CN110992072A

CN110992072A - Abnormal order prediction method and system

Info

Publication number: CN110992072A
Application number: CN201811463983.7A
Authority: CN
Inventors: 缪莹莹; 王志龙; 时少辉
Original assignee: Beijing Didi Infinity Technology and Development Co Ltd
Current assignee: Beijing Didi Infinity Technology and Development Co Ltd
Priority date: 2018-11-30
Filing date: 2018-11-30
Publication date: 2020-04-10

Abstract

The application discloses a method and a system for predicting abnormal orders. The order is a service class order. The method comprises the following steps: acquiring an order to be detected; acquiring a relevant characteristic value of the order to be detected; determining whether the order to be detected is an abnormal order or not based on the related characteristic value of the order to be detected; wherein the related characteristic value reflects at least one of the following pieces of information: service time, service location, operation behavior of the order originator on the platform, personal information of the order originator, or subscription requirements of the order originator for the service.

Description

Abnormal order prediction method and system

Technical Field

The present application relates to the field of internet technologies, and in particular, to a method and a system for predicting an abnormal order.

Background

In recent years, with the rapid development of internet technology, a large amount of online service software is emerging. Such services include network appointment services, take-out services, home services, and the like. While such services expand rapidly, more and more problems are exposed, and many exceptional events occur. In these exceptional cases, the property safety and personal safety of the service provider or the demander are threatened to different extents. Therefore, it is desirable to provide a method and a system for predicting abnormal orders, so as to take measures as soon as possible to prevent the occurrence of abnormal events and ensure the safety of related personnel.

Disclosure of Invention

The method and the device for judging whether the order to be detected is abnormal or not are used for analyzing the difference degree between the relevant characteristic value of the order to be detected and the relevant characteristic value of the historical order.

One aspect of the present application provides a method for predicting an abnormal order, where the order is a service class order. The method comprises the following steps: acquiring an order to be detected; acquiring a relevant characteristic value of the order to be detected; determining whether the order to be detected is an abnormal order or not based on the related characteristic value of the order to be detected; wherein the related characteristic value reflects at least one of the following pieces of information: service time, service location, operation behavior of the order originator on the platform, personal information of the order originator, or subscription requirements of the order originator for the service.

In some embodiments, the determining whether the order to be detected is an abnormal order based on the related characteristic values of the order to be detected further includes: determining the abnormality degree of the order to be detected based on the related characteristic value of the order to be detected; and judging whether the order to be detected is an abnormal order or not based on the abnormality degree.

In some embodiments, the determining the degree of abnormality of the order to be detected based on the related characteristic values of the order to be detected further comprises: and determining the abnormal degree of the order to be detected based on the difference degree of the related characteristic value of the order to be detected and the related characteristic value of the historical order.

In some embodiments, the determining the degree of abnormality of the order to be detected based on the degree of difference between the relevant feature value of the order to be detected and the relevant feature value of the historical order further includes: determining the distance between any two vectors in the relevant characteristic value vector of the order to be detected and the relevant characteristic value vector of the historical order; determining the abnormality degree of the order to be detected at least based on the distance between the relevant characteristic value vector of the order to be detected and the relevant characteristic value vector of each historical order.

In some embodiments, the determining the degree of abnormality of the order to be detected based on the degree of difference between the relevant feature value of the order to be detected and the relevant feature value of the historical order further includes: determining the distance between any two vectors in the relevant characteristic value vector of the order to be detected and the relevant characteristic value vector of the historical order; at least determining the density of the relevant characteristic value vector of the order to be detected and the neighborhood density thereof based on the distance between any two vectors; the size of the neighborhood range is preset; and determining the abnormal degree of the order to be detected based on the density of the relevant characteristic value vector of the order to be detected and the size relation of the density of the adjacent domain.

In some embodiments, determining the degree of abnormality of the to-be-detected order based on the degree of difference between the relevant characteristic value of the to-be-detected order and the relevant characteristic value of the historical order further comprises: and calculating the abnormality degree of the order to be detected by using a local abnormality factor algorithm.

In some embodiments, the determining the degree of abnormality of the order to be detected based on the degree of difference between the relevant feature value of the order to be detected and the relevant feature value of the historical order further includes: classifying the historical orders based on the related characteristic values of the historical orders; determining the identification related characteristic value of each historical order class, wherein the identification related characteristic value forms an identification related characteristic value vector of the historical order class; the identification related characteristic value is a related characteristic value of a history order in the history order class in which the identification related characteristic value is positioned, or the identification related characteristic value reflects a mean value of the related characteristic values of the history orders in the history order class in which the identification related characteristic value is positioned; determining the distance between the relevant characteristic value vector of the order to be detected and the identification relevant characteristic value vector of each historical order class; and determining the abnormality degree of the order to be detected based on the distance.

In some embodiments, the classifying the historical orders based on their associated feature values comprises: and clustering the related characteristic values of the historical orders through a clustering algorithm, and further classifying the historical orders.

In some embodiments, the method further comprises periodically updating the historical orders.

In some embodiments, the method further comprises determining and/or updating the relevant characteristics based on historical exception orders.

In some embodiments, said determining relevant characteristics based on historical exception orders further comprises: determining candidate features; determining the abnormal event identification of the candidate features; and taking the candidate characteristic with the abnormal event identification degree larger than a set threshold value as the related characteristic.

In some embodiments, said updating the relevant features based on historical exception orders further comprises: updating the history abnormal order; determining the relevant features based on the updated historical exception order.

In some embodiments, the operational behavior of the order originator on the platform includes a frequency of order originator cancellation within a time range; the order originator's personal information includes at least one of: whether there is a fixed place of residence, whether there is a fixed place of employment, loan status, or educational level; the order originator subscription requirement for the service includes at least one of: subscription requirements for service tools or subscription requirements for service providers.

Another aspect of the present application provides a system for predicting abnormal orders, where the orders are service-class orders. The system comprises: the system comprises an order acquisition module, a characteristic value acquisition module and a judgment module; the order acquisition module is used for acquiring an order to be detected; the characteristic value acquisition module is used for acquiring the related characteristic value of the order to be detected; the judging module is used for judging whether the order to be detected is an abnormal order or not based on the relevant characteristic value of the order to be detected; wherein the related characteristic value reflects at least one of the following pieces of information: service time, service location, operation behavior of the order originator on the platform, personal information of the order originator, or subscription requirements of the order originator for the service.

Another aspect of the present application provides an apparatus for predicting an abnormal order. The device comprises a memory and a processor; the memory having stored thereon a computer program; the processor is configured to execute at least a portion of the computer program to implement the operations of any of the above methods of predicting an exception order.

Another aspect of the present application provides a computer-readable storage medium. The storage medium stores a computer program, at least a portion of which, when executed by a processor, performs the operations of any of the above-described methods of predicting an exception order.

Another aspect of the present application provides a method for prompting an abnormal order, where the order is a service order. The method comprises the following steps: receiving server information, and displaying order information and prompting information dispatched by the server; the prompt information is used for prompting the abnormality degree of the current order of the user and/or safety warning information related to the abnormality degree of the current order.

Another aspect of the present application provides a system for prompting an abnormal order, where the order is a service order. The system comprises: the receiving module and the display module; the receiving module is used for receiving server information; the display module is used for displaying the order information and the prompt information sent by the server based on the server information; the prompt information is used for prompting the abnormality degree of the current order of the user and/or safety warning information related to the abnormality degree of the current order.

Another aspect of the present application provides an apparatus for prompting an abnormal order. The device comprises a memory and a processor; the memory having stored thereon a computer program; the processor is configured to execute at least a portion of the computer program to implement the operations described in the method for predicting an abnormal order.

Another aspect of the present application provides a computer-readable storage medium. The storage medium stores a computer program, at least a portion of which, when executed by the processor, performs the operations described in the above-described method of placing an exception order.

Drawings

FIG. 1 is a schematic diagram illustrating an application scenario of a predictive exception order system according to some embodiments of the present application;

FIG. 2 is a diagram of the hardware and software components of an exemplary computing device 200, shown in accordance with some embodiments of the present application;

FIG. 3 is a schematic diagram of exemplary hardware and/or software of an exemplary mobile device 300, shown in accordance with some embodiments of the present invention;

FIG. 4 is a block diagram of a predictive exception order system according to some embodiments of the present application;

FIG. 5 is an exemplary flow chart of a method of forecasting abnormal orders, according to some embodiments of the present application;

FIG. 6 is a flow chart of a method for determining anomaly of an order to be placed according to some embodiments of the present application;

FIG. 7 is a flow chart of a method for determining the anomaly of an order to be placed according to some embodiments of the present application;

FIG. 8 is another flow diagram illustrating the determination of the degree of abnormality in an order to be detected according to some embodiments of the present application;

FIG. 9 is an exemplary flow diagram illustrating the determination of relevant features for measuring order anomaly based on historical anomaly events according to some embodiments of the present application;

FIG. 10 is a schematic diagram illustrating updating historical exception-related features according to some embodiments of the present invention;

FIG. 11 is an exemplary flow chart illustrating an order prompting method according to some embodiments of the invention;

FIG. 12 is a block diagram of an order prompting device according to some embodiments of the present invention.

Detailed Description

In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings used in the description of the embodiments will be briefly introduced below. It is obvious that the drawings in the following description are only examples or embodiments of the application, from which the application can also be applied to other similar scenarios without inventive effort for a person skilled in the art. Unless otherwise apparent from the context, or otherwise indicated, like reference numbers in the figures refer to the same structure or operation.

As used in this application and the appended claims, the terms "a," "an," "the," and/or "the" are not intended to be inclusive in the singular, but rather are intended to be inclusive in the plural unless the context clearly dictates otherwise. In general, the terms "comprises" and "comprising" merely indicate that steps and elements are included which are explicitly identified, that the steps and elements do not form an exclusive list, and that a method or apparatus may comprise other steps or elements.

Although various references may be made herein to certain modules or units in a system according to embodiments of the present application, any number of different modules or units may be used and run on a client and/or server. The modules are merely illustrative and different aspects of the systems and methods may use different modules.

Flow charts are used herein to illustrate operations performed by a system according to embodiments of the present application. It should be understood that the preceding or following operations are not necessarily performed in the exact order in which they are performed. Rather, various steps may be processed in reverse order or simultaneously. Meanwhile, other operations may be added to the processes, or a certain step or several steps of operations may be removed from the processes.

