User behavior anomaly detection method

Abstract

The invention discloses a user behavior anomaly detection method. The method comprises the steps of obtaining behavior counting sequences of a target user under multiple time granularities to form multivariable time sequence input data; learning time correlation in the TFT model to obtain time sequence representation, starting Bayesian inference to carry out multiple forward inference to obtain a prediction mean value and a prediction standard deviation at the next moment, and calculating a prediction confidence interval; a real behavior count of a target user at a current moment is obtained, a current prediction error is calculated through a TFT model deployed at an edge side, a standardized deviation index Z-score is calculated based on a prediction standard deviation, a cumulative offset is constructed based on the prediction error, a CUSUM statistical magnitude is calculated, the Z-score and the CUSUM statistical magnitude are fused to obtain a combined abnormal variable, and the combined abnormal variable is calculated. And comparing with two risk thresholds, and judging three risk levels of normal transmission, probe exposure and direct interception. According to the method, millisecond-level prediction of user behaviors is realized, abnormity is dynamically judged, and abnormal user behaviors are intercepted before bidding.

Description

Technical Field

[0001] This application relates to the field of advertising technology, and in particular to a method for detecting abnormal user behavior. Background Technology

[0002] With the development of mobile internet and programmatic advertising technology, real-time bidding (RTB) has become the mainstream method for ad distribution. Advertising platforms need to assess user behavior within millisecond-level time windows to determine whether to send ads, what type of ads to send, and the bidding strategy. However, the advertising ecosystem is rife with abnormal traffic, including fraudulent activities such as artificially inflating impressions, clicks, and conversions. Such behavior not only increases costs for advertisers but also interferes with user profiling and business decisions, becoming a key issue of long-term concern in the industry.

[0003] In RTB scenarios, ad exchange platforms need to complete a bidding process within ~120ms. Existing abnormal traffic detection solutions mainly rely on static rules, univariate thresholds, or offline models based on historical statistics. These solutions have the following shortcomings:

[0004] 1. Offline / Delay Judgment (Batch Processing or Post-Session Statistics): Rule thresholds, aggregated reports, post-event clustering, and manual review often occur within minutes to hours. It is impossible to block invalid traffic before bidding, resulting in the budget being consumed first and then refunded or reduced.

[0005] 2. Single-scale or single-modal detection: This method relies primarily on click-through rate / conversion rate thresholds within fixed time windows and static device fingerprint consistency. It is insensitive to two typical types of fraud: short-term bursts of high-frequency click fraud and long-tail penetration of low-frequency click fraud. High-frequency click fraud occurs in seconds, causing damage by the time it is detected in offline statistics. Low-frequency click fraud spreads the anomaly over a longer period and across multiple devices, making it difficult for single-window statistics to significantly exceed the threshold.

[0006] 3. Strategy rigidity is out of sync with economic goals: Thresholds are fixed year after year or rely solely on manual parameter tuning, making it difficult to adapt to attackers' rapid iterations (concept drift); at the same time, the detection target remains at "classification accuracy / recall rate", which is not coupled with the advertiser's economic goals (ROI, invalid spending rate).

[0007] 4. Engineering and Compliance Constraints: Latency Constraints: Complex models are difficult to determine at the edge in ≤10ms; Data Minimization: Under GDPR / CCPA constraints, reversible identity information or full details cannot be relied upon for cloud computing.

[0008] Therefore, under the constraints of privacy compliance and strict latency, how to reliably determine a single request milliseconds before bidding, while taking into account two different types of cheating with different time structures (high frequency / low frequency), linking detection with economic goals, and being able to adaptively update as traffic distribution and attack strategies evolve. Summary of the Invention

[0009] The purpose of this application is to provide a method for detecting abnormal user behavior, which aims to predict fluctuations in single user behavior in milliseconds, dynamically determine anomalies and intercept them before bidding, while taking into account both improving advertiser ROI and saving system resources.

[0010] In a first aspect of this application, a method for detecting abnormal user behavior is provided, comprising:

[0011] Obtain the target user's behavior count sequence at multiple time granularities, and combine it with the derivation ratio and time interval features to form multivariate time series input data. The behavior count sequence includes exposure count, click count, and conversion count. The time granularity includes at least the second level, the session level, and the cross-session level.

[0012] The multivariate time series input data is aligned to a unified vector space to generate a time step vector, and the time correlation is learned in the TFT model to obtain the time series representation. During inference, Bayesian inference is enabled to perform multiple forward inferences to obtain the predicted mean and predicted standard deviation of the next time step and to calculate the predicted confidence interval.

[0013] Obtain the target user's actual exposure count, click count, and conversion count at the current moment. Calculate the current prediction error using a TFT model deployed on the edge and calculate the standardized deviation index Z-score based on the prediction standard deviation. Construct the cumulative offset based on the prediction error and calculate the CUSUM statistic. Merge the Z-score and the CUSUM statistic to obtain the combined outlier variable R(t).

[0014] When a real-time bidding request arrives, the combined abnormal variable R(t) is compared with two risk thresholds τ1 and τ2. When R(t) < τ1, it is determined to be a normal transmission; when τ1 ≤ R(t) < τ2, it is determined to be a probe exposure transmission; when R(t) ≥ τ2, it is determined to be a direct interception.

[0015] When it is determined that a probe exposure has been sent, a preset probe material is sent to the target user, and the feedback results generated by the probe material are collected. The feedback results include click count and conversion count.

[0016] In a preferred embodiment, it also includes:

[0017] Establish a state function, which includes: a weighted average of the combined outlier variable R(t) and the rate of return on investment within the most recent time window;

[0018] Establish executable actions, including lowering τ1, raising τ1, lowering τ2, raising τ2, and keeping it unchanged;

[0019] Establish a reward function, which is composed of a combination of investment return and ineffective spending ratio within a preset period;

[0020] Based on the state function, executable actions, and reward function, the risk thresholds τ1 and τ2 are updated in the cloud using a reinforcement learning network, and the updated risk thresholds τ1 and τ2 are synchronized to the anomaly detection and execution module on the edge side.

[0021] In a preferred embodiment, the Bayesian inference obtains a prediction set by performing M forward inferences through randomly deactivated neurons in a portion of the TFT model, and calculates the prediction mean and prediction standard deviation for the next time step based on the prediction set.

[0022] In a preferred embodiment, the confidence interval is CI_α(t)=[μ_t-z_α*σ_pred(t),μ_t+z_α*σ_pred(t)], where μ_t is the predicted mean, z_α is the normal quantile, and σ_pred(t) is the total predicted variance.

[0023] In a preferred embodiment, the Z-score at the current time t is calculated by Z(t) = |y_t - μ_t| / σ_pred(t), where y_t is the true value of the count, μ_t is the predicted mean, σ_pred(t) is the total standard deviation of the prediction, σ_a^2(t) is the intrinsic noise / heteroscedasticity of the data, and σ_e^2(t) is the cognitive uncertainty of the model. The CUSUM statistic at the current time t is calculated by S_t = max(0, S{t-1} + Δ(t) - k), where k is the drift sensitivity, S{t-1} is the CUSUM statistic at the previous time t-1, and the combined anomaly variable R(t) at the current time t is R(t) = w1*Z(t) + w2*I[S_t≥h], where I[·] represents the indicator function, w1 and w2 represent the preset weight coefficients of the Z-score and CUSUM statistic, respectively, and h is the preset threshold for identification.

