User advertisement putting management system based on big data analysis

Abstract

The invention relates to the technical field of advertisement management, in particular to a user advertisement putting management system based on big data analysis, which comprises a data aggregation association module for calculating an association link strength value based on user behavior equipment IP record, structuring an advertisement exposure log and associating user equipment IP identification data in the log, and calculating a user advertisement putting management result based on the association link strength value; and constructing a node connection edge to represent the IP interaction relationship of the user equipment, and establishing a user advertisement interaction map. According to the method, through structured processing based on user behavior device IP records and advertisement exposure log data, association link strength values of interaction relations between user devices are mined, node connection edges are constructed to form a user advertisement interaction map, and the user advertisement interaction map is obtained by means of node connection density and path centrality analysis. And the difference of the group aggregation degree is accurately measured, and the more targeted group aggregation deviation degree is obtained, so that the network structure risk group with the release risk is more accurately determined.

Description

Technical Field

[0001] The present invention relates to the technical field of advertising management, and in particular to a user advertising delivery and management system for big data analysis. Background Art

[0002] The field of advertising management technology mainly covers the technical means for the whole process management of advertising planning, implementation, monitoring and optimization, involving key links such as user data analysis, delivery strategy formulation, effect monitoring and evaluation, and real-time regulation. This field is based on user characteristics, behavioral preferences and interaction records to accurately portray user portraits and potential needs, supporting advertising delivery platforms to achieve highly matched content distribution, thereby improving the accuracy of advertising delivery.

[0003] Existing technologies typically focus on macro-level analysis of user group characteristics and advertising effectiveness, neglecting the analysis of fine-grained interactions between user devices. Analysis of ad exposure logs and user interaction data remains limited to basic statistical and classification operations, lacking in-depth exploration of inter-user interactions and group structure risks. This makes it difficult to effectively identify potential ad risk groups hidden within group structures. Regarding user status quantification, existing technologies primarily rely on simple statistics of exposure frequency and click counts, failing to deeply explore differences in user behavior patterns across different scenarios and timescales, resulting in inaccurate user profiles. Therefore, improvements are needed. Summary of the Invention

[0004] The purpose of the present invention is to solve the shortcomings of the prior art and to propose a user advertising delivery management system based on big data analysis.

[0005] In order to achieve the above-mentioned purpose, the present invention adopts the following technical solution: A user advertising delivery management system for big data analysis includes:

[0006] The data aggregation and association module, based on user behavior device IP records, structures the ad exposure log and associates the user device IP identification data in the log, calculates the association bond strength value, and based on the association bond strength value, constructs node connection edges to represent the user device IP interaction relationship and establishes a user-ad interaction map;

[0007] A group relationship mining module calculates the node connection density and path centrality based on the user-advertising interaction graph to measure group aggregation differences, obtains group convergence deviation, and based on the group convergence deviation, screens the node sets whose group convergence deviation exceeds the threshold to determine the network structure risk group;

[0008] The user status quantification module calculates the uniqueness of the pattern based on the ad click and exposure interval, generates a behavioral time series imprint value, and then calculates the comprehensive status based on the behavioral time series imprint value and the weighted exposure amount to obtain the user's comprehensive status score;

[0009] The delivery strategy control module calculates the intervention order based on the network structure risk group and the user comprehensive status score, integrates the group risk individual status assessment, and obtains the delivery intervention priority.

[0010] Preferably, the steps for obtaining the strength value of the association bond are:

[0011] Based on the user behavior device IP record, extract the device IP identifier, exposure behavior timestamp, exposure source page label, exposure duration, and exposure trigger action type contained in each ad exposure log to obtain the device behavior five-tuple log structure;

[0012] Based on the device behavior five-tuple log structure, matching device behaviors with behavior timestamps within the same hour window and the same exposure source page label but different device IP identifiers is performed to form a set of high-frequency interaction device pairs;

[0013] Based on the set of high-frequency interaction device pairs, the strength value of the association bond between each pair of devices is calculated using the following formula:

[0014]

[0015] Among them, Q ij is the strength of the tie between device i and device j, t ik , t jk are the timestamps of device i and j’s exposure behavior at the kth time, d ik d jk are the duration of the kth exposure behavior of device i and j, respectively, CH ik 、CH jk are the click heat of the page corresponding to the kth exposure behavior of device i and j, AD i , AD j are the daily active frequencies of devices i and j in the last month, and m is the number of effective overlapping exposures of the device in the last month.

[0016] Preferably, the steps for obtaining the user advertising interaction graph are:

[0017] According to the association bond strength value, the median of the association bond strength value is used as the association bond strength value threshold, and conditional screening is performed based on the association bond strength value threshold to extract device IP interaction records with association bond strength values greater than the association bond strength value threshold to form a valid interaction device IP record set;

[0018] Based on the set of valid interactive device IP records, the starting device IP and ending device IP of each device IP interaction record are extracted, device IP deduplication is performed, and each deduplicated device IP is defined as an independent node. Then, based on the corresponding association link strength value of each record, the edge weights of the connecting edges between the nodes are defined to establish a user advertising interaction graph.

[0019] Preferably, the steps for obtaining the group convergence deviation are:

[0020] Based on the user advertising interaction graph, extract the number of all connection edges corresponding to each user device IP node, the total number of connection edges of the other end device IP node corresponding to each connection edge, the number of path hops between the user device IP node and all other user device IP nodes, the number of stable node connections, and the range of historical path hops, to generate a user device IP node structure attribute set;

[0021] According to the user equipment IP node structure attribute set, the group convergence deviation is calculated using the following formula:

[0022]

[0023] Among them, R u is the group aggregation deviation of the u-th user equipment IP node, k u is the number of connected edges of the u-th user device IP node, SC u is the historical stable connection times of the u-th user device IP node, z u is the number of reachable paths to the u-th user equipment IP node, p uh is the number of hops from the u-th user equipment IP node to the h-th node, AC u is the average number of connected edges between the u-th user device IP node and the adjacent device IP nodes, b u is the maximum path hop difference of the u-th user equipment IP node in the last month.

[0024] Preferably, the steps for obtaining the network structure risk group are:

[0025] According to the group convergence deviation, the upper quartile of the overall distribution of the group convergence deviation is determined by ascending sorting, which is defined as the group convergence deviation threshold, and user device IP nodes whose group convergence deviation is greater than the group convergence deviation threshold are screened to generate a deviation exceeding threshold node set;

[0026] Based on the set of nodes with deviation exceeding the threshold, the node identification information of each user device IP node is extracted one by one, and the user advertising interaction graph is called to match the information of the neighboring user device IP nodes directly connected to each user device IP node to form a network structure risk group.

[0027] Preferably, the steps for obtaining the behavior timing imprint value are:

[0028] Based on the ad click and browsing sequence and exposure interval, the ad click time series, exposure interval duration, page click count, exposure dwell time, trigger click page number, and exposure jump sequence position of each user device within the complete session cycle are extracted to generate a six-dimensional combination sequence set of user ad click behavior;

[0029] Based on the six-dimensional combination sequence set of user ad click behavior, each click event is numbered and identified by time order, and the exposure interval, page dwell time, number of clicks, jump sequence, page number change frequency, and page click time difference of each record are extracted to generate a user standardized behavior time series input vector set;

[0030] Based on the user standardized behavior time series input vector set, the behavior time series imprint value of the user device at the time behavior level is calculated using the following formula:

[0031]

[0032] Among them, BI is the behavior time series imprint value, λ c DT is the exposure interval before the cth click. c is the duration of the c-th click on the page, φ c is the number of clicks on the corresponding page for the cth click, PCF c is the frequency of page number changes before the cth click occurs, ∈ c is the difference in page jump order between the cth click and the previous click, and r is the total number of ad clicks and views.

