Content auditing abnormity monitoring and early warning method and system based on intelligent alarm suppression

Abstract

The invention discloses a content auditing abnormity monitoring and early warning method and system based on intelligent alarm suppression, and the method comprises the following steps: obtaining real-time content auditing data collected in multiple dimensions, determining multi-dimensional data, carrying out the data cleaning and standardization processing of the multi-dimensional data, and carrying out the monitoring and early warning of the content auditing abnormity. Storing the multi-dimensional data subjected to data cleaning and standardization processing into a database; and constructing a deep reinforcement learning model, determining data input of the deep reinforcement learning model based on the standardized multi-dimensional data, and driving the deep reinforcement learning model to optimize an alarm mode in a training process. According to the method, hidden violation and semantic evolution trends are recognized through semantic clustering, and the traditional detection bottleneck based on a numerical threshold value is broken through; according to the invention, by realizing cross-cycle trend evolution analysis, early signals before abnormal outbreak can be identified in advance; the method has the cross-event semantic comparison capability, and the false alarm rate and the redundant data volume are remarkably reduced.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of Internet content security, in particular to a content review abnormality monitoring and early warning method and system based on intelligent alarm suppression. BACKGROUND

[0002] The technical field of Internet content security involves detecting and identifying multiple types of content such as text, pictures, audio and video published on network platforms. Its core tasks include identifying illegal content based on multi-source data, determining compliance for different business scenarios, combining real-time and offline content screening, and classifying and recording suspicious content. This technical field covers the whole process of content collection, feature extraction, rule matching and result output. It relies on multi-dimensional data monitoring, strategy matching and manual review to achieve comprehensive content security management.

[0003] Traditional content review alarm systems are based on fixed thresholds and static comparison mechanisms to achieve early warning. When the amount of review content increases suddenly or the rules and strategies are temporarily adjusted, it can lead to threshold failure, false positives, and alarm congestion. At the same time, existing technologies lack semantic association recognition capabilities for multi-source review data, making it difficult to distinguish between "abnormal trends" and "normal high-frequency events", resulting in the system being unable to dynamically update the monitoring model. Therefore, a content review abnormality monitoring and early warning method and system based on intelligent alarm suppression is proposed. SUMMARY

[0004] The purpose of the present application is to provide a content review abnormality monitoring and early warning method and system based on intelligent alarm suppression. It solves the problem of alarm redundancy caused by static threshold mechanisms and realizes the cycle optimization of "abnormality recognition - semantic association - intelligent suppression - adaptive feedback".

[0005] To achieve the above purpose, the first aspect of the embodiments of the present disclosure is: to solve the above technical problems, one technical solution adopted by the present application is: a content review abnormality monitoring and early warning method based on intelligent alarm suppression, comprising the following steps: Obtain real-time content review data collected in multiple dimensions, determine multi-dimensional data, perform data cleaning and standardization processing on the multi-dimensional data, and store the multi-dimensional data after data cleaning and standardization processing into a database; Build a deep reinforcement learning model, determine the data input of the deep reinforcement learning model based on the multi-dimensional data after standardization processing, and drive the deep reinforcement learning model to optimize the alarm mode in the training process; Generate potential abnormal trend identifiers based on the knowledge graph of the review, retrieve similar historical event nodes in the knowledge graph and analyze the historical decision path and risk result of the abnormal trend identifier; Based on the effective abnormal trend identification after filtering, multi-dimensional evaluation is performed on the alarm content, an alarm priority vector is generated through a cognitive weight model, and a dynamic level is assigned; The results of manual intervention review and feedback data of response time are written back to the knowledge graph, the feedback data is used by the scheduling engine to optimize the deep reinforcement learning model, repeated alarms or false alarm causes are identified, and strategy evolution task instruction groups are generated, thereby realizing the continuous learning and self-evolution ability of content review anomaly monitoring.

[0006] In a possible implementation manner, the deep reinforcement learning model is constructed, the standardized multi-dimensional data is determined as the data input of the deep reinforcement learning model, and the deep reinforcement learning model is driven to optimize the alarm mode in the training process, specifically including: Based on real-time feedback of scene data, user data and time period data, it is determined whether to trigger an alarm; If abnormal fluctuations in interception rate or request volume are found at a certain moment, the deep reinforcement learning model adjusts the alarm threshold according to the current state, and optimizes the alarm type in combination with historical data; When an alarm is triggered, if the actual review data is consistent with the alarm threshold, the deep reinforcement learning model is given a positive reward; if a false alarm or a missed alarm is triggered, the deep reinforcement learning model is given a negative reward.

[0007] In a possible implementation manner, the multi-dimensional data includes user dimension, scene dimension and content type dimension, the data cleaning includes removing missing values, removing abnormal values and removing noise data, the time period feature is extracted from the timestamp of the real-time content review data after the standardization processing, the time period feature includes hour, day of the week and holiday, and the database indexes the multi-dimensional data.

[0008] In a possible implementation manner, the historical decision path and risk result of the abnormal trend identification specifically include: If the abnormal trend identification and similar historical event nodes meet a preset similarity threshold, the alarm is automatically down-weighted or suppressed; if the similarity threshold is not met, the priority is increased to enter the early warning process; The knowledge graph includes historical alarm types, trigger rules, review strategy change records and manual review results.

[0009] In a possible implementation manner, the multi-dimensional evaluation of the alarm content specifically includes abnormal persistence, propagation breadth, semantic severity and human controllability, the dynamic level is dynamically adjusted according to the historical decision path and risk result of the abnormal trend identification, a high-frequency low-risk event is monitored, and the alarm level is reduced; When a low-frequency high-risk burst risk event is monitored, the alarm level is raised and manual intervention is forced, and finally a dynamic alarm priority table is generated and automatically pushed.

[0010] In a possible implementation, the policy evolution task instruction group specifically includes: automatically optimizing a threshold interval, adjusting aggregation logic, updating semantic weights, or adjusting a whitelist policy in the next period.

[0011] In a possible implementation, the deep reinforcement learning model further includes: transfer learning, which jointly models data of text review, picture review, and video review.

