Illegal behavior prediction method based on dynamic slicing and double-branch confrontation

Abstract

The invention belongs to the technical field of data processing methods for prediction purposes, and particularly relates to an illegal behavior prediction method based on dynamic slicing and double-branch confrontation. The method comprises the following steps: collecting a multi-dimensional network transaction illegal behavior commodity time sequence data set; constructing an illegal behavior time sequence prediction model; inputting the time sequence data set into a dynamic slice length adjusting module, performing dynamic slicing on the data set, and performing standardization processing on each slice; inputting the standardized data into a difference perception time sequence prediction module for processing; inputting the standardized data into a dynamic statistical feature prediction module for processing; and the prediction result of the difference perception time sequence prediction module and the prediction result of the dynamic statistical feature prediction module are fused as a final time sequence prediction result. According to the method, the problems of non-stationarity, long-range dependence and robustness to abnormal data and event data in a time sequence prediction scene are solved.

Description

Technical Field

[0001] This invention belongs to the technical field of data processing methods for prediction purposes, and more specifically, relates to a method for predicting illegal behavior based on dynamic slicing and dual-branch adversarial methods. Background Technology

[0002] Time series forecasting has always been an important but challenging task. Current methods still face three major paradigm flaws: First, anomalous and sudden events (such as holidays) in network behavior data cause non-stationary evolution of the representation space, leading to time-varying statistical properties and pattern drift; second, low-frequency sudden events are often misclassified as outliers, resulting in the loss of key time-series features; third, the single-scale modeling paradigm severs the cross-scale spatiotemporal correlation between long-range dependencies and local fluctuations, forming a key bottleneck in model inference. These flaws collectively lead to degradation in prediction accuracy, bias in correlation measurement, and spatiotemporal topological distortion, ultimately limiting the ability to resolve multivariate coupling relationships.

[0003] These challenges are particularly prominent in key applications such as the accurate prediction of risks associated with illegal online transactions: the innovative advancements of the internet have significantly transformed people's lifestyles. Various e-commerce websites provide internet users with an effective and highly relied-upon online environment. However, the rapid evolution of e-commerce has given rise to new types of illegal online transactions (including but not limited to counterfeit goods, prohibited or restricted sales, information asymmetry, and contract violations), which, if not curbed in time, will seriously harm consumers' legitimate rights and interests. Accurately predicting the risks of illegal transactions and taking corresponding measures can significantly reduce the incidence of violations, thereby maintaining fairness in the transaction market and real-time regulation, and promoting the sustainable development of the digital economy ecosystem. However, achieving accurate prediction faces severe challenges: abnormal and event-driven data exacerbate non-stationarity; accurate early warning requires simultaneous insight into both long-term trends and short-term abnormal transaction fluctuations, where traditional methods often fail.

[0004] Existing methods and their representative improvements still have shortcomings: while traditional time series models are theoretically sound, their linear assumptions make it difficult to characterize complex nonlinear relationships; deep learning models suffer from architectural flaws in feature extraction. TCN captures local features through dilated convolutions but lacks global awareness, while Transformer, based on self-attention, achieves global modeling but lacks sensitivity to local temporal patterns. This theoretical gap between linear assumptions and nonlinear modeling, coupled with the architectural imbalance in local / global feature extraction, ultimately limits the performance boundaries of time series prediction. These challenges have spurred numerous targeted improvement schemes. Regarding nonstationarity: RevIN addresses intra-sequence nonstationarity by normalizing each input sequence and adjusting its mean and variance to a relatively standard range; GBT splits the prediction process into two independent stages: an encoder generates preliminary prediction results, and a decoder learns the intra-sequence relationships. This two-stage decoupling directly solves the input / prediction window distribution shift caused by nonstationarity. For robustness to anomalies / events: DARF enhances robustness to anomalies by separating out anomaly interference through a seasonal-trend decomposition decoder, and improves robustness to both anomalous and event data by minimizing the difference in feature distributions between the two domains through a domain discriminator. For long-short-term dependency modeling: MG-Autoformer captures the temporal patterns of both short-term fluctuations and long-term trends simultaneously through multi-resolution downsampling and a shared query-key mechanism.

[0005] Nevertheless, existing methods still face significant limitations in addressing the core challenges of predicting illegal online transactions: most work focuses on a single challenge and lacks a unified framework for the synergistic optimization of nonstationarity, robustness to events and anomalies, and cross-scale modeling. Summary of the Invention

[0006] The present invention aims to overcome at least one of the defects of the prior art and provide a method for predicting illegal behavior based on dynamic slicing and dual-branch adversarial, so as to solve the problems of non-stationarity, long-range dependence and robustness to abnormal data and event data in time series prediction scenarios.

[0007] The detailed technical solution of this invention is as follows: A method for predicting illegal behavior based on dynamic slicing and dual-branch adversarial mechanisms, the method comprising: S1. Collect a multi-dimensional time-series dataset of goods involved in illegal online transactions; S2. Construct a time series prediction model for illegal behavior, including: a dynamic slice length adjustment module, a difference-aware time series prediction module, and a dynamic statistical feature prediction module; S3. The time series dataset is used as the input to the illegal behavior time series prediction model. It is first input into the dynamic slice length adjustment module. The dataset is dynamically sliced ​​through the variance-driven adaptive decision-making mechanism, and each slice is standardized to solve the non-stationarity problem in the time series data. S4. Input the standardized data into the difference-aware time series prediction module for processing, which includes the following steps: S41. Spatiotemporal feature enhancement is achieved through a parallel fusion mechanism of graph convolutional neural network and TCN-Transformer. S42. Seasonal components in time series are extracted through Fourier series decomposition and adaptive parameter learning, trend components in time series are captured through multinomial regression and time feature extraction, and the two are combined to generate prediction results. S43. Feature alignment between event data and regular data is achieved through a joint optimization framework of adversarial domain alignment and Wasserstein distance optimization. S5. Input the standardized data into the dynamic statistical feature prediction module and process it using a lightweight neural network: For the prediction of the standard deviation of future slices, a non-negative activation constraint is introduced to preserve the physical meaning; for the prediction of the mean of future slices, the network no longer directly predicts the absolute value, but learns the mean of the current slice. Compared with historical global average The residual mode; S6. The prediction results of the difference-aware time series prediction module and the prediction results of the dynamic statistical feature prediction module are fused together to obtain the final time series prediction result.

