An illegal behavior prediction method based on dynamic slicing and double-branch confrontation

Abstract

The present application belongs to the technical field of data processing methods for prediction purposes, and more particularly relates to a method for predicting illegal behavior based on dynamic slicing and double-branch confrontation. The method comprises: collecting a multi-dimensional network transaction illegal behavior commodity time series data set; constructing an illegal behavior time series prediction model; inputting the time series data set into a dynamic slicing length adjustment module, dynamically slicing the data set, and standardizing each slice; inputting the standardized data into a difference perception time series prediction module for processing; inputting the standardized data into a dynamic statistical feature prediction module for processing; and fusing the prediction results of the difference perception time series prediction module and the prediction results of the dynamic statistical feature prediction module as the final time series prediction result. The present application solves the problems of non-stationarity, long-range dependence and robustness to abnormal data and event data in the time series prediction scene.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of data processing methods for prediction purposes, and more particularly, to a method for predicting illegal behavior based on dynamic slicing and double-branch confrontation. BACKGROUND

[0002] Time series prediction has always been an important but challenging task. The current method still faces three major paradigm defects: first, the abnormal events and sudden events (such as holidays) in network behavior data cause non-stationary evolution of the representation space, leading to time-varying statistical characteristics and pattern drift; second, low-frequency sudden events are often misjudged as outliers, resulting in the loss of key time series features; third, the single-scale modeling paradigm breaks the cross-scale spatiotemporal correlation between long-range dependence and local fluctuations, forming a key bottleneck for model reasoning. These defects together lead to degradation of prediction accuracy, deviation of correlation measure, and distortion of spatiotemporal topology, ultimately restricting the analytical ability of multivariate coupling relationships.

[0003] These challenges are particularly prominent in key applications such as accurate prediction of network transaction illegal behavior risks: the innovative progress of the Internet has significantly changed people's way of life today. Different e-commerce websites provide Internet users with an effective and highly dependent online environment. However, the rapid evolution of e-commerce has given rise to new types of network transaction illegal behavior (including but not limited to counterfeiting and shoddy, banned and restricted sales, information asymmetry, and contract violations), which, if not timely curbed, will seriously harm the legitimate rights and interests of consumers. If the illegal risk of goods can be accurately predicted and measures are taken, the occurrence rate of illegal behavior can be significantly reduced, thereby maintaining the fairness of the transaction market and the real-time nature of regulation, and promoting the sustainable development of the digital economic ecosystem. However, achieving accurate prediction faces severe challenges: abnormal data and event data exacerbate non-stationarity; accurate early warning must simultaneously understand long-term trends and short-term abnormal transaction fluctuations in goods, and traditional methods often fail in this scenario.

[0004] The existing method and its representative improvement still have defects: the traditional time series model is theoretically complete, but its linear assumption is difficult to describe complex nonlinear relationships; the deep learning model has structural defects in feature extraction, TCN captures local features through dilated convolution but lacks global perception ability, and the Transformer based on self-attention realizes global modeling but is insufficiently sensitive to local time series patterns. The theoretical gap between linear assumption and nonlinear modeling, combined with the imbalance of local / global feature extraction, ultimately restricts the performance boundary of time series prediction. These challenges have given rise to many targeted improvement schemes. For non-stationarity: RevIN solves the non-stationarity within the sequence by normalizing each input sequence and adjusting its mean and variance to a relatively standard range; GBT splits the prediction process into two independent stages, uses an encoder to generate a preliminary prediction result, and uses a decoder to learn the internal relationship of the prediction sequence, directly solving the input / prediction window distribution offset problem caused by non-stationarity through two-stage decoupling. For abnormal / event robustness: DARF separates abnormal interference through a seasonal-trend decomposition decoder, enhances robustness to abnormalities, and minimizes the feature distribution difference between the two domains through a domain discriminator to improve robustness to abnormal and event data. For long / short-term dependency modeling: MG-Autoformer simultaneously captures short-term fluctuations and long-term trends through multi-resolution downsampling and shared query-key mechanisms.

[0005] However, existing methods still face significant limitations in addressing the core challenges of network transaction illegal behavior prediction: most works focus on a single challenge, and lack a unified framework that optimizes non-stationarity, event and abnormal robustness, and cross-scale modeling simultaneously. SUMMARY

[0006] The present application aims to overcome at least one of the above-mentioned defects of the prior art, and provides a method for predicting illegal behavior based on dynamic slicing and dual-branch confrontation, to solve the problems of non-stationarity, long-range dependence, and robustness to abnormal data and event data in time series prediction scenarios.

[0007] The detailed technical solutions of the present application are as follows:

[0008] A method for predicting illegal behavior based on dynamic slicing and dual-branch confrontation, the method comprising:

[0009] S1, collecting multi-dimensional network transaction illegal behavior commodity time series data set;

[0010] S2, constructing an illegal behavior time series prediction model, including: a dynamic slicing length adjustment module, a difference perception time series prediction module, and a dynamic statistical feature prediction module;

[0011] S3, taking the time series data set as an input of the illegal behavior time series prediction model, first inputting to a dynamic slice length adjustment module, dynamically slicing the data set through a variance driven adaptive decision mechanism, and performing standardization processing on each slice, solving the non-stationary problem existing in the time series data;

[0012] S4, inputting the standardized processed data to a difference perception time series prediction module for processing, specifically including the following steps:

[0013] S41, performing spatio-temporal feature enhancement through a graph convolutional neural network and a TCN-Transformer parallel fusion mechanism;

[0014] S42, extracting seasonal components in the time series through Fourier series decomposition and adaptive parameter learning, capturing trend components in the time series through polynomial regression and time feature extraction, and combining the two to generate a prediction result;

[0015] S43, realizing feature alignment of event data and regular data through a joint optimization framework of adversarial domain alignment and Wasserstein distance optimization;

[0016] S5, inputting the standardized processed data to a dynamic statistical feature prediction module, and processing through a lightweight neural network: for prediction of future slice standard deviation, a non-negative activation constraint is introduced to maintain physical meaning; for prediction of future slice mean, the network no longer directly predicts the absolute value, but learns the residual mode of the current slice mean and the historical global mean; ;

[0017] S6, fusing the prediction result of the difference perception time series prediction module and the prediction result of the dynamic statistical feature prediction module as a final time series prediction result.

