively calculating the deviation degree of the characteristic data of each behavior feature of each risk object in all the corresponding characteristic data of the same behavior feature to obtain the abnormal recognition result of each behavior feature of each risk object.
In one embodiment, the risk identification module 408 may determine an upper quartile, a lower quartile and a quartile range of each behavior feature, respectively, determine a first threshold of each behavior feature according to the upper quartile and the quartile range, determine a second threshold of each behavior feature according to the lower quartile and the quartile range, and determine an abnormal identification result of each behavior feature of each risk object according to the first threshold of each behavior feature, the second threshold of each behavior feature, and the feature data of each behavior feature of each risk object.
In one embodiment, at tka＞Qku+1.5IQRkOr tka＜QkL+1.5IQRkThen, the kth behavior feature of the a-th object is judged as a risk feature, and Q iskL+1.5IQRk≤tka≤Qku+1.5IQRkJudging that the kth behavior characteristic of the a-th object is a non-risk characteristic; wherein Q iskuAnd QkLUpper quartile and lower quartile of feature data representing the kth behavioral feature, IQRkQuartile range, t, of feature data representing the kth behavioral featurekaFeature data representing a kth behavioral feature of the a-th object.
In one embodiment, the risk identification module 408 may determine a risk index for each risk object based on the number of risk features for each risk object.
In one embodiment, the operation data is logistics operation data.
In one embodiment, the apparatus may further include an early warning module (not shown), and the early warning module may provide an early warning service to the user according to the risk identification result.
For specific limitations of the job behavior risk identification device, reference may be made to the above limitations of the job behavior risk identification method, and details are not repeated here. The modules in the job behavior risk identification device may be implemented in whole or in part by software, hardware, and a combination thereof. The modules can be embedded in a hardware form or independent from a processor in the computer device, and can also be stored in a memory in the computer device in a software form, so that the processor can call and execute operations corresponding to the modules.
In one embodiment, a computer device is provided, which may be a server, the internal structure of which may be as shown in fig. 5. The computer device includes a processor, a memory, a network interface, and a database connected by a system bus. Wherein the processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device comprises a nonvolatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program, and a database. The internal memory provides an environment for the operation of an operating system and computer programs in the non-volatile storage medium. The database of the computer device is used for storing relevant data required by or obtained in the job behavior risk identification. The network interface of the computer device is used for communicating with an external terminal through a network connection. The computer program is executed by a processor to implement a job behavior risk identification method.
Those skilled in the art will appreciate that the architecture shown in fig. 5 is merely a block diagram of some of the structures associated with the disclosed aspects and is not intended to limit the computing devices to which the disclosed aspects apply, as particular computing devices may include more or less components than those shown, or may combine certain components, or have a different arrangement of components.
In one embodiment, a computer device is provided, comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, the processor implementing the following steps when executing the computer program:
acquiring operation data, and extracting characteristic data of the operation data to obtain first characteristic data;
performing statistical analysis on the first characteristic data according to the dimensions of the risk objects to obtain second characteristic data, wherein the second characteristic data comprise characteristic data of each behavior characteristic of each risk object;
determining an abnormal identification result of each behavior characteristic of each risk object according to the second characteristic data;
determining the risk index of each risk object and the risk characteristics of each risk object according to the abnormal identification result;
and outputting a risk identification result of each risk object, wherein the risk identification result comprises the risk index of each risk object and the risk characteristics of each risk object.
In one embodiment, when the processor executes the computer program to implement the above step of acquiring job data, the following steps are specifically implemented:
acquiring job entry data and operation log data;
and merging and summarizing the operation input data and the operation log data to obtain the operation data.
In one embodiment, when the processor executes the computer program to implement the above-mentioned step of extracting the feature data from the job data to obtain the first feature data, the following steps are specifically implemented: extracting key characteristic data of each operation link according to the operation data, wherein the key characteristic data comprises at least one of the following data: feature data capable of distinguishing a work object, feature data capable of distinguishing a work operator, feature data recording a work device, feature data recording a work time, feature data recording a work place, and feature data recording a work object attribute.
In one embodiment, the behavior characteristics include at least one of a characteristic capable of representing workload and workload change, a characteristic capable of representing operation cost and operation cost change, a characteristic capable of representing attribution, a characteristic capable of representing operation order, and a characteristic of financial settlement basis.