[0033] Preferably, the steps for obtaining the user's comprehensive status score are:

[0034] Extract the corresponding behavior time series imprint value, ad exposure number, page click number, exposure dwell time, exposure to click time difference, exposure page switching frequency and ad click-effective ratio from the continuous behavior record sequence of each user device to generate a user advertising behavior time series indicator combination set;

[0035] Based on the user advertising behavior time series indicator combination set, the user comprehensive status score is calculated.

[0036] Preferably, the steps for obtaining the intervention priority are:

[0037] Based on the network structure risk group and the user comprehensive status score, extract the number of node connections, historical node connection duration, average user comprehensive status score within the group, number of devices in the group to which the device belongs, and historical number of interventions within the group for all user devices in each network structure risk group to generate a group risk intervention assessment parameter set;

[0038] According to the group risk intervention assessment parameter set, the network structure position of the user device is matched with the corresponding group identification information one by one, and a device-group mapping table is formed to generate a user device group status combination matrix;

[0039] Based on the user device group state combination matrix, the delivery intervention priority of each user device is calculated.

[0040] Compared with the prior art, the advantages and positive effects of the present invention are:

[0041] In the present invention, through structured processing based on user behavior device IP records and advertising exposure log data, the correlation bond strength value of the interaction relationship between user devices is mined, and node connection edges are constructed to form a user advertising interaction map. With the help of node connection density and path centrality analysis, the differences in group aggregation degrees are accurately measured, and a more targeted group convergence deviation is obtained, thereby more accurately determining the network structure risk group with delivery risks. At the same time, through the analysis of advertising click browsing timing and exposure interval, the behavioral time series imprint value of the user pattern uniqueness is obtained, and the user status characteristics are comprehensively quantified in combination with weighted exposure, generating a comprehensive status score that can reflect the user's true status. On this basis, the group risk assessment and individual status difference results are integrated to scientifically calculate the user advertising delivery intervention order and form a delivery intervention priority. This makes the advertising delivery process more in line with the actual needs of users, improves the level of accurate advertising delivery, reduces resource waste, enhances the allocation efficiency of advertising resources, and brings higher user response rates and marketing conversion effects. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 It is a system flow chart of the present invention. DETAILED DESCRIPTION

[0043] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0044] See also Figure 1 The present invention provides a technical solution: a user advertising delivery management system for big data analysis includes:

[0045] The data aggregation and association module, based on user behavior device IP records, structures ad exposure logs and associates the user device IP identification data in the logs, calculates the strength of the association bond, and based on the strength of the association bond, constructs node connection edges to represent the user device IP interaction relationship and establishes a user-ad interaction graph;

[0046] The group relationship mining module calculates the node connection density and path centrality based on the user-advertising interaction graph to measure the difference in group aggregation, and obtains the group convergence deviation. Based on the group convergence deviation, it screens the node sets with group convergence deviation exceeding the threshold and determines the network structure risk group;

[0047] The user status quantification module calculates the uniqueness of the pattern based on the ad click and exposure interval, generates a behavioral time series imprint value, and then calculates the comprehensive status based on the behavioral time series imprint value and the weighted exposure amount to obtain the user's comprehensive status score;

[0048] The delivery strategy control module is based on the network structure risk group and the user's comprehensive status score, integrates the group risk individual status assessment to calculate the intervention order, and obtains the delivery intervention priority.

[0049] The steps to obtain the strength value of the association bond are:

[0050] Based on the user behavior device IP record, extract the device IP identifier, exposure behavior timestamp, exposure source page label, exposure duration, and exposure trigger action type contained in each ad exposure log to obtain the device behavior five-tuple log structure;

[0051] Based on the five-tuple log structure of device behavior, we match device behaviors with behavior timestamps within the same hour window and the same exposure source page label but different device IP identifiers to form a set of high-frequency interaction device pairs;

[0052] Based on the set of high-frequency interaction device pairs, the strength of the association bond between each pair of devices is calculated using the following formula:

[0053]

[0054] Among them, Q ij is the strength of the tie between device i and device j, t ik , t jk are the timestamps of device i and j’s exposure behavior at the kth time, d ik d jk are the duration of the kth exposure behavior of device i and j, respectively, CH ik 、CH jk are the click heat of the page corresponding to the kth exposure behavior of device i and j, AD i , AD jare the daily active frequencies of devices i and j in the last month, and m is the number of effective overlapping exposures of the device in the last month.

[0055] Specifically, when collecting user behavior device IP information, it will parse the advertising exposure data registered in the internal system, read the corresponding time series content one by one and retrieve the information of each field, and achieve preliminary data classification by matching records containing elements such as device IP identification and exposure timestamp. Then, it will split each advertising exposure log in a predetermined order and identify the exposure source page label and exposure trigger action type, and include them in the subsequent processing scope together with the exposure duration. In the case that some data have repeated tags or missing fields, it will retrieve the data records one by one and merge the duplicate records into a single entry. Statistical completion processing is implemented for the records containing the missing fields, and the five fields that have been parsed are combined into a single structure for storage and serialized management with timestamps. This ensures that the corresponding exposure behavior can be quickly locked based on the IP identifier in the subsequent analysis phase. Then, all exposure records of the same device IP are sorted and arranged through vertical retrieval, and the page labels and action types and other information contained are associated in chronological order. Finally, a data combination of five fields including device IP identifier, exposure behavior timestamp, exposure source page label, exposure duration and exposure trigger action type is obtained, forming a complete device behavior five-tuple log structure.

[0056] After the five-tuple log structure is prepared, the exposure timestamp contained in each piece of data is read and compared with the same batch of records. The same hour window is determined based on the 60-minute duration threshold. All records with timestamps within the same hour range are grouped together. The field information of the exposure source page label in these records is then retrieved and entries with the same page label are selected. Records with different IP identifiers are compared and filtered in chronological order. After identifying multiple records with inconsistent IP addresses but the same page label, they are paired. During this period, the timestamp data is uniformly converted to minutes and the page label fields are checked one-to-one. Any pairings that do not meet the window limit or have inconsistent labels are eliminated. The result is record pairs with the same exposure source page label and different device IP identifiers within the same hour range. The valid record pairs are then collected and aggregated, and their corresponding IP identifiers and matched timestamp sequences are saved according to a unified indexing rule to form a set of high-frequency interaction device pairs.

[0057] formula: The benefit of this formula lies in that, through comprehensive processing of the logarithmic difference of the exposure behavior timestamp ratio, the interaction term of the exposure duration, and the frequency of page click heat and active days, it can simultaneously consider whether there is continuous exposure between devices at similar time points and on similar page dimensions, and evaluate the impact of page click heat on the correlation relationship between advertising exposure, thereby quantitatively measuring the strength of the mutual correlation between user devices, laying the foundation for the subsequent identification of device pairs with high-frequency interaction relationships.

[0058] t ik and t jk The steps for obtaining the parameters are as follows: these two parameters represent the timestamps of device i and device j at the kth exposure behavior, respectively. These timestamps are obtained by recording each exposure operation at a fixed point in the advertising delivery environment. Each row of advertising exposure data contains timestamp information accurate to the second, which is obtained by reading the log file and converting the time field into an integer number of seconds. For example, when the system records that the first exposure of device i occurred at 09:05:15 on a certain day, it will be converted into 09 hours × 3600 + 5 minutes × 60 + 15 seconds = 32715 seconds and output externally.