[0018] According to the application, the multi-dimensional network transaction illegal behavior commodity time series data set refers to a collection of different types of multi-dimensional fluctuation feature sequence data reflecting commodity attributes and changes over time within a period of time, wherein the multi-dimensional fluctuation feature sequence data is indexed by time stamp, and records dynamic behavior characteristics and state changes of commodities in different dimensions.

[0019] According to the application, the dynamic slice length adjustment module of the illegal behavior time series prediction model dynamically adjusts the slice length based on the variance size, and adaptively captures patterns and features at different time scales.

[0020] The difference perception time sequence prediction module comprises three parts: 1) a feature extraction part: TCN-Transformer captures short-term and long-term time dependence, and a graph neural network captures spatial dependence; 2) a seasonal-trend component decomposition part: a seasonal block and a trend block capture seasonal components and trend components respectively, and the seasonal-trend component decomposition enhances the robustness to abnormal data; and 3) an adversarial training part: the distribution difference between event data and regular data is minimized, and the robustness to event data is improved.

[0021] The dynamic statistical feature prediction module adopts a lightweight neural network, predicts the mean and variance of future slices based on the mean and variance of the current slice, and effectively suppresses the drift of non-stationary time sequence distribution;

[0022] The illegal behavior time sequence prediction model finally fuses the output of the difference perception time sequence prediction module and the future statistical quantity output by the dynamic statistical feature prediction module through a reverse standardization operation to obtain a final prediction result.

[0023] According to the application, in step S3, the core of the variance-driven adaptive decision mechanism is to dynamically adjust the slice length according to the local real-time variance, and based on this, a double-window architecture of a cooperative detection window and an execution window is designed, the detection window has a fixed length The local variance is recursively estimated, and the slice of the execution window is dynamically adjusted, and the specific steps include the following steps:

[0024] S31, the detection window with a fixed length n is slid through the time sequence data, and the local variance intensity in the detection window is calculated in real time as a core index for measuring data volatility:

[0025] (1)

[0026] wherein, and represent the latest and removed data points in the detection window, is the historical mean;

[0027] Based on the variance intensity the execution window slice length is dynamically adjusted : When increasing, compress to capture local mutations, When decreasing, expand to maintain the continuity of the trend;

[0028] S32, for the intermittent high-variance scenario, an exponential decay mechanism is introduced to suppress the overactive response:

[0029] (2)

[0030] wherein is a reference adjustment amount, controls the decay rate, is the cumulative adjustment number.

[0031] According to the present application, preferably, in step S41, the overgraph convolutional neural network is combined with a TCN-Transformer parallel fusion mechanism for spatiotemporal feature enhancement, specifically including the following steps:

[0032] S411, local time sequence features are extracted through the dilated convolution and residual connection of TCN:

[0033] First, local time sequence patterns are captured through the time convolution TCN. The time convolution TCN integrates dilated causal convolution and residual connection to enhance the model expression ability while ensuring parameter efficiency. Specifically, at the time step , the input is subjected to dilated causal convolution operation:

[0034] (3)

[0035] wherein, represents the dilated factor, represents the convolution kernel size, represents an index variable inside the convolution kernel, used to traverse all positions of the convolution kernel, represents the learnable parameters of the convolution kernel at the th position, used for weighted summation of the input sequence, represents the convolution operation result at the time , and the output sequence after the convolution operation is denoted as ;

[0036] Then, the time convolution TCN can effectively capture multi-scale time sequence patterns by stacking convolution kernels of different dilated factors in a hierarchical manner. The final output of the TCN residual block is denoted as :

[0037] (4)

[0038] wherein, represents the learnable weight matrix, used to project the input to the same dimension space as to realize residual connection, represents the input multivariate time sequence after the convolution operation of X, represents the output after the convolution of the input ;

[0039] S412, model global temporal dependencies by using the Transformer self-attention mechanism:

[0040] To solve the problem of long-term temporal dependencies, a Transformer encoder is cascaded at the back end of the TCN to establish global temporal correlations through multi-head attention mechanisms. Specifically, the hidden state of the (l-1)-th layer is updated as follows: The multi-head attention mechanism calculation process is defined as follows:

[0041] (5)

[0042] (6)

[0043] wherein, denotes the number of attention heads, denotes the output weight matrix, denotes the output of the i-th attention head, which is used to linearly transform the outputs of multiple attention heads, , and denote the weight matrices of the query, key, and value, respectively, denotes the dimensions of the attention head query and key, which are used to scale the dot product results to prevent gradient vanishing; S413, TCN and Transformer construct a parallel processing architecture, integrate convolutional features and self-attention features through a feature fusion module, and generate a joint representation output that integrates global-local dependencies

[0044] :

[0045] (7) wherein H denotes the hidden state, i.e., the intermediate representation in the Transformer encoder,

[0046] denotes the processing result of the hidden state by the multi-head self-attention mechanism, and concat(.) denotes the concatenation operation on the outputs of the TCN and Transformer modules to form a more comprehensive joint representation.