In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings used in the description of the embodiments will be briefly introduced below. It is obvious that the drawings in the following description are only examples or embodiments of the present application, and that for a person skilled in the art, the present application can also be applied to other similar scenarios on the basis of these drawings without inventive effort. Unless apparent from the context of language or otherwise indicated, like reference numerals in the figures refer to the same structure or operation.

It should be understood that "system", "device", "unit" and/or "module" as used herein is a method for distinguishing different components, elements, components, parts or assemblies at different levels. However, other words may be substituted by other expressions if they accomplish the same purpose.

As used in this application and the appended claims, the terms "a," "an," "the," and/or "the" are not intended to be inclusive in the singular, but rather are intended to be inclusive in the plural unless the context clearly dictates otherwise. In general, the terms "comprising" and "comprises" merely indicate that steps and elements are included which are explicitly identified, that the steps and elements do not form an exclusive list, and that a method or apparatus may comprise other steps or elements.

It should be understood that the application scenarios of the system and method of the present application are only examples or embodiments of the present application, and those skilled in the art will be able to apply the present application to other similar scenarios without inventive effort based on these drawings.

Fig. 1 is a schematic diagram of an application scenario of a system for forecasting orders according to some embodiments of the present application. The predictive exception ordering system 100 may be an online service platform for a variety of services. In some embodiments, the forecast exception order system 100 may be used to forecast exceptions in network appointment services, such as forecasting exceptions to taxi orders, forecasting exceptions to express orders, forecasting exceptions to special orders, forecasting exceptions to mini-bar orders, forecasting exceptions to pool orders, forecasting exceptions in bus services, forecasting exceptions during pickup services, and the like. In some embodiments, the predictive exception system 100 may also be used for home services, courier delivery, take-away, and the like. For example, an anomaly of a predicted clean service order or other domestic service order, an anomaly of a predicted consignment order or consignment order, an anomaly of a predicted take-out order, etc. The forecast exception order system 100 may be an online service platform including a server 110, a network 120, a service requester terminal 130, a service provider terminal 140, and a database 150. The server 110 may include a processing device 112.

In some embodiments, server 110 may be used to process information and/or data related to a service order. The server 110 may be a stand-alone server or a group of servers. The set of servers can be centralized or distributed (e.g., server 110 can be a distributed system). In some embodiments, the server 110 may be regional or remote. For example, the server 110 may access information and/or profiles stored in the service requester terminal 130, the service provider terminal 140, and/or the database 150 via the network 120. In some embodiments, the server 110 may interface directly with the service requester terminal 130, the service provider terminal 140, and/or the database 150 to access information and/or material stored therein. In some embodiments, the server 110 may execute on a cloud platform. For example, the cloud platform may include one or any combination of a private cloud, a public cloud, a hybrid cloud, a community cloud, a decentralized cloud, an internal cloud, and the like.

In some embodiments, the server 110 may include a processing device 112. The processing device 112 may process data and/or information related to the service request to perform one or more of the functions described herein. Taking the network car booking service as an example, the processing device 112 may match one service vehicle for the network car booking order based on the network car booking order request acquired from the service requester terminal 130, or the processing device 112 may predict an abnormality of the network car booking order request based on the network car booking order request acquired from the service requester terminal 130. In some embodiments, the processing device 112 may perform special handling of exception orders. For example, for an exception order, the processing device 112 may determine and issue a prompt to the service requestor terminal 130 and/or the service provider terminal 140. For another example, for an exception order, the processing device 112 may alert a platform worker who performs manual processing on the exception order (e.g., cancel the order, contact a service requester/provider, track the order, alert, etc.); alternatively, the processing device 112 may automatically alert a third party authority (e.g., a police department, an emergency contact of a service requester/provider, etc.). As another example, the processing device 112 may automatically cancel the exception order without making a dispatch. In some embodiments, the processing device 112 may include one or more sub-processing devices (e.g., a single core processing device or a multi-core processing device). By way of example only, the processing device 112 may include a Central Processing Unit (CPU), an Application Specific Integrated Circuit (ASIC), an Application Specific Instruction Processor (ASIP), a Graphics Processor (GPU), a Physical Processor (PPU), a Digital Signal Processor (DSP), a Field Programmable Gate Array (FPGA), a programmable logic circuit (PLD), a controller, a micro-controller unit, a Reduced Instruction Set Computer (RISC), a microprocessor, or the like, or any combination thereof.

Network 120 may facilitate the exchange of data and/or information. In some embodiments, one or more components of the predictive exception order system 100 (e.g., the server 110, the service requester terminal 130, the service provider terminal 140, and the database 150) may send data and/or information to other components of the predictive exception order system 100 via the network 120. For example, the server 110 may obtain service request information (e.g., net appointment, take-out, home service) from the service requester terminal 130 via the network 120. For another example, the server 110 may also determine a service provider matching the service request, and send the service request to the corresponding service provider terminal 140 via the network 120 for billing. In some embodiments, network 120 may be any type of wired or wireless network. For example, network 120 may include a cable network, a wired network, a fiber optic network, a telecommunications network, an intranet, the Internet, a Local Area Network (LAN), a Wide Area Network (WAN), a Wireless Local Area Network (WLAN), a Metropolitan Area Network (MAN), a Public Switched Telephone Network (PSTN), a Bluetooth network, a ZigBee network, a Near Field Communication (NFC) network, the like, or any combination thereof. In some embodiments, network 120 may include one or more network access points. For example, the network 120 may include wired or wireless network access points, such as base stations and/or Internet exchange points 120-1, 120-2, through which one or more components of the predictive order system 100 may connect to the network 120 to exchange data and/or information.

In some embodiments, the user of the service requester terminal 130 may be the service requester himself. In some embodiments, the user of the service requester terminal 130 may be someone other than the service requester. For example, in the network car booking service, the user of the service requester terminal 130 may be the vehicle occupant himself or a person who places an order with the vehicle occupant, such as a relative or a friend of the vehicle occupant. For example, in the takeout service, the user of the service requester terminal 130 may be a target object for takeout delivery or a person who assists in the takeout of the target object. For another example, in the home service, the user of the service requester terminal 130 may be an actual requester of the home service, or a person who helps the requester to purchase the home service.

In some embodiments, the user of the service provider terminal 140 may be the service provider himself. In some embodiments, the user of the service provider terminal 140 may be someone other than the service provider. For example, in the network appointment service, the user of the service provider terminal 140 may be the driver himself or herself, or a person who helps the driver to take an order. For example, in the takeaway service, the user of the service provider terminal 140 may be the takeaway dispatcher himself or a person who helps the dispatcher take an order. For another example, in home services, the user of the service provider terminal 140 may be an actual service person (such as a maintenance person, a cleaner, etc.) of the home services, or a person who helps the service person to take an order.

In some embodiments, the service requester terminal 130 may include one or any combination of a mobile device 130-1, a tablet 130-2, a laptop 130-3, an in-vehicle device 130-4, and the like. In some embodiments, the mobile device 130-1 may include a smart home device, a wearable device, a smart mobile device, a virtual reality device, an augmented reality device, and the like, or any combination thereof. In some embodiments, the smart furniture device may include a smart lighting device, a control device for a smart appliance, a smart monitoring device, a smart television, a smart camera, an intercom, or the like, or any combination thereof. In some embodiments, the wearable device may include a smart bracelet, a smart footwear, smart glasses, a smart helmet, a smart watch, a smart garment, a smart backpack, a smart accessory, or the like, or any combination thereof. In some embodiments, the smart mobile device may comprise a smart phone, a Personal Digital Assistant (PDA), a gaming device, a navigation device, a POS device, or the like, or any combination thereof. In some embodiments, the metaverse device and/or the augmented reality device may include a metaverse helmet, metaverse glasses, metaverse eyewear, augmented reality helmets, augmented reality glasses, augmented reality eyewear, and the like, or any combination thereof. In some embodiments, the service requester terminal 130 may include a location-enabled device to determine the location of the requester and/or the service requester terminal 130.

In some embodiments, the service provider terminal 140 may be similar or identical to the service requestor terminal 130. In some embodiments, the service provider terminal 140 may be a device with location technology to determine the location of the service provider and/or the service provider terminal 140. In some embodiments, the service requester terminal 130 and/or the service provider terminal 140 may communicate with other locating devices to determine the location of the service requester, service requester terminal 130, service provider, or service provider terminal 140. In some embodiments, the service requester terminal 130 and/or the service provider terminal 140 may send the location information to the server 110.

Database 150 may store data and/or instructions. In some embodiments, the database 150 may store profiles obtained from the service requester terminal 130 and/or the service provider terminal 140. For example, the database 150 may store personal information, historical order information, historical abnormal order information for service requesters and/or service providers. In some embodiments, database 150 may store information and/or instructions for server 110 to perform or use to perform the example methods described herein. In some embodiments, the database 150 may include mass storage, removable storage, volatile read-write memory (e.g., random access memory RAM), read-only memory (ROM), the like, or any combination thereof. In some embodiments, database 150 may be implemented on a cloud platform. For example, the cloud platform may include a private cloud, a public cloud, a hybrid cloud, a community cloud, a decentralized cloud, an internal cloud, and the like, or any combination thereof.

In some embodiments, the database 150 may be connected to the network 120 to communicate with one or more components of the predictive exception order system 100 (e.g., the server 110, the requester terminal 130, the provider terminal 140, etc.). One or more components of the forecast exception order system 100 may access data or instructions stored in the database 150 via the network 120. In some embodiments, the database 150 may be directly connected to or in communication with one or more components (e.g., the server 110, the requester terminal 130, the provider terminal 140, etc.) in the predictive exception ordering system 100. In some embodiments, database 150 may be part of server 110.

In some embodiments, one or more components (e.g., server 110, service requestor terminal 130, service provider terminal 140, etc.) in the predictive exception order system 100 may have access to the database 150. For example, server 110 may access database 150 via network 120 to read data in database 150. The data read by the server 110 may include, but is not limited to, historical order data, historical exception order data, and the like. In some embodiments, one or more components (e.g., server 110, requester terminal 130, provider terminal 140, etc.) in the predictive exception order system 100 may read and/or modify information related to the service requester, the service provider, and/or the common general knowledge when one or more conditions are satisfied. For example, server 110 may read and/or modify information for one or more users after the predicted abnormal order service is over. Specifically, if an abnormal order is predicted, the server 110 may mark the user corresponding to the abnormal order as an abnormal user, or seal the user, and prohibit the user from operating. For another example, when a service request is received from the service requester terminal 130, the service provider terminal 140 may access information related to the requester, but the provider terminal may not modify the information related to the requester.

