CN111275507A

CN111275507A - Order abnormity identification and order risk management and control method and system

Info

Publication number: CN111275507A
Application number: CN201811471339.4A
Authority: CN
Inventors: 韩福波; 张谷超; 韩戈阳; 刘亚书
Original assignee: Beijing Didi Infinity Technology and Development Co Ltd
Current assignee: Beijing Didi Infinity Technology and Development Co Ltd
Priority date: 2018-12-04
Filing date: 2018-12-04
Publication date: 2020-06-12

Abstract

The embodiment of the application discloses a method and a system for order abnormity identification and order risk management and control. The order abnormity identification method comprises the following steps: obtaining an order to be tested; acquiring characteristic parameters related to the order to be tested; processing at least one part of the characteristic parameters by using a first order abnormity identification model to obtain a first identification result; processing at least one part of the characteristic parameters by using a second order abnormity identification model to obtain a second identification result; and determining an abnormal identification result of the order to be detected by combining the first identification result and the second identification result. The order risk management and control method comprises the following steps: acquiring a service request of a service requester; generating a service order based on the service request and sending the service order to the server; and receiving an abnormal identification result of the service order or a risk management and control instruction related to the abnormal identification result sent by the server. The method and the system can prevent the occurrence of malignant events in the online service platform and ensure the safety of life and property of people.

Description

Order abnormity identification and order risk management and control method and system

Technical Field

The present application relates to the field of internet technologies, and in particular, to a method, a system, an apparatus, and a storage medium for order anomaly identification and order risk management and control.

Background

At present, the development of online service platforms is more and more rapid. Platforms for various online services including a network car booking service, a takeaway service, a home service, and the like have appeared. The online service platforms bring convenience to the life of people, and meanwhile, malignant events that the platforms are utilized to hurt the lives and properties of other people occur. Taking the network car booking service as an example, a vicious event that a driver borrows the airplane to hurt passengers or the passengers hurt the life of the driver occurs. In order to ensure the safety of people and ensure the healthy development of an online service platform, the occurrence of malignant events needs to be prevented. Therefore, a method is needed to identify anomalies in potential service orders and to manage the orders for the purpose of preventing the occurrence of malignant events.

Disclosure of Invention

The application provides an identification method for order abnormity and a risk control method for the order, so that the occurrence of a malignant event in an online service platform is prevented, and the safety of life and property of people is ensured.

In order to achieve the purpose of the invention, the technical scheme provided by the invention is as follows: an order anomaly identification method comprises the following steps: obtaining an order to be tested; acquiring characteristic parameters related to the order to be tested; processing at least one part of the characteristic parameters by using a first order abnormity identification model to obtain a first identification result; processing at least one part of the characteristic parameters by using a second order abnormity identification model to obtain a second identification result; determining an abnormal identification result of the order to be detected by combining the first identification result and the second identification result; wherein the characteristic parameter related to the order to be tested at least reflects at least one of the following various information: service time, service location, operational behavior of the service requester or service provider on the platform, personal information of the service requester or service provider, or subscription requirements of the service requester to the service.

An order anomaly identification system comprising: the first acquisition module comprises an order acquisition unit to be detected and a characteristic parameter acquisition unit; the order acquiring unit to be tested is used for acquiring an order to be tested, and the characteristic parameter acquiring unit is used for acquiring characteristic parameters related to the order to be tested; the order abnormity identification module is used for processing at least one part of the characteristic parameters by utilizing a first order abnormity identification model to obtain a first identification result; processing at least one part of the characteristic parameters by using a second order abnormity identification model to obtain a second identification result; determining an abnormal identification result of the order to be detected by combining the first identification result and the second identification result; wherein the characteristic parameter related to the order to be tested at least reflects at least one of the following various information: service time, service location, operational behavior of the service requester or service provider on the platform, personal information of the service requester or service provider, or subscription requirements of the service requester to the service.

An order abnormity identification device is characterized by comprising at least one processor and at least one memory; the at least one memory is to store instructions; the processor is used for executing the instructions to realize the method.

A computer-readable storage medium storing computer instructions, wherein when the computer instructions in the storage medium are read by a computer, the computer performs the method as described above.

An order risk management and control method comprises the following steps: acquiring a service request of a service requester; the service request at least comprises service time and service place; generating a service order based on the service request and sending the service order to a server; and receiving an abnormal identification result of the service order sent by a server or a risk management and control instruction related to the abnormal identification result.

An order risk management system, comprising: the second acquisition module is used for acquiring the service request of the service requester; the service request at least comprises service time and service place; the service order generating module is used for generating a service order based on the service request and sending the service order to the server; and the risk management and control receiving module is used for receiving the abnormal identification result of the service order sent by the server or a risk management and control instruction related to the abnormal identification result.

An order risk management and control device comprises at least one processor and at least one memory; the at least one memory is to store instructions; the processor is used for executing the instructions to realize the method.

Drawings

The present application will be further explained by way of exemplary embodiments, which will be described in detail by way of the accompanying drawings. These embodiments are not intended to be limiting, and in these embodiments like numerals are used to indicate like structures, wherein:

FIG. 1 is a schematic diagram of an exemplary order anomaly identification system, shown in accordance with some embodiments of the present application;

FIG. 2 is a schematic diagram of exemplary hardware and/or software components of an exemplary computing device according to some embodiments of the present invention;

FIG. 3 is a schematic diagram of exemplary hardware components and/or software components of an exemplary mobile device shown in accordance with some embodiments of the present invention;

FIG. 4 is a block diagram of an order anomaly identification system according to some embodiments of the present invention;

FIG. 5 is a block diagram of an order risk management system according to some embodiments of the present invention;

FIG. 6 is an exemplary flow diagram of an order anomaly identification method according to some embodiments of the present invention;

FIG. 7 is an exemplary flow diagram illustrating the determination of a first order anomaly identification model according to some embodiments of the invention;

FIG. 8 is an exemplary flow diagram illustrating the determination of a second order anomaly identification model according to some embodiments of the invention;

FIG. 9 is an exemplary flow diagram illustrating order risk management according to some embodiments of the invention.

Detailed Description

In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings used in the description of the embodiments will be briefly introduced below. It is obvious that the drawings in the following description are only examples or embodiments of the application, from which the application can also be applied to other similar scenarios without inventive effort for a person skilled in the art. Unless otherwise apparent from the context, or otherwise indicated, like reference numbers in the figures refer to the same structure or operation.

As indicated in the present application and in the claims, unless the context clearly dictates otherwise,

the terms "a", "an" and/or "the" are not intended to be inclusive of the singular, but may include the plural. In general, the terms "comprises" and "comprising" merely indicate that steps and elements are included which are explicitly identified, that the steps and elements do not form an exclusive list, and that a method or apparatus may include other steps or elements. The term "based on" is "based, at least in part, on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment". Relevant definitions for other terms will be given in the following description.

Embodiments of the present application may be applied to different transportation systems and/or mobile devices, including but not limited to one or a combination of land, surface, aviation, aerospace, and the like. Such as a human powered vehicle, a vehicle, an automobile (e.g., a small car, a bus, a large transportation vehicle, etc.), rail transportation (e.g., a train, a bullet train, a high-speed rail, a subway, etc.), a boat, an airplane, an airship, a satellite, a hot air balloon, an unmanned vehicle, etc. Different mobile terminals include, but are not limited to, mobile devices such as smart phones, smart watches, video cameras, notebooks, tablet computers, Personal Digital Assistants (PDAs), in-vehicle computers, and the like. The application scenarios of the different embodiments of the present application include but are not limited to one or a combination of several of transportation industry, warehouse logistics industry, agricultural operation system, urban public transportation system, commercial operation vehicle, etc. It should be understood that the application scenarios of the system and method of the present application are merely examples or embodiments of the present application, and those skilled in the art can also apply the present application to other similar scenarios without inventive effort based on these drawings.

FIG. 1 is a schematic diagram of an order anomaly identification system 100 according to some embodiments of the present invention. For example, the order anomaly identification system 100 may be an online service platform for a variety of services. In some embodiments, the order anomaly identification system 100 may be used to identify anomalies in network appointment services, such as identifying anomalies for taxi orders, identifying anomalies for express orders, identifying anomalies for special orders, identifying anomalies for mini-bus orders, anomalies for carpool orders, identifying anomalies in bus services, and identifying anomalies in transit services, among others. In some embodiments, the order anomaly identification system 100 may also be used for home services, courier, take-out, and the like. For example, identify anomalies for clean service orders or other housekeeping service orders, identify anomalies for inbound or inbound orders, identify anomalies for take-away orders, and so forth. Order anomaly identification system 100 can include a server 110, one or more service requester terminals 120, storage 130, one or more service provider terminals 140, a network 150, and an information source 160. The server 110 may include a processing engine 112.

In some embodiments, the server 110 may be a single server or a group of servers. The server farm can be centralized or distributed (e.g., server 110 can be a distributed system). In some embodiments, the server 110 may be local or remote. For example, the server 110 may access information and/or data stored in the storage device 130, the service requester terminal 120 through the network 150. As another example, the server 110 may be directly connected to the storage device 130, the service requester terminal 120 to access stored information and/or data. In some embodiments, the server 110 may be implemented on a cloud platform. By way of example only, the cloud platform may include a private cloud, a public cloud, a hybrid cloud, a community cloud, a distributed cloud, between clouds, multiple clouds, the like, or any combination of the above. In some embodiments, server 110 may be implemented on a computing device similar to that shown in FIG. 2 or FIG. 3 of the present application. For example, server 110 may be implemented on one computing device 200 as shown in FIG. 2, including one or more components in computing device 200. As another example, server 110 may be implemented on a mobile device 300 as shown in FIG. 3, including one or more components in computing device 300. In some embodiments, processing engine 112 may process data and/or information related to a service request to perform one or more of the functions described herein. Taking the network car booking service as an example, the processing engine 112 may match a service vehicle for the network car booking order based on the network car booking order request acquired from the service requester terminal 130, or the processing engine 112 may identify an anomaly of the network car booking order request based on the network car booking order request acquired from the service requester terminal 120. In some embodiments, the processing engine 112 may specifically handle order exceptions. For example, for order exceptions, the processing engine 112 may determine and issue a prompt message to the service requestor terminal 120 and/or the service provider terminal 140. For another example, for an order exception, the processing engine 112 may issue an alert to a platform worker who performs manual processing on the order exception (e.g., cancel the order, contact a service requester/provider, track the order, alert, etc.); alternatively, the processing engine 112 may automatically alert third party agencies (e.g., police, emergency contacts of service requesters/providers, etc.). As another example, the processing engine 112 may automatically cancel the order exception without making a dispatch.

In some embodiments, the user of the service requester terminal 120 may be the service requester himself. In some embodiments, the user of the service requester terminal 120 may be a person other than the service requester. For example, in the network car booking service, the user of the service requester terminal 120 may be the vehicle occupant himself or a person who places an order with the vehicle occupant, such as a relative or a friend of the vehicle occupant. For example, in the takeout service, the user of the service requester terminal 120 may be a target object for takeout delivery or a person who helps the target object to take out. For another example, in the home service, the user of the service requester terminal 120 may be an actual requester of the home service, or a person who helps the requester to purchase the home service.