[0024] In a preferred embodiment, the TFT model has 4 layers, 8 attention heads, and 256 hidden dimensions; the TFT model deployed on the edge side has 2 layers, 4 attention heads, 128 hidden dimensions, and the loss function is L_t = 0.5 * [(y_t - μ_t)^2 / σ_t^2 + logσ_t^2].

[0025] In a preferred embodiment, the second-level time granularity is 1 second, the session-level time granularity is 30 seconds, and the cross-session-level time granularity is 300 seconds.

[0026] In a preferred embodiment, the risk thresholds τ1 and τ2 are defined as follows: the minimum value of τ1 is 0.5, and the maximum value of τ2 is 5.0.

[0027] In a second aspect of this application, a computer program product is provided, the computer program product comprising computer-executable instructions that, when executed by a processor, implement the steps of the aforementioned method.

[0028] In a third aspect of this application, a computer-readable storage medium is provided, wherein computer-executable instructions are stored therein, which, when executed by a processor, implement the steps of the aforementioned method.

[0029] It should be understood that, within the scope of this invention, the above-described technical features of this invention and the technical features specifically described below (such as in the embodiments) can be combined with each other to form new or preferred technical solutions. Due to space limitations, they will not be described in detail here. Attached Figure Description

[0030] Figure 1 This is a flowchart illustrating a user behavior anomaly detection method according to one embodiment of this application. Detailed Implementation

[0031] In the following description, many technical details are presented to help the reader better understand this application. However, those skilled in the art will understand that the technical solutions claimed in this application can be implemented even without these technical details and various variations and modifications based on the following embodiments.

[0032] Through extensive and in-depth research, the inventors have proposed a predictive anomaly detection method for real-time bidding scenarios. This method constructs multi-time-granularity user behavior sequences and utilizes a TFT model to simultaneously output the predicted mean and uncertainty interval, achieving an individualized baseline for normal behavior. Furthermore, it combines the instantaneous deviation Z-score with the continuous shift CUSUM to construct a combined anomaly variable, characterizing the comprehensive risk of users in both short-term bursts and long-tail penetration anomalies. Low-cost, short-lifecycle probe ads are introduced to proactively verify suspicious users, forming a closed loop through feedback. Simultaneously, reinforcement learning (DQN) is used to dynamically optimize the risk threshold, thereby achieving accurate, stable, and low-cost anomaly traffic identification and three-tier risk decision-making with millisecond-level latency. This invention integrates "prediction-detection-verification-strategy learning" into a unified system, representing a systematic innovation over traditional rule-based and static model-based anti-fraud methods.

[0033] This application has at least the following beneficial effects and advantages:

[0034] This invention achieves high-precision real-time identification of user behavior anomalies by introducing multi-temporal granularity behavior modeling, TFT prediction and uncertainty estimation, a dual-channel anomaly detection mechanism combining Z-score and CUSUM, probe-based active verification, and dynamic threshold optimization based on DQN. This invention can automatically establish an individualized baseline for normal behavior fluctuations for each user, effectively covering both second-level burst anomalies and long-tail penetration anomalies; it constructs a closed loop through probe feedback, significantly reducing false positives and improving decision reliability; it utilizes reinforcement learning to adaptively adjust risk thresholds, enabling the system to continuously optimize strategies based on different media environments and cheating intensity; and it ensures detection and decision-making are completed under millisecond-level latency constraints through edge deployment models, thereby significantly improving the ability to identify abnormal traffic and the robustness of the system while ensuring business benefits.

[0035] To make the objectives, technical solutions, and advantages of this application clearer, the embodiments of this application will be described in further detail below with reference to the accompanying drawings.

[0036] The first embodiment of this application relates to a method for detecting abnormal user behavior, the process of which is as follows: Figure 1 As shown, the method includes the following steps:

[0037] Step 101: Obtain the target user's behavior count sequence at multiple time granularities, and combine it with the derived ratio and time interval features to form multivariate time series input data. The behavior count sequence includes impression count, click count, and conversion count, and the time granularity includes at least the second level (e.g., 1 second), the session level (e.g., 30 seconds), and the cross-session level (e.g., 300 seconds).

[0038] Step 102: Align the multivariate time series input data to a unified vector space to generate a time step vector, learn the time correlation in the TFT model to obtain the time series representation, and enable Bayesian dropout during inference to perform multiple forward inferences to obtain the predicted mean and predicted standard deviation of the next time step and calculate the predicted confidence interval.

[0039] In this scheme, the TFT (Temporal Fusion Transformer) model performs multivariate prediction of user behavior sequences at multiple time granularities, outputs the predicted mean of the next time step, and Bayesian inference provides a reliable uncertainty estimate for user behavior prediction, thereby constructing an individualized baseline for normal behavior fluctuations. This provides a key basis for subsequent Z-score, CUSUM anomaly detection and risk rating, and is the core foundation of the anomaly detection mechanism of this invention.

[0040] Step 103: Obtain the target user's actual exposure count, click count, and conversion count at the current moment. Calculate the current prediction error using the TFT model deployed on the edge and calculate the standardized deviation index Z-score based on the prediction standard deviation. Construct the cumulative offset based on the prediction error and calculate the CUSUM statistic. Merge the Z-score and CUSUM statistic to obtain the combined anomaly variable R(t). The Z-score is used to capture instantaneous high-frequency click-through behavior, while CUSUM is used to capture low-frequency, continuous, and covert pervasive fraud.

[0041] Step 104: When a real-time bidding request arrives, the combined anomaly variable R(t) is compared with two risk thresholds τ1 and τ2. If R(t) < τ1, it is determined to be a normal transmission; if τ1 ≤ R(t) < τ2, it is determined to be a probe impression transmission; and if R(t) ≥ τ2, it is determined to be a direct interception.

[0042] Step 105: When it is determined that the probe exposure has been sent, the preset probe material is sent to the target user, and the feedback results generated by the probe material are collected. The feedback results include click count and conversion count.

[0043] In this solution, probe ads are used to perform low-cost, short-lifecycle behavioral verification on users in the suspicious range. By analyzing the real feedback data of probe exposure, it helps to determine whether the user is abnormal and provides a closed-loop signal for model prediction and risk threshold optimization. It is a key module for this invention to achieve low false positives, high accuracy and dynamic strategy optimization.

[0044] Furthermore, the method of this invention also includes: establishing a state function, establishing executable actions, establishing a reward function, updating risk thresholds τ1 and τ2 in the cloud using a reinforcement learning network DQN based on the state function, executable actions, and reward function, and synchronizing the updated risk thresholds τ1 and τ2 to the anomaly detection and execution module on the edge side. The anomaly detection and execution module is a real-time component deployed at the edge, on the same machine as the TFT prediction model, comparing the R(t) calculated based on Z-score and CUSUM with the thresholds τ1 and τ2. The state function includes the weighted average of the combined anomaly variable R(t) and the rate of return on investment within the most recent time window. Executable actions include lowering τ1, raising τ1, lowering τ2, raising τ2, and keeping it unchanged. The reward function consists of a combination of the rate of return on investment and the proportion of ineffective spending within a preset period.

[0045] DQN adaptively learns the decision strategy for risk score R(t) to learn the optimal strategy between user anomaly score and business benefits, and outputs the optimal risk handling thresholds τ1 and τ2. It realizes adaptive switching between three types of strategies: normal transmission, probe exposure and direct interception, so as to obtain the maximum overall benefit in a dynamic and complex bidding environment. It is the core module of the strategy decision layer of this invention.

