Flow quality monitoring method and system based on artificial intelligence

Abstract

The invention relates to the technical field of data processing, in particular to a flow quality monitoring method and system based on artificial intelligence. The method comprises the following steps: collecting flow related data from a multi-source system; calculating a service index according to the flow-related data and / or detecting the flow-related data by adopting a pre-constructed multi-model fusion detection engine to obtain a detection result; performing weighted summation on the service indexes and / or the detection results to obtain a traffic quality score; and based on the traffic quality score, grading the traffic by adopting a preset rule engine to obtain a grading result. The method provided by the invention can improve the accuracy of traffic quality monitoring.

Description

Artificial Intelligence-Based Traffic Quality Monitoring Method and System Technical Field

[0001] This invention relates to the field of data processing technology, and in particular to a traffic quality monitoring method and system based on artificial intelligence. Background Technology

[0002] In internet advertising, content distribution, and online business systems, traffic quality directly determines business effectiveness and costs. High-quality, genuine traffic can effectively improve advertising ROI, content distribution accuracy, and core revenue of online businesses, while low-quality, invalid, or fraudulent traffic can lead to inflated business costs and biased decision-making.

[0003] To address this, existing technologies primarily employ the following traffic quality monitoring methods: First, static rule monitoring, which uses preset thresholds (such as upper limits for click frequency and lower limits for access duration) to determine whether traffic is abnormal, and triggers an alert when traffic data exceeds the preset thresholds; Second, anomaly detection based on simple statistics, which uses basic traffic characteristics, such as user behavior frequency, to identify abnormal data that deviates from the statistical average and complete the traffic anomaly judgment.

[0004] However, with the continuous iteration and upgrading of cheating technologies, various complex and ever-changing cheating behaviors are emerging one after another. Examples include using click farms to simulate real users generating fake clicks in bulk, using web crawlers to maliciously scrape content or inflate traffic, forging conversion data through ad fraud, and initiating malicious requests to occupy business resources. Existing monitoring methods cannot accurately distinguish between normal and invalid traffic when dealing with these types of cheating behaviors, resulting in high false positive and false negative rates. Specifically, static rules and simple statistical models can only judge based on surface data and cannot capture the deep logic and dynamic changes of cheating behaviors. They are prone to misjudging abnormal operations of normal users as cheating, and are also difficult to identify new types of disguised cheating behaviors.

[0005] Therefore, how to reduce the false alarm and false negative rates of traffic quality monitoring is a technical problem that urgently needs to be solved. Summary of the Invention

[0006] To address the high false alarm and false negative rates associated with static rule-based monitoring or anomaly detection based on simple statistics for traffic quality monitoring, this invention provides solutions in the following aspects.

[0007] In a first aspect, the present invention provides an artificial intelligence-based traffic quality monitoring method, comprising: collecting traffic-related data from a multi-source system; calculating business indicators based on the traffic-related data and / or using a pre-built multi-model fusion detection engine to detect the traffic-related data, thereby obtaining detection results; performing a weighted summation of the business indicators and / or the detection results to obtain a traffic quality score; and classifying the traffic based on the traffic quality score using a preset rule engine to obtain a classification result; wherein the classification result includes invalid traffic.

[0008] Furthermore, the multi-model fusion detection engine includes a supervised learning model, an unsupervised learning model, and a graph neural network model. The detection results include risk probability, anomaly score, and correlation score. The pre-built multi-model fusion detection engine is used to detect traffic-related data to obtain detection results, including: extracting, standardizing, and vectorizing the traffic-related data to obtain feature vectors; inputting the feature vectors into the supervised learning model to obtain the risk probability of known invalid traffic types; inputting the feature vectors into the unsupervised learning model to obtain the anomaly score of unknown abnormal traffic; and inputting the feature vectors into the graph neural network model to output the correlation score of clustered cheating behavior.

[0009] Furthermore, the business metrics and / or the detection results are weighted and summed to obtain a traffic quality score, including: weighting and summing the normalized risk probability, anomaly score, and correlation score to obtain a traffic quality score.

