Supply chain data forgery monitoring method based on generative adversarial network

Abstract

The invention discloses a supply chain data counterfeiting monitoring method based on a generative adversarial network, belongs to the field of data processing, and aims to solve the problems of poor accuracy and weak adaptability of supply chain data counterfeiting monitoring in the prior art. The method comprises the following steps: extracting features from multi-source heterogeneous data to construct a real sample set, constructing a generative adversarial network comprising a generator and two discriminators, respectively analyzing data local statistical characteristics and global logic consistency, and outputting an abnormal score through adaptive weighting. And judging the authenticity of the data according to the score, and realizing monitoring and optimizing the model by utilizing forged data increment. According to the method, the forgery behavior in the complex supply chain data can be effectively identified.

Description

Technical Field

[0001] This invention belongs to the field of data processing, and specifically relates to a method for monitoring supply chain data forgery based on generative adversarial networks. Background Technology

[0002] As global supply chain networks become increasingly complex and digitalized, the authenticity and reliability of supply chain data have become core elements in ensuring the safe, stable, and efficient operation of supply chains. However, driven by enormous economic interests, supply chain data falsification is rampant, including forging orders, creating false logistics information, and altering inventory records and financial data. This falsified data not only interferes with normal business decisions, leading to significant economic losses, but can also infiltrate the entire supply chain network, triggering systemic risks and jeopardizing supply chain security.

[0003] Currently, monitoring methods for supply chain data forgery mainly fall into two categories: traditional rule-based methods and traditional machine learning-based methods. Rule-based methods rely on predefined business logic and threshold rules (e.g., setting a reasonable range for inventory turnover) to identify anomalies. While intuitive and highly interpretable, these methods often have static and rigid rules that are difficult to adapt to complex and ever-changing business scenarios and evolving forgery techniques. They are prone to generating a large number of false positives and false negatives, and the rules are costly to maintain.

[0004] Traditional machine learning methods (such as those using isolated forests, support vector machines, or logistic regression) identify outliers by learning patterns from historical normal data. Compared to rule-based methods, they possess a degree of adaptability. However, these methods heavily rely on high-quality, large-scale normal samples for training and are highly sensitive to noise in the data. More importantly, they are essentially "one-sided" anomaly detection, lacking deep insight into the behavior of "forgers" and unable to simulate and perceive constantly evolving, complex, and novel data forgery patterns. Therefore, their monitoring performance significantly degrades when facing targeted, highly realistic forgery attacks.

[0005] In recent years, Generative Adversarial Networks (GANs), as a powerful deep learning model, have achieved great success in fields such as image generation and data augmentation. Through an adversarial game between a generator and a discriminator, they can deeply learn the inherent distribution and characteristics of real data. Theoretically, this mechanism is very suitable for monitoring forged data that attempts to mimic real data. However, directly applying the original GAN ​​model to supply chain data forgery monitoring faces several challenges: First, supply chain data is multimodal, temporal, high-dimensional, and contains complex business logic, making it difficult for original GANs to effectively capture its micro-statistical anomalies and macro-logical contradictions; second, monitoring thresholds are usually fixed values ​​or simply dynamically adjusted, failing to accurately adapt to the dynamic changes in data distribution across different business dimensions and time periods, resulting in insufficient judgment accuracy; finally, the model lacks continuous learning capabilities, cannot evolve using newly discovered forgery samples, and struggles to cope with the rapid evolution of forgery methods.

[0006] Therefore, there is an urgent need in the existing technology for an intelligent data forgery detection method that can deeply integrate with the characteristics of supply chain business, dynamically adapt and adjust, and has continuous learning capabilities. Summary of the Invention

[0007] To address the aforementioned problems in existing technologies, namely, the poor accuracy and weak adaptability of supply chain data forgery detection, this invention provides a supply chain data forgery detection method based on generative adversarial networks. This method includes:

[0008] Raw data is obtained from multiple heterogeneous data sources of the supply chain management platform, and multimodal data fusion and cleaning are performed to extract feature vectors with time-series correlation and business logic in order to construct a set of real data samples.

[0009] A generative adversarial network (GAN) model is constructed, comprising a generator network and two discriminator networks. The generator network receives a random noise vector and the distribution conditions of real data samples as input, and generates simulated data through a deep convolutional neural network and a long short-term memory network. The first discriminator network analyzes the local statistical characteristics of the data points. The second discriminator network analyzes the global consistency and causal relationship of the data sequence. The outputs of the two discriminator networks are fused through an adaptive weighting module.

[0010] The supply chain data stream to be monitored is input into the trained generative adversarial network model. The first discriminator network extracts micro-anomaly features, and the second discriminator network analyzes the macro-logical rationality. The adaptive weighting module outputs a comprehensive anomaly score.

[0011] Based on the comparison result between the comprehensive anomaly score and the monitoring threshold, it is determined whether the data is forged, and a monitoring report is generated; the data samples confirmed to be forged are added to the training sample library, and incremental learning is performed on the generator network and the discriminator network.

[0012] Furthermore, the original data undergoes multimodal data fusion and cleaning to extract feature vectors with temporal correlation and business logic, thereby constructing a set of real data samples. The method is as follows:

[0013] The format unification and standardization processing is performed on structured data from relational databases, time-series data streams from IoT sensors, and unstructured data from text records. The standardization processing includes data type conversion, unit normalization, and timestamp alignment.

[0014] Business characteristics are extracted from the standardized data, including order cycle characteristics, logistics route characteristics, inventory dynamic characteristics, supplier stability characteristics, and price fluctuation characteristics.

[0015] The extracted business features are aligned and concatenated according to a preset time window, and a composite feature vector with continuous temporal correlation is generated by a sliding window algorithm. This vector is added to the sample library, and the real data sample set is constructed by vector normalization.

[0016] Furthermore, the generator network employs a conditional deep convolutional generation architecture, specifically including:

[0017] The generator network includes a conditional information embedding layer, which maps the distribution conditions of real data samples into conditional vectors through a fully connected layer.

[0018] The generator body adopts an encoder-decoder framework with a dilated convolutional structure, where the encoder uses a one-dimensional convolutional neural network with a gated mechanism to extract multi-scale features, and the decoder uses a hybrid structure of transposed convolution and long short-term memory network to reconstruct the data sequence.

[0019] A skip connection with attention weights is set between the encoder and decoder to maintain high-dimensional feature consistency between input conditions and output data;

[0020] The generator network also includes an output calibration module, which uses a conditional batch normalization layer and an adaptive activation function to perform distribution calibration on the generated data, ensuring that the output data is statistically comparable to the real data samples.

[0021] Furthermore, the two discriminator networks adopt a heterogeneous dual-channel architecture:

[0022] The first discriminator network adopts a multi-scale convolutional neural network structure, which includes dilated convolution branches and regular convolution branches that work in parallel. The dilated convolution branches capture long-range dependency features, and the regular convolution branches extract local statistical features.

[0023] The second discriminator network adopts a spatiotemporal correlation network structure, which includes a temporal causal convolution module and a relational reasoning module. The temporal causal convolution module analyzes the global consistency of the data sequence, and the relational reasoning module constructs a causal correlation model between features based on a graph neural network.

[0024] Each discriminator network has a feature distillation layer at the end, which adaptively recalibrates the weights of the feature channels by compressing the excitation network;

[0025] The two discriminator networks share the underlying feature extraction layer but have independent high-level decision layers, forming a feature learning mechanism that is both collaborative and competitive.

[0026] Furthermore, the adaptive weighting module employs a meta-learning optimization architecture:

[0027] The adaptive weighting module includes a weight generation network and a confidence evaluation submodule. The weight generation network uses a two-layer long short-term memory network to learn the temporal correlation of the outputs of each discriminator.

[0028] The confidence assessment submodule dynamically assesses the real-time monitoring reliability of each discriminator by calculating the entropy change and gradient stability of the output probability of each discriminator.

[0029] The weighted fusion process employs a soft weighting strategy based on temperature parameters, which dynamically adjusts the sharpness of weight allocation according to the discriminator confidence level.

[0030] The training of the generative adversarial network model adopts a progressive course learning strategy, which dynamically adjusts the noise injection intensity and generation difficulty to enable the model to gradually learn from simple samples to complex samples.

[0031] A memory replay mechanism is introduced during training to periodically replay historical difficult samples to prevent the model from forgetting previously learned fake pattern features.

[0032] Furthermore, in the result determination and feedback step, the method for determining whether the data is forged based on the comparison between the comprehensive anomaly score and the monitoring threshold, and generating a monitoring report, is as follows:

[0033] The comprehensive anomaly score output by the adaptive weighting module is compared in real time with the current monitoring threshold calculated by the dynamic threshold adjustment module.

[0034] When the comprehensive anomaly score is greater than the current monitoring threshold, a forged data determination signal is generated;

[0035] Based on the judgment signal, the report generation module is invoked to integrate the original information of the data to be monitored, the comprehensive anomaly score, the micro-anomaly characteristics output by the first discriminator network, and the macro-logical rationality analysis results output by the second discriminator network.

[0036] Generate a structured monitoring report, which includes at least a unique data identifier, a timestamp, a forgery determination result, an anomaly score, details of anomaly characteristics, and a risk level label.

[0037] Furthermore, the current monitoring threshold is calculated as follows:

[0038] Establish a multi-dimensional threshold matrix based on the characteristics of supply chain business. The multi-dimensional threshold matrix includes sub-thresholds for order dimension, logistics dimension, inventory dimension and financial dimension. The weight of each dimension is dynamically allocated according to the importance of business through the entropy weight method.

[0039] Using time series decomposition technology, historical anomaly scores are decomposed into trend components, periodic components, and residual components. ARIMA prediction models are established for each component to calculate the threshold baseline.

[0040] A hybrid anomaly detection model based on isolated forest and local outlier detection is constructed to automatically identify abnormal extreme points in historical scores and eliminate their interference with threshold calculation.

[0041] Design a threshold learning mechanism based on a sliding window, where the window size is adaptively adjusted according to the frequency of data fluctuations through fast Fourier transform analysis;

[0042] Introduce business rule constraints and encode supply chain domain knowledge as threshold boundary constraints;

[0043] The current monitoring threshold is obtained by weighted fusion of sub-thresholds of each dimension and the baseline thresholds of each time series component, and by applying business rule constraints.

[0044] Furthermore, the following threshold optimization steps are also included:

[0045] Implement a threshold smoothing transition mechanism and use an exponentially weighted moving average algorithm to smooth the monitoring threshold over time.

[0046] Establish a threshold verification mechanism and calculate the false alarm rate and false negative rate of the threshold through backtesting.

[0047] When performance indicators fail to meet the standards, the weights of each dimension and the window size parameters are automatically adjusted, and the monitoring thresholds are recalculated.

[0048] The threshold that has been smoothed and validated is used as the current monitoring threshold in the final output.

[0049] Furthermore, business rule constraints are introduced, encoding supply chain domain knowledge into threshold boundary constraints. By weighted fusion of sub-thresholds across dimensions and baseline thresholds for each time series component, and applying business rule constraints, the current monitoring threshold is obtained. The method is as follows:

[0050] Construct a supply chain business rules knowledge base, which includes quantitative expressions for order rationality rules, logistics timeliness rules, inventory turnover rate rules, and financial compliance rules;

[0051] The quantization expression is converted into mathematical constraints, which include inequality constraints and boundary constraints.

[0052] Establish a threshold optimization model based on constraint satisfaction problem, and use the initial monitoring threshold obtained by weighted fusion as the input variable;

[0053] The initial monitoring threshold is corrected using a constraint propagation algorithm to ensure that it meets all business rule constraints;

[0054] The design incorporates an iterative adjustment mechanism that projects an initial monitoring threshold to the nearest feasible solution space when the threshold violates business rules.

[0055] The thresholds of each dimension and the baseline thresholds of each time series component are fused by weighted summation, and the fusion result is input into the threshold optimization model.

[0056] Finally, the threshold optimization model outputs the current monitoring threshold that satisfies all business rule constraints.