In some embodiments, the user of the service provider terminal 140 may be the service provider himself. In some embodiments, the user of service provider terminal 140 may be a person other than the service provider. For example, in the network appointment service, the user of the service provider terminal 140 may be the driver himself or herself, or a person who helps the driver to take an order. For example, in the takeaway service, the user of the service provider terminal 140 may be the takeaway dispatcher himself or a person who helps the dispatcher take an order. For another example, in home services, the user of the service provider terminal 140 may be an actual service person (such as a maintenance person, a cleaner, etc.) of the home services, or a person who helps the service person to take an order.

In some embodiments, the service requester terminal 120 may include, but is not limited to, a desktop computer 120-1, a laptop computer 120-2, an in-vehicle built-in device 120-3, a mobile device 120-4, and the like or any combination thereof. In some embodiments, the in-vehicle built-in device 120-3 may include, but is not limited to, a personal computer, an in-vehicle heads-up display (HUD), an in-vehicle automatic diagnostic system (OBD), and the like, or any combination thereof. In some embodiments, mobile device 120-4 may include, but is not limited to, a smartphone, a Personal Digital Assistant (PDA), a tablet, a palmtop, smart glasses, a smart watch, a wearable device, a virtual display device, a display enhancement device, and the like, or any combination thereof. In some embodiments, the service requester terminal 120 may send the transport service requirements to one or more devices in the order anomaly identification system 100. For example, the service requester terminal 120 may send the transport service requirements to the server 110 for processing.

In some embodiments, the service provider terminal 140 may be a similar or identical device as the service requestor terminal 130. In some embodiments, the service provider terminal 140 may be a device with location technology to determine the location of the service provider and/or the service provider terminal 140. In some embodiments, the service requester terminal 120 and/or the service provider terminal 140 may communicate with other locating devices to determine the location of the service requester, service requester terminal 120, service provider, or service provider terminal 140. In some embodiments, the service requester terminal 120 and/or the service provider terminal 140 may send the location information to the server 110.

Storage device 130 may store data and/or instructions. In some embodiments, the storage device 130 may store data obtained from the data collection site. In some embodiments, storage device 130 may store data and/or instructions for execution or use by server 110, which may be executed or used by server 110 to implement the example methods described herein. In some embodiments, the storage device 130 may be connected to a network 150 to enable communication with one or more components (e.g., the server 110, the service requester terminal 120, etc.) in the order anomaly identification system 100. One or more components of the order anomaly identification system 100 may access data or instructions stored in the storage device 130 over the network 150. In some embodiments, the storage device 130 may be directly connected or in communication with one or more components of the order anomaly identification system 100 (e.g., the server 110, the service requester terminal 120, etc.). In some embodiments, storage device 130 may be part of server 110.

The network 150 may facilitate the exchange of information and/or data. In some embodiments, one or more components (e.g., server 110, storage 130, and service requester terminal 120, etc.) in the order anomaly identification system 100 may send information and/or data to other components in the order anomaly identification system 100 via the network 150. For example, the server 110 may obtain/obtain data information from the service requester terminal 120 through the network 150. In some embodiments, the network 150 may be any one of, or a combination of, a wired network or a wireless network. For example, network 150 may include a cable network, a wired network, a fiber optic network, a telecommunications network, an intranet, the internet, a Local Area Network (LAN), a Wide Area Network (WAN), a Wireless Local Area Network (WLAN), a Metropolitan Area Network (MAN), a Public Switched Telephone Network (PSTN), a bluetooth network, a ZigBee network, a Near Field Communication (NFC) network, the like, or any combination of the above. In some embodiments, network 150 may include one or more network access points. For example, the network 150 may include wired or wireless network access points, such as base stations and/or Internet switching points 150-1, 150-2, and so forth. Through the access point, one or more components of order anomaly identification system 100 may be connected to network 150 to exchange data and/or information.

Information source 160 is one source that provides other information to order anomaly identification system 100. Information sources 160 may be used to provide the system with information related to order information, such as service times, service locations, legal information, news information, life guide information, and the like. The information source 160 may be in the form of a single central server, or may be in the form of a plurality of servers connected via a network, or may be in the form of a large number of personal devices. When the information source 160 is in the form of a plurality of personal devices, the devices may upload text, voice, images, videos, etc. to the cloud server in a user-generated content manner, so that the cloud server communicates with the plurality of personal devices connected thereto to form the information source 160.

FIG. 2 is a schematic diagram of an exemplary computing device 200 shown in accordance with some embodiments of the invention. Server 110 and storage device 130 may be implemented on computing device 200. For example, the processing engine 112 may be implemented on the computing device 200 and configured to implement the functionality disclosed herein.

Computing device 200 may include any components used to implement the systems described herein. For example, the processing engine 112 may be implemented on the computing device 200 by its hardware, software programs, firmware, or a combination thereof. For convenience, only one computer is depicted in the figures, but the computing functions described herein in connection with order anomaly identification system 100 may be implemented in a distributed manner by a set of similar platforms to spread the processing load of the system.

Computing device 200 may include a communication port 250 for connecting to a network for enabling data communication. Computing device 200 may include a processor (e.g., CPU)220 that may execute program instructions in the form of one or more processors. An exemplary computer platform may include an internal bus 210, various forms of program memory and data storage including, for example, a hard disk 270, and Read Only Memory (ROM)230 or Random Access Memory (RAM)240 for storing various data files that are processed and/or transmitted by the computer. An exemplary computing device may include program instructions stored in read-only memory 230, random access memory 240, and/or other types of non-transitory storage media that are executed by processor 220. The methods and/or processes of the present application may be embodied in the form of program instructions. Computing device 200 also includes input/output component 260 for supporting input/output between the computer and other components. Computing device 200 may also receive programs and data in the present disclosure via network communication.

For ease of understanding, only one processor is exemplarily depicted in fig. 2. However, it should be noted that the computing device 200 in the present application may include multiple processors, and thus the operations and/or methods described in the present application that are implemented by one processor may also be implemented by multiple processors, collectively or independently. For example, if in the present application the processors of computing device 200 perform steps 1 and 2, it should be understood that steps 1 and 2 may also be performed by two different processors of computing device 200, either collectively or independently (e.g., a first processor performing step 1, a second processor performing step 2, or a first and second processor performing steps 1 and 2 collectively).

Fig. 3 is a schematic diagram of exemplary hardware and/or software of an exemplary mobile device 300, shown in accordance with some embodiments of the present invention. As shown in fig. 3, mobile device 300 may include a communication unit 310, a display unit 320, a graphics processor 330, a processor 340, an input/output unit 350, a memory 360, and a storage unit 390. A bus or a controller may also be included in the mobile device 300. In some embodiments, mobile operating system 370 and one or more application programs 380 may be loaded from storage unit 390 into memory 360 and executed by processor 340. In some embodiments, application 380 may receive and display information for image processing or other information related to processing engine 112. The input/output unit 350 may enable interaction of data information with the order anomaly identification system 100 and provide interaction related information to other components in the order anomaly identification system 100, such as the server 110, via the network 150.

To implement the various modules, units and their functionality described in this application, a computer hardware platform may be used as the hardware platform for one or more of the elements mentioned herein. A computer having user interface elements may be used to implement a Personal Computer (PC) or any other form of workstation or terminal equipment. A computer may also act as a server, suitably programmed.

FIG. 4 is a block diagram of an order anomaly identification system according to some embodiments of the present invention. As shown in fig. 4, the system may include a first obtaining module 410, an order anomaly recognition module 420, a first order anomaly recognition model training module 430, a second order anomaly recognition model training module 440, and a governing policy enforcement module 450. In some embodiments, the first obtaining module 410, the order anomaly recognition module 420, the first order anomaly recognition model training module 430, the second order anomaly recognition model training module 440, and the governing policy enforcement module 450 may be included in the processing engine 112 shown in fig. 1.

The first obtaining module 410 may be used to obtain an order to be tested. In some embodiments, the order to be tested includes a network appointment service order, a home service order, an express order, a take-away order, and other service type orders. In some embodiments, the order under test may be a historical order over a period of time or an order currently being executed. In some embodiments, the order to be tested may be an order for the service provider to complete the service, an order for the service provider to cancel in the middle, an order for the service requester to submit only the service requirement, or an order for the service provider to submit only the available service. In some embodiments, the order information to be tested may include service requester information, time when the service requester places a service demand, service location, service provider information, and the like. In some embodiments, the historical order to be tested or the current order to be tested may be obtained from the network 150, the storage device 130, the server 110, the service requester terminal 120, the information source 160, and the like.

In some embodiments, the first obtaining module 410 may be further configured to obtain a characteristic parameter associated with the order to be tested. In some embodiments, the characteristic parameter associated with the order under test reflects at least one of the following pieces of information: service time, service location, operational behavior of the service requester or service provider on the platform, personal information of the service requester or service provider, or subscription requirements of the service requester to the service. In some embodiments, the service time may include order placement time, order execution time. In some embodiments, the service location may include travel route related locations and their remote locations, length of travel, and the like. In some embodiments, the travel route-related locations may include a start point, an end point of the appointment, and a route location on the travel path between the start point and the end point. In some embodiments, the remote location of the travel route may be inversely related to the number of orders within a certain range of the location over a certain time. For example, if the starting point appears in the order more times in a week, it can be determined that the location is less remote, and the location related to the driving route of the order is less remote. In some embodiments, the operation behavior of the service requester or service provider on the platform may include the order cancellation frequency, the order cancellation timing, the order modification operation, and the like of the service requester or service provider within a certain time range. In some embodiments, the frequency of cancellation orders by a service requester or service provider over a time range may be determined as a related characteristic value. For example, the frequency with which a passenger or driver takes orders during the day. In some embodiments, the amount of inventory of a service requester or service provider within a certain time frame may be determined as a characteristic parameter. For example, the passenger or driver completes the number of orders within a month. In some embodiments, the personal information of the service requester or service provider may include a gender of the service requester or service provider, a registration time of the service requester or service provider, an address confidence of the service requester or service provider, a workplace confidence of the service requester or service provider, a loan condition of the service requester or service provider, an education level of the service requester or service provider, a number of complaints of the service requester or service provider within a time range, and an evaluated condition of the service requester or service provider within a time range.

The order abnormity identification module 420 is configured to process at least a part of the characteristic parameters by using a first order abnormity identification model to obtain a first identification result; processing at least one part of the characteristic parameters by using a second order abnormity identification model to obtain a second identification result; and determining the abnormal identification result of the order to be detected by combining the first identification result and the second identification result.

