Multi-modal model spatio-temporal sequence analysis method for bidding full-factor compliance review

Abstract

The application provides a bidding full-element compliance review method for multi-modal model space-time sequence analysis, relates to the technical field of data processing, and comprises the following steps: acquiring space-time sequence data and auxiliary data of a bidding project, constructing a space-time double-flow feature network, constructing a knowledge graph based on output, calculating an abnormal score by using a space-time mode encoder, optimizing an abnormal detection result by using a graph attention network, and dynamically generating a bidding compliance verification path by using deep reinforcement learning. The application can realize comprehensive analysis of bidding data, improve the accuracy of abnormal behavior detection, reduce the cost of manual review, and optimize the efficiency of the verification path.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data processing, in particular to a multi-modal model spatio-temporal sequence analysis method for bidding full-element compliance review. BACKGROUND

[0002] With the continuous development of the bidding market, bidding compliance review as an important link to maintain market fair competition has become increasingly important. Traditional bidding compliance review mainly relies on manual methods, which is time-consuming and inefficient. In recent years, with the development of artificial intelligence and big data analysis technology, bidding compliance review has gradually introduced automated and intelligent technical means. The current bidding review system mainly uses text analysis and rule matching methods to review bidding documents, and finds abnormal bidding behavior through simple time series analysis.

[0003] However, the existing bidding compliance review technology has obvious shortcomings. The existing technology lacks comprehensive analysis capability in time and space dimensions, and cannot effectively capture the spatio-temporal correlation patterns in bidding activities, resulting in limited recognition ability for complex irregular behaviors such as collusion bidding and turn-by-turn bidding. The existing abnormal detection methods mostly use fixed thresholds or simple statistical models, which lack adaptive ability and are difficult to cope with complex and variable abnormal patterns and interference factors in the bidding scene, and are prone to high false positive rates. The existing system usually separates the abnormal detection and compliance verification, lacks a systematic method of combining detection results with specific compliance requirements, and is difficult to form a complete review loop, resulting in a lack of persuasiveness and explainability in the final compliance evaluation results.

[0004] In view of the above problems, there is an urgent need for a multi-modal bidding compliance review method that can comprehensively utilize spatio-temporal sequence data and auxiliary text information, and has adaptive analysis capability, to improve the accuracy of abnormal behavior recognition and the efficiency of compliance review. SUMMARY

[0005] The embodiment of the present application provides a multi-modal model spatio-temporal sequence analysis method for bidding full-element compliance review, which can solve the problems in the prior art.

[0006] In a first aspect, the embodiment of the present application provides a multi-modal model spatio-temporal sequence analysis method for bidding full-element compliance review, comprising:

[0007] Obtaining spatio-temporal sequence data and auxiliary data of a bidding project to be reviewed, the spatio-temporal sequence data including bidding time data and bidding geographic location data, and the auxiliary data including bidding text content;

[0008] constructing a spatio-temporal dual-flow feature network, wherein a time-series feature flow adopts an adaptive time window to dynamically segment a time series and extract a time-series feature representation of an event, and a spatial feature flow adopts density clustering to adaptively partition a geographical location and extract a spatial distribution feature;

[0009] constructing a knowledge graph based on an output of the spatio-temporal dual-flow feature network, the knowledge graph including nodes representing bidding events and geographical locations and edges representing time-series dependency relationships and spatial constraint relationships, and attributes of the edges being supplemented by the auxiliary data;

[0010] based on the knowledge graph, calculating, at a local level, a similarity of node features to a normal pattern library by using a spatio-temporal pattern encoder to obtain an anomaly score, and performing context optimization on the anomaly score by using a graph attention network at a global level to obtain an anomaly detection result;

[0011] based on deep reinforcement learning, modeling anomaly verification as a sequential decision-making process, dynamically generating a bidding and tender compliance verification path based on the anomaly detection result and the auxiliary data, obtaining a compliance evaluation result by optimizing the verification path, and generating an audit report.

[0012] In an optional implementation,

[0013] constructing a spatio-temporal dual-flow feature network, wherein a time-series feature flow adopts an adaptive time window to dynamically segment a time series and extract a time-series feature representation of an event, and a spatial feature flow adopts density clustering to adaptively partition a geographical location and extract a spatial distribution feature, the steps comprising:

[0014] constructing a time-series feature flow, the time-series feature flow identifying a bidding time point by designing a time sensitivity function for the bidding time data, constructing a non-uniform time window sequence based on the time point, determining boundaries of the non-uniform time window by maximizing a difference in bidding behavior patterns between windows, and extracting time-series dependency features of a bidding event in each time window by using an attention-enhanced recurrent network to obtain a hierarchical time-series feature representation;

[0015] constructing a spatial feature flow, the spatial feature flow dynamically dividing a bidding area by using an adaptive spatial partitioning algorithm for the bidding geographical location data, the adaptive spatial partitioning algorithm being optimized by minimizing a bidding behavior entropy in a region and maximizing a difference in bidding behavior between regions, constructing a bidding geographical correlation network based on the spatial partitioning, and extracting a spatial distribution feature;

[0016] performing feature fusion on outputs of the time-series feature flow and the spatial feature flow by using a spatio-temporal collaborative attention mechanism, the spatio-temporal collaborative attention mechanism dynamically calculating an association strength of the hierarchical time-series feature representation and the spatial distribution feature, adaptively adjusting weights of different dimension features, and obtaining a unified spatio-temporal feature representation.

[0017] In an alternative embodiment,

[0018] constructing a knowledge graph based on the output of the spatio-temporal dual-stream feature network, the knowledge graph comprising nodes representing the bidding events and the geographical locations and edges representing the temporal dependency and the spatial constraint relationship, the step of supplementing the attributes of the edges by the auxiliary data comprising:

[0019] obtaining fusion features of the spatio-temporal dual-stream feature network, the fusion features comprising temporal feature representations of the bidding events and spatial distribution features of the geographical locations;

[0020] constructing a node set of the knowledge graph, the node set comprising bidding event nodes, geographical location nodes and bidding subject nodes, the bidding event nodes comprising event identifiers, occurrence times and bidding amount attributes, the geographical location nodes comprising city area division attributes, and the bidding subject nodes comprising subject identifiers, registered capital and establishment time attributes;

[0021] mapping the temporal components and the spatial components of the fusion features to feature spaces of the corresponding nodes by a nonlinear mapping function to obtain node feature vectors;

[0022] constructing an edge set of the knowledge graph, the edge set comprising temporal dependency edges, spatial constraint edges and subject association edges, the weights of the temporal dependency edges being obtained by calculating inner products of adjacent node feature vectors, and the weights of the spatial constraint edges being obtained by calculating distances between the geographical location nodes;

[0023] converting the bidding and tender text content into a text semantic vector, splicing and fusing a weight vector of the edges with the text semantic vector to obtain a complete attribute vector of the edges, optimizing the edge set based on importance scores of the complete attribute vector, and ensuring spatio-temporal consistency of the edge attributes by setting proportion coefficients of the temporal feature weights and the spatial feature weights.

[0024] In an alternative embodiment,

[0025] based on the knowledge graph, calculating similarity of node features with a normal pattern library by a spatio-temporal pattern encoder at a local level to obtain an anomaly score, and performing context optimization on the anomaly score by a graph attention network at a global level to obtain an anomaly detection result, the step comprising:

[0026] obtaining node features and neighborhood information in the knowledge graph, the node features comprising temporal features and spatial features, and the neighborhood information comprising dependency relationships between the nodes;

[0027] encoding the node features and the neighborhood information using a spatio-temporal pattern encoder to obtain a spatio-temporal encoded representation of the node, constructing a normal pattern feature library based on the spatio-temporal encoded representation, the normal pattern feature library containing a plurality of normal pattern center representations; calculating a similarity between the spatio-temporal encoded representation of the node and the normal pattern center representations to obtain a local anomaly score of the node;

[0028] constructing a multi-head graph attention network, calculating attention weights between nodes based on a query matrix, a key matrix and a value matrix, and weighting and aggregating node features according to the attention weights to obtain a context representation of the node;

[0029] fusing the local anomaly score of the node with the context representation of the node to obtain a global anomaly score of the node;

[0030] constructing a temporal smoothing constraint based on a temporal dependency relationship, the temporal smoothing constraint being realized by minimizing a difference between global anomaly scores of temporally related nodes, and performing propagation optimization on the global anomaly scores according to a temporal dependency strength to obtain a final anomaly score of the node; determining a detection threshold according to the final anomaly score and performing anomaly labeling to obtain an anomaly detection result.

[0031] In an optional implementation,

[0032] constructing a temporal smoothing constraint based on a temporal dependency relationship, the temporal smoothing constraint being realized by minimizing a difference between global anomaly scores of temporally related nodes, and performing propagation optimization on the global anomaly scores according to a temporal dependency strength to obtain a final anomaly score of the node; determining a detection threshold according to the final anomaly score and performing anomaly labeling to obtain an anomaly detection result.

[0033] constructing a temporal dependency relationship, calculating a temporal dependency strength of a pair of temporally related nodes using a dynamic graph neural network, the dynamic graph neural network containing a temporal query matrix and a temporal key matrix, transforming a node feature vector through the temporal query matrix and the temporal key matrix, and calculating the temporal dependency strength of the node pair in combination with a time interval decay function;

[0034] constructing a smoothing constraint objective function based on the temporal dependency strength, the smoothing constraint objective function containing a smoothing loss term and a causal loss term, the smoothing loss term being based on the temporal dependency strength to calculate a squared difference between global anomaly scores of related nodes, and the causal loss term being based on an intervention operation to calculate a deviation between a global anomaly score of a node and an expected value thereof;

[0035] designing an anomaly score propagation function, iteratively updating a global anomaly score of a node according to the temporal dependency strength, and taking the smoothing constraint objective function as an optimization objective, optimizing the global anomaly score through a gradient descent method, and introducing a penalty term to constrain a variation amplitude of the global anomaly score in each iteration;

[0036] The optimized global anomaly score is fused in multiple scales, and the final anomaly score of the node is calculated based on the global anomaly scores of different scales and corresponding weights.