In one embodiment, when the processor executes the computer program to implement the above-mentioned step of determining the abnormality identification result of each behavior feature of each risk object according to the second feature data, the following steps are specifically implemented: and respectively calculating the deviation degree of the characteristic data of each behavior feature of each risk object in all the corresponding characteristic data of the same behavior feature to obtain the abnormal recognition result of each behavior feature of each risk object.
In one embodiment, when the processor executes the computer program to implement the above step of obtaining the abnormality identification result of each behavior feature of each risk object by calculating the degree of divergence of the feature data of each behavior feature of each risk object in all the corresponding feature data of the same behavior feature, the following steps are specifically implemented:
respectively determining an upper quartile, a lower quartile and a quartile interval of characteristic data of each behavior characteristic;
determining a first threshold value of each row characteristic according to the upper quartile and the quartile spacing, and determining a second threshold value of each row characteristic according to the lower quartile and the quartile spacing;
and determining an abnormal identification result of each behavior feature of each risk object according to the first threshold value of each behavior feature, the second threshold value of each behavior feature and the feature data of each behavior feature of each risk object.
In one embodiment, at tka＞Qku+1.5IQRkOr tka＜QkL+1.5IQRkThen, the kth behavior feature of the a-th object is judged as a risk feature, and Q iskL+1.5IQRk≤tka≤Qku+1.5IQRkJudging that the kth behavior characteristic of the a-th object is a non-risk characteristic; wherein Q iskuAnd QkLUpper quartile and lower quartile of feature data representing the kth behavioral feature, IQRkQuartile range, t, of feature data representing the kth behavioral featurekaFeature data representing a kth behavioral feature of the a-th object.
In one embodiment, when the processor executes the computer program to implement the above step of determining the risk index of each risk object according to the abnormality identification result, the following steps are specifically implemented: and determining the risk index of each risk object according to the number of the risk characteristics of each risk object.
In one embodiment, the operation data is logistics operation data.
In one embodiment, the processor, when executing the computer program, further performs the steps of: and providing early warning service for the user according to the risk identification result.
In one embodiment, a computer-readable storage medium is provided, having a computer program stored thereon, which when executed by a processor, performs the steps of:
acquiring operation data, and extracting characteristic data of the operation data to obtain first characteristic data;
performing statistical analysis on the first characteristic data according to the dimensions of the risk objects to obtain second characteristic data, wherein the second characteristic data comprise characteristic data of each behavior characteristic of each risk object;
determining an abnormal identification result of each behavior characteristic of each risk object according to the second characteristic data;
determining the risk index of each risk object and the risk characteristics of each risk object according to the abnormal identification result;
and outputting a risk identification result of each risk object, wherein the risk identification result comprises the risk index of each risk object and the risk characteristics of each risk object.
In one embodiment, when the computer program is executed by the processor to implement the above-mentioned step of acquiring job data, the following steps are specifically implemented:
acquiring job entry data and operation log data;
and merging and summarizing the operation input data and the operation log data to obtain the operation data.
In one embodiment, when the computer program is executed by the processor to implement the above-mentioned step of extracting the feature data of the job data to obtain the first feature data, the following steps are specifically implemented: extracting key characteristic data of each operation link according to the operation data, wherein the key characteristic data comprises at least one of the following data: feature data capable of distinguishing a work object, feature data capable of distinguishing a work operator, feature data recording a work device, feature data recording a work time, feature data recording a work place, and feature data recording a work object attribute.
In one embodiment, the behavior characteristics include at least one of a characteristic capable of representing workload and workload change, a characteristic capable of representing operation cost and operation cost change, a characteristic capable of representing attribution, a characteristic capable of representing operation order, and a characteristic of financial settlement basis.
In one embodiment, when the computer program is executed by the processor to implement the above-mentioned step of determining the abnormality identification result of each behavior feature of each risk object according to the second feature data, the following steps are specifically implemented: and respectively calculating the deviation degree of the characteristic data of each behavior feature of each risk object in all the corresponding characteristic data of the same behavior feature to obtain the abnormal recognition result of each behavior feature of each risk object.