[0057] Furthermore, the method for adding the confirmed forged data samples to the training sample library and incrementally learning the generator network and discriminator network is as follows:

[0058] The data samples identified as forged are standardized and anonymized, sensitive information is removed, and their data distribution is made consistent with the set of real data samples.

[0059] Add timestamps and anomaly type labels to the processed forged data samples and add them to a dedicated playback buffer;

[0060] Data is sampled from the playback buffer and the original training sample library at a preset period and combined to form an incremental training dataset;

[0061] The generative adversarial network model is fine-tuned using the incremental training dataset. During the training process, the lower-level feature extraction layers of the generator network and the discriminator network are frozen, and only the parameters of their higher-level decision layers are optimized.

[0062] After fine-tuning the training, the model performance is evaluated using a validation set. If the performance improves, the model parameters are updated; if the performance declines, the model is reverted to its pre-training state.

[0063] The beneficial effects of this invention are:

[0064] By constructing a generative adversarial network model with a dual discrimination mechanism, it is possible to perform in-depth analysis and cross-validation of data from both micro-statistical features and macro-business logic dimensions, effectively identifying highly realistic forged data and significantly reducing false positive and false negative rates.

[0065] Enhanced system adaptability: By adopting a dynamic threshold adjustment mechanism and incremental learning method, the monitoring system can adapt to the dynamic changes in the distribution of supply chain data and the continuous evolution of forgery patterns. This overcomes the shortcomings of poor adaptability of traditional static rules and fixed threshold models, and ensures the continuity and stability of monitoring effectiveness.

[0066] Achieving self-optimization and evolution: By feeding back data confirmed as forged into the training process and implementing incremental learning, the generator and discriminator continuously evolve in adversarial games, thereby enabling them to promptly detect and learn new forgery patterns. This forms a monitoring closed loop with continuous learning capabilities, significantly improving the system's intelligence level and long-term maintenance efficiency. Attached Figure Description

[0067] Other features, objects, and advantages of this application will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings:

[0068] Figure 1 This is a flowchart illustrating the supply chain data forgery monitoring method based on generative adversarial networks of the present invention.

[0069] Figure 2 This is a schematic diagram of the generative adversarial network structure in the supply chain data forgery monitoring method based on generative adversarial networks of the present invention. Detailed Implementation

[0070] The present application will now be described in further detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are for illustrative purposes only and are not intended to limit the invention. Furthermore, it should be noted that, for ease of description, only the parts relevant to the invention are shown in the accompanying drawings.

[0071] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. This application will now be described in detail with reference to the accompanying drawings and embodiments.

[0072] The first embodiment of the present invention provides a supply chain data forgery monitoring method based on generative adversarial networks, the method comprising:

[0073] Step S10: Obtain raw data from multiple heterogeneous data sources of the supply chain management platform, perform multimodal data fusion and cleaning, and extract feature vectors with temporal correlation and business logic to construct a real data sample set.

[0074] Step S20: Construct a generative adversarial network model, including a generator network and two discriminator networks; the generator network receives random noise vectors and the distribution conditions of real data samples as input, and generates simulated data through a deep convolutional neural network and a long short-term memory network; the first discriminator network analyzes the local statistical characteristics of the data points; the second discriminator network analyzes the global consistency and causal relationship of the data sequence; the outputs of the two discriminator networks are fused through an adaptive weighting module;

[0075] Step S30: Input the supply chain data stream to be monitored into the trained generative adversarial network model, extract micro-anomaly features through the first discriminator network, analyze macro-logical rationality through the second discriminator network, and output a comprehensive anomaly score by the adaptive weighting module;

[0076] Step S40: Determine whether the data is forged based on the comparison result of the comprehensive anomaly score and the monitoring threshold, and generate a monitoring report; add the data samples confirmed to be forged to the training sample library, and perform incremental learning on the generator network and the discriminator network.

[0077] To more clearly illustrate the supply chain data forgery monitoring method based on generative adversarial networks of the present invention, the following will be combined with... Figure 1 The steps in the embodiments of the present invention are described in detail below:

[0078] Step S10: Obtain raw data from multiple heterogeneous data sources of the supply chain management platform, perform multimodal data fusion and cleaning, and extract feature vectors with temporal correlation and business logic to construct a real data sample set.

[0079] In this embodiment, the original data undergoes multimodal data fusion and cleaning to extract feature vectors with temporal correlation and business logic, thereby constructing a set of real data samples. The method is as follows:

[0080] Step S11: Perform format unification and standardization processing on structured data from relational databases, time-series data streams from IoT sensors, and unstructured data from text records. The standardization processing includes data type conversion, unit normalization, and timestamp alignment.

[0081] Step S12: Extract business features from the standardized data. The business features include order cycle features, logistics route features, inventory dynamic features, supplier stability features, and price fluctuation features.

[0082] Step S13: The extracted business features are aligned and concatenated according to a preset time window, and a composite feature vector with continuous temporal correlation is generated by the sliding window algorithm. This vector is added to the sample library, and the real data sample set is constructed by vector normalization.

[0083] In the specific implementation process, constructing a real data sample set requires a rigorous multi-level data processing workflow. First, connection channels are established with various data sources on the supply chain management platform. For relational databases (such as MySQL and Oracle), persistent connections are established through a configured JDBC connection pool, with a connection timeout of 30 seconds and a maximum number of connections of 50. Structured data such as order tables, inventory tables, and supplier tables are periodically (every 5 minutes) retrieved. Apache NiFi is used to build a data pipeline to process incremental data, with a data buffer size of 1GB and a batch size of 10,000 records. IoT sensor data is subscribed to via the MQTT protocol for real-time data streaming, with a QoS level of 1. The Flink stream processing engine is used for window aggregation, with a rolling window size of 1 minute, and outlier filtering using the 3σ principle. Unstructured textual data is preprocessed using Elasticsearch's Ingest Pipeline, including word segmentation, stop word removal, and stemming. The BERT-base model is used to extract semantic features, generating a 768-dimensional feature vector.

[0084] The data standardization phase employs a tiered processing strategy. Numerical fields undergo Z-Score standardization, calculated using the following formula: ,in and Calculated and persistently stored based on the training set, such as the order amount field. =50000, =20000. Category fields use one-hot encoding, and an encoding mapping table is established and updated periodically. For example, the supplier field "a certain electronics technology company" is encoded as [1,0,0,0], and "a certain machinery manufacturing plant" is encoded as [0,1,0,0]. Timestamps are uniformly converted to ISO 8601 format and calibrated to the UTC+8 time zone, with time accuracy uniformly set to the millisecond level.

[0085] The feature extraction stage employs a multi-path parallel processing architecture. Order cycle features are obtained by calculating the time difference between adjacent orders. Specifically, the arrival time interval of the most recent 30 orders is calculated to obtain statistical measures such as mean, variance, and skewness. Simultaneously, a Fast Fourier Transform is used to extract the cycle pattern, with a frequency resolution of 0.001Hz, to identify the main cycle components and their amplitudes. For example, the amplitude of the 7-day cycle is detected as 0.85, and the amplitude of the 30-day cycle is detected as 0.72.

[0086] The actual path distance is calculated using the Haversine formula, which describes the logistics route characteristics. , , Where R is the Earth's radius of 6371km, the path deviation is calculated by combining real-time traffic data, and the formula is: Deviation = |Actual path length - Shortest path length| / Shortest path length.

[0087] The dynamic turnover rate is calculated based on inventory dynamic characteristics. The formula is: Turnover Rate = Quantity Outbound During Period / [(Beginning Inventory + Ending Inventory) / 2]. An exponentially weighted moving average method is used to smooth fluctuations, with a smoothing coefficient of... =0.3, the calculation formula is: ,in, x is the exponentially weighted moving average calculated at time point t. t This represents the raw data value observed at time point t. This represents the exponentially weighted moving average calculated at the previous time point t-1.

[0088] Calculation example:

[0089] Suppose we are smoothing the daily inventory turnover rate of "product A" and setting... =0.3.

[0090] Day 1: Turnover rate observed =1.5. We initialized it. = =1.5.

[0091] =0.3×1.5+(1-0.3)×1.5=1.5

[0092] Day 2: Turnover rate observed =2.0.

[0093] =0.3×2.0+0.7×1.5=0.6+1.05=1.65

[0094] Day 3: Turnover rate observed =1.2.

[0095] =0.3×1.2+0.7×1.65=0.36+1.155=1.515

[0096] Through this process, although the original turnover rate (1.2) fluctuated significantly on the third day, the smoothed value (1.515) remained relatively stable, reflecting the recent trend of the commodity turnover rate remaining around 1.5. This smoothed sequence [1.5, 1.65, 1.515, ...] will serve as a stable input for constructing the feature vector, greatly improving the model's ability to identify real anomalies rather than random fluctuations.

[0097] Supplier stability characteristics are calculated based on delivery records over the past 90 days, determining on-time delivery rate and quality pass rate. On-time delivery rate = number of on-time deliveries / total number of deliveries; quality pass rate = number of qualified products / total number of deliveries. A sliding window is used to calculate the mean and standard deviation. Price volatility characteristics are determined using the STL decomposition algorithm, which breaks down the price series into trend, seasonal, and residual components. The seasonal period is set to 30 days, and a Loess smoothing parameter of 0.75 is used. The volatility and autocorrelation of each component are calculated separately.

[0098] The time-series alignment stage employs a dynamic time warping algorithm to align time-series data from different sources with minute-level precision. The algorithm uses a symmetric 2-step step mode and Euclidean distance as the distance metric, finding the optimal alignment path through dynamic programming. Feature stitching utilizes a sliding window mechanism, dynamically adjusting the window size based on the business scenario: a 7-day window for order features, a 3-day window for logistics features, and a 30-day window for inventory features. Within each window, the system arranges features across various dimensions in chronological order. For each business dimension, it extracts the following features: mean, standard deviation, maximum value, minimum value, autocorrelation coefficient (lag by 1 period), trend slope, and a total of 56 feature indicators. This ultimately generates a 256-dimensional composite feature vector, specifically composed of: order dimension features (112 dimensions), logistics dimension features (56 dimensions), inventory dimension features (56 dimensions), supplier dimension features (16 dimensions), and price dimension features (16 dimensions).

[0099] The final generated composite feature vector undergoes min-max normalization to scale each feature dimension to the [0,1] interval. The processed feature vector is stored in Parquet columnar format, using the Snappy compression algorithm at level 6, and an indexing mechanism based on time partitioning is established, with partitioning granularity at the day level, supporting fast sample retrieval by time range. Each sample contains a 256-dimensional feature vector and records metadata information, including data source, processing timestamp, and feature version, forming a complete set of real data samples. The system also establishes a feature quality monitoring mechanism, periodically (daily) calculating the KL divergence of the feature distribution. When the KL divergence exceeds a threshold of 0.01, a feature recalculation process is triggered.

[0100] Step S20: Construct a generative adversarial network model, including a generator network and two discriminator networks; the generator network receives random noise vectors and the distribution conditions of real data samples as input, and generates simulated data through a deep convolutional neural network and a long short-term memory network; the first discriminator network analyzes the local statistical characteristics of the data points; the second discriminator network analyzes the global consistency and causal relationship of the data sequence; the outputs of the two discriminator networks are fused through an adaptive weighting module;

[0101] In this embodiment, the generator network adopts a conditional deep convolutional generation architecture, specifically including:

[0102] The generator network includes a conditional information embedding layer, which maps the distribution conditions of real data samples into conditional vectors through a fully connected layer.

[0103] The generator body adopts an encoder-decoder framework with a dilated convolutional structure, where the encoder uses a one-dimensional convolutional neural network with a gated mechanism to extract multi-scale features, and the decoder uses a hybrid structure of transposed convolution and long short-term memory network to reconstruct the data sequence.

[0104] A skip connection with attention weights is set between the encoder and decoder to maintain high-dimensional feature consistency between input conditions and output data; specifically, the attention weights of the skip connection are calculated through a learnable linear transformation: let the output of the encoder's l-th layer be... The input of the decoder's layer l is The output of the jump connection is: ,in and

[0105] For learnable parameters, [;] indicates a concatenation operation. The attention weight vector is the final output of the skip connection.