[0012] In a second aspect of the embodiments of the present disclosure, a content review anomaly monitoring and early warning method based on intelligent alarm suppression is provided, including the following steps: Step 1: Obtain review and interception data in the last period, encode and mark the distribution results in multiple dimensions, and compress the interception features into uniform distribution marker values; Step 2: Based on the distribution marker values, select two adjacent periods as comparison windows on the time sequence, calculate the interception rate change direction and change amplitude by comparing the review data volume and the interception data volume of the two periods, and determine the interception rate anomaly marker value; Step 3: Compare the interception rate anomaly marker value with the multi-level threshold boundary built in the system, if the abnormal value is within the tolerable fluctuation range, the system will not trigger an alarm; if it exceeds the threshold range, enter the alarm filtering instruction group; Step 4: Extract key parameters according to the alarm filtering instruction group, the key parameters include constant amplitude, duration, number of involved labels, and number of channels, perform multi-index analysis on the key parameters, comprehensively evaluate the importance of the abnormal event, and map the result to a level label to generate an alarm priority marker data table; Step 5: According to the alarm priority marker data table, periodically read the configuration frequency, parameter threshold, and response time index of the current system, and dynamically analyze the alarm distribution.

[0013] In a third aspect of the embodiments of the present disclosure, a content review anomaly monitoring and early warning method based on intelligent alarm suppression is provided, including the following steps: Step 1: Obtain original review data in a set period from the review engine, the interception strategy module, and the log database, perform semantic vectorization on the review content and labels based on a natural language understanding model, cluster different types of interception events through semantic correlation, and generate dynamic semantic clusters; Step 2: Identify the evolution path of the dynamic semantic clusters in the continuous period through an associated event chain analysis mechanism. Step 3, time series modeling of historical data and real-time data through long short-term memory networks or gated recurrent units to capture temporal dependencies in the data; Step 4, dynamically adjusting the alarm triggering frequency and threshold based on the deep reinforcement learning model training model; Step 5, according to the transfer learning technology, the deep reinforcement learning model can learn between different fields.

[0014] A fourth aspect of the embodiments of the present disclosure: To solve the above technical problems, another technical solution adopted by the present application is: an intelligent alarm suppression-based content review anomaly monitoring and early warning system, comprising: An acquisition module configured to acquire multi-dimensional collected real-time content review data, determine multi-dimensional data, perform data cleaning and standardization processing on the multi-dimensional data, and store the multi-dimensional data after data cleaning and standardization processing into a database; A learning module configured to build a deep reinforcement learning model, determine the data input of the deep reinforcement learning model based on the multi-dimensional data after standardization processing, and drive the deep reinforcement learning model to optimize the alarm mode in the training process; A feedback module configured to generate a potential abnormal trend identifier based on the knowledge graph of the review, retrieve similar historical event nodes in the knowledge graph, and analyze the historical decision path and risk result of the abnormal trend identifier; A grading module configured to perform multi-dimensional evaluation on the alarm content based on the effective abnormal trend identifier after filtering, generate an alarm priority vector through a cognitive weight model, and assign a dynamic level; An optimization module configured to write back the results of manual intervention review and feedback data of response time to the knowledge graph, optimize the deep reinforcement learning model based on the feedback data by a scheduling engine, identify repeated alarms or false alarm causes, and generate a strategy evolution task instruction group, and finally realize the continuous learning and self-evolution ability of content review anomaly monitoring.

[0015] A fifth aspect of the embodiments of the present disclosure: To solve the above technical problems, another technical solution adopted by the present application is: an electronic device comprising a processor, a memory and a communication interface, the memory storing a computer program, and the processor executing the computer program to implement the steps of any of the above intelligent alarm suppression-based content review anomaly monitoring and early warning methods.

[0016] A sixth aspect of the embodiments of the present disclosure: To solve the above technical problems, another technical solution adopted by the present application is: a computer readable storage medium, the computer readable storage medium storing a computer program, and the computer program being executed by a processor to implement the steps of any of the above intelligent alarm suppression-based content review anomaly monitoring and early warning methods.

[0017] Compared with the prior art, the present application has the following beneficial effects: 1. The present application breaks through the detection bottleneck of traditional numerical threshold-based detection by identifying implicit violations and semantic evolution trends through semantic clustering. 2. The present application can identify early signals before the outbreak of abnormalities by implementing cross-cycle trend evolution analysis; it has cross-event semantic comparison capability, significantly reducing false alarm rates and redundant data volume. 3. The present application enables the alarm system to have self-awareness and self-regulation capability through a dynamic weight decision model. 4. The present application enables the system to have continuous self-evolution and strategy update capability through artificial feedback self-learning mechanism. BRIEF DESCRIPTION OF DRAWINGS

[0018] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0019] Figure 1 The flowchart of the content review abnormality monitoring and early warning method based on intelligent alarm suppression of the present application; Figure 2 The flowchart of the content review abnormality monitoring and early warning method based on intelligent alarm suppression of the second embodiment of the present application; Figure 3 The flowchart of the content review abnormality monitoring and early warning method based on intelligent alarm suppression of the third embodiment of the present application; Figure 4 The module diagram of the content review abnormality monitoring and early warning system based on intelligent alarm suppression of the fourth embodiment of the present application; Figure 5 The structural schematic diagram of an electronic device of the present application. DETAILED DESCRIPTION

[0020] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only some embodiments of the present application, not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0021] Figure 1is a flowchart of a content review abnormality monitoring and early warning method based on intelligent alarm suppression according to an embodiment of the present application. It should be noted that the method of the present application is not limited to the order of the steps shown in the flowchart if there is substantially the same result. Figure 1

[0022] The present disclosure provides a content review abnormality monitoring and early warning method based on intelligent alarm suppression, which introduces multi-dimensional correlation learning, dynamic threshold evolution and cognitive alarm suppression mechanism, solves the alarm redundancy problem caused by the static threshold mechanism, and realizes the cyclic optimization closed loop of "abnormality identification-semantic correlation-intelligent suppression-adaptive feedback".

[0023] Embodiment one: As shown in a content review abnormality monitoring and early warning method based on intelligent alarm suppression, comprising the following steps: Figure 1 In step S10, real-time content review data collected in multiple dimensions is obtained, and multi-dimensional data is determined. The multi-dimensional data is subjected to data cleaning and standardization processing, and the multi-dimensional data after data cleaning and standardization processing is stored in a database. In the present disclosure, content review data is collected in real time from multiple dimensions, and the multi-dimensional data includes user dimension, scene dimension, content type, etc. Data cleaning and standardization processing technology is used for preprocessing to ensure that subsequent analysis can be based on high-quality, structured input data.