[0047] S414, adaptively model spatial dependencies through a graph convolutional neural network:

[0048] The graph convolutional network models the implicit structural correlations between nodes and aggregates high-order neighbor information through multi-order graph convolution layers to iteratively update the node representations. The graph convolution operation is as follows:

[0049] (8)

[0050] wherein G denotes a graph based on an adjacency matrix, ​denotes an activation function, denotes a learnable parameter matrix, is an adjacency matrix with self-connection, is a diagonal matrix, by stacking multiple graph convolution operation layers, the information of multiple order neighbors can be aggregated;

[0051] S415, the spatio-temporal features are fused by a multi-layer perception to form a spatio-temporal joint representation with local perception and global dependence:

[0052] Through a parameterized spatio-temporal feature interaction mechanism, a final spatio-temporal dependence representation is obtained As follows:

[0053] (9)

[0054] wherein, denotes a parameter for decoupling, used for decomposing features into different parts.

[0055] According to the application, preferably, the step S42 specifically comprises the following steps:

[0056] S421, seasonal components in the time series are extracted by Fourier series decomposition and adaptive parameter learning: the seasonal signal is decomposed into a linear combination of multiple sinusoidal and cosine functions of different frequencies by using Fourier series:

[0057] (10)

[0058] wherein, denotes a seasonal component at time , and are parameters learned by the model, corresponding to the amplitude and phase of the th frequency component respectively, is the period of seasonality, is the number of terms of the Fourier series;

[0059] In addition, different learning parameters are introduced when learning the periodic pattern, used for controlling the amplitude and phase of each component in the Fourier series, so as to capture various complex periodic patterns;

[0060] S422, the trend component in the time series is captured by polynomial regression and time feature extraction: a polynomial function is fitted by polynomial regression to describe the long-term change trend of the time series:

[0061] (11)

[0062] wherein, denotes a trend component at time a trend component, , , , is the coefficient of polynomial regression for controlling the shape of the trend, is the degree of polynomial. Extracting long-term trend information in time series through polynomial function can effectively capture linear and nonlinear trend changes in time series;

[0063] S423, the seasonal component and the trend component are integrated together by multiplication to generate the final prediction result.

[0064] According to the application, in step S43, the feature alignment of event data and regular data is realized through the joint optimization framework of adversarial domain alignment and Wasserstein distance optimization, which specifically includes the following steps:

[0065] S431, a domain discriminator loss function is designed to realize the feature alignment of event data and regular data, and the loss function is defined as follows:

[0066] (12)

[0067] wherein, denotes a feature encoder, denotes a domain discriminator, and denote the probability distribution of event data and regular data respectively, and denote the observation samples of and , and the optimization mechanism significantly improves the robustness and accuracy of network transaction illegal behavior prediction;

[0068] S432, the Wasserstein distance is used as a difference measure to alleviate the gradient vanishing problem in adversarial training, and a gradient penalty term is introduced to enhance the training stability, wherein the Wasserstein distance and the gradient penalty term are respectively represented as:

[0069] (13)

[0070] (14)

[0071] wherein denotes a domain discriminator with 1-Lipschit constraint, denotes a feature space sampling point, is a penalty coefficient.

[0072] According to the application, the step S5 is specifically as follows:

[0073] Let the mean of the input sequence of slices be denoted as , and the standard deviation be , the parameterized model is constructed as follows to predict the mean of the future slice and the standard deviation of the future slice :

[0074] (15)

[0075] (16)

[0076] wherein represents the local mean offset, characterizes the stationarity of the sequence; the learnable parameters constitute an adaptive weight matrix of the feature dimension, which is used to fuse the residual prediction term and the historical reference term, and this design endows the model with two modeling capabilities: capture variable-specific dynamic change patterns, maintain reasonable inheritance of the historical reference.

[0077] According to the application, in step S6, the prediction results of the difference-aware time series prediction module and the prediction results of the dynamic statistical feature prediction module are fused, that is, the prediction results generated by the difference-aware time series prediction module on the normalized scale are de-normalized and calculated using the mean prediction value and the standard deviation prediction value of the future slice output by the dynamic statistical feature prediction module to reconstruct the final prediction results on the original data scale.

[0078] Compared with the prior art, the application has the following beneficial effects:

[0079] (1) The dynamic slice length adjustment module proposed in the application intelligently controls the fine-grained cutting in the fluctuating period and the coarse-grained aggregation in the stable period through the variance-driven adaptive slicing mechanism, and accurately captures the local statistical feature drift.

[0080] (2) The application proposes a double-branch prediction module architecture, which includes two parts, namely a difference-aware time series prediction module and a dynamic statistical feature prediction module. The difference-aware time series prediction module realizes spatiotemporal feature extraction and distribution alignment by fusing a TCN-Transformer hybrid architecture and seasonal-trend decomposition, and designs a domain discriminator and a Wasserstein distance joint optimization framework to eliminate the deviation between event data and regular data. The dynamic statistical feature prediction module predicts the mean and variance of the future slice through a lightweight network to further solve the non-stationarity problem of data.

[0081] (3) The application combines Fourier series decomposition and polynomial regression to capture seasonal components and trend components respectively, and through multiplication integration, the expression ability of seasonal components and trend components is enhanced.

[0082] (4) The application designs a fusion strategy based on de-standardization, that is, the mean and variance prediction values of the slices output by the dynamic statistical feature prediction module are used to reconstruct the prediction results of the difference perception time series prediction module to obtain the final prediction results on the original data scale, effectively inhibiting distribution drift. BRIEF DESCRIPTION OF DRAWINGS

[0083] Figure 1 is the flow chart of the illegal behavior prediction method based on dynamic slicing and double-branch confrontation according to the application.

[0084] Figure 2 is the structure diagram of the illegal behavior time series prediction model according to the embodiment of the application.

[0085] Figure 3 is the comparison diagram of the mean square error (MSE) experimental results of the model after removing the key components and the overall model according to the application.

[0086] Figure 4 is the comparison diagram of the mean absolute error (MAE) experimental results of the model after removing the key components and the overall model according to the application. DETAILED DESCRIPTION

[0087] The present disclosure will be further described below in combination with the drawings and embodiments.