[0008] According to a preferred embodiment of the present invention, the multi-dimensional online transaction illegal behavior commodity time series dataset refers to a collection of multi-dimensional fluctuation feature sequence data reflecting commodity attributes and different types of changes over time within a certain period of time. The multi-dimensional fluctuation feature sequence data is indexed by timestamps and records the dynamic behavioral characteristics and state changes of commodities under different dimensions.

[0009] According to a preferred embodiment of the present invention, the dynamic slice length adjustment module of the illegal behavior time series prediction model dynamically adjusts the slice length based on the variance, adaptively capturing patterns and features at different time scales; The difference-aware time series prediction module consists of three parts: 1) Feature extraction: TCN-Transformer captures short-term and long-term time dependencies, and graph neural network captures spatial dependencies; 2) Seasonal-trend component decomposition: seasonal blocks and trend blocks capture seasonal and trend components respectively, and enhance robustness to anomalous data through seasonal and trend component decomposition; 3) Adversarial training: Minimize the distribution difference between event data and regular data to improve robustness to event data. The dynamic statistical feature prediction module uses a lightweight neural network to predict the mean and variance of future slices based on the mean and variance of the current slice, effectively suppressing the drift of non-stationary temporal distributions. The illegal behavior time series prediction model ultimately merges the output of the difference-aware time series prediction module with the future statistics output of the dynamic statistical feature prediction module through an anti-standardization operation to obtain the final prediction result.

[0010] According to a preferred embodiment of the present invention, in step S3, the core of the variance-driven adaptive decision-making mechanism lies in dynamically adjusting the slice length based on the local real-time variance. Based on this, a dual-window architecture is designed that coordinates the detection window and the execution window—the detection window has a fixed length. Recursively estimating local variance triggers dynamic adjustment of the sliced ​​execution window, specifically including the following steps: S31. By sliding a detection window of fixed length n through the time series data, the local variance intensity within the detection window is calculated in real time. As a core indicator for measuring data volatility: (1) in, and These represent the latest and removed data points in the detection window, respectively. This is the historical average. Based on variance strength Dynamically adjust the length of the execution window slice : Compression when increasing To capture local mutations, Expand when decreasing To maintain trend continuity; S32. For intermittent high-variance scenarios, an exponential decay mechanism is introduced to suppress overreactions: (2) in As the baseline adjustment amount, Control the decay rate, This represents the cumulative number of adjustments.

[0011] According to a preferred embodiment of the present invention, in step S41, the spatiotemporal feature enhancement of the graph convolutional neural network and the TCN-Transformer parallel fusion mechanism specifically includes the following steps: S411. Extracting local temporal features through dilated convolution and residual connections of TCN: First, local temporal patterns are captured using Temporal Convolutional Network (TCN). TCN enhances model expressiveness while maintaining parameter efficiency by integrating dilated causal convolutions and residual connections. Specifically, at each time step... At that time, for the input Perform dilated causal convolution operation: (3) in, Indicates the expansion factor. Indicates the kernel size. This represents the index variable inside the convolution kernel, used to traverse all positions within the convolution kernel. Indicates the convolution kernel at the th... Learnable parameters at each position are used to perform a weighted summation of the input sequence. Indicates time The result of the convolution operation at point , the output sequence after the convolution operation is denoted as . ; Then, by stacking convolution kernels with different dilation factors in layers, Temporal Convolutional Networks (TCNs) can effectively capture multi-scale temporal patterns. The final output of the TCN residual block is denoted as... : (4) in, This represents a learnable weight matrix used to project the input onto the matrix. Using the same dimensional space to achieve residual connections. This represents the multivariate time series input after X undergoes a convolution operation. Indicates input Output after convolution ; S412. Modeling global temporal dependencies using the Transformer self-attention mechanism: To address the long-term temporal dependency problem, a Transformer encoder is cascaded at the TCN backend. A multi-head attention mechanism is used to establish global temporal relationships, specifically for the hidden states of layer l-1. The multi-head attention mechanism computation process is defined as follows: (5) (6) in, Indicates the number of heads of attention. This represents the output weight matrix. Indicates the first The output of one attention head is used to perform a linear transformation on the outputs of multiple attention heads. , and These represent the weight matrices for the query, key, and value, respectively. This indicates the dimension of the attention head query and the key, used to scale the dot product result and prevent gradient vanishing; S413, TCN, and Transformer construct a parallel processing architecture. Through a feature fusion module, convolutional features and self-attention features are integrated to generate a joint representation output that incorporates global and local dependencies. : (7) Here, H represents the hidden state, which is the intermediate representation in the Transformer encoder. This represents the result of the multi-head self-attention mechanism processing the hidden state. concat(.) indicates that the outputs of the TCN and Transformer modules are concatenated to form a richer joint representation.

