An advertisement click flow analysis and anomaly identification system and method

Abstract

The application discloses an advertisement click flow analysis and abnormality identification system and method, relates to the technical field of Internet advertisements, and comprises the following steps: acquiring daily advertisement click data in a preset time period in real time; comparing the daily advertisement click data in the preset time period with the daily advertisement click data in the same time period in historical data; and marking the advertisement click data whose fluctuation amplitude exceeds a preset threshold as abnormal data based on the comparison result, wherein the abnormal data comprises determined abnormal data and to-be-determined abnormal data, the determined abnormal data meets all abnormal feature judgment criteria, and the to-be-determined abnormal data only meets part of the abnormal feature judgment criteria. The application can quickly find abnormal click fluctuation by collecting data in real time and comparing the data with historical data, strictly distinguishes between determined abnormal data and to-be-determined abnormal data, and mines co-occurrence feature combinations by means of correlation analysis, which is beneficial to avoiding misjudgment and missing judgment and significantly improves the accuracy of abnormality identification.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of Internet advertising, and specifically relates to an advertising click traffic analysis and abnormality identification system and method. BACKGROUND

[0002] In today's digital marketing field, click advertising occupies a pivotal position and is an indispensable key interaction link in the entire marketing ecosystem. When users encounter various types of advertising materials, whether they are colorful, creative picture advertisements, concise and clear text link advertisements, or vivid and infectious video advertisements, each active click behind them contains complex psychological and behavioral logic and carries huge commercial value and market significance.

[0003] In essence, click advertising is actually a quantitative embodiment of the degree of precise matching between user interest and advertising content. When an advertisement can accurately grasp the user's needs, preferences, and potential purchase intention and present them in a just-right way, the user is more likely to be attracted and thus produce a click behavior. This click behavior is like a signal that conveys to the advertisement provider that the advertisement has successfully attracted the attention of the target audience to some extent, builds a bridge for subsequent conversion and sales, and injects momentum into the continuous advancement of marketing activities.

[0004] However, in actual application scenarios, this marketing model that should be based on real user interest and positive interaction is facing the serious challenge of click fraud. Some unscrupulous individuals or unscrupulous businesses, in order to seek improper interests, use various technical means such as writing malicious scripts, using robots to simulate user clicks, and organizing professional click fraud teams to create a large amount of false click data. This artificially manipulated behavior seriously distorts the actual performance and market feedback of the advertisement.

[0005] On the one hand, false click volume can cause a false propaganda effect, making advertisers mistakenly believe that their advertising strategies have achieved significant results and that the advertising materials are extremely attractive and popular in the market. Based on this false perception, advertisers may further increase their advertising budget and expand their advertising scale, while in reality these investments do not actually reach real users who have actual needs and purchase potential, resulting in a huge waste of resources.

[0006] On the other hand, for the advertiser, each click behind may be associated with a certain cost expenditure. Whether it is a pay-per-click (CPC) advertising mode or other click-related billing methods, click fraud behavior will directly cause the advertiser's advertising budget to be consumed without reason. A large number of false clicks make the real effective clicks be submerged in the ocean of data, greatly reducing the input-output ratio of advertising, eroding the marketing effectiveness of enterprises, and bringing heavy economic losses and market competition pressure to advertisers.

[0007] More seriously, click fraud behavior will also disrupt the order and ecology of the entire digital marketing market. It destroys the advertising placement mechanism based on real data and fair competition in the market, making those advertisers who really care about advertising quality and user experience at a disadvantage, while the bad guys may gain unfair benefits through false means. If this unhealthy phenomenon cannot be effectively contained, it will seriously affect the credibility and sustainable development of the digital marketing industry, hinder the innovation and progress of the entire industry.

[0008] Therefore, how to accurately determine whether the advertising click volume is abnormal, and effectively avoid the problem of misjudgment in the identification process. SUMMARY

[0009] The purpose of the present application is to provide an advertising click traffic analysis and abnormality identification system and method, which solves the technical problem that the prior art cannot accurately determine whether the advertising click volume is abnormal, and effectively avoids the problem of misjudgment in the identification process.

[0010] An advertising click traffic analysis and abnormality identification method, comprising:

[0011] S1, real-time acquisition of daily advertising click volume data in a preset time period;

[0012] S2, comparison of daily advertising click volume data in the current preset time period with daily advertising click volume data in the same time period in the historical data;

[0013] S3, based on the comparison result, marking the advertising click data volume with a fluctuation amplitude exceeding a preset threshold as abnormal data, the abnormal data including determined abnormal data and pending abnormal data, wherein the determined abnormal data meets all abnormal feature judgment criteria, and the pending abnormal data only meets part of the abnormal feature judgment criteria;

[0014] S4, correlation analysis of the determined abnormal data and the pending abnormal data, extraction of a feature combination co-occurring in both, and analysis of the pending abnormal data according to the co-occurring feature combination to determine whether the pending data is determined abnormal data;

[0015] S5, comprehensively determining the final determination result of the abnormal click of the advertisement according to the determined abnormal data.

[0016] As a further scheme of the present application, the abnormal feature determination criterion comprises at least one of high-frequency click, false device ID and abnormal click period.