[0037] In an optional implementation,

[0038] The abnormality verification is modeled as a sequential decision process based on deep reinforcement learning, a bidding compliance verification path is dynamically generated based on the abnormality detection result and the auxiliary data, a compliance evaluation result is obtained by optimizing the verification path, and the step of generating an audit report comprises:

[0039] A verification feature vector is constructed based on the abnormality detection result, the verification feature vector combines the auxiliary data to construct a verification state space and a verification action space, and the verification state space contains the verification feature vector and a historical verification decision sequence;

[0040] A verification policy generation network is constructed based on the verification state space and the verification action space, the verification policy generation network uses a variational autoencoder to encode the verification feature vector to obtain a latent representation of the abnormality pattern, a verification policy distribution is constructed based on the latent representation, and a verification action sequence is generated according to the verification policy distribution;

[0041] A verification evaluation function is constructed, which contains a verification accuracy term, a verification cost term and a decision consistency term, the verification evaluation function is optimized by using a Thompson sampling method, and an optimal verification action sequence is obtained, and a verification path is determined according to the optimal verification action sequence;

[0042] A verification process is performed along the verification path, a time sequence compliance index, a spatial consistency index and a text semantic similarity index are calculated for each verification node, a multi-dimensional risk dependence matrix is constructed based on the time sequence compliance index, the spatial consistency index and the text semantic similarity index, a multi-dimensional risk joint distribution is calculated by using a Copula function, and a compliance evaluation result is output; based on the compliance evaluation result, abnormal spatio-temporal pattern information and its propagation path are extracted, and an audit report is generated.

[0043] In an optional implementation,

[0044] The step of constructing a verification evaluation function comprising a verification accuracy term, a verification cost term and a decision consistency term, and optimizing the verification evaluation function by using a Thompson sampling method to obtain an optimal verification action sequence comprises:

[0045] The verification accuracy term is calculated based on the abnormality detection rate corresponding to the verification action sequence, the verification cost term is calculated based on the resource consumption of the verification depth and the verification range, and the decision consistency term is calculated based on the strategy difference between adjacent verification actions;

[0046] The Thompson sampling method is implemented by using a Bayesian neural network to establish a posterior distribution of the validation evaluation function, and the weight distribution of the Bayesian neural network is trained based on a historical validation decision sequence to obtain a probabilistic representation of the validation evaluation function.

[0047] At each round of validation decision, an instance of the current validation evaluation function is sampled from the posterior distribution based on the Thompson sampling principle, the candidate validation action sequence is scored based on the instance of the current validation evaluation function, and the validation action sequence with the highest score is selected as the optimal validation action sequence.

[0048] The posterior distribution is updated according to the validation feedback information, and the exploration and utilization are balanced by adaptively adjusting the sampling temperature parameter, which decreases with the increase of the validation rounds.

[0049] The second aspect of the embodiment of the application provides an electronic device, comprising:

[0050] a processor;

[0051] a memory for storing processor-executable instructions;

[0052] The processor is configured to invoke the instructions stored in the memory to execute the method described above.

[0053] The third aspect of the embodiment of the application provides a computer-readable storage medium having computer program instructions stored thereon, the computer program instructions being executed by a processor to implement the method described above.

[0054] The application realizes fine processing of the bidding spatio-temporal data by constructing a spatio-temporal double-flow feature network, wherein the time sequence feature flow is dynamically segmented by using an adaptive time window, and the spatial feature flow is adaptively partitioned by using density clustering, effectively capturing the spatio-temporal pattern changes in the bidding activities and improving the accuracy of anomaly detection.

[0055] The application combines knowledge graph technology to perform multi-modal fusion of spatio-temporal features and text content, constructs a knowledge structure containing bidding events, geographic location nodes and their relationships, realizes semantic understanding and correlation analysis of all elements of bidding, and enhances the depth and breadth of compliance review.

[0056] The application adopts an abnormality validation mechanism based on deep reinforcement learning, models the compliance review as a sequential decision-making process, dynamically generates a bidding compliance verification path according to the preliminary anomaly detection result, significantly improves the review efficiency and accuracy, reduces the artificial review cost, and provides an intelligent solution for bidding supervision. BRIEF DESCRIPTION OF DRAWINGS

[0057] Figure 1 A flowchart of a bidding full-element compliance review method of a multi-modal model spatio-temporal sequence analysis according to an embodiment of the present application.

[0058] Figure 2 A spatio-temporal anomaly detection flowchart based on a knowledge graph. DETAILED DESCRIPTION

[0059] To make the objectives, technical solutions, and advantages of the embodiments of the present application clearer, the following will be a clear and complete description of the technical solutions in the embodiments of the present application with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by a person of ordinary skill in the art without creative work are within the protection scope of the present application.

[0060] The technical solutions of the present application will be described in detail with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described in some embodiments.

[0061] Figure 1 A flowchart of a bidding full-element compliance review method of a multi-modal model spatio-temporal sequence analysis according to an embodiment of the present application, as shown in Figure 1 The method comprises:

[0062] Obtaining spatio-temporal sequence data and auxiliary data of a bidding project to be reviewed, the spatio-temporal sequence data comprising bidding time data and bidding geographical position data, and the auxiliary data comprising bidding text content;

[0063] Constructing a spatio-temporal double-flow feature network, wherein a time sequence feature flow adopts an adaptive time window to dynamically segment a time sequence and extract a time sequence feature representation of an event, and a spatial feature flow adopts density clustering to adaptively partition a geographical position and extract a spatial distribution feature;

[0064] Constructing a knowledge graph based on an output of the spatio-temporal double-flow feature network, the knowledge graph comprising nodes representing bidding events and geographical positions and edges representing time sequence dependency relationships and spatial constraint relationships, and attributes of the edges being supplemented by the auxiliary data;

[0065] Based on the knowledge graph, a spatio-temporal pattern encoder is used to calculate a similarity of node features to a normal pattern library at a local level to obtain an anomaly score, and a graph attention network is used to optimize the anomaly score in a context at a global level to obtain an anomaly detection result;

[0066] The abnormality verification is modeled as a sequential decision process based on deep reinforcement learning, a bidding compliance verification path is dynamically generated based on the abnormality detection result and the auxiliary data, a compliance evaluation result is obtained by optimizing the verification path, and an audit report is generated.

[0067] In an alternative embodiment, a spatio-temporal dual-flow feature network is constructed, wherein the time series feature flow adopts an adaptive time window to dynamically segment the time series and extract the time series feature representation of the event, and the spatial feature flow adopts a density clustering to adaptively partition the geographic location and extract the spatial distribution feature, and the steps include:

[0068] A time series feature flow is constructed, which identifies the bidding time points by designing a time sensitivity function for the bidding time data, constructs a non-uniform time window sequence based on the time points, determines the boundary of the non-uniform time window by maximizing the difference in bidding behavior patterns between windows, and extracts the time series dependent features of the bidding event in each time window using an attention-enhanced recurrent network to obtain a hierarchical time series feature representation;

[0069] A spatial feature flow is constructed, which dynamically divides the bidding area using an adaptive spatial partitioning algorithm for the bidding geographic location data, optimizes the adaptive spatial partitioning algorithm by minimizing the bidding behavior entropy within the region and maximizing the bidding behavior difference between regions, constructs a bidding geographic correlation network based on the spatial partitioning, and extracts the spatial distribution features;

[0070] A spatio-temporal collaborative attention mechanism is used to fuse the outputs of the time series feature flow and the spatial feature flow, which dynamically calculates the correlation strength of the hierarchical time series feature representation and the spatial distribution features, adaptively adjusts the weights of different dimensional features, and obtains a unified spatio-temporal feature representation.

[0071] For example, the embodiment constructs a spatio-temporal dual-flow feature network, including a time series feature flow and a spatial feature flow, and a spatio-temporal collaborative attention fusion mechanism.

[0072] The time series feature flow processes the bidding time data, and the time sensitivity function is defined as the weighted combination of the bidding frequency and the bidding price change amplitude within a certain time window. For a given bidding data set, calculate the sensitivity value S(t) of each time point t. When S(t) is greater than a preset threshold α (α can be set to 0.65), mark t as a key time point. For example, in a certain engineering bidding project, it is detected that the sensitivity values of the three time points 24 hours, 12 hours and 2 hours before the bidding deadline are 0.72, 0.81 and 0.93 respectively, all of which exceed the threshold value 0.65, so these three time points are marked as key time points.

[0073] Based on the identified key time points, a sequence of non-uniform time windows is constructed. The window boundaries are determined through iterative optimization, with the goal of maximizing the difference in bidding behavior patterns between adjacent windows. The difference is calculated through multi-dimensional indicators such as bidding frequency, price volatility, and participant changes. In the implementation process, the sliding window technique is used, and the window size is dynamically adjusted according to the data density, ranging from 2 hours to 24 hours. For the aforementioned engineering bidding project, four non-uniform time windows are finally determined: [bid start, 24 hours before the deadline), [24 hours before the deadline, 12 hours before the deadline), [12 hours before the deadline, 2 hours before the deadline), and [2 hours before the deadline, bid deadline].

[0074] In each time window, the attention-enhanced recurrent network is composed of a bidirectional long short-term memory network and a self-attention mechanism. The input features include bid prices, bid time intervals, bidder historical behavior, etc. The network contains 3 layers of bidirectional LSTM, with 128 hidden units in each layer, and residual connections are set in the middle to avoid gradient disappearance problems. The self-attention mechanism dynamically adjusts the feature weights by calculating the correlation between different bidding events. The processed result is a hierarchical temporal feature representation with a dimension of 256. Taking a bidding project as an example, in the 2-hour time window before the deadline, the pattern of multiple bidders densely modifying bid prices in a short period of time is captured, and the attention mechanism automatically increases the feature weight of this period to 0.87.