In some embodiments, the first order anomaly identification model may be a classification model. Such as decision tree models, bayesian classification, random forests, support vector machines, neural networks, and the like. In some embodiments, the above-mentioned feature parameters reflecting the service time, the service location, the operation behavior of the service requester or service provider on the platform, the personal information of the service requester or service provider, or the subscription requirement of the service requester for the service may be obtained, and the classification threshold corresponding to each feature parameter may be determined. Taking the network car booking service as an example, when the characteristic parameter is the order execution time, the corresponding classification threshold value can be 22:00-05:00, and the order execution time is divided into a night order and a non-night order. For another example, the characteristic parameter is the degree of remoteness of the relevant location of the driving route, the degree of remoteness is ten levels in the order of 0 to 10, and the corresponding classification threshold may be "greater than 5". For another example, the characteristic parameter is the order cancellation frequency of the service requester or service provider within a certain time, and the corresponding classification threshold may be "cancel the order 5 times within 30 minutes". In some embodiments, the determination of the classification threshold may be determined by human setting, statistical calculation, machine training, and the like. In some embodiments, after the characteristic parameters in the order to be tested are classified one by one according to the corresponding classification threshold, a final identification result can be obtained, which may be a result of an "abnormal order" or a "normal order".

In some embodiments, the second order anomaly identification model may be a regression model. For example: linear regression, logistic regression, polynomial regression, stepwise regression, ridge regression, Lasso regression, ElasticNet regression, and the like. In some embodiments, the characteristic parameters in the second order anomaly identification model may be the same as or different from or overlap with the characteristic parameters in the first order anomaly identification model. In some embodiments, the characteristic parameters in the second order anomaly identification model are acquired independently from the characteristic parameters in the first order anomaly identification model. In some embodiments, the second order anomaly identification model and the first order anomaly identification model are trained or established independently. For example, when the first order abnormality recognition model is a decision tree model and the second order abnormality recognition model is a regression model, the sample and the feature parameters thereof may be obtained independently, the classification threshold corresponding to the feature parameters in the decision tree and the order of splitting the feature parameters are obtained through training, the decision tree model is obtained through training, and the training sample and the feature parameters thereof may be obtained additionally, and the regression model is obtained through training. In some embodiments, the samples training the first order anomaly recognition model and the second order anomaly recognition model may be from the same set of samples.

In some embodiments, the regression model may output a probability value of an order anomaly. In some embodiments, a threshold of the probability value may be determined, and an identification result of whether the order to be tested is an abnormal order is obtained according to a comparison between the probability value of the abnormal order and the threshold. In some embodiments, the degree of abnormality of the abnormal order may be further determined according to the probability value to determine the degree of danger of the abnormal order. For example, the degree of abnormality may be a continuity value obtained by an established relationship function, or values in different intervals may be classified into different grades, and the higher the grade is, the greater the degree of abnormality is, the greater the potential risk of the order is. In some embodiments, when the first identification result indicates that the order to be tested is an abnormal order, the second order abnormal identification model may be reused to determine the abnormality degree of the order to be tested. And using the abnormality degree as an abnormality identification result of the order to be detected.

The first order anomaly identification model training module 430 may be used to obtain historical orders. In some embodiments, historical orders over a period of time may be obtained as training samples. Such as a one week historical order, a one month historical order, etc. In some embodiments, the order may include an order that is a completed order, an order that was cancelled in the middle, or the like that has submitted a record in the system 100 of the service request. In some embodiments, historical orders over a period of time that includes an order exception may be obtained. For example, when an order exception occurs in 2017, 2, 8, historical orders including within one week of the day may be obtained as training samples. If an order abnormality occurs in each of days 2 and 8 in 2017 and days 10 and 5 in 2017, historical orders in the week of 8 in 2017 and 10 and 5 in 2017 can be obtained. Because the number of order abnormity is usually very small, and is possibly only a few in one year, the training samples are obtained in such a way, the abnormal order samples can be obtained, and the training result and the processing speed are not affected due to the fact that the sample size of the normal order is too large.

In some embodiments, the first order anomaly recognition model training module 430 may be configured to obtain feature parameters associated with historical orders. In some embodiments, the characteristic parameters may include order-related characteristic parameters such as the service time, the service location, the operation behavior of the service requester or service provider on the platform, personal information of the service requester or service provider, or the subscription requirement of the service requester for the service.

In some embodiments, the first order anomaly identification model training module 430 may be configured to mark the order anomalies in the historical orders as positive samples and the normal orders in the historical orders as negative samples. In some embodiments, historical orders may be flagged by a human. For example, in the training sample, order exceptions occur on the day of 8.2.2017, all historical orders on the day of 8.2.2017 have been obtained as samples, the order exceptions on the day of 8.2.2017 may be marked as positive samples, and other normal orders on the day may be marked as negative samples.

In some embodiments, the first order anomaly recognition model training module 430 may be configured to train a first initial model based on the feature parameters and the labeling results in the historical orders to obtain the first order anomaly recognition model. In some embodiments, the first order anomaly identification model may be a decision Tree model, including, but not limited to, Classification And Regression Tree (CART), iterative binary Tree three generation (ID 3), C4.5 algorithm, Random Forest (Random Forest), card square Automatic Interaction Detection (CHAID), Multiple Adaptive Regression Splines (MARS), And Gradient Boosting Machine (GBM), or the like, or any combination thereof.

In some embodiments, the first order anomaly identification model training module 430 may be configured to verify whether the judgment condition and the division result at a node in the first order anomaly identification model are consistent with the distribution of the samples. In some embodiments, nodes in the model have a one-to-one correspondence with the characteristic parameters. The training samples are divided into two types of sample subsets (positive samples and negative samples) at the nodes according to the judgment conditions corresponding to the characteristic parameters, and whether the division result at a certain node is consistent with the distribution of actual positive and negative samples can be verified. For example, in the trained first order abnormality recognition model, the judgment condition corresponding to the characteristic parameter "the completion amount of the service requester" is "greater than the X threshold", and samples satisfying that the completion amount of the service requester is greater than the X threshold are classified into positive samples. In practice, however, in the positive sample, the characteristic parameter "the amount of singletons of service requesters" is much less than the X threshold. Then the node does not conform to the distribution of samples, resulting in an overfitting of the model. If the judgment condition and the division result at the node are not consistent with the actual distribution of the sample, the node can be replaced by other nodes. In some embodiments, a new sub-tree may be obtained by performing decision tree training using all samples at the node and all lower level nodes of the node. And replacing the subtree formed by the node and the lower-layer node in the original first order abnormity identification model with the new subtree. For example, the characteristic parameter of a certain node in the first order abnormality recognition model is "completion amount of service requester", and the characteristic parameter of a node at the next stage of the node is "number of complaints of service requester". And if verification shows that the judgment condition division result corresponding to the characteristic parameter 'the service requester's completion quantity 'is inconsistent with the distribution of the positive sample, deleting the node corresponding to the characteristic parameter, and replacing the deleted node with the characteristic parameter' the service requester's complaint times' of the original next-level node. For another example, the characteristic parameter of a certain node in the first order abnormality recognition model is "completion amount of service requester", the characteristic parameter of the next node of the node is "number of complaints of service requester", and the following nodes include "address confidence of service requester or service provider", "work place confidence of service requester or service provider", "loan condition of service requester or service provider", and "education degree of service requester or service provider". It is understood that the nodes corresponding to the characteristic parameters "number of complaints of the service requester", "address confidence of the service requester or service provider", "workplace confidence of the service requester or service provider", "loan status of the service requester or service provider", "education of the service requester or service provider" constitute a sub-tree. If verification finds that the result of the judgment condition division corresponding to the characteristic parameter 'the completion of the single amount of the service requester' is inconsistent with the distribution of the positive samples, the node corresponding to the characteristic parameter is deleted, all samples at the original nodes corresponding to the characteristic parameter 'the completion of the single amount of the service requester' are used as training samples, and the nodes corresponding to the characteristic parameters 'the number of times of complaints of the service requester', 'the address confidence of the service requester or the service provider', 'the working place confidence of the service requester or the service provider', 'the loan condition of the service requester or the service provider', 'the education degree of the service requester or the service provider' are retrained to obtain a new sub-tree. And replacing the new sub-tree with the original sub-tree started by the node corresponding to the characteristic parameter 'completion amount of service requester'. And obtaining a new first order abnormity identification model. In some embodiments, each node in the first order anomaly identification model may be verified and optimized, and finally, the first order anomaly identification model in which the characteristic parameters of all the nodes conform to the actual distribution of the sample is obtained.

The second order anomaly identification model training module 440 can be used for acquiring historical orders and acquiring characteristic parameters related to the historical orders. In some embodiments, the second order anomaly identification model may obtain the same historical order as the first order anomaly identification model as a training sample. In some embodiments, the second order anomaly recognition model may obtain a different historical order from the first order anomaly recognition model as a training sample. In some embodiments, the training samples of the second order anomaly recognition model may overlap with the training samples of the first order anomaly recognition model. In some embodiments, the characteristic parameters of the second order anomaly identification model may be the same as the characteristic parameters of the first order anomaly identification model. In some embodiments, the characteristic parameters of the second order anomaly identification model may be different from the characteristic parameters of the first order anomaly identification model. In some embodiments, the characteristic parameters of the second order anomaly identification model may overlap with the characteristic parameters of the first order anomaly identification model.

The second order anomaly identification model training module 440 may be configured to mark the order anomalies in the historical orders as positive samples, and the normal orders in the historical orders as negative samples. The second order anomaly identification model training module 440 may be configured to train a second initial model based on the feature parameters and the labeling results in the historical orders to obtain the second order anomaly identification model. In some casesIn an embodiment, the second order anomaly identification model may be a logistic regression model. In some embodiments, a greedy algorithm may be employed to optimize the model. In some embodiments, the characteristic parameters in the model may be determined by maximum likelihood estimation. In some embodiments, a log-likelihood function may be employed, i.e.

And (4) calculating.

The management and control policy executing module 450 is configured to determine and execute a risk management and control policy based on the abnormal recognition result of the order to be tested. In some embodiments, the risk management policy may be to issue alert information to the service requester and/or the service provider. Taking the network car booking service as an example, when the identification result of the order to be detected is 'order abnormity', an instruction can be sent to the user terminal of the passenger and/or the driver, and a voice prompt 'please pay attention to the safety of taking a car' is sent out at the user terminal. In some embodiments, the risk management policy may be to authenticate the service requestor and/or the service provider. In some embodiments, the service requestor and/or the service provider may be authenticated when the degree of abnormality is high. In some embodiments, the authentication may be by a request from a user terminal of the service requester and/or the service provider, requesting the service requester and/or the service provider to upload an identity document, perform face recognition, perform voice recognition of the service requester and/or the service provider, perform vehicle certification, perform vehicle information recognition, or the like. In some embodiments, the execution of the order under test may be terminated if the service requester and/or service provider fails authentication or denies authentication. In some embodiments, the real-name authentication may be performed first, the identity document of the service requester and/or the service provider is verified, the real-name authentication is passed, then the face recognition is performed, if the face recognition and the real-name authentication result are the same, the authentication is passed, and the order is continued, otherwise, the authentication is not passed, and the order is ended. In some embodiments, the risk management policy may be to monitor the behavior of the service requester and/or service provider as the order is executed. In some embodiments, the risk management policy may be to terminate the order to be tested directly, not assign the order to a service provider, or cancel the order directly after the order is dispatched. For example, in the network car booking service, after the passenger submits the request, if the order to be tested is an abnormal order and the abnormality degree is extremely high as a result of the identification, the server can directly stop the order dispatching so as to protect the safety of the service provider. If the order to be detected is an abnormal order and the abnormality degree is extremely high after the system dispatches the order, the server can directly cancel the order after the dispatch and inform the passenger of the reason for cancellation so as to protect the safety of the passenger.