[0059] d ik and d jk The steps for obtaining the parameters are as follows: these two parameters represent the exposure duration of device i and device j during the kth exposure behavior, respectively. The value acquisition process is to collect and store the time difference between the exposure start event and the exposure end event. If the timestamp difference between the exposure end event and the exposure start event is 5 seconds, the duration is counted as 5. The specific value comes from the pairing check of each exposure start and end log. Any invalid or incomplete exposure duration records will be eliminated. The following is an example. In a certain statistics, the exposure duration d of device i in the first exposure is obtained. i1 =5, device j’s first exposure duration d i1 =7, and in the second exposure behavior, they are d i2 =6,d j2 =5.

[0060] CH ik and CH jk The steps to obtain the parameters are as follows: these two parameters represent the click heat of the page corresponding to the kth exposure behavior of device i and device j respectively. Click heat is quantified by counting the total number of clicks generated on the target page within a certain period of time. The specific calculation method is to accumulate all click behaviors on the page on that day, and after obtaining the total number of page clicks, divide it by the average daily visits to the ad space to which the page belongs to form a ratio and add a magnification coefficient. The corresponding formula can be written as Among them ɑ hThe amplification factor for page clicks is determined by combining the daily visit scale segmentation. The average click rate of pages within different visit ranges is calculated by accumulating 30 days of statistical data. Based on this, the segmentation threshold is defined and the corresponding amplification factor is determined. In this example, the amplification factor α for a high-visit page can be selected. h =1.2, if the total number of page clicks detected on a certain day is 1000 and the average daily visits are 800, then we can get In the same way, CH can be obtained jk The numerical value of .

[0061] AD i and AD j The steps to obtain the parameters are as follows: These two parameters represent the frequency of active days of device i and device j in the last month. The acquisition step first counts the number of active days of each device within 30 days, and uses whether the device has at least one ad exposure record in any natural day as the judgment basis, and then uses quantized in the form of, and AD can be obtained by the same logic j In this example, if device i has at least one ad exposure on 21 of the past 30 days, then If device j has been active for 18 days in the past 30 days, then

[0062] The steps for obtaining the m parameter are as follows: This parameter represents the number of times that two devices can be considered as valid overlapping exposures in the past month, that is, the number of times the ad exposures of device i and device j are within the same hour window and the exposure source page label is the same. These overlapping exposure records are retrieved and compared by retrieving their respective exposure timestamps and page labels. Any record that meets the same conditions within the same hour range and the same page is considered a valid overlapping exposure. The final m value is obtained by accumulating all the conditions that meet the conditions in the past month.

[0063] Calculation process:

[0064] The first step is to calculate the molecular part:

[0065]

[0066] In this example, m=2, and when k=1, The sum of the two is 0.087+5.916=6.003. For k=2, Adding the two together gives 0.024 + 5.477 = 5.501. Combining the two results gives the numerator sum of 6.003 + 5.501 = 11.504.

[0067] The second step is to calculate the denominator:

[0068]

[0069] here After taking the square root, we get Add |0.7-0.6|=0.1, and the denominator is 19.105+0.1=19.205;

[0070] The third step is to get:

[0071]

[0072] The results show that the correlation strength value calculated by the above indicators for the example device pair in the selected two overlapping exposure scenes is about 0.599. When the value is between 0 and 1, it can be considered that there is a certain degree of correlation, but it is not extremely close. If the value shows a further increase, it means that the synchronous exposure of the two devices is more prominent. ij The value is compared horizontally with the intensity values of other device pairs to confirm its relative position in the overall device set.

[0073] The steps to obtain the user advertising interaction graph are as follows:

[0074] According to the association bond strength value, the median of the association bond strength value is used as the association bond strength value threshold, and conditional screening is performed based on the association bond strength value threshold to extract device IP interaction records with association bond strength values greater than the association bond strength value threshold to form a valid interaction device IP record set;

[0075] Based on the set of valid interactive device IP records, the starting device IP and ending device IP of each device IP interaction record are extracted, device IP deduplication is performed, and each deduplicated device IP is defined as an independent node. Then, based on the corresponding association link strength value of each record, the edge weight of the connecting edge between nodes is defined to establish a user advertising interaction graph.

[0076] Specifically, according to the association bond strength value, the median of the association bond strength value is used as the association bond strength value threshold. First, all the collected association bond strength values are arranged in ascending order and the value is taken at the center of the entire data sequence. After the value is taken, the value is named the median threshold. This value is recorded in a statistical way and applied to the screening and judgment process. Subsequently, the association bond strength values are compared in turn, and a list of records exceeding the threshold is made. For data sequences of different sizes, they can be segmented according to their length and the median threshold is calculated in batches. In this process, the benchmark value is used to evenly divide the large-scale sequence, and the local median is re-merged in combination with the overall value distribution. The median is calculated repeatedly after each merger until the target threshold is accurately obtained. In order to ensure the rationality of the threshold, the association bond strength values collected in the early stage can be used as the median threshold. The link strength value is marked in a percentage range and it is confirmed that the threshold is in the mainstream interval of multiple measurements. For example, for a scenario containing 10,000 records, if preliminary statistics show that the intersection points of the first 5,000 and the last 5,000 records fall between 0.52 and 0.57, the precise value can be further located in this interval. For example, 0.55 is used as the benchmark value and recalculated. Finally, this value is fixed as the threshold, and then all records are judged. When the association link strength value corresponding to a record is greater than 0.55, the record is output to the qualified list, otherwise it is excluded and not retained. After this link, a group of qualified records can be obtained, and the record integrity and time series correspondence can be rechecked in subsequent links. In this way, all device IP interaction records that meet the requirements can be stored without omission to form a valid interaction device IP record set.

[0077] Based on the effective interactive device IP record set, read each device IP interaction record in the set and identify the corresponding starting device IP and ending device IP. These fields are directly called after the data structure is identified in the previous process, and are matched and read one by one in combination with the established search index. Then, deduplication is performed on repeated IP strings. In order to locate repeated IPs, character comparison is used to check each item one by one, and each IP that appears is compared with the recorded list line by line. When a complete match is found, the duplicate storage is cancelled and only the first loaded record is retained. Subsequently, the deduplication IP list is numbered and marked, and It is managed as an independent node, and the concept of edge weight is introduced for the strength value in the IP record of the same valid interactive device. The strength value of the associated link obtained by the previous screening is assigned, so as to establish a corresponding directed or undirected connection between each pair of starting IP and ending IP. A one-way identifier is used when the direction of the connection is consistent with the specific data requirements. For scenarios that require two-way references, an undirected connection structure is adopted. All the above nodes and their edge weights are constructed into a unified mapping system to ensure that the corresponding connection relationship can be directly found according to the node ID or IP in the future, and finally a user advertising interaction map is established.

[0078] The steps to obtain the group convergence deviation are:

[0079] Based on the user-advertising interaction graph, the number of all connected edges corresponding to each user device IP node, the total number of connected edges corresponding to the other end device IP node of each connection edge, the number of path hops between the user device IP node and all other user device IP nodes, the number of stable node connections, and the range of historical path hops are extracted to generate a set of user device IP node structure attributes;

[0080] According to the set of user device IP node structure attributes, the group convergence deviation is calculated using the following formula:

[0081]

[0082] Among them, R u is the group aggregation deviation of the u-th user equipment IP node, k u is the number of connected edges of the u-th user device IP node, SC u is the historical stable connection times of the u-th user device IP node, z u is the number of reachable paths to the u-th user equipment IP node, p uh is the number of hops from the u-th user equipment IP node to the h-th node, AC u is the average number of connected edges between the u-th user device IP node and the adjacent device IP nodes, b u is the maximum path hop difference of the u-th user equipment IP node in the last month.