[0075] The spatial feature stream processes the bidding geographic location data. The adaptive spatial partitioning algorithm is based on the density clustering principle, and is optimized by minimizing the bidding behavior entropy within the region and maximizing the bidding behavior difference between regions. It converts the bidding geographic coordinates into a standardized format, and then sets the initial partition number K (K can be set to 5-8, depending on the data size). The algorithm iteratively performs the clustering process, adjusting the cluster center and radius each time, until it converges or reaches the maximum number of iterations (usually set to 100 times). For example, in a regional construction project bidding, 300 bidding points are spatially partitioned, with an initial K=6. After 78 iterations, it converges and finally determines 5 effective spatial partitions. The bidding behavior entropy values in each partition are 0.32, 0.41, 0.28, 0.36, and 0.39, respectively, and the average behavior difference between partitions reaches 0.76.

[0076] Based on the spatial partitioning result, a bid geographical correlation network is constructed. The network nodes represent the spatial partitions, and the edges represent the bid relationship strength between partitions. The relationship strength is calculated through the activity frequency and similarity of bidders in different partitions. The network construction uses graph convolution operation, which contains 2 layers of graph convolution layers, each with 64 hidden units. This process extracts spatial distribution features with a dimension of 128. In the aforementioned construction project case, it is identified that there is an abnormally high correlation degree of 0.92 between the 2nd partition and the 4th partition, and further analysis finds that there is a suspected collusion behavior pattern between the bidders in these two regions.

[0077] The spatio-temporal collaborative attention mechanism realizes adaptive weight adjustment of different dimensional features by calculating the correlation strength matrix between hierarchical temporal feature representation and spatial distribution feature. The temporal features (dimension 256) and spatial features (dimension 128) are projected into the same feature space (dimension 192) through linear transformation. Then the attention scores between the two features are calculated, and the attention weights are obtained by normalizing through the softmax function. Finally, the two features are weighted and fused to obtain a unified spatio-temporal feature representation (dimension 192).

[0078] The training of the spatio-temporal double-flow feature network adopts an end-to-end manner, and the loss function combines the classification loss and the contrast learning loss.

[0079] The present application solves the problem that the traditional fixed window cannot cope with the dynamic changes of bid behavior by designing adaptive time window and spatial partition, and overcomes the defect that static spatial division cannot capture regional features. It can automatically adjust the feature extraction strategy according to the spatio-temporal characteristics of bid behavior, significantly improve the accuracy of abnormal pattern recognition, and reduce the workload of manual parameter adjustment.

[0080] In an optional implementation, a knowledge graph is constructed based on the output of the spatio-temporal double-flow feature network, the knowledge graph includes nodes representing bid events and geographical locations and edges representing temporal dependency relationships and spatial constraint relationships, and the step of supplementing the attributes of the edges through the auxiliary data includes:

[0081] Obtaining the fusion features of the spatio-temporal double-flow feature network, the fusion features include temporal feature representation of bid events and spatial distribution features of geographical locations;

[0082] A node set of the knowledge graph is constructed, the node set includes bid event nodes, geographical location nodes and bid subject nodes, the bid event nodes include event identifier, occurrence time and bid amount attributes, the geographical location nodes include city area division attributes, and the bid subject nodes include subject identifier, registered capital and establishment time attributes;

[0083] mapping the time component and the space component of the fusion feature to a feature space of a corresponding node by a nonlinear mapping function to obtain a node feature vector;

[0084] constructing an edge set of the knowledge graph, the edge set including a time-dependent edge, a space constraint edge, and a subject association edge, calculating an inner product of adjacent node feature vectors to obtain a weight of the time-dependent edge, and calculating a distance between geographic location nodes to obtain a weight of the space constraint edge;

[0085] converting the bidding text content into a text semantic vector, splicing and fusing the weight vector of the edge with the text semantic vector to obtain a complete attribute vector of the edge, optimizing the edge set based on an importance score of the complete attribute vector, and ensuring the spatiotemporal consistency of the edge attribute by setting a proportion coefficient of the time feature weight and the space feature weight.

[0086] For example, the fusion feature of the spatiotemporal double-flow feature network is obtained, which includes the time feature representation of the bidding event and the spatial distribution feature of the geographic location. According to the output of the spatiotemporal double-flow feature network, the dimension of this fusion feature is 192.

[0087] In constructing the node set of the knowledge graph, three types of nodes are defined: bidding event nodes, geographic location nodes, and bidding subject nodes. For bidding event nodes, a unique identification code is assigned to each event, such as "Bid20230401001", and the event occurrence time (e.g., "2023-04-01 10:30:00") and the bidding amount (e.g., "5,680,000 yuan") are recorded. For geographic location nodes, the city division is refined to the county level, and the boundary coordinate information is recorded, such as the boundary coordinate point set of a district {(120.15, 30.28), (120.25, 30.28), (120.25, 30.38), (120.15, 30.38)}. For bidding subject nodes, the subject identification (e.g., "Corp20230001"), registered capital (e.g., "1000 million yuan"), and establishment time (e.g., "2010-05-12") are recorded.

[0088] The time component and the space component of the fusion feature are mapped to the feature space of the corresponding node by a nonlinear mapping function. A multilayer perceptron is used as the nonlinear mapping function, with a 192-dimensional fusion feature vector as input, a hidden layer dimension of 128, and an output dimension of 64. For bidding event nodes, the time-related part of the fusion feature (about 60% weight) is mainly used for mapping; for geographic location nodes, the space-related part (about 40% weight) is mainly used for mapping; for bidding subject nodes, all 192-dimensional information is comprehensively utilized. The 64-dimensional vector obtained after mapping is the feature vector of the node, which is used for subsequent relationship modeling.

[0089] In constructing the edge set of the knowledge graph, three types of edges are defined: time-dependent edges, spatial constraint edges, and subject association edges. For time-dependent edges, the inner product of the feature vectors of adjacent bidding event nodes is calculated to obtain the weight value. For example, for two bidding events that occur within 30 days of each other, if the inner product of their feature vectors is greater than 0.7, a time-dependent edge is established, and the weight value is the inner product value. For spatial constraint edges, the Euclidean distance between geographic location nodes is calculated, and the smaller the distance, the greater the weight. Specifically, the weight value is equal to 1 minus the normalized distance value, for example, the weight of adjacent regions is usually above 0.8. For subject association edges, the bidding subjects are connected based on the bidding events they participate in, and the weight value is calculated based on the number of participations and the amount.

[0090] The pre-trained text encoder is used to process the bidding documents, extract key information, and convert it into a 384-dimensional text semantic vector. The weight vector of the edge has a dimension of 32, which is obtained by expanding the weight value of the edge. The 32-dimensional weight vector and the 384-dimensional text semantic vector are concatenated to obtain a 416-dimensional complete attribute vector. When optimizing the edge set based on the importance score of the complete attribute vector, a multilayer perceptron is used to calculate the importance score of each edge, with the input being a 416-dimensional complete attribute vector and the output being a 1-dimensional importance score. Edges with an importance score greater than 0.6 are retained, and edges with lower scores are discarded, thereby optimizing the structure of the knowledge graph. For example, a knowledge graph containing 1000 nodes initially has 4500 edges, and after optimization, 2800 important edges are retained.

[0091] To ensure the spatio-temporal consistency of edge attributes, the proportion coefficient of time feature weight and space feature weight is set. In practical applications, based on historical data analysis and the design of the spatio-temporal double-flow feature network, the proportion of time feature weight and space feature weight is set to 6:4, that is, in the calculation of the complete attribute vector, the time feature contributes 60% of the weight, and the space feature contributes 40% of the weight. This proportion is consistent with the weight distribution of the spatio-temporal collaborative attention mechanism, ensuring the technical coherence from feature extraction to knowledge graph construction. This proportion can be adjusted according to specific application scenarios to adapt to the characteristics of different regions and industries.

[0092] The present application effectively solves the problem of the separation of time features, space features, and text features in traditional methods, and overcomes the information loss caused by single feature representation. A complete multi-modal feature correlation system is established, which greatly improves the completeness of feature representation, enabling subsequent anomaly detection to consider multiple dimensions of information, reducing the false positive rate, and improving the reliability of detection.

[0093] In an alternative embodiment, based on the knowledge graph, the steps of calculating the similarity of node features and normal mode library by a spatio-temporal pattern encoder at a local level to obtain an anomaly score, and optimizing the anomaly score by a graph attention network at a global level to obtain an anomaly detection result include:

[0094] Obtaining node features and neighborhood information in the knowledge graph, the node features including time sequence features and spatial features, and the neighborhood information including the dependency relationship between nodes;

[0095] Encoding the node features and the neighborhood information by a spatio-temporal pattern encoder to obtain a spatio-temporal encoding representation of the node, constructing a normal mode feature library based on the spatio-temporal encoding representation, the normal mode feature library including a plurality of normal mode center representations; calculating the similarity of the spatio-temporal encoding representation of the node and the normal mode center representations to obtain a local anomaly score of the node;

[0096] Constructing a multi-head graph attention network, calculating the attention weight between nodes based on a query matrix, a key matrix and a value matrix, and weighting and aggregating the node features according to the attention weight to obtain a context representation of the node;

[0097] Fusing the local anomaly score of the node and the context representation of the node to obtain a global anomaly score of the node;

[0098] Constructing a time sequence smoothing constraint based on the time sequence dependency relationship, the time sequence smoothing constraint being realized by minimizing the difference between the global anomaly scores of the time sequence related nodes, propagating and optimizing the global anomaly scores according to the time sequence dependency strength to obtain a final anomaly score of the node; determining a detection threshold according to the final anomaly score and performing anomaly labeling to obtain an anomaly detection result.