[0106] ,in This indicates element-wise multiplication. This mechanism ensures that when reconstructing data, the model can dynamically focus on the features in the encoder that are most relevant to the current decoding state, thereby maintaining the consistency of high-dimensional features.

[0107] Example: Suppose the output of a certain layer of the encoder is a 128-dimensional feature vector, and the input of the corresponding layer of the decoder is 128-dimensional. A 128-dimensional weight vector is calculated through the attention mechanism described above. The higher the value of the dimension in the weight vector, the more important the corresponding encoder feature is in the current decoding step, and thus it is given higher weight in the skip connection.

[0108] A skip connection with attention weights is set between the encoder and decoder to maintain high-dimensional feature consistency between input conditions and output data;

[0109] In practical implementation, attention-weighted skip connections are set up between the encoder and decoder. The core purpose is to maintain the consistency of high-dimensional features between the input conditions and the output data. This technical feature solves a key challenge faced by generative adversarial networks in the process of supply chain data generation: how to ensure that the generated simulated data is not only similar to the real data in statistical distribution, but more importantly, maintains its inherent business logic and semantic connections.

[0110] High-dimensional feature consistency is specifically reflected in the generator network's ability to accurately capture and reproduce complex business logic relationships within the input data. In supply chain data scenarios, this consistency means that when the encoder extracts a feature of insufficient capacity from a supplier, the decoder, when generating order data for the corresponding time period, should reflect a corresponding pattern of reasonable reduction in order quantity; when the encoder identifies a feature of logistics delays, the inventory data generated by the decoder should reflect the corresponding replenishment delay features. This cross-dimensional, cross-time-period business logic association is achieved through attention-weighted skip connections.

[0111] In practical implementation, the calculation process of attention weights allows the decoder to dynamically focus on the most relevant parts of the encoder's features at each layer when generating each data point. For example, when the decoder needs to generate inventory level data at a certain point in time, the attention mechanism automatically calculates the correlation between that generation time and the features of the encoder at each point in time, and assigns higher weights to those features with causal relationships. If the encoder extracts features of a sales surge at an earlier point in time, then when generating inventory data for subsequent points in time, these features of the sales surge will influence the generation of inventory data through higher attention weights, thereby ensuring that the output conforms to the basic business logic of "increased sales leading to decreased inventory".

[0112] The calculation of these attention weights is achieved through a learnable parameter matrix, and the system automatically learns the correlation strength between different feature dimensions during training. Initially, these weight parameters are randomly initialized, and as training progresses, they are continuously adjusted through a backpropagation algorithm, allowing the generator to gradually grasp the complex causal relationships within the supply chain data. For example, the system learns the correlation strength between the supplier's on-time delivery rate feature and the subsequent order fulfillment rate feature, thus maintaining consistency in this business logic when generating data.

[0113] To verify the effectiveness of high-dimensional feature consistency, a dedicated evaluation mechanism was implemented. The system quantifies the degree of feature consistency by calculating the mutual information between generated and real data across different business dimensions. For example, during the testing phase, the system specifically checks the statistical correlation between generated order data and inventory data to ensure consistency with the correlation patterns observed in the real data. If the consistency index for a certain business dimension falls below a preset threshold, the system automatically adjusts the parameters of the attention layer and retrains until the consistency indexes for all dimensions meet the required standards.

[0114] Through this attention-weighted skip connection mechanism, generative adversarial networks can ensure that the output simulated data not only resembles real data in appearance, but more importantly, maintains the complex business logic relationships inherent in the supply chain data. This provides high-quality negative samples for subsequent detection of falsified data, significantly improving the accuracy and reliability of the entire monitoring system.

[0115] In one example, specifically:

[0116] The achievement of high-dimensional feature consistency can be clearly illustrated through the following specific example. Suppose that the supply chain data of an electronics manufacturer, "GlobalTech," contains information in three dimensions: orders, inventory, and logistics. A certain time series segment records a real supply chain event: due to a sudden drop in the production capacity of the key component supplier, "ChipMaster," subsequent order deliveries were delayed, which in turn caused abnormal fluctuations in inventory levels.

[0117] When the encoder processes this input data, its convolutional networks at different levels extract multi-scale features. The bottom layer network captures the local statistical feature of "an abnormal peak in order quantity on May 10th"; the middle layer network identifies the business rule feature of "the delivery cycle of supplier ChipMaster has been extended from 7 days to 14 days"; and the top layer network understands the global causal relationship of "component shortages leading to limited finished product production and a decrease in inventory turnover". These features, distributed at different depths and time steps of the network, together constitute a high-dimensional representation of the input data.

[0118] When the generator decoder begins reconstructing the data, attention-weighted skip connections come into play. When the decoder generates inventory data for May 15th, its attention mechanism automatically calculates the association weights with features at each layer of the encoder. The results show that the decoder assigns a high weight of 0.85 to the "component shortage" feature in the high-level encoder features, a weight of 0.72 to the "extended delivery cycle" feature in the mid-level features, and only a weight of 0.23 to the bottom-level peak order feature. This weighting allows the decoder to accurately reproduce a reasonable pattern of continuously declining inventory levels when generating inventory data, rather than simply replicating the specific value at a particular point in time.

[0119] Conversely, without this attention mechanism, the decoder might generate data based solely on local features. For example, it might focus only on the peak order data from May 10th, generating mismatched inventory data and causing business logic inconsistencies. In actual testing, the correlation coefficient between the inventory data and order data generated by the model without the attention mechanism was only 0.31, while the model with the attention mechanism reached 0.89, highly close to the 0.92 observed in real data.

[0120] Another specific case involves logistics route features. The encoder extracts the feature "real-time weather conditions deteriorating for a certain transportation route" from the raw data. This feature influences the decoder's decision-making process for generating logistics delay data through attention weight jump connections. When the decoder generates the logistics status at subsequent time points, the attention weight for the weather-related features in the encoder reaches 0.91. This ensures that the generated logistics data reasonably reflects the extended transportation time due to weather influences, rather than random time fluctuations.

[0121] The generator network also includes an output calibration module, which uses a conditional batch normalization layer and an adaptive activation function to perform distribution calibration on the generated data, ensuring that the output data is statistically comparable to the real data samples.

[0122] Specifically, the calculation process of the conditional batch normalization layer is as follows: given the input feature x and the conditional vector c, c is first mapped to a scaling parameter through a fully connected layer. and offset parameters Then normalize x: ,in and The mean and standard deviation of the current batch are given, and the final output is: The adaptive activation function uses a learnable PReLU function: , where 'a' is a learnable parameter with an initial value of 0.25. Through these two steps, the mean and variance of the generated data are calibrated to match the distribution of the true samples.

[0123] Example: The generator outputs a batch of data with a mean of 0.1 and a standard deviation of 0.5, while the real sample has a mean of 0 and a standard deviation of 1. The conditional batch normalization layer adjusts the generated data to a distribution with a mean close to 0 and a standard deviation close to 1 using learned γ and β, and then performs non-linear calibration using the PReLU function to make it statistically comparable to the real sample.

[0124] The two discriminator networks adopt a heterogeneous dual-channel architecture:

[0125] The first discriminator network adopts a multi-scale convolutional neural network structure, which includes dilated convolution branches and regular convolution branches that work in parallel. The dilated convolution branches capture long-range dependency features, and the regular convolution branches extract local statistical features.

[0126] Specifically, the dilated convolution branch uses one-dimensional convolutions with dilation rates of 1, 2, and 4, all with a kernel size of 3 and channel numbers of 32, 64, and 128, respectively, to capture dependencies between data points that are far apart in the sequence (i.e., long-range dependencies, such as periodic patterns or trend changes). The regular convolution branch uses one-dimensional convolutions with kernel sizes of 3, 5, and 7, and channel numbers of 32, 64, and 128, respectively, to extract statistical features (such as mean, variance, and extreme values) within a local window. The outputs of the two branches are concatenated along the channel dimension and then fed into subsequent layers.

[0127] Example: For a time series data of length 100, dilated convolution (dilation rate = 4) can see information from every 4 points in the input sequence at each output position, thus capturing a pattern with a period of 4; while regular convolution (kernel size = 7) focuses on the local statistical characteristics of 7 consecutive data points.

[0128] The second discriminator network adopts a spatiotemporal correlation network structure, which includes a temporal causal convolution module and a relational reasoning module. The temporal causal convolution module analyzes the global consistency of the data sequence, and the relational reasoning module constructs a causal correlation model between features based on a graph neural network.

[0129] Specifically, the relational reasoning module is built based on a Graph Attention Network (GAT), where the nodes of the graph consist of feature vectors from different business dimensions (e.g., node 1: order quantity, node 2: logistics timeliness, node 3: inventory level), and edges represent causal relationships in business logic (e.g., an increase in order quantity should lead to a decrease in inventory level). The graph attention mechanism calculates the attention coefficient between nodes i and j. Where a and W are learnable parameters, and The node features are represented by ||, which indicates concatenation. Then, softmax normalization is used to obtain the attention weights. The update feature of node i is This module iteratively updates node features through a multi-layer graph attention network, ultimately outputting a score representing global logical consistency.

[0130] Example: Suppose that the number of orders in a certain order data is abnormally high, but the inventory level has not decreased accordingly. The graph attention network will calculate the attention weight between the order node and the inventory node, find that the causal relationship between the two is violated, and thus output a higher anomaly score.

[0131] Each discriminator network has a feature distillation layer at the end, which adaptively recalibrates the weights of the feature channels by compressing the excitation network;

[0132] The two discriminator networks share the underlying feature extraction layer but have independent high-level decision layers, forming a feature learning mechanism that is both collaborative and competitive.

[0133] The adaptive weighting module employs a meta-learning optimization architecture:

[0134] The adaptive weighting module includes a weight generation network and a confidence evaluation submodule. The weight generation network uses a two-layer long short-term memory network to learn the temporal correlation of the outputs of each discriminator.

[0135] The confidence assessment submodule dynamically assesses the real-time monitoring reliability of each discriminator by calculating the entropy change and gradient stability of the output probability of each discriminator.

[0136] The weighted fusion process employs a soft weighting strategy based on temperature parameters, which dynamically adjusts the sharpness of weight allocation according to the discriminator confidence level.

[0137] The training of the generative adversarial network model adopts a progressive course learning strategy, which dynamically adjusts the noise injection intensity and generation difficulty to enable the model to gradually learn from simple samples to complex samples.

[0138] Specifically, the simple samples refer to historical data with relatively small fluctuations, such as data segments where the coefficient of variation (standard deviation / mean) of the order quantity for a certain product is below 0.1 in the past 30 days, and no known outliers are found. These types of samples are used initially, and Gaussian noise with a standard deviation of 0.3 is injected. As training progresses, samples with larger fluctuations (e.g., coefficients of variation between 0.1 and 0.5) are gradually introduced, and the noise standard deviation is reduced to 0.1.

[0139] Example: In the early stage of training, the model is trained using data from a supplier with a stable number of orders over the past 30 days (coefficient of variation = 0.05); in the middle stage of training, data with large fluctuations in the number of orders is introduced (coefficient of variation = 0.3); in the later stage of training, complex samples containing known forgery patterns (such as sudden large orders) are used.

[0140] A memory replay mechanism is introduced during training to periodically replay historical difficult samples to prevent the model from forgetting previously learned fake pattern features.

[0141] like Figure 2 As shown above, the connection relationships of the generative adversarial network model in this embodiment are as follows:

[0142] The input of the random noise vector and the input of the real data sample distribution conditions are both connected to the input of the conditional information embedding layer;

[0143] The output of the conditional information embedding layer is connected to the input of the encoder part in the generator main network;

[0144] The output of the encoder section is connected to the input of the decoder section via a skip connection with attention weights.

[0145] The output of the decoder section is connected to the input of the output calibration module;

[0146] The output of the output calibration module serves as the simulation data generated by the generator.