[0083] Specifically, based on the user advertising interaction graph, the connectivity information between each user device IP node and other nodes is read one by one, and the node identifier and connection edge information indicated in the retrieval record are sorted out. Then, the number of each jump is accumulated in the adjacency structure according to the established path hop definition, and the continuous interaction between the nodes is compared based on the relevant records of the number of stable node connections and the range of changes in the historical path hop count. In the process, all possible connection edge records of each node are first disassembled from the constructed connectivity table, and the number of connection edges of each node is marked according to the number of edges actually observed. Subsequently, when collecting the node identifier of the other end node corresponding to each connection edge, the connection edge number value of the other end device IP node is additionally recorded and included in the comparison process. The path traversal is achieved by combining the total number of connections established between a node and each adjacent node with multiple hop count information. All edges involved in each node are listed one by one and jointly checked according to the node identifier index. When a connection is found to maintain an uninterrupted interaction status within a month, it is recorded as a stable connection number. The standard of non-interruption is based on The interaction frequency is once a day or more, and the interaction interval is ensured not to exceed the set high-frequency range. For example, if it is detected that node A and node B have at least one connection behavior every day for 30 consecutive days, the number of stable connections in 30 days is counted as 30, which is recorded in the local statistical table. For the collection of path hop counts, the jump level is gradually confirmed for any reachable path between nodes. If it is found during the query that node A can jump to node D via node C, the hop count from A to D is recorded as 2. After counting all reachable paths, the number of reachable paths corresponding to the node can be obtained. At the same time, the historical hop count change range is taken as the maximum hop count of each reachable path in the past month minus the minimum hop count. For example, if the path from node A to node D has a 3-hop path and a 2-hop path this month, the difference is 1. The same method is performed on all nodes. Finally, the number of connected edges of the node, the total number of connected edges of the adjacent device IP node, the path hop count with other nodes, the number of stable connections of the node, and the historical hop count change range of the path are filled in the attribute record table and recorded to form the user device IP node structure attribute set.

[0084] formula: The benefit of the formula lies in that by performing a combined logarithmic and square operation on the number of node connection edges and the number of historical stable connections in the numerator, subtracting the cumulative inverse of the node path hop count, and combining the combined influence of the average number of connection edges and the maximum path hop difference of adjacent device IP nodes in the denominator, it can refine the measurement of the balance between the degree of aggregation and dispersion of nodes in the entire network, thereby quantitatively analyzing the degree of convergence deviation at the network group level.

[0085] k uThe steps to obtain the parameter are as follows: This parameter represents the number of connected edges of the u-th user device IP node, which is obtained by reading the interconnection relationship records between nodes one by one during the network retrieval process. It is quantified by querying and counting all edges pointing to or being pointed to the node in the node connection table. If node u has 10 valid edges to the outside, it can be recorded as k u =10 and store.

[0086] SC u The steps to obtain the parameter are as follows: This parameter represents the number of times the u-th user device IP node has maintained a stable connection in history. The statistical method is to search whether each node has at least one interaction with other nodes every day within 30 days. By extracting the connection records of the same node pair every day and accumulating all the days that meet the conditions, if it is statistically found that a node and its target node have always interacted within 30 days, 30 is added to the number of stable connections of this node. This process requires calling the node pair's daily interaction records and checking the interaction timestamp and connection attributes. Every time a day is found to meet the stability condition, 1 is added. The final value is SC u In the following example, after reading the interactions between the node and multiple adjacent nodes, it is found that the total result can be stably recorded to be 8 times, so SC is set u =8.

[0087] z u The steps to obtain the parameter are as follows: This parameter represents the number of paths that can be reached from the u-th user device IP node. All paths starting from node u are searched from the complete user advertising interaction graph, and the hop count is determined for each path. As long as there is a connected path that can start from u and eventually point to other nodes, it is counted as one. Then, after confirming the reachability between all nodes, the result is accumulated and defined as z. u .

[0088] p uh The steps for obtaining the parameter are as follows: This parameter represents the number of hops from the u-th user device IP node to the h-th node. It is obtained by searching the connectivity relationship between node u and node h layer by layer in the user advertising interaction graph. 1 is added for each transit node encountered. If node u is directly connected to node h, the hop count is recorded as 1. The hop count is increased by one for each additional transit layer. After counting all the paths, the shortest hop count is regarded as p uh .

[0089] AC uThe steps to obtain the parameter are as follows: This parameter represents the average number of connected edges between the u-th user device IP node and the adjacent device IP nodes. When obtaining it, first determine the set of all adjacent nodes of node u, then retrieve the number of connected edges of each adjacent node and accumulate them, and finally divide the accumulated value by the total number of adjacent nodes to obtain the value of the average number of connected edges. In the example, if node u has 3 adjacent nodes, and the number of connected edges is 7, 8, and 9 respectively, the average value can be calculated as Record the final results to AC u =8.

[0090] b u The steps to obtain the parameter are as follows: This parameter represents the maximum path hop difference of the u-th user device IP node in the past month. First, the path hop count from node u to any other node must be counted daily. Then, the maximum and minimum values of all hop counts for each day are calculated and the difference between the two is calculated. Count the difference values for 30 consecutive days to obtain 30 differences. Finally, the largest of these 30 differences is found and recorded as b. u .

[0091] Calculation process:

[0092] The first step is to substitute the parameter values:

[0093] k u =10,SC u =8,z u =4,p u1 =2,p u2 =3,p u3 =2,p u4 =1,AC u =8,b u =3;

[0094] The second step is to calculate the molecular part:

[0095]

[0096] First calculate ln(10+1)=ln(11)≈2.397, Add the two together and we get 2.397 + 2.828 = 5.225, then square it to get 5.225 2 ≈27.327;

[0097] Then calculate

[0098] The result of the numerator is 27.327-2.333=24.994;

[0099] The third step is to calculate the denominator:

[0100]

[0101] ln(8+1)=ln(9)≈2.197, The denominator is 2.197 + 2 = 4.197.

[0102] The fourth step is to merge and obtain the group convergence deviation:

[0103]

[0104] The results show that the group convergence deviation of the u-th user device IP node is approximately 5.95. When the value is greater than 1, it means that the node shows a certain degree of deviation tendency. If it continues to increase, it indicates that the dispersion of the node in the overall network is gradually increasing. This value provides a reference basis for subsequent identification of abnormal network structure or extreme connectivity patterns.

[0105] The steps to obtain the network structure risk group are:

[0106] According to the group convergence deviation, the upper quartile of the overall distribution of group convergence deviation is determined by ascending sorting, which is defined as the group convergence deviation threshold. The user device IP nodes whose group convergence deviation is greater than the group convergence deviation threshold are then screened to generate a set of nodes with deviation exceeding the threshold.

[0107] Based on the set of nodes with deviation exceeding the threshold, the node identification information of each user device IP node is extracted one by one, and the user advertising interaction map is called to match the information of the neighboring user device IP nodes directly connected to each user device IP node to form a network structure risk group.

