Big data processing method and device and management system

Abstract

The invention provides a big data processing method and device and a management system, and the method comprises the steps: obtaining associated data entries with timestamp marks from a plurality of different data sources, and carrying out the entity association network construction of the associated data entries based on the unique identification information of entity objects; generating a heterogeneous association network comprising multiple types of entity nodes and attribute association edges, performing multi-path parallel traversal analysis on the heterogeneous association network, extracting abnormal association path features existing in the network, inputting the abnormal association path features into a preset deep feature fusion model, and performing cross-dimension feature recombination and nonlinear mapping processing to obtain a deep feature fusion model; and generating an anomaly evaluation feature vector, and outputting a comprehensive evaluation result containing an anomaly degree quantized value and an anomaly type identifier according to a matching analysis result of the anomaly evaluation feature vector and a preset reference feature template set. The practicability and pertinence of big data association analysis processing can be improved.

Description

Technical Field

[0001] This application relates to the field of data processing, and more particularly to a big data processing method, apparatus and management system. Background Technology

[0002] With the advancement of digital transformation in the used car industry, processing the scattered transaction, consultation, and vehicle status data on used car platforms can uncover the logical connections between different entities, yielding assessment results that reflect anomalies in transaction relationships. Currently, the common approach is to acquire the platform's relational data to be analyzed, directly analyze the surface content of the data, and perform preliminary classification and aggregation according to transaction time or vehicle ownership before directly outputting the correlation analysis results. However, this type of analysis often only focuses on the surface-level correlations, failing to structurally analyze the interaction logic between buyers and sellers, intermediaries, and vehicle resources on the platform. This results in the analysis failing to accurately reflect the deep-seated changes in relationships between different entities, making it difficult to effectively identify abnormal relationships hidden in the regular transaction interaction logic. Consequently, it cannot provide a reliable basis for platform risk management and compliance supervision. Therefore, how to conduct more accurate used car big data correlation analysis and uncover the deep-seated changes in relationships between platform entities has become a research hotspot in the field of digital operations for used cars. Summary of the Invention

[0003] This invention provides a big data processing method, apparatus, and management system.

[0004] In a first aspect, embodiments of the present invention provide a big data processing method, the method comprising: The system acquires timestamped associated data entries from multiple different data sources. These entries contain interaction records and attribute descriptions between different entity objects. Based on the unique identifiers of the entity objects, it constructs an entity association network for these data entries, generating a heterogeneous association network containing multiple types of entity nodes and attributed association edges. The attributed association edges include interaction time features and interaction strength features. The system performs multi-path parallel traversal analysis on the heterogeneous association network to extract abnormal association path features, which include path length features, node type sequence features, and edge attribute change features. These abnormal association path features are input into a preset deep feature fusion model for cross-dimensional feature recombination and nonlinear mapping processing, generating an anomaly evaluation feature vector containing multi-dimensional anomaly evaluation parameters. Based on the matching analysis results between the anomaly evaluation feature vector and a preset set of benchmark feature templates, the system outputs a comprehensive evaluation result containing anomaly degree quantification and anomaly type identifier.

[0005] Secondly, embodiments of the present invention provide a big data processing apparatus, comprising: a data acquisition module, configured to acquire timestamped associated data entries from multiple different data sources, wherein the associated data entries contain interaction records and attribute description information between different entity objects; a network construction module, configured to construct an entity association network for the associated data entries based on the unique identification information of the entity objects, generating a heterogeneous association network containing multiple types of entity nodes and attributed association edges, wherein the attributed association edges contain interaction time features and interaction intensity features; a feature extraction module, configured to perform multi-path parallel traversal analysis on the heterogeneous association network, extracting abnormal association path features existing in the network, wherein the abnormal association path features contain path length features, node type sequence features, and edge attribute change features; a reconstructing and mapping module, configured to input the abnormal association path features into a preset deep feature fusion model, perform cross-dimensional feature reconstructing and nonlinear mapping processing, and generate an abnormal evaluation feature vector containing multi-dimensional abnormal evaluation parameters; and a matching analysis module, configured to output a comprehensive evaluation result containing an abnormality degree quantification value and an abnormality type identifier based on the matching analysis results of the abnormal evaluation feature vector and a preset benchmark feature template set.

[0006] Thirdly, embodiments of this application provide a management system, including: a memory for storing computer-executable instructions or computer programs; and a processor for executing the computer-executable instructions or computer programs stored in the memory to implement the big data processing method described above.

[0007] The embodiments of this application have the following beneficial effects: This invention acquires associated data entries from multiple different data sources and constructs a heterogeneous association network containing multi-type entity nodes and attributed association edges based on the unique identifier information of entity objects. This allows the constructed network to carry dynamic interaction information between entity objects, rather than merely reflecting static entity connections. It organically binds the interaction records and attribute information of the same entity scattered across different data sources, avoiding information fragmentation between different data sources. During multi-path parallel traversal analysis of the heterogeneous association network, abnormal association path features are extracted simultaneously. This allows for the simultaneous capture of complete path information during traversal, avoiding information loss caused by separately processing path traversal and feature extraction. This ensures that the extracted abnormal association path features fully reflect the abnormal association logic in the network. Inputting the abnormal association path features into a preset deep feature fusion model for cross-dimensional feature recombination and nonlinear mapping processing allows for the organic fusion of abnormal association features from different dimensions, generating an abnormal evaluation feature vector that reflects multi-dimensional evaluation information of abnormal associations. This allows the generated feature vector to integrate the structure, sequence, and dynamic change information of the path, comprehensively covering various performance information of abnormal associations. After matching and analyzing the anomaly assessment feature vector with the preset benchmark feature template set, a comprehensive assessment result is output. This can align the assessment result of anomaly association with the preset benchmark logic. The output comprehensive assessment result can simultaneously reflect the quantitative situation and type information of anomaly association, helping users to clearly understand the specific manifestation of anomaly association. This allows them to take appropriate processing strategies for different types of anomaly association, thereby improving the practicality and pertinence of big data association analysis and processing. Attached Figure Description

[0008] Figure 1 This is a schematic diagram of the architecture of the application scenario provided in the embodiments of this application; Figure 2 This is a schematic diagram of the structure of the management system provided in the embodiments of this application; Figure 3 This is a flowchart illustrating the big data processing method provided in the embodiments of this application. Detailed Implementation

[0009] See Figure 1 , Figure 1 This is an architectural diagram of an application scenario provided in this application embodiment. The data platform 400 is connected to the management system 200 through the network 300. The network 300 can be a wide area network or a local area network, or a combination of the two, and data transmission is achieved using wireless or wired links.

[0010] Among them, the data platform 400 includes servers from various data sources, such as management systems for used car trading websites and offline used car trading stores, and databases for vehicle inspection agencies, etc.

[0011] In some embodiments, the management system 200 may be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks (CDN), and big data and artificial intelligence platforms.

[0012] The management system implementing the big data processing method provided in the embodiments of this application will be described next. See [link to documentation]. Figure 2 , Figure 2 This is a schematic diagram of the structure of the management system provided in the embodiments of this application. Figure 2 The management system shown includes at least one processor 210, a memory 250, at least one network interface 220, and an external interface 230. The various components in the management system 200 are coupled together via a bus system 240. It is understood that the bus system 240 is used to implement communication between these components. In addition to a data bus, the bus system 240 also includes a power bus, a control bus, and a status signal bus. However, for clarity, ... Figure 2 The general labeled all buses as Bus System 240.

[0013] Processor 210 can be an integrated circuit chip with signal processing capabilities, such as a general-purpose processor, a digital signal processor (DSP), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. Among them, the general-purpose processor can be a microprocessor or any conventional processor, etc.

[0014] External interface 230 may include, for example, one or more speakers and / or one or more visual displays. External interface 230 may also include one or more input devices 432, such as a keyboard, mouse, microphone, touch screen display, camera, etc.

[0015] The memory 250 may be removable, non-removable, or a combination thereof. Exemplary hardware devices include solid-state storage, hard disk drives, optical disk drives, etc. The memory 250 may optionally include one or more storage devices physically located away from the processor 210.

[0016] The memory 250 may include volatile memory or non-volatile memory, or both. The non-volatile memory may be read-only memory (ROM), and the volatile memory may be random access memory (RAM). The memory 250 described in this application embodiment is intended to include any suitable type of memory.

[0017] In some embodiments, memory 250 is capable of storing data to support various operations, examples of which include programs, modules, and data structures or subsets or supersets thereof, as illustrated below.

[0018] Operating system 251 includes system programs for handling various basic system services and performing hardware-related tasks, such as the framework layer, core library layer, driver layer, etc., for implementing various basic business functions and handling hardware-based tasks; The network communication module 252 is used to reach the data platform via one or more (wired or wireless) network interfaces 220, exemplary network interfaces 220 including: Bluetooth, WiFi, and Universal Serial Bus (USB), etc. Presentation module 253 is configured to enable the display of information (e.g., external interface for operating peripheral devices and displaying content and information) via one or more output devices 231 (e.g., display screen, speaker, etc.) associated with external interface 230; The input processing module 254 is used to detect and translate one or more user inputs or interactions from one or more input devices 232.

[0019] In some embodiments, the apparatus provided in this application can be implemented in software. Figure 2 A large data processing device 255 stored in memory 250 is shown. This device can be software in the form of programs and plug-ins, and includes the following software modules: a data acquisition module 2551, a network construction module 2552, a feature extraction module 2553, a reconstructed mapping module 2554, and a matching analysis module 2555. These modules are logically connected and can therefore be arbitrarily combined or further divided according to their implemented functions. The functions of each module will be described below.

[0020] Based on the above description of the application scenarios and management system provided in the embodiments of this application, the big data processing method provided in the embodiments of this application is described below. In actual implementation, the big data processing method provided in the embodiments of this application can be implemented by a management system. See also Figure 3 , Figure 3This is a flowchart illustrating the big data processing method provided in the embodiments of this application. Next, it will be combined with... Figure 3 The steps shown are explained.

[0021] Step S100: Obtain timestamped associated data entries from multiple different data sources. The associated data entries contain interaction records and attribute description information between different entity objects.

[0022] The following embodiments use used car platform data processing as an example. In these embodiments, multiple different data sources can be used car trading websites, offline used car trading store management systems, vehicle inspection agency databases, etc. Timestamps record the specific time the data was generated. Related data entries are data sets that have some kind of relationship with each other. Different entities can be used cars, sellers, buyers, vehicle inspection agencies, etc. Interaction records reflect the interactions between these entities. For example, actions such as sellers posting vehicle information, buyers viewing vehicle details, and vehicle inspection agencies inspecting vehicles all belong to interaction records. Attribute description information provides a detailed description of the characteristics of the entity. For used cars, attribute description information may include vehicle brand, model, year, mileage, and vehicle condition; for sellers, it may include the seller's credit rating and transaction history; for buyers, it may include the buyer's purchasing preferences and budget.

