A syntax tree structure automatic labeling and behavior pattern mining method and system based on player behavior logs

Abstract

The application discloses a kind of based on player behavior log's syntax tree structure automatic marking and behavior mode mining method and system.The method is washed to player behavior log, conversation segmentation and terminal symbol mapping, based on behavior grammar constructs compressed analysis forest and establishes shared subtree index;Convergent state is retrieved to warm start inference by constructing residual fingerprint history;On analysis forest, adopt alternating direction multiplier method to carry out production consistency, stage monotonicity and resource boundary multiple constraint inference, output node label posteriori and residual tensor aligned according to node-production-constraint type;Stable syntax tree is normalized and encoded and frequent subtree mining, generate behavior mode library and failure positioning mapping with certificate.The scheme improves the consistency and interpretability of marking, reduces the cost of manual and iteration, and improves the controllability of mode online trigger.

Description

Technical Field

[0001] This invention relates to the field of computers, and in particular to a method and system for automatic annotation and behavior pattern mining based on a syntax tree structure of player behavior logs. Background Technology

[0002] With the large-scale operation of online games, mobile games, and cloud games, platforms can continuously collect a large amount of player behavior logs, such as login / logout, task acceptance and completion, level entry / exit, item acquisition and consumption, payment and refund, team formation and social interaction, abnormal disconnection and reconnection, and other event sequences. These logs often have the characteristics of being "semi-structured + strongly context-dependent": on the one hand, event fields differ between different versions, different activity cycles, and different channel SDKs; on the other hand, the semantics and stage relationships of player behavior (such as the new player tutorial stage, main storyline progression stage, payment conversion stage, and early churn stage) cannot be determined solely by a single event, but require understanding in conjunction with the session context and changes in resource flow (such as gold coins, stamina, items, tickets, etc.). To support anti-cheating, anomaly detection, player segmentation, path analysis, and refined operations, the industry typically needs to further structure the raw behavior logs into computable "behavioral templates / patterns," and then conduct pattern mining and decision triggering based on these. However, traditional methods that rely solely on field splitting, regular expression templates, fixed rule bases, or simple clustering often fail to balance generalization capabilities and semantic consistency across heterogeneous origins. Furthermore, they suffer from high maintenance costs and insufficient interpretability during rapid business iterations, leading to problems such as pattern library drift, false triggering, and missed triggering.

[0003] In existing technologies, there are various solutions for log pattern discovery and log structure processing. For example, CN108241658A proposes a log pattern discovery method and system. Its approach includes collecting log messages and forming a log content list, replacing them according to entity feature values ​​and replacement rules, merging identical log content to obtain a log content dataset, further performing part-of-speech tagging on the log content, using probabilistic context-free grammar for syntactic analysis to generate a syntactic tree, defining the grammar, and extracting key information models based on the syntactic tree and grammar. Logs belonging to the same key information model are merged to obtain log pattern records and a static pattern data table. The advantage of this approach is that it introduces syntactic analysis from natural language processing into the log pattern partitioning process, which can more completely preserve semantic structure information than traditional regular expression / field truncation, thus making log pattern partitioning more scientific and the information more complete. However, from the perspective of practical applications of player behavior logs, player behavior is not a static text structure of a single "log statement," but rather a sequence structure spanning events and stages. Merging behavior solely using syntax trees or key information models may still face problems such as differences in multi-session contexts, semantic drift of behavior across versions, and inconsistencies in constraints (e.g., stage reversal, resource non-conservation, path breakage) leading to parsing ambiguity and annotation conflicts. Furthermore, the aforementioned solutions primarily emphasize "generating syntax trees—extracting key information models—merging into patterns," without providing a closed-loop mechanism for accurately attributing conflict sources in multi-constraint conflict scenarios, minimizing the scope of manual verification, and evolving grammar rules while ensuring online security.

[0004] Furthermore, US patent US8473300B1 discloses a method and system for "log mining to modify grammar-based text processing." The overall idea is as follows: An activity log is received from a device. This log contains input commands, functions determined based on matching the input commands with grammar-based text patterns, and responses obtained based on confirmation of the determined functions. The current activity log is then compared with stored historical activity logs to determine correlations. Based on these correlations, the grammar-based text patterns are modified, thereby updating the grammar-based text patterns on the device side. This approach emphasizes using correlations between logs to drive adjustments to grammar-based patterns, embodying a closed-loop concept of "log mining—pattern correlation—grammar update," and can adapt to changes in input commands and response functions to a certain extent. However, its application context leans more towards grammar-based text processing that maps input instructions to functions, and it does not address issues such as consistency constraints of structured tree annotations, ambiguity resolution, multi-constraint conflict localization, and security verification and rollback after updates. For example, when the same input sequence has multiple feasible parsings in different contexts, how can we determine the conflict concentration area and limit the scope of manual intervention with a reproducible quantitative caliber? Also, how can we provide verifiable evidence after grammar updates to reduce the risk of online error triggering caused by erroneous updates? The aforementioned literature does not provide targeted technical means for these issues.

[0005] For example, CN101329666A discloses an automatic syntactic analysis method based on corpus and tree-structured pattern matching. This method extracts and stores syntactic patterns from an annotated corpus, performs pattern matching and transformation on the sentences to be processed, and then combines this with semantic disambiguation to obtain the optimal syntactic analysis result. It also includes modules for extracting, storing, and calling syntactic patterns from a syntactic treebase, as well as modules for syntactic pattern matching, local transformation of approximate patterns, and semantic disambiguation. The implications of this approach are that combining overall matching and local transformation of tree-structured patterns can improve the efficiency and accuracy of syntactic analysis; and the "pattern library—matching—local transformation—disambiguation" chain has a certain degree of interpretability. However, directly applying this type of automated syntactic analysis to the syntax tree annotation and behavior pattern mining scenarios of player behavior logs still encounters at least three types of engineering pain points: First, player behavior logs emphasize the dynamic consistency of "event sequences and resource flows," requiring compliance with business constraints such as stage monotonicity, resource boundaries, and cross-event causality in addition to text structure; second, ambiguity resolution is often not a single-sentence ambiguity, but rather a conversational ambiguity and structural conflicts caused by cross-event dependencies; third, updates to the pattern library, if lacking secure gating and verifiable evidence, can easily introduce the risk of "local rewriting leading to global drift." The aforementioned literature mainly focuses on pattern matching and transformation within syntactic analysis itself, and does not provide clear solutions for mechanisms for online closed-loop governance such as "minimum conflict location under multiple constraint conflicts, validation set gating, rollback updates, and verifiable certificate output."