[0024] In the present disclosure, the specific dimensions include: User dimension: Collecting the review request amount, review result (interception / pass), and behavior frequency (such as login times, review request times) of each user; For example: Monitor the number of content review requests submitted by a user within a certain time period and its interception rate. The data sample includes: user ID, request submission time, review result (pass / intercept), and user device information, etc.

[0025] Scene dimension: Collecting review result data under different review scenes, including text review, image review and video review; For example: Monitor the review interception rate of text content and the interception rate of image content, and analyze the differences between different types of content in the review.

[0026] Content type dimension: Collecting different types of review content for analysis, and counting the interception rate of each type of content, including text, picture and video; According to the type of content, individualized review analysis is performed to identify the risks of different content types.

[0027] ​​In this embodiment of the disclosure, data cleaning is performed: the collected data contains outliers, missing values, or invalid information, and the data is cleaned to ensure the accuracy of the data; In this embodiment of the disclosure, the main cleaning steps include: Remove missing values: During the data collection process, some data may be missing due to system errors or improper user operation. During the cleaning process, it is necessary to delete these missing data or fill them in according to business needs. For example, if a user's review data is missing the "Review Result" field, this data will be removed or filled with the median.

[0028] Outlier removal: Remove data that significantly deviates from the normal pattern (such as extreme values) through outlier detection based on statistical analysis.

[0029] In this embodiment of the disclosure, the purpose of data standardization is to convert data of different scales and units into a unified scale, making it easier for subsequent modeling and analysis. Standardized data not only helps to improve the effect of model training, but also makes data of different dimensions comparable.

[0030] In this embodiment of the disclosure, after data standardization, feature engineering is performed on the data to extract more meaningful features, which helps the model to better identify patterns and anomalies; For example, time-period features (such as hour, day of the week, and holidays) are extracted from the timestamps of the audit data. These features are crucial for anomaly detection. After multi-dimensional data collection, cleaning, and standardization, the cleaned and processed data is stored in a database, providing high-quality input data for subsequent anomaly detection and alarm systems. During storage, the processed data is indexed and managed according to different dimensions to improve the efficiency of subsequent analysis and queries. In this embodiment, the multi-dimensional data acquisition and preprocessing process ensures that the content moderation system can collect and process various types of moderation data in real time and accurately, providing a solid foundation for subsequent anomaly detection and alarm mechanisms. Data standardization, cleaning, and enhancement make subsequent model training more accurate, further improving the system's accuracy in detecting and alarming anomalies.

[0031] In step S20, a deep reinforcement learning model is constructed. The multi-dimensional data after standardization is determined as the data input of the deep reinforcement learning model, driving the deep reinforcement learning model to optimize the alarm method during the training process. In different scenarios, the dynamic threshold adjustment is implemented in the embodiments of the present disclosure, a deep reinforcement learning model is used to train the model, the alarm threshold and alarm triggering strategy are optimized by training real-time monitoring data, and the goal of the deep reinforcement learning model is to maximize long-term rewards to accurately trigger alarms and reduce false positives / negatives; For example, the traditional static threshold alarm mechanism often cannot flexibly adapt to constantly changing content review data, resulting in false positives or negatives. Through the deep reinforcement learning model, the alarm threshold is dynamically adjusted based on real-time data, and the alarm triggering conditions are optimized according to the actual situation, thereby improving the intelligent level of the system. Specifically, the deep reinforcement learning model is used to learn and adjust the rules and thresholds of alarm triggering. The model automatically optimizes according to the constantly changing review data (such as review volume and interception rate), ensuring that the system can adaptively adjust the alarm triggering conditions.

[0032] In the embodiments of the present disclosure, the standardized data obtained in multi-dimensional data collection and preprocessing will be input into the deep reinforcement learning model, and whether to trigger an alarm will be determined by learning the real-time feedback of scene data, user data and time period data, etc. The decision made according to the current state indicates whether an alarm needs to be triggered, the level and type of the alarm. Reward function The reward function is used to score the alarm accuracy and system efficiency of each time period; the alarm types include high-level alarm, medium-level alarm, low-level alarm and false positive / negative; For example, when a high-level alarm is triggered, if the actual review data is consistent with the alarm prediction, a positive reward is given; if a false positive or negative is triggered, a negative reward is given. Reward function As follows: ; Among them, the judgment standard for measuring alarm accuracy and system efficiency is: actual abnormal fluctuation refers to when the daily comparison of the request volume of a certain type of content exceeds 50% or the semantic severity score is greater than or equal to 80 points, it is determined to be an abnormal fluctuation. Accuracy: expected consistency refers to that the abnormal label predicted by the model is consistent with the benchmark label manually labeled by humans. System efficiency: no abnormal fluctuation refers to that within 24 hours after the alarm is triggered, the human review team samples and verifies (the sampling ratio is not less than 10%) to confirm whether the abnormality has really occurred, so as to determine whether it is a false positive or no abnormality.

[0033] For high-level alarms, a reward of +2 is given when triggered correctly, and a penalty of -2 is given when false positives / negatives occur; medium / low-level alarms correspond to rewards of ±1 or ±0.5. Total reward The total sum of the rewards for each time, the goal is to maximize the total reward: ; wherein, is the parameter of the policy network, is the time step, is the mathematical expectation symbol, is the policy network, is the instant reward at time , defined by rules such as alarm accuracy, system efficiency, etc. (e.g. correct alarm +1, false alarm -1, no exception 0).

[0034] For example: based on the above scoring, when the real-time reward of the reward function is set as: high-risk alarm (S≥80 points) and correct triggering, =+2; medium-risk alarm (60≤S<80 points) and correct triggering, =+1; low-risk alarm (S<60 points) and correct triggering, =+0.5; high-risk alarm false alarm or miss, =-2; medium-risk alarm false alarm or miss, =-1; low-risk alarm false alarm or miss, =-0.5; no alarm and confirmed by manual review (sampling verification within 24 hours, sampling ratio not less than 10%) that there is no exception, =0, S represents the semantic severity score, wherein S is the normalized result of multiplying the output violation probability value by 100 when the pre-trained Transformer model classifies and predicts the audit text.

[0035] The total reward is the sum of the real-time rewards from time step t=1 to T, the policy network parameters θ are optimized using the Actor-Critic algorithm, the learning rate α is initially set to 0.01, and is attenuated to 0.9 times the original value every 100 training rounds, and the model convergence condition is that the fluctuation amplitude of the total reward is ≤5% for 50 consecutive rounds.