[0099] For example, in combination with Figure 2 Based on the spatio-temporal anomaly detection flowchart of the knowledge graph, the node features and neighborhood information in the knowledge graph are obtained. The node features are represented by a 64-dimensional vector, including time sequence features and spatial features. The time sequence features occupy the first 38 dimensions of the vector, mainly describing the time pattern features of the bidding event, such as bidding time point distribution, bidding frequency change, etc. The spatial features occupy the last 26 dimensions of the vector, mainly describing the distribution characteristics of the bidding geographical location, such as location aggregation degree, spatial coverage range, etc. The neighborhood information represents the dependency relationship between nodes, which is stored by an adjacency matrix. The matrix element value represents the dependency strength, ranging from 0 to 1. For example, for a node set in a bidding project knowledge graph, a feature matrix (500x64) and a corresponding adjacency matrix (500x500) containing 500 nodes are extracted.

[0100] The spatio-temporal pattern encoder adopts a graph convolutional network structure, including three layers of graph convolutional layers, and the output dimensions of each layer are 128, 96 and 64 respectively. In each layer of graph convolutional operation, the node features are updated by weighted combination of the node features and the neighborhood node features. The weight coefficients are determined by the dependence strength between nodes. After the graph convolutional operation, a nonlinear activation function is connected. The encoder outputs a 64-dimensional node spatio-temporal coding representation. For example, 300 bidding projects in a region are encoded, and a 300x64-dimensional coding matrix is obtained.

[0101] The node-based spatio-temporal coding representation is used to construct a normal pattern feature library. The feature library is constructed by a clustering algorithm. First, 5000 confirmed normal bidding event samples are selected from historical data. The spatio-temporal coding representation of these samples is applied to the clustering algorithm, and the number of clusters is set to 20 to obtain 20 cluster centers. Each cluster center is a 64-dimensional vector representing a normal bidding behavior pattern. For example, one of the cluster centers represents the normal pattern of "multiple bidders uniformly distributing the submission of bidding documents before the bidding deadline in large infrastructure projects". The 20 cluster center vectors form the normal pattern feature library.

[0102] The similarity between the node spatio-temporal coding representation and the normal pattern center representation is calculated using the cosine similarity method. The 64-dimensional coding vector of the node and the 20 normal pattern center vectors in the feature library are calculated respectively to obtain the cosine similarity, and the maximum similarity value is taken as the matching degree of the node and the normal pattern. The local anomaly score is defined as 1 minus the matching degree, so the higher the score value, the more abnormal the node. For example, the local anomaly scores of 100 test nodes are calculated, and the scores are distributed between 0.05 and 0.92. Among them, 80% of the nodes have scores less than 0.4, indicating that most of the nodes conform to the normal pattern.

[0103] A multi-head graph attention network is constructed to optimize the context of the anomaly score. The network includes 4 attention heads, each containing a set of query matrices, key matrices and value matrices. The dimensions of the query matrix and the key matrix are 64x32, and the dimension of the value matrix is 64x16. For each node, its feature vector is transformed by the query matrix to obtain the query vector, and the feature vectors of its neighbor nodes are transformed by the key matrix to obtain the key vector set. The attention score is calculated by the dot product operation of the query vector and the key vector set, and the attention weight is obtained after normalization. The attention weight reflects the attention degree of the center node to the neighbor nodes. The neighbor node feature vectors are transformed by the value matrix to obtain the value vector set, and the weighted sum of the value vector set is obtained according to the attention weight, and the output of the attention head is obtained. The outputs of the four attention heads are spliced and linearly transformed to obtain the context representation of the node, with a dimension of 64. In practical application, the attention weights of an abnormal node in a certain bidding network to three neighbor nodes are 0.42, 0.35 and 0.23 respectively, indicating that the abnormal state of the node is associated with these neighbor nodes.

[0104] The local anomaly score of the node is fused with the context representation to obtain the global anomaly score of the node. The fusion process is realized by a gating mechanism, which calculates the correlation between the local anomaly score and the context representation to generate the fusion weight. The global anomaly score is the weighted sum of the local anomaly score and the context adjustment term. The context adjustment term is generated by the context representation passing through two fully connected networks, representing the influence of neighbor information on anomaly judgment. In a certain case, a node with a local anomaly score of 0.75, considering that most of its neighbors are normal nodes, the global anomaly score is adjusted to 0.62, reflecting the smoothing effect of context information.

[0105] Identify node pairs with time sequence correlation in the knowledge graph, such as bidding behavior of the same bidding subject at different time points, or adjacent bidding events in time. Construct a time sequence dependency graph for these node pairs, and the weight of the edge in the graph represents the time sequence dependency strength. Time sequence smoothing constraint is realized by minimizing the difference of global anomaly scores between time sequence related nodes. For strongly dependent node pairs, their anomaly scores should be closer; for weakly dependent node pairs, the anomaly scores are allowed to have large differences. In a certain bidding sequence, 5 time sequence related nodes are identified, and the time sequence dependency strength matrix shows that the dependency strength between node 1 and node 2 is 0.85, and the dependency strength between node 2 and node 3 is 0.72, indicating that these nodes are closely related in time sequence.

[0106] The global anomaly score is propagated and optimized according to the time sequence dependence strength. The propagation process adopts an iterative mode, and the initial value is the global anomaly score of the node. In each iteration, the anomaly score of the node is updated by the weighted sum of the score and the scores of the neighbor nodes, and the weight coefficient is the time sequence dependence strength. The number of iterations is set to 10 to ensure convergence. After each iteration, a residual connection is introduced to retain the original anomaly score information. After propagation optimization, the final anomaly score of the node is obtained. In a certain bidding sequence case, the global anomaly scores of two adjacent bidding event nodes are 0.82 and 0.35 respectively, and are adjusted to 0.78 and 0.45 after propagation optimization, which embodies the effect of time sequence smoothing.

[0107] The detection threshold is determined according to the final anomaly score, and the anomaly is marked. The threshold determination is based on historical data statistics and business requirements, and is usually set as the 95% quantile point of the anomaly score distribution. On a certain regional bidding data set, the final anomaly score distribution of 2000 nodes is analyzed, and the threshold is determined as 0.68. The nodes with scores exceeding the threshold are marked as anomalies, and an anomaly detection result report is generated. The report includes anomaly node identification, anomaly score, associated node information and preliminary anomaly type judgment. In an audit, 27 abnormal events are detected from 500 bidding events, of which 23 are confirmed as real irregular behaviors in subsequent verification, and 4 are false positives.

[0108] The multi-level anomaly detection method of the application combines local features and global context, and realizes accurate identification of bidding anomalies through space-time pattern coding and graph attention mechanism. The method can not only detect single abnormal events, but also find abnormal propagation paths and correlation patterns, significantly improving the efficiency and accuracy of bidding compliance review.

[0109] In an optional implementation, a time sequence smoothing constraint is constructed based on the time sequence dependence relationship, the time sequence smoothing constraint is realized by minimizing the difference between the global anomaly scores of the time sequence related nodes, the final anomaly score of the node is obtained by propagating and optimizing the global anomaly score according to the time sequence dependence strength, and the step includes:

[0110] The time sequence dependence relationship is constructed, the time sequence dependence strength of the time sequence related node pair is calculated by using a dynamic graph neural network, the dynamic graph neural network includes a time sequence query matrix and a time sequence key matrix, the node feature vector is transformed by using the time sequence query matrix and the time sequence key matrix, and the time sequence dependence strength of the node pair is calculated by combining a time interval attenuation function;

[0111] A smoothing constraint objective function is constructed based on the time sequence dependence strength, the smoothing constraint objective function includes a smoothing loss term and a causal loss term, the smoothing loss term is calculated based on the time sequence dependence strength, the square difference between the global anomaly scores of the related nodes, and the causal loss term is calculated based on the intervention operation, the deviation between the global anomaly score of the node and its expected value.

[0112] An abnormal score propagation function is designed to iteratively update the global abnormal score of a node according to the timing dependency strength, and the smoothing constraint objective function is taken as an optimization target, and the global abnormal score is optimized by a gradient descent method, and a penalty term is introduced to constrain the change amplitude of the global abnormal score in each iteration.

[0113] The optimized global abnormal score is fused in multiple scales, and the final abnormal score of the node is calculated based on the global abnormal scores of different scales and corresponding weights.

[0114] For example, the timing dependency relationship is constructed, and the pair of bidding event nodes associated with each other in the time dimension is identified. For a given knowledge graph, all nodes with time attributes are extracted, including bidding event nodes and related time label nodes. For each pair of timing dependent nodes, a dynamic graph neural network is used to calculate the timing dependency strength. The dynamic graph neural network has special timing perception ability, and the core components include a timing query matrix and a timing key matrix. The timing query matrix has a dimension of 64x32, which is used to transform the feature vector of the source node into a query vector; the timing key matrix also has a dimension of 64x32, which is used to transform the feature vector of the target node into a key vector. In practical applications, for two time points A and B of a certain bidding project, the node feature vectors are 64-dimensional vectors VA and VB, respectively. VA is converted into a 32-dimensional query vector QA by the timing query matrix, and VB is converted into a 32-dimensional key vector KB by the timing key matrix.

