CN-122022976-A - Abnormal behavior handling method, apparatus, device, storage medium, and program product

CN122022976ACN 122022976 ACN122022976 ACN 122022976ACN-122022976-A

Abstract

The application provides an abnormal behavior treatment method which can be applied to the technical fields of big data and financial science and technology. The method comprises the steps of obtaining static attribute information of a target area and multi-mode data generated by the target area, wherein the target area represents a physical area with service attributes, the multi-mode data represents data generated by an entity object set associated with the service attributes in the target area, matching the static attribute information with the multi-mode data to generate state information of the entity object set in the target area, detecting the state information of the entity object set in the target area, determining the confidence that the entity object set in the target area has abnormal behaviors, and disposing the abnormal behaviors based on the relation between the confidence that the entity object set has the abnormal behaviors and a preset confidence threshold. The application also provides an abnormal behavior handling device, equipment, a storage medium and a program product.

Inventors

Qiu Shaoxin
ZHOU YUNPENG
XU XIANG
RAO XIANG

Assignees

中国工商银行股份有限公司

Dates

Publication Date: 20260512
Application Date: 20260127

Claims (12)

1. A method of handling abnormal behavior, comprising: Acquiring static attribute information of a target area and multi-mode data generated by the target area, wherein the target area represents a physical area with service attributes, and the multi-mode data represents data generated by a set of entity objects associated with the service attributes in the target area; matching the static attribute information with the multi-mode data to generate state information of the entity object set in the target area; Detecting state information of the entity object set in the target area, and determining confidence that the entity object set in the target area has abnormal behaviors; and processing the abnormal behavior based on the relation between the confidence coefficient of the abnormal behavior of the entity object set and a preset confidence coefficient threshold value.
2. The method of claim 1, wherein acquiring the multi-modal data generated by the target area comprises: based on a preset video acquisition device, acquiring video stream data of the target area; acquiring sensor data of the target area based on a preset internet of things sensor; And carrying out space-time alignment on the video stream data and the sensor data to obtain the multi-mode data.
3. The method of claim 2, wherein the spatiotemporal alignment of the video stream data and the sensor data to obtain the multi-modal data comprises: Acquiring a first time sequence of the video stream data and a second time sequence of the sensor data, and determining a time mapping relation between the first time sequence and the second time sequence; Acquiring a first space coordinate system of the video stream data and a second space coordinate system of the sensor data, and determining a space mapping relation between the first space coordinate system and the second space coordinate system; and based on the time mapping relation and the space mapping relation, carrying out space-time alignment on the video stream data and the sensor data to obtain the multi-mode data.
4. The method of claim 1, wherein the set of entity objects comprises a plurality of entity objects, wherein matching the static attribute information with the multimodal data to generate state information for the set of entity objects in the target region comprises: Extracting characteristics of the multi-mode data; mapping the extracted features with the static attribute information to obtain the corresponding relation between every two entity objects; And generating state information of the entity object set based on the corresponding relation between every two entity objects.
5. The method of claim 1, wherein the status information includes location information, detecting the status information of the set of entity objects in the target area, determining a confidence that the set of entity objects in the target area has abnormal behavior, comprising: acquiring position information of the entity object set in a preset first continuous time period from a detection result; determining a displacement of the set of physical objects over the continuous period of time based on the location information; And determining the confidence that the entity object set has abnormal behaviors in the target area based on the displacement of the entity object set in the continuous time period and the deviation of a preset displacement threshold value.
6. The method of claim 1, wherein detecting the state information of the set of entity objects in the target area, determining a confidence that the set of entity objects in the target area has abnormal behavior, further comprises: Determining the duration that the position information of the entity object set is in an unauthorized physical area from a preset second continuous time period; And determining the confidence that the entity object set has abnormal behaviors in the target area based on the deviation of the time length of the position information of the entity object set in the unauthorized physical area and a preset time length threshold value.
7. The method of claim 1, wherein handling the abnormal behavior based on a relationship between a confidence level that the set of entity objects has abnormal behavior and a preset confidence threshold comprises: under the condition that the confidence coefficient is larger than or equal to the confidence coefficient threshold value, determining a target confidence coefficient interval corresponding to the confidence coefficient from a preset database, The database stores a multi-level confidence interval and a multi-level treatment rule, the multi-level confidence interval comprises a first-level confidence interval and a second-level confidence interval, the minimum confidence of the second-level confidence interval is the confidence threshold, the minimum confidence of the first-level confidence interval is the maximum confidence of the second-level confidence interval, the multi-level treatment rule sequentially comprises a first-level treatment rule and a second-level treatment rule from high to low according to treatment intensity, the multi-level confidence interval corresponds to the multi-level treatment rule one by one, and the target confidence interval is one of the multi-level confidence intervals; And when the confidence coefficient falls into the target confidence coefficient interval, acquiring a target treatment rule corresponding to the target confidence coefficient interval from the database, and treating the abnormal behavior according to the target treatment rule.
8. The method of claim 1, wherein after determining a confidence that the set of entity objects in the target region has abnormal behavior, the method further comprises: Determining an update coefficient of the confidence coefficient based on the service attribute under the condition that the confidence coefficient of the abnormal behavior exists in the entity object set and is larger than or equal to the confidence coefficient threshold; updating the confidence coefficient based on the update coefficient; And processing the abnormal behavior based on the relation between the updated confidence coefficient and the confidence coefficient threshold value.
9. An abnormal behavior handling apparatus, the apparatus comprising: The system comprises a data acquisition module, a service attribute generation module and a service attribute generation module, wherein the data acquisition module is used for acquiring static attribute information of a target area and multi-mode data generated by the target area, the target area represents a physical area with the service attribute, and the multi-mode data represents data generated by an entity object set associated with the service attribute in the target area; The data matching module is used for matching the static attribute information with the multi-mode data to generate state information of the entity object set in the target area; an anomaly detection module for detecting the state information of the entity object set in the target area, determining whether the entity object set in the target area has abnormal behavior, and And the exception handling module is used for handling the abnormal behavior based on the relation between the confidence degree of the abnormal behavior of the entity object set and a preset confidence threshold value.
10. An electronic device, comprising: one or more processors; A memory for storing one or more computer programs, Characterized in that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1-8.
11. A computer-readable storage medium, on which a computer program or instructions is stored, which, when executed by a processor, carries out the steps of the method according to any one of claims 1-8.
12. A computer program product comprising a computer program or instructions which, when executed by a processor, implement the steps of the method according to any one of claims 1 to 8.