[0147] The simulated data generated by the generator and the real data samples are connected together to the input of the underlying feature extraction layer shared by the two discriminator networks;

[0148] The output of the shared bottom feature extraction layer is connected to the input of the multi-scale convolution branch of the first discriminator network and the input of the spatiotemporal correlation branch of the second discriminator network, respectively.

[0149] The output of the multi-scale convolutional branch of the first discriminator network is connected to the input of its feature distillation layer;

[0150] The output of the spatiotemporal correlation branch of the second discriminator network is connected to the input of its feature distillation layer;

[0151] The outputs of the feature distillation layer of the first discriminator network and the feature distillation layer of the second discriminator network are both connected to the input of the adaptive weighting module;

[0152] The output of the adaptive weighting module is a comprehensive anomaly score.

[0153] In its implementation, the Generative Adversarial Network (GAN) model is constructed using a modular design principle. The conditional information embedding layer of the generator network first maps the distribution conditions of real data samples into conditional vectors using three fully connected layers with dimensions of 256, 128, and 64. These conditional vectors are then concatenated with a 100-dimensional random noise vector and used as the generator's input. The generator itself employs an encoder-decoder architecture. The encoder uses a four-layer one-dimensional convolutional neural network with gating mechanisms, with kernel sizes of 7, 5, 3, and 3, and channel numbers of 64, 128, 256, and 512 respectively. Each layer is followed by dilated convolutions to expand the receptive field, with dilation rates increasing from 1 in powers of 2. The decoder uses a hybrid structure of three layers of transposed convolutions with kernel sizes of 3, 5, and 7, and channel numbers of 256, 128, and 64 respectively, combined with a bidirectional LSTM with 128 hidden units. Skip connections transmit multi-scale features from each layer of the encoder to the corresponding layers of the decoder. The attention weight matrices at the skip connections are generated using a learnable parameterization method. The output calibration module employs a conditional batch normalization layer, whose parameters are dynamically generated from conditional vectors. It also uses a learnable PReLU activation function to finely calibrate the distribution of the generated data, ensuring that the output data is consistent with the real sample in terms of statistical properties such as mean and variance.

[0154] The discriminator network employs a heterogeneous dual-channel design. The first discriminator network includes dilated convolutional branches with dilation rates of 1, 3, and 5 operating in parallel, and regular convolutional branches with kernel sizes of 3, 5, and 7. The output feature maps of the two branches are concatenated and fed into a feature distillation layer, which uses a compressed activation network (compression ratio of 16) to adaptively recalibrate the weights of the feature channels. The second discriminator network uses a temporal causal convolutional module (kernel size 7, with exponentially increasing dilation rate) to capture long-term dependencies in sequences. The relational reasoning module constructs a causal association model between features based on a graph attention network (8 heads), where the nodes of the graph are composed of feature vectors, and the edge weights are calculated through a learnable attention mechanism. The two discriminators share the first three basic feature extraction layers (both with kernel size 3 and channel numbers of 32, 64, and 128 respectively), but each has an independent high-level decision layer (fully connected layer dimensions of 256-128-1 and 256-128-1 respectively), forming a cooperative competitive mechanism.

[0155] In the specific implementation process, the adaptive weighting module adopts a meta-learning optimization architecture. Its weight generation network uses a two-layer long short-term memory network with 64 hidden units each to learn the temporal correlation of the outputs of each discriminator. The confidence evaluation submodule dynamically evaluates the real-time monitoring reliability of each discriminator by calculating the entropy change and gradient stability of the output probability of each discriminator. The entropy change is calculated by using a sliding window with a window size of 50 to calculate the difference of information entropy. The gradient stability is evaluated by statistically analyzing the variance of the gradient magnitude in the most recent 100 iterations, with a variance threshold set at 0.01.

[0156] The weighted fusion process employs a soft weighting strategy based on a temperature parameter. The initial value of the temperature parameter is set to 1.0. This parameter is learned during training and dynamically adjusted based on the discriminator's confidence level, with the adjustment increment controlled to no more than 10% of the original value per update, thus controlling the sharpness of the weight distribution. Model training uses a progressive learning strategy. In the initial stage, stable historical data with a coefficient of variation not exceeding 0.1 are used as simple samples, and Gaussian noise with a standard deviation of 0.3 is injected. As training progresses, when 40% of the total training cycles have been completed, data with a coefficient of variation exceeding 0.5 or containing known anomalous patterns are gradually introduced as complex samples, while the noise intensity is linearly reduced to a standard deviation of 0.1.

[0157] A memory replay mechanism is introduced during training. Every 1000 batches, 20% of the samples are randomly selected from the historical hard sample pool for replay. The hard sample pool has a capacity of 5000 samples, and the sample replacement strategy uses the Least Recently Used (LRU) algorithm. The entire training process uses the Adam optimizer, with the generator learning rate set to 0.0001 and the discriminator learning rate set to 0.0004. A gradient penalty mechanism with a coefficient of 10 is used to enhance training stability. The training batch size is fixed at 64, and the total number of training epochs is 1000. Model validation is performed every 50 epochs. Training is terminated early if the validation set loss does not decrease for 10 consecutive epochs.

[0158] Step S30: Input the supply chain data stream to be monitored into the trained generative adversarial network model, extract micro-anomaly features through the first discriminator network, analyze macro-logical rationality through the second discriminator network, and output a comprehensive anomaly score by the adaptive weighting module;

[0159] In the specific implementation process, when inputting the real-time data stream of the supply chain to be monitored into the trained generative adversarial network model for anomaly monitoring, a data receiving and preprocessing pipeline must first be established. This pipeline receives data streams from various business systems in the supply chain in real time through a high-throughput message queue (such as Kafka), and performs standardization and feature engineering processing on the incoming raw data in the same way as in the training phase, including numerical normalization, timestamp alignment, and business feature extraction, to ensure that the input data and the model training data have the same distribution and dimensionality.

[0160] The preprocessed data fragments are fed in batches into the shared low-level feature extraction layer of the generative adversarial network model. This layer, composed of multiple one-dimensional convolutional modules, is responsible for extracting basic feature representations from the input data. These basic features are then simultaneously fed into two heterogeneous discriminator networks for deep analysis.

[0161] The first discriminator network focuses on detecting microscopic anomalies. Its internal multi-scale convolutional structure processes input features in parallel: dilated convolution branches use increasing dilation rates to capture long-range dependencies and periodic patterns between data points; regular convolution branches focus on extracting local statistical properties, identifying statistical anomalies in data points within short time windows. The output feature maps from the two branches are concatenated and then adaptively recalibrated through a feature distillation layer composed of a compressed excitation network to enhance the representation of important features, ultimately outputting a score indicating the degree of microscopic anomalies in the data.

[0162] In its implementation, the second discriminator network adopts a spatiotemporal correlation network structure. Its temporal causal convolutional module is constructed using 8 layers of dilated convolutions, with dilation rates increasing in powers of 2: 1, 2, 4, 8, 16, 32, 64, and 128, respectively. The kernel size is uniformly set to 3. This design allows the module's receptive field to cover a sequence range of up to 256 time steps, ensuring the capture of long-term dependencies in the supply chain data. When analyzing the global consistency of the data sequence, the module detects basic temporal logic such as order creation time must be earlier than shipment time and receipt time must be later than shipment time. It also verifies complex business patterns such as order volume growth during promotional activities should be accompanied by a decrease in inventory levels.

[0163] The relational reasoning module is built on graph attention network technology. The nodes of the graph consist of 12 core business features, including order quantity, logistics timeliness, inventory level, supplier rating, and price fluctuation. Edge weights are calculated using a multi-head attention mechanism with 8 attention heads. This module explicitly encodes over 20 causal constraint rules in the supply chain domain, such as a sudden increase in order quantity should lead to a decrease in inventory level, a decrease in supplier rating should be accompanied by a decrease in order quantity, and logistics delays should cause a decrease in inventory turnover. Each rule is transformed into constraints between features through a learnable parameter matrix. When input data violates these constraints, the module outputs corresponding anomalous signals.

[0164] The feature distillation layer employs a compressed excitation network structure with a compression ratio of 16. By adaptively recalibrating the weights of the feature channels, it compresses the 256-dimensional intermediate features into a high-quality 64-dimensional feature representation. This layer first compresses each feature channel into a single value through global average pooling, then uses two fully connected layers to learn the importance weights of each channel, and finally applies the weights to the original features through scaling.

[0165] In actual operation, when an abnormal data point is input containing a surge in order volume coupled with a simultaneous increase in inventory levels, the temporal causal convolution module identifies this pattern that violates conventional business logic. The relational reasoning module then strengthens the abnormal correlation between order nodes and inventory nodes through a graph attention mechanism, ultimately outputting a high anomaly score of 0.92. The latency of the entire processing is controlled within 50 milliseconds, supporting real-time monitoring requirements of processing 200 data points per second.

[0166] The output scores of the two discriminator networks are transmitted in real time to the adaptive weighting module. Within this module, the confidence assessment submodule continuously calculates the entropy change and gradient stability of each discriminator's output probability, dynamically evaluating the reliability of the decision at the current moment. The weight generation network, based on a two-layer long short-term memory network, learns the temporal correlation pattern of the two score sequences. Finally, a soft weighting strategy based on temperature parameters is used to dynamically fuse the two scores according to the real-time confidence assessment, generating a comprehensive anomaly score. This score is a continuous scalar value; its value directly reflects the comprehensive probability that the monitored data is judged as forged data, providing a quantitative basis for subsequent decision-making.

[0167] Hypothetical scenario: Monitoring order fulfillment data received by an electronics manufacturer, “Manufacturing Company”, from its supplier, “Supply Company”.

[0168] The specific implementation process of step S30 is as follows:

[0169] Data input and preprocessing:

[0170] A data stream to be monitored entered the system in real time. Its content is: "On October 26, 2023, at 14:30, the supplier 'a certain supply company' sent a batch of 'CPU-X100' chips, with a quantity of 10,000 pieces, and the logistics tracking number 'LOG-20231026-1430' to 'a certain manufacturing company'. It claims that it has been sent from 'Warehouse 1' and is expected to arrive at 'a certain manufacturing company's factory' at 18:00 on October 28."

[0171] The system immediately standardized the data: the timestamp was unified to UTC time, the quantity was normalized to the [0,1] interval (based on the historical maximum and minimum order quantity), the location name was converted to latitude and longitude coordinates, and all information was converted into the feature vector format required by the model.

[0172] Feature extraction and discriminator analysis:

[0173] The feature vector is simultaneously fed into the two discriminators of the trained generative adversarial network model.

[0174] Analysis of the first discriminator (micro discriminator):

[0175] The quantity characteristic of this order (10,000 pieces) is 0.95 after normalization, which is at an extremely high level in the historical distribution (99th percentile). However, for this type of chip, the largest single purchase quantity in history is only 8,000 pieces.

[0176] The order was placed at a time that is significantly different from the usual practice of "a certain supplier" during the ordering cycle (usually Monday morning).

[0177] These anomalies in local statistical features cause the first discriminator to output a high anomaly score, such as 0.88 (out of 1), indicating that the data point is extremely unlikely to be true at the micro-statistical level.

[0178] Analysis of the second discriminator (macro discriminator):

[0179] Temporal causal analysis: Examining the production plan sequence of "a certain manufacturing company", it was found that there is no large-scale production task schedule that requires 10,000 "CPU-X100" chips in the near future.

[0180] Relational Reasoning Analysis: Reasoning Based on Knowledge Graphs

[0181] Logistics route verification: It was found that "Warehouse 1" was not a regular warehouse for "a certain supplier" to store this model of chip, and its regular shipping location was "Warehouse 2".

[0182] Supplier behavior verification: According to the publicly available capacity report of "a certain supplier company", its total quarterly capacity can only support 50,000 chips of this model. This single order accounts for 20% of its quarterly capacity, which is extremely unreasonable.

[0183] Verification of related orders: On the same day, it was discovered that several other companies also received an unusually large number of similar chip orders from "a certain supplier," with the total number far exceeding its production capacity. These orders formed a cluster of related fraud on a macro level.

[0184] These global logical contradictions cause the second discriminator to also output a high anomaly score, such as 0.92.