In one embodiment, when the computer program is executed by the processor to implement the above step of obtaining the abnormality identification result of each behavior feature of each risk object by calculating the degree of divergence of the feature data of each behavior feature of each risk object in all the corresponding feature data of the same behavior feature, the following steps are specifically implemented:
respectively determining an upper quartile, a lower quartile and a quartile interval of characteristic data of each behavior characteristic;
determining a first threshold value of each row characteristic according to the upper quartile and the quartile spacing, and determining a second threshold value of each row characteristic according to the lower quartile and the quartile spacing;
and determining an abnormal identification result of each behavior feature of each risk object according to the first threshold value of each behavior feature, the second threshold value of each behavior feature and the feature data of each behavior feature of each risk object.
In one embodiment, at tka＞Qku+1.5IQRkOr tka＜QkL+1.5IQRkThen, the kth behavior feature of the a-th object is judged as a risk feature, and Q iskL+1.5IQRk≤tka≤Qku+1.5IQRkJudging that the kth behavior characteristic of the a-th object is a non-risk characteristic; wherein Q iskuAnd QkLUpper quartile and lower quartile of feature data representing the kth behavioral feature, IQRkQuartile range, t, of feature data representing the kth behavioral featurekaFeature data representing a kth behavioral feature of the a-th object.
In one embodiment, when the computer program is executed by the processor to implement the above step of determining the risk index of each risk object according to the abnormality recognition result, the following steps are specifically implemented: and determining the risk index of each risk object according to the number of the risk characteristics of each risk object.
In one embodiment, the operation data is logistics operation data.
In one embodiment, the computer program when executed by the processor further performs the steps of: and providing early warning service for the user according to the risk identification result.
It will be understood by those skilled in the art that all or part of the processes of the methods of the embodiments described above can be implemented by hardware related to instructions of a computer program, which can be stored in a non-volatile computer-readable storage medium, and when executed, can include the processes of the embodiments of the methods described above. Any reference to memory, storage, database, or other medium used in the embodiments provided herein may include non-volatile and/or volatile memory, among others. Non-volatile memory can include read-only memory (ROM), Programmable ROM (PROM), Electrically Programmable ROM (EPROM), Electrically Erasable Programmable ROM (EEPROM), or flash memory. Volatile memory can include Random Access Memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in a variety of forms such as Static RAM (SRAM), Dynamic RAM (DRAM), Synchronous DRAM (SDRAM), Double Data Rate SDRAM (DDRSDRAM), Enhanced SDRAM (ESDRAM), Synchronous Link DRAM (SLDRAM), Rambus Direct RAM (RDRAM), direct bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).
The technical features of the above embodiments can be arbitrarily combined, and for the sake of brevity, all possible combinations of the technical features in the above embodiments are not described, but should be considered as the scope of the present specification as long as there is no contradiction between the combinations of the technical features.
The above examples only express several embodiments of the present application, and the description thereof is more specific and detailed, but not construed as limiting the scope of the invention. It should be noted that, for a person skilled in the art, several variations and modifications can be made without departing from the concept of the present application, which falls within the scope of protection of the present application. Therefore, the protection scope of the present patent shall be subject to the appended claims.
Claims (10)
1. A job behavior risk identification method, the method comprising:
acquiring operation data, and extracting characteristic data of the operation data to obtain first characteristic data;
performing statistical analysis on the first characteristic data according to the dimensionality of the risk objects to obtain second characteristic data, wherein the second characteristic data comprises characteristic data of each behavior characteristic of each risk object;
determining an abnormal identification result of each behavior characteristic of each risk object according to the second characteristic data;
determining a risk index of each risk object and a risk characteristic of each risk object according to the abnormal recognition result;
and outputting a risk identification result of each risk object, wherein the risk identification result comprises the risk index of each risk object and the risk characteristics of each risk object.
2. The method of claim 1, wherein the obtaining job data comprises:
acquiring job entry data and operation log data;
and merging and summarizing the operation input data and the operation log data to obtain the operation data.
3. The method of claim 1, wherein the performing feature data extraction on the job data to obtain first feature data comprises:
extracting key feature data of each operation link according to the operation data, wherein the key feature data comprise at least one of the following data:
feature data capable of distinguishing a work object, feature data capable of distinguishing a work operator, feature data recording a work device, feature data recording a work time, feature data recording a work place, and feature data recording a work object attribute.