[0006] In summary, existing technologies have provided log pattern discovery schemes based on grammar and syntax trees, grammar-based pattern update schemes driven by log relevance, and automatic syntactic analysis schemes based on tree-structured pattern matching / local transformation. However, automatic syntax tree annotation and behavior pattern mining for player behavior logs still face unresolved technical contradictions: First, when ambiguity resolution and multiple constraint conflicts coexist, there is a lack of mechanisms to accurately attribute conflicts to "node-production rule-constraint type" and minimize the scope of manual verification accordingly; second, grammar / rule updates lack a safe evolution framework of "reproducible warm-start reuse" and "verification gating-rollback," making it difficult to stably iterate the online pattern library; third, pattern mining results lack verifiable certificates and failure location capabilities that match deployment triggers, making it difficult to achieve a low-risk automated decision-making closed loop. Therefore, there is an urgent need for an automatic syntax tree annotation and behavior pattern mining technology more suitable for player behavior log scenarios, to improve annotation consistency, pattern stability, and deployment controllability while reducing manual costs. Summary of the Invention

[0007] The technical objective of this invention is to address the problems of ambiguous parsing, poor consistency in structural annotation, high cost of manual verification, and difficulty in reusing stable pattern mining results in player behavior logs. This invention provides an automatic annotation and behavior pattern mining method that performs multi-constraint inference on compressed parsing forests and generates residual attribution; accurately locates and minimizes the scope of manual verification through conflict-dominant subtrees; combines residual fingerprint warm-start and rollback-style templated grammar updates to achieve secure evolution; and outputs a verifiable certificate-enabled syntax tree. This improves annotation accuracy and consistency, reduces manual costs, and enhances the interpretability and controllability of the pattern library.

[0008] This invention introduces constraints such as production rule consistency, stage monotonicity, and resource flow conservation / boundary into compressed parsed forests with shared subtree indexes for ADMM inference. This transforms the ambiguity resolution of the original behavior log from "unexplainable choices of a single tree" to "quantifiable, attributable, and constraint-consistent annotations," and achieves precise location of conflict sources using residual tensors aligned to "node-production rule-constraint type." Furthermore, this invention employs a fixed greedy cover to obtain the conflict-dominant subtree covering the main residuals and having the fewest nodes, performing manual verification only on this minimum conflict region. This significantly reduces the amount of manual review and iteration cycle while ensuring annotation consistency. Simultaneously, by retrieving residual fingerprints and reusing historical dual variables and penalty parameters for warm-start, it improves the convergence speed and stability in similar session scenarios and reduces the impact of different versions. The impact of data distribution drift caused by this activity on the inference process; in terms of rule evolution, this invention restricts grammar updates to three types of structured templates: stage guardrail factorization, resource annotation splitting, and same prefix factorization merging, and introduces residual upper bound descent gating and automatic rollback mechanism for the verification session set, so that rule iteration has the security of "interpretability, controllability, and reversibility", avoiding global pattern drift caused by local rewriting; finally, this invention outputs a certificate (stage / resource check set, dual upper bound summary, and failure location mapping) for the mined frequent subtree patterns, so that the policy engine can quickly verify the feasibility of constraints when triggered online and locate specific nodes and production rules when they fail, significantly reducing the problems of false triggering, violation triggering, and difficulty in backtracking, thereby improving the overall stability, interpretability, and controllability of the behavior pattern library in engineering implementation. Attached Figure Description

[0009] Figure 1 This is a schematic diagram of the functional module structure of the present invention;

[0010] Figure 2 This is a schematic diagram of the overall process of the method of the present invention;

[0011] Figure 3 This is a schematic diagram illustrating the relationship between residual fingerprint indexes and warm start calls;

[0012] Figure 4This is a schematic diagram of the ADMM multi-constraint inference and residual tensor generation process;

[0013] Figure 5 This is a schematic diagram illustrating the closed loop of templated production transformation, verification gating, and rollback safety evolution. Detailed Implementation

[0014] The technical solutions in the embodiments of the present invention will be clearly and completely described below. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the protection scope of the present invention.

[0015] I. Terminology Explanation

[0016] 1. Player Behavior Log: A collection of event data recorded and reported by the game client, server, or third-party SDK. It includes at least the event type, timestamp, player ID, session ID, and optional parameter fields (such as level ID, mission ID, item ID, quantity, gold / diamond changes, payment amount, team status, network status, etc.).

[0017] 2. Session: An event sequence obtained by aggregating the behavior logs of the same player within a continuous period of time according to boundary rules. Boundaries can be determined by login / logout events, disconnection / reconnection events, or time interval thresholds between adjacent events.

[0018] 3. Terminal symbol: A unit that maps a single event or group of events in a session to discrete symbols for use in syntax parsing. A terminal symbol can be composed of "event type + bucketed result of key parameters".

[0019] 4. Parameter bucketing: Discretize continuous or high cardinality parameters (quantity, amount, level number, etc.) into finite intervals or categories according to preset rules to reduce grammar complexity and enhance cross-version generalization.

[0020] 5. Behavioral Grammar: A set of formal rules used to describe the structure of player behavior sequences, including a set of non-terminal symbols, a set of terminal symbols, and a set of production rules.

[0021] 6. Production rules: Rules in a behavioral grammar used to expand non-terminal symbols into sequences of terminal symbols or non-terminal symbols, such as "phase → event sequence".

[0022] 7. Compressed Parsing Forest: A data structure that shares a compressed representation of multiple parsing results when the same terminal symbol sequence may correspond to multiple parsing structures; it can reuse the same substructure to avoid exponential expansion.

[0023] 8. Shared Subtree Index: An index table used to identify and reference isomorphic or equivalent substructures in a parsed forest. Index keys may include range position, non-terminal symbol type, stage candidate label, resource summary, etc.

[0024] 9. Hyperedge: A connection unit in a parsed forest that represents a parent node - production rule - list of child nodes, representing a single production rule application.

[0025] 10. Stage Tags: Tags used to identify the stage of a session, such as newbie tutorial, main story progression, social interaction, store activities, event gameplay, and return visit.

[0026] 11. Resource trajectory / resource flow: A sequence of resource quantities that change as events occur in a session sequence, such as stamina, tickets, gold coins, and the quantity of items.

[0027] 12. Constraint types: At least (but not limited to) the following three types: Production consistency constraint: Labels and production structure must be compatible; Stage monotonicity constraint: Stage labels remain monotonically increasing over time or allow finite jumps but not backtracking; Resource conservation / boundary constraint: Resources cannot be negative, consumption must be obtained first, changes do not exceed upper and lower bounds or satisfy conservation relations.

[0028] 13. ADMM Inference: Alternating Direction Multiplier Method (ADMM) iteratively solves constrained optimization problems within the augmented Lagrange framework. It can decompose the problem into local update, global projection, and dual update.

