Abnormal behavior recognition method and system based on multi-dimensional data analysis

Abstract

The application provides an abnormal behavior recognition method and system based on multi-dimensional data analysis, including cleaning and standardizing structured data and unstructured data to obtain a uniform format data set, using natural language processing technology to process document texts therein, extracting entity, relationship and behavior information, and generating a structured feature vector; using the feature vector and the structured data to construct behavior statistics, time sequence and association features, using a sampling algorithm to select feature combinations, establishing an entity relationship graph according to the association data in the constructed multi-dimensional feature set, calculating the association strength between entities, and optimizing the entity relationship graph to establish a network structure model; setting a feature weight system according to the model and the multi-dimensional feature set, calculating a multi-dimensional abnormal score by using a pruning tensor structure measurement method, comprehensively calculating an abnormal score by using a low-rank tensor recovery technology, outputting a warning list, and improving recognition accuracy and efficiency.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data analysis, and particularly relates to an abnormal behavior recognition method and system based on multi-dimensional data analysis. BACKGROUND

[0002] Abnormal behavior recognition technology has important application value in the fields of financial risk control, security supervision, etc. The technology mainly analyzes various types of data to identify behavior characteristics deviating from the normal mode and discover potential risks in a timely manner.

[0003] The common abnormal behavior recognition methods at present are mainly based on a single data source or simple rules. For example, a fixed numerical threshold is set for judgment, or only structured transaction data is analyzed for pattern recognition. These methods are relatively simple and direct, but the analysis dimension is single, and it is difficult to meet the abnormal behavior recognition needs in complex scenarios.

[0004] With the development of technology, more advanced abnormal behavior recognition technology adopts a machine learning method to perform abnormal detection by establishing a behavior model. The technology first collects historical data to establish a benchmark model, and then compares new behavior data with the model to calculate the deviation degree to determine whether it is abnormal.

[0005] However, the technology still has the following problems: first, the processing capability for unstructured data is insufficient, and it is difficult to fully utilize text information; second, there is a lack of in-depth analysis of the association relationship between entities, and complex abnormal patterns based on relationship networks are easily missed; and finally, the model scoring mechanism is rigid, and it is difficult to flexibly adjust the weight according to different scenarios. SUMMARY

[0006] In view of this, the present application provides an abnormal behavior recognition method and system based on multi-dimensional data analysis, which solves the problems of insufficient processing capability for unstructured data, lack of entity association relationship analysis, and rigid scoring mechanism in the prior art.

[0007] The embodiment of the present application provides an abnormal behavior recognition method based on multi-dimensional data analysis, comprising:

[0008] obtaining structured data and unstructured data through a business system interface, performing data cleaning and standardization processing on the structured data and the unstructured data, and obtaining a data set in a unified format;

[0009] receiving a document type text in the data set in the unified format, processing the document type text by using a natural language processing technology, extracting entity information, relationship information and behavior information, and generating a structured feature vector;

[0010] The structured data in the uniform format data set and the structured feature vector are used to construct behavior statistical features, time sequence features and association features, a sampling algorithm based on a generalized Golub-Kahan method is used to select feature combinations, and a multi-dimensional feature set is constructed;

[0011] According to the association data in the multi-dimensional feature set, an entity relationship graph is established, the association strength between entities is calculated by a low-rank tensor and a p-AAA algorithm, and the entity relationship graph is optimized based on the association strength, and a network structure model is established;

[0012] According to the network structure model and the multi-dimensional feature set, a feature weight system is set, a multi-dimensional anomaly score is calculated by using a pruning tensor structure measurement method, a low-rank tensor recovery technology is used to comprehensively calculate the multi-dimensional anomaly score, an anomaly score is obtained, and a pre-warning list is output according to the anomaly score.

[0013] Optionally, the structured data and the unstructured data are subjected to data cleaning and standardization processing to obtain a uniform format data set, including:

[0014] For the structured data and the unstructured data, statistical methods are used to identify outliers of numerical data, correct them, encode and standardize category data, and unify the format of time data to obtain cleaned data.

[0015] According to the cleaned data, the field name, data type and value range are unified to obtain a uniform format data set.

[0016] For the document type text, a conditional random field model is used for word segmentation processing to obtain a word sequence.

[0017] For the word sequence, a named entity recognition technology is used to identify key entities and extract relationship description words between entities to construct entity-relation pairs.

[0018] According to the entity-relation pairs, a dependency syntax analysis is used to extract target syntax components, identify behavior types and behavior features, and output a structured feature vector.

[0019] Optionally, the structured data in the uniform format data set and the structured feature vector are used to construct behavior statistical features, including:

[0020] Based on the structured data in the uniform format data set and the structured feature vector, the behavior frequency and time distribution are counted, the target statistical quantity of behavior frequency is calculated, and the frequency feature is formed.

[0021] According to the frequency feature, a sliding time window is set, the frequency change of different time scales is calculated, and the behavior statistical feature is obtained.

[0022] Optionally, the way of constructing the time series features using the structured data in the uniform format dataset and the structured feature vectors comprises:

[0023] Based on the structured data in the uniform format dataset and the structured feature vectors, a periodic pattern of behavior is detected by Fourier transform, an autocorrelation coefficient is calculated, and a periodicity index is constructed.

[0024] For the periodicity index, a long-term trend is analyzed using a moving average method, a volatility and an amplitude are calculated, and time series features are output.

[0025] Optionally, the way of constructing the association features using the structured data in the uniform format dataset and the structured feature vectors comprises:

[0026] Based on the structured data in the uniform format dataset and the structured feature vectors, the frequency and intensity of direct interaction between entities are counted, a weighted association coefficient is calculated, and a direct association degree is obtained.

[0027] Based on the direct association degree, a multi-hop relationship path is constructed, a path importance weight is calculated, and association features are formed.

[0028] Optionally, the way of calculating the association strength between entities by a low-rank tensor and a p-AAA algorithm comprises:

[0029] Using the association data in the multi-dimensional feature set, a multi-dimensional association tensor is constructed, Tucker decomposition is used to reduce the dimension of the tensor, and main feature information is obtained.

[0030] According to the main feature information, a rational function approximation is constructed by a p-AAA algorithm, the approximation accuracy is iteratively optimized, and the association strength between entities is obtained.

[0031] Optionally, the optimization of the entity relationship graph based on the association strength comprises:

[0032] According to the association strength, an association strength threshold is set, edges below the association strength threshold are deleted, and an optimized entity relationship graph is constructed.

[0033] Using the optimized entity relationship graph, nodes with a similarity exceeding a preset threshold are identified and merged, the association relationship is updated, and a network structure model is formed.

[0034] Optionally, the setting of a feature weight system according to the network structure model and the multi-dimensional feature set comprises:

[0035] According to the network structure model and the multi-dimensional feature set, an associated party closeness weight value, a behavior abnormality weight value and a time sequence abnormality weight value are set, and a weight configuration is constructed;

[0036] Based on the weight configuration, the associated party closeness weight value, the behavior abnormality weight value and the time sequence abnormality weight value are refined to obtain a feature weight system.

[0037] The embodiment of the application further provides an abnormal behavior recognition device based on multi-dimensional data analysis, comprising:

[0038] A data preprocessing module is configured to acquire structured data and unstructured data through a business system interface, perform data cleaning and standardization processing on the structured data and the unstructured data, and obtain a data set in a unified format.

[0039] A text processing module is configured to receive a document text in the data set in the unified format, process the document text by using a natural language processing technology, extract entity information, relationship information and behavior information, and generate a structured feature vector.

[0040] A feature engineering module is configured to construct behavior statistical features, time sequence features and association features by using the structured data in the data set in the unified format and the structured feature vector, select a feature combination by using a sampling algorithm based on a generalized Golub-Kahan method, and construct a multi-dimensional feature set.

[0041] A network construction module is configured to establish an entity relationship graph according to association data in the multi-dimensional feature set, calculate an association strength between entities by using a low-rank tensor and a p-AAA algorithm, optimize the entity relationship graph based on the association strength, and establish a network structure model.

[0042] A score calculation module is configured to set a feature weight system according to the network structure model and the multi-dimensional feature set, calculate a multi-dimensional abnormality score by using a pruning tensor structure measurement method, comprehensively calculate the multi-dimensional abnormality score by using a low-rank tensor recovery technology, obtain an abnormality score, and output an early warning list according to the abnormality score.

[0043] The application has the following technical effects:

[0044] The application obtains structured data and unstructured data through a business system interface, performs data cleaning and standardization processing on the structured data and the unstructured data, and obtains a data set in a unified format; receives a document type text in the data set in the unified format, processes the document type text by using a natural language processing technology, extracts entity information, relationship information and behavior information, and generates a structured feature vector; constructs behavior statistical features, time sequence features and association features by using the structured data in the data set in the unified format and the structured feature vector, selects a feature combination by using a sampling algorithm based on a generalized Golub-Kahan method, and constructs a multi-dimensional feature set; establishes an entity relationship graph according to association data in the multi-dimensional feature set, calculates the association strength between entities by using a low-rank tensor and a p-AAA algorithm, optimizes the entity relationship graph based on the association strength, and establishes a network structure model; sets a feature weight system according to the network structure model and the multi-dimensional feature set, calculates a multi-dimensional anomaly score by using a pruning tensor structure measurement method, comprehensively calculates the multi-dimensional anomaly score by using a low-rank tensor recovery technology, obtains an anomaly score, and outputs an early warning list according to the anomaly score.

[0045] Among them, by using the generalized Golub-Kahan method for feature sampling, the processing efficiency of large-scale hierarchical Bayesian inverse problems is improved; combined with the low-rank tensor and the p-AAA algorithm to realize multi-element rational approximation, the construction accuracy of the entity relationship network is improved, the pruning tensor structure measurement and the efficient low-rank tensor recovery technology are introduced, and the scoring calculation process of the abnormal behavior is optimized; and innovatively combined with text analysis and relationship network analysis, the unified processing of structured and unstructured data is realized; a flexible multi-dimensional weight scoring mechanism is designed, and the accuracy and interpretability of abnormal behavior identification are improved. BRIEF DESCRIPTION OF DRAWINGS

[0046] In order to more clearly illustrate the technical solutions of the embodiments of the present disclosure, the following will briefly introduce the drawings needed to be used in the embodiments. The drawings herein are incorporated into the specification and form a part of the specification, which show the embodiments consistent with the present disclosure, and are used to illustrate the technical solutions of the present disclosure together with the specification. It should be understood that the following drawings only show certain embodiments of the present disclosure, and therefore should not be regarded as a limitation on the scope, and other related drawings can also be obtained by those skilled in the art without creative labor.