In some embodiments, the exchange of information between one or more components in the predictive exception ordering system 100 may be accomplished by requesting a service. The object of the service request may be any product. In some embodiments, the product may be a tangible product or an intangible product. Tangible products may include food, medicine, merchandise, chemical products, appliances, clothing, vehicles, houses, luxury items, and the like, or any combination thereof. Intangible products may include one or any combination of service products, financial products, knowledge products, internet products, and the like. The product may be any software and/or application used in a computer or mobile handset, for example. The software and/or applications may be related to social interaction, shopping, transportation, entertainment, learning, investment, etc., or any combination thereof. In some embodiments, the transportation-related software and/or applications may include travel software and/or applications, vehicle scheduling software and/or applications, mapping software and/or applications. In the vehicle scheduling software and/or application, the vehicle may include one or any combination of a carriage, a human powered vehicle (e.g., bicycle, tricycle, etc.), an automobile (e.g., taxi, bus, special car, etc.), a train, a subway, a ship, an aircraft (e.g., an airplane, a helicopter, a space shuttle, a rocket, a hot air balloon, etc.), and the like.

FIG. 2 is a diagram of the hardware and software components of an exemplary computing device 200, shown in accordance with some embodiments of the present application. The server 110, the service requester terminal 130 and/or the service provider terminal 140 may be implemented on a computing device 200. For example, the processing engine 112 may be implemented on the computing device 200 and configured to implement the functionality disclosed herein.

Computing device 200 may include any components used to implement the systems described herein. For example, the processing engine 112 may be implemented on the computing device 200 by hardware, software programs, firmware, or a combination thereof. For convenience only one computer is depicted in the figures, but the computing functions described herein in connection with the predictive exception ordering system 100 may be implemented in a distributed manner by a similar set of platforms to distribute the processing load.

Computing device 200 may include a communication port 250 for connecting to a network for enabling data communication. Computing device 200 may include a Central Processing Unit (CPU)220 that may execute program instructions in the form of one or more processors. Exemplary computer platforms may include an internal bus 210, various forms of program storage and data storage including, for example, a hard disk 270, Read Only Memory (ROM)230 or Random Access Memory (RAM)240 for storing a variety of data files to be processed and/or transmitted by the computer. The exemplary computing device may also include program instructions stored in read-only memory 230, random access memory 240, and/or other types of non-transitory storage media that are executed by processor 220. The methods and/or processes of the present application may be embodied in the form of program instructions. Computing device 200 also includes input/output component 260 for supporting input/output between the computer and other components. Computing device 200 may also receive programs and data in the present disclosure via network communication.

For ease of understanding, only one central processor is depicted in FIG. 2 by way of example. However, it should be noted that the computing device 200 disclosed herein may include one or more central processors, and thus operations and/or methods described herein that are implemented by one central processor may also be implemented by multiple processors, collectively or independently. For example, if in the present application, a central processor of computing device 200 performs steps a and B, it should be understood that steps a and B may also be performed by two different processors of computing device 200, either collectively or independently (e.g., a first processor performing step a, a second processor performing step B, or a first and second processor performing steps a and B collectively).

FIG. 3 is a diagram illustrating some embodiments according to the inventionAn exemplary hardware and/or software schematic of an exemplary mobile device 300. The service requester terminal 130 and/or the service provider terminal 140 may be implemented on a mobile device 300. As shown in fig. 3, mobile device 300 may include a communications platform 310, a display 320, a graphics processing unit 330, a central processing unit 340, an input/output unit 350, a memory 360, and a storage 390. A bus or a controller may also be included in the mobile device 300. In some embodiments, the operating system 370 is mobile (e.g., iOS)^TM、 Android^TM、Windows Phone^TMEtc.) and one or more application programs 380 may be loaded from storage unit 390 into memory 360 and executed by central processing unit 340. In some embodiments, the application 380 may include a browser, or may receive and display information for image processing or other information related to the processing device 112. The input/output unit 350 may enable interaction of data information with the predictive exception order system 100 and provide related interaction information to other components in the predictive exception order system 100, such as the server 110, via the network 120.

To implement the various modules, units and their functions described in this application, a computer hardware platform may be used as the hardware platform for one or more of the elements described herein. A computer having user interface elements may be used to implement a Personal Computer (PC) or any other form of workstation or terminal device. A computer may also act as a server, suitably programmed.

FIG. 4 is a block diagram of a predictive exception order system according to some embodiments of the present application. As shown in fig. 4, the forecast abnormal order system may include an order obtaining module 410, a feature value obtaining module 420, an abnormality degree determining module 430, a judging module 440, a related feature determining module 450, and a related feature updating module 460. In some embodiments, the order acquisition module 410, the feature value acquisition module 420, the abnormality determination module 430, the determination module 440, the relevant feature determination module 450, and the relevant feature update module 460 may be included in the processing device 112 shown in fig. 1.

The order obtaining module 410 is used for obtaining order information to be detected. The order information to be detected includes, but is not limited to: order placing information, order taking information, an order placing person (also called a service order requester), an order taking person (also called a service order provider) and the like. The order placing information refers to requirement information submitted by an order placing person when placing an order, and the order obtaining module 410 may obtain the requirement information from, for example, the service requester terminal 130. The order taking information is service information submitted by the order taker when taking the order, and the order acquisition module 410 may acquire the order from, for example, the service provider terminal 140. Taking the network appointment order as an example, the ordering information may include one or more of the ordering time, the current position, the getting-on place, the destination, the departure time, the number of passengers, and the like, in any combination. The order taking information may include one or any combination of the current position of the driver, the vehicle travel track, the predicted arrival time, etc. The order placing information may include personal information of the passenger. The order taker information may include personal information of the driver.

The characteristic value obtaining module 420 may be configured to obtain a relevant characteristic value of the order to be detected. Related features refer to order features that may be used to identify anomalous orders. In some embodiments, it is desirable to first determine which order characteristics are used to identify anomalous orders, and these order characteristics used to identify anomalous orders are referred to as correlation characteristics. The relevant feature value refers to the value of the relevant feature in a specific order. In some embodiments, part of the feature values may be extracted by the feature value obtaining module 420 directly from the order information to be detected obtained by the order obtaining module 410; the other part of the characteristic values may be obtained by analyzing and calculating the characteristic value obtaining module 420 according to the order information to be detected. For example, the characteristic value obtaining module 420 may directly extract the service time of the order to be detected, the service location of the order to be detected, the subscription requirement of the order initiator for the service, and the like from the order information to be detected. Order originator subscription requirements for services include, but are not limited to: subscription requirements for service tools or subscription requirements for service providers. For another example, the characteristic value obtaining module 420 may obtain the operation behavior of the order originator on the platform and perform statistical analysis. The operation behavior of the order initiator on the platform includes, but is not limited to, the operation of canceling the order by the order initiator within a certain time range. In some embodiments, the characteristic value acquisition module 420 may also acquire personal information of the order originator and/or the service provider. In some embodiments, the characteristic value obtaining module 420 may read registered account information of the order taker and/or the order taker from a storage device (e.g., the database 150). In some embodiments, the characteristic value obtaining module 420 may also access a database of a third party platform (e.g., a bank, a social security agency, a credit evaluation agency, etc.) to obtain personal information of the order originator and/or the service provider. Personal information includes, but is not limited to: whether there is a fixed place of residence, whether there is a fixed place of employment, loan status, educational level, etc.

The abnormality determination module 430 may be used to determine the degree of abnormality of the order to be tested. In some embodiments, the abnormality determination module 430 may determine the abnormality of the orders to be detected based on the related characteristic values of the orders to be detected. In some embodiments, the abnormality determination module 430 may determine the abnormality of the order to be detected based on the degree of difference between the relevant characteristic value of the order to be detected and the relevant characteristic value of the historical order. In some embodiments, the abnormality determination module 430 may determine a distance between any two vectors in the related eigenvalue vector of the order to be detected and the related eigenvalue of the historical order; and determining the abnormality degree of the order to be detected at least based on the distance between the relevant characteristic value vector of the order to be detected and the relevant characteristic value vector of each historical order. In some embodiments, the abnormality degree determination module 430 may determine a distance between any two of the relevant eigenvalue vector of the order to be detected and the relevant eigenvalue vector of the historical order; at least determining the density of the relevant characteristic value vector of the order to be detected and the neighborhood density thereof (the size of the neighborhood range is preset) based on the distance between any two vectors; and determining the abnormal degree of the order to be detected based on the density of the relevant characteristic value vector of the order to be detected and the magnitude relation of the neighborhood density. In some embodiments, the abnormality determination module 430 may calculate the abnormality of the order to be detected by using a Local Outlier Factor (LOF) algorithm. In some embodiments, the abnormality determination module 430 may classify historical orders based on their associated feature values; determining an identification related characteristic value of each historical order class, wherein the identification related characteristic value forms an identification related characteristic value vector of the historical order class, and the identification related characteristic value is a related characteristic value of a certain historical order in the historical order class in which the identification related characteristic value is positioned, or the identification related characteristic value reflects a mean value of the related characteristic values of the historical orders in the historical order class in which the identification related characteristic value is positioned; determining the distance between the relevant characteristic value vector of the order to be detected and the identification relevant characteristic value vector of each historical order class; and determining the abnormality degree of the order to be detected based on the distance. In some embodiments, the abnormality determination module 430 may cluster the related feature values of the historical orders through a clustering algorithm to further classify the historical orders. In some embodiments, the abnormality determination module 430 may periodically update the historical orders.

The determining module 440 may determine whether the order to be detected is an abnormal order. In some embodiments, the determining module 440 may determine whether the order to be detected is an abnormal order based on the degree of abnormality. In some embodiments, if the abnormality degree exceeds a preset abnormality degree threshold, the determining module 440 determines that the order to be detected is an abnormal order.