It should be understood that the system and its modules shown in FIG. 4 may be implemented in a variety of ways. For example, in some embodiments, the system and its modules may be implemented in hardware, software, or a combination of software and hardware. Wherein the hardware portion may be implemented using dedicated logic; the software portions may be stored in a memory for execution by a suitable instruction execution system, such as a microprocessor or specially designed hardware. Those skilled in the art will appreciate that the methods and systems described above may be implemented using computer executable instructions and/or embodied in processor control code, such code being provided, for example, on a carrier medium such as a diskette, CD-or DVD-ROM, a programmable memory such as read-only memory (firmware), or a data carrier such as an optical or electronic signal carrier. The system and its modules of the present application may be implemented not only by hardware circuits such as very large scale integrated circuits or gate arrays, semiconductors such as logic chips, transistors, or programmable hardware devices such as field programmable gate arrays, programmable logic devices, etc., but also by software executed by various types of processors, for example, or by a combination of the above hardware circuits and software (e.g., firmware).

It should be noted that the above description is merely for convenience and should not be taken as limiting the scope of the present application. It will be understood by those skilled in the art that, having the benefit of the teachings of this system, various modifications and changes in form and detail may be made to the field of application for which the method and system described above may be practiced without departing from this teachings. For example, the first acquisition module 410 and the order anomaly identification module 420 may be integrated together into one module, while performing the functions of data acquisition and model training. However, such changes and modifications do not depart from the scope of the present application.

FIG. 5 is a block diagram of an order risk management system according to some embodiments of the present invention. As shown in fig. 5, the system may include a second obtaining module 510, a service order generating module 520, and a risk management receiving module 530. In some embodiments, the second obtaining module 510, the service order generating module 520, and the risk management receiving module 530 may be included in the service requester terminal 120 or the service provider terminal 140 shown in fig. 1.

The second obtaining module 510 may be configured to obtain a service request of a service requester. In some embodiments, the service request includes at least a service time and a service location. In some embodiments, the service time may be the time the service requester places an order. In some embodiments, the service time may be the time at which the order was executed. In some embodiments, the service location may be a location where the service starts, a location where the service terminates, a location where the service performs a process. Taking the network appointment car as an example, the service location may be information such as a starting point, an end point, a route location of a travel route, a trip length, and the like. In some embodiments, the service site may be a remote location of the site of interest.

The service order generation module 520 may be configured to generate a service order based on the service request and send the service order to the server. In some embodiments, the service order may be generated based on information such as service time, service location, and the like. In some embodiments, after receiving the service order, the server may identify the order abnormality by using the service order as the order to be tested.

The risk management and control receiving module 530 may be configured to receive an abnormal identification result of the service order sent by the server or a risk management and control indication related to the abnormal identification result. In some embodiments, the risk management indication related to the anomaly identification result may include warning information. Taking the network car reservation service as an example, at a passenger end, a warning message of' dripping reminding you, suspected abnormality of the current order, and in order to ensure the driving safety at night, a dripping platform carries a hand and a police, and protects the safety of you and a driver in the whole process! "in some embodiments, different alert information may indicate different degrees of abnormality for an order abnormality. In some implementations, the risk management indication associated with the anomalous recognition result may be an authentication request. In some embodiments, the authentication request may be a combination of one or more of requiring the service requester and/or service provider to upload an identity document, perform face recognition, voice recognition by the service requester and/or service provider, vehicle certification documents, vehicle information recognition, and the like. In some embodiments, the service requester and/or service provider may receive a message that the authentication is successful or a message that the authentication is not successful after performing the authentication. It may also be a direct receipt of an order to proceed or a termination of an order. In some embodiments, the service requester and/or service provider may receive information that the order has terminated without fulfilling the request for authentication. In some embodiments, the risk governing indication associated with the anomaly identification result may include a request for transmission of behavioral information by a service requester and/or a service provider when an order is executed. Taking the network appointment service as an example, the real-time transmission of the driving path and the current position of the vehicle, the transmission of information on whether the driving path is unexpectedly interrupted or stopped, the transmission of order modification information, the transmission of order unexpected interruption or cancellation information, and the like can be required in the driving process. It is also possible to require the full-range transmission of behavior information, distress information, etc. of passengers and drivers in the vehicle. In some embodiments, the user terminal may receive the order termination information directly. For example, in the network car booking service, if the order to be tested is abnormal and the abnormality degree is extremely high as a result of the identification, the server can directly stop dispatching the order and send the information of order termination to the user terminal. In some embodiments, the alert information received by the user terminal may frighten the service requester and alert the service provider of security. Or frightening the service provider and carrying out safety reminding on the service requester.

It should be understood that the system and its modules shown in FIG. 5 may be implemented in a variety of ways. For example, in some embodiments, the system and its modules may be implemented in hardware, software, or a combination of software and hardware. Wherein the hardware portion may be implemented using dedicated logic; the software portions may be stored in a memory for execution by a suitable instruction execution system, such as a microprocessor or specially designed hardware. Those skilled in the art will appreciate that the methods and systems described above may be implemented using computer executable instructions and/or embodied in processor control code, such code being provided, for example, on a carrier medium such as a diskette, CD-or DVD-ROM, a programmable memory such as read-only memory (firmware), or a data carrier such as an optical or electronic signal carrier. The system and its modules of the present application may be implemented not only by hardware circuits such as very large scale integrated circuits or gate arrays, semiconductors such as logic chips, transistors, or programmable hardware devices such as field programmable gate arrays, programmable logic devices, etc., but also by software executed by various types of processors, for example, or by a combination of the above hardware circuits and software (e.g., firmware).

It should be noted that the above description is merely for convenience and should not be taken as limiting the scope of the present application. It will be understood by those skilled in the art that, having the benefit of the teachings of this system, various modifications and changes in form and detail may be made to the field of application for which the method and system described above may be practiced without departing from this teachings. For example, the secondary acquisition module 510 and the service order generation module 520 may be integrated together into one module, while performing the functions of data acquisition and model training. However, such changes and modifications do not depart from the scope of the present application.

FIG. 6 is an exemplary flow diagram illustrating order exception identification according to one embodiment of the present invention. In some embodiments, flow 600 may be performed by processing logic that may comprise hardware (e.g., circuitry, dedicated logic, programmable logic, microcode, etc.), software (instructions run on a processing device to perform hardware simulation), etc., or any combination thereof. One or more of the operations in the flow 600 for identifying order anomalies illustrated in FIG. 6 may be implemented by the roadway information system 100 illustrated in FIG. 1. For example, the flow 600 may be stored in the storage device 130 in the form of instructions and executed by the processing engine 112 to perform the calls and/or perform the operations (e.g., the processor 220 of the computing device 200 shown in fig. 2, the central processor 340 of the mobile device 300 shown in fig. 3).

At 610, an order to be tested may be obtained. Operation 610 may be performed by the first obtaining module 410. In some embodiments, the order to be tested includes a network appointment service order, a home service order, an express order, a take-away order, and other service type orders. In some embodiments, the order under test may be a historical order over a period of time or an order currently being executed. In some embodiments, the period of time may be one week, one month, one quarter, half a year, one year, or several years. In some embodiments, the order to be tested may be an order for the service provider to complete the service, an order for the service provider to cancel in the middle, an order for the service requester to submit only the service requirement, or an order for the service provider to submit only the available service. Taking a network car booking service order as an example, the order to be tested can be an order that a passenger has submitted a car booking requirement, the order to be tested can be an order that a server has matched a driver, the order to be tested can be an order that the driver has taken an order, the order to be tested can be an order that the driver has completed service, and the order to be tested can be an order that the passenger cancels at any time in the midway. In some embodiments, the order information to be tested may include service requester information, time when the service requester places a service demand, service location, service provider information, and the like. Taking a network car appointment as an example, the order information to be tested may include personal information of the passenger, credit information of the passenger, time of the passenger's car appointment, place of the passenger's car getting on, terminal, driving track, driver's information, driver's credit information, order completion time, and the like. In some embodiments, the historical order to be tested or the current order to be tested may be obtained from the network 150, the storage device 130, the server 110, the service requester terminal 120, the information source 160, and the like.

At 620, characteristic parameters associated with the order to be tested may be obtained. Operation 620 may be performed by the first obtaining module 410. In some embodiments, the characteristic parameter associated with the order under test reflects at least one of the following pieces of information: service time, service location, operational behavior of the service requester or service provider on the platform, personal information of the service requester or service provider, or subscription requirements of the service requester to the service. In some embodiments, the service time may include order placement time, order execution time. In some embodiments, the order placing time may be the time when the passenger submits a service request to the server, and the order placing time may be the time taken by the driver to pick up the passenger and then take the passenger from the starting point to the ending point as requested by the order. For example, the passenger's order time is 14:00 PM and the order execution time is 17:30 PM to 18:40 PM.

In some embodiments, the service location may include information about the remoteness, length of travel, etc. of the location associated with the travel route. In some embodiments, the travel route-related locations may include a start point, an end point of the appointment, and a route location on the travel path between the start point and the end point. In some embodiments, the remote location of the travel route may be inversely related to the number of orders within a certain range of the location over a certain time. For example, if the starting point appears in the order more times in a week, it can be determined that the location is less remote, and the location related to the driving route of the order is less remote. For example, if the terminal appears in the order only a few times or does not appear in a month, it can be determined that the location is remote, and the location related to the driving route of the order is remote. For another example, if a certain route point on the driving route appears little or none in the order within one week, it can be determined that the location related to the driving route of the order is far away. In some embodiments, finding the number of times a place appears in an order may be determined using a Geohash encoding algorithm. The geographic space can be divided into rectangular areas, each rectangular area is coded, and the longer the coding length is, the thinner the divided rectangular area is. In some embodiments, the Geohash code length may be selected to be between 1 bit and 12 bits. For example, a 6-bit code may be selected, and a rectangular region may represent a region in the range of about 600 x 600 meters. In some embodiments, the relevant place of the driving route can be projected into the corresponding rectangular area, and the order number in each rectangular area is counted, so as to obtain the remote degree of the place. For example, the starting point of a certain order is the north sea park, and the number of times of the order in the rectangular area of the north sea park within one week can be represented statistically, if the number of times is more, the remote location is lower. In some embodiments, the remote degree of the driving route may be determined by first collecting sampling points on the driving route at equal intervals as the waypoints, for example, collecting 5 sampling points on the driving route at equal intervals as the waypoints, performing distribution statistics on the number of orders in the rectangular area corresponding to the 5 waypoints, and determining the remote degree of the driving route according to the number of orders appearing at the 5 waypoints. In some embodiments, the collected sampling points at equal intervals on the driving route may be used as the waypoints, and then the diffusion sampling points are obtained on the basis of the waypoints, for example, one sampling point may be collected on each of the two sides of each waypoint as the diffusion sampling point, if there are 5 waypoints, corresponding 10 diffusion sampling points may be obtained, the number of orders corresponding to the waypoints and the diffusion sampling points is counted, and the deviation degree of the driving route is determined. If there are few or no orders for a waypoint or diffusion waypoint, the travel route may be considered to be more remote. If there are half of the waypoints or spread spots with little or no orders, the travel route may be considered highly remote. In some embodiments, the remote may be represented as a continuum of values. For example, a relational equation of the order quantity of the place related to the travel path is established, and the calculated value is directly obtained through the relational equation. In some embodiments, the remote may be represented as a discrete number. For example, the degree of segregation can be a class classification of 0, 1, 2-10, the larger the number is, the higher the degree of segregation is, the interval of different order numbers corresponds to a degree, and the degree of segregation corresponding to the degree can be obtained according to the order number of the relevant place. In some embodiments, the trip length may be kilometers of the route traveled. For example, the travel route between the start point and the end point is 45 km, and the travel length is 45 km.