[0023] For data from used car trading websites, web crawler technology can be used to automatically extract webpage information. By writing a web crawler program, specifying the URL of the used car trading website to be accessed, and the data fields to be extracted, such as vehicle title, price, and posting time, the crawler will automatically access the webpage, parse the HTML code, extract the required data, and store it in a local database. Simultaneously, it will record the timestamp of the data during the crawling process. For the management systems of offline used car trading stores and the databases of vehicle inspection agencies, data can be obtained through data interfaces. These systems typically provide API interfaces. By calling the API interface and passing in the corresponding parameters, such as query conditions and data format, the required related data entries can be obtained. For example, when obtaining used car inspection report data, by calling the API interface of the vehicle inspection agency's database and passing in the vehicle's unique identifier, the inspection report for that vehicle, including the inspection time (timestamp), inspection items, and results, can be obtained. It's easy to understand that the data obtained is all from public channels and is legally and compliantly acquired.

[0024] Step S200: Based on the unique identification information of entity objects, construct an entity association network for associated data entries, and generate a heterogeneous association network containing multiple types of entity nodes and attributed association edges. The attributed association edges contain interaction time features and interaction intensity features.

[0025] The unique identifier of an entity is information that can uniquely identify an entity. In the data processing of a used car platform, for a used car, its Vehicle Identification Number (VIN) is the unique identifier; for sellers and buyers, it could be their registered account ID; for vehicle inspection agencies, it could be their agency code. An entity association network is a network structure used to represent the relationships between entity objects. By constructing an entity association network, the interactions between entity objects can be more clearly displayed. Multiple entity nodes represent different types of entity objects, such as the used cars, sellers, buyers, and vehicle inspection agencies mentioned above. Attributed association edges are the edges connecting entity nodes, and these edges have attribute information. Interaction time features record the time when interactions between entity objects occur, while interaction intensity features reflect the frequency or importance of interactions between entity objects. For example, sellers frequently updating vehicle information, or buyers repeatedly viewing the details of the same vehicle, can demonstrate strong interaction intensity.

[0026] In one implementation, step S200 may specifically include the following steps S210 to S260: Step S210: Extract the time series of entity interactions from the associated data entries, group the interaction records with consecutive time intervals into the same cluster, and output the time cluster associated data entry group. Each time cluster associated data entry group contains entity interaction records with similar times and corresponding attribute description information.

[0027] A time series of entity interactions is a record of interactions between entity objects arranged chronologically. In used car platform data processing, actions such as sellers posting vehicle information at different times and buyers viewing vehicle details at different times, arranged chronologically, form a time series of entity interactions. Continuous time intervals mean that the time intervals between interaction records are within a small range. Grouping such interaction records into clusters facilitates subsequent analysis by grouping interactions that are close in time. Time cluster-associated data entry groups are the results of this grouping; each group contains entity interaction records that are close in time and their corresponding attribute descriptions.

[0028] Extracting the time series of entity interactions can be achieved by sorting the timestamps of associated data entries. First, extract the timestamp information from the associated data entries. Then, sort the timestamps using a sorting algorithm (such as quicksort). Simultaneously, arrange the corresponding interaction records and attribute descriptions according to the sorted timestamp order. This yields the time series of entity interactions. When grouping interaction records with consecutive time intervals into the same cluster, a time interval threshold can be set, for example, a threshold of 1 day. Traverse the sorted time series; when the time interval between two adjacent interaction records is less than or equal to 1 day, group them into the same cluster; when the time interval is greater than 1 day, start a new cluster.

[0029] Step S220: Bind the entity attribute description information in each time cluster associated data entry group to the corresponding time cluster label, attach the time cluster imprint to the attribute information, and output the attribute-time cluster binding set. Each set entry contains entity attributes and corresponding time cluster labels.

[0030] A time cluster label is a unique identifier for each time cluster; it can be a number or a specific name. Binding entity attribute descriptions to their corresponding time cluster labels means associating the entity attribute descriptions in each time cluster's associated data entry group with the label for that time cluster. This clearly identifies which time cluster each entity attribute was generated within. The attribute-time cluster binding set is the result of this binding; each set entry contains the entity attribute and its corresponding time cluster label.

[0031] Binding can be implemented programmatically. First, assign a unique time cluster label to each time cluster-associated data entry group. Then, iterate through each time cluster-associated data entry group, combining the entity attribute description information with the corresponding time cluster label to form a new data entry, and store it in a collection.

[0032] Step S230: Extract the inter-entity interaction records from the time cluster associated data entry group, convert the inter-entity interaction records into temporary edges connecting entity nodes, add corresponding time cluster labels to the temporary edges, and output a set of temporary edges with time labels. Each temporary edge is associated with two entity nodes and a time cluster label.

[0033] Inter-entity interaction records reflect the interactive operations between different entity objects. When referring to them, they can be transformed into the form of edges in a graph structure. Temporary edges are edges that have not undergone further processing and are used in this step to represent the interaction relationships between entity nodes. Adding corresponding time cluster labels to temporary edges is to record the time range in which the interaction relationship occurs, facilitating subsequent analysis of entity associations at different time stages. The set of time-labeled temporary edges is a set containing all temporary edges and their corresponding time cluster labels. Each temporary edge is associated with two entity nodes and their corresponding time cluster labels.

[0034] When extracting inter-entity interaction records from the time-clustered data entry group, the records are filtered based on their characteristics. For example, in a used car transaction scenario, if a record contains interaction information between a seller and a buyer, such as a buyer viewing vehicle details posted by a seller, it can be extracted as an inter-entity interaction record. When converting the inter-entity interaction record into a temporary edge connecting entity nodes, the two entity objects in the interaction record are used as the two endpoints of the edge. For example, if a buyer views vehicle details posted by a seller, then the buyer and seller are the two endpoints of the temporary edge. When adding a corresponding time-cluster label to the temporary edge, the time-cluster label to which the interaction record belongs is directly obtained from the time-clustered data entry group and added to the temporary edge's attributes. For example, if the interaction record belongs to "cluster 2", then "cluster 2" will be added as the time-cluster label to the generated temporary edge. Finally, all generated time-labeled temporary edges are stored in a set, and the time-labeled temporary edge set is output.

[0035] Step S240: Connect the time-labeled temporary edges belonging to the same entity node in the order of time clusters, connect the temporary edges of different time clusters in the time sequence, and output a set of time-series entity connection sequences, where each sequence contains the cross-time cluster connection path of the entity node.

[0036] The temporal cluster order is based on the chronological order represented by the time cluster labels. Temporary edges with time labels belonging to the same entity node are all temporary edges connected to that entity node, and these temporary edges also carry time cluster labels. Concatenating temporary edges from different time clusters according to their time sequence connects the interactions of the same entity node across different time clusters in chronological order, forming a continuous connection path. The temporally sequenced entity connection sequence set is the result of this concatenation; each sequence contains cross-time cluster connection paths for entity nodes.

[0037] To implement the concatenation, the set of time-labeled temporary edges is first sorted according to the chronological order of time clusters. This sorting can be based on the time information contained in the time cluster labels; for example, if the time cluster labels are named according to the timestamp sequence number, then they can be directly sorted by sequence number. Then, each entity node is traversed, and all time-labeled temporary edges connected to that entity node are found. These temporary edges are then concatenated according to the sorted chronological order. All cross-time cluster connection paths of all entity nodes are stored in a set, and the resulting time-series entity connection sequence set is output.

[0038] Step S250: Perform cross-cluster cross-association on the temporally sequenced entity connection sequences, merge connection sequences involving the same entity in different time clusters, retain the entity connection relationships across time clusters, and output a set of cross-cluster merged connection sequences, each sequence containing cross-cluster entity connection relationships.

[0039] Cross-cluster cross-association involves analyzing and processing connection sequences within different time clusters to identify and merge sequences involving the same entity. Connection sequences involving the same entity in different time clusters may have partial overlap or continuation. Merging these sequences provides a more comprehensive view of the entity's cross-time cluster connections. The merged cross-cluster connection sequence set is the result of this merging; each sequence contains cross-cluster entity connections, reflecting the overall interaction between an entity and other entities at different time stages.

[0040] When performing cross-cluster cross-associations, the time-series entity connection sequence set is first traversed to identify connection sequences involving the same entity. The unique identifier of the entity node can be used to determine if they belong to the same entity. For example, for the entity "seller," all connection sequences related to that seller are identified by its account ID. Then, these connection sequences are merged. During merging, the temporal order of the connection sequences and the consistency of the connection relationships are considered. For example, if a seller has a connection with buyer A in "cluster 1," and then a new connection exists between the seller and buyer A in "cluster 2," these two connections are integrated during merging to form a continuous cross-cluster connection: Seller-Buyer A (Cluster 1-Cluster 2). After merging all connection sequences involving the same entity, they are stored in a set, and the merged cross-cluster connection sequence set is output.

[0041] Step S260: Transform the cross-cluster merged connection sequence into a structured network, with entities as nodes and cross-cluster merged connections as edges. Add time clusters and interaction feature attributes to the edges, and output a heterogeneous association network containing multiple types of entity nodes and attributed association edges.

[0042] Structured networks are networks with a clear structure and rules. Transforming cross-cluster merged connection sequences into structured networks can more clearly display the relationships between entities. Entities are treated as nodes, such as used cars, sellers, buyers, and vehicle inspection agencies; cross-cluster merged connections are treated as edges. Adding time clusters and interaction feature attributes to edges further enriches their information. Time cluster attributes record the time range in which the connection occurred, while interaction feature attributes record the strength of the interaction between entities. Heterogeneous relational networks contain various types of nodes and edges. In used car platform data processing, different types of entity nodes and attributed edges constitute a heterogeneous relational network.

[0043] In one implementation, step S260 may specifically include the following steps S261 to S266: Step S261: Extract the cross-cluster connection frequency of each entity node from the cross-cluster merged connection sequence set, bind the cross-cluster connection frequency to the corresponding entity node, and output the node-cross-cluster connection frequency binding set. Each set entry contains the entity node identifier and the corresponding cross-cluster connection frequency.

[0044] Cross-cluster connection frequency refers to the number of times an entity node connects to other entity nodes within different time clusters. In the data processing of a used car platform, for example, if a seller node establishes connections with different buyer nodes within multiple time clusters, then the number of these connections is the seller node's cross-cluster connection frequency. Binding the cross-cluster connection frequency to the corresponding entity node allows for the quantification and recording of each entity node's cross-cluster connection activity. The node-cross-cluster connection frequency binding set is the result of this binding; each entry in the set contains the entity node's identifier and its corresponding cross-cluster connection frequency.