The relevant characteristics determination module 450 may determine relevant characteristics for identifying the order that is anomalous. In some embodiments, the relevant feature determination module 450 may determine the relevant feature based on historical exception orders. In some embodiments, the relevant feature determination module 450 may determine a candidate feature; determining the abnormal event identification of the candidate features; and taking the candidate characteristic with the abnormal event identification degree larger than a set threshold value as the related characteristic. For example, at least one candidate feature may be determined (e.g., manually determined by a worker based on experience), and then the relevant feature determination module 450 may verify each candidate feature according to the real historical order to determine whether the degree of identification of the candidate feature between the normal order and the abnormal order is greater than a set threshold. Taking the network appointment service as an example, a platform person may first determine candidate features (such as "taxi taking time") which can be used for identifying abnormal orders according to experience, the relevant feature determination module 450 verifies the candidate features by using real historical taxi taking orders, and finds that the candidate features of the "taxi taking time" are significantly different between normal orders and abnormal orders, for example, the real historical taxi taking orders are reflected, most of the abnormal orders are in a certain time period late at night (for example only, 2: 00-5: 00 early in the morning), and the taxi taking time of the normal orders is generally 2: before 00, the candidate feature of 'time of taking a taxi', or 'whether or not taking a taxi late at night' is determined as the relevant feature. For more on the determination of the relevant features, please refer to fig. 10 and its description. The relevant feature update module 460 may update the relevant features used to identify the abnormal order. In some embodiments, the relevant feature update module 460 may update the historical exception order; updating the correlation characteristics based on the updated historical exception orders.

It should be understood that the system and its modules shown in FIG. 4 may be implemented in a variety of ways. For example, in some embodiments, the system and its modules may be implemented in hardware, software, or a combination of software and hardware. Wherein the hardware portion may be implemented using dedicated logic; the software portions may be stored in a memory for execution by a suitable instruction execution system, such as a microprocessor or specially designed hardware. Those skilled in the art will appreciate that the above described methods and systems can be implemented using computer executable instructions and/or embodied in processor control code, such code provided, for example, on a carrier medium such as a diskette, CD-or DVD-ROM, a programmable memory such as read-only memory (firmware), or a data carrier such as an optical or electronic signal carrier. The system and its modules of the present application may be implemented not only by hardware circuits such as very large scale integrated circuits or gate arrays, semiconductors such as logic chips, transistors, or programmable hardware devices such as field programmable gate arrays, programmable logic devices, etc., but also by software executed by various types of processors, for example, or by a combination of the above hardware circuits and software (e.g., firmware).

It should be noted that the above description of the abnormal order forecasting system and the modules thereof is for convenience of description only and is not intended to limit the present application within the scope of the illustrated embodiments. It will be appreciated by those skilled in the art that, having the benefit of the teachings of the system, any combination of modules or configuration of subsystems with other modules may be made without departing from such teachings. For example, in some embodiments, the order obtaining module 410, the feature value obtaining module 420, the abnormality degree determining module 430, the determining module 440, the relevant feature determining module 450, and the relevant feature updating module 460 may be different modules in one system, or may be a module that implements the functions of two or more modules described above. For example, the order acquisition module 410 and the feature value acquisition module 420 may be two modules, or one module may have both the order acquisition function and the feature value acquisition function. For example, each module may share one memory module, and each module may have its own memory module. Such variations are within the scope of the present application.

FIG. 5 illustrates an exemplary flow chart of a method for forecasting abnormal orders according to some embodiments of the present application. As shown in fig. 5, the method for predicting abnormal orders may include:

step 510, an order to be detected is obtained. Specifically, step 510 may be performed by the order taking module 410.

In some embodiments, the order information to be detected acquired by the order acquisition module 410 includes, but is not limited to, one or any combination of order placing information, order taking information, order placing (also called service initiator) information, order taking (also called service provider) information, and the like. Taking the network appointment order as an example, the ordering information may include one or more of the ordering time, the current position, the getting-on place, the destination, the departure time, the number of passengers, and the like, in any combination. The order taking information may include one or any combination of the current position of the driver, the vehicle travel track, the expected arrival time, and the like. The order placing information may include personal information of the passenger. The order taker information may include personal information of the driver.

In some embodiments, the order to be detected may be initiated by the service requester terminal 130 and sent to the server 110 (e.g., the order taking module 410) over the network 120. Taking the network car booking service as an example, the order to be detected can represent that the passenger has sent the network car booking service request and obtains the order that the driver takes the order but does not go out; alternatively, the order to be detected may be an order for which the passenger has sent a network car booking service request but has no driver pick-up or has not yet been dispatched by the network car booking platform. In some embodiments, the order to be detected may be a real-time order. The real-time order may be an order received by the order taking module 410 at the current time or the current time period.

In some embodiments, the order to be detected may also be initiated by the service provider terminal 140 (e.g., a driver terminal) and sent to the server 110 (e.g., the order taking module 410) via the network 120. The order to be detected contains order information, wherein the order information comprises but is not limited to car using time, a starting place, a destination, the number of passengers, the position of a requester and the like. In some embodiments, the order taking module 410 may obtain the order to be detected from a storage device (e.g., database 150).

Step 520, obtaining the relevant characteristic value of the order to be detected. Specifically, step 520 may be performed by the characteristic value obtaining module 420.

In some embodiments, part of the feature values may be directly extracted from the to-be-detected order information acquired in step 520 by the feature value acquisition module 420; the other part of the characteristic values may be obtained by analyzing and calculating the characteristic value obtaining module 420 according to the order information to be detected. For example, the characteristic value obtaining module 420 may directly extract the service time of the order to be detected, the service location of the order to be detected, the subscription requirement of the order originator for the service, and the like from the order information to be detected. Order originator subscription requirements for services include, but are not limited to: subscription requirements for service tools or subscription requirements for service providers. For another example, the characteristic value obtaining module 420 may obtain the operation behavior of the order originator on the platform and perform statistical analysis. The operation behavior of the order initiator on the platform includes, but is not limited to, the operation of canceling the order by the order initiator within a certain time range. In some embodiments, the characteristic value acquisition module 420 may also acquire personal information of the order originator and/or the service provider. Personal information includes, but is not limited to: whether there is a fixed place of residence, whether there is a fixed place of work, loan status, or educational level. In some embodiments, the personal information may also include facies types of the order originator and/or the service provider, such as facies types of the order originator and/or the service provider that may be determined using machine learning to process and identify facial images of the order originator and/or the service provider. By way of example only, the facies type may be benign, thick, subtle, violent, etc.

In some embodiments, the relevant feature value may be determined according to a service time. Taking the network appointment service as an example, the service time may be ordering time, including but not limited to actual taxi calling time of the passenger, time when the server 110 receives a taxi calling request of the passenger, and the like. The service time may also be a boarding time including, but not limited to, a current time, an expected driver pickup time, a boarding time reserved by the passenger, and the like. In some embodiments, the service time may include a date and/or a time of day. In some embodiments, the service time may be a continuous value, such as 0: 00-23: 59. In some embodiments, the service time may be a discrete value. For example, the service time may be represented by two values, respectively "take a car at night" and "take a car at non-night", such as the service time of the order is 2: 00-05: 00 is denoted by 1, and represents "taxi at night", and the service time of the order is 2: 00-05: the time other than 00 is represented by 0, and represents "non-nighttime taxi".

In some embodiments, the relevant feature value may be determined from the service location. In some embodiments, the relevant feature values may be determined based on the degree of remote location of the service site. Taking the network appointment service as an example, the service locations include, but are not limited to, boarding locations, destinations, route locations, etc. In some embodiments, several regions can be divided in the geographic space, and the order density of each region is determined according to the position and/or track information of historical network taxi appointment orders, and the lower the order density is, the more remote the region is. In some embodiments, the degree of strangeness may be expressed as a continuum of values. In some embodiments, the degree of segregation may be expressed as a discrete number, for example, the regions may be arranged in order of decreasing order density, and the ranking number of each region is determined as the degree of segregation of the region. For another example, at least one order density threshold may be set, each order density threshold corresponding to a remote level, and the region where the order density satisfies the corresponding threshold is determined as the corresponding remote level.

In some embodiments, the relevant feature values may be determined from the operational behavior of the order originator on the platform. The operation behavior includes, but is not limited to, an operation of canceling the order by the order originator, and an operation of modifying the order by the order originator. In particular, the frequency with which the order originator cancels and/or modifies the order over a period of time may be determined as the relevant characteristic value. For example, in the case of a net appointment, the associated feature value may be a frequency with which the passenger cancels the order within a period of time (e.g., 5 minutes, 10 minutes, etc.).

In some embodiments, the relevant feature values may be determined from personal information of the order originator and/or the service provider. In some embodiments, the characteristic value obtaining module 420 may read the registered account information of the order originator and/or the service provider from a storage device (e.g., the database 150) to obtain the corresponding personal information. In some embodiments, the feature value obtaining module 420 may further access a database of a third-party platform (e.g., a bank, a social security organization, a credit evaluation organization, etc.) to obtain corresponding personal information.

In some embodiments, the personal information may include whether there is a fixed residential site, whether there is a fixed work site, and the like. In some embodiments, whether there is a fixed residential site or whether there is a fixed work site may be determined based on a confidence that the user frequented a site. Taking the car booking service as an example, the longitude and latitude of the starting Point of each historical order and the Point of Interest (POI) corresponding to the longitude and latitude can be analyzed by an existing algorithm for a passenger (namely an order initiator) within a period of time, the type (residential area or business area) of the POI is identified, the address and/or the company address of the passenger is predicted, and the confidence of the predicted address and/or the company address is determined. For example, the residential type of interest point with the highest occurrence number in the historical order may be determined as the address of the passenger, and the business district type of interest point with the highest occurrence number may be determined as the company address of the passenger. In some embodiments, the confidence level of the predicted address and/or company address may be calculated according to the following formula:

where α is the confidence level of the predicted address and/or company address (i.e., the address and/or company address that appears most frequently in the historical order), N_maxFor the number of predicted occurrences of the address and/or company address, N_totalIs the total number of historical orders. In some embodiments, if the confidence level exceeds a preset threshold, it is determined that the user has a fixed residential site and/or a fixed work site.

In some embodiments, the personal information may include a loan condition. The loan condition includes, but is not limited to, the number of loans, the amount of borrowed money, the term of borrowed money, and the repayment condition. In some embodiments, the characteristic value obtaining module 420 may obtain the loan status of the order originator from a third-party database. The third party database includes but is not limited to bank database, social security agency database, credit assessment agency database, p2p network lending platform database.

In some embodiments, the personal information may include an educational level. In some embodiments, the level of education may be represented by discrete values. For example, the primary school culture is represented by 0, the junior middle school culture is represented by 1, the high middle school culture is represented by 2, and the subject and above are represented by 3. In some embodiments, the degree of education may be represented by two values, e.g., a degree of education above the subject is represented by 1, and a degree of education below the subject is represented by 0.