[0017] As a further scheme of the present application, the S4 step specifically comprises:

[0018] extracting at least two features in the determined abnormal data to form a feature combination;

[0019] obtaining the to-be-determined abnormal data and extracting features of the to-be-determined abnormal data;

[0020] matching the features of the to-be-determined abnormal data with the feature combination of the determined abnormal data, if the features of the to-be-determined abnormal data contain all features in the feature combination of the determined abnormal data, determining that the to-be-determined abnormal data is associated with the determined abnormal data, and determining the to-be-determined abnormal data as abnormal data; if the features of the to-be-determined abnormal data contain only part of the features in the feature combination of the determined abnormal data, further judging the matching of the features of the to-be-determined abnormal data with other feature combinations of other determined abnormal data until the association determination is completed.

[0021] As a further scheme of the present application, the features comprise at least two of click time, click device identification, click IP address and click frequency.

[0022] As a further scheme of the present application, it further comprises:

[0023] obtaining the determined abnormal data, performing feature co-occurrence analysis on the determined abnormal data, and generating a feature correlation matrix, wherein an element value in the matrix represents the correlation closeness between features;

[0024] obtaining the to-be-determined abnormal data, extracting features thereof and performing weighted matching with the feature correlation matrix;

[0025] calculating a weighted matching score of the features of the to-be-determined abnormal data with the feature combination of the determined abnormal data, if the score reaches a preset matching threshold, determining that the to-be-determined abnormal data is associated with the determined abnormal data, and determining the to-be-determined abnormal data as abnormal data;

[0026] if the score does not reach the threshold, generating an abnormal suspect list based on feature missing conditions, for subsequent manual review or automatic completion verification.

[0027] As a further scheme of the present application, the calculation of the weighted matching score comprises:

[0028] Determine the corresponding weight of each feature of the to-be-determined abnormal data in the feature correlation matrix;

[0029] According to the feature matching condition and the corresponding weight, the matching score of each feature is calculated;

[0030] The matching scores of all features are accumulated to obtain a weighted matching total score.

[0031] As a further scheme of the application, it further comprises:

[0032] The time series pattern mining is performed on the click time series in the determined abnormal data to generate a time series abnormal pattern library;

[0033] The user behavior portrait is constructed based on the user historical click behavior data, and the normal behavior pattern features are extracted;

[0034] The to-be-determined abnormal data is obtained, and it is judged whether the click time series matches any pattern in the time series abnormal pattern library, and meanwhile, the features of the to-be-determined abnormal data are compared with the normal pattern features of the user behavior portrait to identify the feature items deviating from the normal pattern; if the to-be-determined abnormal data meets any of the following conditions: the click time series matches the time series abnormal pattern; the number of feature items deviating from the normal pattern reaches a preset threshold; there is a specific key feature deviating from the normal pattern, it is determined that the to-be-determined abnormal data is abnormal data; otherwise, the unmatched features and the deviation analysis result are used as optimization feedback data for updating the time series abnormal pattern library and the user behavior portrait.

[0035] As a further scheme of the application, it further comprises:

[0036] The cross-domain data of the advertisement delivery platform is integrated, including but not limited to advertisement material types, delivery channel data, and user conversion behavior data;

[0037] The cross-domain correlation graph is constructed based on a graph neural network, and the potential correlation path between the to-be-determined abnormal data and the cross-domain data is analyzed;

[0038] If it is found that the to-be-determined abnormal data and the known abnormal pattern have a cross-domain correlation path overlap, or the correlation path causes an abnormal interruption of the advertisement conversion link, it is determined to be abnormal data;

[0039] Otherwise, the cross-domain correlation analysis result is included in the optimization feedback data for updating the correlation weight and the abnormal path rule of the cross-domain correlation graph.

[0040] As a further scheme of the application, the construction of the cross-domain correlation graph comprises:

[0041] The advertisement click data, material data, and channel data are entity extracted;

[0042] The relationship between entities is mined by association rules, and a dynamic weight is given to the relationship edge;

[0043] The graph embedding technology is used to convert the graph into a feature vector for fast retrieval of abnormal association paths.

[0044] In another aspect, the application also provides an advertisement click traffic analysis and anomaly identification system, which is suitable for the above-mentioned advertisement click traffic analysis and anomaly identification method, and the method comprises the following steps:

[0045] The data acquisition module acquires daily advertisement click volume data in a preset time period in real time.

[0046] The data comparison module compares the daily advertisement click volume data in the current preset time period with the daily advertisement click volume data in the same time period in the historical data.

[0047] The judgment module marks the advertisement click data volume with a fluctuation amplitude exceeding a preset threshold as abnormal data based on the comparison result, and the abnormal data includes determined abnormal data and pending abnormal data, wherein the determined abnormal data meets all abnormal feature judgment criteria, and the pending abnormal data only meets part of the abnormal feature judgment criteria.

[0048] The correlation analysis module performs correlation analysis on the determined abnormal data and the pending abnormal data, extracts a feature combination co-occurring in the two, and analyzes the pending abnormal data according to the co-occurring feature combination to determine whether the pending data is determined abnormal data.

[0049] The result output module comprehensively determines the final determination result of the advertisement abnormal click by all determined abnormal data.

[0050] Compared with the prior art, the application has the following advantages:

[0051] The application can quickly find abnormal click volume fluctuations by real-time collection and accurate comparison with historical data, strictly distinguishes between determined and pending abnormal data, and uses correlation analysis to mine co-occurring feature combinations, which helps to avoid misjudgment and omission, significantly improves the accuracy of anomaly identification, and finally outputs the comprehensive determination result, which provides intuitive early warning and optimization suggestions for advertisers, effectively reduces the cost of invalid advertisement placement, helps advertisers to adjust the placement strategy in time, improves the effectiveness of advertisement placement and the return on investment, and helps to ensure the healthy and orderly development of the advertisement placement ecosystem. BRIEF DESCRIPTION OF DRAWINGS

[0052] Figure 1 The figure is a schematic diagram of the method framework structure of the application. DETAILED DESCRIPTION

[0053] The technical solutions of the present application will be described clearly and completely below in connection with the embodiments. Obviously, the described embodiments are only some of the embodiments of the present application, but not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the present application.

