A system and method for advertisement delivery anomaly monitoring and alarm throttling

Abstract

This invention provides a system and method for monitoring and alarming traffic limiting in ad delivery, aiming to solve the problems of slow response, high false positive and false negative rates, and inability to automatically mitigate losses in existing systems. The system integrates modules such as multimodal data acquisition, real-time stream processing, feature engineering, multimodal fusion anomaly detection, alarm notification, and automatic traffic limiting protection, forming an integrated real-time protection capability. This invention employs a multimodal fusion detection method combining deep learning and statistical analysis, supporting the identification of abnormal behavior by an autoencoder model based on reconstruction error. Simultaneously, it constructs an automated traffic limiting mechanism that can trigger real-time traffic limiting and blocking measures in conjunction with the ad system after anomaly identification. Experiments show that this invention can significantly improve detection accuracy and shorten response time, demonstrating broad practical application value.

Description

Technical Field

[0001] This invention belongs to the field of internet advertising placement and anti-fraud detection technology, and in particular relates to an advertising placement anomaly monitoring and alarm system based on multimodal data fusion and deep statistical learning. Background Technology

[0002] "Ad placement anomalies" specifically refer to abnormal behaviors or data patterns that deviate from normal business practices during ad placement, potentially leading to wasted advertising resources or economic losses. Key anomaly types include clicks triggered by non-genuine user behavior; such as malicious clicks from competitors, script-simulated clicks, and click fraud tools; ineffective spending and impressions; for example, paying for advertising but not generating any real value; and ads displayed on invalid traffic sources (zombie apps, crawler pages). Therefore, it is necessary to detect "ad placement anomalies."

[0003] Current advertising anomaly detection systems have several limitations, primarily in the following aspects: First, static rule-based detection methods typically use fixed thresholds for judgment, such as setting a click frequency cap to identify abnormal behavior. However, these methods struggle to cope with constantly evolving new fraudulent techniques and have poor adaptability. Second, post-event detection mechanisms relying on log backtesting and manual analysis can identify some anomalies, but they suffer from significant response delays and cannot stop losses in time when fraud occurs, leading to increased losses. Third, single-modal detection systems often rely on only one type of log data (such as click logs or consumption logs). Due to the limited information dimensions, they are prone to false positives or false negatives, resulting in insufficient accuracy. Finally, although some systems have introduced machine learning algorithms, they generally rely on a large number of labeled historical samples, leading to high training costs and insufficient generalization ability when facing new fraud patterns, resulting in unsatisfactory real-time detection performance. In summary, existing methods have significant deficiencies in terms of detection accuracy, timeliness, and adaptability. Therefore, there is an urgent need for a system that can identify abnormal advertising behavior in real time with high accuracy and a low false positive rate, and automatically trigger alarms and rate limiting protection mechanisms. Summary of the Invention

[0004] The purpose of this invention is to provide an advertising delivery anomaly monitoring and alarm system and method. By constructing a feature system that integrates multimodal data such as clicks, impressions, consumption, and user behavior, and combining it with an anomaly detection algorithm that combines deep learning and statistical analysis, along with a real-time stream processing framework and an automated rate limiting control mechanism, this invention solves the problems of slow response, large detection error, and inability to automatically limit rates in existing advertising anomaly detection systems. It provides an integrated system that supports multimodal real-time detection and automatic rate limiting and loss mitigation mechanisms.

[0005] According to a first aspect of the embodiments of this specification, a system for monitoring and alarming traffic limiting for abnormal advertising delivery is provided, characterized in that the system comprises:

[0006] The data acquisition module is used to collect click logs, impression logs, consumption logs, user behavior data and conversion data from data sources related to ad placement in real time, and transmit them to subsequent modules through a distributed message queue;

[0007] The real-time data processing module is used to clean, convert, handle missing values, and perform preliminary aggregation on the data.

[0008] The feature engineering module is used to construct multimodal feature vectors based on the cleaned data, including click modality features, exposure modality features, consumption modality features and user behavior modality features, and to perform normalization and standardization processing.