[0047] Figure 1 The flowchart of the abnormal behavior identification method provided by the embodiments of the present application;

[0048] Figure 2 The processing flowchart of the text processing module of the embodiments of the present application;

[0049] Figure 3 A processing flow schematic diagram of the feature engineering module in the embodiment of the present application is shown in FIG. 1.

[0050] Figure 4 A processing flow schematic diagram of the network construction module in the embodiment of the present application is shown in FIG. 2.

[0051] Figure 5 A processing flow schematic diagram of the score calculation module in the embodiment of the present application is shown in FIG. 3.

[0052] Figure 6 A structure schematic diagram of the abnormal behavior recognition system based on multi-dimensional data analysis in the embodiment of the present application is shown in FIG. 4. DETAILED DESCRIPTION

[0053] To make the objects, technical solutions, and advantages of the embodiments of the present disclosure clearer, the following will be combined with the accompanying drawings of the embodiments of the present disclosure to make a clear and complete description of the technical solutions in the embodiments of the present disclosure. Obviously, the described embodiments are only a part of the embodiments of the present disclosure and are not all the embodiments. The components of the embodiments of the present disclosure described and shown in the accompanying drawings can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present disclosure provided in the accompanying drawings is not intended to limit the scope of the claimed present disclosure, but only represents selected embodiments of the present disclosure. Based on the embodiments of the present disclosure, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present disclosure.

[0054] Figure 1 A flow schematic diagram of the abnormal behavior recognition method provided in the embodiment of the present application is shown in FIG. 5. As shown in FIG. 5, the abnormal behavior recognition method based on multi-dimensional data analysis provided in the present application can include the following steps S1 to S5: Figure 1

[0055] S1: obtaining structured data and unstructured data through a business system interface, and performing data cleaning and standardization processing on the structured data and the unstructured data to obtain a data set in a unified format;

[0056] In the embodiment of the present application, the data obtained through the business system interface can be divided into two categories: structured data and unstructured data. The structured data mainly includes numerical data (such as transaction amount, frequency statistics), category data (such as business type, risk level), and time data (such as transaction time, registration date), etc. The unstructured data mainly includes various types of document texts, such as business reports, transaction instructions, risk assessment reports, audit records, customer feedback opinions, business communication records, contract agreement texts, and regulatory filing documents, etc. These document texts contain rich entity information, relationship information, and behavior information, which are important data sources for abnormal behavior recognition.​

[0057] During the data cleaning and standardization phase, the system employs a specialized processing workflow for unstructured data such as document text. First, text preprocessing is performed, including special character filtering, punctuation standardization, typo correction, and redundant information removal. Then, the system standardizes the text format, converting various document formats (such as DOC, PDF, TXT, etc.) into a unified text format (such as the standard text format encoded in UTF-8) to ensure consistency in subsequent processing. The system also performs preliminary structured tagging of the text, identifying key elements such as time expressions, currency amounts, and institution names, and converting them into standardized representations. For example, "December 15, 2023" is standardized to "2023-12-15".

[0058] Through the above processing, the system integrates document-type texts into a unified format dataset, preserving the semantic integrity of the original text while improving data processability. For example, for a transaction description text, "Company A conducted transactions with several affiliated companies under Group B in the fourth quarter of 2023," the system, after standardization, retains the complete original text for in-depth semantic analysis and extracts preliminary structured information such as the transaction entity "Company A," the counterparty "affiliated companies under Group B," and the transaction time "fourth quarter of 2023." This processing method provides high-quality text input for the natural language processing module in subsequent steps, enabling the system to more effectively identify abnormal behavior patterns from document-type texts.

[0059] In one embodiment, step S1 may specifically include steps S1.1 and S1.2:

[0060] S1.1: For the structured data and the unstructured data, statistical methods are used to identify outliers in the numerical data and correct them, to encode and standardize the categorical data, and to unify the format of the time data to obtain cleaned data;

[0061] Specifically, in step S1.1, the system first performs targeted processing on different types of data:

[0062] For numerical data, a statistical outlier identification scheme is adopted: First, the quartiles (Q1, Q2, Q3) and interquartile range (IQR) of the data are calculated, and values ​​outside the range [Q1-1.5IQR, Q3+1.5IQR] are marked as potential outliers. Then, based on business rules and historical data distribution, these outliers are corrected, using methods such as median imputation, linear interpolation, or nearest neighbor interpolation.

[0063] For categorical data, the system adopts standardized encoding schemes for processing. First, a unified category value dictionary is established, mapping category values with the same meaning expressed in different source systems to standard categories, such as "male", "M", "1", etc. unified to "male". For ordinal category variables (such as risk level), ordinal encoding is used; for unordered category variables, One-Hot Encoding is used to convert them into numerical form.

[0064] For time data, the system performs format unification processing. First, different formats of time strings (such as "2024-02-06", "2024 / 02 / 06", "20240206", etc.) are parsed into standard timestamp format. Then, according to business requirements, the timestamp is converted into a unified date and time format, and time zone information is supplemented to ensure the consistency and comparability of time data. In addition, for missing time data, reasonable time interpolation or filling processing is performed according to business rules.

[0065] S1.2: According to the cleaned data, unify field names, data types, and value range, and obtain a unified format data set;

[0066] In step S1.2, the system further standardizes the cleaned data. First, according to the pre-defined data dictionary, the field names of each data source are unified, and the fields with the same meaning expressed in different systems are mapped to the standard field name. For example, "user_id", "uid", "account_no", etc. are unified to "user_identifier".

[0067] Second, the data types are unified and standardized. The system converts the same data in different data sources to a unified data type, such as converting numerical data to double precision floating point type (double), and converting character type data to variable length character type (varchar). At the same time, according to business requirements, set appropriate precision and length limits.

[0068] Finally, the system standardizes the value range of the data. For numerical features, methods such as min-max normalization or Z-score standardization can be used to map the data to a unified interval range. For categorical features, ensure that all possible values are within the pre-defined value range, and handle values outside the range appropriately. Through these processes, a standardized data set with unified format and standardized structure is formed, laying a foundation for subsequent feature extraction and model construction.

[0069] S2: receiving the document class text in the data set in the unified format, processing the document class text by using a natural language processing technology, extracting entity information, relationship information and behavior information, and generating a structured feature vector;

[0070] As shown in Figure 2 Step S2 includes steps S2.1 to S2.3:

[0071] S2.1: For the document class text, a conditional random field model is used for word segmentation processing to obtain a word sequence;

[0072] Specifically, step S2.1 uses an improved conditional random field (CRF) model for text word segmentation processing. First, the system constructs and maintains a special domain dictionary containing professional terms, institutional names and specific expressions in the fields of finance, risk control and the like. On this basis, a feature template is designed, including character features (such as single characters, double character combinations), position features (such as word beginning and end markers) and context features (such as previous and subsequent character combinations). Through these feature templates, the CRF model can learn the context dependency of words, thereby improving the accuracy of professional text word segmentation. For example, for the text "a certain investment company and associated enterprises carry out large amount of fund transactions", the system can accurately identify professional terms such as "investment company", "associated enterprises" and "fund transactions". In addition, the system also introduces a dynamic programming optimization scheme based on the Viterbi algorithm to improve the efficiency of word segmentation.

[0073] S2.2: For the word sequence, a named entity recognition technology is used to identify key entities and extract relationship description words between entities to construct entity-relationship pairs;

[0074] In step S2.2, the system first uses a BiLSTM-CRF-based named entity recognition model to process the word sequence after word segmentation. This model captures context semantic information through a bidirectional LSTM network and performs sequence labeling through a CRF layer, which can accurately identify key entities in the text, such as institutional names, names, times, places, etc. For example, "a certain investment company" can be labeled as an institutional entity, and "the first quarter of 2024" can be labeled as a time entity. Next, the system introduces a relationship extraction module enhanced by an attention mechanism to analyze the dependency relationships between entities and extract key description words representing entity relationships. These description words usually include transaction types (such as "transfer", "investment"), control types (such as "holding", "holding") and other semantic information. Finally, the system organizes the identified entities and relationship information into the form of entity-relationship pairs to provide structured basic data for subsequent behavior analysis.

[0075] In step S2.2, the system first processes the segmented word sequence using a BiLSTM-CRF based named entity recognition model. Specifically, the training data sources of this model include two parts: one is a manually annotated financial domain text dataset (containing about 500,000 annotated sentences), and the other is an entity sample library collected from the business system and annotated (containing about 100,000 standard entities). In the model architecture, a double-layer BiLSTM structure is used, each layer containing 256 hidden units, with a Dropout layer (dropout rate of 0.5) added in the middle to prevent overfitting. The input layer uses a 300-dimensional pre-trained word vector, and character features are extracted through a character-level CNN (convolution kernel size of 3, 4, and 5, with 128 for each). A CRF layer is connected after BiLSTM for sequence labeling, and the loss function uses negative log likelihood.

[0076] It should be noted that the model training uses the Adam optimizer, with an initial learning rate of 0.001, a batch size of 64, and 50 training rounds. Early stopping is performed when the F1 value on the validation set does not improve for 5 consecutive rounds. To improve the generalization ability of the model, entity dictionary enhancement and adversarial training strategies are used during training. For example, "a certain investment company" can be labeled as an institutional entity (confidence 0.95), and "2024 first quarter" can be labeled as a time entity (confidence 0.98).