[0046] This invention forms a real-time adaptive anti-cheating closed loop through multi-scale prediction, dual-channel anomaly detection, probe exposure, reinforcement learning threshold scheduling, and cloud-edge collaborative inference. Through the above-mentioned causal chain and collaborative mechanism, the system can simultaneously improve detection accuracy, reduce false positives, increase ROI, and meet privacy minimization and resource constraints in millisecond-level pre-bid scenarios, achieving system-level technical effects that existing technologies cannot achieve.

[0047] To better understand the technical solution of this application, a specific example is provided below. The details listed in this example are mainly for ease of understanding and are not intended to limit the scope of protection of this application.

[0048] I. Implementation Steps

[0049] 1) Data access and preprocessing

[0050] 1.1 Event Sources and Input Types

[0051] Define a time triple e = (u, a, t); where u is the user / device ID, a ∈ {impression, click, conversion}, and t is the timestamp. For each u, construct a multi-granularity time series, including second-level Δt = 1s; short-session-level Δt = 30s; and inter-session-level Δt = 5min. Let X_{u}^{(k)}(t) be the cumulative count vector for granularity k.

[0052] Impression / Click / Conversion events (integer enumeration: 0 / 1 / 2), timestamp ts (int64, ms), request ID req_id (string, UUID), user / device identifier uid (string, salted hash), media / placement site_id / placement_id (string), device and network (classification features such as ua, os, ip_asn, conn_type, etc.).

[0053] Key fields of OpenRTB 2.5 BidRequest (as characteristics): device.ua, device.ip, geo.country, site.domain, source.ext.schain, user.id (after salting).

[0054] 1.2 De-duplication and cleaning

[0055] Deduplication key: (req_id); : Use req_id as the primary key; if missing, use hash(u∥a∥t_sec∥placement_id); if there are multiple records with the same key, only the earliest t is kept.

[0056] IP / UA anomaly: Tail list (data center ASN list) marker boolean characteristic is_dc_ip.

[0057] 1.3 Identity De-identification and Compliance

[0058] uid_raw → uid = SHA256(uid_raw + salt); only the irreversible hash and necessary digest features are retained.

[0059] 1.4 Output

[0060] Unified event stream Topic: event_stream(Kafka, Avro / Protobuf), each record has the above fields and cleaning tags.

[0061] 2) Multi-scale sequence construction and feature engineering

[0062] 2.1 Time Granularity and Window

[0063] Granularity set k∈{1,30,300} (unit: seconds), sliding window length L_k: L_1=600 steps, L_30=240 steps, L_300=96 steps.

[0064] 2.2 Counting and Derived Features

[0065] Basic count: X_u^{(k)}(t)=[imp_cnt,clk_cnt,conv_cnt].

[0066] Ratio and time interval: ctr = clk / imp, cvr = conv / clk (with Laplace smoothing), iat_mean / iat_std (mean / variance of event arrival interval).

[0067] Environmental characteristics: hour_of_day, dow, geo_country, device_type, is_dc_ip, supply_chain_len (discretization).

[0068] 2.3 Standardization and Coding

[0069] Numerical feature standardization (mean / variance updated online); categorical feature embedding (dimensions 8–32).

[0070] 2.4 Output

[0071] Each uid and each granularity k is a fixed-length sliding window tensor used as model input.

[0072] 3) Multi-scale prediction (TFT + uncertainty)

[0073] 3.1 Model Objectives

[0074] Predict the expectation and uncertainty of the count vector at the next time step (or H future steps): output μ_t (vector) and logσ_a^2(t) (aleatoric variance), and approximate the epistemic uncertainty by Dropout.

[0075] 3.2 Model Structure and Hyperparameters

[0076] Encoder-Decoder type TFT; number of layers L=4, number of attention heads H=8, hidden dimension d=256, Dropoutp=0.1, static feature channel includes device / region / media attributes.

[0077] Quantization / Distillation: Training a large model → Distilling Tiny-TFT (d=128, L=2, H=4) for edge inference.

[0078] 3.3 Loss Function

[0079] Heteroscedastic Gaussian likelihood loss:

[0080] L_t=0.5*[(y_t-μ_t)^2 / σ_a^2(t)+logσ_a^2(t)]

[0081] Where: y_t is the true count (scalar or vector), μ_t is the model mean output, and σ_a^2(t)=exp(logσ_a^2(t)) is the aleatoric variance of the model output.

[0082] Small Batch Time Window Sampling (TBPTT): Batch size B = 128, sequence truncation T = 256.

[0083] 3.4 Uncertainty Synthesis

[0084] The inference process performs M = 30 Dropout samplings to obtain the sample μ_t^{(m)};

[0085] σ_e^2(t)=Var_m[μ_t^{(m)}](epistemic), σ_a^2(t) is the output mean;

[0086] The total variance of the prediction is σ_pred^2(t)=σ_a^2(t)+σ_e^2(t).

[0087] Confidence interval (significance α, normal quantile z_α):

[0088]

[0089] Typical value: α = 0.05 → z_α = 1.96.

[0090] 3.5 Training and Validation

[0091] Data partitioning: time partitioning (first 80% training, last 20% validation); metrics: MAE, RMSE, mAPE; early stopping patience = 5.

[0092] Optimizer: AdamW, lr = 3e-4, weight_decay = 1e-4; learning rate cosine annealing.

[0093] 3.6 Model Export and Deployment

[0094] Export ONNX (dynamic batch / duration), edge inference engine ONNXRuntime / TensorRTFP16; single sample mean inference ≤4ms.

[0095] 4) Real-time anomaly detection (Z+CUSUM+Risk Score)

[0096] Standardization: Z(t) = |y_t - μ_t| / σ_pred(t), where μ_t is the predicted mean, and σ_pred(t) = √(σ_a^2(t) + σ_e^2(t)) is the total standard deviation of the prediction. σ_a^2(t) is the inherent noise / heteroscedasticity of the data (observation uncertainty directly predicted by the model), and σ_e^2(t) is the cognitive uncertainty of the model (often estimated by Dropout / deep ensemble estimation due to insufficient samples or distribution drift); the sum of the two and the square root is σ_pred(t).

[0097] 4.2 CUSUM Variable Point

[0098] S_t = max(0, S_{t-1} + Δ(t) - k), alarm condition S_t ≥ h;

[0099] Typical settings: k=0.5*σ_Δ, h=5*σ_Δ.

[0100] Parameter definitions: S_t (cumulative sum), k (drift sensitivity), h (threshold).

[0101] 4.3 Risk Score

[0102] R(t) = w1 * Z(t) + w2 * I[S_t≥h], w1 + w2 = 1; default w1 = 0.7, w2 = 0.3;

[0103] Classification: R(t) < τ1 (normal), τ1 ≤ R(t) < τ2 (suspicious), R(t) ≥ τ2 (high risk).

[0104] Parameter definitions: w1 / w2 (weights), I[·] (indicator function), τ1 / τ2 (threshold, online learning).

[0105] 4.4 Output

[0106] The decision result and reason (Z value, S_t, magnitude of exceeding CI) are written to the decision_log for use by auditors and reviewers.

[0107] 5) Handling and Feedback: Normal / Probe / Interception + RL Threshold Scheduling

[0108] 5.1 Normal forwarding

[0109] R(t)<τ1: Outbound to the matching DSP according to the normal route; the output contains the normal bidding context.

[0110] 5.2 Probe Exposure

[0111] Triggering condition: τ1≤R(t)<τ2;

[0112] Probe bid: CPM_test = CPM_norm * θ, default θ = 0.05;

[0113] TTL: ≤15min; The material library is owned / publicly funded to avoid wasting the actual budget;

[0114] Postback: Record click_flag and conv_flag and enter the reward function.