[0036] The training process of deep reinforcement learning is optimized by the policy gradient method, and the reward feedback from the environment is used to update the parameters of the policy network, ensuring that the model can adaptively adjust the threshold and alarm strategy.

[0037] This process is represented by the following formula: ; wherein, is the parameter set of the policy network at the first step, is the parameter set of the policy network at the first a set of parameters of a step, is a gradient operator, is a learning rate, which controls the speed of learning; In the embodiments of the present disclosure, the technical solution adopts an Actor-Critic algorithm to realize policy gradient optimization, wherein the policy network is a 3-layer fully connected neural network: the input layer is 128-dimensional (containing 8-dimensional statistical features such as interception rate and propagation breadth), the hidden layer is 2 layers (each containing 64 neurons with ReLU activation), and the output layer is a continuous value (corresponding to the alarm threshold); the parameters include weight matrices and bias vectors of each layer. The learning rate is initially set to 0.01, is attenuated to 0.9 times of the original value every 100 training rounds, and the statistical features of the 8 dimensions are spliced into an 8*16=128-dimensional vector.

[0038] In the embodiments of the present disclosure, the deep reinforcement learning model can capture time dependence and adjust the threshold in time under changing review scenarios; For example: the collected interception rate data will be used as the input of the deep reinforcement learning model, and the deep reinforcement learning model will predict the abnormal fluctuations that will occur next based on these data and decide whether to trigger an alarm.

[0039] When abnormal fluctuations of the interception rate or the request volume are found at a certain moment, the deep reinforcement learning model will adjust the alarm threshold according to the current state and optimize the alarm strategy in combination with historical data, thereby improving the accuracy of the alarm.

[0040] The alarm strategy and threshold optimized by the deep reinforcement learning model can be adjusted adaptively in actual operation, ensuring that the alarm can effectively reflect abnormal fluctuations in the content review system. After each optimization of the deep reinforcement learning model, the output alarm level will be more accurate, reducing the false positives and false negatives of the alarm.

[0041] By dynamically adjusting the alarm threshold and strategy through the deep reinforcement learning model, different business scenarios and changes in content review data can be adapted in real time, thereby optimizing the triggering conditions of the alarm.

[0042] In step S30, a potential abnormal trend identifier is generated based on a knowledge graph of review, similar historical event nodes are searched in the knowledge graph, and a historical decision path and a risk result of the abnormal trend identifier are analyzed.

[0043] In the embodiments of the present disclosure, the knowledge graph records historical alarm types, trigger rules, audit strategy change records and manual review conclusions. When a potential abnormal trend identifier is generated, similar event nodes are searched in the knowledge graph, and the historical decision path and risk result thereof are analyzed. When searching in the knowledge graph, the abnormal trend identifier is vectorized (for example, using GraphEmbedding technology), the cosine similarity of the vectorized abnormal trend identifier and the vector of the historical event node in the knowledge graph is calculated, the preset similarity threshold is set to 0.85-0.9, and the trigger rule is the regular expression (Regex) or keyword table recorded on the historical node when the rule is triggered.

[0044] In the embodiments of the present disclosure, the historical decision path and risk result of the abnormal trend identifier specifically include: If the abnormal trend identifier and the similar historical event node meet the preset similarity threshold, the alarm is automatically down-weighted or inhibited; if the similarity threshold is not met, the priority is increased to enter the early warning process. The knowledge graph includes historical alarm types, trigger rules, audit strategy change records and manual review results.

[0045] Through graph comparison and semantic mapping, cross-time and cross-strategy historical intelligent comparison is realized, so that most non-key alarm events are filtered out. The knowledge graph driven historical semantic comparison mechanism realizes intelligent alarm filtering across scenes and events, and fundamentally reduces invalid alarm triggering.

[0046] In step S40, based on the filtered effective abnormal trend identifier, the alarm content is multi-dimensionally evaluated, an alarm priority vector is generated through a cognitive weight model, and a dynamic level is assigned. Specifically, the multi-dimensional evaluation of the alarm content specifically includes abnormal persistence, propagation breadth, semantic severity and manual controllability, and the dynamic level is dynamically adjusted according to the historical decision path and risk result of the abnormal trend identifier. When a high-frequency low-risk event is monitored, the alarm level is reduced. The cognitive weight model is specifically a weighted scoring or rule mapping process. Index quantization: Abnormal persistence : Normalized duration (unit: hour).

[0047] Propagation breadth : Logarithmic value of the number of users involved.

[0048] Semantic severity : The above-mentioned value (0-100).

[0049] Manual controllability Discrete values (e.g., whitelist user = 1, ordinary user = 0.5, high-risk user = 0).

[0050] The cognitive weight model adopts a dynamic weighted summation formula: ; wherein is a weight coefficient.

[0051] The generated alarm priority vector refers to mapping the calculated scalar to a vector interval (e.g., One-hot encoding: [high, medium-low] -> [1, 0, 0]); The filtered effective abnormal trend identifier is an abnormal trend identifier that is not automatically de-weighted or suppressed after step S30.

[0052] The duration and the number of users are automatically collected by the content review system log, and the abnormal persistence records the cumulative duration of the abnormality detected, the propagation breadth counts the number of independent users reached; the human controllability is quantified according to the object management cost, and the whitelist user, the ordinary user, and the high-risk user are assigned values of 1, 0.5, and 0, respectively.

[0053] The weight needs to be dynamically adjusted to adapt to the risk priority of different business scenarios, such as a short video platform focusing on the propagation breadth, which increases , and an information platform focusing on content risk, which increases .

[0054] The dynamic weight summation is performed by the scheduling engine, which first collects the real-time values of to , reads the preset weights of the scene , and calculates the priority ; through the formula , and finally maps to an alarm priority vector (such as high, medium, and low), achieving precise adaptation of the alarm priority in different scenarios and ensuring the effectiveness and pertinence of abnormal monitoring.

[0055] When a low-frequency high-risk sudden risk event is monitored, the alarm level is increased and human intervention is forced, and finally a dynamic alarm priority table is generated and automatically pushed; In the embodiments of the present disclosure, the alarm priority vector is automatically generated based on the cognitive weight model, and different events are given dynamic levels. The alarm level is not fixedly set, but is automatically adjusted according to the system running situation.