[0077] Next, the system introduces a relationship extraction module based on multi-head attention mechanism, which contains 6 attention heads, each with a dimension of 64, and a feedforward network containing two fully connected layers (dimensions of 512 and 256 respectively). The attention score calculation uses the scaled dot-product attention mechanism, with a scaling factor of 8. The model uses relative position encoding to enhance the position awareness, with a maximum distance of 100 for the position encoding. The training data for this module contains about 300,000 pairs of manually annotated entity relationships, covering 20 core relationship types.

[0078] To improve the accuracy of relationship extraction, the system also incorporates rule constraints based on dependency syntax trees. For example, for a text like "A Company holds B Company", the grammatical dependency relationship can determine that "holds" is the core predicate connecting the two company entities, thus extracting the triple structure of <A Company, holds, B Company>. The system normalizes the extracted relationships according to the predefined relationship ontology, such as mapping similar expressions like "holds", "holds", "owns shares" to the standard relationship type "shareholding control".

[0079] Ultimately, the system organizes the identified entity and relationship information into standardized entity-relation pairs. Each entity-relation pair includes fields such as: entity pair ID, entity type (with confidence score), relationship type (with confidence score), relationship direction, and timestamp. For example:

[0080] {

[0081] "entity1": {"id": "E001", "text": "Company A", "type": "Organization", "confidence": 0.95},

[0082] "entity2": {"id": "E002", "text": "Company B", "type": "Organization", "confidence": 0.93},

[0083] "relation": {"type": "equity control", "direction": "forward", "confidence": 0.89},

[0084] "timestamp": "2024-02-06 10:30:00"

[0085] }

[0086] This structured representation ensures the integrity and traceability of entity relationship information, providing standardized foundational data for subsequent behavioral analysis. The model's overall performance on the test set is as follows: an F1 score of 0.92 for entity recognition and an F1 score of 0.87 for relationship extraction.

[0087] S2.3: Based on the entity-relation pairs, use dependency parsing to extract target syntactic components, identify behavior types and behavior features, and output a structured feature vector;

[0088] In step S2.3, the system uses a method based on dependency syntax analysis to deeply analyze the sentence structure. First, a syntax analysis tree is constructed to identify the subject-predicate-object structure of the sentence and various modifying components. Then, based on predefined grammar rules and semantic templates, the target components related to behavior are extracted from the syntax tree. Specifically, the system focuses on the verb components (representing the type of behavior) and their related modifiers (representing the characteristics of behavior), while considering special components such as negation words, modal words, and other components that may affect the semantics of behavior. For example, for the sentence "the company frequently conducts large-scale capital transactions with multiple associated parties", the system can extract the behavior type as "capital transaction" and the behavior characteristics including "frequent" (frequency attribute) and "large" (scale attribute). Finally, the system converts the extracted semantic information into a structured feature vector according to the preset feature template, which contains information in multiple dimensions such as entity type, relationship type, behavior type, and behavior attribute. This structured representation provides a standardized data foundation for subsequent feature engineering and anomaly detection.

[0089] S3: Using the structured data in the unified format dataset and the structured feature vector, construct behavior statistical features, time series features, and association features, select feature combinations using a sampling algorithm based on the generalized Golub-Kahan method, and construct a multi-dimensional feature set;

[0090] In step S3, the system innovatively uses a feature selection strategy based on the generalized Golub-Kahan method to construct a multi-dimensional feature set. First, the system performs a structured analysis of the original feature space, dividing the features into three categories: behavior statistical features, time series features, and association features. For each category of features, the system designs a special feature extraction method and quantification index.

[0091] Specifically, for behavior statistical features, the system constructs a multi-level index system. The basic layer includes behavior frequency statistics (such as daily transaction count, weekly transaction amount, etc.), the intermediate layer includes behavior pattern features (such as counterparty concentration, transaction time distribution, etc.), and the advanced layer includes behavior complexity indicators (such as behavior entropy, behavior diversity, etc.). For example, for the transfer behavior of a certain enterprise, the following feature values can be obtained:

[0092] {

[0093] "daily_transaction_count": 12.5,

[0094] "weekly_amount_std": 0.85,

[0095] "counterparty_concentration": 0.72,

[0096] "behavior_entropy": 1.23

[0097] }

[0098] In terms of timing features, the system uses multi-scale time windows for feature extraction. First, set short-term (3 days), medium-term (15 days) and long-term (90 days) three basic time windows, calculate the statistical features, trend features and volatility features of the behavior sequence in each window. For example, for the transaction amount sequence, we can get:

[0099] {

[0100] "short_term_trend": 0.45, / / short-term trend slope

[0101] "mid_term_volatility": 0.28, / / mid-term volatility

[0102] "long_term_periodicity": 0.65 / / long-term periodicity intensity

[0103] }

[0104] The construction of correlation features is based on entity relationship network, including direct correlation features (such as degree of connection, weight, etc.) and indirect correlation features (such as path diversity, group characteristics, etc.). For example, the correlation features of a node can be represented as:

[0105] {

[0106] "degree_centrality": 0.34,

[0107] "clustering_coefficient": 0.56,

[0108] "path_diversity": 0.78

[0109] }

[0110] In the feature selection stage, the system innovatively applies the improved Golub-Kahan algorithm for feature combination optimization. The core parameters of the algorithm are set as follows: projection matrix dimension: k = 100; iteration number: max_iter = 1000; convergence threshold: tol = 1e-6; regularization parameter: lambda = 0.01;

[0111] The algorithm execution process includes the following steps: constructing a feature matrix X (number of samples × number of features) and a label matrix Y; applying a two-sided Lanczos process to calculate the Krylov subspace basis; performing SVD decomposition to obtain the feature projection matrix; and calculating the feature importance score based on the projection results.

[0112] For example, for a dataset containing 500 original features, the algorithm's output might look like this:

[0113] {

[0114] "selected_features": {

[0115] "behavior_entropy": 0.92, / / Importance score

[0116] "mid_term_volatility": 0.85,

[0117] "path_diversity": 0.78, ...

[0118] },

[0119] "feature_combinations": [

[0120] ["behavior_entropy", "path_diversity"], / / Optimal feature combination

[0121] ["mid_term_volatility", "clustering_coefficient"], ... ]

[0123] }

[0124] Ultimately, based on feature importance scores and combination effects, the system selected approximately 150 core features to form a multidimensional feature set. The performance of these features on the test data showed: feature redundancy: 0.15 (lower than the traditional method's 0.35); feature coverage: 0.92 (higher than the baseline method's 0.78); model prediction improvement: a 15% increase in AUC compared to the original features.

[0125] This feature engineering approach not only significantly reduces the dimensionality of the feature space but also maintains the expressiveness and interpretability of the features. For example, in a financial risk control scenario, this feature set successfully captured over 95% of known abnormal patterns and discovered several previously undetected abnormal behavior types.

[0126] In one of the embodiments, as shown in FIG. 3, step S3 includes steps S3.1 to S3.6: Figure 3

[0127] S3.1: Based on the structured data in the unified format dataset and the structured feature vector, the target statistics of behavior frequency are calculated by counting the behavior frequency and time distribution, and the frequency feature is formed;

[0128] In step S3.1, the system constructs the behavior statistical features based on the unified format dataset. First, the basic statistics of the behavior of each entity are performed, including the daily average frequency, the cumulative number of times, the maximum / minimum time interval, etc. The system uses a hierarchical statistical method to calculate the statistical quantities of behavior frequency at different time granularities (such as hour, day, week, month), including mean, standard deviation, kurtosis, skewness, etc. For different types of behaviors, the system will also consider their specific attributes, for example, for transaction behavior, in addition to frequency, the distribution characteristics of transaction amount will also be counted. These statistical quantities can reflect the basic patterns and variation laws of entity behavior.

[0129] S3.2: According to the frequency feature, a sliding time window is set to calculate the frequency change at different time scales, and the behavior statistical feature is obtained;

[0130] In step S3.2, the system introduces a sliding time window mechanism to capture the dynamic changes of behavior patterns. Specifically, multiple time windows of different sizes (such as 7 days, 30 days, 90 days, etc.) are set, and the change trend of behavior features is calculated within each window. The system not only focuses on the change of absolute frequency, but also calculates the change rate relative to the historical baseline, as well as the comparative difference with similar entities. Through the sliding window method, the mutation or gradual change characteristics of the behavior pattern can be found in time, providing an important basis for anomaly recognition.

[0131] S3.3: Based on the structured data in the unified format dataset and the structured feature vector, the periodicity index is constructed by calculating the autocorrelation coefficient through Fourier transform to detect the periodic pattern of behavior;

[0132] In step S3.3, the system uses Fourier transform technology to analyze the periodic characteristics of behavior. First, the time series data is converted to the frequency domain space to identify the main frequency components and discover potential periodic patterns. The system calculates the autocorrelation coefficient sequence to quantify the repeatability of behavior patterns, and by setting different time delays, the short-term, medium-term and long-term periodic characteristics are analyzed. This periodic analysis can help to distinguish normal business cycles from abnormal behavior patterns.

[0133] ​In the periodic pattern analysis, the system first preprocesses the time series data. For a given behavior sequence, the system uses interpolation and smoothing techniques to handle missing values and noise, ensuring data continuity and reliability. Meanwhile, the system normalizes the data, eliminating the impact of dimensions, making different types of behavior data comparable.

[0134] Next, the system applies Fast Fourier Transform (FFT) to convert time-domain data to frequency-domain space. In frequency-domain analysis, the system first calculates the power spectral density to identify significant frequency components. By setting an energy threshold, the system filters out the main periodic components and ranks these periods by energy size. The system pays special attention to frequency components with energy exceeding a preset threshold (usually 10%), as these components often correspond to the main periodic patterns of behavior.

[0135] After obtaining the preliminary periodic characteristics, the system calculates the autocorrelation function (ACF) to verify and refine the periodicity analysis results. Specifically, the system sets different time lags and calculates the correlation coefficients between the sequence and its delayed version. By analyzing the change pattern of autocorrelation coefficients, the system can accurately identify the period length and periodic stability of the behavior sequence. For example, a significant peak in the autocorrelation coefficient at a certain lag time often indicates the presence of a corresponding periodic pattern.