[0054] The first aspect is described with reference to Figure 1 The present application provides an advertisement click traffic analysis and anomaly identification method, comprising:

[0055] S1, real-time acquisition of daily advertisement click volume data in a preset time period;

[0056] S2, comparison of daily advertisement click volume data in the current preset time period with daily advertisement click volume data in the same time period in the historical data;

[0057] S3, based on the comparison result, marking the advertisement click data volume with a fluctuation amplitude exceeding a preset threshold as abnormal data, the abnormal data including determined abnormal data and pending abnormal data, wherein the determined abnormal data meets all abnormal feature judgment criteria, and the pending abnormal data only meets part of the abnormal feature judgment criteria;

[0058] S4, correlation analysis of the determined abnormal data and the pending abnormal data, extraction of feature combinations co-occurring in both, analysis of the pending abnormal data according to the co-occurring feature combinations, and determination of whether the pending data is determined abnormal data;

[0059] S5, comprehensive analysis of all determined abnormal data to obtain the final determination result of the advertisement abnormal click.

[0060] As an optional embodiment, the abnormal feature judgment criteria include at least one of high-frequency click, fake device ID, and abnormal click time period.

[0061] It should be understood that the data interface is connected with the advertisement delivery platform and the traffic statistics tool (such as Google Analytics and Baidu Statistics) to pull the advertisement click data at a minute level frequency (such as every 10 minutes). For example, a certain e-commerce platform delivers a commodity advertisement in Douyin, and the system can real-time acquire the number of times that a user clicks the advertisement to jump to the commodity detail page, the click timestamp, the user IP address, and other information.

[0062] Among them, the collected data is stored in a time series database (such as InfluxDB), and indexes are established according to the date, advertisement position ID, advertisement material type, etc. For example, the daily advertisement click data during the National Day promotion period from October 1, 2024 to January 7, 2024 is stored according to different commodity advertisements, which facilitates subsequent quick retrieval of historical data in the same time period.

[0063] Among them, the historical same period data is automatically matched according to the current date, such as the current date is June 2025, the daily advertisement click volume of June 2024 and June 2023 is automatically retrieved. At the same time, considering the change of advertisement launching strategy, only the historical data with the same launching channel and advertisement material as the comparison benchmark is selected.

[0064] Among them, the difference is calculated by percentage fluctuation formula, specifically: It is obtained.

[0065] Further, the abnormal data meets the following conditions at the same time (taking e-commerce advertisements as an example): the fluctuation amplitude exceeds 45%; the click time is concentrated in the early morning 0-6 (non-active period); the same IP address is clicked more than 10 times in a short time (such as 10 minutes); only 1-2 of the above conditions are met, such as the fluctuation amplitude reaches 50%, but the click time distribution is normal, which is a to-be-determined abnormal data;

[0066] Further, the preset threshold value can be dynamically adjusted according to the type of advertisement, for example, new product promotion advertisement: the threshold value is set to 35% (because the initial traffic fluctuation is large), mature brand advertisement: the threshold value is set to 20% (the traffic is relatively stable), and manual fine-tuning of the threshold value according to the historical data is also supported.

[0067] Further, more than 10 features are extracted from the click data, including: time features: click period, click interval; user features: IP address, device type, regional distribution; behavior features: whether to generate purchase after clicking, stay time.

[0068] Through the association rule mining algorithm (such as Apriori algorithm), the high-frequency co-occurrence feature combination in the determined abnormal data is found out. For example, it is found that 80% of the determined abnormal data has the combination feature of “early morning click + same IP multiple clicks + no purchase behavior”; the above feature combination is applied to the to-be-determined data: if a to-be-determined data contains more than 80% of the co-occurrence features, it is determined as a determined abnormal data. For example, a to-be-determined data has a fluctuation amplitude of 60% and meets the “early morning click + same IP multiple clicks” feature, which is determined as an abnormal data;

[0069] For the evaluation of the degree of abnormality, the number and distribution range of the determined abnormal data are calculated Wherein, the weight coefficient is adjusted according to the advertising budget, the higher the budget, the greater the coefficient; the final determination result is presented in the form of a visual report, including the proportion of abnormal data, the main abnormal features, the affected advertising positions and other information. At the same time, the system automatically sends warning emails to advertisers and suggests adjusting the advertising strategy (such as suspending abnormal advertising positions and replacing traffic channels). For example, if the abnormal index of an advertisement reaches 30%, the system suggests temporarily closing the advertisement in a low-quality channel.

[0070] In summary, by real-time collection and accurate comparison with historical data, abnormal fluctuations in click volume can be quickly discovered, and confirmed and pending abnormal data can be strictly distinguished. By using correlation analysis to mine co-occurrence feature combinations, false positives and false negatives can be avoided, and the accuracy of abnormal identification can be significantly improved. The final comprehensive determination output provides intuitive warnings and optimization suggestions for advertisers, which can effectively reduce the cost of invalid advertising, help advertisers adjust their advertising strategies in a timely manner, improve the effectiveness of advertising and the return on investment, and help ensure the healthy and orderly development of the advertising ecosystem.