In some embodiments, the relevant feature value may be determined according to the order originator's subscription requirements for the service. In some embodiments, the order originator's subscription requirements for the service may include subscription requirements for a service tool and/or subscription requirements for a service provider. In some embodiments, the order requirements of the order originator for the service may be represented by a continuous number. In some embodiments, the order originator's subscription requirements for the service may be expressed in discrete numbers. Taking the network appointment service as an example, the passenger may provide personalized requirements when submitting a vehicle using request, including but not limited to a requirement for a driver and a requirement for a vehicle. The requirements for the driver can also include requirements for the sex of the driver, requirements for the face of the driver, and the like. For example, the passenger may request a female driver or a driver with a thick, old and solid face, may request a premium vehicle, and the like. The demand on the driver can be expressed as a discrete number, such as 0 for male drivers and 1 for female drivers; for another example, a driver with a thick facies is denoted as 1, and a driver with an abrupt facies is denoted as 0 (see the example in step 520 in the related description of fig. 5 for the determination of the type of facies, which is not described herein again). The demand on the vehicle may be expressed as a continuous value, such as the price of the vehicle.

Step 530, determining the abnormality degree of the order to be detected based on the related characteristic value of the order to be detected. Specifically, step 530 may be performed by the abnormality determination module execution 430.

In some embodiments, the abnormality determination module 430 may determine the abnormality of the order to be detected based on the degree of difference between the relevant characteristic value of the order to be detected and the relevant characteristic value of the historical order. In some embodiments, the abnormality degree determination module 430 may determine the distance between any two sets of related characteristic values of the order to be detected and the related characteristic values of the historical orders, and determine the abnormality degree of the order to be detected based on the distance between the related characteristic value of the order to be detected and the related characteristic value of each historical order. In some embodiments, the abnormality degree determination module 430 may determine a distance between any two groups of related feature values in the related feature values of the order to be detected and the related feature values of the historical order, determine at least a density of the related feature values of the order to be detected and a neighborhood density thereof based on the distance between any two groups of related feature values (the size of the neighborhood range is preset), and determine the abnormality degree of the order to be detected based on a magnitude relationship between the density of the related feature values of the order to be detected and the neighborhood density thereof. In some embodiments, the abnormality determination module 430 may determine the degree of abnormality of the order to be detected using one or more abnormality detection algorithms. The anomaly detection algorithm includes, but is not limited to, a local-anomaly Factor (LOF) algorithm, a Noise-based Density-based clustering of Applications with Noise (DBSCAN) algorithm, an optimal clustering of clusters by point sorting (ORDERING PONDER) algorithm, an isolated Forest (ISOLATION Forest) algorithm, a single-Class Support Vector Machine (One-Class Support Vector Machine) algorithm. For more details on determining the abnormality degree of the order to be detected by using the abnormality detection algorithm, please refer to fig. 7 and the description thereof.

In some embodiments, the abnormality degree determination module 430 may classify the historical orders based on the related feature values of the historical orders, determine a set of identification related feature values based on each historical order class, where the identification related feature value is a related feature value of a certain historical order in the historical order class where the identification related feature value is located, or the identification related feature values reflect an average value of the related feature values of the historical orders in the historical order class where the identification related feature value is located, determine a distance between the related feature value of the order to be detected and the identification related feature value of each historical order class, and determine the abnormality degree of the order to be detected based on the distance. In some embodiments, the abnormality determination module 430 may cluster the related feature values of the historical orders through a clustering algorithm to classify the historical orders. For more, please refer to fig. 8 and the description thereof.

And 540, judging whether the order to be detected is an abnormal order or not based on the abnormality degree. Specifically, step 540 may be performed by the decision module 440.

In some embodiments, the abnormality degree is a continuous value, and the determining module 440 may determine whether the order to be detected is an abnormal order based on whether the abnormality degree is greater than a preset threshold. When the abnormality degree is less than or equal to a preset threshold value, the order to be detected can be judged to be a normal order; and when the abnormality degree is greater than a preset threshold value, judging the order to be detected as an abnormal order. In still other embodiments, the abnormality degree is a discrete value representing a classification result, and for example only, the abnormality degree 0 represents a normal order, the abnormality degree 1 represents an abnormal order, and the determining module 440 may directly identify the abnormality degree to determine whether the order to be detected is abnormal. In some embodiments, when the order to be detected is determined to be a normal order or an abnormal order, the server 110 may mark the order to be detected and send the order to the database 150 for storage through the network 120. In some embodiments, the determining module 440 may determine the degree of the abnormal order according to different preset thresholds. For example, when the abnormality degree of the order to be detected is greater than the first threshold, it may be determined that the order to be detected is a severely abnormal order, and at this time, the server 110 may send an alarm to the platform staff, and the staff may perform manual processing on the abnormal order (such as canceling the order, contacting with the service requester/provider, tracking the order, alarming, and the like); alternatively, the server 110 may automatically alert third party agencies (e.g., police, emergency contacts of service requesters/providers, etc.); alternatively, the server 110 may automatically cancel the exception order without making a dispatch. For another example, when the abnormality degree of the order to be detected is smaller than the first threshold and larger than the second threshold, it may be determined that the order to be detected is a more abnormal order. At this point, the server 110 may send a security alert to the service provider terminal 140.

FIG. 6 is a flow chart illustrating a method for determining the anomaly of an order to be placed according to some embodiments of the present application. As shown in fig. 6, the method for determining the degree of abnormality of the order to be detected based on the distance may include:

step 610, determining the distance between any two vectors in the relevant characteristic value vector of the order to be detected and the relevant characteristic value vector of the historical order. Specifically, step 610 may be performed by the abnormality determination module 430.

In some embodiments, each order has m associated eigenvalues that make up an associated eigenvalue vector for that order, where m is an integer greater than or equal to 1. The m related eigenvalues of each order can be represented as a point in the m-dimensional space, and the distance between the related eigenvalue vectors of any two orders can be represented as the distance between the corresponding points of the two orders in the m-dimensional space. In some embodiments, since the meaning of the individual sub-eigenvalue expressions in each related eigenvalue vector is different, the related eigenvalue vectors for the orders may be normalized. The following describes the normalization operation as an embodiment.

The relevant characteristic values of the order to be detected and the relevant characteristic values of the historical orders can form a relevant characteristic value vector set, and the relevant characteristic value vector set can be expressed as:

X＝{X_i＝＜x_i1，x_i2，...，x_im＞，i＝1，2，...，n} (2)

wherein, X_iThe order to be detected is a related eigenvalue vector corresponding to the ith order, n is the total number of the orders to be detected and the historical orders, and m is the number (namely dimension) of the partial eigenvalues included in one related eigenvalue vector.

Calculating the average value of some sub-feature values in each related feature value vector:

wherein

Is the average value of j-th score eigenvalue in the eigenvalue set.

The standard deviation of the sub-eigenvalue in the set of relevant eigenvalue vectors can be calculated according to equation (4):

wherein S_jAnd the standard deviation of the j-th seed characteristic value in the related characteristic value regrouping set.

Normalizing each sub-eigenvalue in each correlated eigenvalue vector:

wherein

And dividing the characteristic value of the ith order into the heavier jth characteristic value for the normalized related characteristic value of the ith order.

The normalized relevant eigenvalue vector of each order is:

in some embodiments, the distance between the relevant eigenvalue vectors for any two orders may include, but is not limited to, Euclidean distance, Manhattan distance, Chebyshev distance, Minkowski distance, Mahalanobis distance, cosine distance, Hamming distance, Jacard distance, correlation distance, and the like.

In some embodiments, the contribution of the various sub-eigenvalues is also different when calculating the distance of the correlated eigenvalue vectors of the two orders, and different weights may be given to the various sub-eigenvalues. For example, the distance between the related eigenvalue vector of the pth order and the related eigenvalue vector of the ath order is:

wherein d is_p，qThe distance between the relevant characteristic value vector of the pth order and the relevant characteristic value vector of the qt order, w_jIs the weight of the j-th score feature value.

In some embodiments, the distance between the associated eigenvalue vector of each order and the associated eigenvalue vectors of other orders whose distance is k before may be determined, k being an integer greater than or equal to 1. For example, a vector of associated feature values X for each order_iDetermining the sum of X_iRelevant characteristic value vectors of other orders close to the front k and determining X_iCorrelation characteristic close to the front kDistance of each vector in the eigenvalues. In some embodiments, the distance between the related characteristic value vector of the order to be detected and the related characteristic value vector of the historical order which is k times before the related characteristic value vector of the order to be detected can be determined, and the distance between the related characteristic value vector of each historical order which is k times before the related characteristic value vector of the historical order and the related characteristic value vector of other orders which is k times before the related characteristic value vector of the historical order can be determined.

In some embodiments, the reachable distance of the relevant feature value vector for any two orders may be determined. The determination of the achievable distance is explained below in a specific embodiment.

Vector X of related eigenvalues for a certain order p_pDetermining X_pThe kth distance D_k(X_p). The kth distance is the distance X_pRelevant eigenvalue vector of k < th > distance (excluding X)_pItself) with X_pThe distance of (c). For X_pAny associated eigenvalue vector X within the kth distance of_q，X_pAnd X_qThe true distance between them is D (X)_p，X_q) D is_k(X_p)、D(X_p，X_q) The larger one of them is determined to be X_pTo X_qIs the kth reachable distance of

RD_k(X_p，X_q)＝max{D_k(X_p)，D(X_p，X_q)} (8)

Wherein RD_k(X_p，X_q) Is X_pTo X_qIs reached.

And step 620, determining the abnormality degree of the order to be detected at least based on the distance between the relevant characteristic value vector of the order to be detected and the relevant characteristic value vector of each historical order. In particular, step 620 may be performed by the abnormality determination module 430.

In some embodiments, the vector of associated feature values X for the orders to be tested_oThe distance X can be determined_oThe related characteristic value vectors of other orders with the top k close form X_oK neighborhood N of_k(X_o)，X_oAnd N_k(X_o) Middle correlationAverage of distances of eigenvalue vectors

For N_k(Xo) vector of associated eigenvalues X for each order_qX can be determined_qAverage of the distances of the related eigenvalue vectors that are close to the top k

In some embodiments, may be according to

And

and determining the abnormality degree of the order to be tested. For example, if for N_k(X_o) Each X in_q，

Are all greater than

And if the preset degree is exceeded, the abnormality of the order to be detected can be determined. In some embodiments, may be according to

Ratio of

The large degree determines the degree of abnormality.