[0136] Based on the results of Fourier analysis and autocorrelation analysis, the system constructs a set of periodicity indicators. These indicators include the length and strength of the main period, the stability coefficient of the period, the proportion of harmonic components, the significance level of periodicity, etc. The system also calculates the persistence indicator of the periodic pattern to assess the stability of the periodic behavior. For example, for a certain trading behavior sequence, the system may find that 7 days is the main period (strength 0.85), 30 days is the secondary period (strength 0.45), and the periodic stability is 0.72.

[0137] To improve the accuracy of periodicity analysis, the system uses a sliding window mechanism to repeatedly perform periodicity analysis at different time scales. This multi-scale analysis method can capture the changes in behavior patterns at different time periods. At the same time, the system adjusts analysis parameters such as window size, frequency resolution, etc. according to the characteristics of the business scenario to obtain the optimal detection effect.

[0138] Finally, the system integrates all periodicity indicators into a standardized feature vector. This vector not only contains quantitative periodic characteristics, but also contains qualitative descriptions of periodic patterns, such as the strength of periodicity, the trend of periodic change, etc. These periodicity indicators provide important feature support for subsequent abnormal behavior identification, especially in discovering abnormal behaviors that deviate from normal periodic patterns.

[0139] S3.4: For the periodicity indicators, use moving average methods to analyze long-term trends, calculate volatility and amplitude, and output timing features;

[0140] In step S3.4, based on the calculated periodicity indicators, the system uses improved moving average methods to analyze the long-term trends of behavior. Specifically, it uses techniques such as exponential moving average (EMA) and weighted moving average (WMA) to give higher weights to recent data, better reflecting the changes in trends. At the same time, the system calculates volatility indicators (such as standard deviation, coefficient of variation, etc.) and amplitude features (such as maximum fluctuation range, peak-to-valley ratio, etc.) to describe the stability and intensity of the behavior pattern.

[0141] After obtaining the periodicity indicators, the system first applies a multi-level moving average method to analyze the long-term trend. Specifically, the system uses three methods: simple moving average (SMA), exponential moving average (EMA), and weighted moving average (WMA). For EMA, the system uses decay factors α = 0.1, 0.2, and 0.3 at three levels to capture trend characteristics at different time scales. For WMA, the system designs a weight function based on time distance, so that recent data gets higher weight, while the influence of long-term data gradually decreases. This combination of multiple moving averages can more comprehensively depict the changing characteristics of trends.

[0142] Based on the trend analysis, the system calculates a series of volatility indicators. First, the basic volatility is measured by the standard deviation of log returns. The system sets three calculation windows of 15 days, 30 days, and 60 days to obtain volatility characteristics at different time scales. Second, the directional volatility indicators are calculated, including up and down volatility, to describe the asymmetry of behavior changes. In addition, the system also introduces a volatility estimation method based on extreme value theory, which is specifically used to capture abnormal volatility events.

[0143] The calculation of amplitude characteristics is more detailed. The system first identifies local extreme points in different time windows, calculates the maximum amplitude and average amplitude. Then, by comparing the time interval and amplitude change of adjacent extreme points, it constructs an oscillation intensity indicator. The system pays special attention to the mutation of amplitude, and when the amplitude change exceeds 2 times the historical standard deviation, it is marked as a potential abnormal point. At the same time, the system also calculates the decay characteristics of amplitude to evaluate the persistence of behavior fluctuations.

[0144] To improve the robustness of timing features, the system uses an adaptive threshold mechanism. Specifically, the system dynamically adjusts the volatility and amplitude judgment criteria according to the distribution characteristics of historical data. For example, in periods of high market volatility, the system will appropriately increase the volatility threshold; in stable periods, it will lower the threshold to increase the sensitivity to small abnormalities. This adaptive mechanism significantly improves the adaptability of the features.

[0145] In integrating the indicators, the system constructs a hierarchical temporal feature structure. The first layer is the basic features, including various types of moving averages and original volatility indicators; the second layer is the derived features, including trend strength, volatility change speed, amplitude pattern, etc.; the third layer is the combined features, obtained through the cross operation of multiple basic indicators. For example, the system may find that a certain behavior sequence has an upward trend (trend strength 0.75), accompanied by gradual increase in volatility (volatility change speed 0.15) and asymmetric amplitude characteristics (upper and lower amplitude ratio 1.8).

[0146] Finally, the system standardizes all the temporal features to ensure comparability of features in different dimensions. At the same time, the system also calculates the correlation between features, removes redundant features, and retains the most representative indicator combination. The processed temporal features not only comprehensively describe the dynamic change characteristics of behavior, but also have high computational efficiency and interpretability.

[0147] Through this multi-level and multi-angle temporal feature analysis, the system can accurately capture the long-term evolution trend, periodic change characteristics and abnormal volatility pattern of behavior patterns, providing reliable feature support for subsequent anomaly behavior recognition. Especially in the discovery of gradual and sudden anomalies, these fine temporal features often provide key early warning signals.

[0148] S3.5: Based on the structured data in the dataset in the unified format and the structured feature vector, the frequency and intensity of direct interaction between entities are counted, and the weighted correlation coefficient is calculated to obtain the direct correlation degree;

[0149] First, the interaction frequency between entity pairs is counted, and the weighted coefficient is calculated according to the type, size, etc. of the interaction. The system uses an improved correlation coefficient calculation method, considering the timing characteristics, directionality and intensity of interaction, to generate standardized correlation degree values. These direct correlation features can reflect the closeness and dependency relationship between entities.

[0150] First, in S3.5, the system performs multi-dimensional analysis on the direct interaction relationship between entities. The system first constructs an interaction matrix, each element of which contains not only the basic interaction frequency, but also the time distribution, amount distribution, etc. of the interaction. For the interaction between each pair of entities, the system calculates multiple dimensions of statistics: the mean and variance of interaction frequency, the distribution characteristics of single interaction amount (such as mean, median, quantile, etc.), the interval characteristics of interaction time, etc. These basic statistics provide data support for subsequent correlation strength calculation.

[0151] In calculating the weighted association score, the system adopts a multi-level weight system. The first layer is the interaction attribute weight, which assigns different basic weights according to the nature of the interaction (such as fund transfer, business cooperation, etc.). The second layer is the time decay weight, which uses an exponential decay function to give higher weight to recent interactions. The third layer is the abnormal intensity weight, which gives higher weight when the attributes of an interaction (such as amount, frequency) significantly deviate from historical patterns. This multi-level weight design ensures that the association score accurately reflects the importance and abnormality of the relationship between entities.

[0152] The system constructs a scoring model of direct correlation degree by combining weighted association scores in multiple dimensions. This model not only considers quantitative features of interactions, but also introduces qualitative factors such as relationship persistence and stability. For example, for two entities that frequently interact, the system analyzes whether their interaction patterns are regular, whether there are abnormal interaction periods or changes in amount. This comprehensive analysis helps the system more accurately assess the strength of direct correlation between entities.

[0153] S3.6: Based on the direct correlation degree, construct multi-hop relationship paths, calculate path importance weights, and form correlation features;

[0154] The system explores indirect correlation paths between entities through graph algorithms and calculates the importance weights of the paths based on factors such as path length and intermediate node characteristics. The system also considers the diversity and stability of the paths to assess the complexity of the relationship network. Finally, these direct and indirect correlation features are integrated to form a complete correlation feature set, providing a foundation for subsequent network structure analysis. Through this multi-level feature construction method, the system can comprehensively depict the behavior patterns and correlation relationships of entities, improving the accuracy of anomaly identification.

[0155] In S3.6, the system starts to construct and analyze multi-hop relationship paths based on the calculated direct correlation degree. First, the system uses an improved breadth-first search algorithm to find all possible multi-hop paths in the entity relationship network. To control the computational complexity, the system sets a maximum hop limit (usually 3 or 4 hops) and uses a correlation degree threshold for path pruning, retaining only paths with higher correlation strength.

[0156] During path search, the system uses a dynamic programming method to calculate the importance weights of the paths. Specifically, the calculation of path weights considers the following key factors: path length (number of hops), importance of nodes on the path, decay effect of correlation strength between hops, and uniqueness of the path. The system designs a weight transfer model based on Markov chain, so that the path weight can reasonably reflect the strength decay of indirect correlation.

[0157] To improve the accuracy of path analysis, the system also introduces a path pattern recognition mechanism. First, the system defines a series of typical path patterns, such as loop patterns, star patterns, and chain patterns. Then, for each multi-hop path, the system performs pattern matching to identify the type of pattern it belongs to. Different pattern types of paths will obtain different weight adjustment coefficients. For example, loop patterns usually represent stronger association relationships, so they will obtain higher weight additions.

[0158] The system pays special attention to the timing characteristics of the path. For each multi-hop path, the system analyzes the time sequence of each interaction on the path and identifies whether there is a clear timing pattern or abnormal time difference. For example, if the interactions on a path show clear continuity or regularity, it may imply a certain organized behavior pattern, and the system will adjust the importance weight of the path accordingly.

[0159] Finally, the system integrates direct association features and multi-hop path features to form a complete set of association features. This feature set contains multiple levels: node-level features (such as node degree centrality, intermediary centrality, etc.), direct association-level features (such as association strength, interaction pattern, etc.), path-level features (such as path diversity, path strength, etc.), and network-level features (such as local clustering coefficient, community structure features, etc.). This multi-level feature system can comprehensively depict the association relationships between entities and provide rich feature support for subsequent abnormal behavior identification.

[0160] Through this in-depth association analysis, the system can effectively identify complex association patterns and potential abnormal relationships. For example, the system may find that some entities have no direct interaction but form close indirect associations through multiple intermediate nodes, which may imply a behavior of deliberately avoiding monitoring. At the same time, the timing analysis of association features also helps to discover dynamic evolving abnormal patterns, such as gradually forming a fund transfer chain or gradually expanding an associated transaction network.