In some embodiments, the operation behavior of the service requester or service provider on the platform may include the order cancellation frequency, the order cancellation timing, the order modification operation, and the like of the service requester or service provider within a certain time range. In some embodiments, the frequency of cancellation orders by a service requester or service provider over a time range may be determined as a related characteristic value. For example, the frequency with which a passenger or driver takes orders during the day. Or the frequency of the passenger or the driver canceling the order after continuously taking the order within 10 minutes. In some embodiments, the amount of inventory of a service requester or service provider within a certain time frame may be determined as a characteristic parameter. For example, the passenger or driver completes the number of orders within a month.

In some embodiments, the personal information of the service requester or service provider may include a gender of the service requester or service provider, a registration time of the service requester or service provider, an address confidence of the service requester or service provider, a workplace confidence of the service requester or service provider, a loan condition of the service requester or service provider, an education level of the service requester or service provider, a number of complaints of the service requester or service provider within a time range, and an evaluated condition of the service requester or service provider within a time range. In some embodiments, an address confidence for a service requester or service provider, a workplace confidence for a service requester or service provider may be determined based on a confidence for a user frequented location. Taking the car booking service as an example, the longitude and latitude of the starting Point or the ending Point of each historical order and the Point of Interest (POI) corresponding to the longitude and latitude within a period of time of a passenger (namely an order initiator) can be analyzed through an existing algorithm, the type (residential area or business area) of the POI is identified, the address and/or the company address of the passenger is predicted, and the confidence degree of the predicted address and/or the company address is determined. For example, the residential type of interest point that appears most frequently over a period of time (january, march, half year, etc.) may be determined as the passenger's address, and the commercial district type of interest point that appears most frequently may be determined as the passenger's corporate address. In some embodiments, the confidence level of the predicted address and/or company address may be calculated according to the following formula:

where α is the confidence level of the predicted address and/or company address (i.e., the address and/or company address that appears most frequently in the historical order), N_maxIs the number of occurrences of the predicted address and/or company address. In some embodiments, if the confidence level exceeds a preset threshold, it is determined that the user has a fixed residential site and/or a fixed work site.

In some embodiments, the loan condition may include, but is not limited to, the number of loans, the amount of borrowed, the term of borrowed, and the repayment condition. In some embodiments, the characteristic value obtaining module 420 may obtain the loan status of the order originator from a third-party database. The third party database includes but is not limited to bank database, social security agency database, credit assessment agency database, p2p network lending platform database.

In some embodiments, the personal information may include an educational level. In some embodiments, the level of education may be represented by discrete values. For example, the primary school culture is represented by 0, the junior middle school culture is represented by 1, the high school culture is represented by 2, and the subject and above are represented by 3. In some embodiments, the educational level may be represented by two values, where the educational level is represented by 1 if the academic story is above the subject and 0 if below the subject.

In some embodiments, the characteristic parameter may be the number of complaints made by the service requester or service provider over a time range and/or the evaluated condition of the service requester or service provider over a time range. For example, the number of complaints made by a service requester or a service provider within one month is counted. In some embodiments, service requestors or service providers may cross each other with a full score of five stars, and at worst there may be no or one star. Or directly carrying out mutual evaluation on good evaluation or bad evaluation. For example, the number of bad comments received by the service requester or service provider and the number of good comments received by the service requester or service provider may be counted within one month. Or the order quantity of one-star evaluation received in one month and the order quantity of five-star evaluation received in one month.

In some embodiments, the characteristic parameter may be a service requester's subscription requirement for a service tool or a service provider's subscription requirement. For example, customization requirements such as a requirement for the gender of the driver, a requirement for the number of good reviews by the driver, a requirement for the brand of the vehicle, a requirement for the model of the vehicle, a requirement for the price of the vehicle, etc.

At 630, at least a portion of the characteristic parameters may be processed using a first order anomaly identification model to obtain a first identification result. In some embodiments, 630 may be performed by order exception identification module 420. In some embodiments, the first order anomaly identification model may be a classification model. Such as decision tree models, bayesian classification, random forests, support vector machines, neural networks, and the like. In some embodiments, the above-mentioned feature parameters reflecting the service time, the service location, the operation behavior of the service requester or service provider on the platform, the personal information of the service requester or service provider, or the subscription requirement of the service requester for the service may be obtained, and the classification threshold corresponding to each feature parameter may be determined. Taking the network car booking service as an example, when the characteristic parameter is the order execution time, the corresponding classification threshold value can be 22:00-05:00, and the order execution time is divided into a night order and a non-night order. For another example, the characteristic parameter is the degree of remoteness of the relevant location of the driving route, the degree of remoteness is ten levels in the order of 0 to 10, and the corresponding classification threshold may be "greater than 5". For another example, the characteristic parameter is the order cancellation frequency of the service requester or service provider within a certain time, and the corresponding classification threshold may be "cancel the order 5 times within 30 minutes". In some embodiments, the determination of the classification threshold may be determined by human setting, statistical calculation, machine training, and the like. In some embodiments, after the characteristic parameters in the order to be tested are classified one by one according to the corresponding classification threshold, a final identification result can be obtained, which may be a result of an "abnormal order" or a "normal order". In some embodiments, the recognition result may be to output different numbers, for example, "0" for "normal order" and "1" for "abnormal order".

At 640, at least a portion of the characteristic parameters may be processed using a second order anomaly recognition model to obtain a second recognition result. In some embodiments, 640 may be performed by the order anomaly identification module 420. In some embodiments, the second order anomaly identification model may be a regression model. For example: linear regression, logistic regression, polynomial regression, stepwise regression, ridge regression, Lasso regression, Elastic Net regression, and the like. In some embodiments, the characteristic parameters in the second order anomaly identification model may be the same as or different from or overlap with the characteristic parameters in the first order anomaly identification model. In some embodiments, the characteristic parameters in the second order anomaly identification model are acquired independently from the characteristic parameters in the first order anomaly identification model. In some embodiments, the second order anomaly identification model and the first order anomaly identification model are trained or established independently. For example, when the first order anomaly identification model is a decision tree model, the second order anomaly identification model is a regression model. The method can independently obtain a sample and characteristic parameters thereof, train to obtain a classification threshold corresponding to the characteristic parameters in the decision tree and the splitting order of the characteristic parameters, train to obtain a decision tree model, and can additionally obtain the sample and the characteristic parameters thereof and train to obtain a regression model. In some embodiments, the samples training the first order anomaly recognition model and the second order anomaly recognition model may be from the same set of samples. In some embodiments, the regression model may output a probability value of an order anomaly. In some embodiments, a threshold of the probability value may be determined, and an identification result of whether the order to be tested is an abnormal order is obtained according to a comparison between the probability value of the abnormal order and the threshold. In some embodiments, the degree of abnormality of the abnormal order may be further determined according to the probability value to determine the degree of danger of the abnormal order. For example, the degree of abnormality may be a continuity value obtained by an established relationship function, or values in different intervals may be classified into different grades, and the higher the grade is, the greater the degree of abnormality is, the greater the potential risk of the order is.

In some embodiments, the first order abnormity identification model and the second order abnormity identification model can independently identify the order abnormity, and respectively output the identification result of whether the order abnormity is detected. In some embodiments, the order abnormity identification can be performed by using only the first order abnormity identification model or the second order abnormity identification model, and the identification result of whether the order is abnormal or not is output. In some embodiments, the first order anomaly identification model or the first order anomaly identification model may be selected to identify an order anomaly under different conditions, or the first order anomaly identification model and the first order anomaly identification model may be selected to independently identify an order anomaly and output identification results respectively.

In 650, an abnormal recognition result of the order to be tested may be determined by combining the first recognition result and the second recognition result. In some embodiments, step 650 may be performed by order exception identification module 420. In some embodiments, when the first identification result indicates that the order to be tested is an abnormal order, the second order abnormal identification model may be reused to determine the abnormality degree of the order to be tested. And using the abnormality degree as an abnormality identification result of the order to be detected. In some embodiments, when the first identification result is that the order to be tested is an abnormal order and the second identification result is also an abnormal order, the identification result of the order to be tested is considered to be an abnormal order. In some embodiments, if one of the first identification result or the second identification result is an abnormal order, the identification result of the order to be tested may be considered as an abnormal order. In some embodiments, when the first identification result indicates that the order to be tested is not an abnormal order, the order to be tested may be a normal order as an abnormal identification result of the order to be tested. In some embodiments, when the second identification result indicates that the order to be tested is not an abnormal order, the order to be tested may be a normal order as the abnormal identification result of the order to be tested. In some embodiments, when both the first identification result and the second identification result indicate that the order to be tested is not an abnormal order, the order to be tested may be a normal order as an abnormal identification result of the order to be tested. In some embodiments, the identification result may be a determination result of whether the order to be tested is an abnormal order, for example, the identification result may be an "abnormal order" or a "normal order". In some embodiments, if the identification result is an abnormal order, the final abnormal identification result of the order to be tested may be an abnormal degree. For example, the output recognition result is that the degree of abnormality is high, or the degree of abnormality is 7(1-10 scale). In some embodiments, the identification result may include whether it is an abnormal order and a degree of abnormality. For example, the recognition result may be "abnormal order" with an abnormality degree of 8. Or the recognition result is 'normal order', and the abnormality degree is 4 grades. In some embodiments, if the identification result indicates that the order to be tested is a normal order, only the abnormal identification result of the order to be tested may be output as a normal order.

