A method and system for real-time monitoring of advertising delivery status

Abstract

This application relates to the field of data processing technology and discloses a method and system for real-time monitoring of advertising delivery status. The method includes: collecting advertising delivery event streams, extracting instantaneous indicators and volatility; statistically analyzing historical anomaly propagation delays and strengths to construct a propagation matrix; when detecting single-point anomalies, predicting downstream anomalies based on the propagation matrix and calculating deviation, searching for anomaly propagation chains; extracting propagation chain features to construct anomaly fingerprints, matching fingerprint similarity against a similarity database, directly confirming high similarity, and verifying low similarity by injecting probe traffic. This application, by constructing a real-time monitoring method based on anomaly propagation matrices, solves the problems of existing technologies such as the inability to quantify the propagation relationship between indicators, the inability to predict downstream anomaly moments, high false positive and false negative rates, and slow anomaly confirmation response, thereby improving the accuracy, real-time performance, and intelligence level of advertising delivery anomaly detection.

Description

Technical Field

[0001] This application relates to the field of data processing technology, and in particular to a method and system for real-time monitoring of advertising delivery status. Background Technology

[0002] With the continuous expansion of digital advertising, real-time monitoring of advertising delivery systems has become a crucial element in ensuring advertisers' campaign effectiveness and platform stability. Existing technologies primarily employ single-metric monitoring methods based on fixed thresholds. These methods set upper and lower limits for core metrics such as click-through rate (CTR) and conversion rate, triggering alarms when a metric exceeds these thresholds. Some improved solutions introduce multi-metric independent monitoring mechanisms, setting thresholds for multiple dimensions such as impressions, CTR, conversion rate, and budget expenditure rate, and monitoring them in parallel. This aims to improve the comprehensiveness of anomaly detection by expanding monitoring coverage. Other technical solutions utilize rule-based correlation monitoring, using manually summarized empirical rules to determine abnormal correlations between multiple metrics. For example, a systemic anomaly alarm might be triggered when both CTR and conversion rate abnormally decrease.

[0003] However, the aforementioned existing technologies have significant shortcomings. First, the fixed threshold method cannot adapt to the dynamic fluctuations of metrics in advertising scenarios. Natural fluctuations in metrics during normal traffic peaks and promotional activities are prone to triggering false alarms, while gradual abnormal changes may be missed because they do not reach the threshold, resulting in high false alarm and missed alarm rates. Second, while independent monitoring of multiple metrics expands the monitoring dimensions, alarms from each metric are independent, making it impossible to identify the transmission relationship and causal chain between metrics. When an upstream metric anomaly triggers a chain reaction in downstream metrics, the system can only passively issue alarms at each stage without tracing the source of the anomaly. This requires maintenance personnel to check multiple alarms one by one to locate the root cause, resulting in response times of up to several minutes. Third, rule-based correlation monitoring relies on human experience, has limited rule coverage, and is difficult to adapt to new anomaly patterns. When encountering anomaly transmission paths not defined in the rule base, the system cannot identify them, and conflicts between rules may lead to judgment confusion. Summary of the Invention

[0004] This application provides a method and system for real-time monitoring of advertising delivery status, which improves the accuracy, real-time performance, and intelligence of advertising delivery anomaly detection.

[0005] Firstly, this application provides a method for real-time monitoring of advertising delivery status, the method comprising:

[0006] Step S1: Collect the advertising event stream, extract instantaneous indicator values ​​and volatility according to the time window, and generate a real-time feature sequence;

[0007] Step S2: Calculate the time difference between the abnormal moments of upstream and downstream indicators in historical abnormal events to obtain the propagation delay and propagation strength, and construct an abnormal propagation matrix;

[0008] Step S3: When a single point of anomaly is detected, the expected time of the downstream indicator is determined according to the transmission delay in the anomaly transmission matrix. The deviation between the actual anomaly response intensity of the downstream indicator and the transmission intensity is calculated. When the deviation exceeds the threshold, the associated anomaly is marked. The directed transmission path containing multiple associated anomalies is searched to obtain the anomaly transmission chain.

[0009] Step S4: Extract the topology, delay parameters, and fluctuation amplitude of the abnormal transmission chain to form an abnormal fingerprint. Match the similarity of historical abnormal fingerprints in the fingerprint database. When the similarity is higher than the first threshold, the abnormality is directly confirmed. When the similarity is lower than the second threshold, inject probe traffic to verify whether the abnormal transmission chain is reproduced in the probe traffic.

[0010] Secondly, this application provides a real-time monitoring system for advertising delivery status, the real-time monitoring system for advertising delivery status comprising:

[0011] The generation module is used to collect advertising event streams, extract instantaneous indicator values ​​and volatility according to time windows, and generate real-time feature sequences.

[0012] The statistics module is used to calculate the time difference between the abnormal moments of upstream and downstream indicators in historical abnormal events, obtain the propagation delay and propagation strength, and construct an abnormal propagation matrix.

[0013] The search module is used to determine the expected abnormal time of downstream indicators based on the transmission delay in the abnormal transmission matrix when a single point of abnormality is detected, calculate the deviation between the actual abnormal response intensity of the downstream indicators and the transmission intensity, mark the associated abnormality when the deviation exceeds a threshold, and search for a directed transmission path containing multiple associated abnormalities to obtain an abnormal transmission chain.

[0014] The matching module is used to extract the topology, delay parameters and fluctuation amplitude of the abnormal transmission chain to form an abnormal fingerprint. It matches the similarity of historical abnormal fingerprints in the fingerprint database. When the similarity is higher than a first threshold, the abnormality is directly confirmed. When the similarity is lower than a second threshold, probe traffic is injected to verify whether the abnormal transmission chain is reproduced in the probe traffic.