[0009] A multimodal fusion anomaly detection module is used to perform real-time analysis on the feature vector based on a fusion deep learning model and statistical detection algorithm, and generate anomaly scores. The deep learning model includes a recurrent neural network, an autoencoder, or a Transformer model, and the statistical detection algorithm includes an exponentially weighted moving average (EWMA) algorithm, a 3σ statistical method, or a density clustering method.

[0010] The alarm and notification module is used to generate alarm information based on the anomaly score and type, and push the anomaly information to the preset responsible persons via SMS, email, instant messaging tools or Webhook interface;

[0011] The automated traffic limiting protection module is used to automatically limit, pause, or adjust the delivery of ads based on preset policy rules after abnormal advertising behavior is identified, thereby achieving real-time blocking of abnormal traffic and stopping losses in delivery.

[0012] Preferably, the multimodal fusion anomaly detection module adopts an autoencoder structure based on reconstruction error, and is determined to be an anomaly when the reconstruction error is greater than a set threshold.

[0013] Preferably, the statistical detection algorithm includes an exponentially weighted moving average (EWMA) algorithm, which is used to monitor the mean drift of key indicators such as click frequency and consumption rate, and trigger an abnormal warning when the deviation exceeds a certain multiple of the historical mean, such as 3σ.

[0014] Preferably, the automated rate limiting protection module has a policy configuration engine that can dynamically match rate limiting measures according to the type and level of the anomaly.

[0015] Another aspect of the present invention is to provide a method for monitoring and alarming traffic limiting for abnormal advertising delivery, the method comprising the following steps:

[0016] S1. Data collection steps: The data collection module collects multi-source advertising data from the advertising platform, including click logs, impression logs, consumption logs, user behavior data, and conversion data, and writes it into a high-throughput message queue.

[0017] S2. Real-time processing steps: The real-time data processing module processes the received raw data, associates it with the advertising metadata in real time, and performs preliminary aggregation by sliding window according to advertising ID, user ID, IP, etc.

[0018] S3. Multimodal feature construction steps: The feature engineering module constructs high-dimensional multimodal feature vectors based on multimodal data, and performs standardization and state management;

[0019] S4. Anomaly Detection Step: Input the above feature vectors into the multimodal fusion anomaly detection module, and use a fusion detection algorithm that combines an autoencoder or recurrent neural network with EWMA and 3σ statistical methods to score the advertising behavior and output the anomaly score.

[0020] S5. Alarm Triggering Steps: If the abnormal score exceeds the set threshold, the alarm and notification module will generate alarm information of the corresponding level according to the preset rules and send it to the designated personnel or system via SMS, email, enterprise communication tools or Webhook interface.

[0021] S6. Rate limiting execution steps: The automated rate limiting protection module receives alarms, matches response strategies according to the type and level of the anomaly, generates rate limiting commands, and synchronizes the rate limiting commands to the advertising platform for execution via API or message queue.

[0022] Preferably, the anomaly detection step includes using a deep learning model based on LSTM or an autoencoder to capture the temporal features of click behavior, and combining the exponentially weighted moving average (EWMA) algorithm with the statistical analysis method of the 3σ principle to perform anomaly scoring fusion judgment.

[0023] Preferably, the anomaly detection step includes:

[0024] The feature vector is modeled using an autoencoder structure based on reconstruction error;

[0025] After performing reconstruction, calculate the reconstruction error between the input feature vector and the reconstructed vector;

[0026] When the reconstruction error exceeds a set threshold, the data corresponding to the feature vector is determined to be abnormal.

[0027] This invention addresses the problems of slow response, large detection errors, and inability to automatically stop losses in existing advertising anomaly detection systems by constructing a real-time feature system that integrates multimodal data such as clicks, impressions, consumption, and user behavior. It employs an anomaly detection algorithm combining deep learning and statistical analysis, along with a streaming computing framework and automated rate limiting mechanism. The system boasts millisecond-level response capabilities, completing anomaly identification and triggering rate limiting control within 100-300 milliseconds. Through multimodal modeling and algorithm fusion, it effectively identifies complex and concealed fraudulent behaviors, achieving an accuracy rate exceeding 97% and a recall rate exceeding 93%. It also supports automatic rate limiting based on anomaly levels, reducing manual intervention and improving loss mitigation efficiency. Furthermore, the system features flexible strategy configuration capabilities and data processing scalability up to tens of millions of QPS, making it widely adaptable to high-concurrency and highly sensitive advertising scenarios, significantly enhancing the risk control capabilities and business stability of advertising platforms. Attached Figure Description