[0029] 14. Dual variables and penalty parameters: Iterative state variables in ADMM, used to adjust the strength of constraint consistency; the penalty parameter can also be adaptively adjusted with iteration.

[0030] 15. Residual Tensor: A set of inconsistency measures recorded with "node-production-constraint type" as the alignment dimension, reflecting the distribution of conflict intensity across structural locations and constraint types.

[0031] 16. Residual fingerprint: A searchable key formed by concatenating the session structure summary (n-gram summary, shared structure density summary) and the residual type distribution summary, used to retrieve historical convergence states and warm starts.

[0032] 17. Conflict Origin Graph: A graph constructed with "node-production-constraint type" as vertices and forest structure connections and shared index associations as edges, used to trace the source and propagation path of conflicts.

[0033] 18. Conflict-dominant subtree: A set of subtrees selected by a fixed greedy covering algorithm, covering the main residual quality with as few nodes as possible, to minimize the scope of manual verification.

[0034] 19. Structured Production Transformation Templates: Templated rewriting operators for production sets that are interpretable and auditable, including at least three types: stage guardrail factorization, resource annotation splitting, and factorization merging with the same prefix.

[0035] 20. Verification Session Set: A set of sessions sampled from historical sessions by version, channel, event, and player level, used to evaluate rule updates and serve as the basis for rollback gating.

[0036] 21. Upper bound of residuals: An aggregated index of the total residuals of each constraint type in the validation session set, used to determine whether the overall conflict level has decreased.

[0037] 22. Certificate-carrying behavior pattern library: A pattern library that binds and stores frequent subtree patterns with verifiable certificates; the certificate includes at least a check set, a dual upper bound digest, and a failure location mapping.

[0038] 23. Failure Location Mapping: When online verification fails, the "node-production-constraint type" that caused the failure is output for rollback, re-verification, or retraining loop closure.

[0039] II. System Structure

[0040] See Figure 1 The present invention provides an automatic annotation and behavior pattern mining system based on the syntax tree structure of player behavior logs, which may include the following functional modules:

[0041] Session mapping module: used for log cleaning, field normalization, session splitting, terminal mapping and parameter bucketing, outputting session terminal sequence and session metadata.

[0042] The parse forest building module is used to parse the terminal symbol sequence based on the behavioral grammar, build a compressed parse forest, and establish a shared subtree index.

[0043] Residual fingerprint retrieval module: used to calculate residual fingerprints and access the index table, and output the initial values ​​of the dual variables and penalty parameters required for warm start-up.

[0044] ADMM Constraint Inference and Residual Tensor Generation Module: Used to perform multi-constraint inference on parse forests, output node label posteriors and residual tensors, and write back the index table after convergence.

[0045] The conflict origin graph and conflict subtree solving module is used to construct the conflict origin graph and use a fixed greedy cover to find the conflict dominance subtree, and output the region to be verified and the set of related production rules.

[0046] Manual verification module: Used to issue conflict-dominant subtree verification tasks to annotators and collect correction results.

[0047] Templated production transformation and rollback acceptance module: Used to select transformation templates based on the dominant residual type, rewrite only the productions associated with conflicting regions, and perform gating judgment on the verification session set; if the conditions are not met, rollback is performed.

[0048] Parser write-back module: Used to publish and record the version chain of accepted grammar versions, parser parameters and index table changes.

[0049] Syntax Tree Normalization and Frequent Subtree Mining Module: Used to normalize and encode the labeled syntax tree and mine frequent subtree patterns.

[0050] Certificate Portability Mode Library Output Module: Used to generate certificates for each mode and output the certificate portability behavior mode library and failure location mapping interface.

[0051] See Figure 2 The overall system process can form a closed-loop technical route from steps S1 to S5:

[0052] Step S1 (Mapping and parsing forest) → Step S2 (ADMM inference and residual tensor + fingerprint warm start) → Step S3 (conflict tracing and minimum verification region) → Step S4 (template update + gating rollback) → Step S5 (normalization and certificate portability mode library).

[0053] See Figure 3 The residual fingerprint index table includes at least: fingerprint key, dual variable snapshot, penalty parameter snapshot, convergence round statistics, applicable scenario tags (version / activity / channel), and update timestamp; it supports two types of calling methods: exact match and similarity search.

[0054] See Figure 4 The ADMM inference process can be abstracted into three types of sub-processes: local structure update, global constraint projection, and dual variable update, and the computation is reused at the shared subtree to improve efficiency.

[0055] See Figure 5 Templated production transformation and rollback gating form a closed loop of security evolution: conflict localization → template selection → partial rewriting → verification session set evaluation → acceptance / rollback → version recording and auditing.

[0056] III. Specific technical route for implementing the method of the present invention (steps S1–S5)

[0057] Step S1: Session construction, terminal symbol mapping, and compressed parsing forest generation (combined) Figure 2 , Figure 1 )

[0058] Step S1 is used to convert the original player behavior log into a parsable sequence of terminal symbols and build a compressed parsing forest to support the resolution of ambiguities. The implementation of step S1 may include the following sub-steps:

[0059] (1) Log preprocessing and field normalization

[0060] The session mapping module first performs quality control and field normalization on the raw logs, including at least:

[0061] Unified event types: Map synonymous events from different channels or versions to a unified event type (e.g., unify "QuestFinish / TaskDone" to "TaskFinish").

[0062] Unifying key fields: Establish a field mapping table to map "level_id / StageId / MapID" and other fields to unified level fields.

[0063] Deduplication and error correction: Duplicate reports caused by network retries can be deduplicated by “event signature (event type + key parameter summary) + time window”; abnormal timestamp records can be corrected or removed.

[0064] Missing parameters handling: events with missing key parameters are filled with placeholders, and inferences are made from the context when necessary (for example, missing level IDs can be filled with "EnterLevel / ExitLevel" before and after).

[0065] (2) Session segmentation and sorting

[0066] Session segmentation rules can adopt a combination strategy: when login / logout events exist, they are used as the primary boundary; if there is no explicit boundary, the session is segmented based on the interval between adjacent events being greater than a threshold (e.g., 15–60 minutes); crash / forced exit / disconnection events can be used as boundary candidates, and whether to merge them is determined by combining short-term reconnection; after segmentation, events within the session are sorted by timestamp, and events within the same timestamp are determined to have a stable order by server sequence number or reception order.

[0067] (3) Terminal symbol mapping and parameter bucketing

[0068] To reduce grammar size and enhance generalization, step S1 maps each event to a terminal symbol. The terminal symbol consists of the following information: a base part: event type; and an optional enhancement part: the bucketing result of key parameters (such as quantity range, amount range, chapter bucket, item category bucket). For example, "ConsumeItem(item_id=xxx,qty=12)" can be mapped to "ConsumeItem@qty(8–15)@itemClass(A)"; "Pay(amount=30)" can be mapped to "Pay@amt(30–98)". The bucketing strategy can be a fixed rule or a configuration table maintained with each version. To ensure coding stability, the bucket definition and version mapping table are included in configuration management and the version number is recorded.