[0015] The technical solution provided in this application collects advertising event streams and extracts instantaneous indicator values ​​and volatility according to time windows to generate real-time feature sequences. Compared with existing technologies that use fixed time intervals to batch statistically analyze indicators, this solution achieves millisecond-level event capture and second-level sliding window aggregation. This allows feature extraction to reflect the instantaneous changes in indicators rather than lagging average levels. The introduction of volatility features further captures the speed information of indicator changes, providing a more sensitive input signal for subsequent anomaly detection. The technical feature of obtaining the transmission delay and transmission strength by statistically analyzing the time difference between upstream and downstream indicators in historical anomaly events and constructing an anomaly transmission matrix fundamentally solves the problem that existing technologies cannot quantify the correlation between indicators. A quantitative model of inter-indicator transmission is established through statistical analysis of historical data. The transmission delay parameter quantifies the time required for anomalies to propagate between different indicators, and the transmission strength parameter quantifies the degree of impact of upstream anomalies on downstream indicators. Matrix storage allows for rapid querying of transmission parameters for any pair of indicators, providing a reliable knowledge base for real-time anomaly detection.

[0016] When a single-point anomaly is detected, the expected anomaly time of the downstream indicator is determined based on the propagation delay in the anomaly propagation matrix, and the deviation between the actual anomaly response intensity and the propagation intensity of the downstream indicator is calculated. This technical feature realizes the transformation from passively waiting for anomalies to occur to actively predicting the anomaly time. The system can predict when the downstream will have an anomaly immediately after the upstream anomaly occurs based on the propagation delay and monitor the downstream indicator at the expected time. The deviation calculation further realizes the judgment of whether the correlation relationship itself is abnormal. When there is a significant deviation between the actual response intensity and the historical propagation intensity, it indicates that the normal correlation pattern between indicators has been destroyed. This approach of monitoring the anomaly of the correlation relationship rather than simply monitoring the anomaly of the indicator effectively reduces the false alarm rate. At the same time, by searching for directed propagation paths containing multiple correlated anomalies, the anomaly propagation chain is obtained, and the scattered single-point anomalies are linked into a complete propagation sequence, enabling the system to identify systemic anomalies rather than random fluctuations. Attached Figure Description

[0017] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 This is a schematic diagram of an embodiment of the real-time monitoring method for advertising delivery status in this application.

[0019] Figure 2 This is a schematic diagram of the abnormal transmission matrix in an embodiment of this application. Detailed Implementation

[0020] This application provides a method and system for real-time monitoring of advertising placement status. The terms first, second, third, fourth, etc. (if present) in the specification, claims, and accompanying drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments described herein can be implemented in a sequence other than that illustrated or described herein. Furthermore, the terms include or have, and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that includes a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0021] For ease of understanding, the specific process of the embodiments of this application is described below. Please refer to [link / reference]. Figure 1 One embodiment of the real-time monitoring method for advertising delivery status in this application includes:

[0022] Step S1: Collect the advertising event stream, extract instantaneous indicator values ​​and volatility according to the time window, and generate a real-time feature sequence;

[0023] Specifically, the raw event stream is directly pushed to the streaming computing engine after being marked with millisecond-level timestamps. Real-time aggregation at a 10-second granularity is achieved based on a sliding window mechanism. This architecture reduces feature extraction latency from 5-30 minutes in existing technologies to less than 10 seconds. The introduction of volatility features is a significant innovation of this invention. By calculating the relative rate of change between the current window indicator value and the previous window indicator value, the instantaneous rate of change of the indicator is captured rather than its absolute value. This provides a more sensitive input signal for subsequent identification of abnormal transmission patterns.

[0024] Step S2: Calculate the time difference between the abnormal moments of upstream and downstream indicators in historical abnormal events to obtain the propagation delay and propagation strength, and construct an abnormal propagation matrix;

[0025] Specifically, the propagation delay is obtained by using the median time difference between the occurrence times of upstream and downstream indicator anomalies in historical statistical data. This parameter quantifies the time required for anomalies to propagate between different indicators. The propagation strength is obtained by calculating the correlation coefficient between the amplitudes of upstream and downstream indicator anomalies. This parameter reflects the degree of impact of upstream anomalies on downstream indicators. The parameter pairs stored in the matrix elements enable the system to predict which downstream indicators will be affected and for how long after an anomaly occurs, as well as the intensity of that impact. This quantitative correlation model is unique in existing technologies.

[0026] Step S3: When a single point of anomaly is detected, the expected time of the downstream indicator is determined based on the propagation delay in the anomaly propagation matrix. The deviation between the actual anomaly response intensity and the propagation intensity of the downstream indicator is calculated. When the deviation exceeds the threshold, the associated anomaly is marked. The directed propagation path containing multiple associated anomalies is searched to obtain the anomaly propagation chain.

[0027] Specifically, upon detecting a single-point anomaly, the downstream indicator is predicted to exhibit anomalies after a transmission delay based on the transmission matrix, and its anomaly response strength is expected to be consistent with historical transmission strength. The deviation is obtained by calculating the relative difference between the actual response strength and historical transmission strength. When the deviation exceeds a threshold, it indicates that the correlation between the indicators themselves is abnormal. This approach of monitoring abnormal correlations rather than indicator anomalies fundamentally solves the problem of high false alarm rates in single-indicator threshold judgments. The identification of anomaly transmission chains further links multiple related anomalies according to temporal and causal relationships, forming a complete anomaly transmission path. When the path length reaches three or more nodes and the delay deviation meets the requirements, it indicates that a systemic anomaly has been detected rather than a random fluctuation.

[0028] Step S4: Extract the topology, delay parameters, and fluctuation amplitude of the abnormal transmission chain to form an abnormal fingerprint. Match the similarity of historical abnormal fingerprints in the fingerprint database. When the similarity is higher than the first threshold, the abnormality is directly confirmed. When the similarity is lower than the second threshold, inject probe traffic to verify whether the abnormal transmission chain is reproduced in the probe traffic.