[0010] Furthermore, the business metrics include at least the bounce rate; the traffic quality score is obtained by weighted summation of the business metrics and / or the detection results, including: calculating the correlation between the business metrics and the preset conversion target or total transaction amount within a historical time window, and determining the weight corresponding to each business metric based on the correlation; the weight is positively correlated with the correlation; and the traffic quality score is obtained by weighted summation of the normalized business metrics based on the weights corresponding to the business metrics.

[0011] Furthermore, the classification result also includes normal traffic and suspicious traffic; the traffic is classified using a preset rule engine, including: if the traffic quality score is greater than a first preset threshold, it is classified as normal traffic; if the traffic quality score is less than or equal to the first preset threshold and greater than or equal to a second preset threshold, it is classified as suspicious traffic; if the traffic quality score is less than the second preset threshold, it is classified as invalid traffic.

[0012] Furthermore, the method also includes: if the classification result is suspicious traffic or invalid traffic, triggering an early warning prompt; if the classification result is invalid traffic, triggering a handling action; the handling action includes at least blocking the current request, adding the source IP to the blacklist, or adding the device ID to the isolation list.

[0013] Furthermore, the method also includes: in response to the traffic quality score decreasing by a factor exceeding a preset range and / or the classification result being invalid or suspicious traffic, determining an optimization action using a preset reinforcement learning model; and executing the optimization action.

[0014] Furthermore, the method also includes: in response to the traffic quality score decreasing by a factor exceeding a preset range, determining the contribution value of each business indicator to the decrease in traffic quality score based on the Shapley value; calculating the short-term fluctuation degree of each business indicator within a preset time window; determining the structural anomaly degree of each business indicator using the LOF algorithm; inputting the contribution value, short-term fluctuation degree, and structural anomaly degree into a preset root cause analysis model to calculate the root cause score; outputting the top few business indicators with the highest root cause scores and / or generating a root cause analysis report.

[0015] Furthermore, the root cause analysis model is as follows:

[0016]

[0017] In the formula, For the first Root cause scores for each business metric For the first The contribution value of each business indicator For the first The degree of short-term fluctuation of individual business indicators For the first The degree of structural anomalies in each business indicator.

[0018] In a second aspect, the present invention provides an artificial intelligence-based traffic quality monitoring system, including a processor and a memory, wherein the memory stores computer program instructions, and when the computer program instructions are executed by the processor, the artificial intelligence-based traffic quality monitoring method described in the first aspect is implemented.

[0019] The beneficial effects of this invention are as follows: By quantifying traffic quality through a comprehensive set of multiple business indicators, it can solve the problem of low accuracy caused by static rules or simple statistical judgments. By using actual business output as the evaluation standard, it ensures that high-value traffic will not be mistakenly blocked even if there are abnormal fluctuations in behavioral characteristics, thus reducing the false positive and false negative rates. By evaluating traffic quality through detection results generated by a multi-model fusion detection engine, it overcomes the limitations of rigid thresholds in traditional static rules and simple statistical models. By combining supervised learning for the identification of known attacks with unsupervised learning / graph algorithms for the discovery of unknown anomalies and hidden groups, it significantly reduces the false positive and false negative rates. By integrating business indicators and detection results to calculate traffic quality scores, it can both correct the oversensitivity of the model based on real business conversion data and identify disguised advanced attacks by combining deep detection results, significantly improving the accuracy and robustness of invalid traffic identification and reducing costs and risks. Attached Figure Description

[0020] Figure 1 is a flowchart of the traffic quality monitoring method based on artificial intelligence in an embodiment of the present invention; Figure 2 is a structural block diagram of the traffic quality monitoring system based on artificial intelligence in an embodiment of the present invention. Detailed Implementation

[0021] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0022] The specific embodiments of the present invention will now be described in detail with reference to the accompanying drawings.

[0023] Figure 1 is a flowchart of the traffic quality monitoring method based on artificial intelligence in an embodiment of the present invention.

[0024] In a first aspect, the present invention provides a traffic quality monitoring method based on artificial intelligence. Specifically, as shown in FIG1, the method of the present invention includes the following steps.