[0115] Parameter definitions: CPM_norm (same type normal CPM, sliding estimate), θ (discount factor), TTL (lifetime).

[0116] 5.3 Direct Interception

[0117] R(t)≥τ2: Do not send to external systems; write to the blacklist cache (short-term: T_black=30min) and report statistics;

[0118] Optional review: Offline Forensics task sampling verification. [Optional]

[0119] 5.4 Reinforcement Learning Threshold Scheduling (DQN)

[0120] state: Window length T_win = 5min;

[0121] Action: a_t∈{Δτ1=±ε, Δτ2=±ε}, step size ε=0.05;

[0122] Reward: r_t=α*ROI_t-β*InvalidSpend_t (α=1.0, β=0.8);

[0123] Update: Q(s,a)←Q+η[r_t+γmax_{a'}Q(s',a')-Q](η=1e-3,γ=0.99), ε-greedy annealing (0.2→0.05);

[0124] Send out: Synchronize new τ1 / τ2 to the edge every 5 minutes.

[0125] Definition: ROI_t = revenue / spend, InvalidSpend_t is the percentage of cost that was deemed invalid, and s' is the new state after the action.

[0126] 5.5 Safety Rollback and Stability

[0127] Protection thresholds: τ1_min = 0.5, τ2_max = 5.0; RL must not exceed these limits.

[0128] Abnormal rollback: If the false positive rate exceeds the threshold (calibrated by A / B) within 10 minutes, automatically roll back to the last stable parameter.

[0129] II. Training and Reproduction Details

[0130] Data segmentation: divided by time to strictly avoid leakage; Training: Validation: Testing = 6:2:2.

[0131] Randomness control: seed=2025, fixed initialization and data shuffling order; log recording of training configuration (YAML).

[0132] Metric thresholds: Normal sequence mAPE < 8% and offline replay ROI improvement ≥ 5% under threshold strategy are required for deployment.

[0133] Resources and latency: Edge CPU (8 vCPU) + 32GB RAM per node 3k QPS; prediction + decision ≤10ms (p95).

[0134] III. Detailed Algorithm and Formula

[0135] 3.1 Data Representation

[0136] Event triple: e = (u, a, t), where u is the user / device ID, a ∈ {impression, click, conversion}, and t is the timestamp.

[0137] Construct multi-granularity time series for each u:

[0138] Seconds: Δt = 1s

[0139] Short session level: Δt = 30s

[0140] Inter-session level: Δt = 5min. Let X_{u}^{(k)}(t) be the cumulative count vector of granularity k.

[0141] ●A.1 Definition

[0142] 1.u: User / Device stability identifier (string). Selected from fields such as user.id, device.ifv / ifa, cookie_id, etc.; if missing, the stability fingerprint F(f1…f) is used. n Salted hashing is performed by combining (e.g., UA family, OS, screen, font hash, IP / ASN range) data.

[0143] u=SHA256(canonicalize(user / device identifiers)∥salt).

[0144] 2.a: Event type (int, enumeration). 0 = impression, 1 = click, 2 = conversion. From delivery / feedback logs; if the same req_id is reported multiple times, deduplication is performed by time (only the first entry is kept).

[0145] 3.t: Event timestamp (int64, milliseconds). Consolidate from the source log ts_raw to UTC, storing it as a millisecond integer; to construct a multi-granularity sequence, simultaneously saving both second-aligned and window-aligned versions: t_sec = floor(ts_raw / 1000)*1000; for window granularity k∈{1,30,300} seconds, bucket_k(t) = floor(t / (k·1000)).

[0146] ●A.2 Calculation Method (Implementation Steps)

[0147] 1. Extraction and deduplication: Use req_id as the primary key; if it is missing, use hash(u∥a∥t_sec∥placement_id); for multiple records with the same key, only the earliest t is kept.

[0148] 2. Identity unification: Generate u according to the above rules; discard the reversible original ID and retain the hash.

[0149] 3. Time normalization: Convert to UTC; generate t_sec and each bucket_k(t).

[0150] 4. Event bucketing: Perform incremental counting for each (u,k,bucket):

[0151] ■imp_cnt^k(u, bucket)=ΣI[a=0&bucket_k(τ)=bucket]

[0152] ■clk_cnt^k(u, bucket)=ΣI[a=1&bucket_k(τ)=bucket]

[0153] ■cvt_cnt^k(u, bucket)=ΣI[a=2&bucket_k(τ)=bucket]

[0154] 5. Derivation ratio (with Laplace smoothing, avoid division by zero):

[0155] ctr^k=(clk_cnt^k+α) / (imp_cnt^k+α+β);

[0156] cvr^k = (cvt_cnt^k + α) / (clk_cnt^k + α + β); the default value is α = β = 1.

[0157] 6. Time interval characteristics: mean / variance of event arrival intervals for the same u (iat_mean / iat_std), and "time since last click / conversion".

[0158] ●A.3 The role of subsequent steps

[0159] 1. Target sequence: For each u and each granularity k, form a time series vector X_u^{(k)}(t)=[imp_cnt^k,clk_cnt^k,cvt_cnt^k,ctr^k,cvr^k,iat_*…], which serves as the basis for the model input-output.

[0160] The actual observation y_t (scalar or vector) at the next time step is provided by the corresponding dimension in X_u^{(k)}(t+1).

[0161] 2. Anomaly Calculation: After a real-time event is bucketed, y_t is compared with the prediction. Comparison results in errors For use with Z-score, CUSUM and risk scoring.

[0162] 3. Feedback and reinforcement learning: a = 1 / 2 (clicks / conversions) is used to backfill click_flag / conv_flag, and enters the statistics of ROI_t and InvalidSpend_t in the reward function to drive threshold adaptation.

[0163] 3.2 Multi-scale prediction model (TFT)

[0164] 1. Input Embedding

[0165] h_0=E_c(categorical)⊕E_q(quantitative)

[0166] 2. Transformer Coding

[0167] H_l=MultiHeadAttn(H_{l-1})+PosEnc

[0168] 4. Decoder + Gating Mechanism

[0169] Output prediction And Aleatoric uncertainty σ_t.

[0170] 3. Bayesian Dropout Confidence Interval

[0171] Multiple forward passes: Confidence interval B.1 Input Embedding

[0172] ● Input tensor definition (taking single granularity k and time step τ as an example):

[0173] ○ The set of categorical features is c_τ={c_τ^{(j)}}_{j=1..J} (such as geo_country, device_type, site_domain_bucket, hour_of_day, is_dc_ip, etc.); the range of values ​​for each c_τ^{(j)} is V_j.

[0174] Numerical eigenvectors (Such as imp / clk / cvt counting, ctr / cvr, iat_*, historical sliding window statistics, etc.), have been standardized.

[0175] ●Mapping to vector space:

[0176] ○Category embedding: Create a table for each variable j Get the embedding from the corresponding row

[0177] spliced ​​together

[0178] ○Numerical mapping:

[0179] ○Time / Granularity Encoding: Position encoding pos(τ) (sine / cosine) and granularity one-hot g_k.

[0180] ○Final input vector:

[0181] ( (For splicing).

[0182] ●Significance: Aligning heterogeneous discrete / continuous / temporal information into a unified vector space facilitates subsequent time series modeling.

[0183] B.2 Transformer Encoding

[0184] ●Sequence matrix:

[0185] ●Multiple attention (layer l, h-th head):

[0186] ○Q_h=X W_Q^{(l,h)}, K_h=X W_K^{(l,h)}, V_h=X W_V^{(l,h)};

[0187] A_h=softmax(Q_h K_h^T / √d_k)V_h.