[0161] Suppose the financial transaction behavior of enterprise A is analyzed, and the original data contains one year of transfer records:

[0162] In step S3.1 (constructing behavior statistical features):

[0163] The system performs multi-dimensional statistical analysis on the transfer behavior of enterprise A and obtains the following feature values:

[0164] {

[0165] "Basic statistical features": {

[0166] "Daily transaction frequency": 8.5 times,

[0167] "Monthly cumulative transaction times": 255 times,

[0168] "Max Time Interval": 36 hours,

[0169] "Min Time Interval": 0.5 hours

[0170] },

[0171] "Amount Distribution Features": {

[0172] "Daily Average Transaction Amount": 1.8 million yuan,

[0173] "Amount Standard Deviation": 4.5 million yuan,

[0174] "Amount Kurtosis": 3.2,

[0175] "Amount Skewness": 0.8

[0176] },

[0177] "Counterparty Features": {

[0178] "Monthly Independent Counterparty Number": 25,

[0179] "Fixed Counterparty Proportion": 0.35,

[0180] "New Counterparty Rate": 0.15

[0181] }

[0182] }

[0183] In step S3.2 (sliding time window analysis):

[0184] The system sets multiple time windows for trend analysis:

[0185] {

[0186] "7-day window": {

[0187] "Transaction frequency change rate": +25%,

[0188] "Amount change rate": +45%,

[0189] "Counterparty change rate": +15%

[0190] },

[0191] "30-day window": {

[0192] "Transaction frequency change rate": +15%,

[0193] "Amount change rate": +30%,

[0194] "Opponent's rate of change": +10%

[0195] },

[0196] "90-day window": {

[0197] "Transaction frequency change rate": +5%,

[0198] "Amount Change Rate": +12%,

[0199] "Opponent's rate of change": +3%

[0200] }

[0201] }

[0202] In step S3.3 (periodic analysis):

[0203] Fourier transform analysis yielded the following:

[0204] {

[0205] "Main Cycle": {

[0206] "Short-term cycle": "7 days"

[0207] "Period strength": 0.85,

[0208] Autocorrelation coefficient: 0.72

[0209] },

[0210] "Secondary Cycle": {

[0211] "Medium-term cycle": "30 days"

[0212] "Period strength": 0.45,

[0213] Autocorrelation coefficient: 0.38

[0214] }

[0215] }

[0216] In step S3.4 (long-term trend analysis):

[0217] The system calculates trend indicators at different time scales:

[0218] {

[0219] "EMA indicator": {

[0220] "Short-term (7 days)": 1.85 million yuan

[0221] "Medium term (30 days)": 1.65 million yuan,

[0222] "Long-term (90 days)": 150 million

[0223] },

[0224] "Volatility Index": {

[0225] "Intraday Volatility": 0.25,

[0226] "Weekly Volatility": 0.18,

[0227] "Monthly Volatility": 0.12

[0228] },

[0229] "Trend Characteristics": {

[0230] "Uptrend Strength": 0.65,

[0231] "Trend Stability": 0.78

[0232] }

[0233] }

[0234] In step S3.5 (Direct Association Analysis):

[0235] The system analyzes the direct association relationship between Enterprise A and its trading partners:

[0236] {

[0237] "High-Frequency Trading Partners": {

[0238] "Enterprise B": {

[0239] "Interaction Frequency": 45 times / month,

[0240] "Average Amount": 120 million,

[0241] "Association Strength": 0.82

[0242] },

[0243] "Enterprise C": {

[0244] "Interaction Frequency": 35 times / month,

[0245] "Average Amount": 90 million,

[0246] "Association Strength": 0.75

[0247] }

[0248] },

[0249] "Association Patterns": {

[0250] "bidirectional transaction ratio": 0.45,

[0251] "net flow of funds": "outflow dominant",

[0252] "temporal concentration": 0.68

[0253] }

[0254] }

[0255] In step S3.6 (multi-hop relationship analysis):

[0256] The system constructs and analyzes the indirect association network:

[0257] {

[0258] "two-degree association": {

[0259] "number of nodes": 15,

[0260] "average path length": 2.3,

[0261] "key intermediate nodes": ["Enterprise D", "Enterprise E"],

[0262] "path importance": {

[0263] "A->B->F": 0.65,

[0264] "A->C->G": 0.58

[0265] }

[0266] },

[0267] "three-degree association": {

[0268] "number of nodes": 45,

[0269] "clustering coefficient": 0.42,

[0270] "number of key paths": 8

[0271] },

[0272] "network characteristics": {

[0273] "network density": 0.35,

[0274] "centrality": 0.68,

[0275] "strength of community structure": 0.72

[0276] }

[0277] }

[0278] Based on the above analysis, the system found that enterprise A has the following abnormal characteristics:

[0279] Recent (7-day window) transaction frequency and amount surge, exceeding the historical fluctuation range;

[0280] The financial transactions with enterprise B show a clear one-way outflow feature;

[0281] Through enterprise D as an intermediate node, a close financial circulation path is formed.

[0282] These features together constitute the behavior portrait of enterprise A, providing multi-dimensional feature support for subsequent anomaly identification. Based on these features, the system gives a risk score of 0.82 (high risk) and suggests manual verification. This example shows how to use multi-level feature analysis to fully characterize the behavior patterns and relationships of enterprises, effectively supporting risk monitoring decisions.

[0283] S4: According to the association data in the multi-dimensional feature set, an entity relationship graph is established, the association strength between entities is calculated through low-rank tensor and p-AAA algorithm, and the entity relationship graph is optimized based on the association strength, and a network structure model is established;

[0284] When constructing the initial entity relationship graph based on the association data in the multi-dimensional feature set, the system first structures the association data. Each association data contains multiple dimensions of information: entity pair identification, association type, association time, association strength, interaction features, etc. The system organizes these multi-dimensional data into a tensor structure, where each dimension of the tensor corresponds to a feature dimension. For example, a four-order tensor may contain: entity dimension, time dimension, relationship type dimension and feature dimension. This tensor structure can fully preserve the multi-dimensional characteristics of the data.

[0285] In order to process high-dimensional tensor data, the system uses low-rank tensor decomposition technology. Specifically, the system first uses Tucker decomposition to decompose the original tensor into a combination of core tensor and factor matrix. During the decomposition process, the system determines the optimal rank parameter through cross-validation, usually choosing a rank value that can retain 85%-95% of the information amount. This decomposition not only significantly reduces the data dimension, but also filters out the noise components in the data. For example, for a data set containing 1000 entities, 12 months of time span, and 10 types of relationships, it can be compressed to the form of rank (50, 6, 5) through low-rank decomposition.

[0286] On the basis of low-rank representation, the system applies the p-AAA (parallel Adaptive Anderson-Antoulas Algorithm) algorithm to construct an accurate representation of the strength of the inter-entity associations. The core idea of this algorithm is to capture the non-linear characteristics of the association relationship through rational function approximation. The algorithm first selects the most representative interpolation points in the compressed feature space, and then iteratively optimizes the polynomial coefficients of the numerator and denominator of the rational function. The system uses a parallel computing strategy to handle multiple rational function approximation tasks simultaneously, significantly improving the computational efficiency.

[0287] An important feature of the p-AAA algorithm is its adaptability. The algorithm can automatically adjust the approximation strategy according to the local characteristics of the data, using more interpolation points in areas with complex relationships and fewer interpolation points in areas with simple relationships. The system sets an approximation accuracy threshold (usually 1e-6) and a maximum number of iterations (usually 1000), ensuring that the algorithm converges to the desired accuracy within a reasonable time. This adaptive approximation strategy enables the system to accurately depict different types of association patterns.

[0288] After obtaining the association strength estimates, the system begins to optimize the structure of the entity relationship graph. First, the system uses an adaptive threshold mechanism to filter weakly associated edges. The threshold is set based on the distribution characteristics of the association strength, usually choosing to retain between 20%-40% of the total number of edges. In the process of deleting weakly associated edges, the system will simultaneously evaluate the connectivity of the network to ensure that the overall structure of the network is not damaged by excessive pruning.

[0289] Next, the system optimizes the network at the node level. The system designs a node similarity calculation method based on multi-dimensional features, considering the attribute characteristics, topological characteristics and behavior characteristics of the nodes. When the similarity of two nodes exceeds a pre-set threshold (usually 0.85), the system will evaluate their possibility of merging. The merging process needs to carefully handle the inheritance of node attributes and the reconstruction of association relationships, ensuring that no false associations are introduced.

[0290] During the network optimization process, the system pays special attention to the identification of abnormal structures. For example, the system will detect abnormally dense subgraph structures, abnormal star structures or ring structures, etc. These special structures often imply potential abnormal association patterns. The system will assign special labels to these structures and give them more attention in subsequent analysis.

[0291] Finally, the system builds a complete network structure model. This model not only contains the optimized network topology, but also contains rich attribute information: node importance indicators (such as various centrality measures), edge weight and type information, subgraph structure characteristics, etc. The system also calculates a series of network-level statistical indicators, such as network density, average path length, clustering coefficient, etc., which help to understand the overall characteristics of the network.

[0292] Through this fine network construction and optimization process, the system finally obtains a network model that not only preserves key structural information but also has good interpretability. This model can accurately reflect the complex association relationships between entities and provide reliable network structure support for subsequent anomaly behavior identification. For example, the system may discover that a group of enterprises forms a tightly linked community structure through complex shareholding relationships, which is of great value for identifying related transaction behavior.

[0293] As shown in Figure 4 , step S4 further comprises S4.1 to S4.4:

[0294] S4.1: Use the association data in the multi-dimensional feature set to construct a multi-dimensional association tensor, use Tucker decomposition to reduce the tensor dimension, and obtain the main feature information;

[0295] Specifically, a high-order tensor is constructed, which includes dimensions such as entities, relationship types, and time. Each tensor element represents the association strength under the corresponding dimension combination. To handle this high-dimensional data structure, the system uses Tucker decomposition technology to decompose the original tensor into a combination of core tensor and factor matrix. This decomposition not only significantly reduces the data dimension, but also preserves key feature information. For example, for data containing tens of thousands of entities and dozens of relationship types, Tucker decomposition can compress it to a suitable dimension while maintaining more than 90% of the information.