[0115] The specific implementation of the time interval decay function adopts an exponential decay form. For two nodes with timestamps tA and tB, the time interval is calculated as |tB-tA|, in units of days. The decay function is defined as D(tA,tB)=alpha^(|tB-tA| / beta), where alpha is the basic decay rate, set to 0.9, and beta is the time scale parameter, set to 10 days. This means that when the time interval is 10 days, the decay value is 0.9; when the interval is 20 days, the decay value is 0.81 (i.e. 0.9 2). The parameters alpha and beta can be adjusted according to specific business scenarios. When two bidding events occur on the same day, the decay value is 1; when the interval exceeds 90 days, the decay value approaches 0.1, indicating that the long-term dependence is significantly weakened. When calculating the timing dependence strength, first calculate the dot product of the query vector QA and the key vector KB to obtain the similarity score S, then multiply S by the time decay value D, and finally map the result to 0 to 1 through the Sigmoid function to obtain the final timing dependence strength value. In a certain bidding data set, the bidding events within three consecutive months were analyzed, and a complete dependence strength matrix was generated, in which the dependence strength of consecutive bidding events of the same bidder within a week was 0.85 on average, while the dependence strength of events adjacent in time between different bidders was only about 0.32.

[0116] The smoothing constraint objective function includes two key components: the smoothing loss term and the causal loss term. The specific calculation method of the smoothing loss term is: for all node pairs (i, j) with timing dependence in the knowledge graph, calculate the weighted square difference of their global anomaly scores Si and Sj. The calculation formula of the weighted square difference is: the timing dependence strength Wij of the node pair (i, j) multiplied by the square of the anomaly score difference (Si-Sj) 2 . The sum of the weighted square differences of all node pairs constitutes the smoothing loss term. For example, the smoothing loss is calculated for 5 associated bidding events in a certain bidding project, where the dependence strength of node pair (1, 2) is 0.9, and the anomaly scores are 0.78 and 0.65, respectively, contributing a smoothing loss of 0.9 x (0.78-0.65) 2 =0.015; while the node pair (3, 4) with a dependence strength of only 0.3, even with the same anomaly score difference, contributes only 0.005, which is only one-third of the strong dependence pair. The causal loss term is implemented using the counterfactual analysis method. First, build an anomaly propagation prediction model that accepts node features and anomaly scores as input to predict the anomaly score changes of timing-related nodes. For node i, by replacing its features with the average features of normal samples, simulate the scenario where it becomes normal, and then predict the expected anomaly scores E[Sj] of all timing-related nodes j. The causal loss term calculates the squared difference between the actual anomaly score Sj and the expected anomaly score E[Sj], and is weighted according to the timing dependence strength of the node pair (i, j). This design enables the differentiation between true causal relationships and accidental correlations. In a certain bidding anomaly detection, an intervention was made on a node with an anomaly score of 0.86, and it was found that the expected anomaly scores of the three subsequent nodes directly affected by it decreased by 0.32, 0.28, and 0.15, respectively, while the anomaly scores of the nodes with no direct timing association with it remained almost unchanged, clearly showing the causal path of anomaly propagation.

[0117] The specific implementation of the anomaly score propagation function adopts an iterative message passing mechanism. For node i, the update formula of its anomaly score in the t+1th iteration is: Si(t+1) = lambda * Si(t) + (1-lambda) * weighted average value. Where Si(t) is the anomaly score of node i in the tth iteration, lambda is the retention coefficient, set to 0.6, representing retaining 60% of the original score. The weighted average value is calculated by weighting the anomaly scores Sj(t) of all nodes j that have a temporal dependency with node i according to the dependency strength Wij. In specific calculation, first normalize the dependency strength Wij of all related nodes j so that their sum is 1, then calculate the sum of the product of the normalized weight and the corresponding node anomaly score. Calculate the objective function value after each iteration, and adjust the anomaly score according to the gradient direction. To prevent over-smoothing, introduce a penalty term delta * |Si(t+1) - Si(0)| 2 , where Si(0) is the initial anomaly score, and delta is the penalty coefficient, with an initial value of 0.1, which is reduced by half every 5 iterations until it drops to 0.01. In the anomaly analysis of a certain bidding project, 120 nodes were optimized for 25 iterations, and the maximum anomaly score change was observed to decrease from the initial 0.23 to 0.02 in the 25th iteration, indicating that the iteration process has basically converged.

[0118] The specific implementation of multi-scale fusion involves three time scales: short-term (7 days), medium-term (30 days), and long-term (90 days). At each time scale, a temporal dependency network is independently constructed and the anomaly score is optimized. The short-term scale focuses on recent bidding behavior patterns, using a higher time decay rate a = 0.8; the medium-term scale focuses on monthly bidding patterns, with a decay rate a = 0.9; the long-term scale focuses on quarterly bidding trends, with a decay rate a = 0.95. For each node, obtain the optimized anomaly scores Ss, Sm, and Sl at the three time scales, and the final anomaly score is calculated as: S = ws * Ss + wm * Sm + wl * Sl, where ws, wm, and wl are the weight coefficients of each scale, determined by grid search on the validation set, with typical values of ws = 0.5, wm = 0.3, and wl = 0.2. For example, in the bidding analysis of a certain construction project, a bidding enterprise was identified as highly abnormal in the short term (short-term score 0.88), but with lower medium-term and long-term anomaly scores (0.42 and 0.35 respectively), the final score after multi-scale fusion was 0.62, lower than the original detection threshold 0.7, avoiding possible false positives. It also supports adaptive weight adjustment, automatically adjusting the weights of the three scales according to the temporal characteristics of the node. For example, for a newly established bidding subject, the short-term and medium-term weights are automatically increased due to the lack of long-term data, while for a long-term active bidding subject, the weights of the three scales are more balanced.

[0119] For example, the analysis of all bidding records for a certain bidding project is performed. The project has 52 bidding event nodes, forming a complex time-dependent network. The complete time-dependent intensity matrix is calculated by a dynamic graph neural network, and the intensity value is distributed between 0.05 and 0.92. A smooth constraint objective function is constructed based on the dependence matrix, and the global anomaly score of the node is adjusted through iterative optimization. Before optimization, there are many cases where the anomaly scores of the bidding events at adjacent time points differ greatly, such as two events with an interval of only one day, with scores of 0.78 and 0.31, respectively. After optimization, the scores of these two nodes are adjusted to 0.72 and 0.45, respectively, reflecting the effect of time smoothing. After multi-scale fusion of the final output anomaly scores, 7 highly suspicious bidding events are detected, which show a clear serial pattern in time, suggesting possible bid-rigging behavior.

[0120] The present application realizes accurate identification of bidding and tendering abnormal behaviors through time-dependent relationships and smooth constraints, overcoming the defects of traditional methods that are difficult to capture time patterns and associated anomalies. The technology effectively reduces the fluctuation of anomaly scores in the time dimension, improves the stability and reliability of the detection results. The multi-scale fusion mechanism enables comprehensive consideration of abnormal features in different time ranges, balancing short-term fluctuations and long-term trends, and providing more comprehensive and accurate anomaly detection results for bidding and tendering supervision.

[0121] In an optional implementation, the abnormal verification is modeled as a sequential decision-making process based on deep reinforcement learning, a bidding and tendering compliance verification path is dynamically generated based on the anomaly detection results and the auxiliary data, and a compliance evaluation result is obtained by optimizing the verification path. The step of generating an audit report comprises:

[0122] A verification feature vector is constructed based on the anomaly detection results, and the verification feature vector combines the auxiliary data to construct a verification state space and a verification action space. The verification state space includes the verification feature vector and a historical verification decision sequence;

[0123] A verification policy generation network is constructed based on the verification state space and the verification action space. The verification policy generation network uses a variational autoencoder to encode the verification feature vector to obtain a latent representation of the anomaly pattern. A verification policy distribution is constructed based on the latent representation, and a verification action sequence is generated according to the verification policy distribution;

[0124] A verification evaluation function is constructed, which includes a verification accuracy term, a verification cost term and a decision consistency term. The verification evaluation function is sampled and optimized using the Thompson sampling method to obtain an optimal verification action sequence, and a verification path is determined according to the optimal verification action sequence;

[0125] performing a verification process along the verification path, calculating a time sequence compliance index, a spatial consistency index and a text semantic similarity index for each verification node, constructing a multi-dimensional risk dependence matrix based on the time sequence compliance index, the spatial consistency index and the text semantic similarity index, calculating a multi-dimensional risk joint distribution using a Copula function, and outputting a compliance evaluation result; extracting abnormal spatio-temporal pattern information and its propagation path based on the compliance evaluation result, and generating an inspection report.

[0126] For example, a verification feature vector is constructed based on the abnormality detection result. The verification feature vector includes three parts: an abnormal score feature, a time sequence pattern feature and an entity relationship feature, with a total of 128 dimensions. The abnormal score feature accounts for 32 dimensions, including local abnormal score, global abnormal score and final abnormal score of the node; the time sequence pattern feature accounts for 48 dimensions, describing the time distribution characteristics and change trend of the abnormal node; and the entity relationship feature accounts for 48 dimensions, describing the interaction mode of the abnormal node with other entities. For example, in a certain bidding project, 7 highly suspicious events are detected from 52 bidding events, and a 128-dimensional verification feature vector is constructed for each suspicious event. In addition, relevant auxiliary data is collected, including bidding document information, enterprise registration information, qualification certificate information and historical bid-winning records, etc. These auxiliary data are stored in a structured manner to enrich the verification features.

[0127] Based on the verification feature vector and the auxiliary data, a verification state space and a verification action space are constructed. The verification state space is composed of the current verification feature vector and the historical verification decision sequence. The historical verification decision sequence records the executed verification actions and their results, and the upper limit of the length is set to 10. In the abnormal verification process of a certain bidding project, the dimension of the verification state space is 256, of which 128 dimensions are the verification feature vector and 128 dimensions are the encoded representation of the historical verification decision sequence. The verification action space includes various verification operation types, such as document consistency check, qualification authenticity verification, bidding timeline analysis, enterprise association relationship query, etc., and a total of 15 basic verification actions are designed. Each verification action has different execution cost and expected accuracy. For example, the execution cost of bidding file similarity analysis is 2 units, and the expected accuracy is 0.8; while the execution cost of enterprise on-site visit is 10 units, and the expected accuracy is 0.95. In practical application, the priority of the verification action will be dynamically adjusted according to the abnormal type and severity.