[0108] Specifically, according to the group convergence deviation, the deviation values corresponding to all user device IP nodes are sorted in ascending order, and the entry at the 75th position of the overall data sequence after sorting is selected as the upper quartile benchmark value. In order to ensure accuracy, all values in the deviation list need to be sorted in ascending order and an index is marked for each value. Then, the position corresponding to the index is read to determine whether it meets the 75th% statistical proportion. If there are n records in total, the index is positioned in the area where the integer part is 0.75×n. If n is between 100 and 500, it can be directly rounded down or interpolated to evaluate the interval segment. Then, the listed benchmark value is compared with a deviation value at the previous and next positions to identify the final value closest to the quartile and define it as the group convergence. The deviation threshold is aggregated. After the threshold is confirmed, each deviation value is checked one by one to see if it exceeds the threshold. Once it is detected that the deviation value corresponding to a node exceeds the threshold range, the node is marked and recorded according to the internal index. The marked nodes are listed and summarized to obtain a set of nodes belonging to the high deviation range. For nodes that are less than or equal to the threshold, the status quo is maintained. The number of nodes registered in this list is determined by the data distribution. When the high deviation nodes exceed a certain number range, they can be grouped and managed on a large scale. Through the same numerical arrangement and analysis, these nodes are checked again or the associated distribution ranges between them are continued to be compared. Finally, all user device IP nodes that exceed the group aggregation deviation threshold are included in the same record, and a set of nodes with deviation exceeding the threshold is obtained after the execution is completed.

[0109] Based on the set of nodes with deviation exceeding the threshold, the unique identification code of each user device IP node is retrieved from the set one by one. The connection between the node and its neighboring nodes is queried in the user advertising interaction map according to the pre-established relationship mapping method, and whether there is a directly associated user device IP node is matched. During the retrieval process, the record entry of the corresponding node is first parsed and the neighboring node identification information is locked through the index position. Similar parsing operations are performed on each neighboring node, and the number of connected edges, connection direction and connection conditions are retrieved for verification. A complete adjacency list is obtained from the local network structure information. Special cases of multiple connections or self-loop connections are split and then merged for management. , all nodes with direct connections to each other are stored in correspondence with the initial node. When a node has multiple connections with other nodes in the set, only the first recorded connection is retained. All neighboring information of the same node is merged by means of merging statistics. Finally, these neighboring nodes and the initial node are constructed into block-type groups. If the number of nodes in a group is between 3 and 10, they can be regarded as separate network segments and marked. If it exceeds this range, the internal connection distribution between nodes will be searched again to ensure that all node identifiers and direct connection relationships can be fully integrated. Finally, network structure risk groups will be formed based on the aggregation of each node in the set and its neighboring nodes.

[0110] The steps to obtain the behavior timing imprint value are:

[0111] Based on the ad click and browsing sequence and exposure interval, the ad click time series, exposure interval duration, page click count, exposure dwell time, trigger click page number, and exposure jump sequence position of each user device within the complete session cycle are extracted to generate a six-dimensional combination sequence set of user ad click behavior;

[0112] Based on the six-dimensional combination sequence set of user ad click behavior, each click event is numbered and identified by time order. The exposure interval duration, page dwell time, number of clicks, jump sequence, page number change frequency, and page click time difference of each record are extracted to generate a set of user standardized behavior time series input vectors.

[0113] Based on the user's standardized behavior time series input vector set, the behavior time series imprint value of the user device at the time behavior level is calculated. The calculation formula is:

[0114]

[0115] Among them, BI is the behavior time series imprint value, λ c DT is the exposure interval before the cth click. c is the duration of the c-th click on the page, φ c is the number of clicks on the corresponding page for the cth click, PCFc is the frequency of page number changes before the cth click occurs, ∈ c is the difference in page jump order between the cth click and the previous click, and r is the total number of ad clicks and views.

[0116] Specifically, based on the ad click browsing sequence and exposure interval, first extract the complete session cycle information related to each user device from the internal data records, locate all ad click behaviors during the session by traversing the start and end time of the session, and accurately read the time of each click, and put it into a time sequence list, then retrieve the start and end time of each ad exposure of the device in this cycle, calculate the exposure time difference to get the exposure interval length, compare the interval length with the order of occurrence of the click behavior, and mark the situation where the interval between two clicks is too short or too long, then for the factor of page click count, read the click count field that appears in the log for each page, and determine whether it belongs to the click set under the same page by comparing the page identifier and the click trigger time one by one. After statistics, the results are included in the total number of clicks of the device in the session cycle, and then divided Analyze the exposure dwell time, and obtain the value by calculating the exposure end time minus the exposure start time. If any exposure event meets the minimum dwell standard (for example, 3 seconds), it is regarded as a valid duration, and its corresponding page number information is added for recording. Then, the triggering click page number and the exposure jump sequence position are compared in segments. Once it is found that the jump of the page number and the click sequence appear synchronously, they are marked and sorted according to the temporal position of the click event. In this way, the triggering method and jump level of each page can be clarified in subsequent retrieval. The above six elements, including the ad click time series, exposure interval duration, page click number, exposure dwell time, triggering click page number and exposure jump sequence position, are assembled into a unified record entry and written into the same data structure to ensure that each record contains these six types of information, thereby forming a six-dimensional combination sequence set of user ad click behavior.

[0117] According to the six-dimensional combination sequence set of user ad click behavior, the click events of each user device are sorted by time and numbered one by one, so that the order of each click in the entire sequence can be accurately identified. Then, when traversing each record, the exposure interval, page dwell time, number of clicks, jump order, page number change frequency and page click time difference are read. For the exposure interval, the value obtained by the difference between the start and end time of exposure in the previous step is recorded. If the value is within the pre-established valid range (for example, 0 seconds to 600 seconds), it is counted as a valid interval and counted according to the actual sequence. The pages are numbered in a corresponding manner, and the same record is performed on the page stay time. The stay time value is obtained by performing a differential operation on the collected page stay start and leave time. After comparing the number of clicks with the page number, it can be determined whether multiple clicks occur on the same page, and the frequency of page number changes is calculated based on the changes in the previous and next page numbers. The jump order value is compared with the previous record to obtain the page jump order difference. These numbered information eventually constitutes the user standardized behavior time series input vector set and is stored in the data index as a time series input item that can be directly called in subsequent calculations and analysis.

[0118] formula: The benefit of the formula lies in that by multiplying the exposure interval by the length of time spent on the page and taking the logarithm, and then combining the number of clicks with the square root of the frequency of page number changes, it integrates the user's temporal click pattern and page switching rhythm. It can characterize the user's temporal behavior characteristics in a unified value, and use the cumulative term of the jump order difference as a denominator for constraint, thereby measuring the relative differences between different click behaviors.

[0119] λ c The steps to obtain the parameter are as follows: This parameter represents the exposure interval length before the cth click, which is obtained by reading the start and end time difference between two adjacent exposures in the ad exposure log. The specific method is to retrieve the previous exposure event corresponding to the click behavior from the locally stored timestamp record table. If the difference between the end time of the previous exposure event and the start time of this click event is x seconds, then λ c Take the value of x. If the exposure ends at 12:30:10 and the click occurs at 12:31:05, the interval is 55 seconds, corresponding to λ c =55.

[0120] DT c The steps for obtaining the parameter are as follows: This parameter represents the duration of the cth click on the page, which refers to the actual time the user stays on a certain page. The method for obtaining it is to make a difference between the time when the page loading is completed and the time when the user jumps out. If the page loading completion record is 13:05:00 and the next exit record is 13:05:07, the calculated duration is 7 seconds.

[0121] φ c The steps to obtain the parameter are as follows: This parameter represents the number of clicks on the page corresponding to the cth click, which is extracted from the total number of clicks on the page during the statistical period. First, lock the page number clicked, then sum up all click behaviors attributed to this number in the page click record list and store the result. If page number 123 has 15 clicks during the statistical period, and click c is one of these 15 times, then φ c =15.