[0088] Embodiment 1,

[0089] Referring to Figure 1 The embodiment provides an illegal behavior prediction method based on dynamic slicing and double-branch confrontation, which comprises the following steps:

[0090] S1, collecting a multi-dimensional network transaction illegal behavior commodity time series data set;

[0091] The multi-dimensional network transaction illegal behavior commodity time series data set refers to a collection of different types of multi-dimensional fluctuation characteristic sequence data reflecting commodity attributes and changes over time within a period of time. The multi-dimensional fluctuation characteristic sequence data is usually indexed by a timestamp and records the dynamic behavior characteristics and state changes of commodities in different dimensions, including but not limited to price fluctuations, illegal labels and external event influences, etc. Such data has typical time series characteristics such as high dimensionality, non-stationarity, multi-periodicity and abnormality concentration, and is suitable for fine-grained modeling and risk prediction of network transaction behavior.

[0092] In one possible implementation, the dimension commodity time series data set comprises:

[0093] Commodity type, regional distribution, platform attribute, illegal timestamp, illegal type and event marker (holiday / promotion, etc.).

[0094] In the embodiment of the application, by collecting a plurality of different types of commodity attributes and their related fluctuation characteristics (such as commodity type, regional distribution, platform attribute, illegal timestamp, illegal type and event marker, etc.), a time series data set with spatial and temporal multi-dimensional attributes is constructed. The data set not only contains the basic attributes of the commodity itself, but also fuses the performance of the commodity in different regions and platforms and its association information with external events (such as holidays, promotion activities), thereby providing sufficient information support for subsequent dynamic slicing processing, spatio-temporal feature extraction and illegal behavior prediction.

[0095] S2, a time series prediction model of illegal behavior is constructed, as shown in the following formula: Figure 2 The time series prediction model of illegal behavior includes a dynamic slicing length adjustment module, a difference perception time series prediction module and a dynamic statistical feature prediction module.

[0096] The dynamic slicing length adjustment module dynamically adjusts the slicing length based on the variance size, and adaptively captures patterns and features at different time scales.

[0097] The difference perception time series prediction module includes three parts: 1) feature extraction part: TCN-Transformer captures short-term and long-term time dependence, and graph neural network captures spatial dependence; 2) seasonal-trend component decomposition part: seasonal block and trend block capture seasonal component and trend component respectively, and the robustness to abnormal data is enhanced through seasonal and trend component decomposition; 3) adversarial training part: the distribution difference between event data and regular data is minimized, and the robustness to event data is improved.

[0098] The dynamic statistical feature prediction module adopts a lightweight neural network, predicts the mean and variance of the future slice based on the mean and variance of the current slice, and effectively suppresses the drift of non-stationary time series distribution.

[0099] Finally, the output of the difference perception time series prediction module and the future statistical quantity output by the dynamic statistical feature prediction module are fused through the inverse standardization operation to obtain the final prediction result.

[0100] S3, the time series data set is input into the dynamic slicing length adjustment module, the data set is dynamically sliced through the adaptive decision mechanism driven by variance, and each slice is standardized by Z-score method to solve the non-stationary problem in time series data, as follows:

[0101] The dynamic slicing mechanism mentioned in the application is based on local variance perception, and the slice length is dynamically adjusted by monitoring the variance of the sequence in real time: first, a dynamic threshold is set, when the variance intensity increases above the set dynamic threshold, it is determined that it is a high volatility area, and the slice is adaptively shortened to enhance the mutation feature capture; when the variance intensity is lower than the threshold, it is determined that it is a low volatility area, and the slice length is expanded to balance the calculation efficiency and long-range dependence preservation. Through the dynamic mapping relationship between variance and granularity, the adaptability of the normalization process to non-stationary distribution is significantly improved, and the performance bottleneck of traditional fixed slicing in heterogeneous time sequence scene is broken through.

[0102] The dynamic slice length adjustment module is realized through a variance-driven adaptive decision mechanism, and the core is to dynamically adjust the slice length according to the local variance, based on which the application further designs a double-window architecture of cooperative detection window and execution window-the detection window is of a fixed length Recursively estimate the local variance to trigger the dynamic adjustment of the slice of the execution window, which specifically includes the following steps:

[0103] S31, slidingly traverse the time sequence data through a detection window with a fixed length n, and calculate the local variance intensity in the detection window in real time as a core index for measuring data volatility:

[0104] (1)

[0105] Wherein, and represent the latest and removed data points of the detection window respectively, is the historical mean.

[0106] Based on the variance intensity dynamically control the slice length of the execution window : Increase to compress to capture local mutations, reduce to expand to maintain trend continuity.

[0107] S32, for intermittent high-variance scenarios, an exponential decay mechanism is introduced to suppress overactive response:

[0108] (2)

[0109] Wherein is the reference adjustment amount, controls the decay rate, is the cumulative adjustment number.

[0110] In this way, even if the variance is high, the adjustment range of the slice length is controlled within a reasonable range. Through variance-scale coupling modeling and dynamic smoothing optimization, the generalization representation ability of non-stationary time series is significantly improved.

[0111] S4, input the standardized data into the main prediction module, i.e. the difference perception time series prediction module, to process the local-global feature dependence problem existing in the time series data and the robustness problem of abnormal data and event data;

[0112] The difference perception time series prediction module realizes efficient and complementary extraction of local features and global dependencies of time series through a cascaded TCN-Transformer architecture, effectively solving the common problems of insufficient long-range dependence modeling and lack of local pattern sensitivity in traditional single models in time series prediction. Through an adaptive graph convolutional network, the feature-driven mechanism is used to implicitly learn the graph structure; and by decomposing the time series into seasonal components and trend components, the robustness to abnormal data is improved; in addition, by constructing a domain adaptive optimization framework for adversarial training, the distribution difference between event data and regular data is minimized, effectively preventing abnormal misjudgment of event features. The difference perception time series prediction model aims to solve the following three problems: 1) spatiotemporal dependence hierarchical modeling, i.e. how to construct a unified representation in a complex variable coexistence scenario with local time series patterns, long-range dependencies and spatial correlations; 2) time series component decoupling, i.e. how to realize the decomposition of trend components and seasonal components to improve the time series generalization ability of abnormal data through robust feature representation; 3) event-regular distribution confusion, i.e. how to effectively distinguish event data from regular data to avoid model bias caused by distribution deviation.