[0071] As an optional embodiment, the S4 step is specifically:

[0072] Extracting at least two features in the confirmed abnormal data to form a feature combination;

[0073] Obtaining the pending abnormal data and extracting the features of the pending abnormal data;

[0074] Matching the features of the pending abnormal data with the feature combinations of the confirmed abnormal data. If the features of the pending abnormal data contain all the features in the feature combinations of the confirmed abnormal data, it is determined that the pending abnormal data is associated with the confirmed abnormal data, and the pending abnormal data is determined as abnormal data. If the features of the pending abnormal data only contain part of the features in the feature combinations of the confirmed abnormal data, further judgment is made on the matching of the features of the pending abnormal data with other feature combinations of other confirmed abnormal data until the association judgment is completed.

[0075] As an optional embodiment, the features include at least two of click time, click device identifier, click IP address, and click frequency.

[0076] Specifically, the click time period distribution (such as high-frequency clicks from 0-6 am), click time interval (such as repeated clicks within every 10 minutes), the number of clicks from the same IP address, click depth (only browsing the home page without entering the detail page), and stay time (less than 10 seconds) are obtained. The advertising channel in the abnormal set (such as a low-quality alliance website), and the device type distribution (only low-end Android devices are clicked).

[0077] Among them, the combination optimization algorithm is used to automatically generate feature combinations, 2-3 features are randomly selected from the above feature library to generate a basic combination, for example, "morning click + same IP click more than 10 times + no commodity purchase behavior", the frequency of each combination in determining abnormal data is calculated, and the combination with a frequency lower than 30% is removed, and the high-frequency co-occurrence combination is reserved as the core judgment basis.

[0078] Further, after determining the abnormal data, a special extraction step is started, and the corresponding features are parsed from the original click log through regular expressions and data mapping rules. For example, the click time (morning), IP address and other features are extracted from the log "2025-06-1503:12:00, IP:192.168.1.10, click advertisement A, no jump"; the extracted features are uniformly converted, such as mapping the regional information to the provincial administrative region code, to ensure the accuracy of subsequent matching.

[0079] Further, the features of the to-be-determined abnormal data are compared with the feature combinations of the determined abnormal data one by one, if the to-be-determined data completely contains all the features of a certain feature combination (such as simultaneously satisfying "morning click + same IP multiple clicks + no purchase behavior"), it is immediately determined as abnormal data, and the associated determined abnormal data number is marked, if it only contains part of the features (such as only satisfying "morning click + no purchase behavior"), it enters the recursive matching link;

[0080] Further, for the partially matched to-be-determined data, the following operations are performed, the feature combinations of other determined abnormal data are traversed, and matching attempts are continued. For example, if the to-be-determined data that fails to match the first time contains the "morning click" feature, it is preferred to match other combinations containing this feature, when 80% of the features (the threshold can be configured) in the feature combination are matched, it is determined as abnormal data; if all combinations are traversed and still not up to standard, it is marked as normal data.

[0081] It should be understood that through the systematic feature extraction and matching mechanism, the precision and reliability of the advertisement abnormal click detection can be significantly improved: on the one hand, through multi-dimensional feature combination extraction, the deep pattern of abnormal clicks can be captured, which is helpful to avoid misjudgment or omission caused by single feature judgment; on the other hand, the recursive matching logic performs deep mining on the data that partially meets the features, does not miss any potential abnormality, and effectively reduces the misjudgment risk of ambiguous data. At the same time, this step is closely linked with the previous and subsequent steps, automatically optimizes the judgment strategy, forms a detection closed loop, which is helpful to help the advertiser accurately identify invalid clicks, adjust the delivery strategy in time, and reduce the waste of advertising budget.

[0082] As an optional embodiment, it also includes:

[0083] obtaining the determined abnormal data, performing feature co-occurrence analysis on the determined abnormal data to generate a feature correlation matrix, wherein an element value in the matrix represents a correlation closeness between features;

[0084] obtaining the to-be-determined abnormal data, extracting features thereof, and performing weighted matching with the feature correlation matrix;

[0085] calculating a weighted matching score of a feature combination of the to-be-determined abnormal data and the determined abnormal data, and if the score reaches a preset matching threshold, determining that the to-be-determined abnormal data is associated with the determined abnormal data, and determining the to-be-determined abnormal data as abnormal data;

[0086] If the score does not reach the threshold, an abnormal suspect list is generated based on a feature missing condition, for subsequent manual review or automatic completion verification.

[0087] As an optional embodiment, the calculation of the weighted matching score includes:

[0088] determining a corresponding weight of each feature of the to-be-determined abnormal data in the feature correlation matrix;

[0089] calculating a matching score of each feature according to the feature matching condition and the corresponding weight;

[0090] accumulating the matching scores of all features to obtain a weighted matching total score.

[0091] Specifically, by performing full-quantity feature scanning on the determined abnormal data output in the S3 step, the frequency of simultaneous occurrence of any two features in the data set is counted. For example, in 100 pieces of determined abnormal data, “early morning click” and “same IP click more than 10 times” occur simultaneously 85 times, and the co-occurrence frequency is 85;

[0092] wherein the Pearson correlation coefficient is used to calculate the correlation closeness between features, and the formula is wherein x and y are binary variables of feature occurrence (1 for occurrence and 0 for non-occurrence). The element value of the matrix ranges from -1 to 1, and the greater the absolute value, the closer the correlation. For example, the correlation coefficient of “early morning click” and “no purchase behavior” is 0.78, indicating strong positive correlation, and r xy represents the Pearson correlation coefficient between feature x and feature y, that is, the finally calculated correlation closeness value, x i and y i where i represents the i-th sample in the data set, and are the average values of features x and y in all samples, which is the numerator of the formula, and calculates the covariance of features x and y, reflecting whether the change trends of the two features are consistent,

[0093] denotes the denominator of the formula, which plays a role of normalization, ensuring that the value of the correlation coefficient r xy is between [-1, 1], is the variance of the feature x, which measures the degree of dispersion of the feature x value relative to its average value, is the variance of the feature y. The denominator eliminates the influence of the fluctuation amplitude of the feature itself on the correlation degree calculation by taking the square root of the product of the variances of the two features, so that the correlation coefficients between different features are comparable.