[0069] (4) Behavioral Grammar Organization and Version Management

[0070] Behavioral grammars can adopt a three-layer organizational structure: Session layer: describes the overall structure of the session, e.g., Session→StageSeq; Stage layer: describes the stage structure, e.g., Stage→TutorialStage|MainStage|SocialStage|ShopStage|EventStage; Event layer: describes the typical event sequence or optional structure within a stage, e.g., MainStage→EnterLevel…ExitLevel; The grammar is stored in a configurable format (e.g., JSON / YAML / database) and a version number is assigned for each change. Each production can be accompanied by metadata: applicable version, applicable scenario, source (automatically generated / manually maintained / template rewritten), and optional resource comments and stage attributes.

[0071] (5) Compressed parsing of forests and shared subtree indexes

[0072] The parsing forest building module performs parsing on the terminal symbol sequence. During parsing, multiple parsing structures (ambiguous parsing) are allowed for the same sequence, and these are compressed and stored using a shared subtree index: Forest nodes: at least contain non-terminal symbol types, interval positions (start and end indices), candidate label sets, lists of pointing to superedges, and lists of parent references; Superedges: record production IDs and lists of child nodes; Shared index: references are reused when homogeneous substructures (same interval, non-terminal symbol type, stage candidate, resource summary, etc.) occur, avoiding redundant construction. The key of the shared index can be selected according to project needs, but should at least contain "interval + non-terminal symbol type," and can be expanded to include "stage candidate and resource summary" to improve sharing accuracy and subsequent residual backpropagation accuracy. Step S1 outputs: session terminal symbol sequence, session metadata, compressed parsing forest, and shared subtree index.

[0073] Step S2: ADMM multi-constraint inference, residual tensor generation, and residual fingerprint warm start-up (combined) Figure 4 , Figure 3 )

[0074] Step S2 may include the following sub-steps:

[0075] (1) Residual fingerprint construction and warm start-up Figure 3 )

[0076] The residual fingerprint retrieval module constructs a residual fingerprint for the current session and retrieves historical convergence states. A residual fingerprint is formed by concatenating at least three types of summaries:

[0077] 1) Sequence structure summary: Statistical summary of n-gram terminal sequence (e.g., hash or sparse vector of 2-gram, 3-gram Top-K);

[0078] 2) Summary of Ambiguous Structures: Indicators reflecting the degree of ambiguity include the percentage of shared subtrees, average branching degree, and average number of superedges;

[0079] 3) Summary of residual type distribution: Vector of the proportion of stage inversion risk, resource out-of-bounds risk, and production incompatibility risk in the initial estimate.

[0080] The retrieval strategy can be two-level: prioritize exact hash hits; if no hit occurs, use similarity retrieval (such as cosine similarity or LSH nearest neighbor) to select the nearest neighbor index item. After a hit, reuse the snapshot of the dual variable and the snapshot of the penalty parameter saved by the index item as the initial value of ADMM; if no hit occurs, use the default initial value (e.g., set the dual variable to zero and take the empirical value of the penalty parameter).

[0081] The purpose of warm start is that similar session structures often produce similar constraint tension patterns. Reusing convergence states can reduce the number of iterations, reduce convergence oscillations, and improve stability when switching between different versions / activities.

[0082] (2) Constraint inference modeling and variable partitioning

[0083] When annotating on a parsed forest, "structure selection (hyperedge selection)" and "label assignment (stage, subtask, resource annotation)" can be unified as inference variables. To facilitate ADMM implementation, the variables are divided into: local variables: selections and labels related to a single node or a single hyperedge (mainly reflecting prior consistency and production consistency); global variables: stage sequences and resource trajectories across timelines or structures (mainly reflecting stage monotonicity and resource conservation / boundaries).

[0084] Constraint types include at least: Production consistency: for example, a non-terminal symbol in a certain stage can only be expanded into a specific set of events or a sub-stage structure; Stage monotonicity: stage labels do not regress as time progresses, allowing finite jumps; Resource constraints: resources cannot be negative, consumption must be obtained first, changes do not exceed upper and lower bounds, or conservation relationships are satisfied (e.g., revenue and consumption should be reconcilable).

[0085] (3) ADMM iterative solution process ( Figure 4 )

[0086] The ADMM constraint inference and residual tensor generation module can be implemented using an iterative framework of "local update - global projection - dual update":

[0087] 1) Local update (node / superedge level)

[0088] Under the condition of fixed dual variables and penalty parameters, local optimal updates are performed on each node and its candidate hyperedges, simultaneously considering: prior consistency (from the base labeler or rule scoring); production consistency (structure and label compatibility); and a penalty term consistent with global variables (reflected by the dual variables and penalty parameters). Local updates can be executed in parallel; the results of local updates can be reused for shared subtree structures to reduce redundant computation.

[0089] 2) Global Projection (Stages and Resources)

[0090] Under the condition of fixed local variables, the stage sequence and resource trajectory are projected onto a feasible set that satisfies the constraints: Stage monotonicity projection: Dynamic programming can be used to find the stage sequence that satisfies the monotonicity constraint and has the minimum cost on the time axis; Resource constraint projection: Resource changes are accumulated in the order of events. If negative resource values ​​or out-of-bounds errors occur, the resource annotations of relevant nodes or the selection of superedges that cause resource changes are modified to ensure that the resource trajectory satisfies the boundary constraints. The projection process outputs the modified global variables and can generate a "constraint violation location list," providing a basis for residual attribution.

[0091] 3) Dual variable update and penalty parameter adjustment

[0092] The dual variable is updated based on the degree of inconsistency between the local variable and the projection result, making the next iteration more consistent; at the same time, the penalty parameter can be adaptively adjusted according to the relative relationship between the original inconsistency and the magnitude of the dual update, making the convergence more stable.

[0093] 4) Termination conditions and convergence state write-back

[0094] Termination occurs when any of the following conditions are met: the upper bound of the residuals is below a threshold, the number of iterations reaches the upper limit, or the rate of decrease of the residuals is below a threshold. After termination, snapshots of the dual variables, penalty parameters, and the summaries of the convergence iterations and residual types are written back to the fingerprint index table for reuse in subsequent warm-start sessions.