At 660, a risk management policy may be determined and executed based on the anomaly identification result for the order under test. In some embodiments, this step may be performed by the governing policy enforcement module 450. In some embodiments, the risk management policy may be to issue alert information to the service requester and/or the service provider. Taking the network car booking service as an example, when the identification result of the order to be detected is 'order abnormity', an instruction can be sent to the user terminal of the passenger and/or the driver, and a voice prompt 'please pay attention to the safety of taking a car' is sent out at the user terminal. In some embodiments, the alert information may be a combination of one or more of an audible prompt, a voice prompt, a light prompt, a vibration prompt of the user terminal, and the like. In some embodiments, different alert messages may be issued depending on the degree of abnormality. For example, taking a car booking service as an example, when the degree of abnormality is low, a warning message "drip to remind you," and the current order is suspected to be abnormal, in order to ensure the driving safety at night, the drip platform will carry a police party, and protect the safety of you and the driver! ". When the abnormality degree is higher, a warning message 'dripping and carrying a hand police to remind a user' can be sent out: triggering a drip safety guard! The system can completely relate to the safety of a driver, and if an abnormal condition exists, the system can timely synchronize a public security organization, and 100 percent of quick positioning and tracking is realized! The right to drip is used together with the police to guard the trip safety! ". In some embodiments, the alert information is different on the passenger side and the driver side. For example, the warning information at the driver end is ' drip reminding you ', in order to guarantee the driving safety at night, the drip platform will carry the police, and protect your safety and passengers in the whole process '. In some embodiments, the risk management policy may be to authenticate the service requestor and/or the service provider. In some embodiments, the service requestor and/or the service provider may be authenticated when the degree of abnormality is high. In some embodiments, the authentication may be by a request from a user terminal of the service requester and/or the service provider, requesting the service requester and/or the service provider to upload an identity document, perform face recognition, perform voice recognition of the service requester and/or the service provider, perform vehicle certification, perform vehicle information recognition, or the like. In some embodiments, the execution of the order under test may be terminated if the service requester and/or service provider fails authentication or denies authentication. In some embodiments, the real-name authentication may be performed first, the identity document of the service requester and/or the service provider is verified, the real-name authentication is passed, then the face recognition is performed, if the face recognition and the real-name authentication result are the same, the authentication is passed, and the order is continued, otherwise, the authentication is not passed, and the order is ended. In some embodiments, the risk management policy may be to monitor the behavior of the service requester and/or service provider as the order is executed. By taking the network car booking service as an example, whether the running path has large deviation or not, whether the running path is accidentally interrupted or stopped or not, whether the order is greatly modified or not, whether the order is accidentally interrupted or cancelled or not can be monitored in the whole process, whether the passenger and the driver in the vehicle have accidental help-seeking information or not can be monitored in the whole process, and the like. In some embodiments, the risk management policy may be to terminate the order to be tested directly, not assign the order to a service provider, or cancel the order directly after the order is dispatched. For example, in the network car booking service, after the passenger submits the request, if the order to be tested is an abnormal order and the abnormality degree is extremely high as a result of the identification, the server can directly stop the order dispatching so as to protect the safety of the service provider. If the order to be detected is an abnormal order and the abnormality degree is extremely high after the system dispatches the order, the server can directly cancel the order after the dispatch and inform the passenger of the reason for cancellation so as to protect the safety of the passenger. In some embodiments, the risk management policy may be executed after the service requester submits the service request. For example, in the case of a network car booking, after a passenger submits a car booking request, the system 100 may identify an order to be tested, and may request the passenger to perform identity verification if the order is an abnormal order as a result of the identification. In some embodiments, the risk management policy may be executed after order allocation. For example, in the case of a net car booking, after a passenger submits a car booking request, the system 100 performs order allocation, and after the driver determines that the order to be tested is to be identified, the system 100 may send warning information to the passenger or the driver if the order is an abnormal order as a result of the identification. In some embodiments, the risk management policy may manage the service requester to protect the service provider security. For example, in the case of a network appointment car, if the characteristic parameter is related to a service requester (passenger) and the recognition result is an abnormal order, the passenger is managed, a warning message is issued to the passenger or the passenger is required to be authenticated. In some embodiments, the risk management policy may manage the service provider to protect the service requester. For example, in the case of a net appointment, if the characteristic parameter is related to a service provider (driver) and the recognition result is an order abnormality, the driver is managed, and warning information is given to the driver or authentication is required for the driver. In some embodiments, the risk management policy may manage both the service requester and the service provider. For example, in the case of a net appointment, warning information may be issued to both the passenger and the driver.

It should be noted that the above description is merely for convenience and should not be taken as limiting the scope of the present application. It will be understood by those skilled in the art that, having the benefit of the teachings of this system, various modifications and changes in form and detail may be made to the field of application for which the method and system described above may be practiced without departing from this teachings.

FIG. 7 is an exemplary flow diagram illustrating the determination of a first order anomaly identification model according to one embodiment of the present invention. In some embodiments, flow 700 may be performed by processing logic that may comprise hardware (e.g., circuitry, dedicated logic, programmable logic, microcode, etc.), software (instructions run on a processing device to perform hardware simulation), etc., or any combination thereof. One or more of the operations in the flow 700 for identifying order exceptions illustrated in FIG. 7 may be implemented by the roadway information system 100 illustrated in FIG. 1. For example, flow 700 may be stored in storage device 130 in the form of instructions and executed by processing engine 112 to perform calls and/or execute (e.g., processor 220 of computing device 200 shown in fig. 2, central processor 340 of mobile device 300 shown in fig. 3).

At 710, historical orders may be obtained. In some embodiments, step 710 may be performed by the first order anomaly recognition model training module 430. In some embodiments, historical orders over a period of time may be obtained as training samples. Such as a one week historical order, a one month historical order, etc. In some embodiments, the order may include an order that is a completed order, an order that was cancelled in the middle, or the like that has submitted a record in the system 100 of the service request. In some embodiments, the historical orders may be obtained from the system 100, such as the network 150, the storage device 130, the server 110, the service requester terminal 120, the information source 160, and the like. In some embodiments, historical orders over a period of time that includes an order exception may be obtained. For example, when an order exception occurs in 2017, 2, 8, historical orders in a week including only one day may be obtained as training samples. If an order abnormality occurs in each of days 2 and 8 in 2017 and days 10 and 5 in 2017, historical orders in the week of 8 in 2017 and 10 and 5 in 2017 can be obtained. In some embodiments, historical orders for the day with order exceptions may also be obtained as training samples. For example, if an order exception occurs on the day of 8/2/2017, all historical orders on the day of 8/2/2017 are taken as sample orders. If the order abnormity occurs on the days of the dates of 2017, 2 and 8, 2017, 4 and 15, 2017, 7 and 8, 2017, 11 and 6, and the like. All historical orders of the days such as 2017, 2 and 8 days, 2017, 4 and 15 days, 2017, 7 and 8 days, 2017, 11 and 6 days are obtained as training samples. Because the number of order abnormity is usually very small, and is possibly only a few in one year, the training samples are obtained in such a way, the abnormal order samples can be obtained, and the training result and the processing speed are not affected due to the fact that the sample size of the normal order is too large.

At 720, characteristic parameters associated with the historical order may be obtained. In some embodiments, step 720 may be performed by the first order anomaly recognition model training module 430. In some embodiments, the characteristic parameters may include order-related characteristic parameters such as the service time, the service location, the operation behavior of the service requester or service provider on the platform, personal information of the service requester or service provider, or the subscription requirement of the service requester for the service. Such as the time of order placement, the time of order execution, the remote location of travel route, the length of travel, the frequency of order cancellations by service requesters or service providers over a time frame, the volume of orders completed by service requesters or service providers over a time frame, the gender of the service requester or service provider, the time of registration by the service requester or service provider, the service requester or the service provider has an address confidence level, a work place confidence level, a loan condition, an education level, a complaint frequency, an evaluation condition, a service request order requirement or a service provider order requirement.

In step 730, the order exception in the historical order may be marked as a positive sample, and the normal order in the historical order may be marked as a negative sample. In some embodiments, step 720 may be performed by the first order anomaly recognition model training module 430. In some embodiments, historical orders may be flagged by a human. For example, in the training sample, order exceptions occur on the day of 8.2.2017, all historical orders on the day of 8.2.2017 have been obtained as samples, the order exceptions on the day of 8.2.2017 may be marked as positive samples, and other normal orders on the day may be marked as negative samples. In some embodiments, the marking may be performed according to the recorded results in the system 100, and the historical orders with malignancy occurrences in the record may be marked as positive samples. The orders that are normal in the record are marked as negative examples. In some embodiments, positive samples may be represented by a number "1" and negative samples by a number "0".

In step 740, a first initial model may be trained based on the feature parameters and the labeled results in the historical order to obtain the first order anomaly identification model. In some embodiments, step 720 may be performed by the first order anomaly recognition model training module 430. In some embodiments, the feature parameters and the labeled results in the historical orders may be trained in a machine learning manner to obtain a classification threshold value of each feature parameter and a classification order of the feature parameters, and finally obtain the first order anomaly identification model. In some embodiments, the first order anomaly identification model may be a decision Tree model, including but not limited to Classification And Regression Tree (CART), Iterative binary Tree three generation (ID 3), C4.5 algorithm, Random Forest (Random Forest), card square Automatic Interaction Detection (CHAID), Multiple Adaptive Regression Spline (MARS), And Gradient Boosting Machine (GBM), or the like, or any combination thereof. In some embodiments, information gain may be utilized as a criterion for node selection in the decision tree. The node is selected each time the condition that maximizes the information gain is selected. In some embodiments, the nodes in the decision tree correspond to characteristic parameters. In some embodiments, in the first order anomaly identification model, a feature parameter with the largest information gain is selected from each node, and the judgment condition on each node is a classification threshold corresponding to the feature parameter on the node. In some embodiments, the characteristic parameters of the order to be detected may be used as input, and the trained first order abnormality identification model is used to perform division according to the judgment conditions of the characteristic parameters on each node, so as to finally obtain a final identification result. In some embodiments, the trained model may be used as a first initial model, and after further optimization and verification, a first order anomaly identification model is determined. The method of optimization may be as described in 750 below.

In 750, it may be verified whether the judgment condition and the division result at a certain node in the first order anomaly identification model are consistent with the distribution of the positive samples. In some embodiments, step 720 may be performed by the first order anomaly recognition model training module 430. In some embodiments, the nodes in the model correspond to the characteristic parameters. The training samples are divided into two types of sample subsets (positive samples and negative samples) at the nodes according to the judgment conditions corresponding to the characteristic parameters, and whether the division result at a certain node is consistent with the distribution of the actual positive samples can be verified. For example, in the trained first order abnormality recognition model, the judgment condition corresponding to the characteristic parameter "the completion amount of the service requester" is "greater than the X threshold", and samples satisfying that the completion amount of the service requester is greater than the X threshold are classified into positive samples. In practice, however, in the positive sample, the characteristic parameter "the amount of singletons of service requesters" is much less than the X threshold. Then the node does not conform to the distribution of samples, resulting in an overfitting of the model. In some embodiments, a node in the trained first order anomaly identification model may be verified manually. In some embodiments, each node in the trained first order anomaly identification model may be verified.