4. The method according to claim 1, wherein the behavior characteristics include at least one of a characteristic capable of representing a workload and a workload change, a characteristic capable of representing a work cost and a work cost change, a characteristic capable of representing an attribution relationship, a characteristic capable of representing a work order, and a characteristic of a financial settlement basis.
5. The method according to any one of claims 1 to 4, wherein the determining, from the second feature data, the abnormal recognition result of each behavior feature of each risk object comprises:
and respectively calculating the deviation degree of the feature data of each behavior feature of each risk object in all the corresponding feature data of the same behavior feature to obtain the abnormal identification result of each behavior feature of each risk object.
6. The method according to claim 5, wherein the obtaining the abnormal recognition result of each behavior feature of each risk object by respectively calculating the degree of dissimilarity of the feature data of each behavior feature of each risk object in all the feature data of the same corresponding behavior feature comprises:
respectively determining an upper quartile, a lower quartile and a quartile distance of the feature data of each behavior feature;
determining a first threshold value of each behavior characteristic according to the upper quartile and the quartile distance, and determining a second threshold value of each behavior characteristic according to the lower quartile and the quartile distance;
determining an abnormal recognition result of each behavior characteristic of each risk object according to the first threshold value of each behavior characteristic, the second threshold value of each behavior characteristic and the characteristic data of each behavior characteristic of each risk object;
preferably, at tka＞Qku+1.5IQRkOr tka＜QkL+1.5IQRkThen, the kth behavior feature of the a-th object is judged as a risk feature, and Q iskL+1.5IQRk≤tka≤Qku+1.5IQRkJudging that the kth behavior characteristic of the a-th object is a non-risk characteristic; wherein Q iskuAnd QkLUpper quartile and lower quartile of feature data representing the kth behavioral feature, IQRkQuartile range, t, of feature data representing the kth behavioral featurekaFeature data representing a kth behavioral feature of the a-th object;
further preferably, the determining the risk index of each risk object according to the abnormality identification result includes: determining a risk index for each of the risk objects based on the number of risk features for each of the risk objects.
7. The method of claim 5, wherein the operational data is logistics operational data;
the method further comprises the following steps: and providing early warning service for the user according to the risk identification result.
8. An operational behavioral risk identification apparatus, characterized in that the apparatus comprises:
the operation data acquisition module is used for acquiring operation data;
the operation characteristic extraction module is used for extracting characteristic data of the operation data to obtain first characteristic data;
the characteristic processing module is used for carrying out statistical analysis on the first characteristic data according to the dimensionality of the risk objects to obtain second characteristic data, and the second characteristic data comprises characteristic data of each behavioral characteristic of each risk object;
a risk identification module, configured to determine an abnormal identification result of each behavior feature of each risk object according to the second feature data, and determine a risk index of each risk object and a risk feature of each risk object according to the abnormal identification result;
and the result output module is used for outputting a risk identification result of each risk object, and the risk identification result comprises the risk index of each risk object and the risk characteristic of each risk object.
9. A computer device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, characterized in that the steps of the method of any of claims 1 to 7 are implemented when the computer program is executed by the processor.