[0188] ○ Header concatenation: A = concat_h(A_h)W_O^{(l)};

[0189] ○ Residual and Normalization: X' = LayerNorm(X+A);

[0190] ○ Feedforward network: Z = LayerNorm(X' + FFN(X'))

[0191] (FFN(z)=W2σ(W1z+b1)+b2).

[0192] ●Significance: Explicitly models the dependencies and interactions between different time steps (both long and short time steps), outputting... As a representation of temporal characteristics.

[0193] B.3 Decoding + Gating Mechanism (Taking TFT as an example)

[0194] ● Variable Selection Network (VSN, optional but recommended): Learnable weighting of input variables:

[0195] α_τ=softmax(W^αtanh(W_s s+W_x x_τ))

[0196]

[0197] Where s is the static context (e.g., media / country / device family), and α_τ^{(i)} is the importance weight of the i-th variable.

[0198] ●Gated Residual Network (GRN):

[0199]

[0200] Where GLU(z) = z⊙σ(W_g z+b_g); h_τ is the representation used for prediction.

[0201] ● Output layer (using heteroscedastic Gaussian as an example, with NB distribution as the adaptive counting option):

[0202] μ_τ=softplus(W_μh_τ+b_μ) (non-negative mean);

[0203] logσ_a^2(τ)=W_σh_τ+b_σ,σ_a^2(τ)=softplus(·)+ε_stab(ε_stab≈1e-6). If a negative binomial distribution is used (optional alternative), the output parameters are log r, log p or μ,k, to avoid negative values ​​in the count.

[0204] ●Significance: VSN selects the "most relevant" variable at the moment, GRN controls the information flow and suppression, and outputs the expected value and noise intensity at the next moment.

[0205] B.4 Bayesian Confidence Intervals (Prediction Uncertainty Based on MC Dropout)

[0206] ●Sampling: During inference, Dropout is enabled, and M forward passes are performed to obtain μ_τ^{(m)}.

[0207] ●Statistic:

[0208] (Predicted mean)

[0209] σ_e^2(τ)=Var_m[μ_τ^{(m)}](model cognitive uncertainty),

[0210] σ_pred^2(τ)=σ_a^2(τ)+σ_e^2(τ) (total prediction variance).

[0211] Confidence interval:

[0212]

[0213] Where α is the significance level (default 0.05), and z_α is the standard normal (1-α / 2) quantile (z_α≈1.96 when α=0.05).

[0214] ●Significance: It expands "point prediction" to "range prediction", providing a "normal fluctuation range" for subsequent anomaly detection.

[0215] B.5 Logical relationships among the four (from input to the range that can be used for decision-making)

[0216] 1. Input embedding: Align heterogeneous features into a time step vector x_τ;

[0217] 2. Transformer encoding: Learn the time correlation within the window [t-T+1,t] to obtain the time series representation Z;

[0218] 3. Decoding + Gating: Adaptively select variables and form a predictive representation h_τ, outputting μ_τ and σ_a^2(τ) at the next time step;

[0219] 4. Bayesian confidence interval: Synthesize σ_e^2 and σ_a^2 to obtain CI_α;

[0220] 5. Compare with observed values: When the actual y_t arrives, calculate... The degree of boundary violation is then used to determine Z-score, CUSUM, and risk score, which in turn drive the scheduling of "normal / probe / interception" and RL thresholds.

[0221] 3.3 Real-time anomaly detection

[0222] ●Error:

[0223] ●Standardization: Z(t)=(Δ(t)-μ_Δ) / σ_Δ (statistics in a sliding window).

[0224] ●CUSUM:

[0225] S_t=max(0,S_{t-1}+Δ(t)-k)

[0226] Alarm if S_t≥h

[0227] Among them, k=0.5·σ_Δ, h=5·σ_Δ.

[0228] ● Risk score: R(t)=w1·Z(t)+w2·I[S_t≥h],w1+w2=1.

[0229] ● Threshold: {τ1,τ2} Real-time online learning.

[0230] 1. Error

[0231] ●Formula:

[0232] ●Definition:

[0233] ○y_t: The actual observation at time point t (one of the optional targets: count imp / clk / cvt or ratio ctr / cvr; the unit is consistent with the selected target).

[0234] ○ The mean prediction of the multi-scale prediction model at time t (from Section 3.2, also denoted as...) ).

[0235] ●Significance: Measures the instantaneous deviation between actual behavior and "expected behavior". The larger Δ(t) is, the more abnormal the moment.

[0236] 2. Standardization

[0237] ●Formula: Z(t)=(Δ(t)-μ_Δ) / σ_Δ

[0238] ●Definition:

[0239] ○μ_Δ: The mean error over the most recent W time points (sliding window).

[0240] ○σ_Δ: The standard deviation of the error over the most recent W time points (sliding window).

[0241] ○W: Sliding window length (in points, not seconds; typical value 300).

[0242] ●Significance: Mapping errors to dimensionless standard deviation units facilitates cross-stage comparisons.

[0243] Z(t)≈0 indicates that the value is near the historical mean; Z(t)≥3 is usually considered a significant anomaly.

[0244] Implementation hints (optional): Welford incremental method can be used for online updates of μ_Δ and σ_Δ; when σ_Δ≈0, use σ_Δ←max(σ_Δ,ε) (e.g., ε=1e-6) to ensure numerical stability.

[0245] 3. CUSUM (Cumulative and Changing Points)

[0246] ●Formula: S_t=max(0,S_{t-1}+Δ(t)-k); Alarm condition: S_t≥h

[0247] ●Definition:

[0248] ○S_t: Cumulative offset to t (single-sided uplink CUSUM).

[0249] ○k: Drift sensitivity constant, which compensates for small fluctuations (typically set to k = 0.5·σ_Δ).

[0250] ○h: Decision threshold (typically set as h = 5·σ_Δ).

[0251] ●Significance: Sensitive to “continuous small deviations”; even if a single point is not significant (Z(t) is not high), multiple slight abnormalities will gradually push S_t up to the alarm level, making it suitable for identifying low-frequency penetration-type cheating.

[0252] Optional extensions: If it is necessary to detect downward drift simultaneously, a single downlink CUSUM can be run in parallel; or a dual-sided CUSUM can be used instead.

[0253] 4. Risk scoring (integrating instantaneous and ongoing factors)

[0254] ●Formula: R(t)=w1·Z(t)+w2·I[S_t≥h],w1+w2=1

[0255] ●Definition:

[0256] ○w1,w2: fusion weights (typically w1=0.7, w2=0.3).

[0257] ○I[·]: Indicator function, the condition is 1 if true and 0 if false.

[0258] ●Significance: This method combines the instantaneous anomaly intensity (Z(t)) with the occurrence of a sustained change point (I[S_t≥h]) into a single decision signal. When a sustained anomaly occurs, R(t) will be raised to a more "deterministic" range.

[0259] Optional calibration: If you need to approximate R(t) as a probability, you can perform Platt / Isotonic calibration on R(t) offline using logistic regression / equal probability binning.

[0260] 5. Threshold Classification and Action

[0261] ● Rules: R(t) < τ1 → PASS (normal transmission); τ1 ≤ R(t) < τ2 → PROBE (probe); R(t) ≥ τ2 → BLOCK (interception).

[0262] ●Definition:

[0263] ○τ1,τ2: Low / high risk thresholds, satisfying τ1<τ2; initial values ​​(example) τ1=1.5, τ2=3.0, and are adaptively updated by online learning (RL).