[0012] S414. Adaptive spatial dependency modeling using graph convolutional neural networks: The implicit structural relationships between nodes are modeled using graph convolutional networks, and higher-order neighbor information is aggregated through multi-level graph convolutional layers to iteratively update node representations. The graph convolution operation is as follows: (8) Where G represents a graph based on an adjacency matrix, Represents an activation function. Represents the learnable parameter matrix, It is an adjacency matrix with self-connections. yes The angle matrix can be used to aggregate information from multiple order neighbors by stacking multiple graph convolution operation layers; S415. By fusing spatiotemporal features through a multilayer perceptron, a spatiotemporal joint representation that combines local perception and global dependence is formed: The final representation of spatiotemporal dependency is obtained through a parameterized spatiotemporal feature interaction mechanism. as follows: (9) in, This represents the decoupling parameters used to decompose features into different parts.

[0013] According to a preferred embodiment of the present invention, step S42 specifically includes the following steps: S421. Extracting seasonal components from time series using Fourier series decomposition and adaptive parameter learning: The seasonal signal is decomposed into a linear combination of multiple sine and cosine functions of different frequencies using Fourier series decomposition. (10) in, Indicates time Seasonal components at the location, and These are the parameters learned by the model, corresponding to the first... The amplitude and phase of each frequency component, It's a seasonal cycle. It is the number of terms in the Fourier series; In addition, different learning parameters are introduced when learning periodic patterns to control the amplitude and phase of each component in the Fourier series, thereby capturing various complex periodic patterns. S422. Capturing trend components in time series through multinomial regression and time feature extraction: Multinomial regression fits a multinomial function to describe the long-term trend of the time series. (11) in, Indicates time The trend components at the location, , , , These are the coefficients of a multinomial regression, used to control for the shape of the trend. It represents the degree of the polynomial. Extracting long-term trend information from time series using polynomial functions can effectively capture both linear and non-linear trend changes in time series. S423. Integrate the seasonal and trend components through multiplication to generate the final prediction result.

[0014] According to a preferred embodiment of the present invention, in step S43, feature alignment between event data and regular data is achieved through a joint optimization framework of adversarial neighborhood alignment and Wasserstein distance optimization, specifically including the following steps: S431. Design the domain discriminator loss function to achieve feature alignment between event data and regular data. Loss function... The definition is as follows: (12) in, Represents the feature encoder. Discriminator for the domain, and These represent the probability distributions of event data and regular data, respectively. and They represent and Based on the observed samples, this optimization mechanism significantly improves the robustness and accuracy of predicting illegal online transaction activities; S432. Wasserstein distance is used as the difference metric to alleviate the gradient vanishing problem in adversarial training, and a gradient penalty term is introduced to enhance training stability. The Wasserstein distance and the gradient penalty term are expressed as follows: (13) (14) in Represents a domain discriminant for 1-Lipschit constraints. Represents the sampling points in the feature space. This is the penalty coefficient.

[0015] According to a preferred embodiment of the present invention, step S5 is specifically as follows: Let the input sequence be The mean of the slices is expressed as The standard deviation is Construct the following parameterized model for the mean of future slices. and standard deviation of future slices Make a prediction: (15) (16) in This represents the local mean shift. Characterizing sequence stationarity; learnable parameters An adaptive weight matrix constituting the feature dimension is used to fuse the residual prediction term and the historical baseline term. This design endows the model with modeling capabilities in two aspects: Capture specific dynamic change patterns of variables. Maintain a reasonable inheritance of historical benchmarks.

[0016] According to a preferred embodiment of the present invention, in step S6, fusing the prediction results of the difference-aware time-series prediction module with the prediction results of the dynamic statistical feature prediction module means using the predicted future slice mean and standard deviation values ​​output by the dynamic statistical feature prediction module to perform de-standardization calculation on the prediction results generated by the difference-aware time-series prediction module on the normalized scale, and reconstructing the final prediction results on the original data scale.

[0017] Compared with the prior art, the beneficial effects of the present invention are as follows: (1)The dynamic slice length adjustment module proposed by the present invention uses a variance-driven adaptive slicing mechanism to intelligently regulate fine-grained cutting during periods of severe fluctuations and coarse-grained aggregation during stable periods, accurately capturing local statistical feature drifts.

[0018] (2)The present invention proposes a dual-branch prediction model architecture, which consists of two parts, namely, a differential-aware time series prediction module and a dynamic statistical feature prediction module. The differential-aware time series prediction module realizes spatio-temporal feature extraction and distribution alignment by integrating the TCN-Transformer hybrid architecture and seasonal-trend decomposition. At the same time, a domain discriminator and a Wasserstein distance joint optimization framework are designed to eliminate the deviation between event data and conventional data. The dynamic statistical feature prediction module further solves the problem of data non-stationarity by predicting the mean and variance of future slices through a lightweight network.

[0019] (3)The present invention combines Fourier series decomposition and polynomial regression to capture seasonal components and trend components respectively, and enhances the expression ability of seasonal components and trend components through multiplicative integration.

[0020] (4)The present invention designs a fusion strategy based on inverse normalization, that is, uses the predicted mean and variance of slices output by the dynamic statistical feature prediction module to reconstruct the prediction result of the differential-aware time series prediction module to obtain the final prediction result on the original data scale, effectively suppressing distribution drift. Description of the Drawings

[0021] Figure 1 is the flowchart of the illegal behavior prediction method based on dynamic slicing and dual-branch confrontation described in the present invention.

[0022] Figure 2 is the structural diagram of the illegal behavior time series prediction model described in the embodiment of the present invention.

[0023] Figure 3 is the comparison chart of the mean square error MSE experimental results between the overall model and the model after removing the key components described in the present invention.

[0024] Figure 4 is the comparison chart of the mean absolute error MAE experimental results between the overall model and the model after removing the key components described in the present invention. Detailed Embodiments

[0025] The following further describes the present disclosure in conjunction with the drawings and embodiments.