[0025] S1. Collect traffic-related data from multi-source systems.

[0026] In this embodiment, traffic-related data includes, but is not limited to, user request logs, behavioral events, network attributes, and system performance metrics.

[0027] Specifically, traffic-related data such as user request logs are collected in real time from channels such as Web (World Wide Web Applications) / APP (Mobile Applications), advertising platforms, CDN (Content Delivery Network), and API gateways.

[0028] In one embodiment, to avoid interference from invalid or abnormal data with subsequent traffic quality monitoring, the method of the present invention further includes: data cleaning of traffic-related data.

[0029] S2. Calculate business metrics based on traffic-related data and / or use a pre-built multi-model fusion detection engine to detect traffic-related data and obtain detection results.

[0030] In this embodiment, business metrics include conversion rate, click effectiveness rate (deduplicated clicks), bounce rate, request success rate, average latency, and risk traffic percentage. The multi-model fusion detection engine consists of a supervised learning model for identifying known invalid traffic, an unsupervised learning model for identifying unknown abnormal traffic, and a graph neural network model for detecting clustered or related fraudulent behaviors. The detection results include the outputs of the supervised learning model, the unsupervised learning model, and the graph neural network model. Specifically, the outputs of the supervised learning model include risk probability and confidence level, the unsupervised learning model include anomaly score and confidence level, and the graph neural network model includes correlation score and confidence level. Furthermore, the graph neural network model is also used to identify anomalous structures such as dense clusters of access nodes and chains of synchronized behavior from a multi-dimensional relationship graph.

[0031] In one embodiment, the supervised learning model can be an XGBoost (Extreme Gradient Boosting Tree) model or a DNN (Deep Neural Network) model, and the unsupervised learning model can be an Isolation Forest or an Autoencoder; there are no restrictions here.

[0032] In one embodiment, existing methods can be used to calculate business metrics, and there are no limitations on this approach. For example, the success rate can be obtained by dividing the number of successful requests by the total number of requests. Furthermore, some advertising platforms directly calculate these business metrics, so they can be obtained directly from these platforms.

[0033] In one embodiment, a pre-built multi-model fusion detection engine is used to detect traffic-related data and obtain detection results. This includes: extracting, standardizing, and vectorizing the traffic-related data to obtain a feature vector; the feature vector includes behavioral features, network features, and time-series features. In other optional embodiments, correlation features may also be included. Behavioral features include session length, click-through rate, conversion path, and behavioral stability features; network features include IP / UA distribution, access frequency, and geographic location; time-series features include access cycle, access rhythm, and traffic surge patterns, used to identify abnormal traffic fluctuations within a short period; correlation features are device-account-IP relationship graph structures, obtained by constructing a relationship graph between users, devices, IPs, and request paths.

[0034] Furthermore, some features (such as access frequency, behavior stability features, etc.) or all features in the feature vector are input into a pre-trained supervised learning model to obtain the risk probability of known cheating types; this risk probability represents the similarity between the current traffic sample and historical known cheating samples in the feature space.

[0035] Simultaneously, the feature vector is input into an unsupervised learning model trained based on normal traffic samples to obtain an anomaly score for unknown abnormal traffic. The unsupervised learning model learns the distribution range of normal traffic in the feature space to determine the degree to which the current feature vector deviates from the normal distribution. The anomaly score characterizes the distance or deviation between the sample traffic (i.e., the traffic corresponding to the feature vector) and the center of the normal traffic distribution. The higher the anomaly score, the more the traffic sample deviates from the normal traffic and the more likely it is to belong to an unknown type of abnormal traffic.

[0036] Simultaneously, a relationship graph is constructed with user nodes, device nodes, and IP nodes as vertices, where edges represent access relationships, login relationships, or click relationships. Feature vectors are embedded as node attributes into corresponding nodes and jointly modeled with the features of their neighboring nodes. Through the multi-layer message passing mechanism of a graph neural network, the structural position features of nodes in the overall relationship network are learned, ultimately outputting a correlation score for clustered cheating behavior. This correlation score represents the distance between the node corresponding to the feature vector and the center of the normal traffic cluster, or the similarity between the node corresponding to the feature vector and the core node of the abnormal cluster; the higher the correlation score, the more likely the node belongs to a cheating group or an abnormal access cluster.