[0029] Specifically, the anomaly fingerprint matching mechanism achieves rapid decision-making by establishing a historical anomaly feature database. Anomaly fingerprints comprise three dimensions: topological features, temporal features, and intensity features, comprehensively describing the structural patterns and numerical characteristics of the anomaly propagation chain. Similarity matching is achieved by calculating and weighting the distances between newly detected anomalies and historical anomalies in the database across each dimension. When the similarity exceeds a first threshold, it indicates a high degree of similarity between the new anomaly and known anomalies; in this case, the verification process is skipped, and direct confirmation is performed, reducing the response time from 180 seconds to 15 seconds. When the similarity falls below a second threshold, it indicates the encounter of a new anomaly pattern. At this point, a probe traffic verification mechanism is initiated, injecting a small proportion of test traffic and observing whether it reproduces the same anomaly pattern to eliminate the risk of misjudgment. The configuration parameters of the probe traffic are identical to those of normal traffic but include a unique identifier, minimizing interference with normal deployment during the verification process.

[0030] In one specific embodiment, step S1 includes:

[0031] Deploy an event stream capture module in the front-end monitoring code of the advertising platform to mark ad display events, click events, and conversion events with millisecond-level timestamps to obtain the raw event stream;

[0032] The raw event stream is pushed to the streaming computing engine, and the events are aggregated in real time according to a 10-second time window based on the sliding time window mechanism to calculate the instantaneous display volume, instantaneous click volume and instantaneous conversion volume.

[0033] The instantaneous click-through rate (CTR) is calculated based on the ratio of instantaneous clicks to instantaneous impressions. The CTR fluctuation rate is calculated based on the ratio of the difference between the current CTR and the CTR of the previous time window to the CTR of the previous time window.

[0034] The conversion time distribution of click behavior at the current moment within the subsequent 300-second time window is statistically analyzed. The ratio of the difference between the median actual conversion delay and the expected value of historical conversion delay to the standard deviation of historical conversion delay is calculated to obtain the conversion delay index. The instantaneous click-through rate, click-through rate volatility, instantaneous conversion volume, and conversion delay index are combined to form a real-time feature sequence.

[0035] Specifically, the event stream capture module uses a JavaScript event listener mechanism in the front-end monitoring code to implement millisecond-level timestamps. When a user's browser triggers an ad display, click, or conversion, it immediately records information such as a Unix timestamp, event type identifier, and user device fingerprint. This raw event data is transmitted in real time to the back-end data collection server via asynchronous HTTP requests or WebSocket long connections, avoiding the time delay caused by writing to log files first and then reading them in batches in the traditional method. The streaming computing engine uses a sliding time window mechanism to aggregate events in real time. The window slides forward every 10 seconds, and the events within the window are categorized and statistically analyzed according to event type to obtain instantaneous impressions, instantaneous clicks, and instantaneous conversions. This sliding window design allows for obtaining statistical indicators from the most recent 10 seconds at any given moment, providing higher time resolution and continuity compared to fixed-window statistics.

[0036] Click-through rate (CTR) volatility is calculated by subtracting the CTR of the previous window from the current instantaneous CTR to obtain the absolute change, and then normalizing by dividing by the previous window's CTR. This indicator reflects the relative rate of change of CTR rather than its absolute level, and can effectively identify sudden changes in CTR. The conversion latency index is calculated by tracking whether each click results in a conversion within the next 300 seconds and the timing of the conversion. After sorting all conversion latency samples, the median is taken as the actual conversion latency. The difference between this median and the expected value of the conversion latency under normal historical conditions is calculated, and then divided by the standard deviation of historical conversion latency for standardization. The resulting conversion latency index is a dimensionless standardized indicator. When this index significantly deviates from 0, it indicates an abnormal distribution of current conversion latency. The real-time feature sequence organizes these indicators of different dimensions into a vector form according to time order for subsequent analysis.

[0037] In one specific embodiment, step S2 includes:

[0038] Retrieve advertising data from the past 30 days, which includes real-time feature sequences and the times when confirmed real anomalies occurred;

[0039] Identify the set of moments in historical data where each indicator exhibits significant anomalies. Significant anomalies are defined as the volatility of the corresponding indicator exceeding the 95th percentile of the historical volatility distribution.

[0040] For each abnormal moment of the upstream indicator, search for the earliest moment when the downstream indicator becomes significantly abnormal within the subsequent 600-second time window, calculate the time difference between the two moments, perform statistical analysis on the time differences of all samples and calculate the median to obtain the propagation delay.

[0041] Calculate the correlation coefficient between the abnormal amplitude of upstream metrics at the moment of anomaly and the abnormal amplitude of downstream metrics after the transmission delay to obtain the transmission strength. Construct a 5×5 matrix with five metrics—impressions, click-through rate, conversion rate, budget consumption rate, and user dwell time—as rows and columns. Store parameter pairs of transmission delay and transmission strength from row metrics to column metrics in the matrix elements to obtain the anomaly transmission matrix.

[0042] Specifically, the 95th percentile threshold of historical volatility distribution is determined by collecting all volatility values ​​of a certain indicator over the past 30 days and sorting them from smallest to largest. The value at the 95th percentile after sorting is taken as the criterion for judging the significant anomaly of the indicator. This threshold setting method based on statistical distribution can automatically adjust the judgment criteria according to the historical volatility characteristics of different indicators, avoiding misjudgments caused by manually setting a fixed threshold.

[0043] Identifying significant anomalous time sets requires checking whether the volatility of each indicator in each time window of historical data exceeds the corresponding threshold. The times that meet the conditions are recorded together with their indicator types to form an anomalous event sample library containing timestamps and indicator identifiers. These samples serve as the basic data for analyzing the transmission relationship between indicators.