[0094] Further, the generated correlation matrix is displayed in the form of a heat map, and is also stored as structured data (such as JSON format) for subsequent quick query. The correlation pairs in the matrix with a value higher than 0.5 are marked as "strongly correlated feature combinations" and are taken as the key matching objects.

[0095] The features to be determined in the abnormal data to be determined (such as click time, IP address, device type, etc.) are extracted, and non-numeric features are converted into one-hot encoding, for example, "click in the early morning" is converted into [1, 0], and "non-morning" is converted into [0, 1].

[0096] Further, for each feature of the data to be determined, the correlation matrix is queried to obtain the correlation weight of the feature with other features. For example, if the data to be determined contains the "click in the early morning" feature, the correlation weight of the feature with "no purchase behavior" is 0.78. The weighted sum can be represented by the formula, which is specifically:

[0097] where n is the number of features of the data to be determined, m is the number of features of the abnormal data to be determined, represents the number of target features corresponding to each row in the correlation matrix (i.e. the number of target mode dimensions that a single feature needs to be associated with), the frequency of occurrence of feature i, represents the frequency of the i-th feature in the data (or the absolute number of times), which reflects the activity level of the feature, and the correlation matrix i, j represents the element value of the i-th row and the j-th column in the correlation matrix, which represents the correlation strength of the i-th feature and the j-th target mode (such as "no purchase behavior"). The correlation matrix i, j represents the sum of the correlation degrees of the i-th feature with all m target modes, and the comprehensive correlation strength of the feature is obtained. For example, a certain data to be determined contains 2 features, and the sum of the correlation degrees of the features with the abnormal data to be determined is 0.78 and 0.65 respectively, then the score = 1 x 0.78 + 1 x 0.65 = 1.43.

[0098] If the matching score is greater than or equal to a preset threshold (such as 1.2), it is determined that the data to be determined is associated with the abnormal data to be determined, and is marked as abnormal data;

[0099] If the score is less than the threshold, the system automatically generates an abnormality suspicion list, including missing key features (such as "no purchase behavior") and correlation weights, for example: Suspicion 1: missing "no purchase behavior" feature (correlation 0.78); Suspicion 2: missing "same IP multiple clicks" feature (correlation 0.65).

[0100] In summary, by quantifying feature correlation and dynamically weighting matching, it brings multi-dimensional non-obvious advantages: on the one hand, by constructing a feature correlation matrix, it can accurately capture complex and variable abnormal patterns by mining the hidden feature co-occurrence rules in the data, such as discovering abnormal click correlations in specific time periods, regions, and device type combinations, which are difficult to discover through conventional rules or manual analysis; on the other hand, the weighted matching mechanism combined with dynamic threshold adjustment gives the system adaptive ability, which can automatically learn new abnormal feature combinations, such as quickly identifying unique click behaviors generated by new brushing tools. At the same time, the generation of the abnormal suspicion list not only realizes efficient human-machine collaboration, but more importantly, through continuous feedback optimization, it promotes the evolution of the entire abnormal detection model, forming a self-improving intelligent closed loop, fundamentally improving the intelligent level and long-term effectiveness of advertising abnormal detection.

[0101] As an optional embodiment, it also includes:

[0102] Performing time series pattern mining on the click time series in the determined abnormal data to generate a time series abnormal pattern library;

[0103] Constructing a user behavior portrait based on user historical click behavior data and extracting normal behavior pattern features;

[0104] Obtaining the to-be-determined abnormal data, judging whether its click time series matches any pattern in the time series abnormal pattern library, and comparing the features of the to-be-determined abnormal data with the normal pattern features of the user behavior portrait to identify feature items that deviate from the normal pattern; if the to-be-determined abnormal data meets any of the following conditions: the click time series matches the time series abnormal pattern; the number of feature items deviating from the normal pattern reaches a preset threshold; there is a specific key feature deviating from the normal pattern, then the to-be-determined abnormal data is determined as abnormal data; otherwise, the unmatched features and deviation analysis results are used as optimization feedback data to update the time series abnormal pattern library and the user behavior portrait.

[0105] Specifically, after determining the abnormal data, the click timestamp (accurate to the minute) of each data is extracted and grouped according to dimensions such as ad position ID and ad material type. For example, the click times of the same product ad on different dates are organized into independent time series, after removing outliers (such as click times outside the normal business hours), time normalization is performed to unify the time format;

[0106] The dynamic time warping (DTW) algorithm and the frequent pattern mining algorithm (such as PrefixSpan) are used to extract high-frequency abnormal patterns from the time series, including: the similarity between different time series is calculated by using the DTW algorithm, and similar click time distributions are aggregated into a category. For example, it is found that multiple advertisements have a high-frequency click similar pattern from 2 a.m. to 4 a.m. The PrefixSpan algorithm is used to mine the frequently occurring time subsequence, such as the pattern of concentrated clicks at 10 a.m. for three consecutive days.