[0037] S3. Perform a weighted summation of business metrics and / or detection results to obtain a traffic quality score.

[0038] In one embodiment, calculating a traffic quality score based on the detection results includes: weighted summation of the normalized risk probability, anomaly score, and correlation score; or weighted summation of the confidence scores corresponding to the supervised learning model, unsupervised learning model, and graph neural network model to obtain the traffic quality score. The weights used in calculating the traffic quality score can be derived from expert experience.

[0039] By determining the traffic quality score based on the detection results obtained by the multi-model fusion detection engine, it is possible not only to detect known invalid traffic, but also to detect unknown abnormal traffic and cluster cheating behavior, thereby accurately quantifying traffic quality and reducing the false alarm and false negative rates of traffic quality monitoring.

[0040] In another embodiment, calculating the traffic quality score based on business metrics includes: normalizing the business metrics using Min-Max normalization to obtain normalized business metrics; further, calculating the correlation between each business metric and a preset conversion target or total transaction amount, and calculating the weight corresponding to the business metric based on the correlation; further, performing a weighted summation of each business metric based on the weight corresponding to the business metric to obtain the traffic quality score.

[0041] By quantifying traffic quality scores through a combination of multiple business metrics, misjudgments and omissions caused by relying solely on behavioral characteristics can be avoided, thereby improving the accuracy and reliability of traffic quality monitoring. Compared to static weighting, the accuracy of calculating traffic quality scores is further improved by considering the correlation between business metrics and conversion goals.

[0042] In one embodiment, the calculation expression for the normalized business metric is as follows:

[0043] In the formula, For the normalized first Individual business metrics The first before normalization Individual business metrics Within a historical sliding window (e.g., a 7-day sliding window) The minimum value of each business indicator. Within the history sliding window The maximum value of each business indicator.

[0044] In one embodiment, the Pearson correlation coefficient can be used to calculate the correlation between business metrics and conversion targets or total transaction volume. The greater the correlation, the greater the weight of the business metrics. That is, the weight of the business metrics is positively correlated with the correlation. For example, the normalized correlation can be directly used as the weight.

[0045] In one embodiment, the corresponding traffic quality score is calculated as follows:

[0046] In the formula, To score traffic quality, For the first The weight of each business indicator, For the first Individual business metrics The number of business metrics.

[0047] In one embodiment, before calculating the traffic quality score, the method of the present invention further includes: classifying business metrics to obtain positive and negative metrics; subtracting the negative metrics from 1 to convert the negative metrics into positive metrics. The business metrics can be classified by business experts: if a business metric is higher, the traffic quality is better, then the business metric is classified as a positive metric, such as conversion rate; if a business metric is higher, the traffic quality is worse, then the business metric is classified as a negative metric, such as bounce rate.

[0048] Since different business metrics have different impacts on traffic quality scores, converting all negative metrics into positive ones ensures that the calculated traffic quality score is accurate and effective.

[0049] In another embodiment, if the traffic quality score is determined based on business metrics and detection results, then the corresponding expression for calculating the traffic quality score is:

[0050] Or:

[0051] In the formula, To calculate the traffic quality score based on business indicators and test results, This is the traffic quality score calculated based on business metrics. The flow quality score is calculated based on the test results. and Weighting coefficients are set based on expert experience.

[0052] By quantifying traffic quality scores through a combination of business indicators and testing results, the accuracy of traffic quality monitoring can be further improved.

[0053] Alternatively, the quality flow score can also be obtained by: using an LSTM (Long Short-Term Memory) model or / and a Prophet model to predict business metrics, and calculating residuals based on the predicted business metrics; simultaneously, using the LOF (Local Outlier Factor) algorithm to detect density anomalies in the feature vectors to obtain density anomaly scores; and adding the average residuals to the density anomaly scores to obtain the quality flow score. This method takes into account both trend anomalies and structural anomalies, and can cover all types of flow anomalies.