[0122] PCF c The steps to obtain the parameter are as follows: This parameter represents the frequency of page number changes before the cth click occurs. The acquisition method is to track the continuous click events locally, and increment the count each time the page number changes until the cth click occurs. If the page number changes 3 times between the previous click and the current click, then PCF c =3.

[0123] ∈ c The steps to obtain the parameter are as follows: This parameter represents the page jump order difference between the cth click and the previous click. By analyzing the jump tracks of adjacent click events, if the page number at the end of the previous click is X and the page number at the start of this click is Y, and the jump order interval is recorded as Δ, then directly record ∈ c =Δ

[0124] The steps to obtain the r parameter are as follows: this parameter represents the total number of ad clicks and views, that is, the number of all valid click events of the user within the statistical period. As long as the click behavior is recognized as valid in the system, it will be counted and accumulated until the end of the statistical period to obtain the final r value.

[0125] Calculation process:

[0126] The first step is to obtain the sample values ​​combined with the above parameters:

[0127] r=4, λ1=55, λ2=60, λ3=40, λ4=50, DT1=7, DT2=10, DT3=5, DT4=8,;

[0128] φ1=12, φ2=15, φ3=9, φ4=20, PCF1=2, PCF2=4, PCF3=1, PCF4=3, ∈1=1, ∈2=2, ∈3=1, ∈4=3;

[0129] The second step is to calculate the absolute value term in the numerator:

[0130] Calculate for each c separately:

[0131]

[0132] Here we take the first click as an example:

[0133] 1+λ1·DT1=1+55×7=386, ln(386)≈5.96

[0134]

[0135] A1=|5.96-3.51|=2.45;

[0136] Calculate the remaining three clicks in the same way and sum the four results:

[0137]

[0138] Get a sum value and then perform a square operation;

[0139] The third step is to calculate the denominator:

[0140]

[0141] In the example, the four clicks correspond to ∈ 1, 2, 1, and 3 respectively.

[0142] The fourth step is to combine and get the BI value:

[0143] First The result is recorded as S, and the square operation is performed on S, and the result is divided by the aforementioned denominator 11 to obtain the final BI value;

[0144] The results show that, given factors such as click sequences and exposure, the user's temporal behavior characteristics can be characterized by a specific numerical value. When the BI value is greater than 10, it indicates that there is a significant difference in the temporal characteristics of the user's click time span and page switching behavior within a session cycle. If it is lower than 1, it indicates that the user's exposure and click patterns are relatively concentrated and stable.

[0145] The steps to obtain the user's comprehensive status score are as follows:

[0146] Extract the corresponding behavior time series imprint value, ad exposure number, page click number, exposure dwell time, exposure to click time difference, exposure page switching frequency and ad click-effective ratio from the continuous behavior record sequence of each user device to generate a user advertising behavior time series indicator combination set;

[0147] Based on the combination of time series indicators of user advertising behavior, the user's comprehensive status score is calculated using the following formula:

[0148]

[0149] Among them, US is the user's comprehensive status score, BI d is the behavior time sequence imprint value in the dth user behavior record, α d is the number of ad exposures in the dth record, β d is the number of page clicks in the dth record, ED d The exposure duration in the dth record, ECT d is the time difference from exposure to click in the dth record, μ d is the exposure page switching frequency in the d-th record, and q is the number of behavior records of the user.

[0150] Specifically, the corresponding behavioral time sequence imprint values, ad exposure times, page click times, exposure dwell time, exposure-to-click time difference, exposure page switching frequency, and ad click effectiveness ratio are extracted from the continuous behavioral record sequence of each user device. First, all behavioral entries of each device within the specified monitoring period are searched in the user data record table. These entries are arranged in sequence by reading the corresponding timestamp intervals, and the exposure behaviors and click behaviors therein are checked one by one. Then, the exposure time is accumulated by subtracting the exposure start time from the exposure end time, and the interval between the two exposures is confirmed by comparing the trigger time of the ad click. The ad exposure times are summarized in units of days and split into single-day dimensions. Then, the click records of multiple exposures on the same day are further matched and statistically analyzed. The number of records where the click is successful and not marked as invalid or duplicate is used as the number of page clicks. The time difference from exposure to click is then calculated. For example, the time of click is subtracted from the corresponding exposure time to obtain a difference in seconds or milliseconds. In the subsequent parsing stage, the exposure page switching frequency is counted incrementally by comparing the page numbers one by one. When the page number is different from the previous record, the switching count is increased by 1. Finally, the behavior timing imprint value, ad exposure number, page click number, exposure stay duration, exposure to click time difference, exposure page switching frequency, and ad click effectiveness ratio obtained by the above process are written into the corresponding index positions in sequence, and the complete record entries are merged into a user advertising behavior timing indicator combination set.

[0151] formula: The benefit of the formula is that, by combining the behavioral temporal imprint value with multiple indicators such as the number of ad exposures and page clicks, it can quantify the user's behavioral stability and degree of interaction in the ad browsing scenario from multiple dimensions, and normalize the denominator by the number of records, so that the final comprehensive status score reflects both the overall trend and the differences between individual records.

[0152] BI dThe steps for obtaining the parameter are as follows: the parameter represents the behavior time series imprint value in the dth user behavior record. When obtaining it, it is necessary to first obtain the behavior time series imprint value BI result from the previous step.

[0153] α d The steps to obtain the parameter are as follows: This parameter represents the number of ad exposures in the dth record. It is necessary to extract the number of exposure events that occur in the same behavior record for the same user from the actual log. The specific method is to match the time period from the start to the end of the record, and accumulate the event counts that meet the ad exposure characteristics to α d In the case of daily advertising, a single record may correspond to 1 to dozens of exposures. If 8 exposures are observed in a record, α can be set d =8.

[0154] β d The steps to obtain the parameter are as follows: This parameter represents the number of page clicks in the dth record. When counting, all successful click behaviors that occur within the time covered by the record are counted and accumulated. If several click events are detected within the time range corresponding to the record, β is written. d .

[0155] ED d The steps to obtain the parameter are as follows: This parameter represents the exposure duration in the dth record. The log file collected in the previous step can record the time difference between the start and end of the exposure. If an exposure lasts 20 seconds, the statistical result increases by 20. If the total exposure time in the time period covered by this record is as long as 150 seconds, it can be recorded as ED d =150.

[0156] ECT d The steps for obtaining the parameter are as follows: This parameter represents the time difference between exposure and click in the dth record. It is necessary to lock the start time of the exposure event and the subsequent click event in the log data. If a user is detected to click within 3 seconds after the end of exposure in a record, it is recorded as 3 seconds. If multiple clicks occur, the minimum time difference or the average time difference is usually selected.

[0157] μ d The steps to obtain the parameter are as follows: This parameter represents the exposure page switching frequency in the dth record. The number of page jumps per unit time is measured by counting each page switch and combining it with the total length of the record. If 10 page switches occur within 5 minutes of the record, the frequency can be calculated.

[0158] The steps for obtaining the q parameter are as follows: the parameter represents the number of user behavior records. For example, if it is detected that the user has generated 50 behavior records within a month, then q=50.

[0159] Calculation process:

[0160] The first step is to mark all behavior records as d = 1, 2, ..., q, and read BI for each record separately. d ,α d ,β d ,ED d ,ECT d ,μ d , and stored uniformly in a list format.

[0161] The second step is to calculate the molecular part:

[0162]

[0163] Substitute the parameters corresponding to each record and perform item-by-item calculations.

[0164] The third step is to sum the numerator results and divide them by q to obtain the final US.