[0095] (4) Generation method of residual tensor

[0096] Step S2 generates a residual tensor after each iteration or convergence. The residual tensor is aligned with the "Node-Production-Constraint Type" column, and its value is obtained by combining the original residual components and the dual residual components: Original residual components: For each hyperedge, calculate the local overlimit quantity or non-satisfaction degree (non-negative) caused by the hyperedge under each constraint type; then weight the overlimit quantity according to the posterior weight or confidence of the hyperedge; finally, aggregate the weighted result into the "Head Node-Production-Constraint Type" entry. Dual residual components: Calculate the norm or absolute increment for the update increment of the dual variables in two adjacent iterations, and decompose and aggregate according to "Node-Production-Constraint Type" to reflect the intensity of constraint tension change at that point. Shared subtree merging and backpropagation: Merge the isomorphic structure entries hit by the shared subtree index and backpropagate them to the parent node entries according to the structural contribution ratio, so that the conflict converges upward along the structure, which is convenient for tracing the source.

[0097] To facilitate gating assessment, a "residual upper bound" can be defined as a total aggregation indicator, one possible expression of which is:

[0098] ;

[0099] in: The upper bound of the residual; Constraint type; For type The set of residual entries below; For the first The residual strength of each item.

[0100] Step S2 outputs: Node label posterior, residual tensor, fingerprint index table update items, and convergence statistics.

[0101] Step S3: Conflict origination graph construction, fixed greedy cover algorithm for finding conflict-dominant subtrees, and manual verification (combined with...) Figure 2 , Figure 5 )

[0102] Step S3 is used to transform the residual tensor output in step S2 into an operable "minimum manual verification region" to reduce manual costs and improve iteration efficiency.

[0103] (1) Construction of conflict origin map

[0104] The conflict origination graph uses "node-production-constraint type" as vertices, with vertex weights corresponding to residual strengths. Edge construction rules include at least: structural expansion edges: edges are established between parent node entries and their child node entries, reflecting production expansion relationships; same-hyperedge association edges: associations are established between entries of different constraint types triggered by the same hyperedge, reflecting common-origin conflicts; shared-index association edges: associations are established between entries hitting the same subtree, reflecting the reuse and propagation of conflicts on shared structures. The origination graph supports tracing downwards from high residual vertices to leaf events, and also supports tracing upwards from leaf events to upper-level stages or session structures, thereby locating the root cause of the conflict.

[0105] (2) Definition of Coverage Residual Quality and Generation of Candidate Subtrees

[0106] For each candidate node in the parsed forest, generate its induced subtree (the maximum depth or time interval window can be limited to control the size). Define the "coverage residual quality" of the subtree as the deduplicated sum of the residual vertex weights within the coverage area of ​​the subtree. To avoid duplicate coverage, maintain the already covered set, and only count the uncovered portion when calculating the new coverage.

[0107] (3) Fixed greedy cover algorithm for finding conflict-dominant subtrees

[0108] This invention employs a fixed and reproducible greedy criterion: in each round, the candidate node with the largest increase in residual quality brought by each newly added node is added to the set until the coverage reaches a threshold. The algorithm can be implemented as follows: Initialize the conflict-dominant subtree set to empty and the covered set to empty; for each candidate node, calculate: the increase in residual quality and the number of newly added nodes; calculate the unity gain and select the largest one to add to the set; update the covered set and repeat; stop when the residual quality reaches a preset percentage threshold (e.g., 80% or 90%) of the total residual quality; output the conflict-dominant subtree set, the contribution ranking of each subtree, and the set of associated production rules.

[0109] (4) Manual verification task generation and feedback collection

[0110] The manual verification module generates verification tasks only for conflict-dominant subtrees. Each task includes at least: the session interval and event fragment corresponding to the node; candidate labels and their confidence levels, candidate production rules and resource annotations; warnings of triggered constraint violations (phase rollback, negative resources, incompatible production rules, etc.); and suggested actions (confirm / correct labels, reject a superedge, supplement resource annotations). The collected results are stored in a structured format, including corrected labels, confirmed production rule selections, corrected resource annotations, and remarks. This feedback is used for template selection and update decisions in step S4 and can also be used to update the prior labeled model.

[0111] Step S3 outputs: conflict-dominant subtree, set of associated production rules and contribution sorting, and manually verified feedback data.

[0112] Step S4: Templated production transformation, verification gating and rollback safety evolution (combined) Figure 5 )

[0113] Step S4 restricts rule updates to structured templates, limits the scope of application, and introduces verification gating and rollback to avoid rule drift and improve the controllability of deployment.

[0114] (1) Determination of dominant residual type and template selection

[0115] Aggregate residual entries covered by conflict-dominant subtrees by constraint type to determine the dominant residual type: if the stage monotonicity residual has the highest proportion or the greatest strength, select the stage guardrail factorization template; if the resource constraint residual has the highest proportion or the greatest strength, select the resource annotation split template; if the production consistency residual has the highest proportion or the greatest strength, select the same prefix factorization merge template; if there are multiple dominant types, they can be sorted by "strength × scope of influence" and combined applications are allowed, but the principle of minimum perturbation of "only acting on the production set associated with the conflict-dominant subtree" must be followed.

[0116] (2) Implementable rewriting methods for three types of structured production transformation templates

[0117] 1) Phased guardrail factorized template

[0118] The key non-terminal symbol is split into non-terminal symbols with stage indices according to stage number, and the expansion in the production rules is restricted to not allow stage backtracking, only allowing adjacent stage advancement or limited jumps. Engineering implementation can be achieved by: adding the "allowed stage set / adjacency relationship" attribute to the production rules; applying stage consistency checks to hyperedges during parsing, and reducing weights or pruning directly if the requirements are not met; the effect of this template is to resolve "stage reversal" conflicts in advance through structural constraints, reducing stage monotonicity residuals.

[0119] 2) Resource annotation split template

[0120] This template rewrites a one-step production rule into a two-step production rule, introducing intermediate non-terminal symbols that carry resource addition / reduction annotations, making resource changes explicit in the syntactic structure. Engineering implementation can be achieved by: attaching resource change rules (addition / reduction direction, quantity bucket, resource type) to intermediate non-terminal symbols; synchronously updating the resource trajectory during parsing / inference; and performing boundary checks at intermediate nodes. The effect of this template is to locate resource conflicts to explicit resource change nodes, improving interpretability and reducing the difficulty of subsequent verification.

[0121] 3) Prefix factorization merging template

[0122] Multiple productions with the same right-hand prefix are factored and merged, with branch non-terminal symbols introduced to handle different suffixes. In practice, candidate merge groups can be identified using prefix hash indexes, and new rules can be automatically generated. This template reduces redundancy and inconsistency, lowers production consistency residuals, and improves parsing stability.

[0123] (3) Verify session set gating and rollback acceptance

[0124] After template rewriting, the key inference process is re-executed on the validation session set before parser write-back (warm start can be used to accelerate this), and the updated upper bound of the residuals is calculated and compared with the one before the update. Acceptance conditions include at least: the upper bound of the residuals decreases by no less than a threshold; and at least two types of constraint residuals decrease simultaneously, or the distribution entropy of the residual type decreases.