[0054] S4. Based on the traffic quality score, the traffic is classified using a preset rule engine to obtain the classification results.

[0055] In this embodiment, the classification results include normal traffic, suspicious traffic, and invalid traffic.

[0056] Specifically, if the traffic quality score is greater than a first preset threshold, it is classified as normal traffic; if the traffic quality score is less than or equal to the first preset threshold but greater than or equal to a second preset threshold, it is classified as suspicious traffic; if the traffic quality score is less than the second preset threshold, it is classified as invalid traffic. Both the first and second preset thresholds are derived from expert experience.

[0057] In one embodiment, the method of the present invention further includes: triggering an early warning if the classification result is suspicious traffic or invalid traffic; triggering a preset handling action if the classification result is invalid traffic; in this embodiment, the handling action includes blocking the current request, adding the source IP corresponding to the invalid traffic to the blacklist or adding the device ID corresponding to the invalid traffic to the isolation list, adjusting the delivery strategy to reduce the budget consumption of invalid traffic, etc.

[0058] Furthermore, the execution results of the processing actions and subsequent transformation data can be fed back to the multi-model fusion detection engine to update and optimize it. This multi-model fusion detection engine can be optimized and updated through online training to further improve detection accuracy.

[0059] In addition, you can set it to output a real-time traffic quality score every minute, which is used by the system to perceive the overall quality.

[0060] In one embodiment, the method of the present invention further includes: if the classification result is suspicious traffic / invalid traffic, and / or the traffic quality score decreases by more than a preset amount, triggering a quantitative analysis of traffic updates.

[0061] Specifically, the TQS model (i.e., the function expression for calculating TQS mentioned above) is decomposed using Shapley values ​​to obtain the contribution of each business indicator to the decline in traffic quality score. Simultaneously, the short-term volatility of each business indicator is calculated within a preset time window, and the structural anomaly of each business indicator is calculated using the LOF algorithm. The contribution values, short-term volatility, and structural anomaly are input into a preset root cause analysis model to obtain root cause scores. The root cause scores are then ranked, and the top 1-3 business indicators with the highest root cause scores and their corresponding percentage impact are output. Furthermore, a visualized root cause analysis report can be output, which includes the ranking of the root cause scores of the business indicators and their percentage impact. The short-term volatility can be either variance or standard deviation.

[0062] In one embodiment, the root cause analysis model is:

[0063] In the formula, For the first Root cause scores for each business metric For the first The contribution value of each business indicator For the first The degree of short-term fluctuation of individual business indicators For the first The degree of structural anomalies in each business indicator.

[0064] Root cause analysis can quickly pinpoint the source of anomalies, identifying which business metric caused the anomaly or decline in traffic quality, thus providing a reliable basis for relevant personnel to make correct decisions. Furthermore, calculating root cause scores by combining contribution values, short-term volatility, and the degree of structural anomalies can improve the reliability and accuracy of root cause analysis.

[0065] In one embodiment, the method of the present invention further includes: if the classification result is suspicious traffic / invalid traffic, and / or the traffic quality score drops by more than a preset range, triggering an automatic optimization closed-loop mechanism to ensure automatic recovery after traffic anomalies.

[0066] Specifically, a pre-defined reinforcement learning model is used to determine optimization actions; these actions are then executed to restore the traffic quality score, thereby reducing the impact of invalid traffic. The reinforcement learning model can employ the Q-learning algorithm.

[0067] Specifically, the reinforcement learning model is defined with a state space, action space, and reward function. The state space includes the current traffic quality score, the slope of change of the traffic quality score within a historical time window (e.g., 5 minutes), the degree of anomaly in business metrics, and the proportion of abnormal traffic. The action space includes actions such as adding the source IP to a blacklist, enabling graphical CAPTCHA or slider verification, reducing the ad bid for that channel, switching alternative ad creatives, and adjusting the traffic routing ratio. The reward function is the change in traffic quality score before and after executing the action. Alternatively, to avoid the reinforcement learning model overusing aggressive actions, the following reward function can be used:

[0068] In the formula, For instant rewards, The mass flow score is the score after the action is performed. The mass flow score is calculated before the action is performed. Each action has a pre-defined cost penalty. and These are the preset weighting coefficients.