In 760, if the determination condition and the division result at the node are not consistent with the actual distribution of the sample, the node may be replaced with another node. In some embodiments, step 720 may be performed by the first order anomaly recognition model training module 430. In some embodiments, a new sub-tree may be obtained by performing decision tree training using all samples at the node and all lower level nodes of the node. And replacing the subtree formed by the node and the lower-layer node in the original first order abnormity identification model with the new subtree. For example, the characteristic parameter of a certain node in the first order abnormality recognition model is "completion amount of service requester", and the characteristic parameter of a node at the next stage of the node is "number of complaints of service requester". And if verification shows that the judgment condition division result corresponding to the characteristic parameter 'the service requester's completion quantity 'is inconsistent with the distribution of the positive sample, deleting the node corresponding to the characteristic parameter, and replacing the deleted node with the characteristic parameter' the service requester's complaint times' of the original next-level node. For another example, the characteristic parameter of a certain node in the first order abnormality recognition model is "completion amount of service requester", the characteristic parameter of the next node of the node is "number of complaints of service requester", and the following nodes include "address confidence of service requester or service provider", "work place confidence of service requester or service provider", "loan condition of service requester or service provider", and "education degree of service requester or service provider". It is understood that the nodes corresponding to the characteristic parameters "number of complaints of the service requester", "address confidence of the service requester or service provider", "workplace confidence of the service requester or service provider", "loan status of the service requester or service provider", "education of the service requester or service provider" constitute a sub-tree. If verification finds that the result of the judgment condition division corresponding to the characteristic parameter 'the completion of the single amount of the service requester' is inconsistent with the distribution of the positive samples, the node corresponding to the characteristic parameter is deleted, all samples at the original nodes corresponding to the characteristic parameter 'the completion of the single amount of the service requester' are used as training samples, and the nodes corresponding to the characteristic parameters 'the number of times of complaints of the service requester', 'the address confidence of the service requester or the service provider', 'the working place confidence of the service requester or the service provider', 'the loan condition of the service requester or the service provider', 'the education degree of the service requester or the service provider' are retrained to obtain a new sub-tree. And the new subtree is used as a new subtree in the model to replace the original subtree which is started by a node corresponding to a characteristic parameter 'the completion quantity of the service requester'. And obtaining a new first order abnormity identification model.

In some embodiments, each node in the first order anomaly identification model is verified and optimized, and finally the first order anomaly identification model with characteristic parameters on all nodes conforming to the actual distribution of the sample is obtained. At 770, the training is completed after the first order anomaly identification model verification is completed.

FIG. 8 is an exemplary flow diagram illustrating the determination of a second order anomaly identification model according to one embodiment of the present invention. In some embodiments, flow 800 may be performed by processing logic that may comprise hardware (e.g., circuitry, dedicated logic, programmable logic, microcode, etc.), software (instructions run on a processing device to perform hardware simulation), etc., or any combination thereof. One or more of the operations in the flow 800 for identifying order exceptions illustrated in FIG. 7 may be implemented by the roadway information system 100 illustrated in FIG. 1. For example, the flow 800 may be stored in the storage device 130 in the form of instructions and executed by the processing engine 112 to perform the calls and/or perform the operations (e.g., the processor 220 of the computing device 200 shown in fig. 2, the central processor 340 of the mobile device 300 shown in fig. 3).

At 810, historical orders may be obtained. In some embodiments, step 810 may be performed by second order anomaly recognition model training module 440. In some embodiments, the second order anomaly identification model may obtain the same historical order as the first order anomaly identification model as a training sample. In some embodiments, the second order anomaly recognition model may obtain a different historical order from the first order anomaly recognition model as a training sample. In some embodiments, the training samples of the second order anomaly recognition model may overlap with the training samples of the first order anomaly recognition model. In some embodiments, the second order anomaly recognition model training module 440 may obtain historical orders separately from the first order anomaly recognition model training module 430. In some embodiments, the second order anomaly recognition model training module 440 may directly obtain the historical orders obtained by the first order anomaly recognition model training module 430.

At 820, characteristic parameters associated with the historical order may be obtained. In some embodiments, step 810 may be performed by second order anomaly recognition model training module 440. In some embodiments, the characteristic parameters may include the above-mentioned service time, service location, operation behavior of the service requester or service provider on the platform, personal information of the service requester or service provider or subscription requirements of the service requester for the service, and the like. Such as the time of order placement, the time of order execution, the remote location of travel route, the length of travel, the frequency of order cancellations by service requesters or service providers over a time frame, the volume of orders completed by service requesters or service providers over a time frame, the gender of the service requester or service provider, the time of registration by the service requester or service provider, the service requester or the service provider has an address confidence level, a work place confidence level, a loan condition, an education level, a complaint frequency, an evaluation condition, a service request order requirement or a service provider order requirement. In some embodiments, the characteristic parameters of the second order anomaly identification model may be the same as the characteristic parameters of the first order anomaly identification model. In some embodiments, the characteristic parameters of the second order anomaly identification model may be different from the characteristic parameters of the first order anomaly identification model. In some embodiments, the characteristic parameters of the second order anomaly identification model may overlap with the characteristic parameters of the first order anomaly identification model.

At 830, the order exceptions in the historical orders may be marked as positive samples and the normal orders in the historical orders may be marked as negative samples. In some embodiments, step 810 may be performed by second order anomaly recognition model training module 440. In some embodiments, historical orders may be flagged by a human. For example, in the training sample, order exceptions occur on the day of 8.2.2017, all historical orders on the day of 8.2.2017 have been obtained as samples, the order exceptions on the day of 8.2.2017 may be marked as positive samples, and other normal orders on the day may be marked as negative samples. In some embodiments, the marking may be performed according to the recorded results in the system 100, and the historical orders with malignancy occurrences in the record may be marked as positive samples. The orders that are normal in the record are marked as negative examples. In some embodiments, positive samples may be represented by a number "1" and negative samples by a number "0".

In 840, a second initial model may be trained based on the feature parameters and the labeled results in the historical order to obtain the second order anomaly identification model. In some embodiments, step 810 may be performed by second order anomaly recognition model training module 440. In some embodiments, the second order anomaly identification model may be a logistic regression model. In some embodiments, during the training process, the model may be validated using the validation set and the model parameters may be adjusted to optimize the model based on the validation results (e.g., the model is under-fit and/or over-fit). And the data in the verification set and the training data of the second initial model are independently and identically distributed and have no intersection. In some embodimentsWhen the preset condition is met, stopping model training, and outputting the final model as the second order abnormity identification model. In some embodiments, a greedy algorithm may be employed to optimize the model. In some embodiments, the characteristic parameters in the model may be determined by maximum likelihood estimation. In some embodiments, a log-likelihood function may be employed, i.e.

And (4) calculating.

FIG. 9 is an exemplary flow diagram illustrating order risk management according to one embodiment of the present invention. In some embodiments, flow 900 may be performed by processing logic that may comprise hardware (e.g., circuitry, dedicated logic, programmable logic, microcode, etc.), software (instructions run on a processing device to perform hardware simulation), etc., or any combination thereof. One or more of the operations in the flow 900 for identifying order exceptions illustrated in FIG. 9 may be implemented by the roadway information system 100 illustrated in FIG. 1. For example, flow 900 may be stored in storage device 130 in the form of instructions and executed by processing engine 112 to perform calls and/or execute (e.g., processor 220 of computing device 200 shown in fig. 2, central processor 340 of mobile device 300 shown in fig. 3).

At 910, a service request of a service requestor can be obtained. In some embodiments, this step may be performed by the second acquisition module 510. In some embodiments, the service request includes at least a service time and a service location. In some embodiments, the service time may be the time the service requester places an order. In some embodiments, the service time may be the time at which the order was executed. In some embodiments, the service location may be a location where the service starts, a location where the service terminates, a location where the service performs a process. Taking the network appointment car as an example, the service location may be information such as a starting point, an end point, a route location of a travel route, a trip length, and the like. In some embodiments, information such as the operation behavior of the service requester or service provider on the platform, personal information of the service requester or service provider, or subscription requirements of the service requester for the service may also be obtained.

At 920, a service order may be generated based on the service request and sent to a server. In some embodiments, 920 may be performed by the service order generation module 520. In some embodiments, the service order may be generated based on information such as service time, service location, and the like. In some embodiments, after receiving the service order, the server may identify the order abnormality by using the service order as the order to be tested.

In 930, an anomaly identification result for the service order or a risk management indication related to the anomaly identification result sent by a server may be received. In some embodiments, 930 may be performed by risk management receiving module 530. In some embodiments, the risk management indication related to the anomaly identification result may include warning information. Taking the network car reservation service as an example, at a passenger end, a warning message of' dripping reminding you, suspected abnormality of the current order, and in order to ensure the driving safety at night, a dripping platform carries a hand and a police, and protects the safety of you and a driver in the whole process! Or drop the hand-carrying police to remind you: triggering a drip safety guard! The system can completely relate to the safety of a driver, and if an abnormal condition exists, the system can timely synchronize a public security organization, and 100 percent of quick positioning and tracking is realized! The right to drip is used together with the police to guard the trip safety! ". At the driver end, the warning information can be 'drip to remind you, in order to guarantee the driving safety at night, the drip platform is used for carrying the police, and the safety of you and passengers is protected in the whole process'. In some embodiments, different alert information may indicate different degrees of abnormality for an order abnormality. In some embodiments, the alert information may be a combination of one or more of an audible prompt, a voice prompt, a light prompt, a vibration prompt of the user terminal, and the like. In some implementations, the risk management indication associated with the anomalous recognition result may be an authentication request. In some embodiments, the authentication request may be a combination of one or more of requiring the service requester and/or service provider to upload an identity document, perform face recognition, voice recognition by the service requester and/or service provider, vehicle certification documents, vehicle information recognition, and the like. Taking a network appointment car as an example, the passenger can be required to upload an identity document to perform real-name authentication at the passenger end, and can also be required to perform face recognition. The driver can be required to upload an identity document to carry out real-name authentication at the driver end, and the driver can also be required to carry out face recognition. Or require the driver to upload vehicle identification documents. In some embodiments, the service requester and/or service provider may receive a message that the authentication is successful or a message that the authentication is not successful after performing the authentication. It may also be a direct receipt of an order to proceed or a termination of an order. In some embodiments, the service requester and/or service provider may receive information that the order has terminated without fulfilling the request for authentication. In some embodiments, the risk governing indication associated with the anomaly identification result may include a request for transmission of behavioral information by a service requester and/or a service provider when an order is executed. Taking the network appointment service as an example, the real-time transmission of the driving path and the current position of the vehicle, the transmission of information on whether the driving path is unexpectedly interrupted or stopped, the transmission of order modification information, the transmission of order unexpected interruption or cancellation information, and the like can be required in the driving process. It is also possible to require the full-range transmission of behavior information, distress information, etc. of passengers and drivers in the vehicle. In some embodiments, the user terminal may receive the order termination information directly. For example, in the network car booking service, if the order to be tested is abnormal and the abnormality degree is extremely high as a result of the identification, the server can directly stop dispatching the order and send the information of order termination to the user terminal. In some embodiments, the alert information received by the user terminal may frighten the service requester and alert the service provider of security. Or frightening the service provider and carrying out safety reminding on the service requester.