[0044] The statistical analysis of propagation delay is performed separately for each pair of indicators. When the upstream indicator becomes significantly abnormal at a certain moment, the moment when the downstream indicator first becomes significantly abnormal is found within 600 seconds after that moment. The interval between the two moments is the time difference of a single propagation. This process is repeated to collect time difference samples corresponding to all abnormal moments of the upstream indicator. After sorting these samples, the value of the median position is extracted as the propagation delay of the indicator pair. The median is less sensitive to extreme values ​​than the mean and therefore reflects the typical propagation time better.

[0045] The transmission strength reflects the degree of linear correlation between the amplitude of upstream and downstream anomalies. During calculation, the absolute value of the volatility at the moment of the upstream indicator's anomaly and the absolute value of the volatility of the downstream indicator after the transmission delay are extracted from each sample. The upstream amplitude values ​​from multiple samples form one set of data, and the downstream amplitude values ​​form another set. The Pearson correlation coefficient between the two sets of data is calculated to quantify their synchronous change relationship. The closer the absolute value of the correlation coefficient is to 1, the more stable and predictable the impact of the upstream anomaly on the downstream anomaly is. The anomaly transmission matrix uses a row-column structure to store the transmission parameters between the five core indicators. Each off-diagonal position in the matrix corresponds to a pair of upstream and downstream indicator combinations. This position stores the transmission delay and transmission strength values ​​calculated using the above method. After the matrix is ​​constructed, the transmission parameters of any indicator pair can be directly retrieved through row and column indexes.

[0046] Figure 2 This is a schematic diagram of the abnormal transmission matrix in an embodiment of this application; Figure 2 The diagram illustrates the anomaly propagation matrix structure constructed in this application. This matrix uses five core metrics—impressions, click-through rate (CTR), conversion rate, budget expenditure rate, and dwell time—as rows and columns. The matrix employs an upper triangular storage method, with each off-diagonal position storing the propagation parameter pair from the row metric to the column metric. The shades of gray in the diagram represent the magnitude of the propagation intensity; larger values ​​indicate darker colors, signifying a stronger correlation between upstream and downstream metrics. Each cell is labeled with two key parameters: propagation delay (in seconds) and propagation intensity (correlation coefficient). For example, the propagation delay from impressions to CTR is 15 seconds, and the propagation intensity is 0.82, indicating that an anomaly in impressions typically triggers an anomaly in CTR 15 seconds later, and the correlation coefficient between the two anomaly magnitudes reaches 0.82. This matrix was obtained by statistically analyzing the median time difference and correlation coefficient of anomaly events for each metric over a historical 30-day period. It provides a quantitative basis for predicting the expected anomaly time for downstream metrics and determining whether the correlation is abnormal during real-time anomaly detection, and is the core data structure for achieving anomaly propagation chain identification in this application.

[0047] In one specific embodiment, step S3, which determines the expected abnormal moment of the downstream indicator based on the propagation delay in the abnormal propagation matrix and calculates the deviation between the actual abnormal response intensity and the propagation intensity of the downstream indicator, includes:

[0048] When the volatility of a certain indicator at time t exceeds the historical volatility threshold, the corresponding indicator is marked as having a single point of anomaly at time t.

[0049] Based on the abnormal transmission matrix, query the set of downstream related indicators of the corresponding indicator. The set of downstream related indicators consists of all indicators with a transmission strength greater than 0.5.

[0050] For each downstream indicator, based on the propagation delay stored in the anomaly propagation matrix, the expected time of anomaly occurrence is calculated by adding the propagation delay to the current time. Within a 30-second time window before and after the expected time of anomaly occurrence, the downstream indicator is monitored for single-point anomalies.

[0051] When a single-point anomaly is detected in a downstream indicator within a time window, the ratio of the abnormal amplitude of the downstream indicator to the abnormal amplitude of the upstream indicator is calculated as the actual correlation response strength. The deviation is obtained by calculating the ratio of the difference between the actual correlation response strength and the transmission strength stored in the anomaly transmission matrix to the transmission strength.

[0052] Specifically, single-point anomaly identification is achieved by comparing the volatility of each indicator at the current moment with its historical threshold in real time. At the end of each 10-second time window, the monitoring system calculates the volatility of each indicator for that window and compares the volatility of click-through rate, conversion rate, etc., with the corresponding 95th quantile threshold established in step S2. When the absolute value of the volatility of an indicator exceeds its threshold, the indicator type and the current time t are recorded as a single-point anomaly event. This real-time determination mechanism keeps the anomaly detection delay within 10 seconds. The query of the downstream related indicator set is based on the anomaly transmission matrix. When a single-point anomaly is identified for an indicator, all off-diagonal elements in that row are queried according to the indicator's row position in the matrix. The transmission strength value stored in each element is extracted, and all column indicators with a transmission strength greater than 0.5 are selected. These column indicators constitute the downstream related indicator set. A transmission strength threshold of 0.5 indicates that only transmission relationships with moderate to high correlation between upstream and downstream indicators are considered, avoiding noise interference caused by weak correlations.

[0053] The expected time of an anomaly is calculated by adding the current time t to the propagation delay found in the anomaly propagation matrix. This time represents the expected time point when the downstream indicator should exhibit an anomaly according to historical statistical patterns. The monitoring system continuously observes the volatility of the downstream indicator within a 60-second time window, from 30 seconds before to 30 seconds after this expected time, and determines whether the volatility of the downstream indicator exceeds the threshold within this time window. The window is designed with 30 seconds before and after to account for a certain deviation between the actual propagation time and the statistical median. This window tolerance range can cover most actual propagation situations.

[0054] The actual correlation response strength is calculated by dividing the absolute value of the volatility when the downstream indicator actually becomes abnormal by the absolute value of the volatility when the upstream indicator becomes abnormal. This ratio reflects the actual response magnitude of the downstream indicator to the upstream abnormality. The deviation calculation is divided into three steps: First, the intensity deviation is obtained by subtracting the historical transmission strength of the indicator pair stored in the abnormal transmission matrix from the actual correlation response strength. Then, the intensity deviation is normalized by dividing by the historical transmission strength. The resulting value is the deviation. A positive deviation indicates that the downstream response strength is higher than the historical average level, and a negative deviation indicates that it is lower than the average level. The absolute value quantifies the degree of deviation between the current correlation and the historical normal correlation. When the absolute value of the deviation exceeds 0.4, the correlation is marked as abnormal.