[0069] When an optimization request is triggered, the current state s is obtained, based on... -The greedy strategy selects actions based on probability. Randomly select an action (i.e., optimize the action) with a probability of 1. Select the action with the highest current Q value:

[0070] In the formula, For optimal action, For action, This refers to the set of actions, or action space. Indicates selecting an action In the case of Expected value Indicates the search for Action when the maximum value is obtained .

[0071] In one embodiment, the expression for calculating the Q value is:

[0072] In the formula, Indicates the state Next action Long-term benefits To perform the action The immediate reward afterwards This is the discount factor, which can be set to 0.8. Indicates the execution of an action The system then enters a new state. Indicates a new state The next possible new actions, In the new state The Q-value of the optimal action under the given conditions represents the maximum potential future return.

[0073] This invention upgrades traditional passive monitoring systems into self-healing systems by introducing an automated tuning closed-loop mechanism based on reinforcement learning. This system can automatically make decisions and execute optimal actions based on the decline in TQS using a Q-learning algorithm, without human intervention.

[0074] The method of this invention can be applied to scenarios such as advertising, e-commerce, and finance. For example, in advertising scenarios, real-time data on ad impressions and click logs is collected. Based on this data, the system identifies the following behaviors: click farms (high-intensity clicks from the same device / IP), bot clicks (fixed time periods), extremely high bounce rates (clicks that immediately close), and no behavioral path (no dwell time / no conversion). Simultaneously, actions such as lowering bids, blocking traffic, and adjusting creative exposure strategies are taken for low-quality traffic. After these actions, the detection engine is continuously optimized using conversion data, ultimately achieving a reduction of invalid clicks by over 40% and a significant improvement in advertising ROI (Return on Investment).

[0075] Figure 2 is a structural block diagram of the traffic quality monitoring system based on artificial intelligence in an embodiment of the present invention.

[0076] In a second aspect, the present invention also provides an artificial intelligence-based traffic quality monitoring system. As shown in FIG2, the system includes a processor and a memory, the memory storing computer program instructions, which, when executed by the processor, implement the artificial intelligence-based traffic quality monitoring method described in the first aspect of the present invention.

[0077] The system also includes other components well known to those skilled in the art, such as communication interfaces, the settings and functions of which are known in the art and will not be described in detail here.

[0078] In this invention, the aforementioned memory can be any tangible medium containing or storing a program that can be used or combined with an instruction execution system, apparatus, or device. For example, a computer-readable storage medium can be any suitable magnetic or magneto-optical storage medium, such as Resistive Random Access Memory (RRAM), Dynamic Random Access Memory (DRAM), Static Random Access Memory (SRAM), Enhanced Dynamic Random Access Memory (EDRAM), High-Bandwidth Memory (HBM), Hybrid Memory Cube (HMC), etc., or any other medium that can be used to store desired information and can be accessed by an application, module, or both. Any such computer storage medium can be part of a device or accessible to or connected to a device. Any application or module described in this invention can be implemented using computer-readable / executable instructions that can be stored or otherwise maintained by such a computer-readable medium.

[0079] In the description of this specification, "multiple" means at least two, such as two, three or more, etc., unless otherwise explicitly specified. Furthermore, the division of steps in the above method is only for clarity of description; in implementation, it can be combined into one step or some steps can be split into multiple steps, as long as they include the same logical relationship. In all examples shown and discussed herein, any specific values ​​should be interpreted as merely exemplary and not as limitations. Therefore, other examples of exemplary embodiments may have different values.

[0080] While this specification has shown and described numerous embodiments of the invention, it will be apparent to those skilled in the art that such embodiments are provided by way of example only. Many modifications, alterations, and alternatives will occur to those skilled in the art without departing from the spirit and essence of the invention. It should be understood that various alternatives to the embodiments of the invention described herein may be employed in the practice of this invention.