[0026] Embodiment 1 Refer Figure 1 , this embodiment provides an illegal behavior prediction method based on dynamic slicing and dual-branch confrontation, and the method includes: S1. Collect a multi-dimensional time-series dataset of goods involved in illegal online transactions; The multi-dimensional online transaction illegal behavior commodity time-series dataset refers to a collection of multi-dimensional fluctuation feature sequence data reflecting commodity attributes and different types of changes over time within a certain period. This multi-dimensional fluctuation feature sequence data is typically indexed by timestamps and records the dynamic behavioral characteristics and state changes of commodities under different dimensions, including but not limited to price fluctuations, illegal labels, and the impact of external events. This type of data exhibits typical time-series characteristics such as high dimensionality, non-stationarity, multi-periodity, and abnormal density, making it suitable for fine-grained modeling and risk prediction of online transaction behavior.

[0027] In one possible implementation, the time-series dataset of the dimensioned goods includes: Product type, geographical distribution, platform attributes, violation timestamp, violation type, and event marker (holidays / promotional activities, etc.).

[0028] In this embodiment of the invention, a time-series dataset with spatiotemporal multidimensional attributes is constructed by collecting multiple different types of product attributes and their related fluctuation characteristics (such as product type, geographical distribution, platform attributes, violation timestamps, violation types, and event markers). This dataset not only includes the basic attributes of the products themselves, but also integrates their performance in different regions and platforms and their correlation with external events (such as holidays and promotional activities), thereby providing sufficient information support for subsequent dynamic slicing processing, spatiotemporal feature extraction, and illegal behavior prediction.

[0029] S2. Construct a time series prediction model for illegal activities, such as Figure 2 As shown, it includes: a dynamic slice length adjustment module, a difference-aware temporal prediction module, and a dynamic statistical feature prediction module; The dynamic slice length adjustment module dynamically adjusts the slice length based on the variance, adaptively capturing patterns and features at different time scales; The difference-aware time-series prediction module comprises three parts: 1) Feature extraction part: TCN-Transformer captures short-term and long-term time dependencies, and graph neural network captures spatial dependencies; 2) Seasonal-trend component decomposition part: seasonal blocks and trend blocks capture seasonal components and trend components respectively, and enhances robustness to anomalous data through seasonal and trend component decomposition; 3) Adversarial training part: minimizes the distribution difference between event data and regular data, and improves robustness to event data. The dynamic statistical feature prediction module uses a lightweight neural network to predict the mean and variance of future slices based on the mean and variance of the current slice, effectively suppressing the drift of non-stationary temporal distributions.

[0030] Finally, the output of the difference-aware time series prediction module and the future statistics output of the dynamic statistical feature prediction module are fused through an inverse standardization operation to obtain the final prediction result.

[0031] S3. The time series dataset is input into the dynamic slice length adjustment module. A variance-driven adaptive decision-making mechanism dynamically slices the dataset, and each slice is standardized using the Z-score method to address the non-stationarity issue in time series data. Specifically: The dynamic slicing mechanism mentioned in this invention is based on local variance awareness. It dynamically adjusts the slice length by monitoring the variance of the sequence in real time: First, a dynamic threshold is set. When the variance intensity increases above the set threshold, it is identified as a high-fluctuation region, and the slice is adaptively shortened to enhance the capture of mutation features. When the variance intensity is below the threshold, it is identified as a low-fluctuation region, and the slice length is extended to balance computational efficiency and long-range dependency preservation. This mechanism, through the dynamic mapping relationship between variance and granularity, not only significantly improves the adaptability of the normalization process to non-stationary distributions but also overcomes the performance bottleneck of traditional fixed slices in heterogeneous time-series scenarios.

[0032] The dynamic slice length adjustment module is implemented through a variance-driven adaptive decision-making mechanism. Its core lies in dynamically adjusting the slice length based on local variance. Based on this, the present invention further designs a dual-window architecture where the detection window and execution window collaborate—the detection window has a fixed length. Recursively estimating local variance triggers dynamic adjustment of the sliced ​​execution window, specifically including the following steps: S31. By sliding a detection window of fixed length n through the time series data, the local variance intensity within the detection window is calculated in real time. As a core indicator for measuring data volatility: (1) in, and These represent the latest and removed data points in the detection window, respectively. This is the historical average.

[0033] Based on variance strength Dynamically adjust the length of the execution window slice : Compression when increasing To capture local mutations, Expand when decreasing To maintain the continuity of the trend.

[0034] S32. For intermittent high-variance scenarios, an exponential decay mechanism is introduced to suppress overreactions: (2) in As the baseline adjustment amount, Control the decay rate, This represents the cumulative number of adjustments.

[0035] Even with high variance, the adjustment range of slice length is controlled within a reasonable range. This mechanism significantly improves the generalization representation ability of non-stationary time series through variance-scale coupling modeling and dynamic smoothing optimization.

[0036] S4. Input the standardized data into the main prediction module, namely the difference-aware time series prediction module, to deal with the local-global feature dependency problem in time series data, as well as the robustness problem to abnormal data and event data. The difference-aware time-series prediction module achieves efficient and complementary extraction of local features and global dependencies of time series through a cascaded TCN-Transformer architecture. This effectively addresses the common challenges of insufficient long-range dependency modeling and lack of sensitivity to local patterns faced by traditional single models in time-series prediction. Furthermore, it utilizes an adaptive graph convolutional network, leveraging its feature-driven mechanism to implicitly learn the graph structure. By decomposing time series into seasonal and trend components, it improves robustness to anomalous data. Additionally, by constructing an adversarial training domain adaptive optimization framework to minimize the distribution differences between event data and regular data, it effectively prevents misjudgment of event features. The difference-aware time-series prediction model aims to solve the following three major problems: 1) Spatiotemporal dependency hierarchical modeling, i.e., how to construct a unified representation in scenarios where local time-series patterns, long-range dependencies, and spatial correlations coexist among complex variables; 2) Decoupling of time-series components, i.e., how to achieve the decomposition of trend and seasonal components and improve the time-series generalization ability of anomalous data through robust feature representation; 3) Event-regular distribution confusion, i.e., how to effectively distinguish between event data and regular data to avoid model bias caused by distribution shifts.