[0113] S41, for problem 1), a spatiotemporal feature enhancement module (feature embedding) is proposed to realize efficient representation of multivariate time series through cascading local-global dependence modeling and spatial feature extraction, i.e. through TCN-Transformer parallel fusion mechanism and graph convolutional neural network for spatiotemporal feature enhancement, the specific steps include:

[0114] S411, local time series feature extraction

[0115] Local time series patterns are captured through time convolution TCN. Time convolution TCN integrates dilated causal convolution and residual connection to enhance model representation while ensuring parameter efficiency. Specifically, at each time step , the standardized input sequence is subjected to dilated causal convolution operation:

[0116] (3)

[0117] wherein, is the dilation factor, denotes the size of the convolution kernel, denotes an index variable within the convolution kernel, used to traverse all positions of the convolution kernel, denotes the learnable parameters of the convolution kernel at the th position, used for weighted summation of the input sequence, denotes the result of the convolution operation at time , the output sequence after the convolution operation is denoted as .

[0118] Then, the time convolution TCN can effectively capture multi-scale temporal patterns by stacking convolution kernels with different dilation factors at different levels, and the final output of the TCN residual block is denoted as :

[0119] (4)

[0120] wherein, denotes the output of X after the convolution operation, and is taken as the input of the TCN, denotes the convolution operation on the input, denotes the learnable weight matrix used to project the input to the same dimensional space as ;

[0121] S412, modeling of global temporal dependence

[0122] To solve the problem of long-term temporal dependence, this module cascades a Transformer encoder at the back end of the TCN to establish global temporal correlation through a multi-head attention mechanism. Specifically, the hidden state of the th-1 layer is denoted as , and the multi-head attention mechanism calculation process is defined as:

[0123] (5)

[0124] (6)

[0125] wherein, denotes the number of attention heads, denotes the output weight matrix, denotes the output of the th attention head, used for linear transformation of the outputs of multiple attention heads, , and denote the weight matrices of the query, key and value, respectively, denotes the dimensions of the attention head query and key, used to scale the dot product result to prevent gradient disappearance.

[0126] S413, TCN and Transformer are constructed in parallel processing, and the convolutional features and self-attention features are integrated through a feature fusion module to generate a joint representation output that integrates global-local dependency :

[0127] (7)

[0128] wherein, represents the intermediate representation in the Transformer encoder, i.e., the hidden state, represents the processing result of the multi-head self-attention mechanism on the hidden state , represents the splicing of the outputs of TCN and Transformer, i.e., the fusion of local features and global features, to form a more rich joint representation.

[0129] S414, adaptive spatial dependency modeling

[0130] To capture the dynamic association between nodes, this module designs an adaptive graph convolutional network to implicitly learn the graph structure through a feature-driven mechanism. Specifically, the implicit structural association between nodes is modeled through a graph convolutional network, and high-order neighbor information is aggregated through multiple-order graph convolutional layers to iteratively update the node representation. The graph convolution operation applied in the method is briefly described as follows:

[0131] (8)

[0132] wherein, G represents a graph based on an adjacency matrix, represents an activation function, represents a learnable parameter matrix, is an adjacency matrix with self-connection, is a diagonal matrix. By stacking multiple graph convolution operation layers, the information of multiple-order neighbors can be aggregated.

[0133] S415, fusion of spatio-temporal features through a multi-layer perceptron to form a spatio-temporal joint representation with local perception and global dependency: through a parameterized spatio-temporal feature interaction mechanism, the limitations of traditional methods in modeling time-series-space features are effectively solved, and the final spatio-temporal dependent representation is as follows:

[0134] (9)

[0135] wherein, represents a decoupling parameter used to decompose the features into different parts.

[0136] S42, for question 2), the time series is decomposed into seasonal components and trend components, and the two are integrated together by multiplication, improving the robustness to abnormal data, including the following steps:

[0137] S421, extract the seasonal component in the time series by Fourier series decomposition and adaptive parameter learning. Fourier series can decompose periodic signals into a linear combination of multiple different frequency sine and cosine functions, effectively representing the seasonal component in the time series:

[0138] (10)

[0139] where, denotes the seasonal component at time , and are the parameters learned by the model, corresponding to the amplitude and phase of the th frequency component, is the period of the seasonal component, is the number of terms in the Fourier series. In addition, different learning parameters are introduced when learning the periodic pattern, which are used to control the amplitude and phase of each component in the Fourier series, so as to capture various complex periodic patterns.

[0140] S422, capture the trend component in the time series by polynomial regression and time feature extraction. Polynomial regression describes the long-term trend of the time series by fitting a polynomial function, which can adapt to different shapes of trend curves,

[0141] (11)

[0142] where, denotes the trend component at time , , , , is the coefficient of polynomial regression, which is used to control the shape of the trend, is the degree of the polynomial. By polynomial function to extract the long-term trend information in the time series can effectively capture the linear and nonlinear trend changes in the time series.

[0143] S423, the seasonal component and the trend component decomposed from the time series are integrated by multiplication to generate the final prediction result, so as to realize accurate prediction of the time series.

[0144] S43. Regarding problem 3), this invention proposes a domain adaptive optimization framework based on adversarial training, the core component of which is a domain discriminator. The training objective of this framework is to induce the feature encoder to generate domain-invariant features through an adversarial game process.