[0056] For example, when a high-frequency but low-risk event is detected, the base alarm level of this type of event is automatically reduced; conversely, if a low-frequency but high-risk content suddenly rises, the system will increase its risk level in real time and force human intervention.

[0057] Finally, a dynamic alarm priority table is generated and automatically pushed to the corresponding channel.

[0058] The cognitive weight model is used to realize the self-evolution of the alarm level, which no longer depends on fixed rules, and realizes the real-time adaptation to the change of the system environment.

[0059] In the embodiments of the present disclosure, the four types of key features of the abnormal event are input as the core components for generating the alarm priority vector by the cognitive weight model, and the four types of key features include abnormal persistence, propagation breadth, semantic severity, and human controllability. In the embodiments of the present disclosure, by dynamically allocating the weight of each feature, the priority score representing the alarm emergency level is calculated, thereby realizing the monitoring of high-frequency low-risk events, reducing the alarm level, monitoring low-frequency high-risk sudden risk events, increasing the alarm level and forcing human intervention, and finally generating a dynamic alarm priority table and automatically pushing it.

[0060] In step S50, the feedback data of the results of human intervention review and response time are written back to the knowledge graph, the scheduling engine optimizes the deep reinforcement learning model based on the feedback data, identifies the causes of repeated alarms or false positives, and generates a strategy evolution task instruction set, finally realizing the continuous learning and self-evolution ability of content review anomaly monitoring.

[0061] The strategy evolution task instruction set is used to realize the instruction set of model and strategy self-optimization, specifically including four types of instructions: one is a threshold interval optimization instruction, two is an aggregation logic adjustment instruction, three is a semantic weight update instruction, and four is a whitelist strategy adjustment instruction. The threshold interval optimization instruction is to adjust the determination threshold of the abnormal fluctuation of the interception rate, the aggregation logic adjustment instruction is to modify the aggregation period of multi-dimensional data, the semantic weight update instruction is to improve the recognition weight of a certain emerging violation semantic, and the whitelist strategy adjustment instruction is to add a whitelist label of a specific operation activity.

[0062] The execution period of the instruction is adapted according to the data type, for example: when the text review data has a high update frequency, the instruction execution period is set to once a day; when the video review data has a large processing amount, the instruction execution period is set to once every 3 days.

[0063] In the embodiments of the present disclosure, after each alarm processing, the human review results, response time, false positive rate and other information are written back to the knowledge graph.

[0064] Based on this feedback data, the scheduling engine performs self-learning strategy optimization, automatically identifies parameters that cause repeated alarms or false alarms, and dynamically generates strategy evolution task instruction sets.

[0065] In the next cycle, this task instruction group will automatically optimize the threshold range, adjust the aggregation logic, update the semantic weights, or adjust the whitelist strategy to achieve the self-evolution of the model.

[0066] Ultimately, a closed-loop self-learning system of "detection-filtering-grading-feedback-optimization" is formed, enabling the content review anomaly monitoring system to have continuous learning and self-evolution capabilities.

[0067] Specifically, the system parameters are trained by reverse-engineering the conclusions of manual review, enabling dynamic evolution of the threshold and the model, and providing continuous performance improvement capabilities.

[0068] Example 2: Currently, content moderation systems often rely on fixed thresholds or simple comparison logic to implement alarm and warning mechanisms when dealing with scenarios involving high concurrency, multi-dimensional, and multi-type data. However, such mechanisms are prone to "alarm overload" and "false alarms" when faced with dynamically changing content traffic, semantically diverse moderation rules, and complex distribution of blocking behaviors.

[0069] For example, when certain short-term trending events cause keyword or tag aggregation, the system may misjudge it as a large-scale outbreak of illegal content, thus generating a large number of redundant alarms, which not only affects the efficiency of reviewers, but also weakens the ability to identify real abnormal events.

[0070] like Figure 2 As shown, to solve the above-mentioned technical problems, based on Embodiment 1, another technical solution adopted in this application is: A method for monitoring and issuing early warnings of content moderation anomalies based on intelligent alarm suppression includes the following steps: Step 1: Obtain the review and interception data for the most recent period, encode and label the multi-dimensional distribution results, and compress the interception features into a unified distribution label value; In this embodiment of the disclosure, the review and blocking data of the most recent period is automatically obtained from the content review module according to a preset period.

[0071] First, the core fields in the intercepted data (including interception reason, tag type, content source, review channel, reviewer, and timestamp) are extracted in a standardized manner.

[0072] Subsequently, the above fields are aggregated and analyzed according to the tag combination logic to form a multi-dimensional interception statistical model. For example, a three-dimensional aggregation mode based on time period, tag category, and channel source is used.

[0073] The distribution results of each dimension are encoded and marked, and the interception features are compressed into uniform distribution mark values for subsequent rapid matching and comparison.

[0074] The change trend of the multi-dimensional interception behavior is dynamically perceived with less computing load, laying a foundation for subsequent anomaly identification.

[0075] Step two: Based on the distribution mark value, select two adjacent periods as a comparison window on the time series, calculate the interception rate change direction and change amplitude by comparing the examination data volume and the interception data volume of the two periods, and determine the interception rate anomaly mark value. In the embodiments of the present disclosure, based on the generated multi-dimensional interception distribution mark value, two adjacent periods are selected as a comparison window on the time series.

[0076] By comparing the examination data volume and the interception data volume of the two periods, the interception rate change direction and change amplitude are calculated.

[0077] If the interception rate of a certain dimension changes beyond the dynamic fluctuation boundary set by the system, the system will automatically mark the dimension as an abnormal fluctuation section and add attribute codes such as content type anomaly, channel anomaly, and time period anomaly to it.

[0078] According to these attribute codes, an interception rate anomaly mark value is generated and stored in an abnormal feature cache area for further intelligent filtering and early warning.

[0079] Step three: Based on the comparison of the interception rate anomaly mark value and the multi-level threshold boundary built in the system, if the abnormal value is within the tolerable fluctuation range, the system will not trigger an alarm; if it exceeds the threshold range, it will enter the alarm filtering instruction group. In the embodiments of the present disclosure, the generated interception rate anomaly mark value is read and compared with the multi-level threshold boundary built in the system.

[0080] If the abnormal value is within the tolerable fluctuation range, the system will not trigger an alarm; if it exceeds the threshold range, it will enter the alarm filtering process.