[0107] Further, the mined abnormal patterns are sorted according to the confidence and support, and the patterns with a confidence of ≥80% and a support of ≥50% are retained and stored in the time series abnormal pattern library. Each pattern contains time series features (such as start time, interval period, click frequency), associated ad position ID and other information, for example: "from 2 a.m. to 4 a.m., ad position A, click frequency is 10 times that of normal period".

[0108] Further, by integrating the user's historical click behavior data for at least 3 months, including click time, click ad type, browsing time, purchase behavior, device information, and geographic information. For example, a user has clicked on beauty ads from 19 to 21 p.m. for the past 3 months, and 70% of the clicks have resulted in purchase behavior.

[0109] Further, the clustering algorithm (such as K-Means) and the association rule mining algorithm (such as Apriori) are used to extract user behavior features from the data:

[0110] User grouping: users are divided into different groups according to the click period, ad preference and other characteristics, such as "night active users" and "high-frequency purchase users";

[0111] Normal pattern extraction: for each user group, the high-frequency normal behavior pattern is mined. For example, the normal pattern of the "night active user" group is: click on ads from 20 to 24 p.m. at night, average browsing time of 3 minutes, and purchase conversion rate of 15%;

[0112] Further, the extracted normal behavior pattern features are stored as a user behavior portrait feature library, each feature containing group label, time feature, behavior feature, and associated weight information. For example, the "night click period" feature weight of "night active user" is set to 0.8, indicating that this feature has high reference value in judging whether the user behavior is normal;

[0113] Further, the DTW algorithm is used to calculate the similarity of the to-be-determined data time sequence and each mode in the mode library, and if the similarity is greater than or equal to 0.7, it is determined that the matching is successful. For example, a certain to-be-determined data has concentrated clicks at 3-5 am, and the similarity with the “morning abnormal click mode” in the mode library reaches 0.8, triggering the abnormality determination;

[0114] The features (such as click time, advertisement type, and purchase behavior) of the to-be-determined data are compared with the normal mode in the user behavior portrait feature library, and the feature deviation is calculated.

[0115] For each feature, the difference value is calculated, such as the deviation of the actual click time from the normal time period, and the difference of the purchase conversion rate from the group average

[0116] When the feature deviation exceeds the preset threshold (such as the click time deviation exceeds 2 hours, and the purchase conversion rate is less than 50% of the average), it is marked as a feature item deviating from the normal mode.

[0117] When the abnormal data satisfies any of the following conditions, it is determined to be abnormal data: the click time sequence matches any mode in the time sequence abnormal mode library; the number of feature items deviating from the normal mode reaches a preset threshold (such as 3 or more); there is a specific key feature deviating from the normal mode (such as a high purchase conversion rate user suddenly clicking 10 times in a row without purchase behavior).

[0118] If the above conditions are not met, the unmatched time sequence features, deviated behavior features, and analysis results are used as optimization feedback data to automatically update the time sequence abnormal mode library and the user behavior portrait feature library, for example, to include newly discovered edge abnormal modes into the mode library, or to adjust the normal behavior feature threshold of the user group.

[0119] Through the above steps, the limitations of traditional anomaly detection relying only on data fluctuations and feature correlations are broken through, and from the time sequence rule and user behavior mode level, it is helpful to realize the deep mining and accurate identification of abnormal data. Through time sequence mode mining, hidden abnormal behaviors such as periodic timing brushing and regular click interval can be captured, which are difficult to detect by isolated click data; based on the user historical behavior portrait and the analysis of deviated features, abnormal clicks disguised as normal user behavior can be identified, such as low-frequency abnormal clicks of a high-activity user suddenly appearing. In addition, the dynamic updating mechanism driven by optimization feedback data enables the system to have self-evolution ability, which can automatically adapt to changes in advertisement delivery scenarios, is beneficial to predict new abnormal modes, improves the accuracy of anomaly recognition, and helps to provide forward-looking reference for advertisement delivery strategy optimization, creating value far beyond traditional detection methods.

[0120] As an optional embodiment, it further includes:

[0121] Integrate cross-domain data of the advertising delivery platform, including but not limited to advertising material types, delivery channel data, and user conversion behavior data;

[0122] Construct a cross-domain association graph based on a graph neural network, and analyze potential association paths between the to-be-determined abnormal data and the cross-domain data;

[0123] If it is found that the to-be-determined abnormal data and the known abnormal patterns have overlapping cross-domain association paths, or the association paths cause abnormal interruption of the advertising conversion link, the to-be-determined abnormal data is determined to be abnormal;

[0124] Otherwise, the cross-domain association analysis result is included in the optimization feedback data for updating the association weights and abnormal path rules of the cross-domain association graph.

[0125] As an optional embodiment, the construction of the cross-domain association graph includes:

[0126] Extract entities from advertising click data, material data, and channel data;

[0127] Mine the relationships between entities through association rules and assign dynamic weights to the relationship edges;

[0128] Convert the graph into a feature vector using graph embedding technology for fast retrieval of abnormal association paths.

[0129] Specifically, data is connected through API interfaces with advertising delivery platforms (such as Douyin Jubaoyin Engine and Tencent Advertising), user behavior analysis tools (such as Mixpanel), and e-commerce transaction systems (such as Taobao backend), including but not limited to advertising material types, delivery channel data, and user conversion behavior data;

[0130] Among them, multiple imputation methods (such as random forest prediction of missing values) are used for key fields such as advertising exposure.

[0131] Among them, the timestamps of different platforms are converted to UTC standard time, and the regional information is uniformly mapped to the provincial administrative code.

[0132] Among them, sensitive information such as user ID and mobile phone number is processed by hash encryption.