[0165] Here is a numerical example:

[0166] Let q = 2, for the first record: BI1 = 3, α1 = 8, β1 = 10, ED1 = 150, ECT1 = 5, μ1 = 3; for the second record: BI2 = 2, ɑ2 = 5, β2 = 4, ED2 = 80, ECT2 = 2, μ2 = 2,

[0167] Calculate the first record first: The last term of the numerator The combined result is (2.28+500)=502.28.

[0168] Calculate the second record again: The latter The combined result is (1.95+143.2)=145.15.

[0169] The sum of the numerators = 502.28 + 145.15 = 647.43, and finally divided by q = 2:

[0170]

[0171] The results show that in the two recorded scenarios shown, the user's comprehensive status score is approximately 323.715. If this value continues to increase in subsequent statistics, it means that the user has a higher total interaction volume and temporal feature changes in exposure and click scenarios. If it is in a lower range, it indicates that their activity or interaction intensity is limited. The steps in the above formula can be used to quantify and compare the user's overall status based on the US value and further use it.

[0172] The steps to obtain the intervention priority are as follows:

[0173] Based on the network structure risk group and user comprehensive status score, the number of node connections, historical node connection duration, average user comprehensive status score within the group, number of devices in the group to which the device belongs, and historical number of interventions within the group are extracted for all user devices in each network structure risk group to generate a group risk intervention assessment parameter set;

[0174] According to the group risk intervention assessment parameter set, the network structure location of the user device is matched with the corresponding group identification information one by one, and a device-group mapping table is formed to generate a user device group status combination matrix;

[0175] Based on the user device group status combination matrix, the intervention priority of each user device is calculated using the following formula:

[0176]

[0177] Among them, P w is the intervention priority of the wth user device, L w is the number of node connections of the w-th user device, D w is the historical connection duration of the nodes in the group to which the wth user device belongs, US w Score the user's comprehensive status of the w-th user device, G g The average user comprehensive status score of the g-th network structure risk group to which it belongs, M g is the number of user devices in the g-th network structure risk group, T g is the historical number of interventions for the g-th network structure risk group.

[0178] Specifically, based on the network structure risk group and the user's comprehensive status score, the number of node connections corresponding to all devices is extracted when reading the group identification record, and the corresponding historical connection data is retrieved one by one to obtain the connection duration of the node in the past monitoring period, and compared with the previously generated user comprehensive status score. At the same time, the number of devices in the group and the historical intervention situation are counted. In the process, each network structure risk group is first partitioned according to the group identifier and the devices belonging to the group are searched one by one in the record. Then, for each device, its node connection records in the monitoring period are summarized and the total number of connections is calculated. This number is compared with the established valid range, such as the node connection number interval of 0 to 100. If the number of connections is at the upper limit of the interval, it will be marked as a high connection state and recorded in the statistical table. At the same time, the historical connection duration of the device is queried in the same data table and quantified into an integer value according to the specific number of days or hours, and compared with the predetermined threshold range, such as 10 hours to 500 hours. If the device connection duration exceeds 500 hours, it will be classified as an abnormal interval and require special attention during subsequent intervention assessment. Combined with the user comprehensive status score corresponding to the device in the group, this score is compared with the average score of other devices in the group for multi-dimensional verification to determine the score position of this device in the entire group, thereby generating data on the average user comprehensive status score in the group. At the same time, the number of devices in the group to which it belongs is recorded so that the size of the group can be distinguished according to the total number of devices. Finally, the number of intervention history in the group is retrieved, and the number of occurrences of the corresponding group identifier is queried in the intervention record details table and accumulated. If the number of interventions is between 0 and 10, it is counted as a normal range. If the number of interventions exceeds 10, it is considered a multiple intervention interval. Combining all these factors, a collection of content such as the number of node connections, the duration of node historical connection, the average user comprehensive status score in the group, the number of devices in the group to which the device belongs, and the number of intervention history in the group is obtained, and finally a group risk intervention assessment parameter set is generated.

[0179] According to the group risk intervention assessment parameter set, the previously constructed network structure location index and group identification information are read one by one, and by comparing these parameters, the group identification number of the user device is matched one by one, and the location of the corresponding device in the network and its intervention assessment parameters within the group are sorted out. The number of node connections and the duration of the node's historical connection are listed for each device. Combined with the average comprehensive status score of all devices in the group and the number of interventions in the group to which the device belongs, a comparison table mapping between devices and groups is formed, and devices with the same group identification are divided into the same area. In the process, multiple table records need to be retrieved, such as indexing the device ID and its corresponding number of node connections in the device information table, and then entering the group information table for verification. Verify whether the group identifier is consistent with the data listed in the evaluation parameter set. For example, when encountering the average user comprehensive status score and device number data in the group, it is necessary to verify how many devices the group contains and confirm whether the score value is within the established range. After the comparison is completed, the device ID and group identifier and the corresponding number of node connections, node historical connection duration, average score and number of interventions are recorded in a device-group mapping table. Then, based on this mapping table, a user device group status combination matrix is constructed. The rows of the matrix usually represent a single device, and the columns represent the indicator information related to the group to which it belongs. If the same device belongs to different risk groups, multiple columns of data need to be appended to the corresponding rows to finally obtain a complete set of device group status combination matrices.

[0180] formula: The benefit of the formula is that by incorporating the number of node connections, the duration of historical node connections, the difference between the device's group and the overall average user comprehensive status score, and the number of historical group interventions into a calculation framework, it can directly quantify the intervention priority of each device in the group environment, and then allocate intervention resources in an orderly manner.

[0181] L w The steps to obtain the parameter are as follows: This parameter represents the number of node connections of the wth user device, which refers to the number of connections between the device and other nodes in the network graph. The total number of edges of the device can be accurately calculated by counting the connectivity table related to the network structure risk group. If a device forms 15 connection edges with 15 different devices, then let L w =15.

[0182] D w The steps for obtaining the parameter are as follows: This parameter represents the duration of the historical connection of the nodes in the group to which the wth user device belongs. The acquisition method is to summarize the connection relationship of the device within the same group and check its traceable period. The duration of the device connection is counted based on the daily or hourly interaction records. The total duration is obtained by calculating and accumulating the timestamps. If the total duration is 180 hours, D w=180.

[0183] US w The steps for obtaining the parameter are as follows: This parameter represents the user comprehensive status score of the wth user device and needs to be obtained according to the calculation formula in the previous link.

[0184] G g The steps for obtaining the parameter are as follows: This parameter represents the average user comprehensive status score of the g-th network structure risk group. It is obtained by summing the comprehensive status scores of all devices in the same group and dividing it by the number of devices. If a group has 10 devices and their comprehensive status scores are different values between 100 and 250, the sum of all the scores is divided by 10 to obtain the result.

[0185] M g The steps for obtaining the parameter are as follows: This parameter represents the number of user devices in the g-th network structure risk group, which is obtained by counting the devices with the same group ID. If there are 30 devices in the entry with group ID g retrieved from the database, then M g =30.

[0186] T g The steps to obtain the parameter are as follows: This parameter represents the number of historical interventions for the g-th network structure risk group. It is necessary to find the intervention actions with the same group ID in the intervention record list and accumulate them. For example, if the same group was intervened 5 times in the past monitoring, then T g =5.

[0187] Calculation process:

[0188] The first step is to select sample values:

[0189] Let the number of connections of the wth device node be L w =15, the duration of the node's historical connection D w =180, user comprehensive status score US w =220, the average user comprehensive status score G of the group g =200, the number of devices in the group M g =10, the number of intervention history T g =3. The above values are obtained from actual monitoring and data statistics, without any virtual setting link.