[0037] S41. Regarding Problem 1), a spatiotemporal feature enhancement module (feature embedding) is proposed. This module achieves efficient representation of multivariate time series data through cascaded local-global dependency modeling and spatial feature extraction. Specifically, it enhances spatiotemporal features using a TCN-Transformer parallel fusion mechanism and a graph convolutional neural network. The specific steps include: S411, Local Temporal Feature Extraction Temporal Convolutional Networks (TCNs) capture local temporal patterns. By integrating dilated causal convolutions with residual connections, TCNs enhance model expressiveness while maintaining parameter efficiency. Specifically, at each time step... At that time, for the input sequence after standardization Perform dilated causal convolution operation: (3) in, Indicates the expansion factor. Indicates the kernel size. This represents the index variable inside the convolution kernel, used to traverse all positions within the convolution kernel. Indicates the convolution kernel at the th... Learnable parameters at each position are used to perform a weighted summation of the input sequence. Indicates time The result of the convolution operation at point , the output sequence after the convolution operation is denoted as . .

[0038] Then, by stacking convolution kernels with different dilation factors in layers, Temporal Convolutional Networks (TCNs) can effectively capture multi-scale temporal patterns. The final output of the TCN residual block is denoted as... : (4) in, This represents the output of X after the convolution operation, and is used as the input of the TCN. This indicates that a convolution operation is performed on the input. This represents a learnable weight matrix used to project the input onto the matrix. Same dimensional space; S412, Global Temporal Dependency Modeling To address the long-term temporal dependency problem, this module cascades a Transformer encoder at the TCN backend and establishes global temporal relationships through a multi-head attention mechanism. Specifically, it addresses the hidden states of layer l-1. The multi-head attention mechanism computation process is defined as follows: (5) (6) in, Indicates the number of heads of attention. This represents the output weight matrix. Indicates the first The output of one attention head is used to perform a linear transformation on the outputs of multiple attention heads. , and These represent the weight matrices for the query, key, and value, respectively. This indicates the dimension of the attention head query and key, used to scale the dot product result and prevent gradient vanishing.

[0039] S413, TCN, and Transformer are constructed in parallel for processing. A feature fusion module integrates convolutional features and self-attention features to generate a joint representation output that fuses global and local dependencies. : (7) in, This represents the intermediate representation, or hidden state, in the Transformer encoder. This indicates the multi-head self-attention mechanism for the hidden state. The processing results This means concatenating the output of TCN with that of Transformer, that is, fusing local and global features to form a richer joint representation.

[0040] S414, Adaptive Spatial Dependency Modeling To capture dynamic relationships between nodes, this module designs an adaptive graph convolutional network that implicitly learns the graph structure through a feature-driven mechanism. Specifically, it models the implicit structural relationships between nodes using a graph convolutional network and aggregates high-order neighbor information through multi-level graph convolutional layers, thereby iteratively updating node representations. A brief description of the graph convolutional operations used in the method is as follows: (8) Where G represents a graph based on an adjacency matrix, Represents an activation function. Represents the learnable parameter matrix, It is an adjacency matrix with self-connections. yes The angle matrix. By stacking multiple graph convolution operation layers, information from multi-order neighbors can be aggregated.

[0041] S415. By fusing spatiotemporal features through a multilayer perceptron, a spatiotemporal joint representation that combines local perception and global dependency is formed: Through a parameterized spatiotemporal feature interaction mechanism, the limitations of the traditional method of separating temporal and spatial feature modeling are effectively solved, resulting in a final spatiotemporal dependency representation. as follows: (9) in, This represents the decoupling parameters used to decompose features into different parts.

[0042] S42. Regarding question 2), the time series is decomposed into seasonal and trend components, and then integrated together using a multiplication method to improve robustness to outlier data. This includes the following steps: S421. Extracting seasonal components from time series using Fourier series decomposition and adaptive parameter learning. The Fourier series decomposes periodic signals into linear combinations of sine and cosine functions of different frequencies, thus effectively representing the seasonal components in the time series. (10) in, Indicates time Seasonal components at the location, and These are the parameters learned by the model, corresponding to the first... The amplitude and phase of each frequency component, It is the cycle of seasonal components. It is the number of terms in the Fourier series. Furthermore, different learning parameters are introduced when learning periodic patterns to control the amplitude and phase of each component in the Fourier series, thereby capturing various complex periodic patterns.

[0043] S422. By using multinomial regression and time feature extraction to capture the trend components in time series, multinomial regression describes the long-term trend of a time series by fitting a multinomial function, and can flexibly adapt to trend curves of different shapes. (11) in, Indicates time The trend components at the location, , , , These are the coefficients of a multinomial regression, used to control for the shape of the trend. It represents the degree of the polynomial. Extracting long-term trend information from time series using polynomial functions can effectively capture both linear and non-linear trend changes in time series.

[0044] S423. The seasonal and trend components of the time series are integrated through multiplication to generate the final prediction result, thereby achieving accurate prediction of the time series.

[0045] S43. Regarding problem 3), this invention proposes a domain adaptive optimization framework based on adversarial training, the core component of which is a domain discriminator. The training objective of this framework is to induce the feature encoder to generate domain-invariant features through an adversarial game process.

[0046] Specifically, the following steps are included: S431. Design a domain discriminant. Its loss function The definition is as follows: (12) During adversarial training, we fix the feature encoder. To maximize the parameters To optimize the domain discriminator Subsequently, the fixed domain discriminator To minimize the parameters To optimize the feature encoder This iterative game approach achieves feature alignment between event data and regular data. Represents the feature encoder. Discriminator for the domain, and These represent the probability distributions of event data and regular data, respectively. and They represent and Based on the observed samples, this optimization mechanism significantly improves the robustness and accuracy of predicting illegal online transaction activities.