[0045] When extracting the cross-cluster connection frequency for each entity node from the cross-cluster merged connection sequence set, the set is traversed, and the number of connections associated with each entity node is counted. This can be done using the unique identifier of the entity node. For example, for a seller node, its account ID is used to identify all cross-cluster connection sequences associated with that seller, and the number of these sequences is counted; this is the cross-cluster connection frequency for that seller node. The identifier of each entity node and its corresponding cross-cluster connection frequency are combined into a new data entry and stored in a set, outputting a node-cross-cluster connection frequency binding set.

[0046] Step S262: Divide the entity nodes according to the time span of cross-cluster connections, group entity nodes with similar time spans into the same group, and output the time span node group set. Each group contains entity nodes with similar time spans and corresponding attribute information.

[0047] The time span of cross-cluster connections refers to the range of time within which entity nodes connect to each other across different time clusters. For example, if a seller node has connections to buyer nodes from "cluster 1" to "cluster 5," then its cross-cluster connection time span is "cluster 1-cluster 5." Grouping entity nodes with similar time spans into the same group is for the purpose of classifying entity nodes, facilitating subsequent analysis of the characteristics and behaviors of entity nodes across different time spans. The time span node group set is the result of this grouping; each group contains entity nodes with similar time spans and their corresponding attribute information.

[0048] During the partitioning process, the cross-cluster connection time span of each entity node is first calculated. This can be determined by the time cluster attributes of the edges in the cross-cluster merged connection sequence. For example, for a seller node, if the time cluster attributes of the edges in its cross-cluster merged connection sequence are "cluster 2-cluster 4", then the cross-cluster connection time span of this seller node is "cluster 2-cluster 4". Then, a threshold for time span similarity is set; for example, a time span with 80% overlap is considered similar. All entity nodes are traversed, and entity nodes with similar time spans are grouped into the same group. For example, seller A's cross-cluster connection time span is "cluster 1-cluster 5", and seller B's cross-cluster connection time span is "cluster 2-cluster 6". Since their time spans overlap to some extent and exceed the set threshold, seller A and seller B are grouped into the same group. Simultaneously, the attribute information of the entity nodes within each group is stored together in that group, outputting the time span node group set.

[0049] Step S263: Filter the cross-cluster merged connection sequences of each time span node group, retain the cross-cluster connections whose connection intervals conform to the time span range, and output a set of time-series filtered cross-cluster connection sequences, each sequence containing cross-cluster connections that conform to the time span.

[0050] The connection interval is the time interval between two adjacent connections in a cross-cluster merged connection sequence. Filtering the cross-cluster merged connection sequences involves selecting cross-cluster connections whose connection intervals conform to the time span range of the node group. The time-series filtered cross-cluster connection sequence set is the filtered result; each sequence contains cross-cluster connections that conform to the time span, thus removing some connections that do not follow a temporal pattern and making subsequent analysis more accurate.

[0051] When filtering, first define the time span range for each time span node group. This can be determined based on the cross-cluster connection time span of the entity nodes within that group. For example, for a time span node group with a time span of "cluster 3-cluster 6", filter out connections in the cross-cluster merge connection sequence whose connection intervals fall within this time span. For each connection in the cross-cluster merge connection sequence, the connection interval can be determined by the time cluster attribute of its edges. For example, if a connection's time cluster attribute is "cluster 4-cluster 5", which falls within the time span of "cluster 3-cluster 6", then this connection will be retained; however, if a connection's time cluster attribute is "cluster 7-cluster 8", which is outside the time span, then this connection will be filtered out. Store all cross-cluster connection sequences that meet the time span requirements in a set, and output the time-series filtered cross-cluster connection sequence set.

[0052] Step S264: Associate the temporal filtering cross-cluster connection sequence with the corresponding time span node group, take the entities in the node group as nodes and the temporal filtering connection as edges, generate dynamic sub-networks, and output a set of dynamic sub-networks. Each sub-network contains entity nodes and connection edges of the same time span.

[0053] The time-series filtered cross-cluster connection sequence is associated with the corresponding time span node group, that is, the filtered cross-cluster connection sequence is linked to the entity nodes in the corresponding time span node group. Using entities within the node group as nodes and time-series filtered connections as edges, a subnetwork is constructed. A dynamic subnetwork is a subnetwork structure within a certain time range, reflecting the relationships between entities within that time span. The dynamic subnetwork set is the collection of all generated dynamic subnetworks, each containing entity nodes and connecting edges within the same time span.

[0054] During the association process, each time span node group is first traversed to find the corresponding temporal filtering cross-cluster connection sequence. Matching can be performed using time cluster labels and the unique identifiers of entity nodes. For example, for a time span node group with a time span of "cluster 4-cluster 6", find temporal filtering cross-cluster connection sequences whose time cluster labels are within the range of "cluster 4-cluster 6" and involve entity nodes within that node group. Then, using the entity nodes within the node group as nodes and the matched temporal filtering connections as edges, a dynamic subnetwork is constructed. All generated dynamic subnetworks are stored in a set, and the dynamic subnetwork set is output.

[0055] Step S265: Perform spatiotemporal alignment on the subnetworks in the dynamic subnetwork set, map the time cluster labels of different subnetworks to a continuous time axis, align the time dimensions of the subnetworks, and output a spatiotemporally aligned dynamic subnetwork set with a unified time axis for each subnetwork.

[0056] Spatiotemporal alignment unifies the processing of different sub-networks along the time dimension, giving them a continuous timeline. The time cluster labels of different sub-networks may be discontinuous or overlapping; by uniformly mapping them to a continuous timeline, it becomes easier to compare and analyze the relationships between different sub-networks. A spatiotemporally aligned dynamic sub-network set is the result of spatiotemporal alignment, where each sub-network has a unified timeline, clearly demonstrating the temporal continuity and correlation between different sub-networks.

[0057] When performing spatiotemporal alignment, a unified timeline range is first determined. The start and end points of the timeline can be determined using the time cluster labels of all sub-networks. For example, if the time cluster label range for all sub-networks is from "Cluster 1" to "Cluster 8", then the unified timeline range is "Cluster 1 - Cluster 8". Next, the time cluster labels of each sub-network are mapped to this unified timeline. This can be done by creating a mapping table that assigns each time cluster label to a position on the unified timeline. For example, "Cluster 1" corresponds to the start point on the timeline, "Cluster 8" to the end point, and "Cluster 2" to an intermediate position. For each sub-network, the time cluster attributes of its edges and the time-related attributes of its nodes are updated according to the mapping table to conform to the unified timeline. All spatiotemporally aligned sub-networks are stored in a set, outputting a dynamically aligned spatiotemporally aligned sub-network set.

[0058] Step S266: Integrate the spatiotemporally aligned dynamic subnetworks, preserve the entity connection relationships between the subnetworks, add time clusters and interaction feature attributes to the edges, and output a heterogeneous association network containing multiple types of entity nodes and attributed associated edges.

[0059] During integration, the nodes and edges in all spatiotemporally aligned dynamic subnetworks are first merged. The unique identifier of each entity node is used to determine if they are the same node; if so, only one is retained. Similarly, edges are determined to be duplicates based on the nodes they connect to, their temporal cluster, and interaction characteristics. If an edge is not a duplicate, it is added to the integrated network. When adding an edge, its temporal cluster and interaction characteristics are added to its attributes. For example, an edge connecting a seller node and a buyer node might have a temporal cluster attribute of "cluster 3-cluster 5" and an interaction strength attribute of 5; these attributes are fully added to the integrated network during integration. After integrating all nodes and edges, a heterogeneous relational network containing multiple types of entity nodes and attributed relational edges is formed.

[0060] In one implementation, step S266 may specifically include the following steps S2661 to S2666: Step S2661: Extract all entity pairs that are not directly connected but share at least three adjacent entity nodes from the spatiotemporally aligned dynamic subnetwork set, treat these entity pairs as objects with potential connections, and output a set of potentially associated entity pairs, each entry containing two entities that are not directly connected but share neighboring nodes.

[0061] A non-directly connected entity pair is one where there is no direct edge connecting two entity nodes. A shared-at-at-three-adjacent-nodes entity pair is one where these two entity nodes share at least three common adjacent nodes. A potentially related entity pair is one where, although there is no direct connection, there may be a potential connection relationship due to sharing multiple adjacent nodes. The set of potentially related entity pairs is the set containing all such potentially related entity pairs, with each entry containing two entities that are not directly connected but share adjacent nodes.

[0062] When extracting potentially related entity pairs, each subnetwork in the spatiotemporally aligned dynamic subnetwork set is traversed. For each entity node in a subnetwork, all its neighboring nodes are identified. Then, all entity node pairs are traversed to determine if they are not directly connected and share at least three neighboring nodes. All potentially related entity pairs that meet the criteria are stored in a set, and the set of potentially related entity pairs is output.

[0063] Step S2662: Bind the potential related entity pairs to their common neighboring entity nodes, using the common neighboring nodes as the supporting basis for the potential association, and output the potential association-common neighboring node binding set, with each entry containing the potential related entity pair and the corresponding common neighboring node.

[0064] Binding potentially related entity pairs to their common neighboring entity nodes serves to clarify the supporting evidence for the potential connections between these pairs. Common neighboring nodes are adjacent nodes shared by potentially related entity pairs; their existence indicates a possible indirect connection between them. The potential association-common neighboring node binding set is the result of this binding, with each entry containing the potentially related entity pair and its corresponding common neighboring node.

[0065] During binding, for each potentially related entity pair in the set of potentially related entity pairs, their common neighboring entity nodes are identified. This can be done by iterating through the list of neighboring nodes for each entity node in the potentially related entity pair to find the common nodes. The potentially related entity pairs and their corresponding common neighboring nodes are then combined into a new data entry and stored in a set, outputting the potentially related-common neighboring node binding set.

[0066] Step S2663: Based on the interaction time order of common neighbor nodes and potential associated entity pairs, generate time constraints for potential associations to ensure that potential associations conform to the logic of interaction time sequence, and output a set of potential association time constraints, with each entry containing a potential association and its corresponding time constraint.

[0067] Interaction time order refers to the chronological order in which interactions occur between common neighbor nodes and potentially related entity pairs. The time constraints for generating potential associations ensure that these associations are temporally reasonable and conform to actual interaction logic. For example, if a common neighbor node interacts with one entity in a potentially related entity pair before interacting with the other, the potential association should also follow this chronological order. The potential association time constraint set is a collection containing all potential associations and their corresponding time constraints; each entry includes the potential association and its corresponding time constraint.