[0128] A verification strategy generation network is constructed based on the verification state space and the verification action space. The network uses a variational autoencoder to encode the verification feature vectors to obtain the latent representation of the abnormal pattern. The variational autoencoder consists of an encoder and a decoder. The encoder includes three fully connected networks, with the input layer dimension of 128, the hidden layer dimensions of 96 and 64, and the output layer dimension of 32, generating a mean vector and a variance vector each with 16 dimensions. The decoder also includes three fully connected networks, with the structure symmetric to the encoder. Through the reparameterization trick, a 16-dimensional latent representation vector is sampled from the distribution defined by the mean and variance. For example, in a certain bidding abnormality verification case, the verification feature vectors of 7 suspicious events are encoded to obtain 7 latent representation vectors. The clustering of these vectors in the latent space reflects the similarity of the abnormal patterns. Based on the latent representation, a verification strategy distribution is constructed. The distribution is realized through a strategy network consisting of two fully connected networks, with the input layer dimension of 16, the hidden layer dimension of 32, and the output layer dimension of 15, corresponding to the probability distribution of 15 verification actions. In each verification step, the next verification action is sampled from the strategy distribution to form a verification action sequence. For a suspicious bidding record of a certain bidding project, a sequence of 5 verification actions is generated: bidding document similarity analysis, bidder qualification inspection, bidding timeline comparison, enterprise association relationship analysis, and historical bidding pattern comparison.

[0129] A verification evaluation function is constructed, including three parts: verification accuracy term, verification cost term, and decision consistency term. The verification accuracy term reflects the expected accuracy of the verification action sequence, and the calculation method is the weighted average of the accuracy of each verification action, and the weight is determined by the action importance. The verification cost term considers the total cost of executing the verification action sequence, including time cost, labor cost and resource cost. The decision consistency term evaluates the internal consistency of the verification action sequence, which is realized by calculating the semantic correlation of adjacent verification actions. In a certain bidding verification case, two candidate verification sequences are evaluated: the accuracy of sequence A is 0.85, the cost is 12, and the consistency is 0.78; the accuracy of sequence B is 0.88, the cost is 15, and the consistency is 0.82. The Thompson sampling method is used to optimize the verification evaluation function. This method maintains the evaluation distribution of each verification action sequence, and in each optimization iteration, samples are taken from these distributions to select the sequence with the highest evaluation value. By continuously updating the evaluation distribution parameters, a balance between exploration and exploitation is achieved. After 50 rounds of iterative optimization, the optimal verification action sequence is obtained, and the verification path is determined accordingly. For the above bidding case, the optimal verification path is selected as a compromise solution with an accuracy of 0.87, a cost of 13, and a consistency of 0.81.

[0130] Along the determined verification path, the verification process is performed, and three core indicators are calculated for each verification node. The timing compliance indicator assesses the compliance degree of bidding behavior in the time dimension, including bidding time point distribution, modification frequency, and submission timing, etc. Timing compliance is calculated by comparing the deviation degree of the actual timing mode and the normal baseline mode. The larger the deviation degree, the lower the compliance. For example, in a certain bidding project, the submission time distribution of the bidding document is analyzed, and it is found that the submission time of 3 suspicious bidders is highly concentrated in the last 15 minutes before the deadline, and the timing compliance indicator is less than 0.4, while the timing compliance indicator of normal bidding is usually higher than 0.7. The spatial consistency indicator assesses the rationality of bidding behavior in the spatial dimension, including bidding location distribution, relationship between office address and registered address, etc. The indicator is calculated through the consistency analysis of geographic location information. In the verification process, it is found that although the registered addresses of two bidding companies are different, they actually use the same network environment to submit bidding documents, and the spatial consistency indicator is only 0.32. The text semantic similarity indicator assesses the independence of the bidding document in the content, and calculates the semantic similarity by analyzing the document structure, wording characteristics and format style. Analysis of 5 bidding documents found that the semantic similarity of 3 of them in the specific technical solution part was as high as 0.88, much higher than the industry average level of 0.45, indicating that there may be bidding collusion behavior.

[0131] Based on the above three indicators, a multi-dimensional risk dependence matrix is constructed to describe the correlation between different risk indicators. The matrix is a 3x3 symmetric matrix, and the diagonal elements are 1. The non-diagonal elements represent the dependence strength between the corresponding risk indicators. In the verification of a certain bidding project, the dependence strength of timing compliance and spatial consistency is 0.65, the dependence strength of timing compliance and text semantic similarity is 0.42, and the dependence strength of spatial consistency and text semantic similarity is 0.58. The Copula function is used to calculate the multi-dimensional risk joint distribution. Copula function can capture the complex dependence structure between multiple risk indicators, even if the marginal distribution of each indicator is different. According to the historical verification data, the parameters of the Copula function are estimated, and then the probability value of the current verification node under the joint distribution is calculated, which is converted into the final compliance score. In the verification of a certain bidding project, 7 suspicious events are evaluated, and the compliance score distribution is between 0.25 and 0.78, of which 3 events score less than 0.3, and are judged as high-risk violation events.

[0132] Based on the compliance evaluation results, abnormal spatio-temporal pattern information and its propagation path are extracted, and an audit report is generated. The audit report contains five main parts: abnormal event overview, abnormal spatio-temporal pattern description, verification path and key evidence, compliance evaluation results and recommended treatment scheme. In the abnormal spatio-temporal pattern description part, the time distribution and spatial correlation of abnormal events are displayed through visualization technology, and the abnormal propagation path is highlighted. For example, in the audit report of a certain bidding project, a "turnaround bid" pattern is identified, and three associated enterprises show obvious turnaround bid characteristics in 8 projects they participated in within six months. The report details the formation process and characteristic performance of this pattern. The verification path and key evidence part lists the sequence of verification actions performed and the key evidence found, such as hidden association between enterprises, abnormal similarity data of bid documents, etc. The compliance evaluation results part gives the final compliance score and risk level, and explains the contribution of each risk indicator. The recommended treatment scheme part proposes appropriate treatment suggestions according to the type and severity of the violation, such as canceling the bid-winning qualification, suspending the bid qualification, or including in the key monitoring list, etc.

[0133] The present application models abnormal verification as a sequential decision-making process, dynamically generates the optimal verification strategy through deep reinforcement learning, and realizes accurate verification of bidding abnormal behavior. This method integrates multi-dimensional risk index evaluation to assess compliance, not only effectively identifying single violation behavior, but also revealing complex violation patterns and propagation paths. By optimizing the verification path, the verification efficiency and accuracy are significantly improved, and the verification cost is reduced, providing an interpretable and operable decision support tool for bidding supervision.

[0134] In an optional implementation, the step of constructing a verification evaluation function including a verification accuracy term, a verification cost term and a decision consistency term, and using the Thompson sampling method to sample and optimize the verification evaluation function to obtain the optimal verification action sequence includes:

[0135] The verification accuracy term is calculated based on the abnormal detection rate corresponding to the verification action sequence, the verification cost term is calculated based on the resource consumption of the verification depth and the verification range, and the decision consistency term is calculated based on the strategy difference of adjacent verification actions;

[0136] The Bayesian neural network is used to implement the Thompson sampling method, the posterior distribution of the verification evaluation function is established, the weight distribution of the Bayesian neural network is trained based on the historical verification decision sequence, and the probability representation of the verification evaluation function is obtained;

[0137] At each round of verification decision, an instance of the current verification evaluation function is sampled from the posterior distribution based on the Thompson sampling principle, the candidate verification action sequence is scored based on the instance of the current verification evaluation function, and the verification action sequence with the highest score is selected as the optimal verification action sequence.

[0138] The posterior distribution is updated according to the verification feedback information, and exploration and utilization are balanced by adaptively adjusting a sampling temperature parameter, which decreases with the increase of the verification round.

[0139] In the process of implementing the present application, a verification evaluation function including a verification accuracy term, a verification cost term and a decision consistency term can be constructed, and the Thompson sampling method is used to sample and optimize the verification evaluation function, so as to obtain the optimal verification action sequence.

[0140] For example, the verification accuracy term is calculated based on the anomaly detection rate corresponding to the verification action sequence, and is evaluated by combining the detection ability of each verification action with the matching degree of the anomaly type. An anomaly type-verification action mapping matrix is maintained, and each element in the matrix represents the detection effect of a specific verification action on a specific anomaly type. For example, for the "collusion in bid" anomaly, the detection rate of the "bid file similarity analysis" action is 0.85, the detection rate of the "bid time correlation analysis" action is 0.72, and the detection rate of the "enterprise association relationship query" action is 0.9. According to the current anomaly type distribution of the verification, the weighted detection rate of each verification action sequence is calculated. For a sequence containing five verification actions, the comprehensive detection rate is calculated as the weighted geometric mean of the detection rates of each action, and the weight is determined according to the severity of the anomaly type and the prior probability. The verification accuracy term is normalized to convert the comprehensive detection rate to a score between 0 and 1, and the higher the detection rate, the higher the score. Specifically, if the detection rates of the verification actions in the sequence are r1, r2,..., rn, and the corresponding weights are w1, w2,..., wn (the sum of the weights is 1), then the comprehensive detection rate r=r1 w1 ×r2 w2 ×...×rn wn , and the final verification accuracy term score AccScore=r.