[0185] Adaptive weighted and comprehensive score output:

[0186] The adaptive weighting module receives scores from the two discriminators (D1=0.88, D2=0.92).

[0187] The confidence assessment submodule then calculates that: the first discriminator, based on statistical features, has a stable output, low entropy, and high confidence; the second discriminator, due to complex graph calculations, has a slightly fluctuating output gradient in this calculation, and its confidence is relatively lower.

[0188] The weight generation network determines, based on historical learning patterns, to assign slightly higher weights (e.g., 0.55) to the micro discriminator output and slightly lower weights (e.g., 0.45) to the macro discriminator output.

[0189] Finally, the comprehensive anomaly score was calculated by weighting: 0.88×0.55+0.92×0.45≈0.898.

[0190] The system outputs a comprehensive anomaly score of 0.898 for this data and compares this score with the dynamic monitoring threshold (e.g., 0.85) in subsequent step S40.

[0191] Step S40: Determine whether the data is forged based on the comparison result of the comprehensive anomaly score and the monitoring threshold, and generate a monitoring report; add the data samples confirmed to be forged to the training sample library, and perform incremental learning on the generator network and the discriminator network.

[0192] In this embodiment, the method for determining whether data is forged based on the comparison between the comprehensive anomaly score and the monitoring threshold in the result determination and feedback step, and generating a monitoring report, is as follows:

[0193] Step S41: The comprehensive anomaly score output by the adaptive weighting module is compared in real time with the current monitoring threshold calculated by the dynamic threshold adjustment module.

[0194] Step S42: When the comprehensive anomaly score is greater than the current monitoring threshold, a forged data determination signal is generated;

[0195] Step S43: Based on the judgment signal, call the report generation module to integrate the original information of the data to be monitored, the comprehensive anomaly score, the micro-anomaly features output by the first discriminator network, and the macro-logical rationality analysis results output by the second discriminator network;

[0196] Step S44: Generate a structured monitoring report, which includes at least a unique data identifier, timestamp, forgery determination result, anomaly score, anomaly feature details, and risk level label.

[0197] The current monitoring threshold in step S41 is calculated as follows:

[0198] Step S411: Establish a multi-dimensional threshold matrix based on the characteristics of supply chain business. The multi-dimensional threshold matrix includes sub-thresholds for order dimension, logistics dimension, inventory dimension and financial dimension. The weight of each dimension is dynamically allocated according to the importance of business through the entropy weight method.

[0199] Step S412: Using time series decomposition technology, historical anomaly scores are decomposed into trend components, periodic components, and residual components. For each component, an ARIMA prediction model is established to calculate the threshold baseline.

[0200] Step S413: Construct a hybrid anomaly identification model based on isolated forest and local outlier detection to automatically identify abnormal extreme points in historical scores and eliminate their interference with threshold calculation.

[0201] Step S414: Design a threshold learning mechanism based on a sliding window, wherein the window size is adaptively adjusted according to the data fluctuation frequency through fast Fourier transform analysis;

[0202] Step S415: Introduce business rule constraints and encode supply chain domain knowledge into threshold boundary constraints;

[0203] Step S416: The current monitoring threshold is obtained by weighted fusion of the sub-thresholds of each dimension and the baseline thresholds of each time series component, and by applying business rule constraints.

[0204] In practice, the dynamic threshold adjustment module's calculation is a sophisticated process involving multiple stages and models. This module first establishes a multi-dimensional threshold matrix based on the characteristics of supply chain operations. This matrix includes sub-thresholds for four dimensions: orders, logistics, inventory, and finance. The weights of each dimension are dynamically allocated using the entropy weighting method: the system periodically (e.g., hourly) calculates the information entropy of each dimension's indicator data and dynamically determines its weight based on the entropy value; the smaller the entropy value (the lower the information uncertainty), the higher the dimension's weight.

[0205] During the time series processing phase, the system invokes time series decomposition techniques to process historical anomaly scores. Specifically, the STL decomposition algorithm is used to decompose the historical score series into trend components, seasonal components, and residual components. For the trend component, an ARIMA(p,d,q) model is established, where the parameters p, d, and q are automatically determined using the AIC criterion. Typically, p ranges from [0,5], d is 1 or 2, and q ranges from [0,5]. The model is trained using maximum likelihood estimation, and a rolling forecast method is used to generate predicted values ​​for the trend component over a future period.

[0206] For the seasonal component, a seasonal autoregressive model, SARIMA, was established, with its seasonal cycle parameters determined through spectral analysis. The residual component was modeled using a GARCH model to capture fluctuation clustering characteristics. The predicted values ​​of all components were summed to obtain a comprehensive threshold baseline prediction.

[0207] To eliminate interference from outliers, the system constructs a hybrid anomaly identification model: first, the isolated forest algorithm (with the contamination parameter set to 0.1) is used to perform preliminary anomaly detection on historical scores, and then the Local Outlier Detection (LOF) algorithm (with k=20) is used for fine filtering. The identified outliers will be replaced with values ​​obtained through linear interpolation.

[0208] The sliding window mechanism employs a dynamic adjustment strategy: it analyzes the dominant frequency components of the historical scoring sequence using Fast Fourier Transform, with the window size set to an integer multiple of the sequence's dominant period, a minimum of 24 data points, and a maximum of 720 data points. The window slides in one time unit increments.

[0209] The introduction of business rule constraints is achieved through constraint programming: supply chain domain knowledge is encoded into inequality constraints, such as "lower limit of inventory turnover threshold ≥ 0.5" and "upper limit of order fulfillment rate threshold ≤ 1.2". These constraints constitute a constraint satisfaction problem (CSP), and the constraint propagation algorithm ensures that the generated thresholds satisfy all business rules.

[0210] The final threshold generation employs a weighted fusion method: the weights of each dimension's sub-thresholds are determined by the entropy weighting method, and the baseline weights of each component's threshold are dynamically adjusted based on its recent prediction accuracy (higher accuracy results in greater weight). The fusion formula is:

[0211] Threshold = Σ(Dimension weight × Dimension sub-threshold) × (Component weight × Component baseline) ;

[0212] in and To adjust the coefficients, optimization is performed using a grid search within the interval [0,1] with a step size of 0.1. A typical value is... =0.6, =0.4, and satisfies The grid search process uses historical data for cross-validation, with the weighted sum of false positive and false negative rates as the objective function, and selects the (α,β) combination that minimizes the objective function.

[0213] Example: Suppose that grid search tested combinations such as (0.5,0.5), (0.6,0.4), and (0.7,0.3) on the validation set. Ultimately, (0.6,0.4) had a false positive rate of 4.2% and a false negative rate of 1.8% on the validation set, and the overall cost was the lowest, so it was selected as the final parameter.

[0214] Once a comprehensive anomaly score is generated, the system compares it in real-time with the current monitoring threshold with a millisecond delay. If the score exceeds the threshold, a judgment signal is immediately generated, triggering the report generation process. The report generation module uses a template-based approach, extracting raw data from the data cache and calling detailed anomaly feature data provided by two discriminators. Micro-anomaly features include quantitative indicators such as statistical deviation values ​​and distribution anomaly probabilities; macro-logical analysis results include details of business rule violations and correlation analysis conclusions.

[0215] The generated structured monitoring report uses JSON-LD format and includes the following required fields: dataUUID (unique data identifier, generated using version 4 UUID), timestamp (ISO8601 format timestamp), isForgery (Boolean judgment result), anomalyScore (floating-point score value, retained to 4 decimal places), featureDetails (nested JSON object, containing detailed micro and macro anomaly features), and riskLevel (enumerated risk level, divided into high, medium, and low levels). The report also includes a digital signature to ensure integrity and non-repudiation.

[0216] The entire judgment process has a time delay controlled within 100 milliseconds, supporting real-time monitoring needs that process thousands of data points per second. The system periodically performs backtesting tests on the threshold calculation effect to evaluate the false alarm rate and false negative rate. When performance indicators fail to meet the standards, the threshold recalculation process is automatically triggered.

[0217] For example, when the system receives an order data stream to be monitored, it performs the following steps:

[0218] Step S41: Real-time comparison

[0219] Calculate the current monitoring threshold (0.85): At this moment, the dynamic threshold adjustment module calculates the threshold through the following complex calculation:

[0220] Multi-dimensional sub-threshold calculation:

[0221] Order dimension sub-threshold (0.82): The entropy weight method calculates that the current order dimension has the highest weight (0.4). This sub-threshold is based on the historical rating of recent order data, and its calculation excludes outlier points identified by the isolated forest algorithm (setting 100 trees, pollution rate 0.1).

[0222] Logistics dimension sub-threshold (0.78): weight 0.3. During calculation, its historical data was decomposed by STL, and its seasonal component showed a clear pattern with a "week" cycle. The SARIMA model successfully captured this pattern and used it for prediction.

[0223] Inventory dimension sub-threshold (0.80): weight 0.2; Financial dimension sub-threshold (0.75): weight 0.1.

[0224] Time series threshold baseline calculation (0.83): The historical composite anomaly score series was decomposed using STL. The trend component was predicted using the ARIMA(1,1,1) model (parameters automatically optimized and selected by the AIC criterion), yielding a trend baseline of 0.81; the seasonal component baseline was 0.02; and the residual component's upper limit of volatility was estimated at 0.05 using the GARCH(1,1) model. These three factors were then combined to obtain the baseline.

[0225] Fusion and Constraint Application: The above sub-thresholds are weighted and fused (0.82×0.4+0.78×0.3+0.80×0.2+0.75×0.1)≈0.80, and then weighted and averaged with the time series baseline of 0.83 (α=0.6, β=0.4) to obtain an initial threshold of 0.812. Subsequently, business rule constraints take effect: one rule stipulates that "no threshold shall be lower than 0.85 to ensure risk control," therefore, the constraint propagation algorithm projects the initial threshold to the nearest feasible solution of 0.85, which is used as the final output current monitoring threshold.

[0226] Comparison: The comprehensive anomaly score output by the adaptive weighting module is 0.898. The system compares this score with the current monitoring threshold of 0.85 in real time. If 0.898 > 0.85, the condition is triggered.

[0227] Step S42: Generate a decision signal

[0228] If the comparison result is true, the system immediately generates a digital "forged data determination signal". This signal is a structured message containing an event ID, timestamp, and determination result, which is published to the internal message bus to trigger all subsequent related processes.

[0229] Step S43: Call the report generation module

[0230] The specific operation process of step S43 is as follows: After the report generation module is activated by the forged data judgment signal, it first extracts the complete original record of the order data to be monitored from the cache database, including the order number LOG-20231026-1430, the transaction time October 26, 2023 at 14:30, the supplier number SUP-2023001, the product code CPU-X100, the order quantity of 10,000 pieces, the order amount and other key business data.

[0231] Subsequently, the module reads the comprehensive anomaly score of 0.898 output by the adaptive weighting module. This score is accurate to three decimal places and uses a continuous scale from 0 to 1 to represent the degree of anomaly. Next, the module queries the first discriminator network for detailed analysis results of micro-anomaly features, obtaining quantitative indicators including order quantity Z-score of 3.2, order time anomaly score of 0.95, and amount deviation of 2.8.

[0232] At the same time, the module obtains the macro-logical rationality analysis results from the second discriminator network, including a list of specific business rules violated, an anomaly score of 0.92 in the causal graph, and analysis conclusions such as the high risk level of related orders.

[0233] In step S44, the report generation module integrates all the above information into a predefined structured template to generate a complete monitoring report. The report includes a unique identifier (aa6c5f6b-3a7d-48b7-b234-7c2d8c1a54f1) generated using UUID version 4 format, a timestamp accurate to milliseconds recorded in ISO 8601 format as 2023-10-26T14:30:05.123Z, and a unique data identifier composed of the order type and tracking number (order::log-20231026-1430). The original data snapshot fully preserves the original state of the data, and the judgment result is clearly marked as confirmed as forged CONFIRMED_FRAUD.