[0264] ●Significance: Transforming continuous risk signals into actionable strategies, achieving a balance between the risk and cost of false positives.

[0265] Optional improvement: Replace Δ(t) with "heteroscedasticity-weighted residuals": (σ_pred is the total standard deviation of the prediction, which comes from the uncertainty of 3.2), which allows the threshold to be more equitable for different uncertainty scenarios.

[0266] Logical relationships between steps (end-to-end execution order):

[0267] 1. Obtain the prediction baseline: the predicted mean at time point t from the output of the multi-scale prediction model. (and σ_pred(t); see 3.2).

[0268] 2. Align with true observations: Once the true value y_t is reached, calculate the instantaneous deviation Δ(t).

[0269] 3. Distribution alignment: Δ(t) is standardized to Z(t) using sliding window statistics μ_Δ and σ_Δ to achieve comparability across time periods and scales.

[0270] 4. Persistence determination: Update CUSUM S_t, determine whether it exceeds h, and identify persistent deviation / chronic penetration.

[0271] 5. Merge into a single risk: Use weights w1 and w2 to merge Z(t) and I[S_t≥h] into R(t).

[0272] 6. Classification and handling: Compare R(t) with thresholds τ1 and τ2, execute PASS / PROBE / BLOCK and record Z, S, R, and τ to the log.

[0273] 7. Online Adaptive (Optional but Recommended): RL uses ROI / ineffective cost as a reward to fine-tune τ1 and τ2 online, making the decision strategy consistent with the economic goal.

[0274] Common Boundaries and Key Implementation Points:

[0275] ●When σ_Δ is extremely small or zero, set a lower limit ε to ensure numerical stability; the window W is recommended to be equivalent to 5–10 minutes of points.

[0276] ● In the case of multiple objectives (vectors), the standardized residuals are calculated for each dimension, and then aggregated into the population Z*(t) using L2 / L∞; each dimension can be weighted w_d.

[0277] ● If the business is more conservative, hysteresis can be added: the uplink threshold τ↑ and the downlink threshold τ↓ are separated to reduce strategy jitter.

[0278] 3.4 Reinforcement Learning Threshold Scheduling (DQN)

[0279] ●Status:

[0280] ●Action: a_t∈{Δτ1=±ε,Δτ2=±ε}.

[0281] ●Rewards:

[0282] r_t=α·ROI_t-β·InvalidSpend_t

[0283] ●Q update: Q(s,a)←Q+η[r+γ·max_{a'}Q(s',a')-Q(s,a)].

[0284] Status:

[0285] ■s_t: The state vector at time t (2-dimensional, dimensionless).

[0286] ■ The weighted average (either EMA or arithmetic mean) of risk scores R(·) within the most recent time window T_win. Reflects the current "risk control pressure".

[0287] ■ROI_win: Return on investment (revenue / spend) within the same T_win, aggregated according to the advertiser's real-time / near real-time feedback. Reflects "business effectiveness".

[0288] ■T_win: The length of the state statistics window (e.g., 5 minutes) to ensure that the state is not dominated by transient noise.

[0289] ○Action: a_t∈{Δτ1=±ε,Δτ2=±ε}

[0290] ■a_t: The threshold adjustment action selected at time t.

[0291] ■τ1,τ2: Low / high risk thresholds (τ1<τ2), used to segment continuous risk R(t) into PASS / PROBE / BLOCK.

[0292] ■Δτ1,Δτ2: The increment of the threshold in this step (one positive and one negative).

[0293] ■ε: Adjust the step size (e.g., 0.05).

[0294] ■Constraints (engineering required): τ1_min≤τ1≤τ2-δ, τ1+δ≤τ2≤τ2_max, and |Δτ|≤ε_max; to avoid oscillations and out-of-bounds errors.

[0295] ○ Reward: r_t = α·ROI_t - β·InvalidSpend_t

[0296] ■r_t: The scalar reward obtained within an evaluation period from t to t+1.

[0297] ■ROI_t: The ROI (revenue_t / spend_t) for this period can be aggregated by media / country and then averaged, or directly expressed as the total amount.

[0298] ■InvalidSpend_t: The proportion of spending deemed invalid during this period (or the amount normalized to 0–1). It can consist of refunds, probe consumption (optional), rule corrections, etc.

[0299] ■α,β: Trade-off coefficients (e.g., α=1.0, β=0.8), which combine business objectives and risk control objectives into an optimization target.

[0300] ■Meaning: Make the agent tend to increase ROI and reduce ineffective spending; when the two conflict, the choice is determined by α / β.

[0301] ○Q update: Q(s,a)←Q(s,a)+η·[r_t+γ·max_{a'}Q(s',a')-Q(s,a)]

[0302] ■Q(s,a): The long-term value estimate (expected return) of taking action a in state s.

[0303] ■η: Learning rate (e.g., 0.001), which determines the step size for each update.

[0304] ■γ: Discount factor (e.g., 0.99), which determines the degree of importance attached to future returns.

[0305] ■s': The new state obtained in the next evaluation cycle after executing a_t and applying the new threshold.

[0306] ■max_{a'}Q(s',a'): The optimal action value achievable under the new state (greedy goal).

[0307] ■Meaning: Minimize TD error and iteratively approximate the optimal threshold scheduling strategy. In engineering, this is often used with the target network. Experience replay improves stability and sample efficiency.

[0308] ● Logical relationships between steps (end-to-end execution order)

[0309] 1. Summary Status (Input): Aggregated within the scrolling window T_win. Together with ROI_win, they form s_t.

[0310] 2. Action selection (decision): Using an ε-greedy or softmax strategy, select a_t from {Δτ1=±ε, Δτ2=±ε} and check the constraints (boundaries and maximum change).

[0311] 3. Apply action (execute): Issue new thresholds τ1 and τ2 to the edge nodes; for a period of time thereafter, perform PASS / PROBE / BLOCK according to the new thresholds.

[0312] 4. Data collection and feedback (observation): Within the same evaluation period, calculate ROI_t and InvalidSpend_t, calculate the reward r_t, and generate a new state s_{t+1}.

[0313] 5. Update the value function (learning): Train using Q-update method (batch sampling from the experience pool <s,a,r,s'>), and periodically train using the target network / soft update to stabilize the training.

[0314] 6. Cycle and Convergence (Adaptive): Proceed to the next window and continue with steps 1–5; if the KPI degenerates or oscillates, trigger rollback and step size / weight adaptation (e.g., reduce ε, adjust α / β).

[0315] ●Key points and optional calibers

[0316] ○ Status and caliber:

[0317] ■ (EEMA recommended, β_ema 0.7–0.9);

[0318] ■ ROI_win and ROI_t use the same caliber (total amount or bucket weighting) to avoid training / application bias.

[0319] ○ Normalization and robustness: Normalize ROI_t and InvalidSpend_t to [0,1] or perform quantile scaling to avoid the impact of reward scale drift on stability.

[0320] ○ Safety Boundaries: Set τ1_min, τ2_max, δ (minimum spacing) and use hysteresis (different thresholds for uplink / downlink) to reduce frequent jitter.

[0321] ○ Training stability (optional but highly recommended):

[0322] ■Target Network (Soft update, ρ≈0.005);

[0323] ■ Experience Review: Capacity N = 50k–200k, batch size 64–256, priority sampling can improve sample efficiency.