[0141] The verification cost item is based on the resource consumption calculation of the verification depth and the verification range. The verification depth refers to the length of the verification action sequence, and the verification range refers to the amount of data and the number of associated entities involved in the verification. A basic cost value is assigned to each verification action, and then adjusted according to the verification depth and range. For example, in a certain bid exception verification, the basic cost of "bid file similarity analysis" is 2 units, but when the verification range is expanded to involve 8 bid files, the adjusted cost is 2xlog(8+1)=4.16 units. The influence of verification depth on cost is realized through an exponential decay factor, which makes the cost of verification actions in the later stage of the sequence relatively lower, reflecting the decreasing marginal effect in the verification process. For a verification sequence of length n, the decay factor of the i-th action is 0.9^(i-1). The verification cost item is converted into a score between 0 and 1 by normalization and inversion processing, and the lower the cost, the higher the score. In specific calculation, if the basic costs of the verification actions in the sequence are c1, c2,..., cn respectively, and the verification range adjustment coefficients are s1, s2,..., sn, then the actual cost of the i-th action is ci×si×0.9^(i-1), and the total cost C is the sum of the actual costs of all actions. The final verification cost item score CostScore=max(0,1-C / Cmax), where Cmax is the preset maximum acceptable cost, usually set to 20 units.

[0142] The decision consistency item is based on the strategy difference calculation of adjacent verification actions, aiming to ensure the coherence and logic of the verification process. A verification action semantic correlation matrix is constructed, and each element in the matrix represents the correlation degree between two verification actions. For example, the correlation degree between "bid file similarity analysis" and "bid text style comparison" is 0.85, while the correlation degree with "enterprise on-site visit" is only 0.25. The decision consistency is realized by calculating the average correlation degree of adjacent actions in the verification sequence. For a sequence of length n, the correlation degrees of n-1 pairs of adjacent actions are calculated, and their arithmetic mean is taken as the consistency score. In specific calculation, if the correlation degree of the adjacent action pair (i, i+1) in the sequence is rel(i, i+1), then the decision consistency item score ConsScore=(rel(1,2)+rel(2,3)+...+rel(n-1,n)) / (n-1). In practice, the correlation matrix is constructed based on historical verification experience and expert knowledge, and the value range is 0 to 1, the higher the value, the more coherent the two verification actions.

[0143] The verification evaluation function is constructed by comprehensively considering the verification accuracy term, the verification cost term and the decision consistency term. The function combines the three terms by weighting, and the weights can be dynamically adjusted according to the priority of the verification task. In the regular verification, the weights of the three terms are set to 0.5, 0.3 and 0.2; in the resource-limited case, the weights of the three terms are set to 0.6, 0.2 and 0.2; and in the high-risk case, the weights of the three terms are set to 0.7, 0.2 and 0.1. Taking a certain bidding abnormality verification task as an example, a sequence of 5 verification actions needs to be evaluated: "document acquisition", "enterprise association analysis", "bid text similarity comparison", "price analysis" and "historical bidding pattern analysis". The detection rates of the sequence of actions on the current abnormal type are 0.75, 0.9, 0.85, 0.65 and 0.8 respectively, and the weights are 0.15, 0.25, 0.3, 0.1 and 0.2 respectively. The comprehensive detection rate is calculated as 0.75 0.15 ×0.9 0.25 ×0.85 0.3 ×0.65 0.1 ×0.8 0.2 =0.813, so AccScore=0.813; the basic costs of the actions are 1, 3, 2, 1.5 and 2.5 respectively, the verification range adjustment coefficients are 1, 1.2, 1.5, 1 and 1.1 respectively, and the total costs considering the depth attenuation are 1×1×1+3×1.2×0.9+2×1.5×0.9 2 +1.5×1×0.9 3 +2.5×1.1×0.9 4 =8.954, assuming Cmax=20, then CostScore=1-8.954 / 20=0.552; the correlation degrees of adjacent action pairs are 0.7, 0.85, 0.6 and 0.75 respectively, and the average consistency score ConsScore=(0.7+0.85+0.6+0.75) / 4=0.725. The final verification evaluation score is 0.5×0.813+0.3×0.552+0.2×0.725=0.713. Similarly, the evaluation scores of other candidate verification sequences can be calculated, and the sequence with the highest score is selected as the optimal verification action sequence.

[0144] The Thompson sampling method is implemented using a Bayesian neural network to establish the posterior distribution of the validation evaluation function. The main difference between a Bayesian neural network and a traditional neural network is that the weights are not deterministic but have a probability distribution. The constructed Bayesian neural network consists of three layers: the input layer has a dimension equal to the feature dimension of the validation sequence (usually 128 dimensions), the hidden layer contains 64 neurons, and the output layer has one neuron corresponding to the validation evaluation score. Each weight in the network has a prior distribution, usually a normal distribution with a mean of 0 and a variance of 0.1. The network is trained using historical validation decision sequences and their effect feedback to update the weight distribution. The training data includes validation sequence features, execution results, and human scores. The training uses the variational inference method to minimize the KL divergence between the true posterior distribution and the approximate posterior distribution. After 5000 iterations of training, the network weight distribution gradually converges, with the mean standard deviation decreasing from the initial 0.1 to around 0.03, indicating that the model's expression of the validation evaluation function is becoming more and more certain.

[0145] At each round of validation decision, an instance of the current validation evaluation function is sampled from the posterior distribution based on the Thompson sampling principle. Specifically, for each weight in the Bayesian neural network, a value is randomly sampled from its posterior distribution to form a complete neural network instance, which is an instance of the current validation evaluation function. This sampled function instance is used to score all candidate validation action sequences. In a certain bidding anomaly validation task, 10 candidate validation sequences are generated, and the sampled evaluation function is used to score them, with scores ranging from 0.45 to 0.82. The validation action sequence with the highest score is selected as the optimal sequence, which in this case is a sequence containing "document acquisition", "enterprise association analysis", "bid text similarity comparison", "price analysis", and "historical bidding pattern analysis", with a score of 0.82.

[0146] After executing the selected validation action sequence, the posterior distribution is updated based on the validation feedback information. The validation feedback information includes the actual detection rate, actual cost, and fluency score of the validation process. These feedback information is converted into the actual score of the validation sequence and compared with the predicted score to calculate the prediction error. Through the Bayesian update rule, the weight distribution of the Bayesian neural network is adjusted according to the prediction error. For well-performing parameters, their distribution mean moves in the effective direction, and the variance decreases; for poorly performing parameters, their variance may increase, indicating increased uncertainty. In a certain bidding validation case, after executing the validation sequence, it is found that the actual detection rate is 0.75, which is lower than the expected 0.82, and accordingly the validation action effect distribution for the corresponding anomaly type is updated, with the mean adjusted from 0.85 to 0.82 and the variance increased from 0.03 to 0.05, reflecting the increased uncertainty.

[0147] The sampling temperature parameter is adaptively adjusted to balance exploration and utilization. The sampling temperature parameter controls the randomness degree of sampling from the posterior distribution. The higher the temperature, the more random the sampling result, and the stronger the exploration. The lower the temperature, the closer the sampling result to the distribution mean, and the stronger the utilization. A mechanism is designed to decrease the sampling temperature with the verification round. The initial temperature is set to 1.0, and gradually decreases with the increase of the verification round. The temperature decay formula is: the current temperature is equal to the initial temperature multiplied by the verification round power of the decay factor, and the decay factor is usually set to 0.95. In the early stage of verification, high temperature promotes the attempt of various verification strategies; with the verification and experience accumulation, the temperature decreases, and the known effective strategy is more inclined to be selected. In a continuous verification process of a certain bidding supervision, various verification combinations such as "document analysis priority", "enterprise association priority" and "historical pattern priority" are tried in the initial several rounds; when the temperature decreases to 0.36 in the 20th verification round, the verification strategy tends to be stable, and the strategy mode of mainly selecting "enterprise association analysis" is started according to the found clues to decide the subsequent verification path.

[0148] In order to adapt to different verification scenes, initial temperature adaptive adjustment based on verification task characteristics is also realized. For high-risk and high-urgency verification tasks, the initial temperature is set to be low, such as 0.7, to promote the utilization of known effective strategies; for exploratory verification, the initial temperature is set to be high, such as 1.2, to encourage the attempt of new verification paths. After a complete verification cycle, the entire verification process is reviewed and analyzed according to the final verification effect, the efficient verification mode and the inefficient verification link are identified, and the posterior distribution and sampling strategy of the verification evaluation function are continuously optimized. In a complex bidding anomaly verification, through 30 rounds of verification accumulation, an efficient verification path template for "multi-level associated enterprise bid rigging" type anomaly is formed, which can complete the verification process of originally needing 7 steps in an average of only 4 steps, greatly improving the verification efficiency.

[0149] The verification evaluation function constructed by the application comprehensively considers verification accuracy, verification cost and decision consistency. The Thompson sampling method realized by the Bayesian neural network can automatically balance exploration and utilization in the verification process and dynamically optimize the verification path. This method not only improves the accuracy and efficiency of anomaly verification, but also continuously learns and improves according to the verification feedback, has strong adaptability and scalability, provides intelligent verification decision support for bidding supervision, and effectively reduces the subjectivity and resource consumption of manual verification.

[0150] In a second aspect, the embodiment of the application provides an electronic device, comprising:

[0151] a processor;

[0152] a memory for storing processor-executable instructions;

[0153] The processor is configured to invoke instructions stored in the memory to perform the method described above.

[0154] In a third aspect, the present application provides a computer readable storage medium having stored thereon computer program instructions, which when executed by a processor, implement the method described above.

[0155] The present application can be a method, apparatus, system, and / or computer program product. The computer program product can include a computer readable storage medium having computer readable program instructions stored therein, which, when executed by a processor, perform various aspects of the present application.