[0081] In this process, the whitelist strategy is matched first.

[0082] The whitelist strategy includes historical high-frequency labels, operation activity keywords, and audit strategy change period data, etc. to avoid false alarms caused by short-term or manual operations.

[0083] After removing the abnormal records that hit the whitelist, the data that does not hit is reordered, the comprehensive influence weight is calculated according to the change amplitude, duration, label density, etc., and the corresponding alarm filtering instruction group is generated.

[0084] The instruction set will define the alarm type that needs to be triggered, response level, processing path, etc. parameters, and provide the basis for the next step of intelligent push.

[0085] Step four: Extract key parameters according to the alarm filtering instruction set, including amplitude, duration, number of involved labels, and channel quantity. Perform multi-index analysis on the key parameters, comprehensively evaluate the importance of abnormal events, and map the results to a level label to generate an alarm priority label data table. In the embodiments of the present disclosure, according to the generated alarm filtering instruction set, key parameters such as abnormal amplitude, duration, number of involved labels, and channel quantity are extracted.

[0086] These parameters are subjected to multi-index analysis, comprehensive evaluation of the importance of abnormal events, and mapping of the results to a level label (such as high risk, medium risk, and low risk).

[0087] After classification is completed, according to the preset push rules, alarms of different levels are pushed to corresponding processing channels. For example, high-risk alarms are directly pushed to on-duty supervisors or risk control systems, medium-risk alarms enter an artificial review queue, and low-risk alarms are recorded in a log and notified with a delay.

[0088] At the same time, an alarm priority label data table is generated internally to record the level label, occurrence period, processing status, and historical processing feedback of the alarm event, providing data support for subsequent alarm suppression and strategy optimization.

[0089] Step five: According to the alarm priority label data table, periodically read the configuration frequency, parameter threshold, and response time index of the current system, and dynamically analyze the alarm distribution.

[0090] In the embodiments of the present disclosure, based on the alarm priority label data table, the configuration frequency, parameter threshold, and response time index of the current system are periodically read, and the alarm distribution is dynamically analyzed.

[0091] When it is detected that a certain type of alarm frequently occurs in a short period of time but is verified by artificial verification to be non-abnormal, an alarm suppression strategy is automatically triggered.

[0092] This strategy will effectively suppress the re-triggering of similar alarms by adjusting the alarm trigger threshold of the corresponding dimension, extending the trigger time window, or temporarily freezing the repeated alarm channel, thereby reducing the rate of repetitive alarms.

[0093] In addition, according to the historical alarm processing results, a task scheduling optimization template is matched to dynamically adjust the rule engine parameters, review frequency, and data sampling period, forming a closed-loop adaptive optimization mechanism.

[0094] Finally, the output task scheduling optimization instruction set is output, used for guiding subsequent policy iteration and system tuning, and realizing intelligent and low-interference abnormal monitoring process.

[0095] Compared with the prior art, the present application has the following significant advantages and substantial progress: The present application can identify potential abnormal fluctuations in a multi-dimensional feature space, avoiding misjudgment caused by a single dimension. The present application effectively reduces repetitive and invalid alarms through adaptive threshold and dynamic weight adjustment. The present application retains real key abnormalities while filtering redundant data, achieving more accurate early warning. The present application uses alarm data for system tuning in reverse, realizing the intelligent cycle of "identification - filtering - suppression - optimization". The present application can greatly reduce the alarm load in the content review scene, improve the efficiency of manual processing and the real-time response ability of the system.

[0096] Embodiment three: Existing content review systems mostly rely on static thresholds and single-dimensional monitoring, and cannot fully adapt to real-time data fluctuations when facing complex Internet content ecosystems, and cannot effectively avoid repeated alarms and alarm storms.

[0097] The common deficiencies of the current technical solutions are as follows: It is unable to automatically adjust the alarm threshold according to the real-time changes of different business scenarios.

[0098] It only relies on the overall interception rate, ignoring the individual differences of different scenarios and users.

[0099] The alarm mechanism of the existing system is prone to cause alarm storms, and lacks intelligent alarm suppression strategies.

[0100] The existing technology usually cannot detect abnormalities across multiple business scenarios, and it is difficult to identify the relevance between businesses.

[0101] As shown in Figure 3 To solve the above technical problems, based on embodiment one, another technical solution adopted by the present application is: a content review abnormal monitoring and early warning method based on intelligent alarm suppression, comprising the following steps: Step 1, obtain the original review data in the set period from the review engine, the interception strategy module and the log database, perform semantic vectorization on the review content and labels based on a natural language understanding model, cluster different types of interception events through semantic correlation degree, and generate dynamic semantic clusters. In the embodiments of the present disclosure, the dynamic semantic cluster is formed by the natural language understanding model for semantic vectorization processing of the three types of audit data of text, picture and video, and a clustering algorithm is used to aggregate the intercepted events with similar semantic features to form an event set.

[0102] The events in the cluster have the same or similar violation attributes, and the number and internal structure of the cluster are updated in real time with the appearance of new violation semantics, and the violation attributes include vulgar and pornographic and false propaganda. For example, when a homophonic clip type violation occurs, the system automatically generates a new semantic cluster or classifies it into an existing similar cluster and updates the semantic feature description of the cluster.

[0103] In the embodiments of the present disclosure, the original audit data is obtained from the audit engine, the interception strategy module and the log database in parallel according to a set period.

[0104] On the basis of traditional field extraction (such as interception time, label, channel, and audit rule number), according to the semantic feature aggregation mechanism: Based on the natural language understanding model, the audit content and the label are semantically vectorized, different types of intercepted events are clustered through semantic correlation, and dynamic semantic clusters are generated.

[0105] These semantic clusters not only reflect the logical similarity of the intercepted events, but also reveal the potential abnormal semantic distribution trend; For example, synonym replacement violations and implicit violation expressions.

[0106] After clustering is completed, an adaptive statistical model is automatically established for each semantic cluster, and a multi-dimensional semantic interception label set is generated, which is used for subsequent dynamic threshold calculation and trend analysis.

[0107] Semantic aggregation and vectorization clustering extend the traditional single-dimensional statistics to semantic space modeling, realizing semantic layer identification and abnormal clustering perception of interception behavior.