[0055] In one specific embodiment, step S3 involves marking association anomalies when the deviation exceeds a threshold, and searching for directed propagation paths containing multiple association anomalies, including:

[0056] When the deviation is greater than 0.4, it indicates that the correlation between upstream and downstream indicators is abnormal.

[0057] Construct a real-time anomaly propagation graph. The node set of the real-time anomaly propagation graph contains all events that have caused single-point anomalies within the last 600 seconds. Each event includes an indicator and the time of occurrence. The edge set of the real-time anomaly propagation graph contains all propagation relationships that are marked as related anomalies.

[0058] A depth-first search algorithm is used to find directed paths with a length of 3 or more in the real-time anomaly propagation graph. A directed path represents an anomaly propagation sequence from the starting node through intermediate nodes to the ending node.

[0059] For each identified directed path, verify whether the deviation between the time interval of adjacent nodes and the propagation delay of the corresponding index pair in the anomaly propagation matrix is ​​less than 30%. If the deviation is less than 30%, retain the corresponding path and obtain the candidate anomaly propagation chain.

[0060] Specifically, the marking of abnormal correlations is based on the absolute value of the deviation. When the calculated deviation value is greater than +0.4, it indicates that the actual response strength of the downstream indicator is significantly higher than the historical transmission strength. When the deviation value is less than -0.4, it indicates that the actual response strength is significantly lower than the historical level. Both of these situations indicate that the normal correlation pattern between indicators has been disrupted. The system records the upstream and downstream indicator pair, the time of the anomaly, and the deviation value, marking the transmission relationship as an abnormal correlation. This marking not only identifies the anomaly of a single indicator, but more importantly, it captures the abnormal changes in the correlation pattern between indicators. The real-time anomaly transmission graph uses a graph data structure to dynamically maintain the abnormal events and their correlations within the current time window. The node set is implemented by maintaining a first-in-first-out queue. Whenever a single point of anomaly is detected, a new node is added to the tail of the queue. The node contains an indicator type identifier and a timestamp of the anomaly occurrence. Expired nodes whose occurrence time is earlier than the current time are continuously removed from the head of the queue. The edge set stores all upstream and downstream indicator pairs marked as having abnormal correlations. Each edge connects two nodes and has a direction, pointing from the upstream indicator node to the downstream indicator node. The deviation value is also attached to the edge as a weight attribute.

[0061] The depth-first search algorithm starts from any node in the graph and recursively visits adjacent nodes along the outgoing edges. During the visit, the sequence of nodes visited is recorded to form a path. When the path length reaches 3 or more nodes, the path is added to the candidate set. The algorithm avoids visiting the same node repeatedly by maintaining visit markers. After traversing all reachable paths, the algorithm obtains a set of all directed paths in the graph with a length greater than or equal to 3. A path length of 3 means that it contains at least three stages: the initial index anomaly, the intermediate index anomaly, and the terminal index anomaly, which reflects the continuous transmission process of anomalies among multiple indices. Path delay verification is performed on adjacent node pairs in each candidate path. The timestamps of the two adjacent nodes are extracted to calculate the actual time interval. Based on the index type of the two nodes, the corresponding transmission delay is queried in the anomaly transmission matrix. The absolute value of the difference between the actual time interval and the transmission delay is calculated. This difference is divided by the transmission delay to obtain the relative deviation ratio. When the deviation ratio is less than 0.3 (30%), the temporal relationship of the adjacent node pair is considered to conform to the historical transmission pattern. All adjacent node pairs in the path are verified one by one. Only the path in which all node pairs meet the delay deviation requirement is retained as a candidate anomaly transmission chain. This delay verification mechanism filters out random associations with unreasonable temporal order and ensures that the identified transmission chain has real causal transmission characteristics.

[0062] In one specific embodiment, obtaining the abnormal propagation chain in step S3 further includes:

[0063] For each candidate abnormal propagation chain, extract the propagation intensity corresponding to each edge in the path, calculate the product of all propagation intensities, and obtain the cumulative propagation intensity of the path;

[0064] When the cumulative conduction strength is greater than 0.35 and the path length is greater than or equal to 3, the corresponding candidate anomalous conduction chain is marked as a high-confidence anomalous conduction chain.

[0065] Record the topology, start time, cumulative conduction intensity, and deviation parameters of each node of the abnormal conduction chain to obtain the abnormal conduction chain.

[0066] Specifically, the cumulative transmission strength is calculated by traversing each edge in the candidate anomaly transmission chain. Each edge in the path connects a pair of adjacent anomaly nodes. Based on the index type of this pair of nodes, the corresponding transmission strength value is queried in the anomaly transmission matrix. The transmission strength of the first edge, the second edge, and so on up to the last edge in the path are multiplied sequentially. The resulting product is the cumulative transmission strength of the path. This value quantifies the overall strength attenuation of the anomaly signal from the starting index through multiple intermediate links to the ending index. Since the transmission strength of each edge is between 0 and 1, the value gradually decreases after multiple transmission strengths are multiplied. Therefore, the cumulative transmission strength reflects the reliability of the transmission chain. The larger the value, the more stable the transmission relationship of the entire link.