In some embodiments, a preset radius epsilon and a point threshold value MinPts may be given, and a related feature value vector X of the order to be detected is determined according to the distance between the related feature value vectors of any two orders determined in step 610_oNumber of groups N of related eigenvalue vectors of other orders contained in the range with the center of circle and the radius of epsilon_ε(X_o) If N is present_ε(X_o) If MinPts is less than the preset threshold, the order to be detected is determined to be an abnormal order. It will be appreciated that other orders within the scopeThe smaller the number of the associated eigenvalue vectors of (2), the less X_oThe fewer vectors of related feature values for the same or similar other orders, X_oThe more likely the anomaly is. In some embodiments, may be according to N_ε(X_o) A degree less than MinPts determines the degree of abnormality of the order to be detected.

FIG. 7 is a flow chart illustrating a method for determining the anomaly of an order to be placed according to some embodiments of the present application. As shown in fig. 7, the method for determining the degree of abnormality of the order to be detected by the density-based method may include:

step 710, determining the distance between any two vectors in the relevant eigenvalue vector of the order to be detected and the relevant eigenvalue vector of the historical order. In some embodiments, the associated feature vectors for each order may be normalized. In some embodiments, each of the fractional eigenvalues may be given a different weight. In some embodiments, the distance between the related eigenvalue vector of each order and the related eigenvalue vectors of other orders that are k before it can be determined, where k is an integer greater than or equal to 1. In some embodiments, the distance between the related feature value vector of the order to be detected and the historical order related feature value vector which is k times before the related feature value vector can be determined, and the distance between each historical order related feature value vector which is k times before the related feature value vector of the order to be detected and other order related feature value vectors which are k times before the historical order related feature value vector can be determined. In some embodiments, the reachable distance of the relevant feature value vector for any two orders may be determined. Step 710 is similar to step 610 and will not be described herein.

And 720, determining the density of the relevant characteristic value vectors of the orders to be detected and the neighborhood density of the relevant characteristic value vectors of any two orders based on the distance between the relevant characteristic value vectors of any two orders. In some embodiments, the density of the associated eigenvalue vector for an order may be the number of other order associated eigenvalue vectors within a certain range of the order associated eigenvalue vector. In some embodiments, the density of the order-related feature value vector may be the inverse of the average of the distances of the order-related feature value vector to other order-related feature value vectors in its neighborhood. In some embodiments, the local reachable density of the relevant eigenvalue vector of the order to be detected may be calculated using the LOF algorithm. For details regarding the calculation of the density using the LOF algorithm, reference is made to the following example.

And step 730, determining the abnormal degree of the order to be detected based on the density of the relevant characteristic value vector of the order to be detected and the size relationship of the neighborhood density. In some embodiments, the smaller the density of the relevant eigenvalue vector of the order to be detected is, or the larger the density difference from the relevant eigenvalue vector of the historical order in the neighborhood thereof is, the more abnormal the order to be detected is. In some embodiments, the LOF algorithm may be used to calculate the degree of anomaly of the orders to be placed. The determination of the degree of order abnormality is described below using the LOF algorithm as an example.

Firstly, determining a relevant characteristic value vector X of an order to be detected_oThe kth distance D_k(X_o) The kth distance is the distance X_oCorrelated eigenvalue vector and X of k-th historical order_oThe distance of (c). X_oA kth distance D_k(X_o) The vector of the related eigenvalues of all historical orders in X_oK-th distance neighborhood N_k(X_o)。

Second step, for N_k(X_o) Vector X of arbitrary correlation eigenvalues within_qDetermining X_oTo X_qKth reachable distance of (1):

RD_k(X_o，X_q)＝max{D_k(X_o)，D(X_o，X_q)} (9)

third, determining X_oHas a local achievable density of N_k(X_o) Vector of related eigenvalues to X_oThe inverse of the average of the achievable distances of (a), i.e.:

the fourth step of determining X_oThe local outlier factor of (A) is X_oK-th distance neighborhood N_k(X_o) Local achievable density and X of each associated eigenvalue vector within_oIs calculated as the average of the local achievable density ratios of (a):

in some embodiments, it may be based on LOF_k(X_o) The degree of abnormality of the order to be detected is determined. LOF_k(X_o) The value of (c) may reflect the degree of abnormality of the order to be detected. It can be understood that LOF_k(X_o) Closer to 1, indicate X_oThe closer the density of the related eigenvalue vectors to the historical orders in its neighborhood, X_oThe more likely it is a normal point; LOF_k(X_o) The more less than 1, the more X is indicated_oHigher density than the associated eigenvalue vector, X, of the historical orders in its neighborhood_oThe more likely it is a normal point; LOF_k(X_o) The larger the number is larger than 1, the description shows that X_oThe less dense the density of related eigenvalue vectors, X, of history orders in its neighborhood_oThe more likely it is an outlier.

FIG. 8 is another flow diagram illustrating the determination of the degree of order anomaly to be detected according to some embodiments of the present application. As shown in fig. 8, the method for determining the abnormality degree of the order to be detected may include:

step 810, classifying the historical orders based on the related characteristic values of the historical orders. Specifically, step 810 may be performed by the abnormality determination module 420;

in some embodiments, the historical orders may be one or more orders over a period of time (e.g., three days, five days, one week, one month, three months, etc.). In some embodiments, orders over a period of time may be retrieved at intervals as historical orders. In some embodiments, the relevant characteristic values for the historical orders may be obtained by referring to step 520. In some embodiments, the historical orders may be classified using a clustering algorithm based on the associated feature values of the historical orders, resulting in a plurality of historical order classes. In some embodiments, the clustering algorithm may include a nearest neighbor algorithm, a BIRCH algorithm, a k-means algorithm, an OPTICS algorithm, and the like.

A set of identity-related feature values is determined based on each historical order class, step 820. Step 820 may be performed by the abnormality determination module 420.

It is understood that there is some similarity between the historical orders in each of the historical order classes. Further, the related characteristic values between the historical orders in each historical order class have certain similarity. In some embodiments, the relevant feature value of a historical order in a class of historical orders may be determined as the identifying relevant feature value of the class. In some embodiments, a mean value of some related feature value in all historical orders in a certain historical order class may be calculated, and the mean value of each related feature value is used as an identification related feature value of the class.

Step 830, determining the distance between the relevant characteristic value vector of the order to be detected and the identification relevant characteristic value vector of each historical order class. Specifically, step 830 may be performed by the abnormality determination module 420.

As described above, the related characteristic values of the orders to be detected constitute related characteristic value vectors of the orders to be detected. Similarly, the identification-related feature values of each historical order class constitute an identification-related feature value vector of that historical order class. In some embodiments, the associated feature value vector of the order to be tested and/or the identified associated feature value vector of each historical order class may be normalized. In some embodiments, the respective fractional eigenvalues may be given different weights when calculating the distance. In some embodiments, the distance metric may be a Euclidean distance, a Manhattan distance, a Chebyshev distance, a Minkowski distance, a Mahalanobis distance, a cosine distance, a Hamming distance, a Jacard distance, a correlation distance, or the like.

In step 840, the degree of abnormality of the order to be detected is determined based on the distance. Specifically, step 840 may be performed by the abnormality determination module 420.

It can be understood that the order to be detected may belong to the historical order class if the relevant eigenvalue vector of the order to be detected is closer to or coincides with the identified relevant eigenvalue vector of the at least one historical order class. If the distance between the relevant characteristic value vector of the order to be detected and the identification relevant characteristic value vectors of all historical order classes is long, the order to be detected may not belong to any historical order class, and the order to be detected is likely to be abnormal. In some embodiments, an identification related feature vector of a history order class closest to a related feature value vector of an order to be detected may be determined, and the abnormality degree of the order to be detected is determined according to a distance between the identification related feature vector of the history order class and the related feature value vector of the order to be detected, where the larger the distance is, the larger the abnormality degree of the order to be detected is.

FIG. 9 illustrates an exemplary flow chart for determining relevant characteristics for measuring order anomaly based on historical anomaly events according to some embodiments of the present application. As shown in fig. 9, the method for determining relevant characteristics based on historical abnormal events may include:

at step 910, candidate features are determined. In some embodiments, the candidate features may be determined manually from a priori knowledge. Candidate characteristics include, but are not limited to, time of service, location of service, frequency of order withdrawals by order initiators over a range of time, loan status, education level, whether there is a fixed residence or fixed work location, etc. For example, in a network appointment service, candidate characteristics such as taxi-taking time, location, etc. may be determined empirically by a worker.

Step 920, obtaining historical order information, wherein the historical order information includes abnormal order information and normal order information. The abnormal order is an order in which an abnormal event occurs. In some embodiments, the abnormal event may refer to a malicious event that may harm property safety, personal safety or mental attack of a person, such as a passenger of the online taxi appointment service platform being threatened by property safety of a driver or a driver being threatened by property safety of a passenger, a reseller of the take-away service platform being threatened by personal safety, a courier of the express service platform being attacked, or the like, occurring in the online platform service. In some embodiments, historical exceptions may refer to exceptions that occur within a period of time (e.g., a year, month, or week) elapsed. In some embodiments, obtaining historical exceptions may be by user reporting, media reporting, or other means, such as television reporting, newspaper recording, magazine recording, cell phone news recording, criminal investigation archive recording, paper recording, and the like. In some embodiments, the corresponding historical orders may be marked as abnormal orders and the remaining orders may be marked as normal orders according to the abnormal event information.

Step 930, determining the abnormal event identification of the candidate feature according to the historical order information.

The abnormal event identification can reflect the difference degree of a certain characteristic between a normal order and an abnormal order. In some embodiments, the magnitude of the abnormal event identification of each feature may be determined by calculating the Information Value (IV) of each candidate feature. In some embodiments, the information values of characteristics such as gender, the area of the home location, the native place, the service place, the frequency of the order originator cancelling orders within a certain time range, and the like are calculated, and it is found that the frequency of the order originator cancelling orders within a certain time range and the information value of the service place are higher, and the information values of the other characteristics are lower. In some embodiments, the Pearson correlation coefficient, Gini index, maximum information coefficient, distance correlation coefficient, feature ranking based on a learning model, etc. of the candidate feature may also be calculated from the abnormal order and the normal order to determine the abnormal event identification of the candidate feature.

In step 940, the candidate features with the abnormal event identification degree greater than the set threshold are used as the relevant features.