[0190] The second step is to calculate the molecular part:

[0191]

[0192] Among them, ln(15+1)=ln(16≈2.772, ln(16)+180≈2.772+180=182.772, after square root Again The numerator product is 13.52×201.82≈2731.23, and then square it to get 2731.23 2 ≈7,468,404.71;

[0193] The third step is to calculate the denominator:

[0194] T g +1=3+1=4;

[0195] The fourth step is to comprehensively determine the intervention priority:

[0196]

[0197] The result shows that the intervention priority of this device under the current group environment and comprehensive status score data is approximately 1867101.18. The larger the value, the higher the potential risk or criticality of the device, which has reference significance for the deployment of subsequent intervention strategies. If other devices are given higher priorities in the statistics, it means that they need more timely intervention in terms of network structure and user status. When adjusting the delivery plan, they can be placed in a higher position for processing or monitoring.

Claims

1. A user advertising management system for big data analysis, characterized in that: The system comprises: The data aggregation and association module, based on user behavior device IP records, structures the ad exposure log and associates the user device IP identification data in the log, calculates the association bond strength value, and based on the association bond strength value, constructs node connection edges to represent the user device IP interaction relationship and establishes a user-ad interaction map; A group relationship mining module calculates the node connection density and path centrality based on the user-advertising interaction graph to measure group aggregation differences, obtains group convergence deviation, and based on the group convergence deviation, screens the node sets whose group convergence deviation exceeds the threshold to determine the network structure risk group; The user status quantification module calculates the uniqueness of the pattern based on the ad click and exposure interval, generates a behavioral time series imprint value, and then calculates the comprehensive status based on the behavioral time series imprint value and the weighted exposure amount to obtain the user's comprehensive status score; The delivery strategy control module calculates the intervention order based on the network structure risk group and the user comprehensive status score, integrates the group risk individual status assessment, and obtains the delivery intervention priority.

2. The user advertising delivery management system for big data analysis according to claim 1, characterized in that: The steps for obtaining the association bond strength value are: Based on the user behavior device IP record, extract the device IP identifier, exposure behavior timestamp, exposure source page label, exposure duration, and exposure trigger action type contained in each ad exposure log to obtain the device behavior five-tuple log structure; Based on the device behavior five-tuple log structure, matching device behaviors with behavior timestamps within the same hour window and the same exposure source page label but different device IP identifiers is performed to form a set of high-frequency interaction device pairs; Based on the set of high-frequency interaction device pairs, the strength value of the association bond between each pair of devices is calculated using the following formula: Among them, Q ij is the strength of the tie between device i and device j, t ik , t jk are the timestamps of device i and j’s exposure behavior at the kth time, d ik d jk are the duration of the kth exposure behavior of device i and j, respectively, CH ik 、CH jk are the click heat of the page corresponding to the kth exposure behavior of device i and j, AD i , AD j are the daily active frequencies of devices i and j in the last month, and m is the number of effective overlapping exposures of the device in the last month.

3. The user advertising delivery management system for big data analysis according to claim 1, characterized in that: The steps for obtaining the user advertising interaction graph are as follows: According to the association bond strength value, the median of the association bond strength value is used as the association bond strength value threshold, and conditional screening is performed based on the association bond strength value threshold to extract device IP interaction records with association bond strength values greater than the association bond strength value threshold to form a valid interaction device IP record set; Based on the set of valid interactive device IP records, the starting device IP and ending device IP of each device IP interaction record are extracted, device IP deduplication is performed, and each deduplicated device IP is defined as an independent node. Then, based on the corresponding association link strength value of each record, the edge weights of the connecting edges between the nodes are defined to establish a user advertising interaction graph.

4. The user advertising delivery management system for big data analysis according to claim 1, characterized in that: The steps for obtaining the group convergence deviation are: Based on the user advertising interaction graph, extract the number of all connection edges corresponding to each user device IP node, the total number of connection edges of the other end device IP node corresponding to each connection edge, the number of path hops between the user device IP node and all other user device IP nodes, the number of stable node connections, and the range of historical path hops, to generate a user device IP node structure attribute set; According to the user equipment IP node structure attribute set, the group convergence deviation is calculated using the following formula: Among them, R u is the group aggregation deviation of the u-th user equipment IP node, k u is the number of connected edges of the u-th user device IP node, SC u is the historical stable connection times of the u-th user device IP node, z u is the number of reachable paths to the u-th user equipment IP node, p uh is the number of hops from the u-th user equipment IP node to the h-th node, AC u is the average number of connected edges between the u-th user device IP node and the adjacent device IP nodes, b u is the maximum path hop difference of the u-th user equipment IP node in the last month.

5. The user advertising delivery management system for big data analysis according to claim 1, characterized in that: The steps for obtaining the network structure risk group are: According to the group convergence deviation, the upper quartile of the overall distribution of the group convergence deviation is determined by ascending sorting, which is defined as the group convergence deviation threshold, and user device IP nodes whose group convergence deviation is greater than the group convergence deviation threshold are screened to generate a deviation exceeding threshold node set; Based on the set of nodes with deviation exceeding the threshold, the node identification information of each user device IP node is extracted one by one, and the user advertising interaction graph is called to match the information of the neighboring user device IP nodes directly connected to each user device IP node to form a network structure risk group.

6. The user advertising delivery management system for big data analysis according to claim 1, characterized in that: The steps for obtaining the behavior timing imprint value are: Based on the ad click and browsing sequence and exposure interval, the ad click time series, exposure interval duration, page click count, exposure dwell time, trigger click page number, and exposure jump sequence position of each user device within the complete session cycle are extracted to generate a six-dimensional combination sequence set of user ad click behavior; Based on the six-dimensional combination sequence set of user ad click behavior, each click event is numbered and identified by time order, and the exposure interval, page dwell time, number of clicks, jump sequence, page number change frequency, and page click time difference of each record are extracted to generate a user standardized behavior time series input vector set; Based on the user standardized behavior time series input vector set, the behavior time series imprint value of the user device at the time behavior level is calculated using the following formula: Among them, BI is the behavior time series imprint value, λ c DT is the exposure interval before the cth click. c is the duration of the c-th click on the page, φ c is the number of clicks on the corresponding page for the cth click, PCF c is the frequency of page number changes before the cth click occurs, ∈ c is the difference in page jump order between the cth click and the previous click, and r is the total number of ad clicks and views.

7. The user advertising delivery and management system for big data analysis according to claim 1, characterized in that: The steps for obtaining the user's comprehensive status score are: Extract the corresponding behavior time series imprint value, ad exposure number, page click number, exposure dwell time, exposure to click time difference, exposure page switching frequency and ad click-effective ratio from the continuous behavior record sequence of each user device to generate a user advertising behavior time series indicator combination set; Based on the user advertising behavior time series indicator combination set, the user comprehensive status score is calculated.

8. The user advertising delivery management system for big data analysis according to claim 1, characterized in that: The steps for obtaining the delivery intervention priority are as follows: Based on the network structure risk group and the user comprehensive status score, extract the number of node connections, historical node connection duration, average user comprehensive status score within the group, number of devices in the group to which the device belongs, and historical number of interventions within the group for all user devices in each network structure risk group to generate a group risk intervention assessment parameter set; According to the group risk intervention assessment parameter set, the network structure position of the user device is matched with the corresponding group identification information one by one, and a device-group mapping table is formed to generate a user device group status combination matrix; Based on the user device group state combination matrix, the delivery intervention priority of each user device is calculated.

Images