[0047] S432. Wasserstein distance is used as the difference metric to alleviate the vanishing gradient problem in adversarial training, and a gradient penalty term is introduced to enhance training stability. The Wasserstein distance and gradient penalty term are expressed as follows: (13) (14) in Represents a domain discriminant for 1-Lipschit constraints. Represents the sampling points in the feature space. This is the penalty coefficient.

[0048] S5. Input the standardized data into the dynamic statistical feature prediction module to further process the non-stationarity problem in the time series data; The dynamic statistical feature prediction module aims to solve the modeling challenge of future distribution drift in slice-level normalization through a differentiable statistical prediction mechanism. The dynamic statistical feature prediction framework establishes the evolutionary patterns of time-series statistics, enabling accurate modeling of local statistics within future time windows.

[0049] The dynamic statistical feature prediction module employs a lightweight neural network structure, achieving efficient distribution estimation through feature engineering and parameterized design. Specifically, this module uses a two-stage fully connected network architecture, consisting of two parallel, structurally similar lightweight neural network architectures within the module. The core idea is to use two relatively independent but parallelly computed sub-networks, each specifically responsible for predicting the future slice mean and variance. Non-negative activation constraints are introduced in the standard deviation prediction path to preserve physical meaning. To improve modeling efficiency, this application proposes a statistical prediction mechanism based on difference learning: for the mean component, the network no longer directly predicts the absolute value, but instead learns the residual pattern between the current slice mean and the historical global mean. This design stems from the assumption of mean persistence in time series data, i.e., the historical global mean... With the mean of future slices There is a strong correlation.

[0050] At the mathematical modeling level, the input sequence will be... The mean of the slices is expressed as The standard deviation is Construct the following parameterized model for the mean of future slices. and standard deviation of future slices Make a prediction: (15) (16) in This represents the local mean shift. Characterizes the stationarity of a sequence. Learnable parameters An adaptive weight matrix, constituting the feature dimension, is used to fuse the residual prediction term and the historical baseline term. This design endows the model with two aspects of modeling capabilities: Capture specific dynamic change patterns of variables. Maintain a reasonable inheritance of historical benchmarks.

[0051] S6. The prediction results of the difference-aware time series prediction module and the prediction results of the dynamic statistical feature prediction module are merged to form the final time series prediction result. This step is the core integration step of the method of this invention. It aims to deeply fuse the refined time-series features output by the difference-aware time-series prediction module (main prediction module) with the future data distribution statistics predicted by the dynamic statistical feature prediction module, in order to generate a final prediction result that is both accurate and stable. This fusion process is not a simple weighted average, but a reconstruction process with clear physical meaning based on statistical denormalization.

[0052] The outputs of the two modules represent predictions at different levels of the future sequence. The difference-aware time series prediction module outputs predicted values ​​generated on the standardized data scale. It captures the detailed sequence shape after seasonal-trend decomposition, adversarial training, and spatiotemporal modeling, but its numerical range depends on the mean and variance used in the previous slice standardization. The output of the dynamic statistical feature prediction module is the predicted statistics (predicted mean and standard deviation) for future time windows (slices), which defines the expected distribution characteristics of future data at the original scale. Therefore, the final prediction must "pull back" the output of the difference-aware time series prediction module from the standardized scale to the true original data scale. This "pulling back" operation requires using the predicted future distribution statistics, which is essentially an anti-standardization process.

[0053] The final fusion is achieved through an inverse standardization operation. Specifically, the output of the difference-aware time-series prediction module and the future statistics output by the dynamic statistical feature prediction module are fused according to the following formula: (17) in, This represents the prediction results generated by the difference-aware temporal prediction module on a normalized scale. This indicates the final predicted result after fusion. Furthermore, This represents element-wise multiplication. This operation is equivalent to dynamically adjusting the scale and offset of the refined results from the difference-aware time-series prediction module based on the predicted future data distribution, thereby generating a final prediction result that is both accurate and stable. The advantages of this fusion strategy are mainly reflected in the following aspects: First, this method fundamentally solves the non-stationarity problem, dynamically adapting to the time-varying characteristics of time series distributions (mean and variance). Traditional methods use fixed global statistics or statistics from past windows for destandardization, which cannot cope with future distribution drift. This invention directly predicts future statistics and corrects for them, fundamentally suppressing the distribution shift caused by non-stationarity. Second, this method enhances robustness through seasonal-trend decomposition and domain adversarial mechanisms. That is, with mutual verification between the two modules, if a sudden event causes drastic changes in the short-term sequence morphology, but the dynamic statistical feature prediction module judges that the overall statistical changes are not significant based on a longer-term perspective, then the fused result will be pulled back to a more reasonable range.

[0054] Experimental example Regarding the experimental configuration and the experimental results of this invention, the following content is included: A. Dataset and Model Setup: This invention is mainly tested on commodity datasets. The proposed model has an input length of 96, a convolution kernel size of 3, uses ReLU activation and a multilayer perceptron, and finally uses a fully connected layer, which includes an intermediate layer and an output layer with 128 units.

[0055] B. Training Setup: like Figure 3 and Figure 4 As shown, to better examine the effectiveness of this invention, this experiment was conducted with different time series output lengths of 96, 192, 336, and 720, ensuring that the models all followed the same experimental settings. Two widely used metrics were employed in the experiment: mean squared error (MSE). Figure 3 Mean Absolute Error (MAE) Figure 4The model's performance is measured using [method / mechanism]. In this invention, the number of iterations is set to 2, the training rounds are 10, and Adam is used as the local optimizer. Time series data are divided into segments dynamically based on mean and variance. The learning rate and dropout rate are dynamically adjusted during training to control the model's learning level in each round. Lower learning and dropout rates result in parameters that are closer to the model in each learning round, leading to more accurate predictions. This invention compares the ablation experiments with the overall model by removing key components, namely the Temporal Convolutional Network (TCN), the Transformer, and the dynamic slice length adjustment module.