In some embodiments, candidate features with abnormal event identification greater than a set threshold may be determined as the relevant features. For example, if the identification degree of the abnormal event in the service time is greater than the set threshold, the service time is taken as the relevant characteristic. For example, the service location, the frequency of canceling the order amount by the order originator within a certain time range, the loan status, the education level, and the identification of the abnormal event with respect to whether there is a fixed residential location or a fixed work location, etc. are all greater than a predetermined threshold, and these characteristics can be used as the relevant characteristics. And the numerical value of the relevant characteristic in the specific order is a relevant characteristic value. Taking the network appointment service as an example, the service time may be ordering time, including but not limited to actual taxi calling time of the passenger, time when the server 110 receives a taxi calling request of the passenger, and the like. The service time may also be a boarding time, including but not limited to a current time, an expected driver pickup time, a boarding time reserved by the passenger, etc.; the service location may be a boarding location, a destination, a route location, etc. In some embodiments, information such as service time, service location, etc. may be obtained from the passenger's request for use of the vehicle. In some embodiments, the server 110 may determine the service time, service location, etc. based on information in the user's request for a car. The frequency with which the order originator cancels orders within a certain time frame may be the frequency with which the passenger cancels orders. The loan condition, the education level may be included in the personal information of the passenger and/or the driver. In some embodiments, the registered account information of the passenger and/or driver may be read from a storage device (e.g., database 150) to obtain personal information of the passenger and/or driver. In some embodiments, a database of a third party platform (e.g., bank, social security agency, credit rating agency, etc.) may also be accessed to obtain personal information about the passenger and/or driver.

FIG. 10 is a schematic diagram illustrating updating historical exception-related features according to some embodiments of the present invention. As events progress, new exceptions may occur, and new features that may also occur with new historical exceptions have better exception resolution, and in some embodiments, relevant features may be updated based on the newly occurring historical exceptions. As shown in fig. 10, the method based on updating the relevant features may include:

step 1001, a newly occurring abnormal event is acquired. In particular, step 1001 may be performed by the correlation characteristic update module 460.

In some embodiments, the new exception event may be an exception event that has newly occurred in the near future, e.g., within the last three months, the last month, or the last week. The acquisition of the new abnormal event may be obtained by one or any combination of user reporting, media reporting or other means, such as television reporting, newspaper recording, magazine recording, mobile news recording, criminal investigation archive recording, paper recording, etc. For example, a new exception may refer to an exception, such as a 5-new occurrence, that was counted by an online service platform (e.g., a net appointment, take-out, courier, or online cleaning service) within the past week.

At step 1002, new features are determined based on the fresh history exception event. In particular, step 1002 may be performed by the relevant feature update module 460.

In some embodiments, a new subsequent characteristic may be determined based on the new exceptional event. For example, based on the new abnormal event, the facial features of the user, the subscription requirement of the service tool, and the subscription requirement of the service provider may also have a certain degree of abnormal event recognition.

And 1003, determining the abnormal event identification degree of the new subsequent characteristics. In particular, step 1003 may be performed by the relevant feature update module 460.

In some embodiments, the anomaly recognition of the new candidate feature may be determined by calculating the information value (e.g., by calculating the information gain), Pearson correlation coefficient, Gini index, maximum information coefficient, distance correlation coefficient, learning model-based feature ranking, etc. of the new candidate feature based on the new anomaly and normal events. The method for determining the degree of identification of the new abnormal event is described in step 920.

Step 1004, determining whether to update the relevant features based on the abnormal event identification.

In some embodiments, it may be determined whether the anomaly identification of the new feature is greater than a set threshold, and if so, the new feature may be taken as a new relevant feature and incorporated into the relevant feature update relevant feature. And when the abnormal event identification degree of the new characteristic is not greater than the set threshold, the related characteristic is not updated. For example, the abnormal event identification degree of the facial feature of the user, the subscription requirement of the service tool and the subscription requirement of the service provider is calculated to be larger than a set threshold value, so that the abnormal event identification degree is added into the existing related features. For example, in a web appointment service, the facial features of the user may be facial features of a passenger and/or a driver. In some embodiments, facial features of the user may be extracted through a trained model. The customized requirements for the service tool may be a passenger's requirements for a vehicle, for example, a passenger's requirements for a premium vehicle. The customized request to the service provider may be a request from the passenger to the driver, for example, the passenger may request that the driver be female. In some embodiments, the customized requirements for service tools and/or customized requirements for service providers may be extracted from the passenger's vehicle utilization request.

FIG. 11 is an exemplary flow chart illustrating an order prompting method according to some embodiments of the invention. As shown in fig. 11, the method for prompting an abnormal order may include:

step 1101, receiving information sent by the server. Specifically, step 1101 may be performed by the receiving module 1201 on the user terminal (e.g., the service requester terminal 130, the service provider terminal 140).

In some embodiments, the information sent by the server includes exception order prompting information. In some embodiments, the server 110 may obtain the order information to be detected, and analyze whether the order to be detected is an abnormal order. Details regarding the determination of the abnormal order can be found in fig. 5 to 8 and the description thereof, which are not repeated herein. In some embodiments, if the server 110 determines that the order to be detected is an abnormal order, abnormal alert information may be generated. In some embodiments, the server 110 may determine different abnormality prompting messages according to different abnormality degrees. Taking the network car booking service as an example, after receiving the car taking request of the passenger and dispatching the order, the server 110 determines that the order is an abnormal order, if the abnormal degree is relatively low, the abnormal prompt information can remind the driver to pay attention to safety precaution and pay attention to the abnormal behavior of the passenger, and if the abnormal degree is relatively high, the abnormal prompt information can remind the driver of an emergency help seeking mode and the like.

Step 1102, displaying the information sent by the server. Specifically, step 1102 may be performed by a display module 1202 on a user terminal (e.g., service requester terminal 130, service provider terminal 140). In some embodiments, the information sent by the server includes exception order prompting information. In some embodiments, the display module 1202 may display the abnormal order prompting message in a form of voice, text, image, or any combination thereof.

FIG. 12 is a block diagram of an order prompting device according to some embodiments of the present invention. As shown in fig. 11, the system for prompting an abnormal order may include: a receiving module 1201 and a display module 1202. In some embodiments, the receiving module 1201 and the displaying module 1202 may be included in the processing device 112 shown in fig. 1.

The receiving module 1201 is configured to receive information sent by a server. In some embodiments, the information sent by the server includes exception order prompting information. In some embodiments, if the server 110 determines that the order to be detected is an abnormal order, an abnormal prompt may be generated. In some embodiments, the server 110 may determine different abnormality prompting messages according to different abnormality degrees. In some embodiments, the receiving module 1201 may receive information of the server 110 through the network 120.

The display module 1202 is configured to display the received information sent by the server. In some embodiments, the information sent by the server includes exception order prompting information. In some embodiments, the display module 1202 may display the abnormal order prompting message in a form including one or more of voice, text, image, and any combination thereof.

It should be noted that the above description is merely for convenience and should not be taken as limiting the scope of the present application. It will be understood by those skilled in the art that, having the benefit of the teachings of this system, various modifications and changes in form and detail may be made to the field of application for which the method and system described above may be practiced without departing from this teachings.

The beneficial effects that may be brought by the embodiments of the present application include, but are not limited to: (1) the abnormal degree of the abnormal events can be predicted in time; (2) the safety of the user can be improved, and the service of the user using the online platform is improved; (3) the user can be helped to send out request help in time, and the severity of the abnormal event is reduced; (4) the quality of the on-line platform service is improved, and therefore the utilization rate of the user is improved.

It is to be noted that different embodiments may produce different advantages, and in different embodiments, any one or combination of the above advantages may be produced, or any other advantages may be obtained.

The foregoing describes the present application and/or some other examples. Various modifications may be made in the present application, in light of the above teachings. The subject matter disclosed herein can be implemented in various forms and examples, and the present application can be applied to a wide variety of applications. All applications, modifications and variations that are claimed in the following claims are within the scope of this application.

Also, this application uses specific language to describe embodiments of the application. Reference throughout this specification to "one embodiment," "an embodiment," and/or "some embodiments" means that a particular feature, structure, or characteristic described in connection with at least one embodiment of the present application is included in at least one embodiment of the present application. Therefore, it is emphasized and should be appreciated that two or more references to "an embodiment" or "one embodiment" or "an alternative embodiment" in various places throughout this specification are not necessarily all referring to the same embodiment. Furthermore, some of the features, structures, or characteristics of one or more embodiments of the present application may be combined as suitable.

Those skilled in the art will appreciate that numerous variations and modifications may be made to the disclosure herein. For example, the different system components described above are implemented by hardware devices, but may also be implemented by software solutions only. For example: the system is installed on an existing server. Further, the location information disclosed herein may be provided via a firmware, firmware/software combination, firmware/hardware combination, or hardware/firmware/software combination.

All or a portion of the software may sometimes communicate over a network, such as the internet or other communication network. Such communication enables loading of software from one computer device or processor to another. For example, the following examples: from a management server or host computer of the road information system, to a hardware platform of a computer environment, or other computer environment implementing the system, or similar functional system associated with providing information needed for order spelling rate prediction. Thus, another medium capable of transferring software elements may also be used as a physical connection between local devices, such as optical, electrical, electromagnetic waves, etc., propagating through cables, optical cables, or the air. The physical medium used for the carrier wave, such as an electric, wireless or optical cable or the like, may also be considered as the medium carrying the software. As used herein, unless limited to a tangible "storage" medium, other terms referring to a computer or machine "readable medium" refer to media that participate in the execution of any instructions by a processor.

Computer program code required for operation of various portions of the present application may be written in any one or more programming languages, including an object oriented programming language such as Java, Scala, Smalltalk, Eiffel, JADE, Emerald, C + +, C #, VB.NET, Python, and the like, a conventional programming language such as C, Visual Basic, Fortran2003, Perl, COBOL2002, PHP, ABAP, a dynamic programming language such as Python, Ruby, and Groovy, or other programming languages. The program code may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer through any network, such as a Local Area Network (LAN) or a Wide Area Network (WAN), or the connection may be made to an external computer (for example, through the Internet), or in a cloud computing environment, or as a service, such as a software as a service (SaaS).

Additionally, the order in which elements and sequences of the processes described herein are processed, the use of alphanumeric characters, or the use of other designations, is not intended to limit the order of the processes and methods described herein, unless explicitly claimed. While various presently contemplated embodiments have been discussed in the foregoing disclosure by way of example, it should be understood that such detail is solely for that purpose and that the appended claims are not limited to the disclosed embodiments, but, on the contrary, are intended to cover all modifications and equivalent arrangements that are within the spirit and scope of the embodiments of the disclosure. For example, although the system components described above may be implemented by hardware devices, they may also be implemented by software-only solutions, such as installing the described system on an existing server or mobile device.