[0067] The determination of high-confidence anomaly propagation chains is based on two conditions: cumulative propagation strength and path length. The cumulative propagation strength threshold of 0.35 is an empirical value determined based on historical data analysis. When three edges with a propagation strength of approximately 0.7 are multiplied sequentially, the product is approximately 0.343. Therefore, the threshold of 0.35 can filter out propagation chains where the propagation strength of each link reaches a medium or higher level. Simultaneously, a path length of at least three nodes is required to ensure continuous propagation of the anomaly between at least two propagation links. Candidate anomaly propagation chains that meet these two conditions are marked as high-confidence, indicating that the chain has both sufficient propagation length to reflect systemic anomaly characteristics and sufficient propagation strength to ensure the reliability of the association between each link. The record of the anomaly propagation chain contains multi-dimensional information. The topology is represented by a node sequence, recording the complete order of the path from the starting index through each intermediate index to the ending index. The starting time records the timestamp of the first node in the path, i.e., the starting index, where the anomaly occurs. The cumulative propagation strength records the product value obtained from the aforementioned calculations. The deviation parameters of each node are stored in array form, representing the deviation values ​​of the association between each pair of adjacent nodes in the path. This information comprehensively describes the structural, temporal, and intensity characteristics of the anomaly propagation chain. In one specific embodiment, step S4 includes:

[0068] The indicators involved in the abnormal transmission chain are numbered and an adjacency matrix is ​​constructed as the topological feature. The time delay parameters of each transmission link are extracted as the time series feature. The abnormal volatility of each node and the transmission strength of each edge are extracted as the intensity feature. The topological feature, time series feature and intensity feature are spliced ​​together to obtain the abnormal fingerprint.

[0069] Retrieve historical anomalous fingerprints from the anomalous fingerprint database, calculate the topological distance, temporal distance, and intensity distance between the anomalous fingerprint and the historical anomalous fingerprint, calculate the comprehensive distance based on the weighted combination, and convert it into similarity.

[0070] When the similarity is higher than the first threshold, the status of the abnormal transmission chain is directly set to confirmed; when the similarity is lower than the second threshold, probe traffic is injected into the advertising platform, and the abnormal detection process of steps S1 to S3 is performed on the probe traffic. When the weighted combination of the topological similarity and temporal similarity between the abnormal transmission chain detected in the probe traffic and the original abnormal transmission chain is greater than the verification threshold, the abnormal transmission chain is confirmed to be a real systemic problem.

[0071] Specifically, the construction of topological features first involves numbering the metrics involved in the anomaly propagation chain from 1 to 5 in a fixed order: impressions, click-through rate, conversion rate, budget expenditure rate, and user dwell time. Then, a 5x5 adjacency matrix A is created, with all elements initialized to 0. The path of the anomaly propagation chain is traversed; for each pair of adjacent nodes in the path, if the propagation occurs from metric number i to metric number j, the element in the i-th row and j-th column of the adjacency matrix is ​​set to 1. After traversal, a value of 1 in the adjacency matrix indicates the existence of an abnormal propagation relationship, while a value of 0 indicates no propagation. The diagonal elements of the matrix are always 0 because the indicator does not propagate to itself. Temporal features are constructed by extracting the actual time intervals between adjacent nodes in the path, specifically by extracting the timestamps of the k-th and (k+1)-th nodes in the path. and And calculate the difference Arrange these time differences in path order to form a time delay vector. , where n is the path length. The intensity feature contains two parts of data: node intensity extraction, which is the absolute value of the volatility of the anomalous event corresponding to the k-th node in the path, denoted as . The conduction strength value corresponding to the k-th edge in the edge strength extraction path is denoted as . The strength vector is formed by alternating the node strength and edge strength. The concatenation of abnormal fingerprints flattens the adjacency matrix A into a one-dimensional vector by rows. .

[0072] With time delay vector and intensity vector Connect them sequentially to form a complete feature vector. .

[0073] The fingerprint database is searched and all historical anomalous fingerprints stored in the database are traversed. For the m-th historical fingerprint, the distance between it and the current anomalous fingerprint is calculated. The topological distance is obtained by calculating the Frobenius norm of the two adjacency matrices, i.e. Where A is the adjacency matrix of the current fingerprint. Let be the adjacency matrix of the m-th historical fingerprint. Temporal distance is calculated by the Manhattan distance between two time delay vectors, i.e. ,in This represents the k-th time delay component of the historical fingerprint.

[0074] Intensity distance is calculated by determining the Euclidean distance between two intensity vectors, i.e. ,in and These are the p-th components of the current fingerprint and historical fingerprint strength vectors, respectively. The overall distance is calculated through a weighted combination. The weighting coefficient =0.25、 =0.20、 =0.20.

[0075] Similarity through Calculation, where The maximum value of the combined distance across all historical fingerprints is used for normalization. A similarity score > 0.85 indicates that the current anomaly is highly similar to the m-th historical anomaly. The system directly marks the current anomaly propagation chain as confirmed and generates an alert. When the similarity of all historical fingerprints meets the following condition... A value less than 0.60 indicates a new anomaly pattern. The system initiates probe traffic verification and injects a significant portion of the total traffic into the ad delivery system. The proportion of test traffic.

[0076] Perform the same detection procedure as for normal probe traffic. If an abnormal probe propagation chain is detected within a 180-second verification window, calculate its adjacency matrix. Topological similarity with the original abnormal adjacency matrix A .

[0077] Calculate the temporal similarity of delay vectors ,in To determine the maximum allowable delay, the weighted similarity is: .when When the value is >0.75, it is confirmed that the original abnormal propagation chain is a real systemic problem.

[0078] The above describes the real-time monitoring method for advertising delivery status in the embodiments of this application. The following describes the real-time monitoring system for advertising delivery status in the embodiments of this application. One embodiment of the real-time monitoring system for advertising delivery status in the embodiments of this application includes:

[0079] The generation module is used to collect advertising event streams, extract instantaneous indicator values ​​and volatility according to time windows, and generate real-time feature sequences.

[0080] The statistics module is used to calculate the time difference between the abnormal moments of upstream and downstream indicators in historical abnormal events, obtain the propagation delay and propagation strength, and construct an abnormal propagation matrix.