Claims

1. A traffic quality monitoring method based on artificial intelligence, characterized in that, include: Collect traffic-related data from multi-source systems; Based on the traffic-related data, business metrics are calculated and / or a pre-built multi-model fusion detection engine is used to detect the traffic-related data to obtain detection results; the business metrics and / or the detection results are weighted and summed to obtain a traffic quality score. Based on the traffic quality score, a preset rule engine is used to classify the traffic to obtain a classification result; the classification result includes invalid traffic.

2. The traffic quality monitoring method based on artificial intelligence according to claim 1, characterized in that, The multi-model fusion detection engine includes a supervised learning model, an unsupervised learning model, and a graph neural network model. The detection results include risk probability, anomaly score, and correlation score. A pre-built multi-model fusion detection engine is used to detect traffic-related data and obtain detection results, including: extracting, standardizing, and vectorizing the traffic-related data to obtain feature vectors; inputting the feature vectors into a supervised learning model to obtain the risk probability of known invalid traffic types; inputting the feature vectors into an unsupervised learning model to obtain anomaly scores for unknown abnormal traffic; and inputting the feature vectors into a graph neural network model to output the correlation score of clustered cheating behavior.

3. The traffic quality monitoring method based on artificial intelligence according to claim 2, characterized in that, The traffic quality score is obtained by weighted summation of the business metrics and / or the detection results, including: weighted summation of the normalized risk probability, anomaly score and correlation score.

4. The traffic quality monitoring method based on artificial intelligence according to claim 1, characterized in that, The business metrics include at least the bounce rate; the business metrics and / or the detection results are weighted and summed to obtain a traffic quality score, including: calculating the correlation between the business metrics and the preset conversion target or total transaction amount within a historical time window, and determining the weight corresponding to each business metric based on the correlation; the weight is positively correlated with the correlation; and the normalized business metrics are weighted and summed based on the weights corresponding to the business metrics to obtain a traffic quality score.

5. The traffic quality monitoring method based on artificial intelligence according to claim 1, characterized in that, The classification results also include normal traffic and suspicious traffic; Traffic is classified using a preset rule engine, including: if the traffic quality score is greater than a first preset threshold, it is classified as normal traffic; if the traffic quality score is less than or equal to the first preset threshold and greater than or equal to a second preset threshold, it is classified as suspicious traffic; if the traffic quality score is less than the second preset threshold, it is classified as invalid traffic.

6. The traffic quality monitoring method based on artificial intelligence according to claim 5, characterized in that, Also includes: If the classification result indicates suspicious or invalid traffic, an alert will be triggered. If the classification result is invalid traffic, a handling action is triggered; the handling action includes at least blocking the current request, adding the source IP to the blacklist, or adding the device ID to the isolation list.

7. The traffic quality monitoring method based on artificial intelligence according to claim 5, characterized in that, Also includes: In response to a decrease in traffic quality score exceeding a preset range and / or a classification result indicating invalid or suspicious traffic, a preset reinforcement learning model is used to determine optimization actions; the optimization actions are then executed.

8. The traffic quality monitoring method based on artificial intelligence according to claim 1, characterized in that, Also includes: In response to a decrease in traffic quality score exceeding a preset threshold, the contribution of each business indicator to the decrease in traffic quality score is determined based on the Shapley value. Calculate the short-term fluctuation of each business indicator within a preset time window; determine the structural anomaly of each business indicator using the LOF algorithm; input the contribution value, short-term fluctuation, and structural anomaly into a preset root cause analysis model to calculate the root cause score; output the top few business indicators with the highest root cause scores and / or generate a root cause analysis report.

9. The traffic quality monitoring method based on artificial intelligence according to claim 8, characterized in that, The root cause analysis model is as follows: In the formula, For the first Root cause scores for each business metric For the first The contribution value of each business indicator For the first The degree of short-term fluctuation of individual business indicators For the first The degree of structural anomalies in each business indicator.

10. A traffic quality monitoring system based on artificial intelligence, characterized in that, It includes a processor and a memory, the memory storing computer program instructions, which, when executed by the processor, implement the AI-based traffic quality monitoring method according to any one of claims 1-9.

Images