[0145] Specifically, the following steps are included:

[0146] S431. Design a domain discriminant. Its loss function The definition is as follows:

[0147] (12)

[0148] During adversarial training, we fix the feature encoder. To maximize the parameters To optimize the domain discriminator Subsequently, the fixed domain discriminator To minimize the parameters To optimize the feature encoder This iterative game approach achieves feature alignment between event data and regular data. Represents the feature encoder. Representation domain discriminator, and These represent the probability distributions of event data and regular data, respectively. and They represent and Based on the observed samples, this optimization mechanism significantly improves the robustness and accuracy of predicting illegal online transaction activities.

[0149] S432. Wasserstein distance is used as the difference metric to alleviate the vanishing gradient problem in adversarial training, and a gradient penalty term is introduced to enhance training stability. The Wasserstein distance and gradient penalty term are expressed as follows:

[0150] (13)

[0151] (14)

[0152] in Represents a domain discriminant for 1-Lipschit constraints. Represents the sampling points in the feature space. This is the penalty coefficient.

[0153] S5. Input the standardized data into the dynamic statistical feature prediction module to further process the non-stationarity problem in the time series data;

[0154] The dynamic statistical feature prediction module is committed to solving the modeling problem of future distribution drift in slice-level normalization through a differentiable statistical prediction mechanism. The dynamic statistical feature prediction framework realizes accurate modeling of local statistics in the future time window by establishing the evolution law of time series statistics.

[0155] The dynamic statistical feature prediction module adopts a lightweight neural network structure to achieve efficient distribution estimation through feature engineering and parameterization design. Specifically, the module adopts a two-stage fully connected network architecture, i.e., two parallel lightweight neural network architectures with similar structures inside the module. The core idea is to use two relatively independent but parallel computing subnetworks to predict the future slice mean and the future slice variance, respectively. Non-negative activation constraints are introduced in the standard deviation prediction path to maintain physical significance. To improve modeling efficiency, the present application proposes a statistical quantity prediction mechanism based on differential learning: for the mean component, the network no longer directly predicts the absolute value, but learns the residual pattern of the current slice mean and the historical global mean. This design is based on the assumption of mean persistence of time series, i.e., there is a strong correlation between the historical global mean and the future slice mean .

[0156] At the mathematical modeling level, the mean of the slices of the input sequence is represented as , and the standard deviation is , and the following parameterized model is constructed to predict the future slice mean and the future slice standard deviation :

[0157] (15)

[0158] (16)

[0159] where represents the local mean shift, characterizes the stationarity of the sequence. The learnable parameters constitute an adaptive weight matrix of the feature dimension, which is used to fuse the residual prediction term and the historical reference term. This design gives the model two modeling capabilities: capture variable-specific dynamic change patterns, maintain reasonable inheritance of historical reference.

[0160] S6, fuse the prediction results of the difference-aware time series prediction module and the prediction results of the dynamic statistical feature prediction module as the final time series prediction results;

[0161] This step is the core integrated link of the method of the present application, aiming to deeply fuse the refined time sequence features output by the difference perception time sequence prediction module (main prediction module) with the future data distribution statistics predicted by the dynamic statistical feature prediction module, to generate the final prediction result which is both accurate and stable. The fusion process is not a simple weighted average, but a reconstruction process based on statistical denormalization with clear physical meaning.

[0162] The outputs of the two modules represent different levels of prediction of the future sequence. The output of the difference perception time sequence prediction module is a prediction value generated on the standardized data scale. It captures the detailed sequence pattern after seasonal-trend decomposition, adversarial training and spatiotemporal modeling, but its numerical range depends on the mean and variance used in the previous slice standardization. The output of the dynamic statistical feature prediction module is the predicted statistics (predicted mean and standard deviation) of the future time window (slice), which defines the expected distribution characteristics of the future data on the original scale. Therefore, the final prediction must "pull back" the output of the difference perception time sequence prediction module from the standardized scale to the real original data scale. This "pull back" operation requires the use of the predicted future distribution statistics, which is essentially a denormalization process.

[0163] The final fusion is achieved through the denormalization operation. Specifically, the output of the difference perception time sequence prediction module and the future statistics output by the dynamic statistical feature prediction module are fused according to the following formula:

[0164] (17)

[0165] wherein, denotes the prediction result generated by the difference perception time sequence prediction module on the normalized scale, denotes the final fused prediction result, and in addition, denotes element-wise multiplication, which is equivalent to dynamically adjusting the scale and offset of the refined result of the difference perception time sequence prediction module according to the predicted future data distribution, thereby generating the final prediction result which is both accurate and stable. The advantages of this fusion strategy are highlighted in the following aspects:

[0166] Firstly, this method can fundamentally solve the non-stationary problem, that is, it dynamically adapts the time-varying characteristics of the time series distribution (mean and variance). The traditional method uses fixed global statistics or past window statistics for de-standardization, which cannot cope with the drift of future distribution, while the present invention directly predicts the future statistics and corrects it, which fundamentally suppresses the distribution deviation problem caused by non-stationarity. Secondly, this method enhances robustness through seasonal-trend decomposition and domain adversarial mechanism, that is, under the mutual verification of the two modules, if a sudden event causes a short-term sequence pattern, a dramatic change, but the dynamic statistical feature prediction module judges that the overall statistical quantity does not change much based on a longer perspective, then the result after fusion will be pulled back to a more reasonable range.

[0167] Experimental example,

[0168] Regarding the experimental related configuration and the experimental results of the present invention, the following contents are included:

[0169] A. Dataset and model setting:

[0170] The present invention mainly conducts experiments on commodity data sets, the proposed model input length is 96, the convolution kernel size is 3, uses ReLU activation and multi-layer perception, and finally uses a fully connected layer, which includes an intermediate layer of 128 units and an output layer.