[0081] The search module is used to determine the expected abnormal time of downstream indicators based on the transmission delay in the abnormal transmission matrix when a single point of abnormality is detected, calculate the deviation between the actual abnormal response intensity of the downstream indicators and the transmission intensity, mark the associated abnormality when the deviation exceeds a threshold, and search for a directed transmission path containing multiple associated abnormalities to obtain an abnormal transmission chain.

[0082] The matching module is used to extract the topology, delay parameters and fluctuation amplitude of the abnormal transmission chain to form an abnormal fingerprint. It matches the similarity of historical abnormal fingerprints in the fingerprint database. When the similarity is higher than a first threshold, the abnormality is directly confirmed. When the similarity is lower than a second threshold, probe traffic is injected to verify whether the abnormal transmission chain is reproduced in the probe traffic.

[0083] The above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for real-time monitoring of advertising delivery status, characterized in that, The method includes: Step S1: Collect the advertising event stream, extract instantaneous indicator values ​​and volatility according to the time window, and generate a real-time feature sequence; Step S2: Calculate the time difference between the abnormal moments of upstream and downstream indicators in historical abnormal events to obtain the transmission delay and transmission strength, and construct an abnormal transmission matrix. This includes: retrieving advertising data from the past 30 days, which includes the real-time feature sequence and the confirmed occurrence time of the actual abnormal event; identifying the set of moments in the historical data where each indicator exhibits significant abnormalities, where a significant abnormality is defined as the volatility of the corresponding indicator exceeding the 95th quantile of the historical volatility distribution; for each abnormal moment of the upstream indicator, searching for the earliest moment when the downstream indicator exhibits a significant abnormality within a subsequent 600-second time window, calculating the time difference between the two moments, performing statistical analysis on the time differences of all samples and calculating the median to obtain the transmission delay; calculating the correlation coefficient between the abnormal amplitude of the upstream indicator at the abnormal moment and the abnormal amplitude of the downstream indicator after the transmission delay to obtain the transmission strength; constructing a 5×5 matrix using five indicators—impressions, click-through rate, conversion rate, budget consumption rate, and user dwell time—as rows and columns, with matrix elements storing parameter pairs of transmission delay and transmission strength from row indicators to column indicators, to obtain the abnormal transmission matrix. Step S3: When a single point of anomaly is detected, the expected time of the downstream indicator is determined according to the transmission delay in the anomaly transmission matrix. The deviation between the actual anomaly response intensity of the downstream indicator and the transmission intensity is calculated. When the deviation exceeds the threshold, the associated anomaly is marked. The directed transmission path containing multiple associated anomalies is searched to obtain the anomaly transmission chain. Step S4: Extract the topology, delay parameters, and fluctuation amplitude of the abnormal transmission chain to form an abnormal fingerprint. Match the similarity of historical abnormal fingerprints in the fingerprint database. When the similarity is higher than the first threshold, the abnormality is directly confirmed. When the similarity is lower than the second threshold, inject probe traffic to verify whether the abnormal transmission chain is reproduced in the probe traffic.

2. The real-time monitoring method for advertising delivery status according to claim 1, characterized in that, Step S1 includes: Deploy an event stream capture module in the front-end monitoring code of the advertising platform to mark ad display events, click events, and conversion events with millisecond-level timestamps to obtain the raw event stream; The original event stream is pushed to the streaming computing engine, and the events are aggregated in real time according to a 10-second time window based on the sliding time window mechanism to calculate the instantaneous display volume, instantaneous click volume and instantaneous conversion volume. The instantaneous click-through rate is calculated based on the ratio of the instantaneous click volume to the instantaneous display volume, and the click-through rate fluctuation rate is calculated based on the ratio of the difference between the instantaneous click-through rate at the current moment and the instantaneous click-through rate of the previous time window to the instantaneous click-through rate of the previous time window. The conversion time distribution of click behavior at the current moment within the subsequent 300-second time window is statistically analyzed. The ratio of the difference between the median of the actual conversion delay and the expected value of the historical conversion delay to the standard deviation of the historical conversion delay is calculated to obtain the conversion delay index. The instantaneous click-through rate, the click-through rate volatility, the instantaneous conversion volume, and the conversion delay index constitute the real-time feature sequence.

3. The real-time monitoring method for advertising placement status according to claim 1, characterized in that, In step S3, the expected abnormal moment of the downstream indicator is determined based on the propagation delay in the abnormal propagation matrix, and the deviation between the actual abnormal response intensity of the downstream indicator and the propagation intensity is calculated, including: When the volatility of a certain indicator at time t exceeds the historical volatility threshold, the corresponding indicator is marked as having a single point of anomaly at time t. The downstream related indicator set is queried according to the abnormal transmission matrix. The downstream related indicator set is all indicators with a transmission strength greater than 0.

5. For each downstream indicator, the expected time of occurrence of the anomaly is calculated by adding the transmission delay to the current time based on the transmission delay stored in the anomaly transmission matrix. The downstream indicator is monitored for single-point anomalies within a 30-second time window before and after the expected time of occurrence of the anomaly. When a single-point anomaly is detected in a downstream indicator within the time window, the ratio of the abnormal amplitude of the downstream indicator to the abnormal amplitude of the upstream indicator is calculated as the actual correlation response strength. The deviation is obtained by calculating the ratio of the difference between the actual correlation response strength and the transmission strength stored in the anomaly transmission matrix to the transmission strength.

4. The real-time monitoring method for advertising placement status according to claim 3, characterized in that, In step S3, when the deviation exceeds a threshold, an association anomaly is marked, and a directed propagation path containing multiple association anomalies is searched, including: When the deviation is greater than 0.4, the correlation between upstream and downstream indicators is considered abnormal. Construct a real-time anomaly propagation graph. The node set of the real-time anomaly propagation graph contains all events in the last 600 seconds that have caused single-point anomalies. Each event includes an indicator and the time of occurrence. The edge set of the real-time anomaly propagation graph contains all propagation relationships that are marked as related anomalies. A depth-first search algorithm is used to find directed paths with a length greater than or equal to 3 in the real-time anomaly propagation graph. The directed path represents the anomaly propagation sequence from the starting node through intermediate nodes to the ending node. For each identified directed path, verify whether the deviation between the time interval of adjacent nodes and the propagation delay of the corresponding index pair in the anomaly propagation matrix is ​​less than 30%. If the deviation is less than 30%, retain the corresponding path and obtain the candidate anomaly propagation chain.