[0028] To more clearly illustrate the technical solutions in the embodiments or related technologies of this specification, the drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0029] Figure 1 The overall system architecture diagram for the advertising delivery anomaly monitoring, alarm, and traffic limiting system;

[0030] Figure 2 This is a flowchart of the overall workflow for an advertising placement anomaly monitoring, alarm, and traffic limiting system. Detailed Implementation

[0031] The technical solutions in the embodiments of this specification will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0032] It should be noted that the terms "comprising" and "having," and any variations thereof, in the embodiments and drawings of this specification are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or device that includes a series of steps or units is not limited to the steps or units listed, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to these processes, methods, products, or devices.

[0033] The following examples are combined Figure 1The technical solution of the present invention will be described in detail to demonstrate the system functional modules and their collaborative mechanism.

[0034] The data acquisition module 10 in this invention is used to acquire raw data in real time from each stage of the advertising delivery chain, ensuring that the system has a comprehensive and accurate monitoring foundation. This module supports multiple data sources, including click logs, impression logs, consumption logs, user behavior data, and advertising conversion data. The collected content covers multi-dimensional information such as user click time, IP address, device information, ad ID, billing type, user profile, and conversion behavior, providing rich data support for subsequent anomaly detection.

[0035] In terms of data collection methods, the system achieves stable access to server-side data through distributed log collection tools (such as Apache Flume and Logstash) and a self-developed agent program. Simultaneously, it integrates an SDK into the mobile app to enable real-time uploading of client behavior data; some platform data is obtained synchronously through API interfaces. All collected data is uniformly aggregated into a high-performance distributed message queue (such as Apache Kafka). By dividing topics by type and rationally partitioning them, the system decouples different data streams such as clicks, impressions, and consumption, and supports high concurrency, providing a reliable data foundation for subsequent real-time processing and feature construction.

[0036] The real-time data processing module 20 is responsible for preprocessing, cleaning, parsing, and initially aggregating the collected raw advertising data, providing accurate and reliable basic data support for subsequent feature engineering and anomaly detection. The system preferentially uses Apache Flink (Apache Flink is an open-source, high-throughput, low-latency, event-time processing distributed real-time stream processing engine. Flink supports stateful computation, windowing mechanisms, and rich connection operations, making it particularly suitable for complex real-time data analysis scenarios. In this invention, Apache Flink is used to build the real-time data processing module, realizing real-time cleaning, aggregation, and feature construction of multi-source data such as ad clicks, impressions, and consumption, and providing a low-latency, high-timeliness input data stream for the anomaly detection module. Flink's Exactly-Once semantic guarantee ensures the accuracy and reliability of data processing) as the stream processing engine. Leveraging its event-time processing, state management, and low-latency characteristics, it can achieve high-throughput, highly stable real-time computation.

[0037] During data processing, the module deduplicates, validates, and converts the received log data, handles missing values, and filters out dirty data, such as invalid IPs or outdated timestamps. Simultaneously, the system resolves IP addresses to geographic locations, parses User-Agents to extract device and browser information, and correlates this with advertising metadata (such as advertisers, ad placements, and historical blacklists) in real time to enrich the data context. Building upon this, the system uses rolling windows (e.g., 1-minute, 5-minute, 10-minute intervals) to aggregate key metrics in real time, such as calculating the clicks and spending for each IP, user, and ad placement within the window period, providing structured input for subsequent feature construction.

[0038] Feature engineering module 30 is one of the core components of this invention. It aims to construct multimodal, high-dimensional, and highly discriminative feature vectors based on real-time processed data to drive subsequent anomaly detection models. This module extracts various temporal features, behavioral features, regional features, fluctuation features, and behavioral consistency indicators for different modalities such as clicks, consumption, exposure, and user behavior. For example, the click modality includes the frequency of clicks from the same IP address within a short period, click intervals, and click path regularity; the consumption modality covers the consumption rate per unit time and the degree of deviation from historical consumption.