[0068] When generating time constraints, examine the temporal cluster attributes of the edges between common neighbor nodes and potentially related entity pairs. By comparing the order of these temporal cluster attributes, the time constraints for potential associations are determined. For example, for a potentially related entity pair, seller A and seller B, if the temporal cluster attributes of the interaction between common neighbor buyer C and seller A are "cluster 2-cluster 3," and the interaction time cluster attributes with seller B are "cluster 4-cluster 5," then the time constraint can be generated: the potential association of seller A should occur before seller B. Combine the potential associations and their corresponding time constraints into a new data entry, store it in a set, and output the potential association time constraint set.

[0069] Step S2664: Based on the potential association time constraint, retain the potential association entity pairs that meet the time constraint, and output the verified potential association entity pair set, where each entry contains a reasonable potential association entity pair.

[0070] The filtering process is based on potential association time constraints, which involves checking whether potential related entity pairs meet the time constraints. If they do, the potential related entity pair is considered reasonable and retained; otherwise, it is filtered out. The verified set of potential related entity pairs is the filtered result, with each entry containing reasonable potential related entity pairs.

[0071] During the filtering process, the set of potential related entity pairs and the set of potential related time constraints are traversed. For each potential related entity pair, it is checked whether it meets the corresponding time constraint. This can be determined by comparing the time cluster attributes of the interactions between the entities in the potential related entity pair and their common neighbors. For example, for the potential related entity pair of seller A and seller B, the time constraint is that the potential association of seller A should occur before seller B. By checking the time cluster attributes of the interactions between seller A and seller B and their common neighbors, if seller A's interaction time does indeed occur before seller B's, then the potential related entity pair is retained; otherwise, it is filtered out. All potential related entity pairs that meet the time constraints are stored in a set, and the verified set of potential related entity pairs is output.

[0072] Step S2665: Convert the verified potential associated entity pairs into implicit connection edges, add common neighbor node support and time constraint imprint to the implicit edges, add the implicit edges to the spatiotemporally aligned dynamic sub-network, and output a heterogeneous associated network with implicit edges, including explicit edges and implicit edges.

[0073] Implicit edges are not directly observed edges, but rather edges generated based on potentially related entity pairs. Adding common neighbor node support and temporal constraint imprints to implicit edges clarifies the basis for their support and the temporal constraints. Incorporating implicit edges into the spatiotemporally aligned dynamic subnetwork enriches the network structure, enabling it to reflect more potential relationships. Heterogeneous association networks with implicit edges are the result of adding implicit edges, including both explicit edges (edges that already exist in the original network) and implicit edges.

[0074] During the transformation, for each potentially related entity pair in the verified set of potentially related entity pairs, an implicit edge is created connecting the two entity nodes. Common neighbor node support is added to the implicit edge, that is, the corresponding common neighbor node information is added to the attributes of the implicit edge; temporal constraint imprints are added, that is, the corresponding temporal constraints are added to the attributes of the implicit edge. All generated implicit edges are added to the spatiotemporally aligned dynamic sub-network, outputting a heterogeneous related network with implicit edges.

[0075] Step S2666: Perform redundancy cleanup on the heterogeneous association network with implicit edges, remove duplicate implicit edges and implicit edges that completely overlap with explicit edges, retain implicit edges with unique connection meanings, and output the expanded heterogeneous association network, which includes multiple types of entity nodes, explicit edges and implicit edges.

[0076] Redundancy cleanup removes unnecessary edges from a network to simplify its structure and improve the efficiency of network analysis. Duplicate implicit edges are two implicit edges connecting the same two entity nodes with identical attribute information. Implicit edges that completely overlap with explicit edges connect two entity nodes with attribute information identical to existing explicit edges in the network. Implicit edges with unique connection meaning provide additional information, reflecting potential relationships. The expanded heterogeneous network is the result of redundancy cleanup, containing multiple types of entity nodes, explicit edges, and implicit edges with unique connection meaning.

[0077] During redundancy cleanup, all implicit edges in the heterogeneous association network with implicit edges are traversed. For each implicit edge, it is checked whether there are duplicate implicit edges or edges that completely overlap with explicit edges. This can be determined by comparing the nodes connected to the edge and the edge's attribute information. All nodes and edges that have undergone redundancy cleanup are combined into a single network, and the expanded heterogeneous association network is output.

[0078] Step S300: Perform multi-path parallel traversal analysis on the heterogeneous network to extract the abnormal association path features in the network. The abnormal association path features include path length features, node type sequence features, and edge attribute change features.

[0079] Multi-path parallel traversal analysis simultaneously traverses and analyzes multiple paths in a heterogeneous network to improve analysis efficiency. Anomaly paths are those that differ significantly from the majority of paths in the network; these paths may reflect unusual behaviors or relationships. Anomaly path features are used to describe these paths. Path length features represent the number of nodes in the path; node type sequence features are the sequence of node types arranged in order, such as seller-buyer-vehicle inspection agency; edge attribute variation features are the changes in edge attributes (such as time clusters, interaction strength, etc.) within the path.

[0080] In one implementation, step S300 may specifically include the following steps S310 to S360: Step S310: Select entity nodes from the heterogeneous association network that involve interactions with at least three different time clusters as traversal starting nodes. These nodes have interaction records across multiple time clusters. Output a set of cross-cluster starting nodes, where each node contains interaction records and attribute information across multiple time clusters.

[0081] An entity node involved in interactions across at least three different time clusters is a node that interacts with other entity nodes in three or more different time clusters. Cross-time cluster interaction records are the interaction details of these nodes across different time clusters, including the interacting objects and the timing of the interactions. The cross-cluster starting node set is the set containing all such nodes, with each node containing cross-time cluster interaction records and node attribute information.

[0082] When selecting the starting node for traversal, all nodes in the heterogeneous association network are traversed. For each node, the temporal cluster attribute of its edges is checked, and the number of different temporal clusters involved with the node is counted. If the number is at least three, the node is selected as the starting node for traversal. All nodes that meet the criteria are stored in a set, and the set of cross-cluster starting nodes is output.

[0083] Step S320: Starting from each cross-cluster starting node, traverse along the path where the edge attributes change continuously, track the complete path of the edge attributes from the initial state to the changed state, generate the attribute evolution traversal path, and output the attribute evolution traversal path set. Each path contains a node sequence and the corresponding edge attribute change trajectory.

[0084] Continuous changes in edge attributes occur when the attributes of edges (such as time clusters, interaction strength, etc.) change according to a certain pattern or order within a path. An attribute evolution traversal path is a path obtained by traversing the continuously changing edge attributes, starting from the cross-cluster starting node. This path records the complete process of the edge attributes from their initial state to their changed state. The set of attribute evolution traversal paths is the set containing all such paths, where each path includes a sequence of nodes and the corresponding trajectory of edge attribute changes.

[0085] During the traversal, starting from each cross-cluster initiating node, an edge is selected for traversal. When selecting an edge, it is checked whether the edge's attributes change continuously with those of the edges in the current path. For example, if the interaction strength of edges in the current path gradually increases, then the next edge selected should also have an increasing interaction strength. This traversal continues along such edges until no more edges meeting the criteria can be found. During the traversal, the node sequence and the trajectory of edge attribute changes are recorded. All generated attribute evolution traversal paths are stored in a set, and the attribute evolution traversal path set is output.

[0086] Step S330: Extract the total number of entity nodes contained in each attribute evolution traversal path as the path length content, extract the category identifier of each entity node in the path as the node type sequence content, extract the continuous change trajectory of edge attributes in the path as the edge attribute change content, and output the path basic feature set.

[0087] The path length information represents the number of entity nodes contained in the path, reflecting the path's length. The node type sequence information is a sequence formed by arranging the category identifiers of each entity node in the path, reflecting the type distribution of nodes in the path. The edge attribute change information is the continuous change trajectory of edge attributes in the path, reflecting the dynamic changes of edge attributes in the path. The basic path feature set is a collection containing the path length information, node type sequence information, and edge attribute change information for all paths.

[0088] When extracting path length, the number of nodes in the path is counted through the attribute evolution traversal. For example, for an attribute evolution traversal path Seller-Buyer-Vehicle Inspection Agency, the path length is 3. When extracting node type sequence, the node category identifier is recorded according to the order of nodes in the path. For example, the node type sequence of the above path is Seller-Buyer-Vehicle Inspection Agency. When extracting edge attribute change, the continuous change trajectory of edge attributes (such as time clusters, interaction intensity, etc.) in the path is recorded. The path length, node type sequence, and edge attribute change of all paths are combined into a new data entry, stored in a set, and the basic feature set of the path is output.

[0089] Step S340: Compare each path feature in the basic path feature set with the path features generated by all starting nodes of the same type, identify the content that deviates from the majority of path features, and output a path feature deviation comparison result set, with each entry containing the path feature and the corresponding deviation content.

[0090] Same-type starting nodes are cross-cluster starting nodes of the same type, such as all being seller nodes. Comparing each path feature in the basic path feature set with the path features generated by all starting nodes of the same type is to identify paths that differ from the majority of path features; these paths may be anomalous. The path feature deviation comparison result set is the result of this comparison, with each entry containing the path feature and its corresponding deviation.

[0091] During comparison, for each path feature in the basic path feature set, its similarity to all path features generated from starting nodes of the same type is calculated. Distance metrics (such as Euclidean distance, Manhattan distance, etc.) can be used to calculate similarity. For example, for path length, node type sequence, and edge attribute variation, their distances to other path features can be calculated separately. If the distance between a path feature and most path features exceeds a set threshold, then that path feature is considered to have a deviation. The path features and their corresponding deviations are recorded, such as excessively long path lengths, abnormal node type sequences, or irregular edge attribute variations. All path feature deviation comparison results are stored in a set, and the resulting set of path feature deviation comparison results is output.

[0092] Step S350: Filter out paths whose deviation content covers three types of features—path length, node type sequence, and edge attribute change—from the path feature deviation comparison result set, and use these paths as differentiated paths. Output a set of differentiated evolutionary paths, with each path containing three types of feature deviation content.

[0093] Deviation content covers three features: path length, node type sequence, and edge attribute changes. Differentiated paths are those that differ significantly from most paths in all three aspects; these paths may be anomalously related. The set of differentiated evolutionary paths represents the filtered result, with each path containing deviation content across all three features.

[0094] During the filtering process, the set of path feature deviation comparison results is traversed. For each path feature deviation comparison result, it is checked whether the deviation content simultaneously includes deviations in three aspects: path length, node type sequence, and edge attribute changes. For example, if a path's deviation content includes excessively long path length, abnormal node types in the node type sequence, and edge attribute changes that do not conform to normal patterns, then this path meets the filtering criteria. All paths that meet the criteria are stored in a set, and the differentiated evolution path set is output.

[0095] Step S360: Extract path length, node type sequence, and edge attribute change from the differential evolution path set, integrate the three types of features into a unified format, and output the abnormal associated path features in the network, which contain the three types of complete feature content.