[0125] One possible form of residual type distribution entropy is as follows:

[0126] ;

[0127] in: The residual type distribution entropy; For constraint type The proportion of residuals; This includes at least production consistency, stage monotonicity, and resource constraints. Decreasing entropy implies a more concentrated source of conflict and enhanced governability.

[0128] If the gating conditions are not met, a rollback is performed: the current production rule rewrite is undone, the grammar version and parser configuration are restored, and audit information (reason for failure, failure location mapping, and related session samples and template summaries) is recorded. If the gating conditions are met, the update is accepted and a new grammar version number is generated. The parser write-back module completes the release and records the version chain.

[0129] Step S4 outputs: accepted new grammar version or rollback result, gating assessment report, failure location mapping and audit log.

[0130] Step S5: Syntax tree normalization, frequent subtree mining, and certificate-carrying pattern library generation (combined with...) Figure 2 , Figure 1 )

[0131] Step S5 is used to solidify stable annotation results into reusable behavior patterns and provide verifiable certificates to support the reliability and auditability of online triggering.

[0132] (1) Annotation of syntax tree storage and version binding

[0133] For each session, the final annotated syntax tree is output (either a single best tree or a Top-N consistent tree), and the following are bound in storage: grammar version number, inferred version number, gating version number, session metadata, and timestamp to ensure traceability.

[0134] (2) Syntax Tree Normalization Encoding

[0135] The syntax tree normalization and frequent subtree mining modules uniquely encode the syntax tree, recommending a fixed traversal order to generate bracket sequences or equivalent codes: each node code should at least include a production rule ID, a node label ID, and a parameter bucket ID; a fixed sorting rule should be used for isomorphic subtrees (ascending order by production rule ID, then by child node position); explicit placeholders should be used for missing fields; and a bucket mapping table should be introduced to maintain encoding stability for version changes. Normalization ensures consistent representation of the same structure across different sessions and time windows, avoiding schema statistical bias.

[0136] (3) Frequent subtree mining

[0137] Frequent subtree mining is performed on a normalized tree set. The mining process may include: candidate generation: generating candidates based on subtree hashing or depth-first encoding; support statistics: counting the number of times or the proportion of candidates; stability filtering: introducing stability constraints across days, versions, and channels (e.g., satisfying the support threshold in at least two scenarios); output selection: outputting a set of patterns that satisfy the minimum support threshold and have high stability, and recording typical trigger windows and sensitive constraint types (constraint types that contribute the most to residuals within the pattern coverage).

[0138] (4) Certificate Portability Generation and Failure Location Mapping

[0139] The certificate-carrying pattern library output module generates a certificate for each pattern. The certificate includes at least: a normalized representation of the pattern subtree; a set of stage guardrail checks (stages cannot be rolled back, jump range constraints, etc.); a set of resource checks (resources cannot be negative, consumption must be acquired first, changes cannot exceed limits, etc.); a dual upper bound summary (reflecting the constraint pressure level of the corresponding structure of the pattern in inference, used for rapid online risk assessment); and a failure location mapping: when a pattern triggers a verification failure, it locates the "node-production-constraint type" that caused the failure to drive a rollback, re-verification, or retraining closed loop.

[0140] Step S5 output: Certificate-carrying behavior pattern library (pattern + certificate + failure location mapping interface) and its version information.

[0141] IV. Specific Application Examples: Automatic Annotation of Syntax Trees Based on Player Behavior Logs and Closed-Loop Verification of Abnormal Behavior Pattern Mining

[0142] 1. Application Scenarios and Data Sources

[0143] This embodiment uses the operational data of a large-scale online mobile game as an example. Player behavior logs are reported collaboratively by the client and the server, and the log fields include at least: event type. Event timestamp Player ID Session identifier Key parameter set (Level number, mission number, item number and quantity, changes in gold / diamonds, changes in stamina, payment amount, team status, network status, etc.).

[0144] The business objective is:

[0145] (1) Automatically generate syntax tree structure annotations at the conversation scale to obtain a stable sequence of stage labels (newbie, main line progress, social, mall, event, etc.) and satisfy the stage progress logic;

[0146] (2) Mine frequent subtree patterns of “abnormal resource brushing / scripted behavior” from the stable annotated syntax tree set, output the certificate with certificate for online trigger verification, reduce false triggering and support failure location and rollback.

[0147] 2. Dataset Construction and Partitioning

[0148] The dataset was constructed using 30 consecutive days of logs. The session segmentation rules are as follows: if a login / logout event exists, it is used as the boundary; if there is no explicit boundary, adjacent events with a time interval of more than 30 minutes are segmented; crash / forced exit / disconnection events are used as boundary candidates, and if they reconnect within 5 minutes, they are merged into the same session.

[0149] A total of 1,200,000 sessions were obtained, including 800,000 in the training set, 200,000 in the validation set, and 200,000 in the test set. Stratified sampling was performed on the validation and test sets to ensure coverage of players before and after version updates, different channels, different event cycles, and different payment tiers.

[0150] 3. System Configuration and Parameter Settings

[0151] (1) Terminal symbol mapping and parameter bucketing:

[0152] Quantity parameters (item quantity, gold coin changes, etc.) are divided into buckets {1, 2-3, 4-7, 8-15, 16+};

[0153] The monetary parameters (payment amount) are divided into buckets: {0, 0-6, 6-30, 30-98, 98+}.

[0154] Level numbers are bucketed by chapter and difficulty level (chapter number, difficulty level).

[0155] Terminators are encoded as “event type + parameter bucket ID”, for example, “ConsumeItem@qty(8-15)@itemClass(A)”.

[0156] (2) Initial Behavior Grammar:

[0157] The initial grammar contains 312 production rules, organized in three layers: "session layer - stage layer - event layer", and allows optional branches and loop structures within the stage (such as entering the level multiple times, repeatedly receiving rewards, etc.).

[0158] (3) Constraint settings:

[0159] Production consistency constraint: Phase non-terminal symbols are only allowed to expand to their set of valid events / substructures;

[0160] Stage monotonicity constraint: Stage labels allow finite jumps but do not allow backtracking;

[0161] Resource boundary constraints: Resources such as physical strength and tickets must not be negative; consumption events must have a source or sufficient balance; single-step resource changes must not exceed the upper limit threshold.

[0162] (4) Warm Startup and Indexing:

[0163] Residual fingerprints are formed by a sequence of terminal symbols. The abstract, the summary of the proportion of shared subtrees and the branching degree, and the summary of the initial residual type distribution are concatenated and hashed. The index table stores "fingerprint - dual variable snapshot - penalty parameter snapshot - convergence statistics".