[0056] C. Experimental Results: From experimental comparison Figure 3 and Figure 4 The results show that the overall model significantly outperforms the model after removing key components, exhibiting the lowest average MSE and MAE. The Transformer module's contribution is most crucial; its absence causes a substantial 27.32% increase in the mean absolute error (MAE) for predictions with an output length of 720. Furthermore, removing the dynamic slice length adjustment module leads to higher MSE and MAE across all prediction lengths compared to removing other key components. This demonstrates that the complete structure of the model, especially the Transformer and dynamic statistical feature prediction modules, is essential for improving prediction accuracy.

[0057] Obviously, the above embodiments of the present invention are merely examples for clearly illustrating the technical solutions of the present invention, and are not intended to limit the specific implementation of the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the claims of the present invention should be included within the protection scope of the claims of the present invention.

Claims

1. A method for predicting illegal behavior based on dynamic slicing and bi-branch adversarial mechanisms, characterized in that, The method includes: S1. Collect a multi-dimensional time-series dataset of goods involved in illegal online transactions; S2. Construct a time series prediction model for illegal behavior, including: a dynamic slice length adjustment module, a difference-aware time series prediction module, and a dynamic statistical feature prediction module; S3. The time series dataset is used as the input to the illegal behavior time series prediction model. First, it is input into the dynamic slice length adjustment module. The dataset is dynamically sliced ​​through the variance-driven adaptive decision-making mechanism, and each slice is standardized. S4. Input the standardized data into the difference-aware time series prediction module for processing, which includes the following steps: S41. Spatiotemporal feature enhancement is achieved through a parallel fusion mechanism of graph convolutional neural network and TCN-Transformer. S42. Seasonal components in time series are extracted through Fourier series decomposition and adaptive parameter learning, trend components in time series are captured through multinomial regression and time feature extraction, and the two are combined to generate prediction results. S43. Feature alignment between event data and regular data is achieved through a joint optimization framework of adversarial domain alignment and Wasserstein distance optimization. S5. Input the standardized data into the dynamic statistical feature prediction module and process it using a lightweight neural network: For the prediction of the standard deviation of future slices, a non-negative activation constraint is introduced to preserve the physical meaning; for the prediction of the mean of future slices, the network no longer directly predicts the absolute value, but learns the mean of the current slice. Compared with historical global average The residual mode; S6. The prediction results of the difference-aware time series prediction module and the prediction results of the dynamic statistical feature prediction module are fused together to obtain the final time series prediction result.

2. The illegal behavior prediction method based on dynamic slicing and bi-branch adversarial as described in claim 1, characterized in that, The multi-dimensional online transaction illegal behavior commodity time series dataset refers to a collection of multi-dimensional fluctuation feature sequence data reflecting commodity attributes and different types of changes over time within a certain period of time. The multi-dimensional fluctuation feature sequence data is indexed by timestamps and records the dynamic behavioral characteristics and state changes of commodities under different dimensions.

3. The illegal behavior prediction method based on dynamic slicing and bi-branch adversarial as described in claim 1, characterized in that, In step S2, the dynamic slice length adjustment module of the illegal behavior time series prediction model dynamically adjusts the slice length based on the variance to adaptively capture patterns and features at different time scales. The difference-aware temporal prediction module consists of three parts: 1) Feature extraction part: TCN-Transformer captures short-term and long-term temporal dependencies, and graph neural network captures spatial dependencies; 2) Seasonal-trend component decomposition: Seasonal blocks and trend blocks capture seasonal and trend components respectively, enhancing robustness to outlier data through seasonal and trend component decomposition; 3) Adversarial training: Minimize the distribution difference between event data and regular data; The dynamic statistical feature prediction module uses a lightweight neural network to predict the mean and variance of future slices based on the mean and variance of the current slice. The illegal behavior time series prediction model ultimately merges the output of the difference-aware time series prediction module with the future statistics output of the dynamic statistical feature prediction module through an anti-standardization operation to obtain the final prediction result.

4. The illegal behavior prediction method based on dynamic slicing and bi-branch adversarial as described in claim 1, characterized in that, In step S3, the core of the variance-driven adaptive decision-making mechanism lies in dynamically adjusting the slice length based on the local real-time variance. Based on this, a dual-window architecture is designed that coordinates the detection window and the execution window—the detection window has a fixed length. Recursively estimating local variance triggers dynamic adjustment of the sliced ​​execution window, specifically including the following steps: S31. By sliding a detection window of fixed length n through the time series data, the local variance intensity within the detection window is calculated in real time. As a core indicator for measuring data volatility: （1） in, and These represent the latest and removed data points in the detection window, respectively. This is the historical average. Based on variance strength Dynamically adjust the length of the execution window slice : Compression when increasing To capture local mutations, Expand when decreasing To maintain trend continuity; S32. For intermittent high-variance scenarios, an exponential decay mechanism is introduced to suppress overreactions: （2） in As the baseline adjustment amount, Control the decay rate, This represents the cumulative number of adjustments.