[0096] In one implementation, step S360 may specifically include the following steps S361 to S366: Step S361: Extract all neighboring nodes of each entity node in each path from the differentiated evolution path set, bind the neighboring nodes to the corresponding paths, and output the path-neighboring node binding set. Each entry contains the path identifier and all neighboring nodes of the corresponding node.

[0097] A path identifier is information used to uniquely identify each path; it can be a number or a specific name. Adjacent nodes are nodes directly connected to entity nodes within the path. Binding adjacent nodes to their corresponding paths clarifies the adjacent node information for each node in the path. The path-adjacent node binding set is the result of this binding; each entry contains the path identifier and all its adjacent nodes.

[0098] During extraction, the set of differentiated evolutionary paths is traversed. For each path, each entity node within the path is traversed. Through the structure of the heterogeneous association network, all directly connected neighboring nodes of that entity node are identified. For example, for the path Seller-Buyer-Vehicle Inspection Agency, for the seller node, all its neighboring buyer nodes and vehicle inspection agency nodes are identified; for the buyer node, all its neighboring seller nodes and vehicle inspection agency nodes are identified. The path identifier and all its corresponding neighboring nodes are combined into a new data entry and stored in a set, outputting the path-neighboring node binding set.

[0099] Step S362: Associate the node type sequence of the path with the neighbor node categories of the corresponding node, add the neighbor node categories of each node to the node type sequence, generate an extended node type sequence, and output an extended node type sequence set, where each sequence contains the original node type and the neighbor node categories.

[0100] Associating the node type sequence of a path with the neighbor node categories of the corresponding node enriches the information of the node type sequence, enabling it to reflect the distribution of node types around the node. An extended node type sequence is a sequence created by adding the neighbor node categories of the corresponding node to the original node type sequence. The set of extended node type sequences contains all extended node type sequences, each containing both the original node type and the neighbor node categories.

[0101] During association, the path-neighbor binding set is traversed. For each entry, the path's node type sequence is combined with the corresponding node's neighbor categories. For example, for the path Seller-Buyer-Vehicle Inspection Agency, the Seller node's neighbor categories are Buyer and Vehicle Inspection Agency, the Buyer node's neighbor categories are Seller and Vehicle Inspection Agency, and the Vehicle Inspection Agency node's neighbor categories are Seller and Buyer. These neighbor categories are added to the node type sequence, generating the extended node type sequence Seller(Buyer, Vehicle Inspection Agency)-Buyer(Seller, Vehicle Inspection Agency)-Vehicle Inspection Agency(Seller, Buyer). All generated extended node type sequences are stored in a set, and the extended node type sequence set is output.

[0102] Step S363: Extract the occurrence frequency of node categories from the extended node type sequence set, bind the category frequency with the corresponding path, and output the path-category frequency binding set. Each entry contains the path identifier and the corresponding node category frequency.

[0103] The frequency of a node category is the number of times each node category appears in the extended node type sequence. Binding category frequencies to corresponding paths records the distribution of node categories within each path. The path-category frequency binding set is the result of this binding; each entry contains the path identifier and the frequency of the corresponding node category.

[0104] During extraction, the set of extended node type sequences is traversed. For each extended node type sequence, the frequency of each node category is counted. For example, for the extended node type sequence Seller (Buyer, Vehicle Inspection Agency) - Buyer (Seller, Vehicle Inspection Agency) - Vehicle Inspection Agency (Seller, Buyer), the frequency of seller, buyer, and vehicle inspection agency is counted. The path identifier and the frequency of the corresponding node category are combined into a new data entry and stored in a set, outputting a path-category frequency binding set.

[0105] Step S364: Associate the frequency content in the path-category frequency binding set with the path length content and the edge attribute change content, associate and bind the three types of features, generate extended anomaly associated path features, and output the extended anomaly associated path feature set. Each feature includes length, type frequency and attribute change.

[0106] Associating the frequency content in the path-category frequency binding set with the path length content and edge attribute change content is to integrate these three types of features into a more comprehensive anomaly-related path feature set. The extended anomaly-related path feature set is the integrated feature set, containing information on path length, node category frequency, and edge attribute change. The extended anomaly-related path feature set is a collection containing all extended anomaly-related path features, each feature including length, type frequency, and attribute change.

[0107] During association, the path-category frequency binding set is traversed. For each entry, the frequency information is combined with the corresponding path length information and edge attribute change information. For example, for an entry with the path identifier "Path 1", its node category frequency is seller: 2, buyer: 3, vehicle inspection agency: 1, path length is 5, and edge attribute change information is the interaction intensity changing from 3 to 8. This information is combined into an extended abnormal association path feature (path length: 5, node category frequency: seller: 2, buyer: 3, vehicle inspection agency: 1, edge attribute change: interaction intensity from 3 to 8). All generated extended abnormal association path features are stored in a set, and the extended abnormal association path feature set is output.

[0108] Step S365: Integrate the extended anomaly associated path feature set, arrange the three types of features in a fixed order to ensure that the structure of each feature is consistent, and output an extended anomaly path feature set with a unified structure, where each feature has a consistent structure.

[0109] Integrating the extended anomaly path feature set aims to give each feature a unified structure, facilitating subsequent analysis and processing. Arranging the three types of features in a fixed order can be done by first listing path length, then node category frequency, and finally edge attribute changes. The integrated feature set exhibits a unified structure, with each feature sharing a consistent structure.

[0110] During integration, the extended anomaly associated path feature set is traversed. For each extended anomaly associated path feature, its contents are rearranged according to a specified order. All rearranged extended anomaly associated path features are stored in a set, outputting a structurally unified extended anomaly path feature set.

[0111] Step S366: Organize the structurally unified extended abnormal path features, remove duplicate feature content, retain the unique abnormal associated path features, and output the optimized abnormal associated path features, including complete features of path length, node type sequence and edge attribute change.

[0112] The purpose of organizing the structurally unified extended abnormal path features is to remove duplicate features and avoid information redundancy. Removing duplicate features can be achieved by comparing the various elements within the features. The optimized abnormal association path features are the organized result, encompassing complete features in three aspects: path length, node type sequence, and edge attribute changes.

[0113] In one implementation, step S366 may specifically include the following steps S3661 to S3666: Step S3661: Extract the edge attribute change trajectory of each path from the structurally unified extended abnormal path feature set, bind the edge attribute change trajectory with the corresponding path, and output the path-attribute change trajectory binding set. Each entry contains the path identifier and the corresponding edge attribute change trajectory.

[0114] Edge attribute change trajectories represent the continuous changes in edge attributes along a path, such as the changes in edge interaction strength and time clusters. Binding edge attribute change trajectories to corresponding paths clarifies the edge attribute changes for each path. The path-attribute change trajectory binding set is the result of this binding; each entry contains a path identifier and the corresponding edge attribute change trajectory.

[0115] During extraction, the unified extended abnormal path feature set is traversed. For each extended abnormal path feature, the edge attribute change content is extracted. The path identifier and the corresponding edge attribute change trajectory are combined into a new data entry and stored in a set, outputting a path-attribute change trajectory binding set.

[0116] Step S3662: Associate the path edge attribute change trajectory with the path length and extended node type sequence, match the trajectory change period with the path length and node type, generate time-series linkage anomaly associated path features, and output the time-series linkage anomaly associated path feature set, each feature containing three types of time-series linkage content.

[0117] Associating the path's edge attribute change trajectory with path length and extended node type sequence aims to combine these three aspects of information to form a more comprehensive feature set of anomaly-related paths. The trajectory change cycle is a complete change cycle within the edge attribute change trajectory, such as the process of interaction intensity increasing from one value to another and then returning to its initial value. Matching the trajectory change cycle with path length and node type allows for analysis of the relationship between edge attribute changes and these factors. The temporally linked anomaly-related path features are the associated features, encompassing the path length, extended node type sequence, and edge attribute change trajectory of the temporally linked path. The temporally linked anomaly-related path feature set is a collection containing all such features, with each feature encompassing the three categories of temporally linked content.

[0118] During the association process, the path-attribute change trajectory binding set is traversed. For each entry, the edge attribute change trajectory is combined with the corresponding path length and extended node type sequence. All generated time-series linkage anomaly association path features are stored in a set, and the time-series linkage anomaly association path feature set is output.

[0119] Step S3663: Extract the fluctuation range of the change trajectory from the feature set of the time-series linkage anomaly associated path, bind the fluctuation range with the corresponding path, and output the path-fluctuation range binding set. Each entry contains the path identifier and the corresponding attribute change fluctuation range.

[0120] The fluctuation range of the change trajectory is the maximum range of attribute value change in the edge attribute change trajectory, such as the difference between the minimum and maximum value of the interaction intensity. Binding the fluctuation range to the corresponding path is to record the fluctuation of edge attribute changes for each path. The path-fluctuation range binding set is the result of this binding; each entry contains a path identifier and the corresponding attribute change fluctuation range.

[0121] During extraction, the feature set of time-series linked anomalies is traversed. For each feature, the trajectory of edge attribute changes is analyzed to find the minimum and maximum values ​​of the attribute, and their difference is calculated as the fluctuation range. The path identifier and the corresponding attribute change fluctuation range are combined into a new data entry and stored in a set, outputting a path-fluctuation range binding set.

[0122] Step S3664: Associate the fluctuation range content in the path-fluctuation range binding set with the path length and extended node type sequence content to generate fluctuation-related abnormal path features, and output the fluctuation-related abnormal path feature set, where each feature contains fluctuation range, length and type sequence.

[0123] Associating the fluctuation range content with the path length and extended node type sequence content in the path-fluctuation range binding set is to integrate these three aspects of information into a more comprehensive abnormal correlation path feature. The fluctuation correlation abnormal path feature is the integrated feature, containing information on fluctuation range, path length, and extended node type sequence. The fluctuation correlation abnormal path feature set is the set containing all such features, each feature including fluctuation range, length, and type sequence.

[0124] During the association process, the path-fluctuation range binding set is traversed. For each entry, the fluctuation range content is combined with the corresponding path length and extended node type sequence content. For example, for an entry with the path identifier "Path 1", its fluctuation range is 5, its path length is 5, and its extended node type sequence is Seller (Buyer, Vehicle Inspection Agency) - Buyer (Seller, Vehicle Inspection Agency) - Vehicle Inspection Agency (Seller, Buyer). This information is combined into a fluctuation-related abnormal path feature (fluctuation range: 5, path length: 5, extended node type sequence: Seller (Buyer, Vehicle Inspection Agency) - Buyer (Seller, Vehicle Inspection Agency) - Vehicle Inspection Agency (Seller, Buyer)). All generated fluctuation-related abnormal path features are stored in a set, and the fluctuation-related abnormal path feature set is output.

[0125] Step S3665: Deduplicate the fluctuation-related abnormal path feature set, remove duplicate fluctuation-related abnormal path features, and output the deduplicated fluctuation-related abnormal path feature set.