[0164] (5) Gating and rollback:

[0165] The rule update gating condition is: the upper bound of the validation set residual decreases by ≥8%, and satisfies either "at least two types of residuals decrease simultaneously" or "the distribution entropy of the residual type decreases". If the condition is not met, the rule is rolled back.

[0166] 4. Implementation process of the method of the present invention

[0167] Step S1: Perform terminal symbol mapping for each session and build a compressed parsing forest, and establish a shared subtree index (range, non-terminal symbol, stage candidate, resource summary).

[0168] Step S2: Perform multi-constraint inference on the parsing forest using ADMM, and output the posterior node label and residual tensor; for similar sessions, warm-start reuse dual variables and penalty parameters are retrieved through residual fingerprint retrieval.

[0169] Step S3: Construct a conflict source graph, use a fixed greedy cover algorithm to find the conflict-dominant subtrees, so that they cover 90% of the total residual quality, generate manual verification tasks only for the subtree ranges and collect corrections.

[0170] Step S4: Select a structured template based on the dominant residual type (stage guardrail factorization, resource annotation splitting, and same prefix factorization merging), and only rewrite the set of production rules associated with conflict-dominant subtrees; evaluate the gating conditions on the validation set, and if they are met, accept and publish the new grammar version; if they are not met, roll back and record the failure location mapping.

[0171] Step S5: Normalize and encode the stable annotation syntax tree, mine frequent subtree patterns and generate certificate-carrying certificates (stage-checked set, resource-checked set, dual upper bound summary, failure location mapping), and output the certificate-carrying behavior pattern library for online strategy engine to call.

[0172] 5. Scale settings

[0173] To demonstrate the technical advantages of this invention over existing solutions, three comparative examples are provided:

[0174] Comparative Example 1 (C1): Only "regular expression / fixed template + sequence frequent pattern mining" is used, without syntax tree parsing, parsing forest, constraint inference and template rollback gating.

[0175] Comparative Example 2 (C2): Structured representation is achieved using "probabilistic grammar syntax tree / rule merging", but not using parsing forest shared representation, not using ADMM multi-constraint inference, and not performing residual tensor attribution and conflict-dominant subtree minimization verification.

[0176] Comparative Example 3 (C3, Ablation): The process of this invention is adopted, but "residual fingerprint warm start" and "verification gating rollback" are removed, that is, warm start is not adopted and template updates are directly accepted.

[0177] 6. Definition of Evaluation Indicators

[0178] (1) Phase monotonicity violation rate: The proportion of phase rollbacks that occur in test set sessions.

[0179] (2) Resource boundary violation rate: The proportion of sessions in the test set where resources are negative or "consumption has no source".

[0180] (3) Production inconsistency violation rate: The proportion of stage labels and production expansions that are incompatible in the test set session.

[0181] (4) Upper bound of residual (Normalization): The total residuals of the three types in the validation set are aggregated and normalized according to the comparison ratio 1.

[0182] (5) Manual verification workload: The average number of nodes pushed for manual verification per 10,000 sessions.

[0183] (6) Average inference iteration rounds: The average number of rounds in which ADMM reaches the termination condition.

[0184] (7) Online false trigger rate: The proportion of false alarms caused by certificate verification failure or review after the certificate portability mode is triggered.

[0185] (8) Abnormal sample recall rate: The proportion of abnormal resource brushing sessions marked by historical work orders that can be covered and triggered by the mining mode.

[0186] (9) Failure location rate: When an online failure is triggered, the proportion of cases where the specific "node-production-constraint type" can be located.

[0187] 7. Experimental Results

[0188] Table 1. Comparison of Consistency and Residuals (Test Set / Validation Set)

[0189]

[0190] Table 2 Comparison of Convergence Efficiency and Labor Costs

[0191]

[0192] Table 3 Comparison of Launch Trigger Effects (7-day Testing Period)

[0193]

[0194] 8. Results Analysis and Conclusions on Technical Effectiveness

[0195] As shown in Table 1, compared with Comparative Examples 1 and 2, this invention, by implementing multi-constraint inference on compressed parsing forests, achieves consistency in ambiguous parsing under three types of constraints: "production consistency, stage monotonicity, and resource boundaries." This significantly reduces the violation rates of stage backoff, resource out-of-bounds, and production incompatibility, while also verifying the upper bound of residuals. The significant decrease indicates a reduction in the overall conflict level and more stable and consistent annotation results.

[0196] As shown in Table 2, the present invention introduces residual fingerprint warm-start reuse of dual variables and penalty parameters, reducing the average number of iterations from 46 to 28. Furthermore, by using a conflict source graph and a fixed greedy cover to obtain the conflict-dominant subtree, the scope of manual verification is compressed to the minimum structural region covering the main residuals, thereby significantly reducing the number of manual verification nodes per 10,000 sessions and requiring fewer iterations after verification feedback, demonstrating significant advantages in engineering efficiency and maintainability.

[0197] As shown in Table 3, this invention mines frequent subtrees based on stable annotation trees and generates certificates with certificates, enabling rapid execution of stage and resource check verification before online triggering, significantly reducing the false trigger rate; at the same time, because the pattern structure is closer to the real behavioral logic, the recall rate of abnormal samples is higher; and with the help of failure location mapping, the cause of failure can be located to "node-production-constraint type", improving the efficiency of problem backtracking and rollback governance.

[0198] Therefore, this embodiment fully demonstrates that the present invention can achieve more consistent automatic annotation of syntax tree structure, lower manpower and iteration costs, more controllable mode online triggering and localizable failure backtracking in player behavior log scenarios, thereby achieving stable, interpretable and auditable technical effects.

[0199] The foregoing description of embodiments of the present invention, through which those skilled in the art are able to implement or use the present invention, will be readily apparent to those skilled in the art. Various modifications to these embodiments will be readily apparent to those skilled in the art. The general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the present invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novelty disclosed herein.