[0039] To achieve efficient feature extraction, the system combines Flink's sliding window and rolling window mechanisms to continuously calculate and update various metrics in the time series, and records historical states through a state management mechanism to ensure the continuity and consistency of feature calculation. To eliminate scale differences between features, the module performs feature standardization or normalization. Simultaneously, the generated feature vectors can be directly sent to the anomaly detection module or written to a real-time feature storage system (such as Redis or Feast) to support subsequent model training and policy iteration. This module achieves structured fusion of multi-source data, providing a solid data representation foundation for accurately identifying abnormal behavior.

[0040] The multimodal fusion anomaly detection module 40 is a core component of the system of this invention. It is primarily responsible for real-time analysis of the multimodal feature vectors output by the feature engineering module, generating anomaly scores, and determining whether advertising behavior is abnormal. This module integrates deep learning models and statistical analysis methods, enabling it to model complex nonlinearities and temporal dependencies in data, as well as efficiently capture sudden and boundary-type anomalies, achieving accurate identification.

[0041] During deep learning, the system can optionally employ models such as Recurrent Neural Networks (RNNs), Long Short-Term Memory Networks (LSTMs), and Gated Recurrent Units (GRUs) to model the time-series features of clicks and data consumption, supplemented by an attention mechanism to enhance the ability to identify key anomaly signals. For scenarios with higher feature dimensions or more complex patterns, a Transformer structure can be used for global modeling. Autoencoders and Variational Autoencoders (VAEs) are used for reconstruction error analysis, suitable for identifying unseen types of fraudulent behavior. Simultaneously, the system utilizes statistical detection algorithms (such as EWMA, CUSUM, 3σ rule, IQR rule, and density clustering) to improve the detection capabilities for extreme fluctuations and low-frequency anomalies.

[0042] To integrate the outputs of different models, the system employs a score fusion and decision fusion mechanism, employing strategies such as weighted summation, maximum value calculation, and voting rules to derive the final anomaly score. This module supports offline training and real-time inference. The model is deployed as a microservice interface via GPU / high-performance CPU and is periodically iterated and updated based on detection feedback and new samples, ensuring the model possesses good generalization ability and fraud adaptability.

[0043] The alarm and notification module 50 is used to promptly trigger multi-level alarms and push them to relevant personnel based on the anomaly score and type after detecting abnormal advertising behavior, thereby ensuring that the system can quickly respond to and intervene in risky traffic. This module supports flexible alarm rule configuration, including setting anomaly score threshold, alarm frequency limits, anomaly level classification (such as P0 / P1 / P2), and fine-grained allocation of alarm recipients.

[0044] In terms of alert delivery methods, the system supports multiple channels such as SMS, telephone, email, instant messaging tools (such as DingTalk, WeChat Work, Lark, etc.), and Webhook interfaces, ensuring that abnormal events can be quickly and accurately communicated to relevant personnel such as operations, risk control, and technical support in different scenarios. Each alert message includes the anomaly type and score. Optionally, it also includes key fields such as the scope of impact, ad ID, and user / IP information, and provides a link to a visual dashboard for quick location and follow-up processing.

[0045] To avoid the "alarm storm" problem (an "alarm storm" refers to the phenomenon where a large number of repetitive alarm messages are triggered and pushed within a short period of time due to frequent abnormal events or unreasonable alarm policy settings, causing interference, stress, or even "paralysis" to operation and maintenance personnel or the system), the system introduces an alarm suppression and aggregation mechanism. This mechanism merges duplicate or similar alarms within the same time window, or retains only critical alarms and continuously updates their status. This mechanism improves the readability and processing efficiency of alarm information, making the alarm system both sensitive and not excessively disruptive, ensuring the platform's operational stability under large-scale data flows.

[0046] The automated traffic limiting protection module 60 automatically executes protective operations such as traffic limiting, pausing, or adjusting ad delivery based on preset policy rules after abnormal advertising behavior is identified, thereby achieving real-time blocking of abnormal traffic and mitigating delivery losses. Through close integration with the anomaly detection module, this module can automatically match appropriate response strategies based on the type of anomaly (such as click fraud, sudden increases in spending, abnormal CTR, etc.) and severity (such as P0 / P1 levels), quickly intervening in potential risks without manual intervention.