[0296] In S4.1, the system first constructs a high-dimensional association tensor. This tensor contains multiple key dimensions: entity dimension (I x J, where I and J represent the number of source entities and target entities, respectively), time dimension (T, representing the number of sampling points in the observation period), relationship type dimension (R, containing different types of association relationships), and feature dimension (F, containing various interaction features). For example, for a dataset containing 1000 entities, 12 months of daily data, 10 relationship types, and 20 features, the initial tensor has dimensions 1000 x 1000 x 365 x 10 x 20. This multi-dimensional structure can completely preserve the time evolution characteristics and multi-dimensional attribute information of entity association.

[0297] When constructing the tensor, the system uses a sparse storage format (COO format) to handle large-scale sparse data. For each non-zero element, the system records its complete index information and the corresponding eigenvalue. At the same time, the system normalizes the eigenvalues using the Min-Max normalization or Z-score standardization method to ensure that features of different dimensions are comparable. In addition, the system also handles missing value problems, and uses appropriate interpolation methods to fill in missing tensor elements based on the time series correlation and entity similarity of the data.

[0298] To reduce the dimension of the tensor, the system uses Tucker decomposition technology. Tucker decomposition decomposes the original tensor into a core tensor and the product of multiple factor matrices. Specifically, for a D-dimensional tensor X, its Tucker decomposition can be represented as:

[0299]

[0300] where G is the core tensor and Ui is the factor matrix of the i-th dimension. The system solves this decomposition problem by alternating least squares (ALS) and uses a multi-start strategy to avoid local optimal solutions.

[0301] When determining the rank parameter of Tucker decomposition, the system uses an adaptive strategy. First, calculate the singular value spectrum of the tensor and analyze the energy distribution. Then, select the smallest rank value combination that can retain more than 90% of the information. For example, the original tensor can be compressed to a form with a rank of (50, 50, 30, 5, 10), which significantly reduces the data dimension while maintaining key structural information. The system also verifies the compression quality through reconstruction error and cross-validation to ensure that the compressed representation accurately reflects the characteristics of the original data.

[0302] S4.2: According to the main feature information, construct a rational function approximation through the p-AAA algorithm, iteratively optimize the approximation accuracy, and obtain the correlation strength between entities;

[0303] First, based on the low-dimensional features obtained by Tucker decomposition, construct a rational function to approximate the correlation between entities. This algorithm uses an iterative optimization process to adaptively select the optimal interpolation points and continuously adjust the polynomial coefficients of the numerator and denominator of the rational function until the preset approximation accuracy is reached. Compared with traditional methods, the p-AAA algorithm has better numerical stability and convergence, and can more accurately describe the nonlinear correlation between entities. For example, when dealing with correlation patterns with strong periodicity or mutation characteristics, this algorithm can maintain high fitting accuracy.

[0304] In S4.2, the system constructs the precise representation of inter-entity association strength using the p-AAA algorithm based on the compressed feature representation. The core idea of the p-AAA algorithm is to capture the nonlinear association patterns through rational function approximation. The algorithm constructs a rational function approximation in each dimension separately, and then combines these approximations through a tensor product form to obtain the representation of multi-dimensional association strength.

[0305] Specifically, for each pair of entities (i, j), the system constructs a rational function of the following form:

[0306]

[0307] where z represents the feature variable, and p(z) and q(z) are the numerator and denominator polynomials, respectively. The system determines the coefficients of the polynomials through iterative optimization so that the rational function can accurately approximate the observed association patterns.

[0308] In the implementation of the p-AAA algorithm, the system adopts a parallel computing strategy. First, the entity pairs are divided into multiple batches, and each batch simultaneously computes multiple rational function approximations. The system uses GPU acceleration for matrix operations, significantly improving the execution efficiency of the algorithm. For each approximation task, the system sets the following key parameters: the highest degree of the numerator polynomial: m = 5; the highest degree of the denominator polynomial: n = 4; the convergence threshold: ε = 1e-6; the maximum number of iterations: maxIter = 1000;

[0309] The iterative process of the algorithm includes the following steps: adaptive selection of interpolation points, preferentially selecting data points with significant association features; constructing a Loewner matrix and calculating its SVD decomposition; solving a linear system of equations and updating the coefficients of the rational function; calculating the approximation error and determining whether the convergence condition is met; during the approximation process, the system pays special attention to numerical stability issues. Regularization techniques are used to control the size of the coefficients to prevent overfitting. At the same time, the system monitors the condition number and automatically adjusts the regularization parameter or re-selects the interpolation points when numerical instability is found. Finally, the system obtains the association strength estimates between each pair of entities.

[0310] These estimates not only contain scalar strength but also contain confidence interval information, reflecting the reliability of the estimates. The system organizes these association strengths into a matrix form as the basis for subsequent network optimization. For example, for two frequently interacting entities, the system may obtain the following results:

[0311] {

[0312] "association strength": 0.85,

[0313] "confidence interval": [0.82, 0.88],

[0314] "approximation error": 0.003,

[0315] "convergence round": 245

[0316] }

[0317] Through this precise correlation strength calculation, the system can accurately depict the complex correlation patterns among entities, providing a reliable quantitative basis for subsequent network structure optimization. Especially in dealing with nonlinear correlation patterns, this rational function-based approximation method shows obvious advantages, which can capture the complex correlation characteristics that traditional linear methods may ignore.

[0318] S4.3: According to the correlation strength, set a correlation strength threshold, delete edges below the correlation strength threshold, and construct an optimized entity relationship graph;

[0319] First, the system uses an adaptive threshold setting method to dynamically determine the cutoff threshold of correlation strength based on the connection density of the overall network and the characteristics of the business scenario. For edges below the threshold, the system will delete them from the network to reduce the impact of noise. This process is progressive, and the system will re-evaluate the network's connectivity and structural characteristics after each edge deletion to ensure that the optimized network still maintains a reasonable topological structure. For example, for a network containing tens of thousands of edges, about 60% of weakly correlated edges can be deleted through this optimization while maintaining the main connectivity of the network.

[0320] In S4.3, the system first sets the correlation strength threshold based on the statistical distribution characteristics of the correlation strength using an adaptive method. Specifically, the system calculates the statistical quantities of the correlation strength, including the mean (μ), standard deviation (σ), quantile, etc. Based on these statistical quantities, the system designs a three-level threshold mechanism:

[0321] Strong correlation threshold (T1 = μ + 1.5σ);

[0322] Medium correlation threshold (T2 = μ + 0.5σ);

[0323] Weak correlation threshold (T3 = μ - 0.5σ).

[0324] This hierarchical threshold setting allows the system to adopt differentiated processing strategies for different strength correlation relationships.

[0325] During the filtering of edges, the system adopts a progressive strategy. First, edges below a weak association threshold (T3) are removed, as these typically represent noise or accidental associations. For edges between T3 and T2, the system further assesses their temporal persistence and stability. If an edge exhibits significant temporal persistence (e.g., existing for multiple consecutive months) despite being weakly associated, the system considers preserving it. This time-dimensioned filtering strategy avoids mistakenly removing important, long-term stable associations.

[0326] The system pays particular attention to maintaining the connectivity of the network. During edge removal, the system monitors several key indicators of the network in real-time: average degree, clustering coefficient, number of connected components, and size distribution. When it finds that a certain edge removal might significantly alter the network structure (e.g., creating a large isolated connected component), it re-evaluates the importance of the relevant edges. For example, if removing an edge would split an important community structure, the system might choose to preserve it, even if its association strength is relatively low.

[0327] S4.4: Using the optimized entity relationship graph, identify nodes with similarity exceeding a preset threshold and merge nodes, update association relationships, and form a network structure model;

[0328] In step S4.4, the system further optimizes the structure of the optimized entity relationship graph. First, a node similarity calculation method based on multi-dimensional features is designed, considering the attribute features, topological features, and behavior features of the nodes. When the similarity of two nodes exceeds a preset threshold, the system evaluates their possibility of merging. During the merging process, the system carefully handles the inheritance and merging of association relationships to ensure that no false associations are introduced. Meanwhile, for the merged nodes, the system recalculates their association strength with other nodes and updates the network structure. This optimization not only reduces the complexity of the network but also discovers potential entity association groups, providing a clearer network structure basis for subsequent abnormal behavior identification. For example, through node merging, entities that are apparently independent but actually highly related can be identified as an association group, effectively preventing behaviors that evade monitoring through dispersion.

[0329] In S4.4, the system conducts optimization at the node level. First, a node similarity calculation framework is constructed, considering multiple dimensions of features: attribute similarity (such as the basic features of entities), structural similarity (such as the local network structure of nodes), and behavior similarity (such as interaction patterns). For each dimension, the system designs a special similarity calculation method:

[0330] Attribute similarity: uses weighted Jaccard coefficient to calculate the similarity of categorical features and cosine similarity to calculate the similarity of numerical features;

[0331] Structural Similarity: Calculate structural similarity based on the neighbor set of nodes, considering the importance weight of neighbor nodes;

[0332] Behavioral Similarity: Calculate the similarity of behavior sequences using Dynamic Time Warping (DTW) algorithm;

[0333] The system combines the similarity of these dimensions with weighted combination, and gets the comprehensive similarity score. The weight setting is based on the importance and reliability of features, and the optimal weight combination is determined through cross-validation. When the comprehensive similarity of two nodes exceeds the preset threshold (usually set to 0.85), the system will mark them as potential merging candidate pairs.

[0334] In the node merging process, the system adopts a cautious strategy. First, for each pair of candidate nodes, the system will conduct in-depth association analysis to check whether they have obvious complementarity or conflict. For example, if two nodes show obvious complementarity in time (one node is active while the other node is not active), it may imply that they are actually the same entity in different periods, and merging is reasonable.