[0126] The deduplication operation on the feature set of fluctuation-related anomaly paths aims to eliminate duplicate feature information and avoid information redundancy that could interfere with subsequent analysis. Identical fluctuation-related anomaly path features refer to features that are completely identical across the three key dimensions of fluctuation range, path length, and extended node type sequence. Removing these duplicate features makes the set more concise, improving the efficiency of data processing and analysis.

[0127] During deduplication, each feature entry in the fluctuation-related abnormal path feature set is traversed. For each feature, its fluctuation range, path length, and extended node type sequence are combined into a unique identifier. A hash algorithm can be used to generate this identifier. Hash algorithms can convert complex data into a fixed-length hash value; different content usually generates different hash values, while the same content generates the same hash value. A hash table is used to store the hash values ​​of already traversed features. When a new feature is encountered, its hash value is calculated and searched in the hash table. If the hash value already exists in the hash table, the feature is considered a duplicate and is removed from the set; if the hash value does not exist in the hash table, the feature is retained, and its hash value is stored in the hash table. Finally, all deduplicated fluctuation-related abnormal path features are stored in a new set, and the deduplicated fluctuation-related abnormal path feature set is output.

[0128] Step S3666: Organize the deduplicated fluctuation association abnormal path features, retain the complete content of path length, node type sequence and edge attribute change, and output the optimized abnormal association path features, which contain three types of complete feature content.

[0129] The deduplicated fluctuation-related abnormal path features are organized to ensure that the final output of abnormal path features can completely and accurately reflect the key feature information of the path. The complete content of path length, node type sequence, and edge attribute changes is retained because these three features can describe the characteristics of abnormal path associations from different perspectives. Path length reflects the scale of the path, node type sequence shows the type distribution and combination of nodes in the path, and edge attribute changes reflect the dynamic characteristics of edges in the path.

[0130] During the data processing, the deduplicated set of fluctuating correlation anomaly path features is first further checked and filtered. For each feature entry, it is ensured that its path length, node type sequence, and edge attribute change content are complete and accurate. If any part of the content in a feature entry is missing or contains errors, it is corrected or the entry is removed from the set. For example, if the edge attribute change content of a feature entry is incomplete and cannot clearly reflect the change process of the edge attributes, then the content needs to be supplemented or corrected; if it cannot be corrected, the entry is removed. Then, the checked and filtered feature entries are sorted according to certain rules to facilitate subsequent analysis and use. Sort can be done in ascending order by path length or in lexicographical order by node type sequence. Finally, the processed feature entries are stored in a new set, outputting the optimized anomaly correlation path features. This feature set contains three complete feature contents: path length, node type sequence, and edge attribute change.

[0131] Step S400: Input the abnormal correlation path features into the preset deep feature fusion model, perform cross-dimensional feature recombination and nonlinear mapping processing, and generate an abnormal evaluation feature vector containing multi-dimensional abnormal evaluation parameters.

[0132] The pre-trained deep feature fusion model is designed to process and analyze the input features of anomaly-related paths. Cross-dimensional feature recombination rearranges features from different dimensions within the anomaly-related path features, breaking down the original dimensional boundaries and uncovering potential correlations and combinations between different dimensions. Nonlinear mapping maps the recombined features to a high-dimensional space using nonlinear functions, allowing the features to better express their inherent complex relationships and patterns. Multi-dimensional anomaly evaluation parameters are used to assess anomalies across multiple dimensions, reflecting the degree and characteristics of the anomaly from various perspectives. The anomaly evaluation feature vector, generated after cross-dimensional feature recombination and nonlinear mapping, contains multi-dimensional anomaly evaluation parameters, providing a more comprehensive and accurate description of the features of the anomaly-related path.

[0133] In one implementation, step S400 may specifically include the following steps S410 to S460: Step S410: Arrange the path length content, node type sequence content, and edge attribute change content of the abnormal associated path features according to the temporal order of the path, concatenate the three types of features in chronological order, and output the abnormal associated path feature set sorted by time. Each entry contains the three types of features in chronological order.

[0134] The temporal order of a path refers to the chronological order in which the interactions of nodes and edges occur within an anomaly-related path. Arranging the path length, node type sequence, and edge attribute changes of the anomaly-related path features in chronological order allows for the display and analysis of these features in a timely manner, better reflecting the changes in the anomaly-related path over time. Concatenating these three types of features in chronological order combines them into a continuous feature sequence, ensuring that each entry fully encompasses all three types of features arranged chronologically.

[0135] In the arrangement and concatenation process, the temporal information of the paths is first extracted from the abnormal associated path features. The temporal order of the paths can be determined by the time cluster information in the edge attribute change content. For example, if the edge attribute change content records the interaction time of the edges from time cluster 1 to time cluster 3, then the relevant features can be arranged according to this temporal order. Then, for each abnormal associated path feature, the path length content, node type sequence content, and edge attribute change content are arranged and concatenated according to the temporal order. After performing this process on all abnormal associated path features, a set of abnormal associated path features sorted by time is output.

[0136] Step S420: Interleave the different path features in the time-sorted abnormal associated path feature set, and concatenate the time-series segments of each path with the time-series segments of other paths to generate interleaved features. Output the interleaved feature set, where each feature contains time-series segments of different paths.

[0137] Interleaving features from different paths within a time-ordered set of anomaly-related path features aims to break down the independence between paths and uncover potential correlations and interactions between them. Each path's temporal segment represents the feature content within a specific time period from the time-ordered set of anomaly-related path features. By interleaving these temporal segments from different paths, new feature combinations can be generated. These combinations may contain interaction information from different paths at different points in time, thereby revealing hidden patterns and regularities.

[0138] In the interleaving process, the rules and methods for interleaving are first determined. A sliding window approach can be used, setting a window size, for example, two time clusters. For each path in the time-sorted set of anomalous associated path features, its temporal segment within the window is extracted. Then, other paths are traversed, and their temporal segments within the same window are interleaved with the temporal segment of the current path. This process is repeated for all paths and all windows, outputting an interleaved feature set.

[0139] Step S430: Input the interlaced features into the preset deep feature fusion model, input the interlaced features into the feature processing link, generate the initial fusion features, and output the initial fusion feature set, where each feature contains fusion content with multiple interlaced paths.

[0140] When inputting interleaved features into the feature processing chain, the interleaved features are first encoded, converting them into a numerical form that the model can process. One-hot encoding, embedding encoding, and other methods can be used to encode the node type sequence content, converting it into a vector representation. For path length content and edge attribute variation content, normalization can be performed directly before inputting into the model. Then, the encoded interleaved features are input into the input layer of the feature processing chain. The feature processing chain typically contains multiple convolutional layers, pooling layers, and fully connected layers. Convolutional layers perform convolution operations on the input features, extracting local feature information; pooling layers downsample the features, reducing feature dimensionality and improving computational efficiency; fully connected layers fully connect the features after convolution and pooling, uncovering global correlations between features. Through these layer operations, initial fused features are generated. All generated initial fused features are stored in a set, outputting the initial fused feature set.

[0141] Step S440: Perform cross-temporal association on the features in the initial fusion feature set, associate and bind the feature content of different temporal segments, mine cross-temporal feature association relationships, and output a cross-temporal associated fusion feature set, where each feature contains cross-temporal associated content.

[0142] Cross-temporal association involves establishing feature relationships between different time segments to uncover the continuity and patterns of feature changes over time. The feature content of different time segments represents the feature information at different points in time or within a time period from the initial fused feature set. Associating and binding these feature contents aims to discover potential connections between features at different points in time, such as how changes in a feature at one point in time affect other features at subsequent points in time.

[0143] When performing cross-temporal association, recurrent neural network (RNN) structures such as Long Short-Term Memory (LSTM) networks or Gated Recurrent Units (GRUs) can be employed. These network structures can effectively process sequential data and capture long-term dependencies within the sequence. Each feature in the initial fusion feature set is input into the RNN in chronological order. The hidden states in the network are updated based on the currently input features and the hidden states from the previous time step, thereby achieving the association of features from different temporal segments. At each time step, the network outputs a feature vector containing cross-temporal association information. The feature vectors from all time steps are combined to form a cross-temporal association fusion feature. This process is repeated for all features in the initial fusion feature set, outputting a cross-temporal association fusion feature set where each feature contains cross-temporal association content.

[0144] Step S450: Perform nonlinear mapping on the cross-temporal correlation fusion features, convert the correlation fusion features into a high-dimensional vector form, generate intermediate anomaly evaluation feature vectors, and output the intermediate anomaly evaluation feature vector set, where each vector contains multi-dimensional feature content.

[0145] Nonlinear mapping maps input features to a high-dimensional space using a nonlinear function. Applying nonlinear mapping to cross-temporal correlation fusion features allows the features to better express their inherent complex relationships and feature patterns in a high-dimensional space, improving their discriminative power and representability. Converting the correlation fusion features into a high-dimensional vector form facilitates subsequent computation and analysis. The intermediate anomaly evaluation feature vector, generated after nonlinear mapping, contains multi-dimensional feature content and can more comprehensively reflect the characteristics of anomaly correlation paths.

[0146] When performing nonlinear mapping, neural network structures such as Multilayer Perceptrons (MLPs) can be used. A MLP consists of multiple fully connected layers, each containing multiple neurons connected by nonlinear activation functions. Cross-temporal correlation fusion features are input into the input layer of the MLP. The neurons in the input layer pass the input features to the hidden layers, where they perform nonlinear transformations. Commonly used nonlinear activation functions include ReLU and Sigmoid. After nonlinear transformations through multiple hidden layers, the final fully connected layer outputs an intermediate anomaly evaluation feature vector. This process is repeated for all cross-temporal correlation fusion features, outputting a set of intermediate anomaly evaluation feature vectors, where each vector contains multi-dimensional feature content.

[0147] Step S460: Integrate the intermediate anomaly evaluation feature vector set, unify the multi-dimensional features of different vectors, and output anomaly evaluation feature vector containing multi-dimensional anomaly evaluation parameters.

[0148] Integrating the set of intermediate anomaly assessment feature vectors aims to synthesize and unify the information from multiple intermediate anomaly assessment feature vectors, eliminating differences and redundancy between vectors, and enabling the final anomaly assessment feature vector to more accurately reflect the characteristics of anomaly association paths. Unifying the multi-dimensional features of different vectors is to arrange and combine the multi-dimensional features of each vector according to certain rules to form a unified feature representation.

[0149] In one implementation, step S460 may specifically include the following steps S461 to S466: Step S461: Extract the temporal feature fragment of each vector from the intermediate anomaly evaluation feature vector set, bind the temporal feature fragment with the corresponding vector, and output the vector-temporal feature fragment binding set. Each entry contains a vector identifier and the corresponding temporal feature fragment.