[0171] B. Training setting:

[0172] As shown in Figure 3 and Figure 4 , in order to better view the effectiveness of the present invention, this experiment is conducted under different time series output lengths 96, 192, 336, 720, and ensures that the model follows the same experimental settings. In the experiment, two widely used indicators, mean square error MSE ( Figure 3 ) and mean absolute error MAE ( Figure 4 ), are used to measure the performance of the model. The present invention sets the number of iterations to 2 and the training rounds to 10 rounds in the experiment, and uses Adam as the local optimizer. The time series data is divided by dynamic slicing according to the mean and variance size. By dynamically adjusting the learning rate and dropout rate during training, the learning degree of the model in each round is controlled. The lower the learning rate and dropout rate, the closer the parameters learned each time to the model, and the more accurate the model prediction result. The present invention compares the ablation experiment by removing key components, that is, the time convolution TCN, the Transformer and the dynamic slicing length adjustment module, and the overall model.

[0173] C. Experimental results:

[0174] From the experimental comparison Figure 3 and Figure 4It can be concluded that the performance of the overall model is significantly better than that of its key components, and the average MSE and MAE are the lowest. Among them, the contribution of the Transformer module is the most critical, and its absence leads to a significant increase in the average absolute error MAE by 27.32% in the length prediction of the output length of 720. In addition, compared with removing other key components, removing the dynamic slice length adjustment module will result in higher MSE and MAE at all prediction lengths. This shows that the complete structure of the model, especially the Transformer and dynamic statistical feature prediction module, is crucial to improving the prediction accuracy.

[0175] Obviously, the above embodiments of the present application are only examples for clearly illustrating the technical solutions of the present application, and are not intended to limit the specific embodiments of the present application. Any modifications, equivalent replacements and improvements made within the spirit and principle of the claims of the present application should be included in the protection scope of the claims of the present application.

Claims

1. A method for illegal behavior prediction based on dynamic slicing and dual-branch adversarial, characterized in that, The method comprises: S1, collecting a multi-dimensional network transaction illegal behavior commodity time series data set; The multi-dimensional network transaction illegal behavior commodity time series data set refers to a collection of different types of multi-dimensional fluctuation characteristic sequence data reflecting commodity attributes and changes over time within a period of time, wherein the multi-dimensional fluctuation characteristic sequence data is indexed by a time stamp, and records the dynamic behavior characteristics and state changes of commodities in different dimensions; The commodity time series data set includes: commodity type, regional distribution, platform attribute, illegal timestamp, illegal type and event marker; S2, constructing an illegal behavior time series prediction model, comprising: a dynamic slice length adjustment module, a difference perception time series prediction module, and a dynamic statistical feature prediction module; S3, taking the time series data set as the input of the illegal behavior time series prediction model, first inputting it into the dynamic slice length adjustment module, dynamically slicing the data set through a variance-driven adaptive decision mechanism, and standardizing each slice; S4, inputting the standardized data into the difference perception time series prediction module for processing, specifically comprising the following steps: S41, performing spatio-temporal feature enhancement through a graph convolutional neural network and a TCN-Transformer parallel fusion mechanism; S42, extracting seasonal components in the time series through Fourier series decomposition and adaptive parameter learning, capturing trend components in the time series through polynomial regression and time feature extraction, and combining the two to generate a prediction result; S43, realizing feature alignment of event data and regular data through a joint optimization framework of adversarial domain alignment and Wasserstein distance optimization; S5, input the standardized data into the dynamic statistical feature prediction module, and process it using a lightweight neural network: for the prediction of future slice standard deviation, introduce a non-negative activation constraint to maintain physical meaning; for the prediction of future slice mean, the network no longer directly predicts the absolute value, but learns the current slice mean and the residual mode of the historical global mean ​ S6, fusing the prediction results of the difference perception time series prediction module and the prediction results of the dynamic statistical feature prediction module as the final time series prediction result.

2. The method of claim 1, wherein the method is characterized by, In step S2, the dynamic slice length adjustment module of the illegal behavior time series prediction model dynamically adjusts the slice length based on the variance size, adaptively capturing patterns and features at different time scales; The difference perception time series prediction module includes three parts: 1) feature extraction part: TCN-Transformer captures short-term and long-term time dependence, and graph neural network captures spatial dependence; 2) Seasonal-trend component decomposition part: seasonal block and trend block capture seasonal component and trend component respectively, and enhance the robustness to abnormal data through seasonal and trend component decomposition; 3) Adversarial training part: minimize the distribution difference between event data and regular data; The dynamic statistical feature prediction module uses a lightweight neural network to predict the mean and variance of the future slice based on the mean and variance of the current slice; The illegal behavior time series prediction model finally fuses the output of the difference perception time series prediction module and the future statistical quantity output by the dynamic statistical feature prediction module through a de-standardization operation to obtain the final prediction result.

3. The method of claim 1, wherein the method is characterized by, The core of the variance-driven adaptive decision mechanism in step S3 is to dynamically adjust the slice length according to the local real-time variance, based on which a dual-window architecture of a cooperative detection window and an execution window is designed The recursive estimation of the local variance triggers the dynamic adjustment of the slice of the execution window, and specifically includes the following steps: S31, sliding through the fixed length n detection window traversal timing data, real-time calculation of local variance intensity in the detection window , as a measure of data volatility core indicators: （1） wherein, and represent the detection window latest and move-out data points, respectively, is the historical mean; based on variance intensity Dynamic regulation of execution window slice length : Increase time compression To capture local mutations, Decrease time expansion To maintain trend continuity; S32, for intermittent high-variance scenarios, an exponential decay mechanism is introduced to suppress overactive response: （2） wherein is the baseline adjustment amount, controls the decay rate, is the cumulative adjustment count.