[0047] To ensure coordinated operation of the aforementioned modules and to achieve monitoring, alarm suppression, and aggregation functions, this system proposes a specific monitoring and alarm method. See [link / reference]. Figure 2 This method processes and analyzes data through a series of ordered steps to achieve intelligent merging and accurate presentation of monitoring alarms. The specific implementation steps of this method are as follows:

[0048] Step S1: Data input and output of the data acquisition module

[0049] In this embodiment, the advertising delivery system acquires raw behavioral data in real time from multiple data sources through a data acquisition module. The collected content includes: user click logs (including click time, IP address, device ID, ad ID, etc.), exposure logs (including display time, ad slot ID, device ID, etc.), consumption logs (including consumption amount, ad ID, billing type, etc.), user behavior data (such as page dwell time, conversion behavior), and ad conversion logs (such as registration, order placement, etc.).

[0050] Data is aggregated in real-time to a Kafka message queue via log brokers (such as Apache Flume), SDKs, and third-party APIs. Each data category corresponds to an independent Topic (such as click_topic, expose_topic), ensuring clear data categorization and a defined flow. The technical effect of this step is to achieve comprehensive collection and real-time distribution of advertising behavior data, ensuring the system has a high-quality, high-concurrency input data foundation.

[0051] Step S2: The real-time data processing module performs cleaning and aggregation.

[0052] After data collection is completed, the real-time data processing module (based on Apache Flink) consumes various types of raw log data from Kafka and performs data cleaning, formatting and transformation, field validation, outlier filtering and correlation processing operations.

[0053] For example, the system associates the click behavior data of an IP address 112.86.0.133 (not a real address, but only an illustrative technical assumption) with user agent information to resolve its device model and operating system; then, it determines its geographical origin through IP address geolocation resolution. With a rolling processing time window of 1 minute, the system initially aggregates the clicks from this IP address, recording it as 34 clicks per minute.

[0054] This step outputs a structured, clean data stream, laying the foundation for the feature engineering module to build high-quality feature vectors. Through Flink's windowing mechanism and state management, the system achieves low-latency, highly stable real-time data preprocessing capabilities.

[0055] Step S3: The feature engineering module constructs multimodal feature vectors.

[0056] After receiving the real-time aggregated data, the feature engineering module extracts various structured features across multiple modalities, including ad clicks, impressions, spending, and conversions. In this example, the system extracts the following features from the behavior of 112.86.0.133 over a 5-minute period: click frequency of 0.44 times per second, ad spending of 136.8 yuan, average page dwell time of 1.1 seconds, and conversion rate of less than 1%.

[0057] Simultaneously, this module performs Z-score (also known as "standard deviation score," a statistical indicator that measures the distance between a data point and the overall average) standardization on ad spending data. The historical average spending is 85 yuan, the standard deviation is 8 yuan, and the current value is 136.8 yuan, resulting in a deviation value Z = 6.6. Furthermore, features such as click frequency are also standardized, ultimately forming a feature vector. .

[0058] in, This means that the vector formed by concatenating all the normalized features mentioned above is used as the multidimensional feature representation for the model input.

[0059] This represents the time window characteristics in the click modality, such as the click frequency of a certain IP or user ID per unit time, after being calculated and standardized by a sliding window.

[0060] The volatility characteristics in the consumption modality, such as the percentage deviation of ad spending from the historical mean over the past 5 minutes (ΔCost), are also standardized. It represents the modal characteristics of user behavior, such as whether a click leads to a conversion (registration, order placement), average dwell time, and other user behavior data, which are then normalized / encoded and comprehensively represented.

[0061] Through sliding window computation and feature standardization, this module ensures that multimodal features have a uniform scale, high discriminative power, and strong temporal sensitivity, providing accurate input for subsequent anomaly detection.

[0062] Step S4: The multimodal fusion anomaly detection module performs anomaly score calculation.