[0234] The anomaly feature details section systematically displays the analysis results of micro and macro features. Micro features include order quantity Z-score of 3.2, order time anomaly score of 0.95, and amount deviation of 2.8. Macro features include violation of business rules list, inventory turnover rate mismatch, supplier behavior anomaly, cause-effect graph anomaly score of 0.92, and high risk level of related orders.

[0235] The risk level is classified as CRITICAL based on a comprehensive score of 0.898. The digital signature is generated using the SHA-256 with RSA algorithm, and the report content is signed using a 2048-bit key. The generated monitoring report is distributed through a dual-path system: firstly, it is stored in an audit database using WORM storage technology with a retention period of five years; secondly, it is pushed in real-time to the risk control team's monitoring dashboard and the security personnel's mobile alert system via an encrypted API interface. The entire report generation cycle, from receiving the judgment signal to completing distribution, is strictly controlled within 100 milliseconds to ensure the timeliness and effectiveness of the monitoring results.

[0236] The report is automatically stored in the audit database and simultaneously pushed to the risk control team's monitoring dashboard and the security personnel's alarm system via API, completing a full cycle of real-time monitoring, judgment, and report generation.

[0237] In this embodiment, the following threshold optimization steps are also included:

[0238] Implement a threshold smoothing transition mechanism and use an exponentially weighted moving average algorithm to smooth the monitoring threshold over time.

[0239] Establish a threshold verification mechanism and calculate the false alarm rate and false negative rate of the threshold through backtesting.

[0240] When performance indicators fail to meet the standards, the weights of each dimension and the window size parameters are automatically adjusted, and the monitoring thresholds are recalculated.

[0241] The threshold that has been smoothed and validated is used as the current monitoring threshold in the final output.

[0242] In practice, threshold optimization is a continuously running, automated, closed-loop process that ensures the monitoring threshold is always maintained at its optimal performance level. The process is implemented as follows:

[0243] First, a threshold smoothing transition mechanism is implemented. The system uses the Exponentially Weighted Moving Average (EWMA) algorithm to smooth the initially calculated monitoring threshold sequence over time. Specifically, a smoothing coefficient α is set (typically ranging from 0.1 to 0.3), and the new threshold is iteratively calculated using the formula: New Threshold = α × Current Calculated Threshold + (1-α) × Previous Period Smoothing Threshold. This process effectively filters out threshold fluctuations caused by short-term data volatility, ensuring the continuity and stability of threshold changes and avoiding unnecessary impacts on the business system.

[0244] Secondly, establish a robust threshold verification mechanism. The system should periodically (e.g., every 24 hours) perform backtesting: using historical data from a past period (e.g., 30 days), the monitoring logic is rerun with the current threshold, and the false positive rate (FPR) and false negative rate (FNR) are calculated. The backtesting process is conducted in an isolated data sandbox to ensure no impact on the online production environment. Pre-defined performance metrics (e.g., FPR must be below 5%, FNR below 2%) serve as standards for evaluating the effectiveness of the thresholds.

[0245] When backtesting results show that performance metrics are not up to standard, the system automatically triggers a parameter adjustment and recalculation process. The adjustment strategy is based on a Bayesian optimization framework: using the weights of each dimension (orders, logistics, inventory, finance) and the sliding window size as hyperparameters, and the overall cost (FPR+FNR) as the objective function, it performs an intelligent search within a preset parameter space. For example, if backtesting finds a high false negative rate, the algorithm may automatically increase the weight of the logistics dimension and appropriately increase the sliding window size to capture longer-term patterns. The adjusted parameters are then fed into the main threshold calculation process to regenerate a batch of candidate thresholds.

[0246] These candidate thresholds were smoothed again before entering the second round of validation. The system used cross-validation to evaluate their performance across multiple time slices, and finally selected the threshold with the lowest overall cost as the winner.

[0247] Finally, the threshold, smoothed by EWMA and optimized through multiple rounds of verification, is used as the final output current monitoring threshold and deployed to the online real-time monitoring system. Simultaneously, all parameter adjustments, performance metrics, and the final selected threshold version are meticulously recorded in the metadata database, providing a data foundation and audit trails for subsequent optimization iterations. The entire optimization cycle requires no manual intervention, forming an intelligent closed loop of self-evaluation, self-adjustment, and self-optimization.

[0248] In step S415 of this embodiment, business rule constraints are introduced, and supply chain domain knowledge is encoded as threshold boundary constraints.

[0249] Step S416: The current monitoring threshold is obtained by weighted fusion of the sub-thresholds of each dimension and the baseline thresholds of each time series component, and by applying business rule constraints.

[0250] Specifically as follows:

[0251] Construct a supply chain business rules knowledge base, which includes quantitative expressions for order rationality rules, logistics timeliness rules, inventory turnover rate rules, and financial compliance rules;

[0252] The quantization expression is converted into mathematical constraints, which include inequality constraints and boundary constraints.

[0253] Establish a threshold optimization model based on constraint satisfaction problem, and use the initial monitoring threshold obtained by weighted fusion as the input variable;

[0254] The initial monitoring threshold is corrected using a constraint propagation algorithm to ensure that it meets all business rule constraints;

[0255] The design incorporates an iterative adjustment mechanism that projects an initial monitoring threshold to the nearest feasible solution space when the threshold violates business rules.

[0256] The thresholds of each dimension and the baseline thresholds of each time series component are fused by weighted summation, and the fusion result is input into the threshold optimization model.

[0257] Finally, the threshold optimization model outputs the current monitoring threshold that satisfies all business rule constraints.

[0258] In practical implementation, encoding supply chain domain knowledge into threshold boundary constraints and optimizing the threshold by satisfying these constraints is achieved through the following methods:

[0259] First, a supply chain business rules knowledge base was constructed. This knowledge base stores the quantitative expressions of four major categories of business rules in a structured format: order reasonableness rules (e.g., "the amount of a single order shall not exceed three times the average historical order amount of the supplier"), logistics timeliness rules (e.g., "domestic logistics transportation time should be within the range of 2-7 days"), inventory turnover rules (e.g., "finished goods inventory turnover rate should be maintained between 4-6 times / year"), and financial compliance rules (e.g., "payment period shall not exceed 60 days as stipulated in the contract"). These rules were determined through a combination of domain expert evaluation and historical data analysis and are stored in machine-readable JSON format.

[0260] Next, the above quantitative expressions are converted into mathematical constraints. The system has a built-in rule parsing engine that can automatically convert these business rules into mathematical expressions. For example:

[0261] The requirement that "inventory turnover should be maintained at 4-6 times / year" is transformed into an inequality constraint: 4 ≤ ≤ 6; where, This is the threshold for inventory turnover rate;

[0262] The rule that "the amount of a single order must not exceed three times the average value" has been transformed into a boundary constraint. ;in, For order amount threshold,

[0263] This is the historical average.

[0264] These mathematical constraints constitute a set of constraints. This serves as a constraint for subsequent optimization problems.

[0265] Then, a threshold optimization model based on the constraint satisfaction problem (CSP) is established. This model uses the initial monitoring threshold obtained by weighted fusion. Using the business rule constraint set C as the input variable, the goal is to find the optimal threshold that satisfies all constraints. The objective is to solve the problem. Specifically, this is a constrained optimization problem:

[0266] ; ;

[0267] in, This indicates that the constraints are satisfied. , This represents the i-th constraint function.

[0268] In the specific implementation process, a constraint propagation algorithm is used to correct the initial monitoring threshold to ensure that it meets all business rule constraints. This constraint propagation algorithm is specifically implemented using the AC-3 algorithm (Arc Consistency Algorithm #3). The algorithm's execution process is as follows: First, an initialization phase is performed, defining the initial monitoring threshold T to be optimized as a continuous variable and setting an initial feasible value range for it based on historical thresholds and business common sense. For example, it can be set to [0.5, 1.0]. Simultaneously, the business rules in the supply chain business rule knowledge base are converted into a set of inequality constraints. For example, this includes the lower limit constraint for inventory turnover rate c1: T >= 0.6 and the upper limit constraint for order fulfillment rate c2: T <= 0.95. During the initialization phase, a constraint queue Q also needs to be established. Since this example only involves a single variable T, queue Q initially contains all constraints C.

[0269] Next, the propagation loop phase begins. While the constraint queue Q is not empty, the algorithm iteratively performs the following operations: It retrieves a constraint ci from queue Q and calls the REVISE(T, ci) function to check if a solution exists that satisfies constraint ci for every value t of T within the current domain D(T). The REVISE function iterates through every value t in the current domain D(T) of T, checking if t satisfies constraint ci. If t does not satisfy ci, it is removed from the domain D(T). If the domain D(T) becomes empty after the removal operation, the algorithm terminates immediately, indicating that no feasible solution exists. When the REVISE operation causes a change in the domain D(T) of T, all other constraints involving variable T (except for the recently processed ci) need to be re-added to queue Q to ensure that these constraints can be re-checked based on the new, narrower domain.

[0270] The algorithm terminates when the constraint queue Q is empty, at which point all values ​​in the range D(T) of variable T are compatible with all constraints. The final optimal threshold... It can be selected from the final value range D(T), for example, selecting the value that is closest to the initial threshold. The closest value, or the midpoint of the range.

[0271] To illustrate the algorithm execution process, refer to the following example: The initial state is... Let D(T) = [0.5, 1.0], with constraints c1: T >= 0.6 and c2: T <= 0.95. The initial queue Q contains [c1, c2]. In the first step, constraint c1 is removed and a REVISE operation is performed. It is found that the value range [0.5, 0.6) does not satisfy constraint c1, so it is removed and the value range is updated to [0.6, 1.0]. Since the value range has changed, constraint c2 is added back to the queue, and Q = [c2]. In the second step, constraint c2 is removed and a REVISE operation is performed. It is found that the value range (0.95, 1.0] does not satisfy constraint c2, so it is removed and the value range is updated to [0.6, 0.95]. The value range changes again, but there are no other constraints to process in the queue. When the algorithm terminates, the final value range is D(T) = [0.6, 0.95], constraint propagation is complete, and the initial threshold of 0.55 has been successfully corrected to the feasible range.

[0272] Based on the constraint propagation algorithm, an iterative adjustment mechanism is designed. When the initial monitoring threshold violates business rules, it is projected to the nearest feasible solution space by combining constraint propagation and the projection gradient method. The sub-thresholds of each dimension and the baseline thresholds of each time series component are fused using a weighted summation method, and the fusion result is input into the threshold optimization model. Finally, the threshold optimization model outputs the current monitoring threshold that satisfies all business rule constraints. Specifically:

[0273] When the initial monitoring threshold violates business rules, the projection gradient method is used to project it to the nearest feasible solution space. Specifically, this is achieved by solving the following optimization problem:

[0274]

[271]

[0275] ; where g i (T) ≤ 0 is the standardized form of the inequality constraint. Solve using the interior point method or the effective set method, ensuring that the solution remains within the feasible region throughout the iteration process.

[0276]

[272] In the actual calculation process, the sub-thresholds of each dimension and the baseline thresholds of each time series component are first fused by weighted summation. The specific calculation formula is as follows:

[0277] ,in and The weight coefficients representing each business dimension and time series component are dynamically calculated using the entropy weight method, and strictly satisfy the constraint that the sum of all weight coefficients is 1.

[0278] The calculation of sub-thresholds for each business dimension covers four core business areas: order business dimension, logistics business dimension, inventory business dimension, and financial business dimension.

[0279] For the order business dimension, historical data of three characteristic indicators—order quantity, order amount, and order cycle—are analyzed. The isolated forest algorithm is used to remove outliers. This algorithm sets up 100 decision trees, with a subsampling size of 256 records and an outlier ratio parameter of 0.05. Based on the cleaned data, the 95th percentile of the historical score sequence is taken as the threshold for this dimension.

[0280] The logistics business dimension is based on three characteristic indicators: logistics timeliness, route deviation, and transportation cost. After using the same outlier removal process, the 97th percentile is calculated.

[0281] From the perspective of inventory operations, three characteristic indicators are considered: inventory turnover rate, safety stock level, and inventory age structure. After data cleaning, the 93rd percentile is taken.