[0108] Step 2, through the associated event chain analysis mechanism, the evolution path of the dynamic semantic cluster in the continuous period is identified; In the embodiments of the present disclosure, a time series comparison matrix is automatically constructed according to the generated semantic interception label set.

[0109] Through the associated event chain analysis mechanism, the evolution path of the semantic cluster in the continuous period is identified.

[0110] For example, if a sensitive topic is rapidly spreading in different channels and the frequency is steeply rising, the system automatically marks it as a semantic abnormal propagation trend.

[0111] Meanwhile, according to the context correlation detection mechanism, the context correlation degree behind the abnormal interception is analyzed to identify whether it is a homologous event (such as the same rule adjustment and the same operation activity).

[0112] For example, if the abnormal propagation path is detected and the context is not identified as a white list behavior by the system, a potential abnormal trend identifier is generated, and the alarm analysis module is entered.

[0113] In the embodiments of the present disclosure, the abnormal trend identifier is an abnormal trend identifier generated based on an audit knowledge graph, which is used to mark the feature label of potential violation abnormalities, and includes three core fields: an abnormal type field, an associated dimension field, and a content channel, and a risk preliminary judgment result field. The abnormal trend identifier is the core basis for subsequent alarm filtering and grading.

[0114] The abnormal type field includes an interception rate surge, a semantic violation upgrade, and a cross-channel propagation anomaly, the associated dimension field includes a user group involved (new user / old user) and a content channel, and the risk preliminary judgment result field includes a preliminary judgment based on historical data as low risk, medium risk or high risk.

[0115] The semantic time sequence correlation identification mechanism is adopted to replace the traditional single interception rate comparison, and has cross-period and cross-channel abnormal trend perception capability.

[0116] Step 3, time sequence modeling of historical data and real-time data is performed through a long short-term memory network or a gated recurrent unit to capture the time dependence in the data; Step 4, the alarm triggering frequency and threshold are dynamically adjusted based on a deep reinforcement learning model to reduce repeated alarms; Step 5, according to the transfer learning technology, the deep reinforcement learning model can share learning between different fields.

[0117] In the embodiments of the present disclosure, the transfer learning improves the sensitivity of the model to different types of abnormalities by jointly modeling data in different fields such as text review, picture review, and video review.

[0118] The transfer learning is aimed at the modal difference of the three types of review data of text, picture and video. Through feature fusion technology, the features of different modal data are associated and modeled, so that the violation identification rule learned by the deep reinforcement learning model on one modal data (such as text) can be transferred to the identification task of other modal data (such as picture and video).

[0119] It is beneficial to solve the problem of poor model generalization caused by insufficient single modal data samples, and to improve the consistency and accuracy of cross-type content review.

[0120] Embodiment four: As Figure 4 shown to solve the above technical problems, on the basis of embodiment one, another technical solution adopted by the present application is: a content review abnormality monitoring and early warning system based on intelligent alarm suppression, comprising: The acquisition module is configured to acquire multi-dimensional collected real-time content review data, determine multi-dimensional data, perform data cleaning and standardization processing on the multi-dimensional data, and store the multi-dimensional data after data cleaning and standardization processing into a database; The learning module is configured to build a deep reinforcement learning model, determine data input for the deep reinforcement learning model based on the multi-dimensional data after standardization processing, and drive the deep reinforcement learning model to optimize the alarm mode in the training process; The feedback module is configured to generate a potential abnormal trend identifier based on the knowledge graph of the review, retrieve similar historical event nodes in the knowledge graph, and analyze the historical decision path and risk result of the abnormal trend identifier; The grading module is configured to perform multi-dimensional evaluation on the alarm content based on the effective abnormal trend identifier after filtering, generate an alarm priority vector through a cognitive weight model, and give a dynamic level; The optimization module is configured to write back the results of manual intervention review and feedback data of response time to the knowledge graph, and schedule an engine to optimize the deep reinforcement learning model based on the feedback data, identify repeated alarms or false alarm causes, and generate a strategy evolution task instruction group, so as to finally realize the continuous learning and self-evolution ability of content review abnormality monitoring.

[0121] For other details of the implementation of the technical solutions of the modules in the above-mentioned embodiment system, refer to the description in the above-mentioned one kind of content review abnormality monitoring and early warning method based on intelligent alarm suppression, which will not be repeated here.

[0122] It should be noted that each embodiment in the present specification adopts a progressive description manner, and each embodiment focuses on the difference from other embodiments. The same and similar parts of each embodiment can be referred to. For system embodiments, since they are basically similar to method embodiments, the description is relatively simple, and the relevant parts can be referred to the part of the method embodiment.

[0123] Embodiment five: As Figure 5 A structural schematic diagram of an electronic device is provided for the embodiments of the present disclosure. It shows a structural schematic diagram suitable for implementing the electronic device in the embodiments of the present disclosure. Figure 5 The electronic device shown is only an example and should not impose any limitations on the functions and use range of the embodiments of the present disclosure.

[0124] As Figure 5 shown, an electronic device includes a processor, a memory and a communication interface, the memory stores a computer program, and the processor executes the computer program to implement a content review abnormality monitoring and early warning method based on intelligent alarm suppression according to the embodiments of the present disclosure. The electronic device can exchange data with other devices or systems through the communication interface to realize real-time updating and sharing of drug information.

[0125] The processor in the above electronic device is the core of the electronic device, and the processor is responsible for executing the computer program stored in the memory to realize various functions of the paperless conference terminal intelligent interaction method. The processor can use high-performance multi-core CPU or special-purpose chips to meet the needs of complex calculations and real-time processing. The memory is used to store the operating system, application programs, data and computer programs, etc. In this embodiment, the memory stores the computer program for implementing the paperless conference terminal intelligent interaction method. The memory can be RAM, ROM, Flash memory or other types of non-volatile memory. The communication interface is used to connect the electronic device with other devices or networks to realize the transmission and exchange of data. In this embodiment, the communication interface supports multiple communication protocols and interface standards, such as Wi-Fi, Bluetooth, USB, Ethernet, etc., to meet the communication needs in different scenarios.

[0126] The detailed description of the present embodiment can be referred to the corresponding description in the foregoing embodiments, which will not be repeated here.

[0127] Embodiment six According to the computer readable storage medium of the present disclosure, the computer readable storage medium stores a computer program, and the computer program is executed by the processor to realize the functions of the content review abnormality monitoring and early warning method based on intelligent alarm suppression according to the embodiments of the present disclosure.