[0133] Among them, the advertising delivery full link is abstracted as a directed attribute graph, the node types are: advertising material nodes (including material ID, type, and script); channel nodes (including channel ID and traffic source); user behavior nodes (click, add to cart, and order behavior records); time nodes (time windows divided by hours / days); edge types: delivery relationship (advertising material → delivery channel); behavior association (user click → add to cart → order); time association (behavior node → time node);

[0134] The association rule is a method for mining hidden association relationships between entities in data. The core is to analyze the co-occurrence mode of data items, for example, in the form of "X→Y", where X and Y are disjoint entity sets (such as goods, behaviors, attributes, etc.), indicating that "when X appears, Y has a certain probability of appearing", and the corresponding database is preset.

[0135] Further, the graph convolution network (GCN) and the graph attention network (GAT) are used to train the model, and the node attributes (such as advertising copy keywords and channel traffic features) are encoded into vector representations. Through the training of historical normal / abnormal data, the association strength between different nodes is learned. For example, if a certain channel is frequently associated with high conversion rate advertising materials, the edge weight between the two is high. The graph structure and weight are updated based on the latest data increment in the early morning every day to adapt to the changes in advertising placement strategies.

[0136] Further, for the to-be-determined abnormal data output by the S3 step, the system uses the Monte Carlo tree search (MCTS) algorithm to find the association path in the graph, taking the advertising ID and user click behavior of the to-be-determined data as the search starting point, and exploring the connection path with other nodes according to the association weight priority principle, such as "click behavior→placement channel→similar advertising materials→conversion link". If the search path has a coincidence degree of more than 70% with the path of the known abnormal mode (such as the combination of a specific channel and low-quality materials leading to false clicks) in the graph, it is determined to be abnormal. When the association path shows that the advertising conversion link has an abnormal breakpoint (such as a large number of clicks without any add-to-cart behavior), and the breakpoint node association weight is higher than the threshold (such as 0.8), it is determined to be abnormal. For example, the click volume of a certain advertisement in the Douyin channel increases sharply, but there is no corresponding traffic import to the Taobao store, which triggers an abnormal alarm.

[0137] Further, if the to-be-determined data is not determined to be abnormal, the cross-domain association analysis result will be used as optimization feedback data to supplement new abnormal path rules, such as including the "high click and low conversion of a certain advertising material in a specific period and a specific channel" mode in the monitoring range.

[0138] It should be noted that the above is an example for explanation, which is convenient for understanding the technical solution and has no special meaning.

[0139] The existing advertisement abnormal click identification is mainly focused on the feature analysis of the click data itself, such as click frequency, device ID, etc., and the scheme breaks through the limitation of traditional abnormal detection by cross-domain data association analysis, mines hidden abnormalities from the whole link of advertisement delivery, and brings multi-dimensional non-obvious value: on the one hand, by integrating cross-domain heterogeneous data such as advertisement materials, delivery channels, user conversion, etc., a dynamic association graph is constructed, which can find deep correlations that isolated data cannot detect, such as accurately identifying the "brushing network" coordinated between different platforms or the hidden abnormal pattern of specific channels combined with low-quality materials; on the other hand, based on the path analysis and weight learning mechanism of graph neural network, the abnormal breakpoints in the advertisement conversion link can be adaptively captured, such as identifying the fault phenomenon of surface high click but no actual conversion caused by false traffic. In addition, by optimizing the feedback-driven graph and dynamically updating the rules, the system has the ability of self-evolution, which is not only beneficial to predict new abnormal patterns, but also can guide the optimization of advertisement delivery strategy, improve the accuracy of abnormal detection, and create double value from risk prevention to business growth, and improve the accuracy of identification.

[0140] In a second aspect, the present application further provides an advertisement click traffic analysis and abnormal identification system, the method comprising the following steps

[0141] A data acquisition module acquires daily advertisement click volume data in a preset time period in real time.

[0142] A data comparison module compares the daily advertisement click volume data in the current preset time period with the daily advertisement click volume data in the same time period in the historical data.

[0143] A judgment module marks the advertisement click data volume with a fluctuation amplitude exceeding a preset threshold as abnormal data based on the comparison result, the abnormal data including determined abnormal data and pending abnormal data, wherein the determined abnormal data meets all abnormal feature judgment criteria, and the pending abnormal data only meets part of the abnormal feature judgment criteria.

[0144] An association analysis module performs association analysis on the determined abnormal data and the pending abnormal data, extracts the co-occurring feature combinations of the two, and analyzes the pending abnormal data according to the co-occurring feature combinations to determine whether the pending data is determined abnormal data.

[0145] A result output module synthesizes all the determined abnormal data to obtain the final determination result of the advertisement abnormal click.