[0324] ○ Push strategy: The new threshold is switched atomically with "effective timestamp + version number"; if the ROI deteriorates significantly or the block surges in the short term, the previous version will be automatically rolled back.

[0325] ○ Cold start: You can warm up the device first with a fixed threshold or context bandit (LinUCB / Thompson) before switching to DQN.

[0326] ●The overall meaning of the formula is to reinforce learning threshold scheduling to control the "strength of risk control signals". Combined with "Business Effectiveness" (ROI_win), it forms a learnable state. By making small, stable adjustments to τ1 / τ2, it automatically finds the risk segment position with the maximum ROI and the minimum ineffective cost while ensuring real-time performance. Q update ensures that the strategy continuously approaches the long-term optimum in a dynamic environment.

[0327] 3.5 Probe Exposure Strategy

[0328] Requests for τ1≤R(t)<τ2:

[0329] ● Set CPM to the normal ≤5%;

[0330] ●Material lifecycle ≤15min;

[0331] ●Record subsequent clicks / conversions as additional feedback for RL.

[0332] process

[0333] 1. When τ1≤R(t)<τ2, do not directly intercept, but mark the request as "suspicious".

[0334] 2. The system selects registered probe creative materials: the ad size is the same as the regular ones, the content is brand public welfare or self-owned promotion, and the cost is extremely low.

[0335] 3. Set bidding parameters:

[0336] ○ CPM_test = CPM_norm × θ, default θ = 0.05 (i.e., 5% normal)

[0337] CPM).

[0338] ○ TTL (Time-to-Live): The content can be displayed to the user for a maximum of 15 minutes.

[0339] 4. Record subsequent clicks and conversions, generate feedback (click_flag, conv_flag) and send it to the RL reward function.

[0340] 5. Update user / device risk profile: If the conversion rate of probe ads is much lower than the baseline, the risk score of subsequent requests will be weighted and increased.

[0341] 3.5. Logical relationships between steps A

[0342] 1. Trigger: When R(t) falls within the interval [τ1, τ2), mark the request as "suspicious but unconfirmed";

[0343] 2. Cost reduction: Set the bid to CPM_test = CPM_norm × θ (θ≈0.05) and limit TTL to ≤15min to ensure cost control.

[0344] 3. Isolation: Prioritize routing to owned / public welfare creatives or controlled DSPs to avoid impacting genuine advertisers;

[0345] 4. Observation: Record secondary behaviors such as click_flag, conv_flag, and dwell time;

[0346] 5. Attribution: If the performance is significantly lower than the baseline performance of normal traffic of the same type, the subsequent risk score of the uid / device / source will be increased or its whitelist lifespan will be shortened.

[0347] 6. Feedback: Write the probe results into the reward and state statistics of RL to support threshold adaptation;

[0348] 7. Convergence: As samples accumulate, boundary traffic will be further "pulled" towards the normal or intercepted ends, reducing long-term gray zone costs.

[0349] 3.5.B Decision Matrix and Options

[0350] ● Decision matrix (core conditions × adjustment factors):

[0351] ○ Behavioral axis: R(t)<τ1(PASS) / [τ1,τ2)(PROBE) / ≥τ2(BLOCK);

[0352] ○ Adjustment factors: budget_ok (probe budget not exceeded), fc_uid (user frequency control), vertical (whether probes are allowed in a vertical category, such as finance / medical, which can be disabled);

[0353] Example: If PROBE is true and budget_ok ∧ fc_uid ∧ vertical_ok, send the probe; otherwise, roll back to PASS but record a high-risk flag. [Optional]

[0354] ●Probe budget and frequency control:

[0355] ○ daily_probe_cap (divided by media / country / page),

[0356] per_uid_probe_cap (e.g., ≤ 2 times per 24h);

[0357] ○ pacing: Distribute the remaining probe quota evenly over 15 minutes to avoid instantaneous concentration.

[0358] ●Optional alternatives: For extremely sensitive verticals, use "zero-bid probes" (requests only, no payment) or server-side synthetic exposure as offline verification signals.

[0359] 3.6 Cloud-Edge Model Collaboration

[0360] 3.6.1 Components and Responsibilities

[0361] ●Cloud-based: Training and fine-tuning (TFT / calibration), RL agents, Model Registry, Config Service, and Observability Platform (Logs / Metrics / Tracing).

[0362] ● Edge: Feature aggregation cache (State Store, RingBuffer / Redis), inference engine (ONNXRuntime / TensorRT), decision maker (Z / CUSUM / Score), executor (routing / probe / interception).

[0363] 3.6.2 Model Bundle

[0364] ● Directory: / bundle / {version} / model.onnx,inference.yaml (initial threshold, feature dictionary, normalization parameters),checksum.sig (signature).

[0365] ● Security: Inventory signing (Ed25519) and integrity verification (SHA-256).

[0366] 3.6.3 Distribution and Grayscale

[0367] ● V_new is generated in the cloud, and p95_latency, BLOCK rate, and ROIΔ are observed through Canary (5% traffic); after meeting the threshold, it is expanded to 25% → 100%.

[0368] ● In case of failure, automatically roll back V_current and freeze V_new.

[0369] 3.6.4 Edge runtime

[0370] ●Time budget: Preprocessing ≤2ms → Inference ≤4ms → Decision ≤2ms → Recording ≤1ms (total ≤10ms).

[0371] ●Feature consistency: inference.yaml contains the version number of the standardized mean / variance and class mapping table; edges are hot-swapped by version.

[0372] ●Timeout Degradation: Inference >6ms uses the "fast path" (Z-score only); >15ms marks it as PASS and returns it for review to ensure availability.

[0373] 3.6.5 RL Parameter Synchronization

[0374] ● Each T_win cloud-based calculation of new τ1 / τ2 and step size ε is pushed via Config Service; the edge switches atomically based on "version + effective timestamp".

[0375] ● Set safety boundaries: τ1_min, τ2_max and "upper limit of rate of change" to prevent oscillation.

[0376] 3.6.6 Logging and Backtracking

[0377] ● Write decision_log(req_id,uid_hash,R,τ,action,latency_ms,bundle_ver) to Kafka at the edge;

[0378] ● Cloud-based aggregation generates KPIs and audit reports (including a sample playback facility for offline replay verification).

[0379] 3.6.7 Compatibility and Replacement

[0380] ● Edge nodes without GPUs use INT8 quantization ONNX;

[0381] ● You can also replace the Dropout confidence interval with a quantile regression model (just replace the output mapping inference.yaml).

[0382] IV. Model Training and Combination Process

[0383] 1. Offline Phase

[0384] ○ Generate a sequence using 90 days of historical events, granularized into three levels;

[0385] ○ Cross-validation selected TFT layer number L=4 and head number H=8;

[0386] ○ Distillation Tiny-TFT deployment to Edge.

[0387] 2. Online fine-tuning

[0388] ○ Daily incremental data replay, fine-tuning by 1 epoch;

[0389] ○ Synchronize Cloud→Edge weights.

[0390] 3. RL Collaboration

[0391] ○ DQN updates probe exposure results using cloud FIFO;

[0392] ○ New τ1 and τ2 are issued to Edge (GRPC).

[0393] V. Key Points of the Invention

[0394] 1. Multi-scale prediction + confidence interval: For the first time, second-level and session-level sequences are unified into TFT, and Bayesian confidence intervals are output for direct decision-making.

[0395] 2. Millisecond-level interception before bidding: The entire judgment link is ≤10ms, achieving true RTB-level real-time performance, which is different from traditional post-event settlement.