[0063] After the feature vector is input, the multimodal fusion anomaly detection module first uses a deep learning model (such as an autoencoder) to reconstruct the vector, obtaining the anomaly reconstruction error of the vector. Meanwhile, the statistical model, based on EWMA and the 3σ principle (a widely used outlier detection criterion in statistics, especially applicable to data that follows or approximately follows a "normal distribution"), calculates deviations in advertising expenditure, identifies them as extreme anomalies, and sets statistical scores accordingly. .

[0064] The system uses a score fusion strategy to calculate the final anomaly score:

[0065]

[0066] The score far exceeds the preset alarm threshold. The model outputs a label indicating "click fraud + abnormal spending". This module leverages the strengths of depthwise and statistical methods, effectively improving the ability to identify complex fraudulent behavior.

[0067] Step S5: The alarm and notification module triggers tiered alarms.

[0068] The anomaly detection results are sent to the alarm and notification module. Due to the anomaly score... The system classified it as the highest level (P0 level) alarm and immediately pushed an anomaly notification to the advertising operations team and the technical support team via SMS and WeChat.

[0069] The alert content includes key information such as the abnormal score, abnormal type, occurrence time, ad ID, source IP, click volume and cost, and comes with a link to a visualization panel for quick location.

[0070] In addition, the alarm system also aggregates anomalies of the same advertisement within the past 5 minutes to avoid repeated pushes, thereby improving the readability and operational efficiency of alarm information.

[0071] Step S6: The automated current limiting protection module performs current limiting operations.

[0072] After receiving the alarm information, the current limiting protection module matches the abnormality type and response action according to the preset strategy table.

[0073] In this example, the system determines the behavior to be severe click fraud + abnormal data consumption, and automatically implements the following rate limiting measures:

[0074] Call the block_ip("112.86.0.133", duration=1800) interface to block access to this IP address for 30 minutes;

[0075] Call the pause_ad("Ad_778892") interface to pause the ad display for this ad slot.

[0076] The rate-limiting command is delivered to the advertising system in real time via API or message queue, and the system continuously tracks behavioral data after the rate limit is implemented. Within 5 minutes of the rate limit being implemented, the number of clicks from this IP address dropped from 132 to 7, the cost dropped from 136.8 yuan to 5.2 yuan, the conversion rate rebounded to 6.3%, and the loss prevention rate reached 96%.

[0077] The module's automated traffic limiting mechanism effectively blocks malicious traffic paths, significantly reducing advertisers' losses while minimizing interference with normal traffic.

[0078]

[0079] Table 1. Evaluation of the technical effects before and after flow restriction

[0080] Those skilled in the art will understand that the accompanying drawings are merely schematic diagrams of one embodiment, and the modules or processes shown in the drawings are not necessarily essential for implementing the present invention.

[0081] Those skilled in the art will understand that the modules in the apparatus of the embodiments can be distributed in the apparatus of the embodiments as described in the embodiments, or they can be located in one or more devices different from this embodiment with corresponding changes. The modules of the above embodiments can be combined into one module, or they can be further divided into multiple sub-modules.

[0082] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. An advertisement delivery anomaly monitoring and alert throttling system, characterized in that, The system includes: The data acquisition module (10) is used to collect multi-source heterogeneous data, including click logs, exposure logs, consumption logs, user behavior data and conversion data, from advertising-related data sources in real time. The data acquisition module (10) uses a distributed log collection tool to uniformly aggregate the data into a distributed message queue and store it in partitions according to data type. The real-time data processing module (20) is used to clean, convert, filter outliers and perform preliminary aggregation on the aggregated multi-source heterogeneous data. The real-time data processing module (20) uses a stream processing engine to perform exactly-once semantic processing on the data. The feature engineering module (30) is used to construct a multimodal feature vector based on the cleaned data. The feature engineering module (30) extracts time-series features, behavioral features, regional features, fluctuation features and behavioral consistency indicators for different modalities of click, consumption, exposure and user behavior. It continuously calculates and updates various indicators in combination with Flink's sliding window and rolling window mechanism. The multimodal fusion anomaly detection module (40) is used to perform real-time analysis on the feature vector based on the fusion deep learning model and statistical detection algorithm, and generate anomaly scores. The deep learning model includes a recurrent neural network, an autoencoder or a Transformer model, and the statistical detection algorithm includes an exponentially weighted moving average algorithm, a 3σ statistical method or a density clustering method. The alarm and notification module (50) is used to generate alarm information and push it according to the anomaly score and type. The alarm and notification module (50) supports the fine allocation of anomaly level division P0, P1, P2 and alarm receiving objects, and introduces an alarm suppression and aggregation mechanism to merge repeated or similar alarms within the same time window. An automated rate limiting protection module (60) is used to automatically execute differentiated rate limiting measures based on preset policy rules after abnormal advertising behavior is identified. The automated rate limiting protection module (60) automatically matches response strategies according to the type and severity of the abnormality. The abnormality types include at least click fraud, sudden increase in consumption, and abnormal CTR. The severity levels include at least P0 and P1 levels. The module blocks abnormal IPs and suspends abnormal ad placements by calling the rate limiting interface. The differentiated rate limiting measures include at least calling the rate limiting interface to block abnormal sources, suspending the delivery of abnormal ad placements, and continuously monitoring the rate limiting effect.