Description

Abnormal behavior handling method, apparatus, device, storage medium, and program product Technical Field The present application relates to the technical field of big data and financial science and technology, and more particularly, to an abnormal behavior handling method, apparatus, device, storage medium, and program product. Background With the deep advancement of digital transformation of financial institutions and the continuous improvement of intelligent wind control requirements, the abnormal behavior monitoring and risk handling requirements of banking website working areas are increasingly complex and fine. At present, monitoring of a bank website working area faces the problems that performance limitation exists in manual monitoring, monitoring staff needs to pay attention to multiple paths of video pictures at the same time, abnormal behavior identification capability is limited, timeliness problem exists in system response, obvious delay exists from occurrence of events to completion of treatment, real-time risk prevention and control requirements are difficult to meet, systematic defects exist, effective coordination is lacking among different monitoring systems, and complete risk identification, verification and treatment closed loops cannot be formed. Disclosure of Invention In view of the above problems, the present application provides an abnormal behavior handling method, apparatus, device, storage medium and program product, which generate status information of a set of entity objects by matching static attribute information of a target area with generated multi-modal data, so as to perform hierarchical handling on detected abnormal behaviors, solve the problems of untimely recognition and inaccurate handling of abnormal behaviors by current banking outlets, and improve real-time performance of risk prevention and control of financial institutions in critical places. According to the first aspect of the application, an abnormal behavior treatment method is provided, which comprises the steps of obtaining static attribute information of a target area and multi-mode data generated by the target area, wherein the target area represents a physical area with business attributes, the multi-mode data represents data generated by an entity object set associated with the business attributes in the target area, matching the static attribute information with the multi-mode data to generate state information of the entity object set in the target area, detecting the state information of the entity object set in the target area, determining the confidence that the entity object set in the target area has abnormal behaviors, and treating the abnormal behaviors based on the relation between the confidence that the entity object set has abnormal behaviors and a preset confidence threshold. According to the embodiment of the application, the multi-mode data generated by the target area is acquired, wherein the multi-mode data comprises the steps of acquiring video stream data of the target area based on a preset video acquisition device, acquiring sensor data of the target area based on a preset internet of things sensor, and performing space-time alignment on the video stream data and the sensor data to obtain the multi-mode data. According to the embodiment of the application, the video stream data and the sensor data are subjected to space-time alignment to obtain multi-mode data, wherein the method comprises the steps of obtaining a first time sequence of the video stream data and a second time sequence of the sensor data, determining a time mapping relation of the first time sequence and the second time sequence, obtaining a first space coordinate system of the video stream data and a second space coordinate system of the sensor data, determining a space mapping relation of the first space coordinate system and the second space coordinate system, and carrying out space-time alignment on the video stream data and the sensor data based on the time mapping relation and the space mapping relation to obtain the multi-mode data. According to the embodiment of the application, the entity object set comprises a plurality of entity objects, static attribute information and multi-modal data are matched to generate state information of the entity object set in a target area, the method comprises the steps of extracting characteristics of the multi-modal data, mapping the extracted characteristics with the static attribute information to obtain a corresponding relation between every two entity objects, and generating the state information of the entity object set based on the corresponding relation between every two entity objects. According to the embodiment of the application, the state information comprises position information, the state information of the entity object set in the target area is detected, and the confidence level of the abnormal behavior of the entity object set in the target area is determ