10. A computer-readable storage medium, on which a computer program is stored, which, when being executed by a processor, carries out the steps of the method of any one of claims 1 to 7.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010166185.9A CN111382944A (en) | 2020-03-11 | 2020-03-11 | Job behavior risk identification method and device, computer equipment and storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010166185.9A CN111382944A (en) | 2020-03-11 | 2020-03-11 | Job behavior risk identification method and device, computer equipment and storage medium |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN111382944A true CN111382944A (en) | 2020-07-07 |
Family
ID=71221506
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202010166185.9A Pending CN111382944A (en) | 2020-03-11 | 2020-03-11 | Job behavior risk identification method and device, computer equipment and storage medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN111382944A (en) |
Cited By (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111815238A (en) * | 2020-07-14 | 2020-10-23 | 上海燕汐软件信息科技有限公司 | Logistics profit supervision method, device and system |
| CN111967321A (en) * | 2020-07-15 | 2020-11-20 | 菜鸟智能物流控股有限公司 | Video data processing method and device, electronic equipment and storage medium |
| CN113935696A (en) * | 2021-12-14 | 2022-01-14 | 国家***邮政业安全中心 | Consignment behavior abnormity analysis method and system, electronic equipment and storage medium |
Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104915846A (en) * | 2015-06-18 | 2015-09-16 | 北京京东尚科信息技术有限公司 | Electronic commerce time sequence data anomaly detection method and system |
| CN110210751A (en) * | 2019-05-29 | 2019-09-06 | 国家电网有限公司 | Upkeep operation risk analysis method, device and terminal neural network based |
-
2020
- 2020-03-11 CN CN202010166185.9A patent/CN111382944A/en active Pending
Patent Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104915846A (en) * | 2015-06-18 | 2015-09-16 | 北京京东尚科信息技术有限公司 | Electronic commerce time sequence data anomaly detection method and system |
| CN110210751A (en) * | 2019-05-29 | 2019-09-06 | 国家电网有限公司 | Upkeep operation risk analysis method, device and terminal neural network based |
Cited By (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111815238A (en) * | 2020-07-14 | 2020-10-23 | 上海燕汐软件信息科技有限公司 | Logistics profit supervision method, device and system |
| CN111815238B (en) * | 2020-07-14 | 2023-08-08 | 上海燕汐软件信息科技有限公司 | Logistics profit supervision method, device and system |
| CN111967321A (en) * | 2020-07-15 | 2020-11-20 | 菜鸟智能物流控股有限公司 | Video data processing method and device, electronic equipment and storage medium |
| CN111967321B (en) * | 2020-07-15 | 2024-04-05 | 菜鸟智能物流控股有限公司 | Video data processing method, device, electronic equipment and storage medium |
| CN113935696A (en) * | 2021-12-14 | 2022-01-14 | 国家***邮政业安全中心 | Consignment behavior abnormity analysis method and system, electronic equipment and storage medium |
| CN113935696B (en) * | 2021-12-14 | 2022-04-08 | 国家***邮政业安全中心 | Consignment behavior abnormity analysis method and system, electronic equipment and storage medium |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US10140642B2 (en) | Automated customer engagement and issue location, prediction, and response through utilization of public and private data sources | |
| CN111382944A (en) | Job behavior risk identification method and device, computer equipment and storage medium | |
| CN111177714B (en) | Abnormal behavior detection method and device, computer equipment and storage medium | |
| CN111859384B (en) | Abnormal event monitoring method, device, computer equipment and storage medium | |
| CN111475370A (en) | Operation and maintenance monitoring method, device and equipment based on data center and storage medium | |
| CN111143163B (en) | Data monitoring method, device, computer equipment and storage medium | |
| CN109508903B (en) | Risk assessment method, risk assessment device, computer equipment and storage medium | |
| CN110830438A (en) | Abnormal log warning method and device and electronic equipment | |
| CN111385123A (en) | WEB service distributed intelligent monitoring method, device, computer equipment and storage medium | |
| CN109840183B (en) | Data center grading early warning method and device and storage medium | |
| WO2019062192A1 (en) | Salesperson behavior risk screening management method, application server and computer-readable storage medium | |
| CN111931189A (en) | API interface transfer risk detection method and device and API service system | |
| CN114638391A (en) | Waybill risk scene identification processing method and device, computer equipment and medium | |
| CN112163154A (en) | Data processing method, device, equipment and storage medium | |
| CN111831817A (en) | Questionnaire generation and analysis method and device, computer equipment and readable storage medium | |
| CN109726188B (en) | Logistics log processing method and device, computer equipment and readable storage medium | |
| CN109218062B (en) | Internet service alarm method and device based on confidence interval | |
| CN115760390A (en) | Service data processing method and device and network point terminal equipment | |
| CN111489165B (en) | Data processing method and device of target object and server | |
| CN112765213A (en) | Second-generation credit investigation automation query method, system and computer equipment | |
| CN113672507A (en) | Software source code detection method and device, computer equipment and storage medium | |
| US20150095099A1 (en) | Rapid assessment of emerging risks | |
| CN112508207A (en) | Fault detection method, device, equipment and storage medium | |
| CN114663107A (en) | Customer complaint risk prediction method, apparatus, computer device and storage medium | |
| WO2020055230A1 (en) | System and method for performing vulnerability assessment of a computer network |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| RJ01 | Rejection of invention patent application after publication | ||
| RJ01 | Rejection of invention patent application after publication |
Application publication date: 20200707 |