2. The system of claim 1, wherein, The multimodal fusion anomaly detection module (40) adopts an autoencoder structure based on reconstruction error, and is determined to be abnormal when the reconstruction error is greater than a set threshold.

3. The system according to claim 1, wherein the statistical detection algorithm includes an exponentially weighted moving average algorithm, used to monitor the mean drift of key indicators such as click frequency and consumption rate, and to trigger an abnormal warning when the deviation exceeds a certain multiple of the historical mean.

4. The system of claim 1, wherein, The automated rate limiting protection module (60) has a policy configuration engine that can dynamically match rate limiting measures according to the type and level of the anomaly.

5. A method for advertisement delivery anomaly monitoring and alerting throttling, the method comprising: Includes the following steps: S1. Data collection steps: Collect multi-source heterogeneous data in real time from data sources related to advertising, including click logs, impression logs, consumption logs, user behavior data and conversion data. Then, aggregate the data in real time to a distributed message queue through a distributed log collection tool and store it in partitions according to data type. S2. Real-time processing steps: Cleaning, format conversion, outlier filtering and preliminary aggregation of the aggregated multi-source heterogeneous data; using a stream processing engine to perform exactly-Once semantic processing on the data. S3. Multimodal feature construction steps: Construct multimodal feature vectors based on the cleaned data, extract time-series features, behavioral features, regional features, fluctuation features and behavioral consistency indicators for different modes of advertising data, and continuously calculate and update various indicators by combining sliding window and rolling window mechanisms; S4. Anomaly detection steps: Input the above feature vectors into the multimodal fusion anomaly detection module (40), and use a fusion detection algorithm that combines an autoencoder or recurrent neural network with EWMA and 3σ statistical methods to score the advertising behavior and output the anomaly score; S5. Alarm Triggering Steps: Based on the anomaly score and type, generate alarm information of corresponding level. The system classifies anomalies into P0, P1, and P2 levels. The alarm system aggregates anomalies of the same advertisement within the past 5 minutes, supports multi-level alarm classification and fine-grained allocation of alarm receiving objects, and merges duplicate or similar alarms. S6. Traffic limiting execution steps: Match the response strategy according to the anomaly type and level, call the block_ip interface to block abnormal IP access permissions and call the pause_ad interface to pause the corresponding ad placement. The system continuously tracks the behavior data after traffic limiting to evaluate the stop loss rate. Differentiated traffic limiting measures include at least calling the traffic limiting interface to block the source of the anomaly, pausing the placement of abnormal ad placements, and continuously monitoring the traffic limiting effect.

6. The method according to claim 5, characterized in that: The anomaly detection step includes using a deep learning model based on LSTM or an autoencoder to capture the temporal features of click behavior, and combining an exponentially weighted moving average algorithm with a statistical analysis method based on the 3σ principle to perform anomaly scoring fusion judgment.

7. The method according to claim 5, wherein the anomaly detection step comprises: The feature vector is modeled using an autoencoder structure based on reconstruction error; After performing reconstruction, calculate the reconstruction error between the input feature vector and the reconstructed vector; When the reconstruction error exceeds a set threshold, the data corresponding to the feature vector is determined to be abnormal.

Images