[0146] The above is only a specific embodiment of the present application, but the protection scope of the present application is not limited thereto, any person skilled in the art can easily think of changes or replacements within the technical scope disclosed in the present application, which should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A method for analyzing and identifying anomalies in advertising click traffic, characterized in that, include: S1. Real-time acquisition of daily ad click data within a preset time period; S2. Compare the daily ad click data within the current preset time period with the daily ad click data for the same time period in the historical data. S3. Based on the comparison results, the amount of ad click data with fluctuations exceeding a preset threshold is marked as abnormal data. The abnormal data includes confirmed abnormal data and pending abnormal data. Among them, data that meets all the abnormal feature judgment criteria is confirmed abnormal data, and data that only meets some of the abnormal feature judgment criteria is pending abnormal data. S4. Perform correlation analysis on the determined abnormal data and the abnormal data to be determined, extract the feature combinations of the two co-occurrence, analyze the abnormal data to be determined based on the co-occurrence feature combinations, and determine whether the data to be determined is determined abnormal data. S5. Based on all confirmed abnormal data, the final judgment result of abnormal ad clicks is obtained; The S4 step is specifically as follows: Extract at least two features from the identified abnormal data to form a feature combination; Obtain the abnormal data to be identified and extract its features; The features of the data to be identified as anomalous are matched with the feature combination of the data to be identified as anomalous. If the features of the data to be identified as anomalous contain all the features in the feature combination of the data to be identified as anomalous, then the data to be identified as anomalous is determined to be associated with the data to be identified as anomalous, and the data to be identified as anomalous is determined to be anomalous. If the features of the abnormal data to be determined only contain some of the features in the feature combination of the abnormal data to be determined, then the matching of the features of the abnormal data to be determined with other feature combinations of the abnormal data to be determined is further judged until the association judgment is completed.

2. The method for analyzing and identifying anomalies in advertising click traffic according to claim 1, characterized in that, The criteria for judging abnormal features include at least one of the following: high-frequency clicks, fake device IDs, and abnormal click periods.

3. The method for analyzing and identifying anomalies in advertising click traffic according to claim 1, characterized in that, The features include at least two of the following: click time, click device identifier, click IP address, and click frequency.

4. The method for analyzing and identifying anomalies in advertising click traffic according to claim 3, characterized in that, Also includes: Obtain identified abnormal data, perform feature co-occurrence analysis on the identified abnormal data, and generate a feature correlation matrix, wherein the element values ​​in the matrix represent the degree of correlation between features; Obtain the abnormal data to be identified, extract its features, and perform a weighted matching with the feature correlation matrix; Calculate the weighted matching score of the combination of features of the data to be identified as anomalous and features of the data to be identified as anomalous. If the score reaches the preset matching threshold, it is determined that the data to be identified as anomalous is associated with the data to be identified as anomalous, and the data to be identified as anomalous is determined as anomalous. If the score does not reach the threshold, an abnormal list of suspicious points will be generated based on the missing features, which will be used for subsequent manual review or automatic completion verification.

5. The method for analyzing and identifying anomalies in advertising click traffic according to claim 4, characterized in that: The calculation of the weighted matching score includes: Determine the weight of each feature in the feature correlation matrix for the anomaly data to be identified; Calculate the matching score for each feature based on the feature matching results and corresponding weights; The weighted matching score is obtained by summing the matching scores of all features.

6. The method for analyzing and identifying anomalies in advertising click traffic according to claim 5, characterized in that, Also includes: Perform time series pattern mining on click time series in identified abnormal data to generate a time series abnormal pattern library; Build user behavior profiles based on users' historical click behavior data and extract features of normal behavior patterns; Obtain the abnormal data to be determined, determine whether its click time series matches any pattern in the time series abnormal pattern library, and at the same time, compare the features of the abnormal data to be determined with the normal pattern features of the user behavior profile to identify feature items that deviate from the normal pattern; the abnormal data to be determined meets any of the following conditions: the click time series matches the time series abnormal pattern; the number of feature items that deviate from the normal pattern reaches a preset threshold. If specific key features deviate from the normal pattern, the data to be identified is determined to be abnormal data. Otherwise, the unmatched features and deviation analysis results will be used as optimization feedback data to update the time series abnormal pattern library and user behavior profile.

7. The method for analyzing and identifying anomalies in advertising click traffic according to claim 6, characterized in that, Also includes: Integrate cross-domain data from advertising platforms, including but not limited to ad creative types, advertising channel data, and user conversion behavior data; A cross-domain association graph is constructed based on a graph neural network to analyze the potential association paths between the anomaly data to be identified and the cross-domain data. If the data to be identified is found to have a cross-domain association path that overlaps with a known abnormal pattern, or if the association path causes an abnormal interruption in the advertising conversion link, then it is determined to be abnormal data. Otherwise, the results of cross-domain association analysis will be incorporated into the optimization feedback data to update the association weights and abnormal path rules of the cross-domain association graph.

8. The method for analyzing and identifying anomalies in advertising click traffic according to claim 7, characterized in that, The construction of the cross-domain association graph includes: Extract entities from ad click data, creative data, and channel data; Relationships between entities are discovered through association rules, and dynamic weights are assigned to the edges of these relationships. Graph embedding techniques are used to convert graphs into feature vectors for fast retrieval of anomalous related paths.

9. A system for analyzing and identifying anomalies in advertising click traffic, applicable to the method for analyzing and identifying anomalies in advertising click traffic as described in any one of claims 1 to 8, characterized in that, The system includes: The data acquisition module acquires daily ad click data in real time within a preset time period; The data comparison module compares the daily ad click data within the current preset time period with the daily ad click data for the same time period in historical data. The judgment module marks the amount of ad click data with fluctuations exceeding a preset threshold as abnormal data based on the comparison results. The abnormal data includes confirmed abnormal data and pending abnormal data. Among them, data that meets all the abnormal feature judgment criteria is confirmed abnormal data, and data that only meets some of the abnormal feature judgment criteria is pending abnormal data. The association analysis module performs association analysis on the confirmed abnormal data and the abnormal data to be determined, extracts the co-occurring feature combinations of the two, analyzes the abnormal data to be determined based on the co-occurring feature combinations, and determines whether the data to be determined is confirmed abnormal data. The results output module integrates all identified abnormal data to arrive at the final judgment result of abnormal ad clicks.

Images