[0128] The above computer readable storage medium includes but is not limited to optical storage medium (such as CD-ROM and DVD), magneto-optical storage medium (such as MO), magnetic storage medium (such as magnetic tape or mobile hard disk), media with built-in rewritable non-volatile memory (such as memory card) and media with built-in ROM (such as ROM cartridge).

[0129] The detailed description of the present embodiment can be referred to the corresponding description in the foregoing embodiments, which will not be repeated here.

[0130] The above only describes the preferred embodiments of the present application and does not limit the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application.

Claims

1. A method for monitoring and early warning of content moderation anomalies based on intelligent alarm suppression, characterized in that, Includes the following steps: Acquire real-time content review data collected from multiple dimensions, determine the multi-dimensional data, perform data cleaning and standardization processing on the multi-dimensional data, and store the multi-dimensional data after data cleaning and standardization processing into the database; A deep reinforcement learning model is constructed, and the multi-dimensional data after standardization is determined as the data input of the deep reinforcement learning model, which drives the deep reinforcement learning model to optimize the alarm method during the training process. Based on the knowledge graph of the audit, potential abnormal trend identifiers are generated. Similar historical event nodes are retrieved in the knowledge graph, and the historical decision-making paths and risk outcomes of the abnormal trend identifiers are analyzed. Based on the filtered and effective abnormal trend identifiers, the alarm content is evaluated in multiple dimensions, and an alarm priority vector is generated and assigned a dynamic level through a cognitive weight model. The feedback data of the results of manual review and response time is written back to the knowledge graph. The scheduling engine optimizes the deep reinforcement learning model based on the feedback data, identifies the causes of repeated alarms or false alarms and generates a set of policy evolution task instructions, and finally realizes the continuous learning and self-evolution capability of content review anomaly monitoring.

2. The content moderation anomaly monitoring and early warning method based on intelligent alarm suppression according to claim 1, characterized in that, The construction of the deep reinforcement learning model, based on the standardized multi-dimensional data determined as the data input of the deep reinforcement learning model, drives the deep reinforcement learning model to optimize the alarm method during training, specifically including: Based on deep reinforcement learning of real-time feedback from scene data, user data, and time period data, it is determined whether to trigger an alarm. If abnormal fluctuations in the interception rate or request volume are detected at a certain moment, the deep reinforcement learning model adjusts the alarm threshold according to the current state and optimizes the alarm type by combining historical data. When an alarm is triggered, if the actual audited data matches the alarm threshold, the deep reinforcement learning model will receive a positive reward; if a false alarm or a missed alarm is triggered, the deep reinforcement learning model will receive a negative reward.

3. The content moderation anomaly monitoring and early warning method based on intelligent alarm suppression according to claim 1, characterized in that, The multi-dimensional data includes user dimension, scenario dimension and content type dimension. The data cleaning includes removing missing values, removing outliers and removing noisy data. After standardization, time period features are extracted from the timestamps of the real-time content review data. The time period features include hour, day of the week and holidays. The database indexes and manages the multi-dimensional data.

4. The content moderation anomaly monitoring and early warning method based on intelligent alarm suppression according to claim 1, characterized in that, The historical decision-making paths and risk outcomes identified by the abnormal trend indicators specifically include: If the abnormal trend identifier and similar historical event nodes meet a preset similarity threshold, the alarm will be automatically downgraded or suppressed; if the similarity threshold is not met, the priority will be increased and the alarm will enter the warning process. The knowledge graph includes historical alarm types, triggering rules, audit strategy change records, and manual review results.

5. The content moderation anomaly monitoring and early warning method based on intelligent alarm suppression according to claim 1, characterized in that, The multi-dimensional evaluation of the alarm content includes: anomaly persistence, propagation breadth, semantic severity, and human controllability. The dynamic level is dynamically adjusted according to the historical decision-making path and risk outcome of the anomaly trend identifier. When high-frequency, low-risk events are detected, the alarm level is reduced. When low-frequency, high-risk, and sudden incidents are detected, the alarm level is increased and manual intervention is forced. Finally, a dynamic alarm priority table is generated and automatically pushed.

6. The content moderation anomaly monitoring and early warning method based on intelligent alarm suppression according to claim 1, characterized in that, The strategy evolution task instruction group specifically includes: automatically optimizing the threshold range, adjusting the aggregation logic, updating the semantic weight, or adjusting the whitelist strategy in the next cycle.

7. The content moderation anomaly monitoring and early warning method based on intelligent alarm suppression according to claim 1, characterized in that, The deep reinforcement learning model also includes transfer learning, which jointly models the data from text review, image review, and video review.

8. A content moderation anomaly monitoring and early warning system based on intelligent alarm suppression, applied to the content moderation anomaly monitoring and early warning method based on intelligent alarm suppression as described in any one of claims 1-7, characterized in that, include: The acquisition module is configured to acquire real-time content review data collected from multiple dimensions, determine the multi-dimensional data, perform data cleaning and standardization processing on the multi-dimensional data, and store the multi-dimensional data after data cleaning and standardization processing into the database. The learning module is configured to build a deep reinforcement learning model, and the multi-dimensional data after standardization is determined as the data input of the deep reinforcement learning model, driving the deep reinforcement learning model to optimize the alarm method during the training process; The feedback module is configured to generate potential abnormal trend identifiers based on the reviewed knowledge graph, retrieve similar historical event nodes in the knowledge graph, and analyze the historical decision-making paths and risk outcomes of the abnormal trend identifiers. The hierarchical module is configured to perform multi-dimensional evaluation of alarm content based on the filtered and effective abnormal trend identifiers, generate alarm priority vectors through a cognitive weight model, and assign dynamic levels. The optimization module is configured to write back the feedback data of the results of manual review and response time to the knowledge graph. The scheduling engine optimizes the deep reinforcement learning model based on the feedback data, identifies the causes of repeated alarms or false alarms and generates a set of policy evolution task instructions, and finally realizes the continuous learning and self-evolution capability of content review anomaly monitoring.

9. An electronic device, characterized in that, The method includes a processor, a memory, and a communication interface. The memory stores a computer program. When the processor executes the computer program, it implements the content moderation anomaly monitoring and early warning method based on intelligent alarm suppression as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the content moderation anomaly monitoring and early warning method based on intelligent alarm suppression as described in any one of claims 1 to 7.

Images