4. The method of claim 1, wherein the method is characterized by, In step S41, the over-graph convolutional neural network is combined with the TCN-Transformer parallel fusion mechanism for spatio-temporal feature enhancement, specifically including the following steps: S411, local time sequence features are extracted through the dilated convolution and residual connection of TCN: First, by temporal convolutional network (TCN) through integrating dilated causal convolution and residual connection, specifically, at time step , dilated causal convolution operation is performed on the input : （3） wherein, denotes the dilation factor, denotes the convolution kernel size, denotes an index variable inside the convolution kernel, used to traverse all positions of the convolution kernel, denotes the learnable parameter of the convolution kernel at the th position, used for weighted summation of the input sequence, denotes the result of the convolution operation at time , and the output sequence after the convolution operation is denoted as ; Then, the time convolution TCN can effectively capture multi-scale temporal patterns by stacking convolution kernels with different dilation factors in a hierarchy, and the final output of the TCN residual block is denoted as : （4） wherein, represents a learnable weight matrix for projecting the input into the same dimensional space to enable a residual connection, represents a multivariate time series of inputs after convolution operation on X, represents the output after convolution on the input ;​​ S412, global time sequence dependencies are modeled using the Transformer self-attention mechanism: In the TCN backend cascade Transformer encoder, the global temporal correlation is established through the multi-head attention mechanism. Specifically, the hidden state of the l-1 layer The multi-head attention mechanism calculation process is defined as: （5） （6） wherein, represents the number of attention heads, represents the output weight matrix, represents the output of the th attention head, , and represent the weight matrices of the query, key and value, respectively, represents the dimensions of the attention head query and key; S413, the TCN and the Transformer construct a parallel processing architecture, integrate the convolution feature and the self-attention feature through a feature fusion module, and generate a joint representation output integrating global-local dependency : （7） where H denotes the hidden state, i.e., the intermediate representation in the Transformer encoder, denotes the processing result of the multi-head self-attention mechanism on the hidden state, and concat(.) denotes the concatenation operation on the outputs of the TCN and the Transformer module. S414, adaptive spatial dependency modeling is performed through the graph convolutional neural network: The implicit structure correlation between nodes is modeled through the graph convolutional network, and high-order neighbor information is aggregated through multiple-order graph convolutional layers to iteratively update the node representation. The graph convolution operation is as follows: （8） wherein G represents a graph based on an adjacency matrix, represents an activation function, represents a learnable parameter matrix, is an adjacency matrix with self-connections, is is a diagonal matrix of S415, spatio-temporal features are fused through a multi-layer perceptron to form a spatio-temporal joint representation that combines local perception and global dependency: By parameterizing the spatiotemporal feature interaction mechanism, the final representation of spatiotemporal dependency is obtained As follows: （9） wherein, represents a function for decoupling parameters for splitting the feature into different parts.

5. The method of claim 4, wherein the method is characterized by, Step S42 specifically includes the following steps: S421, seasonal components in the time series are extracted through Fourier series decomposition and adaptive parameter learning: the seasonal signal is decomposed into a linear combination of multiple sinusoidal and cosine functions of different frequencies using Fourier series: （10） wherein, denotes the seasonal component at time , and are parameters learned by the model, corresponding to the amplitude and phase of the th frequency component, respectively, is the period of the seasonality, is the number of terms of the Fourier series; In addition, different learning parameters are introduced when learning periodic patterns to control the amplitude and phase of each component in the Fourier series, thereby capturing various complex periodic patterns; S422, the trend component in the time series is captured through polynomial regression and time feature extraction: a polynomial function is fitted through polynomial regression to describe the long-term trend of the time series: （11） wherein, denotes a trend component at time , , , , is a coefficient of a polynomial regression for controlling the shape of the trend, is the degree of the polynomial, and extracting long-term trend information in the time series by the polynomial function can effectively capture linear and nonlinear trend changes in the time series; S423, the seasonal component and the trend component are integrated together through multiplication to generate the final prediction result.

6. The method of claim 5, wherein the method is characterized by, In step S43, the feature alignment between event data and regular data is realized through a joint optimization framework of adversarial domain alignment and Wasserstein distance optimization, specifically including the following steps: S431、design domain discriminator loss function to achieve feature alignment of event data and regular data, loss function is defined as follows: （12） wherein, denotes a feature encoder, denotes a domain discriminator, and denote probability distributions of event data and regular data, respectively, and denote and observed samples of S432, the Wasserstein distance is used as a difference measure to alleviate the gradient vanishing problem in adversarial training, and a gradient penalty term is introduced to enhance training stability, where the Wasserstein distance and the gradient penalty term are represented as: （13） （14） wherein denotes a domain discriminator for 1-Lipschit constraints, denotes a feature space sampling point, is a penalty coefficient.

7. The method of claim 1, wherein the method further comprises: The step S5 is specifically as follows: Let the input sequence be The mean of the slices is expressed as The standard deviation is Construct the following parameterized model for the mean of future slices. and standard deviation of future slices Make a prediction: （15） （16） wherein denotes the local mean shift, characterizes the stationary feature of the sequence; the learnable parameter constitutes the adaptive weight matrix of the feature dimension, which is used to fuse the residual prediction term and the historical reference term, and endows the model with two aspects of modeling capabilities: capture the variable-specific dynamic change pattern, maintain a reasonable inheritance of the historical reference.

8. The method of claim 1, wherein the method is characterized by, In step S6, the fusion of the prediction results of the difference-aware time series prediction module and the prediction results of the dynamic statistical feature prediction module refers to the inverse normalization calculation of the prediction results generated by the difference-aware time series prediction module on the normalized scale using the future slice mean prediction value and the standard deviation prediction value output by the dynamic statistical feature prediction module, to reconstruct the final prediction results on the original data scale.

Images