5. The real-time monitoring method for advertising placement status according to claim 4, characterized in that, Obtaining the abnormal propagation chain in step S3 further includes: For each candidate abnormal propagation chain, extract the propagation intensity corresponding to each edge in the path, calculate the product of all propagation intensities, and obtain the cumulative propagation intensity of the path; When the cumulative conduction strength is greater than 0.35 and the path length is greater than or equal to 3, the corresponding candidate abnormal conduction chain is marked as a high-confidence abnormal conduction chain. The abnormal conduction chain is obtained by recording its topology, start time, cumulative conduction intensity, and deviation parameters of each node.

6. The real-time monitoring method for advertising placement status according to claim 1, characterized in that, Step S4 includes: The indicators involved in the abnormal transmission chain are numbered and an adjacency matrix is ​​constructed as a topological feature. The time delay parameters of each transmission link are extracted as time series features. The abnormal volatility of each node and the transmission strength of each edge are extracted as intensity features. The topological feature, the time series feature and the intensity feature are concatenated to obtain the abnormal fingerprint. Retrieve historical abnormal fingerprints from the abnormal fingerprint database, calculate the topological distance, temporal distance, and intensity distance between the abnormal fingerprint and the historical abnormal fingerprint, calculate the comprehensive distance based on the weighted combination, and convert it into the similarity. When the similarity is higher than the first threshold, the status of the abnormal transmission chain is directly set to confirmed; when the similarity is lower than the second threshold, probe traffic is injected into the advertising platform, and the abnormal detection process of steps S1 to S3 is performed on the probe traffic. When the weighted combination of the topological similarity and temporal similarity between the abnormal transmission chain detected in the probe traffic and the original abnormal transmission chain is greater than the verification threshold, the abnormal transmission chain is confirmed to be a real systemic problem.

7. A real-time monitoring system for advertising delivery status, characterized in that, The method for real-time monitoring of advertising delivery status as described in any one of claims 1-6, wherein the real-time monitoring system for advertising delivery status comprises: The generation module is used to collect advertising event streams, extract instantaneous indicator values ​​and volatility according to time windows, and generate real-time feature sequences. The statistics module is used to calculate the time difference between the abnormal moments of upstream and downstream indicators in historical abnormal events, obtain the transmission delay and transmission strength, and construct an abnormal transmission matrix. This includes: retrieving 30 days of historical advertising data, which includes the real-time feature sequence and confirmed actual abnormal event occurrence times; identifying the set of moments in historical data where each indicator exhibits significant anomalies, where a significant anomaly is defined as the volatility of the corresponding indicator exceeding the 95th quantile of the historical volatility distribution; for each abnormal moment of an upstream indicator, searching for the earliest moment of a significant anomaly in the downstream indicator within a subsequent 600-second time window, calculating the time difference between the two moments, performing statistical analysis on the time differences of all samples, and calculating the median to obtain the transmission delay; calculating the correlation coefficient between the abnormal amplitude of the upstream indicator at the abnormal moment and the abnormal amplitude of the downstream indicator after the transmission delay to obtain the transmission strength; and constructing a 5×5 matrix using five indicators—impressions, click-through rate, conversion rate, budget consumption rate, and user dwell time—as rows and columns, with matrix elements storing parameter pairs of transmission delay and transmission strength from row indicators to column indicators, thus obtaining the abnormal transmission matrix. The search module is used to determine the expected abnormal time of downstream indicators based on the transmission delay in the abnormal transmission matrix when a single point of abnormality is detected, calculate the deviation between the actual abnormal response intensity of the downstream indicators and the transmission intensity, mark the associated abnormality when the deviation exceeds a threshold, and search for a directed transmission path containing multiple associated abnormalities to obtain an abnormal transmission chain. The matching module is used to extract the topology, delay parameters and fluctuation amplitude of the abnormal transmission chain to form an abnormal fingerprint. It matches the similarity of historical abnormal fingerprints in the fingerprint database. When the similarity is higher than a first threshold, the abnormality is directly confirmed. When the similarity is lower than a second threshold, probe traffic is injected to verify whether the abnormal transmission chain is reproduced in the probe traffic.

8. The system according to claim 7, characterized in that, Collect advertising event streams, extract instantaneous indicator values ​​and volatility according to time windows, and generate real-time feature sequences, including: Deploy an event stream capture module in the front-end monitoring code of the advertising platform to mark ad display events, click events, and conversion events with millisecond-level timestamps to obtain the raw event stream; The original event stream is pushed to the streaming computing engine, and the events are aggregated in real time according to a 10-second time window based on the sliding time window mechanism to calculate the instantaneous display volume, instantaneous click volume and instantaneous conversion volume. The instantaneous click-through rate is calculated based on the ratio of the instantaneous click volume to the instantaneous display volume, and the click-through rate fluctuation rate is calculated based on the ratio of the difference between the instantaneous click-through rate at the current moment and the instantaneous click-through rate of the previous time window to the instantaneous click-through rate of the previous time window. The conversion time distribution of click behavior at the current moment within the subsequent 300-second time window is statistically analyzed. The ratio of the difference between the median of the actual conversion delay and the expected value of the historical conversion delay to the standard deviation of the historical conversion delay is calculated to obtain the conversion delay index. The instantaneous click-through rate, the click-through rate volatility, the instantaneous conversion volume, and the conversion delay index constitute the real-time feature sequence.

Images