[0396] 3. Probe Exposure Closed Loop: Utilizing TRIZ#27 "Inexpensive Short-Lifetime Objects", design low-cost probe ads to sample abnormal traffic behavior in real time.

[0397] 4. RL dynamic threshold mechanism: Based on the advertiser's ROI, the risk threshold is automatically adjusted to avoid the failure of manually static rules.

[0398] 5. Cloud-Edge Layered Inference: Model slicing and distillation ensure high-accuracy prediction even with limited edge computing resources.

[0399] 6. Security and Privacy: Only the minimum necessary characteristics are sent to Edge, without any reversible identity information, to achieve data security compliance.

[0400] VI. Technical Effects and Advantages

[0401]

[0402] 6.1 Resource saving

[0403] ●DSP load: The amount of data sent is reduced by approximately 18%, and the cost of unpacking and parsing on the DSP side decreases simultaneously.

[0404] ●Network bandwidth: Edge-trimmed logs, daily average compression ratio >65%.

[0405] 6.2 Data Security

[0406] ● Event data is identified using local Hash & Bloom filters, which complies with the GDPR / CCPA minimization principle.

[0407] ●Summary: This invention significantly reduces invalid traffic and improves ad conversion through two major innovations: prediction-judgment-RL closed loop and probe exposure. At the same time, it takes into account data security and resource efficiency, providing a feasible and commercially viable new path for the field of RTB anti-fraud.

[0408] VII. Explanation of Terms and Professional Vocabulary

[0409]

[0410] Accordingly, embodiments of this application also provide a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the various method embodiments of this application. Computer-readable storage media include permanent and non-permanent, removable and non-removable media, and information storage can be implemented by any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, disk storage or other magnetic storage devices, or any other non-transfer medium that can be used to store information accessible by a computing device. As defined herein, computer-readable storage media do not include transient computer-readable media, such as modulated data signals and carrier waves.

[0411] Furthermore, embodiments of this application also provide a user behavior anomaly detection system, including a memory for storing computer-executable instructions, and a processor; the processor is used to implement the steps in the above-described method embodiments when executing the computer-executable instructions in the memory. The processor may be a Central Processing Unit (CPU), Graphics Processing Unit (GPU), Digital Signal Processor (DSP), Microcontroller Unit (MCU), Neural Processing Unit (NPU), Application Specific Integrated Circuit (ASIC), Field Programmable Gate Array (FPGA), or other programmable logic devices. The aforementioned memory may be read-only memory (ROM), random access memory (RAM), flash memory, hard disk, or solid-state drive, etc. The steps of the methods disclosed in the embodiments of this invention can be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules in the processor.

[0412] Furthermore, embodiments of this application also provide a computer program product, including computer-executable instructions that, when executed by a processor, implement the steps in the above-described method embodiments.

[0413] In some cases, the actions or steps described in the claims can be performed in a different order than that shown in the embodiments and still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require a specific or sequential order to achieve the desired result. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

Claims

1. A method for detecting user behavior anomaly, characterized in that, The method comprises the following steps: obtaining a behavior count sequence of a target user at multiple time granularities, and combining the behavior count sequence with derived ratio and time interval features to form multivariate time series input data, wherein the behavior count sequence includes exposure count, click count and conversion count, and the time granularities include at least second level, session level and cross-session level; aligning the multivariate time series input data to a unified vector space to generate a time step vector, and learning time correlation in a TFT model to obtain a time series representation, and enabling Bayesian inference during inference to perform multiple forward inferences to obtain a predicted mean and a predicted standard deviation at the next time and calculate a prediction confidence interval; obtaining real exposure count, click count and conversion count of the target user at the current time, calculating a current prediction error by the TFT model deployed on the edge side, calculating a Z-score based on the predicted standard deviation, constructing a cumulative offset based on the prediction error and calculating a CUSUM statistic, and fusing the Z-score and the CUSUM statistic to obtain a combined anomaly variable R(t); when a real-time bidding request arrives, comparing the combined anomaly variable R(t) with two risk thresholds τ1 and τ2, determining normal sending when R(t) < τ1, determining probe exposure sending when τ1 ≤ R(t) < τ2, and determining direct interception when R(t) ≥ τ2; when it is determined that the probe exposure sending, sending a preset probe material to the target user, and collecting feedback results generated by the probe material, wherein the feedback results include click count and conversion count.

2. The user behavior anomaly detection method of claim 1, wherein, Further comprising: establishing a state function, wherein the state function includes a weighted average of the combined anomaly variable R(t) in the latest time window and a return on investment; establishing executable actions, wherein the executable actions include lowering τ1, raising τ1, lowering τ2, raising τ2 and keeping unchanged; establishing a reward function, wherein the reward function is composed of a combination of return on investment and invalid cost ratio in a preset period; updating the risk thresholds τ1 and τ2 in the cloud by using a reinforcement learning network according to the state function, the executable actions and the reward function, and synchronizing the updated risk thresholds τ1 and τ2 to the anomaly determination and execution module on the edge side.

3. The user behavior anomaly detection method of claim 1, wherein, The Bayesian inference obtains a prediction set by randomly inactivating neurons in part of layers of the TFT model for M times of forward inferences, and calculates the predicted mean and the predicted standard deviation at the next time based on the prediction set.

4. The user behavior anomaly detection method of claim 1, wherein, The confidence interval is CI_α(t) = [μ_t-z_α*σ_pred(t), μ_t+z_α*σ_pred(t)], wherein μ_t is the predicted mean, z_α is a normal quantile, and σ_pred(t) is the predicted total variance.

5. The user behavior anomaly detection method of claim 1, wherein, The Z-score of the current time t is calculated by Z(t) = |y_t - μ_t| / σ_pred(t), y_t is the true value of the count, μ_t is the predicted mean, σ_pred(t) is the predicted total standard deviation, σ_pred(t) = √(σ_a^2(t) + σ_e^2(t)) is the predicted total standard deviation, σ_a^2(t) is the intrinsic noise of the data, and σ_e^2(t) is the model cognitive uncertainty, the CUSUM statistic of the current time t is calculated by S_t = max(0, S{t-1} + Δ(t) - k), k is the drift sensitivity, S{t-1} is the CUSUM statistic of the last time t-1, the combined anomaly variable R(t) of the current time t = w1*Z(t) + w2*I[S_t ≥ h], I[·] represents the indicator function, w1 and w2 represent the preset weight coefficients of the Z-score and the CUSUM statistic respectively, and h is the preset threshold.

6. The user behavior anomaly detection method of claim 5, wherein, The TFT model has 4 layers, 8 attention heads, and a hidden dimension of 256; the TFT model deployed on the edge side has 2 layers, 4 attention heads, and a hidden dimension of 128, and the loss function is L_t = 0.5*[(y_t - μ_t)^2 / σ_t^2 + logσ_t^2].

7. The user behavior anomaly detection method of claim 1, wherein, The time granularity of the second level is 1 second, the time granularity of the session level is 30 seconds, and the time granularity of the cross-session level is 300 seconds.

8. The user behavior anomaly detection method of claim 1, wherein, The risk threshold τ1 and τ2 have a value range of: the minimum value of τ1 is 0.5, and the maximum value of τ2 is 5.

0.

9. A non-transitory computer-readable storage medium, comprising: The non-transitory computer-readable storage medium stores computer executable instructions, and the computer executable instructions are executed by the processor to realize the steps in the method of any one of claims 1 to 8.

10. A computer program product comprising computer executable instructions, characterised in that, The computer executable instructions are executed by the processor to realize the steps in the method of any one of claims 1 to 8.

Images