[0282] The financial and business dimension covers three characteristic indicators: payment cycle, payment period matching degree, and capital turnover rate. After outlier removal, the 96th percentile is calculated.

[0283] The calculation of the time series component threshold baseline employs a multi-model collaborative prediction architecture. The trend component is predicted using an ARIMA model. First, the historical composite anomaly score series is first-differenced to ensure stationarity. The optimal model parameters are determined to be ARIMA(2,1,2) using the AIC criterion. The model is trained using maximum likelihood estimation to predict the trend component values ​​for the next 24 hours. The seasonal component is modeled using a SARIMA model with a 24-hour seasonal period and SARIMA(1,1,1)(1,1,1)24 model parameters. The model coefficients are calculated using the conditional sum of squares estimation method to predict the seasonal component fluctuations over the same time range. The residual component's fluctuation range is estimated using a GARCH(1,1) model. The model parameters are determined using a quasi-maximum likelihood estimation method. The upper bound of the 95% confidence interval for the residual component over the next 24 hours is calculated as the fluctuation range estimate.

[0284] The prediction results of each component are weighted and fused to obtain the time series threshold baseline, where the trend component has a weight of 0.5, the seasonal component has a weight of 0.3, and the residual component has a weight of 0.2. The weighting ratio of the business dimension to the time series component is 6:4, i.e. =0.6, =0.4, ensuring a balanced consideration of business logic and time series characteristics. The weight coefficients are updated every 24 hours and dynamically adjusted based on the recent prediction accuracy of each dimension. The accuracy assessment uses the mean absolute percentage error index, with dimensions with lower errors receiving higher weight allocations.

[0285] The fusion result After being input into the threshold optimization model, the model is optimized through the following steps:

[0286] examine Does it satisfy all constraints? If so, then ;

[0287] If the conditions are not met, the feasible solution space is calculated using the constraint propagation algorithm, and then the projection gradient method is used to... Project onto the feasible solution space and output the projected solution. ;

[0288] Ultimately, the threshold optimization model outputs a current monitoring threshold that satisfies all business rule constraints. This threshold not only considers data statistical characteristics but also ensures business rationality, effectively preventing threshold settings that violate common business sense. The entire optimization process is executed automatically once a day to ensure that the threshold always complies with the latest business rule requirements.

[0289] In this embodiment, the method for adding the data samples confirmed as forged to the training sample library and performing incremental learning on the generator network and discriminator network is as follows:

[0290] Step S45: Standardize and anonymize the data samples confirmed to be forged, remove sensitive information, and make its data distribution consistent with the real data sample set.

[0291] Step S46: Add a timestamp and anomaly type label to the processed forged data sample and add it to a dedicated playback buffer;

[0292] Step S47: Sample data from the playback buffer and the original training sample library according to a preset period and combine them to form an incremental training dataset;

[0293] Step S48: Fine-tune the generative adversarial network model using the incremental training dataset. During the training process, freeze the low-level feature extraction layers of the generator network and the discriminator network, and optimize only the parameters of their high-level decision layers.

[0294] Step S49: After fine-tuning the training, use the validation set to evaluate the model performance. If the performance improves, update the model parameters; if the performance declines, revert to the model state before training.

[0295] The specific implementation details are as follows:

[0296] Step S45: Standardize and anonymize the data samples confirmed to be forged, remove sensitive information, and make its data distribution consistent with the real data sample set.

[0297] In practice, standardization and anonymization of data samples confirmed to be forged is a rigorous data preprocessing step. Standardization uses the exact same parameter system as the initial training phase to ensure consistency in data distribution. For numerical features, Z-score standardization is performed using the mean μ and standard deviation σ obtained from the initial training set metadata, with the following formula: The values ​​of μ and σ are calculated and persistently stored during system initialization, remaining fixed throughout all subsequent processing. For example, the order amount characteristic... =50000, =20000, then the original value 70000, after standardization, becomes (70000-50000) / 20000=1.0. For categorical features, the one-hot encoding mapping table established during the initial training phase is used for conversion. For example, the supplier name "a certain electronics technology company" is mapped to [1,0,0], and "a certain machinery manufacturing plant" is mapped to [0,1,0]. Anonymization processing adopts a strict protection mechanism based on differential privacy, generalizing the direct identifier, replacing the specific supplier name with the category label, such as replacing "a certain electronics technology company" with "supplier_A", and replacing the precise geographical location with the area code, such as replacing "No. xx, xx Road, Haidian District, Beijing" with "110108". Laplace noise is added to numerically sensitive information, with the noise scale parameter... Set to 0.1 for global sensitivity. Based on the feature type setting, for the order amount feature =10000 yuan, the specific formula is as follows Where Lap(b) represents sampling from a Laplace distribution with scale parameter b. For example, the original order amount is 50,000 yuan. =100000, after adding noise, it may become 50123.45 yuan, while maintaining the statistical characteristics of the data and ensuring that it cannot be traced back to the specific transaction record.

[0298] Step S46: Add a timestamp and anomaly type label to the processed forged data sample and add it to a dedicated playback buffer;

[0299] In the specific implementation process, after the processed forged data samples are added with precise timestamps and structured anomaly type tags, they need to be stored in a dedicated playback buffer with a fixed capacity. The timestamps use the ISO 8601 extended format, accurate to milliseconds, such as "2023-10-26T14:30:05.123Z". The anomaly type tags adopt a three-level classification system: Level 1 tags include four main categories: order forgery, logistics information forgery, inventory record forgery, and financial data forgery; Level 2 tags are subdivided based on forgery methods, such as random anomalies, strategic anomalies, and coordinated anomalies; Level 3 tags record specific combinations of anomaly features, such as "order quantity anomaly_logistics path anomaly_inventory mismatch". The buffer uses a sample replacement strategy based on weighted scores. The weighted score S is calculated using the formula S = m × recency + n × recency, where m = 0.6 and n = 0.4 are weighting coefficients. Recency measures the time freshness of the sample, and is calculated using the formula... Where λ = 0.02 is the decay rate constant, and Δt is the time difference (in hours) between samples entering the buffer. Rarity measures the scarcity of anomaly types, calculated as rarity = 1 - (F... type / F max), where F type F is the frequency of occurrence of this exception type in the buffer. max It has the highest frequency of all types.

[0300] The buffer is implemented as a circular queue with a capacity of N=10000. When a new sample needs to be added and the buffer is full, the system iterates through all samples, calculates the weight score S, and finds the sample with the lowest S value to replace it. For example, a "forged order" sample is stored for 100 hours, and this type has 3000 samples in the buffer (F...). max =3000), then recency=exp(-0.02×100)≈0.135, rarity=1-(3000 / 3000)=0, S=0.6×0.135+0.4×0=0.081; another "inventory record forgery" sample was stored for 10 hours, this type has 50 samples, then recency=exp(-0.02×10)≈0.819, rarity=1-(50 / 3000)≈0.983, S=0.6×0.819+0.4×0.983≈0.884; the system will select the order forgery sample with the lower S value for replacement.

[0301] Step S47: Sample data from the playback buffer and the original training sample library according to a preset period and combine them to form an incremental training dataset;

[0302] The system automatically constructs the incremental training dataset according to a preset 24-hour cycle. The sampling process employs a strict stratified sampling strategy to ensure a balanced sample distribution. First, stratified sampling is performed from the replay buffer according to anomaly type, with at least min(total number of samples of that type × 0.1, 50) samples drawn for each anomaly type to ensure that rare anomaly types are adequately represented. For example, if there are 3000 "order forgery" records in the buffer, then min(3000 × 0.1, 50) = 300 records are sampled; if there are 50 "inventory record forgery" records, then min(50 × 0.1, 50) = 5 records are sampled. Simultaneously, a number of normal samples equal to the total number of samples drawn from the replay buffer are randomly drawn from the original real sample library to maintain a 1:1 balance between positive and negative samples. The total size of the incremental training dataset is controlled to be 8% of the original training set size. After the dataset is constructed, rigorous quality checks are performed, including feature distribution consistency checks and sample independence checks. Feature distribution consistency was tested using the Kolmogorov-Smirnov test, comparing the differences in distribution across each feature dimension between the incremental dataset and the original training set, with a p-value threshold set to 0.05. Sample independence was tested using the variance inflation factor (VIF) to detect multicollinearity among features, with a VIF threshold set to 5. Only datasets that passed all quality checks were used for subsequent incremental training.

[0303] Step S48: Fine-tune the generative adversarial network model using the incremental training dataset. During the training process, freeze the low-level feature extraction layers of the generator network and the discriminator network, and optimize only the parameters of their high-level decision layers.

[0304] Fine-tuning training employs a feature extractor freezing strategy. Specifically, the first three parameters of all one-dimensional convolutional layers in the generator network are frozen, including kernel weights and bias terms; the first two parameters of all convolutional layers and the first one parameter of the LSTM layer in the discriminator network are frozen. Only the output calibration module of the generator, the high-level fully connected layers of the discriminator, and the attention mechanism parameters are optimized. A piecewise learning rate strategy is used during training, with the initial learning rate set to 1 / 10 of the original training phase (1e-5 for the generator and 4e-5 for the discriminator). After every 10 epochs, the learning rate decays exponentially with a decay factor of 0.95. The optimization algorithm uses stochastic gradient descent with momentum (momentum parameter = 0.9) and a weight decay factor of 1e-4. Regularization techniques include Dropout applied to high-level fully connected layers with a dropout rate of 0.2, and L2 regularization applied to all trainable parameters with a coefficient of 1e-4. Gradient clipping is implemented during training, with a gradient norm threshold set to 1.0 to prevent gradient explosion. Each training batch is fixed at 32 bytes, and a dynamic batch reorganization strategy is used to ensure a balanced ratio of positive and negative samples in each batch. The total number of training epochs is set to 50, with performance evaluation performed on the validation set every 5 epochs. During training, the system monitors the trend of the loss function, and training is terminated early if the loss on the validation set does not improve for 10 consecutive epochs.

[0305] Step S49: After fine-tuning the training, use the validation set to evaluate the model performance. If the performance improves, update the model parameters; if the performance declines, revert to the model state before training.

[0306] The validation set consists of 1000 independently collected samples, including 800 normal samples and 200 fake samples of various types, ensuring coverage of all known anomaly types. Performance evaluation employs a multi-metric comprehensive scoring system, including accuracy, precision, recall, F1 score, and AUC-ROC value. The weighting of each metric is as follows: F1 score (weight 0.3), AUC-ROC (weight 0.25), recall (weight 0.2), precision (weight 0.15), and accuracy (weight 0.1). Performance improvement is judged by an overall score improvement exceeding 0.5% and no individual metric decrease exceeding 1%. If performance improves, the system executes a model parameter update process: first, a complete backup of the current production model is created, including network structure, parameter status, and training metadata; then, the system atomically switches to the newly trained model; after the update, integrity verification is performed to ensure all parameters are correctly loaded. If performance degrades, the system performs a rollback operation: restoring the original model parameters from the backup, clearing temporary files generated during incremental training, and generating a detailed rollback report, recording the specific metrics of performance degradation and possible causes. The entire update or rollback process is completed within 30 seconds, ensuring uninterrupted online monitoring services. The system also maintains a version control system, recording metadata for each incremental training iteration, including training time, dataset features, and performance metric changes, providing data support for subsequent optimizations.

[0307] Although the steps in the above embodiments are described in the above order, those skilled in the art will understand that in order to achieve the effect of this embodiment, different steps do not need to be executed in such an order. They can be executed simultaneously (in parallel) or in a reverse order. These simple variations are all within the protection scope of this invention.

[0308] The second embodiment of the present invention proposes a supply chain data forgery monitoring system based on generative adversarial networks (GANs), and a supply chain data forgery monitoring method based on GANs. The system includes:

[0309] The sample construction module is configured to acquire raw data from multiple heterogeneous data sources of the supply chain management platform, perform multimodal data fusion and cleaning, and extract feature vectors with temporal correlation and business logic to construct a set of real data samples.