[0335] The merging operation needs to handle three key issues: attribute inheritance: decide how the merged node inherits the attribute values of the original nodes, which may use weighted average, maximum value or other appropriate aggregation methods; association relationship reconstruction: handle the association relationship between the merged node and other nodes, which needs to reasonably accumulate or average the association strength; time sequence information preservation: ensure that the time sequence characteristics of the merged node can accurately reflect the time evolution pattern of the original nodes;

[0336] For example, when merging two highly similar enterprise nodes, the system may generate the following merging record:

[0337] {

[0338] "merged node pair": ["Enterprise A", "Enterprise B"],

[0339] "similarity score": 0.89,

[0340] "attribute inheritance strategy": {

[0341] "registered capital": "maximum value",

[0342] "business scope": "union",

[0343] "risk level": "highest value"

[0344] },

[0345] "association reconstruction": {

[0346] "updated edge number": 15,

[0347] "Max Intensity Change": 0.12

[0348] }

[0349] }

[0350] After the node merging is completed, the system updates and optimizes the entire network structure. This includes recalculating the topological features of the network, updating the centrality indicators of the nodes, adjusting the community division results, etc. The system also generates a detailed optimization report, recording the changes in the network structure, such as the reduction ratio of the number of nodes, the change in edge density, the evolution of community structure, etc.

[0351] This optimized network structure model provides a reliable foundation for subsequent abnormal behavior identification. For example, the system can more accurately identify abnormal fund flow paths or suspicious associated transaction patterns based on this optimized network structure.

[0352] S5: According to the network structure model and the multi-dimensional feature set, set up a feature weight system, calculate the multi-dimensional anomaly score using the pruning tensor structure measurement method, use low-rank tensor recovery technology to comprehensively calculate the multi-dimensional anomaly score, obtain the anomaly score, and output the early warning list according to the anomaly score;

[0353] As shown in Figure 5 , step S5 includes steps S5.1 and S5.2:

[0354] S5.1: According to the network structure model and the multi-dimensional feature set, set the associated party tightness weight value, behavior abnormality weight value and time sequence abnormality weight value, and construct the weight configuration;

[0355] In step S5.1, the system constructs a multi-level weight configuration system based on the network structure model and the multi-dimensional feature set. First, for the setting of the associated party tightness weight value, the system considers the importance of the entity's position in the network and the connection pattern. Specifically, by calculating the degree centrality, betweenness centrality and eigenvector centrality of the nodes, etc., the influence of the entity in the network is evaluated. At the same time, considering the path diversity and clustering coefficient between entities, the stability of the association relationship is quantified. For example, for entities that are in the core position of the network and have diversified connections, the system will give a higher associated party tightness weight, usually between 0.3-0.5.

[0356] For the behavior abnormality weight value, the system mainly sets it based on the behavior characteristics distribution of the entity. First, analyze the frequency, scale and complexity of the behavior, and establish a benchmark behavior pattern. Then, according to the degree of deviation of the behavior from the benchmark pattern, dynamically adjust the weight value. For example, for transaction behavior, the system will focus on the mutation of transaction frequency, abnormal change of transaction counterpart, etc., and set the weight according to the significance of these characteristics, the typical value range is between 0.2-0.4.

[0357] The setting of the time sequence abnormality weight value mainly considers the time evolution characteristics of the behavior pattern. The system evaluates the abnormality degree of the time sequence pattern by analyzing the periodicity, trend and mutability of the behavior sequence. For different time scales (such as day, week, month), the system will set different weight coefficients to capture short-term, medium-term and long-term abnormal patterns. Generally, the weight value of short-term abnormality will be slightly higher, set between 0.3-0.5.

[0358] S5.2: Based on the weight configuration, refine the associated party closeness weight value, the behavior abnormality weight value and the time sequence abnormality weight value to obtain a feature weight system;

[0359] In step S5.2, the system makes fine adjustment to the initially set weight value. First, for the associated party closeness weight, the system introduces a hierarchical adjustment mechanism. For direct association, refine according to interaction frequency, interaction scale and relationship duration; for indirect association, consider path length, intermediate node characteristics, etc. to attenuate the weight. For example, the weight of two-degree association will be attenuated by 40%-60% based on the original weight.

[0360] For the refinement of the behavior abnormality weight, the system adopts a multi-dimensional decomposition strategy. The behavior abnormality is decomposed into multiple sub-dimensions, such as transaction abnormality, operation abnormality, relationship abnormality, etc., and the weight proportion of each sub-dimension is set according to the specific business scenario. The system also considers the severity and impact range of the behavior, and gives higher weight to high-risk behavior types.

[0361] In the refinement process of the time sequence abnormality weight, the system introduces an adaptive adjustment mechanism. First, according to the fluctuation characteristics of historical data, establish the benchmark interval of time sequence pattern. Then, according to the deviation of real-time data from the benchmark interval, dynamically adjust the weight value. The system also considers seasonal factors and the impact of special periods, and adjusts the weight sensitivity appropriately. For example, during the business peak period, the system will appropriately reduce the weight threshold of time sequence abnormality to reduce the false positive rate.

[0362] With this multi-level and refined weight system, the system can more accurately depict the various dimensions of abnormal behavior, improving the accuracy and interpretability of identification. At the same time, this weight system has strong adaptability and can be dynamically adjusted according to changes in business scenarios and evolution of abnormal patterns.

[0363] Suppose we are monitoring a financial transaction network containing 2000 enterprises, and the goal is to identify possible abnormal transaction behavior. In this case, the multi-dimensional feature set includes the following dimensions: transaction behavior features (such as transaction frequency, amount, time distribution), enterprise basic features (such as registered capital, operating years, industry category), network structure features (such as node centrality, community affiliation), and time evolution features (such as changes in transaction patterns).

[0364] First, the system sets up a weight system for these features. Taking the transaction behavior dimension as an example, the system may give the following weight distribution:

[0365] Transaction amount anomaly: 0.35 (high weight, directly reflects risk level);

[0366] Transaction frequency anomaly: 0.25 (medium-high weight, reflects behavior pattern changes);

[0367] Transaction counterparty anomaly: 0.25 (medium-high weight, reflects associated risks);

[0368] Transaction time anomaly: 0.15 (medium-low weight, auxiliary indicator);

[0369] Taking a specific enterprise A as an example, its abnormal feature performance in a certain observation period is as follows:

[0370] Transaction amount suddenly increases: the daily transaction amount in the last month is 5 times the historical average;

[0371] Transaction frequency significantly increases: daily transaction times increase from an average of 3 to 15;

[0372] Newly added multiple never-traded counterparties: 10 new transaction counterparties in a week;

[0373] Transaction time anomaly: a large number of transactions occur at non-working hours;

[0374] Using the pruning tensor structure measurement method, the system organizes these abnormal features into a four-order tensor (enterprise × feature × time × associated entity). For enterprise A, the system calculates the abnormal score of each dimension:

[0375] Amount dimension anomaly score: 0.85 (severe anomaly);

[0376] Frequency dimension anomaly score: 0.78 (significant anomaly);

[0377] Opponent dimension anomaly score: 0.92 (severe anomaly);

[0378] Time dimension anomaly score: 0.65 (moderate anomaly);

[0379] Then, the system applies low-rank tensor recovery technology to comprehensively calculate these multi-dimensional anomaly scores. Considering the correlation between different dimensions, the system uses Tucker decomposition for low-rank approximation to obtain a more robust anomaly score. For company A, the final anomaly score calculation process is as follows:

[0380] Initial overall score:

[0381] Anomaly score = 0.85×0.35 + 0.78×0.25 + 0.92×0.25 + 0.65×0.15 = 0.82;

[0382] Adjustments for time-series correlation:

[0383] Duration of abnormality detected: 15 consecutive days;

[0384] Timing adjustment factor: 1.2 (for anomalies lasting more than 10 days);

[0385] Adjusted score: 0.82 × 1.2 = 0.984;

[0386] Consider adjusting the network structure:

[0387] Anomaly rate of related entities: 30%;

[0388] Network adjustment factor: 1.1 (high-risk community);

[0389] Final anomaly score: 0.984 × 1.1 = 0.982;

[0390] Based on this anomaly score, the system generates the following warning message:

[0391] Warning level:

[0392] Level 1 (highest level) warning targets:

[0393] Company A

[0394] Anomaly score: 0.982;

[0395] Key abnormal characteristics:

[0396] Transaction amounts fluctuated wildly;

[0397] The counterparty is expanding rapidly;

[0398] An abnormal increase in transaction frequency;

[0399] Associated Risks:

[0400] 3 out of 10 new trading partners also exhibit anomalies;

[0401] The associated community risk level increases;

[0402] Recommended Actions:

[0403] Immediately initiate on-site verification;

[0404] Temporarily restrict large transactions;

[0405] Closely monitor associated enterprises;

[0406] At the same time, the system also identifies a risk transmission chain closely associated with Enterprise A:

[0407] Enterprise A → Enterprise B (abnormal score 0.875) → Enterprise C (abnormal score 0.823) → Enterprise D (abnormal score 0.792);

[0408] This indicates the possibility of an organized risk network, and the system expands the monitoring scope accordingly, adding these associated enterprises to the list of key monitoring targets.

[0409] On a larger scale, the system generates a hierarchical early warning list based on abnormal scores:

[0410] First-level warning (score > 0.9): 5 enterprises;

[0411] Second-level warning (score 0.8-0.9): 12 enterprises;

[0412] Third-level warning (score 0.7-0.8): 25 enterprises;

[0413] For each warning target, the system generates a detailed abnormal feature analysis report, including:

[0414] Time sequence evolution graph of abnormal behavior;

[0415] Contribution analysis of key abnormal features;

[0416] Visual display of risk transmission paths;

[0417] Comparative analysis of historical abnormal behavior;

[0418] Targeted regulatory recommendations;

[0419] This multi-dimensional abnormal scoring and early warning mechanism can help regulators quickly locate high-risk entities and understand the specific characteristics and transmission path of abnormal behavior, so as to take targeted regulatory measures. For example, for the case of enterprise A, the regulatory department may immediately start an on-site inspection and implement joint regulation on its associated enterprises, effectively preventing the spread and evolution of risks.

[0420] In addition, as Figure 6 shown, the application also provides an abnormal behavior identification system 600 based on multi-dimensional data analysis, which can specifically include:

[0421] A data preprocessing module 601 is configured to obtain structured data and unstructured data through a business system interface, perform data cleaning and standardization processing on the structured data and the unstructured data, and obtain a data set in a unified format.