[0150] Temporal feature segments are the time-related feature parts of intermediate anomaly assessment feature vectors, reflecting the feature changes of anomaly association paths at different time points. Binding temporal feature segments to their corresponding vectors clarifies the temporal feature information associated with each vector, facilitating subsequent analysis and processing. Vector identifiers are used to uniquely identify each intermediate anomaly assessment feature vector; they can be a number or a specific name.

[0151] During the extraction and binding process, the first step is to determine which parts of the intermediate anomaly assessment feature vector belong to temporal feature segments. This can be determined based on the vector's generation process and feature meaning. For example, if the intermediate anomaly assessment feature vector is obtained through a nonlinear mapping of cross-temporal correlation fusion features, then the time-step-related parts of the vector are likely temporal feature segments. For each intermediate anomaly assessment feature vector, the temporal feature segments are extracted. Then, the vector identifier and the corresponding temporal feature segment are combined into a new data entry and stored in a set.

[0152] Step S462: Evolve and extend the temporal feature segments of the vector, generate extended feature segments according to the changing trend of the temporal features, bind the extended feature segments with the original vector, and output a vector-extended temporal feature binding set, where each entry contains a vector and the corresponding extended temporal feature.

[0153] Evolving and expanding temporal feature segments of a vector aims to predict and generate potential future feature changes based on existing trends in temporal feature evolution, thereby enriching the temporal feature information. Generating expanded feature segments based on these trends can be achieved using time series prediction methods such as the Autoregressive Integral Moving Average (ARIMA) model and Long Short-Term Memory (LSTM) networks. These methods can learn the historical patterns of temporal feature changes and predict future feature values ​​based on these patterns.

[0154] In the evolutionary expansion process, each entry in the vector-temporal feature fragment binding set is first processed. For each entry, a temporal feature fragment is extracted. Then, a selected time series prediction method is used to train and predict the temporal feature fragments. For example, an LSTM network is used, with the temporal feature fragment as input, to train the network to learn the variation patterns of the features. After training, the trained network is used to predict future time steps, generating extended feature fragments. Finally, the extended feature fragments are bound to the original vectors, and the bound entries are stored in a new set, outputting a vector-extended temporal feature binding set, where each entry contains a vector and its corresponding extended temporal feature.

[0155] Step S463: Associate the extended temporal features in the vector-extended temporal feature binding set with the multi-dimensional features of the original vector to generate an evolutionary extended anomaly evaluation feature vector, and output the evolutionary extended anomaly evaluation feature vector set, where each vector contains extended temporal features and original multi-dimensional features.

[0156] Associating the extended temporal features in the vector-extended temporal feature binding set with the multi-dimensional features of the original vector aims to integrate the extended temporal feature information with other multi-dimensional features in the original vector, forming a more comprehensive and richer anomaly evaluation feature vector. The evolved extended anomaly evaluation feature vector is the result of this association, containing both the extended temporal features and the multi-dimensional features of the original vector, and can more accurately reflect the characteristics of the anomaly association path in the time dimension and other dimensions.

[0157] During the association process, each entry in the vector-extended temporal feature binding set is processed first. For each entry, the extended temporal features and the multi-dimensional features of the original vector are combined. This can be done by concatenating the extended temporal features as a new dimension to the original vector. For example, if the original vector contains multi-dimensional features such as path length, node type sequence, and edge attribute changes, and the extended temporal features are the predicted edge attribute changes for future time steps, concatenating the extended temporal features to the end of the original vector forms a new vector. Then, the concatenated vector undergoes further processing, such as normalization, to ensure that the features of each dimension in the new vector have the same scale and range. All the associated and processed vectors are stored in a set, outputting the evolutionary extended anomaly evaluation feature vector set, where each vector contains both the extended temporal features and the original multi-dimensional features.

[0158] Step S464: Integrate the feature vector set for evolutionary expansion anomaly evaluation. Integrate the extended temporal features with the original features in a fixed ratio to ensure that the feature content of each vector is complete. Output the integrated set of evolutionary expansion anomaly evaluation vectors.

[0159] Integrating the feature vector set for evolutionary extended anomaly assessment aims to rationally fuse extended temporal features with original features, preventing any single feature from being overemphasized or neglected, and ensuring a more balanced and complete feature content for each vector. Integrating extended temporal features and original features at a fixed ratio can be determined based on their importance and reliability. For example, if extended temporal features are considered highly important for anomaly assessment, their proportion can be set relatively high.

[0160] During the integration process, a fixed ratio is first determined. Assume the fixed ratio is 30% for extended temporal features and 70% for original features. For each vector in the evolutionary extended anomaly evaluation feature vector set, its extended temporal features and original features are weighted according to this ratio. Then, the weighted extended temporal feature vector and the original feature vector are concatenated to form a new vector. Further processing, such as normalization, is performed on the concatenated vector to ensure that the features in each dimension of the vector have the same scale and range. All integrated and processed vectors are stored in a new set, outputting the integrated evolutionary extended anomaly evaluation vector set.

[0161] Step S465: Perform a consistency mapping on the integrated evolutionary extension anomaly evaluation vector, mapping the feature content of the vector to a unified dimension format, and output a set of consistent anomaly evaluation feature vectors.

[0162] Consistency mapping transforms the feature content of different vectors into a unified dimensional format, eliminating dimensional differences between vectors and ensuring all vectors have the same dimensional representation, facilitating subsequent comparison and analysis. Vector feature content may have different dimensions and formats; for example, some vectors may contain more feature dimensions, while others have fewer. Consistency mapping unifies these vectors into a common dimensional space. Methods such as Principal Component Analysis (PCA) or autoencoders can be used for consistency mapping. PCA is an unsupervised learning method that projects high-dimensional data into a low-dimensional space while preserving the main information. Autoencoders are neural network structures that learn the feature representation of input data and reconstruct it into output. For each vector in the integrated evolutionary expansion anomaly evaluation vector set, it is input into a PCA model or autoencoder. All vectors after consistency mapping are stored in a set, outputting a consistent anomaly evaluation feature vector set.

[0163] Step S466: Organize the set of consistent anomaly assessment feature vectors, retain the content of multi-dimensional anomaly assessment parameters, and output anomaly assessment feature vectors containing multi-dimensional anomaly assessment parameters.

[0164] Organizing the set of consistency anomaly assessment feature vectors is for the purpose of further filtering and optimization of the vectors in the set, removing redundant information and noise, and retaining only the content related to the multi-dimensional anomaly assessment parameters. Multi-dimensional anomaly assessment parameters are parameters that can reflect anomalies from different aspects, such as path length, node type sequence, and edge attribute changes.

[0165] During the processing, each vector in the consistency anomaly assessment feature vector set is first analyzed and evaluated. For each vector, its feature content is checked to see if it is related to the multi-dimensional anomaly assessment parameters. If a feature content does not directly contribute to the anomaly assessment or is redundant information, it is removed from the vector. For example, if a vector contains statistical information unrelated to anomaly assessment, such as the average number of interactions at a node, but this information does not help in determining the features of anomaly association paths, it is removed from the vector. Then, the filtered vectors undergo further processing, such as normalization, to ensure that the features of each dimension in the vector have the same scale and range. Finally, the processed vectors are merged and integrated to form a final anomaly assessment feature vector, which contains the multi-dimensional anomaly assessment parameter content.

[0166] Step S500: Based on the matching analysis results of the anomaly assessment feature vector and the preset benchmark feature template set, output a comprehensive assessment result including the anomaly degree quantification value and anomaly type identifier.

[0167] The preset baseline feature template set is a pre-defined set of feature templates that represent the characteristic patterns of different types of normal or abnormal situations. Matching the anomaly assessment feature vector with the preset baseline feature template set aims to identify which baseline feature templates the anomaly assessment feature vector is most similar to, thereby determining the type and severity of the anomaly. The anomaly severity quantification value is a numerical value used to measure the severity of the anomaly, helping users intuitively understand its degree. The anomaly type identifier is used to identify the type of anomaly, such as fraud anomaly, violation anomaly, etc.

[0168] In one implementation, step S500 may specifically include the following steps S510-S560: Step S510: Perform evolutionary matching between the anomaly evaluation feature vector and the preset benchmark feature template set, match the temporal feature fragments of the vector with the temporal evolution features of the benchmark template, identify the matching fragments of the two, and output the evolutionary matching result set. Each entry contains a vector, the matched benchmark template and the corresponding matching fragment.

[0169] The temporal feature fragments of the vector are the time-related feature parts of the anomaly assessment feature vector, recording the feature changes of the anomaly association path at different time points. The temporal evolution features of the baseline template are the time-related feature change patterns in the pre-defined baseline feature template, representing the change patterns of a specific type of anomaly or normal situation in the time dimension. Matching the temporal feature fragments of the vector with the temporal evolution features of the baseline template is to find the similar parts, i.e., the matching fragments, between the two in the time dimension.

[0170] In the evolutionary matching process, temporal feature fragments are first extracted from the anomaly evaluation feature vector, and the temporal evolution features of each template are extracted from the baseline feature template set. Then, for each anomaly evaluation feature vector, its temporal feature fragment is compared with the temporal evolution features of all baseline templates. Dynamic Time Warping (DTW) algorithm can be used for matching. DTW can find the optimal matching path between two time series, considering the differences in time series length. For each match, the matching fragments between the two are identified, i.e., the similar parts of the time series. For example, the temporal feature fragments of the anomaly evaluation feature vector record the changes in edge attributes of the anomaly association path in time clusters 1-5, and the temporal evolution features of the baseline template record the changes in edge attributes of a certain anomaly type in time clusters 2-6. The DTW algorithm finds that the edge attribute change features of the two are similar in time clusters 2-5, so the feature part of time clusters 2-5 is the matching fragment. The vector, the matched baseline template, and the corresponding matching fragment are combined into a new data entry, stored in a set, and the evolutionary matching result set is output.

[0171] Step S520: Extract the matching fragments corresponding to each vector from the evolution matching result set, bind the matching fragments to the corresponding vectors, and output the vector-matching fragment binding set. Each entry contains a vector identifier and a corresponding matching fragment.

[0172] Extracting the matching fragment corresponding to each vector from the evolutionary matching result set is to associate the matching fragments obtained during the matching process with their corresponding vectors, facilitating subsequent processing and analysis. Binding the matching fragments to their corresponding vectors combines these two pieces of information into a new data entry, ensuring that each vector has corresponding matching fragment information.

[0173] During the extraction and binding process, each entry in the evolutionary matching result set is traversed. For each entry, the vector and matching fragment are extracted. Then, a unique vector identifier is assigned to the vector, and the vector identifier and matching fragment are combined into a new data entry and stored in a new set. For example, for the entry (vector A, baseline template 1, matching fragment of time cluster 2-5) in the evolutionary matching result set, vector A is assigned the vector identifier "vector A1", and "vector A1" and the matching fragment of time cluster 2-5 are combined into a new entry (vector A1, matching fragment of time cluster 2-5). All such entries are stored in a set, and the vector-matching fragment binding set is output.