[0310] The model building module is configured to construct a generative adversarial network model, including a generator network and two discriminator networks. The generator network receives random noise vectors and the distribution conditions of real data samples as input, and generates simulated data through a deep convolutional neural network and a long short-term memory network. The first discriminator network analyzes the local statistical characteristics of the data points. The second discriminator network analyzes the global consistency and causal relationship of the data sequence. The outputs of the two discriminator networks are fused through an adaptive weighting module.

[0311] The data processing module is configured to input the supply chain data stream to be monitored into the trained generative adversarial network model, extract micro-anomaly features through the first discriminator network, analyze macro-logical rationality through the second discriminator network, and output a comprehensive anomaly score by the adaptive weighting module.

[0312] The output module is configured to determine whether the data is forged based on the comparison result of the comprehensive anomaly score and the monitoring threshold, and generate a monitoring report; add the data samples confirmed to be forged to the training sample library, and perform incremental learning on the generator network and the discriminator network.

[0313] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working process and related descriptions of the system described above can be found in the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0314] It should be noted that the supply chain data forgery monitoring system based on generative adversarial networks provided in the above embodiments is only an example of the division of the above functional modules. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the modules or steps in the embodiments of the present invention can be further decomposed or combined. For example, the modules in the above embodiments can be merged into one module, or further divided into multiple sub-modules to complete all or part of the functions described above. The names of the modules and steps involved in the embodiments of the present invention are only for distinguishing the various modules or steps and are not considered as an improper limitation of the present invention.

[0315] An electronic device according to a third embodiment of the present invention includes:

[0316] At least one processor; and

[0317] A memory communicatively connected to at least one of the processors; wherein,

[0318] The memory stores instructions that can be executed by the processor to implement the aforementioned supply chain data forgery monitoring method based on generative adversarial networks.

[0319] A fourth embodiment of the present invention provides a computer-readable storage medium storing computer instructions, which are executed by the computer to implement the above-described supply chain data forgery monitoring method based on generative adversarial networks.

[0320] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working process and related descriptions of the storage device and processing device described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0321] Those skilled in the art will recognize that the modules and method steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. The programs corresponding to the software modules and method steps can be placed in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disks, removable disks, CD-ROMs, or any other form of storage medium known in the art. To clearly illustrate the interchangeability of electronic hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in electronic hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the invention.

[0322] The terms “first”, “second”, etc., are used to distinguish similar objects, not to describe or indicate a specific order or sequence.

[0323] The term "comprising" or any other similar term is intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus / device that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent in such process, method, article, or apparatus / device.

[0324] The technical solution of the present invention has been described above with reference to the preferred embodiments shown in the accompanying drawings. However, it will be readily understood by those skilled in the art that the scope of protection of the present invention is obviously not limited to these specific embodiments. Without departing from the principles of the present invention, those skilled in the art can make equivalent changes or substitutions to the relevant technical features, and the technical solutions after these changes or substitutions will all fall within the scope of protection of the present invention.

Claims

1. A supply chain data forgery monitoring method based on generative adversarial networks, characterized in that, The method includes: Raw data is obtained from multiple heterogeneous data sources of the supply chain management platform, and multimodal data fusion and cleaning are performed to extract feature vectors with time-series correlation and business logic in order to construct a set of real data samples. A generative adversarial network (GAN) model is constructed, comprising a generator network and two discriminator networks. The generator network receives a random noise vector and the distribution conditions of real data samples as input, and generates simulated data through a deep convolutional neural network and a long short-term memory network. The first discriminator network analyzes the local statistical characteristics of the data points. The second discriminator network analyzes the global consistency and causal relationship of the data sequence. The outputs of the two discriminator networks are fused through an adaptive weighting module. The supply chain data stream to be monitored is input into the trained generative adversarial network model. The first discriminator network extracts micro-anomaly features, and the second discriminator network analyzes the macro-logical rationality. The adaptive weighting module outputs a comprehensive anomaly score. Based on the comparison result between the comprehensive anomaly score and the monitoring threshold, it is determined whether the data is forged, and a monitoring report is generated; the data samples confirmed to be forged are added to the training sample library, and incremental learning is performed on the generator network and the discriminator network.

2. The supply chain data forgery monitoring method based on generative adversarial networks according to claim 1, characterized in that, The original data is subjected to multimodal data fusion and cleaning to extract feature vectors with temporal correlation and business logic, in order to construct a set of real data samples. The method is as follows: The format unification and standardization processing is performed on structured data from relational databases, time-series data streams from IoT sensors, and unstructured data from text records. The standardization processing includes data type conversion, unit normalization, and timestamp alignment. Business characteristics are extracted from the standardized data, including order cycle characteristics, logistics route characteristics, inventory dynamic characteristics, supplier stability characteristics, and price fluctuation characteristics. The extracted business features are aligned and concatenated according to a preset time window, and a composite feature vector with continuous temporal correlation is generated by a sliding window algorithm. This vector is added to the sample library, and the real data sample set is constructed by vector normalization.

3. The supply chain data forgery monitoring method based on generative adversarial networks according to claim 1, characterized in that, The generator network employs a conditional deep convolutional generation architecture, specifically including: The generator network includes a conditional information embedding layer, which maps the distribution conditions of real data samples into conditional vectors through a fully connected layer. The generator body adopts an encoder-decoder framework with a dilated convolutional structure, where the encoder uses a one-dimensional convolutional neural network with a gated mechanism to extract multi-scale features, and the decoder uses a hybrid structure of transposed convolution and long short-term memory network to reconstruct the data sequence. A skip connection with attention weights is set between the encoder and decoder to maintain high-dimensional feature consistency between input conditions and output data; The generator network also includes an output calibration module, which uses a conditional batch normalization layer and an adaptive activation function to perform distribution calibration on the generated data, ensuring that the output data is statistically comparable to the real data samples.

4. The supply chain data forgery monitoring method based on generative adversarial networks according to claim 1, characterized in that, The two discriminator networks adopt a heterogeneous dual-channel architecture: The first discriminator network adopts a multi-scale convolutional neural network structure, which includes dilated convolution branches and regular convolution branches that work in parallel. The dilated convolution branches capture long-range dependency features, and the regular convolution branches extract local statistical features. The second discriminator network adopts a spatiotemporal correlation network structure, which includes a temporal causal convolution module and a relational reasoning module. The temporal causal convolution module analyzes the global consistency of the data sequence, and the relational reasoning module constructs a causal correlation model between features based on a graph neural network. Each discriminator network has a feature distillation layer at the end, which adaptively recalibrates the weights of the feature channels by compressing the excitation network; The two discriminator networks share the underlying feature extraction layer but have independent high-level decision layers, forming a feature learning mechanism that is both collaborative and competitive.

5. The supply chain data forgery monitoring method based on generative adversarial networks according to claim 1, characterized in that, The adaptive weighting module employs a meta-learning optimization architecture: The adaptive weighting module includes a weight generation network and a confidence evaluation submodule. The weight generation network uses a two-layer long short-term memory network to learn the temporal correlation of the outputs of each discriminator. The confidence assessment submodule dynamically assesses the real-time monitoring reliability of each discriminator by calculating the entropy change and gradient stability of the output probability of each discriminator. The weighted fusion process employs a soft weighting strategy based on temperature parameters, which dynamically adjusts the sharpness of weight allocation according to the discriminator confidence level. The training of the generative adversarial network model adopts a progressive course learning strategy, which dynamically adjusts the noise injection intensity and generation difficulty to enable the model to gradually learn from simple samples to complex samples. A memory replay mechanism is introduced during training to periodically replay historical difficult samples to prevent the model from forgetting previously learned fake pattern features.

6. The supply chain data forgery monitoring method based on generative adversarial networks according to claim 1, characterized in that, The result determination and feedback step determines whether the data is falsified based on the comparison between the comprehensive anomaly score and the monitoring threshold, and generates a monitoring report. The method is as follows: The comprehensive anomaly score output by the adaptive weighting module is compared in real time with the current monitoring threshold calculated by the dynamic threshold adjustment module. When the comprehensive anomaly score is greater than the current monitoring threshold, a forged data determination signal is generated; Based on the judgment signal, the report generation module is invoked to integrate the original information of the data to be monitored, the comprehensive anomaly score, the micro-anomaly characteristics output by the first discriminator network, and the macro-logical rationality analysis results output by the second discriminator network. Generate a structured monitoring report, which includes at least a unique data identifier, a timestamp, a forgery determination result, an anomaly score, details of anomaly characteristics, and a risk level label.

7. A supply chain data forgery monitoring method based on generative adversarial networks according to claim 6, characterized in that, The current monitoring threshold is calculated as follows: Establish a multi-dimensional threshold matrix based on the characteristics of supply chain business. The multi-dimensional threshold matrix includes sub-thresholds for order dimension, logistics dimension, inventory dimension and financial dimension. The weight of each dimension is dynamically allocated according to the importance of business through the entropy weight method. Using time series decomposition technology, historical anomaly scores are decomposed into trend components, periodic components, and residual components. ARIMA prediction models are established for each component to calculate the threshold baseline. A hybrid anomaly detection model based on isolated forest and local outlier detection is constructed to automatically identify abnormal extreme points in historical scores and eliminate their interference with threshold calculation. Design a threshold learning mechanism based on a sliding window, where the window size is adaptively adjusted according to the frequency of data fluctuations through fast Fourier transform analysis; Introduce business rule constraints and encode supply chain domain knowledge as threshold boundary constraints; The current monitoring threshold is obtained by weighted fusion of sub-thresholds of each dimension and the baseline thresholds of each time series component, and by applying business rule constraints.

8. A supply chain data forgery monitoring method based on generative adversarial networks according to claim 7, characterized in that, It also includes the following threshold optimization steps: Implement a threshold smoothing transition mechanism and use an exponentially weighted moving average algorithm to smooth the monitoring threshold over time. Establish a threshold verification mechanism and calculate the false alarm rate and false negative rate of the threshold through backtesting. When performance indicators fail to meet the standards, the weights of each dimension and the window size parameters are automatically adjusted, and the monitoring thresholds are recalculated. The threshold that has been smoothed and validated is used as the current monitoring threshold in the final output.

9. A supply chain data forgery monitoring method based on generative adversarial networks according to claim 7, characterized in that, By introducing business rule constraints, supply chain domain knowledge is encoded as threshold boundary constraints. The current monitoring threshold is obtained by weighted fusion of sub-thresholds from various dimensions and the baseline thresholds of each time series component, and by applying business rule constraints. The method is as follows: Construct a supply chain business rules knowledge base, which includes quantitative expressions for order rationality rules, logistics timeliness rules, inventory turnover rate rules, and financial compliance rules; The quantization expression is converted into mathematical constraints, which include inequality constraints and boundary constraints. Establish a threshold optimization model based on constraint satisfaction problem, and use the initial monitoring threshold obtained by weighted fusion as the input variable; The initial monitoring threshold is corrected using a constraint propagation algorithm to ensure that it meets all business rule constraints; The design incorporates an iterative adjustment mechanism that projects an initial monitoring threshold to the nearest feasible solution space when the threshold violates business rules. The thresholds of each dimension and the baseline thresholds of each time series component are fused by weighted summation, and the fusion result is input into the threshold optimization model. Finally, the threshold optimization model outputs the current monitoring threshold that satisfies all business rule constraints.

10. A supply chain data forgery monitoring method based on generative adversarial networks according to claim 1, characterized in that, The data samples confirmed to be forged are added to the training sample library, and incremental learning is performed on the generator network and the discriminator network. The method is as follows: The data samples identified as forged are standardized and anonymized, sensitive information is removed, and their data distribution is made consistent with the set of real data samples. Add timestamps and anomaly type labels to the processed forged data samples and add them to a dedicated playback buffer; Data is sampled from the playback buffer and the original training sample library at a preset period and combined to form an incremental training dataset; The generative adversarial network model is fine-tuned using the incremental training dataset. During the training process, the lower-level feature extraction layers of the generator network and the discriminator network are frozen, and only the parameters of their higher-level decision layers are optimized. After fine-tuning the training, the model performance is evaluated using a validation set. If the performance improves, the model parameters are updated; if the performance declines, the model is reverted to its pre-training state.

Images