Similarly, it should be noted that in the preceding description of embodiments of the application, various features are sometimes grouped together in a single embodiment, figure, or description thereof for the purpose of streamlining the disclosure aiding in the understanding of one or more of the embodiments. This method of disclosure, however, is not intended to imply that more features are required of the subject matter than are set forth in the claims. Indeed, the embodiments may be characterized as having less than all of the features of a single embodiment disclosed above.

Numbers describing attributes, quantities, etc. are used in some embodiments, it being understood that such numbers used in the description of the embodiments are modified in some instances by the use of the modifier "about", "approximately" or "substantially". Unless otherwise indicated, "about", "approximately" or "substantially" indicates that the number allows a variation of ± 20%. Accordingly, in some embodiments, the numerical parameters used in the specification and claims are approximations that may vary depending upon the desired properties of the individual embodiments. In some embodiments, the numerical parameter should take into account the specified significant digits and employ a general digit preservation approach. Notwithstanding that the numerical ranges and parameters setting forth the broad scope of the range are approximations, in the specific examples, such numerical values are set forth as precisely as possible within the practical range.

For each patent, patent application publication, and other material, such as articles, books, specifications, publications, documents, articles, and the like, cited in this application, the entire contents of which are hereby incorporated by reference into this application. Except where the application history document does not conform to or conflict with the present disclosure, it is to be understood that the application claims are to be accorded the widest scope limited only to documents that are currently or later appended to the present application. It is noted that the descriptions, definitions and/or use of terms in this application shall control if they are inconsistent or contrary to the contents of the present application in the areas where the descriptions, definitions and/or use of terms in the attached materials of this application are inconsistent or contrary to the contents of this application.

Finally, it should be understood that the embodiments described herein are merely illustrative of the principles of the embodiments of the present application. Other variations are also possible within the scope of the present application. Thus, by way of example, and not limitation, alternative configurations of the embodiments of the present application can be viewed as being consistent with the teachings of the present application. Accordingly, embodiments of the present application are not limited to those explicitly described and depicted herein.

Claims

1. A method for predicting abnormal orders, wherein the orders are service class orders, comprising:

acquiring an order to be detected;

acquiring a relevant characteristic value of the order to be detected;

determining whether the order to be detected is an abnormal order or not based on the related characteristic value of the order to be detected; wherein the content of the first and second substances,

the correlation characteristic value reflects at least one of the following pieces of information: service time, service location, operation behavior of the order originator on the platform, personal information of the order originator, or subscription requirements of the order originator for the service.

2. The method according to claim 1, wherein the determining whether the order to be detected is an abnormal order based on the related characteristic value of the order to be detected further comprises:

determining the abnormality degree of the order to be detected based on the related characteristic value of the order to be detected;

and judging whether the order to be detected is an abnormal order or not based on the abnormality degree.

3. The method of predicting abnormal orders as claimed in claim 2, wherein said determining the abnormality degree of the order to be detected based on the related characteristic value of the order to be detected further comprises: and determining the abnormal degree of the order to be detected based on the difference degree of the related characteristic value of the order to be detected and the related characteristic value of the historical order.

4. The method of claim 3, wherein the related feature value of each order forms a related feature value vector of the order, and the determining the degree of abnormality of the order to be detected based on the degree of difference between the related feature value of the order to be detected and the related feature value of the historical order further comprises:

determining the distance between any two vectors in the relevant characteristic value vector of the order to be detected and the relevant characteristic value vector of the historical order;

determining the abnormality degree of the order to be detected at least based on the distance between the relevant characteristic value vector of the order to be detected and the relevant characteristic value vector of each historical order.

5. The method of claim 3, wherein the related feature value of each order forms a related feature value vector of the order, and the determining the degree of abnormality of the order to be detected based on the degree of difference between the related feature value of the order to be detected and the related feature value of the historical order further comprises:

at least determining the density of the relevant characteristic value vector of the order to be detected and the neighborhood density thereof based on the distance between any two vectors; the size of the neighborhood range is preset;

and determining the abnormal degree of the order to be detected based on the density of the relevant characteristic value vector of the order to be detected and the size relation of the neighborhood density.

6. The method of claim 3, wherein determining the degree of abnormality of the to-be-detected order based on the degree of difference between the relevant characteristic value of the to-be-detected order and the relevant characteristic value of the historical order further comprises:

and calculating the abnormality degree of the order to be detected by using a local abnormality factor algorithm.

7. The method of claim 3, wherein the related feature value of each order forms a related feature value vector of the order, and the determining the degree of abnormality of the order to be detected based on the degree of difference between the related feature value of the order to be detected and the related feature value of the historical order further comprises:

classifying the historical orders based on the related characteristic values of the historical orders;

determining the identification related characteristic value of each historical order class, wherein the identification related characteristic value forms an identification related characteristic value vector of the historical order class; the identification related characteristic value is a related characteristic value of a history order in the history order class in which the identification related characteristic value is positioned, or the identification related characteristic value reflects a mean value of the related characteristic values of the history orders in the history order class in which the identification related characteristic value is positioned;

determining the distance between the relevant characteristic value vector of the order to be detected and the identification relevant characteristic value vector of each historical order class;

and determining the abnormality degree of the order to be detected based on the distance.

8. The method of predicting abnormal orders as claimed in claim 7, wherein said classifying historical orders based on their associated feature values comprises: and clustering the related characteristic values of the historical orders through a clustering algorithm, and further classifying the historical orders.

9. The method of forecasting an abnormal order as set forth in claim 3, further comprising updating the historical order periodically.

10. The method of forecasting abnormal orders as claimed in claim 1, further comprising determining and/or updating relevant features based on historical abnormal orders.

11. The method of forecasting an exception order as set forth in claim 10, wherein said determining relevant characteristics based on historical exception orders further comprises:

determining candidate features;

determining the abnormal event identification of the candidate features;

and taking the candidate characteristic with the abnormal event identification degree larger than a set threshold value as the related characteristic.

12. The method of forecasting abnormal orders as claimed in claim 11, wherein said updating the correlation characteristics based on historical abnormal orders further comprises:

updating historical abnormal orders;

determining the relevant features based on the updated historical exception order.

13. The method of forecasting abnormal orders as set forth in claim 1,

the operation behavior of the order initiator on the platform comprises the frequency of canceling orders by the order initiator within a certain time range;

the order originator's personal information includes at least one of: whether there is a fixed place of residence, whether there is a fixed place of employment, loan status, or educational level;

the order originator subscription requirement for the service comprises at least one of: subscription requirements for service tools or subscription requirements for service providers.

14. A system for forecasting abnormal orders, said orders being service class orders, said system comprising: the system comprises an order acquisition module, a characteristic value acquisition module and a judgment module;

the order acquisition module is used for acquiring an order to be detected;

the characteristic value acquisition module is used for acquiring the related characteristic value of the order to be detected;

the judging module is used for judging whether the order to be detected is an abnormal order or not based on the related characteristic value of the order to be detected; wherein the content of the first and second substances,

15. The system for forecasting orders as claimed in claim 14 further comprising an abnormality degree determination module;

the abnormality degree module is used for determining the abnormality degree of the order to be detected based on the relevant characteristic value of the order to be detected;

the judging module is used for judging whether the order to be detected is an abnormal order or not based on the abnormality degree.

16. The system of predicting an anomalous order as in claim 15, wherein said anomaly determination module is further configured to: and determining the abnormal degree of the order to be detected based on the difference degree of the related characteristic value of the order to be detected and the related characteristic value of the historical order.

17. The system of predicting abnormal orders of claim 16, wherein the associated eigenvalue of each order constitutes an associated eigenvalue vector of that order, the abnormality determination module further being configured to:

18. The system of predicting abnormal orders of claim 16, wherein the associated eigenvalue of each order constitutes an associated eigenvalue vector of that order, the abnormality determination module further being configured to:

19. The system of predicting abnormal orders of claim 16, wherein the abnormality determination module is further configured to:

20. The system of predicting abnormal orders of claim 14, wherein the associated eigenvalue of each order constitutes an associated eigenvalue vector of the order, the abnormality determination module further being configured to:

21. The system of claim 20, wherein the abnormality degree determination module is further configured to cluster the related feature values of the historical orders by a clustering algorithm, so as to classify the historical orders.

22. The system of predicting abnormal orders of claim 16, wherein the abnormality determination module is further configured to periodically update the historical orders.

23. The system for forecasting abnormal orders as claimed in claim 14, further comprising a correlation characteristic determining module and/or a correlation characteristic updating module,

the related characteristic determining module is used for determining related characteristics based on historical abnormal orders;

the related characteristic updating module is used for updating the related characteristics based on the historical abnormal orders.

24. The system for forecasting orders as claimed in claim 23, wherein the relevant characteristic determining module is further configured to:

determining candidate features;

determining the abnormal event identification of the candidate features;

25. The system for forecasting orders as claimed in claim 24, wherein the relevant characteristic update module is further configured to:

updating historical abnormal orders;

26. The system for forecasting an abnormal order as set forth in claim 14,

the operation behavior of the order initiator on the platform comprises the frequency of canceling orders by the order initiator within a certain time range:

27. An apparatus for predicting abnormal orders comprises a memory and a processor;

the memory having stored thereon a computer program, wherein the processor is configured to execute at least a portion of the computer program to implement the method of predicting an exception order of any of claims 1-13.

28. A computer-readable storage medium, on which a computer program is stored, at least a part of which, when executed by a processor, implements a method of predicting an exception order according to any one of claims 1 to 13.

29. A method for prompting abnormal orders, wherein the orders are service orders, is characterized by comprising the following steps:

receiving server information, and displaying order information and prompt information dispatched by the server;

the prompt information is used for prompting the abnormality degree of the current order of the user and/or safety warning information related to the abnormality degree of the current order.

30. A system for prompting an abnormal order, wherein the order is a service order, comprising: the receiving module and the display module;

the receiving module is used for receiving server information;

the display module is used for displaying the order information and the prompt information sent by the server based on the server information;

31. A device for prompting abnormal orders comprises a memory and a processor;

the memory having stored thereon a computer program, wherein at least a portion of the computer program is executed by the processor to implement the method of prompting an exception order of claim 29.

32. A computer-readable storage medium, on which a computer program is stored, at least a part of which, when being executed by a processor, implements the method of prompting an exception order of claim 29.