5. The illegal behavior prediction method based on dynamic slicing and bi-branch adversarial as described in claim 1, characterized in that, In step S41, the parallel fusion mechanism of the graph convolutional neural network and TCN-Transformer performs spatiotemporal feature enhancement, specifically including the following steps: S411. Extracting local temporal features through dilated convolution and residual connections of TCN: Firstly, Temporal Convolutional Network (TCN) integrates dilated causal convolutions with residual connections. Specifically, at each time step... At that time, for the input Perform dilated causal convolution operation: （3） in, Indicates the expansion factor. Indicates the kernel size. This represents the index variable inside the convolution kernel, used to iterate through all positions of the convolution kernel. Indicates the convolution kernel at the th... Learnable parameters at each position are used to perform a weighted summation of the input sequence. Indicates time The result of the convolution operation at point , the output sequence after the convolution operation is denoted as . ; Then, by stacking convolution kernels with different dilation factors in layers, Temporal Convolutional Networks (TCNs) can effectively capture multi-scale temporal patterns. The final output of the TCN residual block is denoted as... : （4） in, This represents a learnable weight matrix used to project the input onto the matrix. Using the same dimensional space to achieve residual connections. This represents the multivariate time series input after X undergoes a convolution operation. Indicates input Output after convolution ; S412. Modeling global temporal dependencies using the Transformer self-attention mechanism: A Transformer encoder is cascaded at the back end of the TCN, and a global temporal correlation is established through a multi-head attention mechanism. Specifically, this involves the hidden states of layer l-1. The multi-head attention mechanism computation process is defined as follows: （5） （6） in, Indicates the number of heads of attention. This represents the output weight matrix. Indicates the first The output of each attention head, , and These represent the weight matrices for the query, key, and value, respectively. This indicates the dimensions of the attention header query and the key; S413, TCN, and Transformer construct a parallel processing architecture. Through a feature fusion module, convolutional features and self-attention features are integrated to generate a joint representation output that incorporates global and local dependencies. : （7） Here, H represents the hidden state, which is the intermediate representation in the Transformer encoder. This indicates the result of the multi-head self-attention mechanism processing the hidden state, and concat(.) indicates the concatenation operation between the outputs of the TCN and Transformer modules; S414. Adaptive spatial dependency modeling using graph convolutional neural networks: The implicit structural relationships between nodes are modeled using graph convolutional networks, and higher-order neighbor information is aggregated through multi-level graph convolutional layers to iteratively update node representations. The graph convolution operation is as follows: （8） Where G represents a graph based on an adjacency matrix, Represents an activation function. Represents the learnable parameter matrix, It is an adjacency matrix with self-connections. yes The angle matrix; S415. By fusing spatiotemporal features through a multilayer perceptron, a spatiotemporal joint representation that combines local perception and global dependence is formed: By using a parameterized spatiotemporal feature interaction mechanism, the final spatiotemporal dependency representation is obtained. as follows: （9） in, This represents the decoupling parameters used to decompose features into different parts.

6. The illegal behavior prediction method based on dynamic slicing and bi-branch adversarial as described in claim 5, characterized in that, Step S42 specifically includes the following steps: S421. Extracting seasonal components from time series using Fourier series decomposition and adaptive parameter learning: The seasonal signal is decomposed into a linear combination of multiple sine and cosine functions of different frequencies using Fourier series decomposition. （10） in, Indicates time Seasonal components at the location, and These are the parameters learned by the model, corresponding to the first... The amplitude and phase of each frequency component, It's a seasonal cycle. It is the number of terms in the Fourier series; In addition, different learning parameters are introduced when learning periodic patterns to control the amplitude and phase of each component in the Fourier series, thereby capturing various complex periodic patterns. S422. Capturing trend components in time series through multinomial regression and time feature extraction: Multinomial regression fits a multinomial function to describe the long-term trend of the time series. （11） in, Indicates time Trend components at the location, , , , These are the coefficients of a multinomial regression, used to control for the shape of the trend. It is the degree of the polynomial. By using polynomial functions to extract long-term trend information from time series, we can effectively capture linear and nonlinear trend changes in time series. S423. Integrate the seasonal and trend components through multiplication to generate the final prediction result.

7. The illegal behavior prediction method based on dynamic slicing and bi-branch adversarial as described in claim 6, characterized in that, In step S43, feature alignment between event data and regular data is achieved through a joint optimization framework of adversarial domain alignment and Wasserstein distance optimization, specifically including the following steps: S431. Design the domain discriminator loss function to achieve feature alignment between event data and regular data. Loss function... The definition is as follows: （12） in, Represents the feature encoder. Discriminator for the domain, and These represent the probability distributions of event data and regular data, respectively. and They represent and Observational samples; S432. Wasserstein distance is used as the difference metric to alleviate the gradient vanishing problem in adversarial training, and a gradient penalty term is introduced to enhance training stability. The Wasserstein distance and the gradient penalty term are expressed as follows: （13） （14） in Represents a domain discriminant for 1-Lipschit constraints. Represents the sampling points in the feature space. This is the penalty coefficient.

8. The illegal behavior prediction method based on dynamic slicing and bi-branch adversarial as described in claim 1, characterized in that, Step S5 is as follows: Let the input sequence be The mean of the slices is expressed as The standard deviation is Construct the following parameterized model for the mean of future slices. and standard deviation of future slices Make a prediction: （15） （16） in This represents the local mean shift. Characterizing sequence stationarity; learnable parameters An adaptive weight matrix is ​​constructed to form the feature dimension, which is used to fuse the residual prediction term with the historical baseline term. and It endows the model with two aspects of modeling capabilities: Capture specific dynamic change patterns of variables. Maintain a reasonable inheritance of historical benchmarks.

9. The illegal behavior prediction method based on dynamic slicing and bi-branch adversarial as described in claim 1, characterized in that, In step S6, the fusion of the prediction results of the difference-aware time series prediction module and the prediction results of the dynamic statistical feature prediction module means that the prediction results generated by the difference-aware time series prediction module on the normalized scale are de-standardized using the predicted future slice mean and standard deviation values ​​output by the dynamic statistical feature prediction module, and the final prediction results on the original data scale are reconstructed.

Images