Abstract: To enhance the effectiveness and specificity of violation behavior management, the behavior security “2-4” model (24Model) and self-organizing mapping network (SOM) are introduced to study the distribution characteristics of violation behavior. The 24Model is used to analyze on-site violations and construct a violation classification system; the violation feature data is trained and learned through SOM, and the clustering features of the department are analyzed in conjunction with the k-means algorithm to generate a visual topology that identifies the key violations. The results indicate the establishment of a three-level classification system for violation behaviors; the study identifies departments with a high frequency of violations and their specific high-frequency violation behaviors; according to the three-level mapping of violations, “failure to reasonably arrange process equipment and working environment”, “failure to effectively maintain equipment and facilities”, “absence from work or duty” are high-frequency violations across the entire mine, which are widely found in most of the mines. According to the mapping of secondary violations, the number of “unsafe operation” is the highest, mainly reflecting “failure to operate according to regulations or operation not in place”, which mostly occurs in the production technology department and the drilling rig team. Adopting targeted measures for key violations and corresponding departments can effectively reduce the possibility of accidents caused by unsafe act.