The beneficial effects that may be brought by the embodiments of the present application include, but are not limited to: (1) in the method, two models are adopted for identifying the order abnormity, manual verification and optimization are performed in the process of determining the first order abnormity identification model, the identification accuracy is improved, and the overfitting problem of the model caused by the small quantity of positive samples is improved. (2) The application also provides different risk management and control strategies according to different abnormal identification results, the abnormal orders are controlled and managed, and malignant events are further prevented. It is to be noted that different embodiments may produce different advantages, and in different embodiments, any one or combination of the above advantages may be produced, or any other advantages may be obtained.

Having thus described the basic concept, it will be apparent to those skilled in the art that the foregoing disclosure is by way of example only, and is not intended to limit the present application. Various modifications, improvements and adaptations to the present application may occur to those skilled in the art, although not explicitly described herein. Such modifications, improvements and adaptations are proposed in the present application and thus fall within the spirit and scope of the exemplary embodiments of the present application.

Also, this application uses specific language to describe embodiments of the application. Reference to "one embodiment," "an embodiment," and/or "some embodiments" means that a particular feature, structure, or characteristic described in connection with at least one embodiment of the application. Therefore, it is emphasized and should be appreciated that two or more references to "an embodiment" or "one embodiment" or "an alternative embodiment" in various places throughout this specification are not necessarily all referring to the same embodiment. Furthermore, some features, structures, or characteristics of one or more embodiments of the present application may be combined as appropriate. Additionally, the order in which elements and sequences of the processes are recited in the present application, the use of alphanumeric or other designations, is not intended to limit the order of the processes and methods in the present application, unless otherwise indicated in the claims. While various presently contemplated embodiments of the invention have been discussed in the foregoing disclosure by way of example, it is to be understood that such detail is solely for that purpose and that the appended claims are not limited to the disclosed embodiments, but, on the contrary, are intended to cover all modifications and equivalent arrangements that are within the spirit and scope of the embodiments herein. For example, although the system components described above may be implemented by hardware devices, they may also be implemented by software-only solutions, such as installing the described system on an existing server or mobile device.

Similarly, it should be noted that in the preceding description of embodiments of the application, various features are sometimes grouped together in a single embodiment, figure, or description thereof for the purpose of streamlining the disclosure aiding in the understanding of one or more of the embodiments. This method of disclosure, however, is not intended to require more features than are expressly recited in the claims. Indeed, the embodiments may be characterized as having less than all of the features of a single embodiment disclosed above.

Numerals describing the number of components, attributes, etc. are used in some embodiments, it being understood that such numerals used in the description of the embodiments are modified in some instances by the use of the modifier "about", "approximately" or "substantially", etc. Unless otherwise indicated, "about", "approximately" or "substantially" indicates that the number allows a variation of ± 20%. Accordingly, in some embodiments, the numerical data used in the specification and claims are approximations that may vary depending upon the desired properties of the individual embodiments. In some embodiments, numerical data should take into account the specified significant digits and employ a general digit preservation approach. Notwithstanding that the numerical ranges and data setting forth the broad scope of the range presented in some of the examples are approximations, in specific examples, such numerical values are set forth as precisely as possible within the practical range.

Finally, it should be understood that the embodiments described herein are merely illustrative of the principles of the embodiments of the present application. Other variations are also possible within the scope of the present application. Thus, by way of example, and not limitation, alternative configurations of the embodiments of the present application can be viewed as being consistent with the teachings of the present application. Accordingly, the embodiments of the present application are not limited to only those embodiments explicitly described and depicted herein.

Claims

1. An order abnormity identification method is characterized by comprising the following steps:

obtaining an order to be tested;

acquiring characteristic parameters related to the order to be tested;

processing at least one part of the characteristic parameters by using a first order abnormity identification model to obtain a first identification result;

processing at least one part of the characteristic parameters by using a second order abnormity identification model to obtain a second identification result;

determining an abnormal identification result of the order to be detected by combining the first identification result and the second identification result;

wherein the characteristic parameter related to the order to be tested at least reflects at least one of the following various information: service time, service location, operational behavior of the service requester or service provider on the platform, personal information of the service requester or service provider, or subscription requirements of the service requester for the service.

2. The method of claim 1, wherein the first order anomaly identification model is a classification model and the second order anomaly identification model is a regression model.

3. The method of claim 1,

when the first identification result is that the order to be detected is an abnormal order, determining the abnormality degree of the order to be detected by using the second order abnormality identification model, and taking the abnormality degree as the abnormality identification result of the order to be detected;

and when the first identification result indicates that the order to be detected is not an abnormal order, taking the order to be detected as a normal order as an abnormal identification result of the order to be detected.

4. The method of claim 1, further comprising:

and determining and executing a risk management and control strategy based on the abnormal identification result of the order to be tested.

5. The method of claim 4,

the risk management policies include at least a combination of one or more of the following policies: alert information is issued to the service requester and/or service provider, the service requester and/or service provider is authenticated, the behavior of the service requester and/or service provider is monitored while the order is executed, or the order is not assigned to the service provider.

6. The method of claim 1, wherein the characteristic parameter comprises at least one of:

order placement time, order execution time, remote location of travel route, length of travel, frequency of order cancellation by service requester or service provider within a time frame, amount of orders completed by service requester or service provider within a time frame, gender of service requester or service provider, registration time of service requester or service provider, the service requester or service provider comprises a service requester or service provider address confidence level, a service requester or service provider work place confidence level, a service requester or service provider loan condition, a service requester or service provider education level, a service requester or service provider complaint frequency within a certain time range, a service requester or service provider evaluated condition within a certain time range, a service requester subscription requirement for a service tool or a service provider subscription requirement.

7. The method of claim 6,

the remote degree of a relevant place of a driving route is inversely related to the number of orders within a certain range from the place within a certain time; the travel route-related place includes at least one of: starting point, end point or pathway location.

8. The method of claim 1, wherein the first order anomaly identification model is obtained by:

acquiring a historical order;

acquiring the characteristic parameters related to the historical orders;

marking abnormal orders in the historical orders as positive samples, and marking normal orders in the historical orders as negative samples;

and training a first initial model based on the characteristic parameters and the marking results in the historical orders to obtain the first order abnormity identification model.

9. The method of claim 8,

the first order abnormity identification model is a decision tree model.

10. The method of claim 9, further comprising a first order anomaly identification model optimization process comprising:

verifying whether the judgment condition and the division result at a certain node in the first order abnormity identification model are consistent with the distribution of the sample; nodes in the first order abnormity identification model correspond to the characteristic parameters;

if not, the node is replaced by other nodes.

11. The method of claim 10, wherein replacing the node with the other node further comprises:

performing decision tree training by using all samples at the node and all lower-layer nodes of the node to obtain a new sub-tree;

and replacing the subtree formed by the node and the lower-layer node in the original first order abnormity identification model with the new subtree.

12. The method of claim 1, wherein the second order anomaly identification model is obtained by a method comprising:

acquiring a historical order;

acquiring the characteristic parameters related to the historical orders;

marking the order abnormity in the historical order as a positive sample, and marking the normal order in the historical order as a negative sample;

and training a second initial model based on the characteristic parameters and the marking results in the historical orders to obtain the second order abnormity identification model.

13. The method of claim 12,

the second order abnormity identification model is a logistic regression model.

14. An order anomaly identification system, comprising:

the first acquisition module comprises an order acquisition unit to be detected and a characteristic parameter acquisition unit; the order acquiring unit to be tested is used for acquiring an order to be tested, and the characteristic parameter acquiring unit is used for acquiring characteristic parameters related to the order to be tested;

the order abnormity identification module is used for processing at least one part of the characteristic parameters by utilizing a first order abnormity identification model to obtain a first identification result; processing at least one part of the characteristic parameters by using a second order abnormity identification model to obtain a second identification result; determining an abnormal identification result of the order to be detected by combining the first identification result and the second identification result;

15. The system of claim 14, wherein the first order anomaly identification model is a classification model and the second order anomaly identification model is a regression model.

16. The system of claim 14, wherein the order anomaly identification module is further configured to:

17. The system of claim 14,

the system further comprises a management and control strategy execution module, wherein the management and control strategy execution module is used for determining and executing a risk management and control strategy based on the abnormal identification result of the order to be tested.

18. The system of claim 17,

19. The system of claim 14, wherein the characteristic parameters include at least one of:

20. The system of claim 19,

21. The system of claim 14, further comprising a first order anomaly recognition model training module configured to:

acquiring a historical order;

acquiring the characteristic parameters related to the historical orders;

22. The system of claim 21,

the first order abnormity identification model is a decision tree model.

23. The system of claim 22, wherein the first order anomaly recognition model training module is further configured to:

if not, the node is replaced by other nodes.

24. The system of claim 23, wherein the first order anomaly recognition model training module is further configured to:

25. The system of claim 14, further comprising a second order anomaly recognition model training module configured to:

acquiring a historical order;

acquiring the characteristic parameters related to the historical orders;

26. The system of claim 25,

the second order abnormity identification model is a logistic regression model.

27. An order abnormity identification device is characterized by comprising at least one processor and at least one memory;

the at least one memory is to store instructions;

the processor is used for executing the instructions and realizing the method of any one of claims 1 to 13.

28. A computer-readable storage medium storing computer instructions, wherein when the computer instructions in the storage medium are read by a computer, the computer performs the method of any one of claims 1 to 13.

29. An order risk management and control method is characterized by comprising the following steps:

acquiring a service request of a service requester; the service request at least comprises service time and service place;

generating a service order based on the service request and sending the service order to a server;

and receiving an abnormal identification result of the service order sent by a server or a risk management and control instruction related to the abnormal identification result.

30. The method of claim 29, wherein the risk management indication related to the abnormal recognition result comprises one or more of a combination of warning information, an authentication request, or a request for transmission of behavior information of a service requester and/or a service provider when an order is executed.

31. An order risk management and control system, comprising:

the second acquisition module is used for acquiring the service request of the service requester; the service request at least comprises service time and service place;

the service order generating module is used for generating a service order based on the service request and sending the service order to the server;

and the risk management and control receiving module is used for receiving the abnormal identification result of the service order sent by the server or a risk management and control instruction related to the abnormal identification result.

32. The system of claim 31, wherein the risk management indications related to the abnormal recognition result comprise one or more of a combination of warning information, an authentication request, or a request for transmission of behavior information of the service requester and/or the service provider when the order is executed.

33. An order risk management and control device is characterized by comprising at least one processor and at least one memory;

the at least one memory is to store instructions;

the processor is configured to execute the instructions to implement the method according to any one of claims 29 to 30.

34. A computer-readable storage medium storing computer instructions which, when read by a computer, cause the computer to perform the method of any one of claims 29 to 30.