[0156] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present application, and not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand: it can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement for part or all of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for tender full-factor compliance review of multi-modal model spatio-temporal sequence analysis, characterized in that, include: Acquire spatiotemporal sequence data and auxiliary data of the bidding projects to be reviewed. The spatiotemporal sequence data includes bidding time data and bidding geographical location data, and the auxiliary data includes the content of the bidding text. A spatiotemporal dual-stream feature network is constructed, in which the temporal feature stream uses an adaptive time window to dynamically segment the time series and extract the temporal feature representation of events, and the spatial feature stream uses density clustering to adaptively partition the geographical location and extract the spatial distribution features. A knowledge graph is constructed based on the output of the spatiotemporal dual-stream feature network. The knowledge graph includes nodes representing bidding events and geographical locations, and edges representing temporal dependencies and spatial constraints. The attributes of the edges are supplemented by the auxiliary data. Based on the knowledge graph, at the local level, a spatiotemporal pattern encoder is used to calculate the similarity between node features and the normal pattern library to obtain an anomaly score. At the global level, a graph attention network is used to optimize the anomaly score in context to obtain the anomaly detection result. Anomaly verification is modeled as a sequential decision-making process based on deep reinforcement learning. Based on the anomaly detection results and the auxiliary data, a compliance verification path for bidding is dynamically generated. By optimizing the verification path, a compliance assessment result is obtained, and a review report is generated.

2. The method of claim 1, wherein, The construction of a spatiotemporal dual-stream feature network, wherein the temporal feature stream uses an adaptive time window to dynamically segment the time series and extract the temporal feature representation of events, and the spatial feature stream uses density clustering to adaptively spatially partition geographical locations and extract spatial distribution features, includes the following steps: A temporal feature stream is constructed. The temporal feature stream identifies the bidding time points by designing a time sensitivity function for the bidding time data. A non-uniform time window sequence is constructed based on the time points. The boundary of the non-uniform time window is determined by maximizing the difference in bidding behavior patterns between windows. Within each time window, an attention-enhanced recurrent network is used to extract the temporal dependency features of bidding events, resulting in a hierarchical temporal feature representation. A spatial feature stream is constructed, and an adaptive spatial partitioning algorithm is used to dynamically divide the bidding area into the bidding geographical location data. The adaptive spatial partitioning algorithm is optimized by minimizing the bidding behavior entropy within the area and maximizing the difference in bidding behavior between areas. Based on the spatial partitioning, a bidding geographical association network is constructed to extract spatial distribution features. A spatiotemporal collaborative attention mechanism is used to fuse the outputs of the temporal feature stream and the spatial feature stream. The spatiotemporal collaborative attention mechanism dynamically calculates the correlation strength between the hierarchical temporal feature representation and the spatial distribution features, and adaptively adjusts the weights of features of different dimensions to obtain a unified spatiotemporal feature representation.

3. The method of claim 1, wherein, A knowledge graph is constructed based on the output of the spatiotemporal dual-stream feature network. The knowledge graph includes nodes representing bidding events and geographical locations, and edges representing temporal dependencies and spatial constraints. The steps of supplementing the edge attributes with the auxiliary data include: The fusion features of the spatiotemporal dual-stream feature network are obtained, and the fusion features include the temporal feature representation of bidding events and the spatial distribution features of geographical locations; A node set of a knowledge graph is constructed, the node set comprising a bid event node, a geographic location node, and a bid subject node, the bid event node comprising event identification, time of occurrence, and bid amount attributes, the geographic location node comprising city area division attributes, and the bid subject node comprising subject identification, registered capital, and establishment time attributes; a time sequence component and a spatial component of the fusion feature are mapped to a feature space of a corresponding node by a nonlinear mapping function to obtain a node feature vector; An edge set of the knowledge graph is constructed, the edge set comprising a time sequence dependent edge, a spatial constraint edge, and a subject association edge, a weight of the time sequence dependent edge being obtained by calculating an inner product of adjacent node feature vectors, and a weight of the spatial constraint edge being obtained by calculating a distance between geographic location nodes; The bid and tender text content is converted into a text semantic vector, a weight vector of an edge is spliced and fused with the text semantic vector to obtain a complete attribute vector of the edge, the edge set is optimized based on an importance score of the complete attribute vector, and a proportion coefficient of a time sequence feature weight and a spatial feature weight is set to ensure the spatiotemporal consistency of edge attributes.

4. The method of claim 1, wherein, Based on the knowledge graph, a spatiotemporal pattern encoder is used to calculate the similarity between the node features and the normal pattern library at a local level to obtain an anomaly score, and a graph attention network is used to optimize the anomaly score at a global level to obtain an anomaly detection result, which comprises the following steps: obtaining node features and neighborhood information in a knowledge graph, the node features comprising time sequence features and spatial features, and the neighborhood information comprising dependent relationships between nodes; using a spatiotemporal pattern encoder to encode the node features and the neighborhood information to obtain a spatiotemporal encoding representation of the node, and constructing a normal pattern feature library based on the spatiotemporal encoding representation, the normal pattern feature library comprising a plurality of normal pattern center representations; calculating the similarity between the spatiotemporal encoding representation of the node and the normal pattern center representations to obtain a local anomaly score of the node; constructing a multi-head graph attention network, calculating attention weights between nodes based on a query matrix, a key matrix, and a value matrix, and weighting and aggregating node features according to the attention weights to obtain a context representation of the node; fusing the local anomaly score of the node with the context representation of the node to obtain a global anomaly score of the node; constructing a time sequence smoothing constraint based on a time sequence dependent relationship, the time sequence smoothing constraint being realized by minimizing the difference between global anomaly scores of time sequence related nodes, propagating and optimizing the global anomaly scores according to time sequence dependent strengths to obtain a final anomaly score of the node, determining a detection threshold according to the final anomaly score, and marking an anomaly to obtain an anomaly detection result.

5. The method of claim 4, wherein, constructing a time sequence smoothing constraint based on a time sequence dependent relationship, the time sequence smoothing constraint being realized by minimizing the difference between global anomaly scores of time sequence related nodes, propagating and optimizing the global anomaly scores according to time sequence dependent strengths to obtain a final anomaly score of the node, determining a detection threshold according to the final anomaly score, and marking an anomaly to obtain an anomaly detection result. The time sequence dependency relationship is constructed, and a dynamic graph neural network is used to calculate the time sequence dependency strength of a time sequence related node pair, the dynamic graph neural network comprising a time sequence query matrix and a time sequence key matrix, the node feature vectors being transformed through the time sequence query matrix and the time sequence key matrix, and the time sequence dependency strength of the node pair being calculated in combination with a time interval attenuation function; A smooth constraint objective function is constructed based on the time sequence dependency strength, the smooth constraint objective function comprising a smooth loss term and a causal loss term, the smooth loss term being based on the time sequence dependency strength to calculate the square difference of the global anomaly score of the related nodes, and the causal loss term being based on the intervention operation to calculate the deviation of the global anomaly score of the nodes from the expected value; An anomaly score propagation function is designed, the global anomaly score of the nodes is iteratively updated according to the time sequence dependency strength, and the smooth constraint objective function is taken as an optimization objective, the global anomaly score is optimized through a gradient descent method, and a penalty term is introduced in each iteration to constrain the change amplitude of the global anomaly score; The optimized global anomaly score is subjected to multi-scale fusion, and the final anomaly score of the nodes is calculated based on the global anomaly scores of different scales and corresponding weights.

6. The method of claim 1, wherein, The abnormality verification is modeled as a sequential decision process based on deep reinforcement learning, a bidding compliance verification path is dynamically generated based on the abnormality detection result and the auxiliary data, a compliance evaluation result is obtained by optimizing the verification path, and the steps of generating an audit report include: A verification feature vector is constructed based on the abnormality detection result, the verification feature vector is combined with the auxiliary data to construct a verification state space and a verification action space, and the verification state space comprises the verification feature vector and a historical verification decision sequence; A verification policy generation network is constructed based on the verification state space and the verification action space, the verification policy generation network uses a variational autoencoder to encode the verification feature vector to obtain a latent representation of an abnormality pattern, a verification policy distribution is constructed based on the latent representation, and a verification action sequence is generated according to the verification policy distribution; A verification evaluation function comprising a verification accuracy term, a verification cost term and a decision consistency term is constructed, the verification evaluation function is optimized by sampling using a Thompson sampling method, and an optimal verification action sequence is obtained, and the verification path is determined according to the optimal verification action sequence; The verification process is performed along the verification path, the time sequence compliance index, the spatial consistency index and the text semantic similarity index are calculated for each verification node, a multi-dimensional risk dependency matrix is constructed based on the time sequence compliance index, the spatial consistency index and the text semantic similarity index, a multi-dimensional risk joint distribution is calculated using a Copula function, and a compliance evaluation result is output; abnormal spatio-temporal pattern information and its propagation path are extracted based on the compliance evaluation result, and an audit report is generated.

7. The method of claim 6, wherein, The steps of constructing a verification evaluation function comprising a verification accuracy term, a verification cost term and a decision consistency term, and optimizing the verification evaluation function by sampling using a Thompson sampling method to obtain an optimal verification action sequence include: The verification accuracy term is calculated based on an anomaly detection rate corresponding to the verification action sequence, the verification cost term is calculated based on resource consumption of a verification depth and a verification range, and the decision consistency term is calculated based on a policy difference of adjacent verification actions; A Bayesian neural network is used to implement a Thompson sampling method to establish a posterior distribution of the verification evaluation function, and a weight distribution of the Bayesian neural network is trained based on a historical verification decision sequence to obtain a probabilistic representation of the verification evaluation function; At each round of verification decision, an instance of the current verification evaluation function is sampled from the posterior distribution based on the Thompson sampling principle, a candidate verification action sequence is scored based on the instance of the current verification evaluation function, and the verification action sequence with the highest score is selected as the optimal verification action sequence; The posterior distribution is updated according to verification feedback information, and exploration and utilization are balanced by adaptively adjusting a sampling temperature parameter, which decreases with an increase in verification rounds.

8. An electronic device, comprising: Comprise: a processor; a memory for storing processor-executable instructions; wherein the processor is configured to invoke the instructions stored in the memory to perform the method of any one of claims 1 to 7.

9. A computer-readable storage medium having stored thereon computer program instructions, wherein, The computer program instructions, when executed by the processor, implement the method of any one of claims 1 to 7.

Images