Claims

1. A method for automatic annotation and behavior pattern mining based on a syntax tree structure of player behavior logs, characterized in that, include: S1: Map player behavior log events to a sequence of terminal symbols per session, and build a compressed parsed forest with a shared subtree index based on the behavior grammar; S2: Establish an augmented Lagrangian constraint inference model on the analytical forest. The constraints include at least production consistency constraints, stage monotonicity constraints, and resource boundary constraints. The alternating direction multiplier method (ADMM) is used to iteratively solve the node label posterior and generate the residual tensor. The initial dual variable and penalty parameter of the ADMM are warm-started from the historical convergence state obtained by residual fingerprint retrieval. Production consistency constraint: Phase non-terminal symbols are only allowed to expand to their set of valid events or substructures; Stage monotonicity constraint: Stage labels allow finite jumps but do not allow backtracking; Resource boundary constraints: Stamina and ticket resources cannot be negative; consumption events must have a source or sufficient balance; single-step resource changes cannot exceed the upper limit threshold; The residual fingerprint is generated by concatenating the following three types of summary information and is used for retrieval: (1) n-gram statistical summary of the session terminator sequence; (2) Analyze the forest shared subtree ratio or shared structure density summary; (3) Summary of residual type distribution vector, wherein the distribution vector reflects at least the proportion of three types of residuals: production consistency, stage monotonicity and resource constraints; When the concatenated result is retrieved by hash or similarity to obtain a hit item, the dual variable and penalty parameter corresponding to the hit item are reused as the initial value of ADMM. When no hit is found, the default initial value is used and the new fingerprint and the corresponding convergence state are recorded. S3: Construct a conflict source graph using the residual tensor, and select the conflict-dominant subtree with the lowest number of nodes and a residual quality not lower than the threshold according to a fixed greedy coverage criterion. Only the conflict-dominant subtree is manually verified. S4: Only perform a preset structured production transformation template update on the production set associated with the conflict-dominant subtree, and determine whether the upper bound of the residual is monotonically decreasing on the verification session set. If the decreasing condition is not met, roll back the update. S5: Standardize the updated annotation syntax tree and mine frequent subtrees to generate a certificate-carrying behavior pattern library.

2. The method as described in claim 1, characterized in that: The conflict origination graph uses "node-production-constraint type" as vertices and the parse forest hyperedge connection relationship and shared subtree index relationship as edges; The fixed greedy cover criterion includes: (1) Define the total residual mass of the forest as the sum of all residual tensor entries; (2) Calculate the residual quality that can be covered by the induced subtree for each candidate node; (3) Starting from an empty set, iteratively select candidate nodes that can bring the "maximum gain of residual coverage per unit of newly added node" to add to the conflict-dominant subtree set until the residual quality covered by the set reaches or exceeds the preset ratio threshold. The conflict-dominant subtree, its associated production set, and residual contribution sorting are output to generate a manual verification task.

3. The method as described in claim 1, characterized in that: The residual tensor is aligned along the "node-production-constraint type" dimension and is obtained by a weighted combination of the original residual components and the dual residual components; wherein: (1) The calculation method of the original residual components is as follows: For each hyperedge in the parsing forest, calculate the local overlimit quantity or non-satisfaction degree of the hyperedge under each constraint type according to the initial label and constraint rules; the local overlimit quantity is represented in non-negative form; then the local overlimit quantity is weighted and accumulated by the posterior probability or weight of the hyperedge, and the accumulated result is collected into the "head node - production rule - constraint type" entry corresponding to the hyperedge. (2) The calculation method for dual residual components is as follows: calculate the norm or absolute increment of the update increment of dual variables in ADMM iteration, and decompose and collect them according to node-production-constraint type. (3) Merge the residual entries of the isomorphic structure at the shared subtree index, and backfeed the merged residuals to the parent node—production entries according to the super-edge posterior weight or structural contribution ratio.

4. The method as described in claim 1, characterized in that: The structured production transformation template includes only the following three types and is only allowed to operate on the production set associated with conflict-dominant subtrees: (1) Stage guardrail factorization template: Non-terminal symbols are split into non-terminal symbols with stage indexes according to stage number, and production expansion is restricted to advance only between adjacent stages to eliminate stage reverse residuals. (2) Resource flow annotation split template: rewrite the single-step production into a two-step production, and introduce intermediate non-terminal symbols carrying resource increase and decrease annotations, so that resource conservation or resource boundary constraints can be checked and satisfied at the intermediate non-terminal symbols. (3) Same prefix factorization merge template: Factorize and merge multiple productions with the same prefix, introduce branch non-terminal symbols to take over different suffixes, thereby reducing production inconsistency residuals; Template selection is determined based on the type of dominant constraint of residuals within the conflict-dominant subtree.

5. The method as described in claim 1, characterized in that: The rollback is accepted based on the upper bound of the residuals on the verification session set, which is defined as the aggregate value of the total residual components for each constraint type. The updated grammar must satisfy: (1) Verify that the upper bound of the residuals on the session set decreases by no less than a preset threshold compared to before the update; and (2) The residuals of at least two types of constraints decrease simultaneously, or the entropy of the residual type distribution decreases; Otherwise, cancel this production rule rewriting and parser write-back; The certificate-carrying behavior pattern library outputs a certificate for each pattern. The certificate includes at least: a normalized representation of the pattern subtree, a set of stage guardrail checks, a set of resource checks, a summary of the dual upper bound, and a failure location map. The failure location map at least indicates the node that caused the verification failure, the production rule, and the constraint type.

6. A system for automatic annotation and behavior pattern mining based on a syntax tree structure of player behavior logs, the system being used to implement the method described in any one of claims 1-5, characterized in that, include: The module includes a session mapping module, a parsing forest construction module, a residual fingerprint retrieval module, an ADMM constraint inference and residual tensor generation module, a conflict source graph construction module, a conflict subtree greedy solution module, a manual verification module, a templated production rule transformation and rollback acceptance module, a parser write-back module, a syntax tree normalization and frequent subtree mining module, and a certificate-carrying pattern library output module.

7. The system as described in claim 6, characterized in that: The residual fingerprint retrieval module establishes an index table of "residual fingerprint - dual variable - penalty parameter". When the retrieval hits, it sends the initial value of the start-up to the ADMM constraint inference and residual tensor generation module. After each round of ADMM convergence, the index table is updated to reuse the convergence state and the adaptive result of the penalty parameter. The templated production rule transformation and rollback acceptance module includes: a template selection unit, a verification and evaluation unit, and a rollback unit; the verification and evaluation unit calculates the upper bound of the residuals and the distribution entropy of the residual types on the verification session set and determines whether the acceptance conditions are met; the rollback unit cancels the production rule rewriting, parameter rewriting, and the resulting parser structure changes when the acceptance conditions are not met; the certificate-carrying pattern library output module outputs certificates and failure location mappings while outputting frequent subtree patterns, so that the external policy engine can perform verification based on the stage guardrail check set and resource check set in the certificate when the pattern is triggered, and use the failure location mapping to locate the node-production rule-constraint type when the verification fails to trigger the rollback, re-verification, or retraining process.

8. A computer device, characterized in that, The computer device includes a processor, a graphics processing unit (GPU), and a memory, wherein the memory stores a computer program that, when executed by the processor and the GPU, causes the computer device to perform the method as described in any one of claims 1 to 5.

9. A computer-readable storage medium having a computer program stored thereon, the computer program, when executed by a computer device, causing the computer device to perform the method as described in any one of claims 1 to 5.

Images