[0422] A text processing module 602 is configured to receive a document text in the data set in the unified format, process the document text by using a natural language processing technology, extract entity information, relationship information and behavior information, and generate a structured feature vector.

[0423] A feature engineering module 603 is configured to construct behavior statistical features, time sequence features and association features by using the structured data in the data set in the unified format and the structured feature vector, select a feature combination by using a sampling algorithm based on a generalized Golub-Kahan method, and construct a multi-dimensional feature set.

[0424] A network construction module 604 is configured to establish an entity relationship graph according to association data in the multi-dimensional feature set, calculate an association strength between entities by using a low-rank tensor and a p-AAA algorithm, optimize the entity relationship graph based on the association strength, and establish a network structure model.

[0425] A score calculation module 605 is configured to set a feature weight system according to the network structure model and the multi-dimensional feature set, calculate a multi-dimensional abnormal score by using a pruning tensor structure measurement method, comprehensively calculate the multi-dimensional abnormal score by using a low-rank tensor recovery technology, obtain an abnormal score, and output an early warning list according to the abnormal score.

[0426] The system of the embodiments of the present disclosure can execute the method provided by the embodiments of the present disclosure, the implementation principles of which are similar. The actions performed by each module in the device of the embodiments of the present disclosure are corresponding to the steps in the method of the embodiments of the present disclosure. The detailed function description of each module of the device can be referred to the description of the corresponding method in the foregoing description, and will not be repeated here.

[0427] Finally, it should be noted that the above-described embodiments are merely specific embodiments of the present disclosure, used to illustrate the technical solutions of the present disclosure, and are not intended to limit the present disclosure. The protection scope of the present disclosure is not limited thereto. Although the present disclosure has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can make modifications or easy changes to the technical solutions described in the foregoing embodiments, or easily think of changes or equivalent replacements for some of the technical features; and these modifications, changes or replacements do not cause the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present disclosure, and should be covered within the protection scope of the present disclosure. Therefore, the protection scope of the present disclosure should be subject to the protection scope of the claims.

Claims

1. An abnormal behavior identification method based on multidimensional data analysis, characterized in that, include: Structured and unstructured data are obtained through business system interfaces. The structured and unstructured data are then cleaned and standardized to obtain a dataset in a unified format. Receive document-type texts from the dataset in the unified format, process the document-type texts using natural language processing technology, extract entity information, relational information and behavioral information, and generate structured feature vectors; Using the structured data in the unified format dataset and the structured feature vectors, behavioral statistical features, temporal features, and correlation features are constructed. A sampling algorithm based on the generalized Golub-Kahan method is used to select feature combinations and construct a multidimensional feature set. Based on the associated data in the multidimensional feature set, an entity relationship graph is established. The association strength between entities is calculated using a low-rank tensor and p-AAA algorithm. The entity relationship graph is then optimized based on the association strength to establish a network structure model. The calculation of the association strength between entities using a low-rank tensor and p-AAA algorithm includes: Using the associated data in the multidimensional feature set, a multidimensional association tensor is constructed. Tucker decomposition is used to reduce the tensor dimension and obtain the main feature information. The Tucker decomposition is used to decompose the original tensor into a core tensor and the product of multiple factor matrices. Based on the aforementioned key feature information, a rational function approximation is constructed using the p-AAA algorithm, and the approximation accuracy is iteratively optimized to obtain the association strength between entities, including: Based on the low-dimensional features obtained from Tucker decomposition, rational functions are constructed to approximate the relationships between entities. The p-AAA algorithm is used to construct a representation of the strength of associations between entities, including: Adaptively select interpolation points; construct the Loewner matrix and calculate the SVD decomposition of the Loewner matrix; solve the linear equation system and update the rational function coefficients; calculate the approximation error and determine whether the convergence condition is met; when numerical instability is found, automatically adjust the regularization parameter or reselect the interpolation points to finally obtain the association strength estimate between each pair of entities. The optimization of the entity relationship graph based on the association strength includes: Based on the association strength, an association strength threshold is set, edges below the association strength threshold are deleted, and an optimized entity relationship graph is constructed. Using the optimized entity relationship graph, nodes with similarity exceeding a preset threshold are identified and merged, the association relationships are updated, and a network structure model is formed. Based on the network structure model and the multidimensional feature set, a feature weight system is set, and a multidimensional anomaly score is calculated using the pruned tensor structure measurement method. The low-rank tensor recovery technique is used to comprehensively calculate the multidimensional anomaly score to obtain an anomaly score, and an early warning list is output based on the anomaly score. The method of constructing associated features using structured data in the unified format dataset and the structured feature vectors includes: Based on the structured data and structured feature vectors in the unified format dataset, the frequency and intensity of direct interactions between entities are statistically analyzed, and a weighted correlation coefficient is calculated to obtain the direct correlation degree. Based on the direct correlation, multi-hop relationship paths are constructed, path importance weights are calculated, and correlation features are formed.

2. The method according to claim 1, characterized in that, The structured and unstructured data are cleaned and standardized to obtain a dataset in a unified format, including: For the structured data and the unstructured data, statistical methods are used to identify and correct outliers in numerical data, to encode and standardize categorical data, and to unify the format of time data to obtain cleaned data. Based on the cleaned data, the field names, data types, and value ranges are standardized to obtain a dataset with a unified format.

3. The method according to claim 1, characterized in that, The document-type text is processed using natural language processing techniques, including: For the document-type text, a conditional random field model is used for word segmentation to obtain a word sequence; For the term sequence, named entity recognition technology is used to identify key entities and extract relational descriptive words between entities to construct entity-relation pairs; Based on the entity-relation pairs, dependency parsing is used to extract target grammatical components, identify behavior types and behavior features, and output structured feature vectors.

4. The method according to claim 1, characterized in that, The methods for constructing behavioral statistical features using structured data in the unified format dataset and the structured feature vectors include: Based on the structured data and structured feature vectors in the unified format dataset, the frequency and time distribution of behaviors are statistically analyzed, the target statistics of behavior frequency are calculated, and frequency features are formed. Based on the frequency characteristics, a sliding time window is set to calculate the frequency changes at different time scales, thereby obtaining behavioral statistical characteristics.

5. The method according to claim 1, characterized in that, The method of constructing time-series features using structured data in the unified format dataset and the structured feature vectors includes: Based on the structured data and structured feature vectors in the unified format dataset, the periodic patterns of behavior are detected by Fourier transform, the autocorrelation coefficient is calculated, and a periodic index is constructed. For the aforementioned periodic indicators, the moving average method is used to analyze the long-term trend, calculate volatility and amplitude, and output time series characteristics.

6. The method according to claim 1, characterized in that, The step of setting a feature weight system based on the network structure model and the multidimensional feature set includes: Based on the network structure model and the multidimensional feature set, the association density weight value, behavior anomaly weight value and time series anomaly weight value are set to construct the weight configuration; Based on the weight configuration, the weight values ​​of the related party closeness, the behavioral anomaly, and the temporal anomaly are refined to obtain a feature weight system.

7. An abnormal behavior recognition system based on multidimensional data analysis, characterized in that, include: The data preprocessing module is used to obtain structured and unstructured data through the business system interface, and to perform data cleaning and standardization on the structured and unstructured data to obtain a dataset in a unified format. The text processing module is used to receive document-type text from the unified format dataset, process the document-type text using natural language processing technology, extract entity information, relational information and behavioral information, and generate structured feature vectors. The feature engineering module is used to construct behavioral statistical features, time series features, and correlation features using the structured data and structured feature vectors in the unified format dataset, and to select feature combinations using a sampling algorithm based on the generalized Golub-Kahan method to construct a multidimensional feature set. The network construction module is used to establish an entity relationship graph based on the association data in the multidimensional feature set, calculate the association strength between entities using low-rank tensors and the p-AAA algorithm, and optimize the entity relationship graph based on the association strength to establish a network structure model; wherein, calculating the association strength between entities using low-rank tensors and the p-AAA algorithm includes: Using the associated data in the multidimensional feature set, a multidimensional association tensor is constructed. Tucker decomposition is used to reduce the tensor dimension and obtain the main feature information. The Tucker decomposition is used to decompose the original tensor into a core tensor and the product of multiple factor matrices. Based on the aforementioned key feature information, a rational function approximation is constructed using the p-AAA algorithm, and the approximation accuracy is iteratively optimized to obtain the association strength between entities, including: Based on the low-dimensional features obtained from Tucker decomposition, rational functions are constructed to approximate the relationships between entities. The p-AAA algorithm is used to construct a representation of the strength of associations between entities, including: Adaptively select interpolation points; construct the Loewner matrix and calculate the SVD decomposition of the Loewner matrix; solve the linear equation system and update the rational function coefficients; calculate the approximation error and determine whether the convergence condition is met; when numerical instability is found, automatically adjust the regularization parameter or reselect the interpolation points to finally obtain the association strength estimate between each pair of entities. The optimization of the entity relationship graph based on the association strength includes: Based on the association strength, an association strength threshold is set, edges below the association strength threshold are deleted, and an optimized entity relationship graph is constructed. Using the optimized entity relationship graph, nodes with similarity exceeding a preset threshold are identified and merged, the association relationships are updated, and a network structure model is formed. The scoring calculation module is used to set a feature weight system based on the network structure model and the multidimensional feature set, calculate the multidimensional anomaly score using the pruning tensor structure measurement method, perform a comprehensive calculation on the multidimensional anomaly score using the low-rank tensor recovery technique to obtain an anomaly score, and output an early warning list based on the anomaly score. The feature engineering module is used to construct associated features using structured data in the unified format dataset and the structured feature vectors, including: Based on the structured data and structured feature vectors in the unified format dataset, the frequency and intensity of direct interactions between entities are statistically analyzed, and a weighted correlation coefficient is calculated to obtain the direct correlation degree. Based on the direct correlation, multi-hop relationship paths are constructed, path importance weights are calculated, and correlation features are formed.

Images