[0174] Step S530: Expand the matching segments, generate expanded matching features based on the feature trends of the matching segments, bind the expanded matching features with the corresponding vectors, and output a vector-expanded matching feature binding set, where each entry contains a vector and the corresponding expanded matching feature.

[0175] Expanding the matching segments aims to predict and generate potential future feature changes based on the existing feature trends of the segments, thereby enriching the matching feature information. Generating expanded matching features based on the feature trends of the matching segments can be achieved using time series prediction methods, such as the Autoregressive Integral Moving Average (ARIMA) model and Long Short-Term Memory (LSTM) networks. These methods can learn the historical change patterns of the matching segments and predict future feature values ​​based on these patterns.

[0176] During the expansion process, each entry in the vector-matching fragment binding set is processed first. For each entry, the matching fragments are extracted. Then, a selected time series prediction method is used to train and predict the matching fragments. For example, an LSTM network is used, with the matching fragments as input, to train the network to learn the changing patterns of the features. After training, the trained network is used to predict future time steps, generating expanded matching features.

[0177] Step S540: Extract the anomaly type identifier corresponding to the matching baseline template from the vector-extended matching feature binding set, bind the anomaly type identifier to the corresponding vector, and output the vector-anomaly type association set, where each entry contains a vector and the corresponding anomaly type identifier.

[0178] The anomaly type identifier corresponding to the matching baseline template is the identifier information of the anomaly type corresponding to each template in the preset baseline feature template set. Binding the anomaly type identifier to the corresponding vector clarifies the anomaly type corresponding to each vector, facilitating subsequent anomaly classification and processing. During the extraction and binding process, each entry in the vector-extended matching feature binding set is traversed. For each entry, based on the matching baseline template corresponding to the vector, the anomaly type identifier corresponding to that template is searched from the preset baseline feature template set. For example, if the matching baseline template corresponding to vector A is baseline template 1, and the anomaly type identifier corresponding to baseline template 1 in the preset baseline feature template set is "fraud anomaly," then "fraud anomaly" is bound to vector A. The bound entries are stored in a new set, outputting a vector-anomaly type association set, where each entry contains the vector and its corresponding anomaly type identifier.

[0179] Step S550: Extract the coverage ratio of the matching segments from the vector-extended matching feature binding set, use the coverage ratio as the anomaly degree quantification content, bind it with the corresponding vector, and output the vector-anomaly degree association set, where each entry contains the vector and the corresponding anomaly degree quantification content.

[0180] The coverage ratio of a matching segment is the proportion of the matching segment in the temporal feature segments of the entire vector or the temporal evolution features of the baseline template. The coverage ratio is used as a quantification of anomaly level because a higher coverage ratio indicates a higher degree of matching between the vector and the baseline template, and a potentially lower degree of anomaly; conversely, a lower coverage ratio may indicate a potentially higher degree of anomaly.

[0181] During the extraction and binding process, each entry in the vector-extended matching feature binding set is traversed. For each entry, the coverage ratio of the matching fragment is calculated. The coverage ratio can be calculated by comparing the time length of the matching fragment with the time length of the vector's temporal feature fragment or the temporal evolution feature of the baseline template. For example, if the vector's temporal feature fragment records the feature changes of the anomaly association path in time clusters 1-8, and the matching fragment records the feature changes in time clusters 2-5, then the coverage ratio is (5-2+1) / 8=0.5. The calculated coverage ratio is used as the anomaly degree quantification content and bound to the corresponding vector. The bound entries are stored in a new set, outputting a vector-anomaly degree association set, where each entry contains the vector and the corresponding anomaly degree quantification content.

[0182] Step S560: Bind the vector-anomaly type association set with the vector-anomaly degree association set, associate the anomaly type identifier and anomaly degree quantification content of the same vector, and output a comprehensive evaluation result containing the anomaly degree quantification value and the anomaly type identifier.

[0183] Binding the vector-anomaly type association set with the vector-anomaly severity association set is to associate two crucial pieces of information—anomaly type identifier and anomaly severity quantification—with the same vector, forming a complete and comprehensive evaluation result. Associating the anomaly type identifier and anomaly severity quantification of the same vector clearly demonstrates the anomaly type and severity corresponding to each vector.

[0184] In one implementation, step S560 may specifically include the following steps S561 to S566: Step S561: Extract vectors with the same exception type identifier from the vector-anomaly type association set, group these vectors into the same group, and output a set of vectors of the same type. Each group contains all vectors of the same exception type.

[0185] Extracting vectors with the same anomaly type identifier from the vector-anomaly type association set is for vector classification. Grouping vectors with the same anomaly type together facilitates subsequent analysis and processing of vectors with different anomaly types. Grouping these vectors into a single set combines all vectors of the same anomaly type. During extraction and grouping, each entry in the vector-anomaly type association set is traversed. For each entry, the anomaly type identifier and vector are extracted. Then, the vectors are classified according to the anomaly type identifier. For example, all vectors with the anomaly type identifier "fraud anomaly" are grouped together. All groups are stored in a single set, outputting a set of vectors of the same type, where each group contains all vectors of the same anomaly type.

[0186] Step S562: Extract the anomaly quantization content corresponding to each vector in the vector-anomaly degree association set from the vector-anomaly degree association set, bind the quantization content with the corresponding vector, and output the vector-quantization value association set of the same type, each group containing the vector and the corresponding quantization value.

[0187] Extracting the anomaly quantification content corresponding to each vector in the vector-anomaly severity association set is to associate the anomaly severity quantification content of vectors of the same anomaly type with their corresponding vectors, facilitating subsequent analysis and comparison of the anomaly severity of vectors of the same anomaly type. Binding the quantification content to the corresponding vector combines these two pieces of information into a new data entry. During the extraction and binding process, each group in the vector-anomaly severity association set is traversed. For each vector in each group, the corresponding anomaly severity quantification content is found in the vector-anomaly severity association set. All bound entries in each group are stored in a new set, outputting the vector-quantization value association set of the same type, where each group contains the vector and its corresponding quantization value.

[0188] Step S563: Associate the quantized content in the vector-quantized value association set of the same type, collect all quantized content under the same type, and output the type-quantized value association set. Each entry contains an anomaly type identifier and all corresponding quantized content.

[0189] Associating quantized content within the same type of vector-quantized value association set aims to integrate the anomaly severity quantization of all vectors under the same anomaly type, facilitating a holistic analysis of the anomaly severity of the same anomaly type. Grouping all quantized content under the same type involves combining these quantized contents into a single set. During the association and grouping process, each group within the same type of vector-quantized value association set is traversed. For each group, the anomaly severity quantization of all vectors within it is extracted. The anomaly type identifier and all corresponding quantized content are combined into a new data entry, stored in a set, and the output is a type-quantized value aggregation set, where each entry contains the anomaly type identifier and all corresponding quantized content.

[0190] Step S564: Extract the distribution range of quantized content from the type-quantized value aggregation set, bind the distribution range with the corresponding anomaly type identifier, and output the type-quantized distribution association set, where each entry contains the anomaly type and the corresponding quantized distribution.

[0191] The distribution range of quantified content represents the range of values ​​for the quantified anomaly severity of all vectors under the same anomaly type, reflecting the fluctuations in the anomaly severity of that anomaly type. Binding the distribution range to the corresponding anomaly type identifier clarifies the anomaly severity distribution for each anomaly type, facilitating subsequent anomaly analysis and processing.

[0192] During the extraction and binding process, each entry in the type-quantization value aggregation set is traversed. For each entry, the quantization content set is extracted. Then, the minimum and maximum values ​​in the quantization content set are identified; the range between these two values ​​is the distribution range. The anomaly type identifier and the corresponding quantization distribution are combined into a new data entry and stored in a set. The output type-quantization distribution association set is then created, with each entry containing the anomaly type and its corresponding quantization distribution.

[0193] Step S565: Bind the quantization distribution content in the type-quantization distribution association set to the corresponding anomaly type identifier, use the distribution range as a reference for the anomaly degree, and output the type-degree distribution association set, where each entry contains the anomaly type, quantization distribution, and corresponding degree basis.

[0194] Binding the quantization distribution content in the type-quantization distribution association set to the corresponding anomaly type identifier is to further clarify the distribution of anomaly severity for each anomaly type, and to use the distribution range as a reference for anomaly severity. Using the distribution range as a reference for anomaly severity is because the distribution range can reflect the fluctuation of the anomaly severity for that anomaly type; the larger the range, the greater the difference in anomaly severity.

[0195] During the binding process, each entry in the type-quantification distribution association set is traversed. For each entry, the anomaly type identifier, the quantification distribution content, and the information that the distribution range is used as a reference for the anomaly severity are combined into a new data entry. All such entries are stored in a set, and the type-severity distribution association set is output, where each entry contains the anomaly type, the quantification distribution, and the corresponding severity basis.

[0196] Step S566: Organize the type-degree distribution association set, retain the anomaly type identifier and the corresponding anomaly degree quantification value distribution, and output a comprehensive evaluation result containing the anomaly degree quantification value and the anomaly type identifier.

[0197] Organizing the type-degree distribution association set is for further filtering and optimization of the items in the set, removing redundant information and retaining only information related to the anomaly type identifier and the distribution of anomaly degree quantification values. Retaining the anomaly type identifier and its corresponding anomaly degree quantification value distribution ensures that the final comprehensive evaluation result clearly displays the anomaly degree distribution for each anomaly type.

[0198] During the data processing, each entry in the type-degree distribution association set is traversed. For each entry, the anomaly type identifier and the distribution of anomaly degree quantification values ​​are extracted. The extracted information is combined into a new data entry and stored in a new set. The entries in the set are further sorted and processed, for example, by lexicographical order of the anomaly type identifier. Finally, a comprehensive evaluation result containing the anomaly degree quantification value and the anomaly type identifier is output.

[0199] It is understood that the various algorithms involved in the above descriptions of the embodiments of the present invention can be obtained from relevant content in the prior art. In order to save space, they will not be elaborated on in the embodiments of the present invention.

[0200] Furthermore, those skilled in the art can supplement the details when implementing the solution of this invention based on common knowledge in the field. For example, they can use normalization to eliminate dimensional conflicts before feature fusion, use interpolation to eliminate dimensional differences, and reasonably set thresholds based on historical data, experience, or business scenario requirements, and ensure feature scale consistency based on feature preprocessing, etc. For example, in step S410, the path length content, node type sequence content, and edge attribute change content of the abnormal associated path features can be standardized and vectorized to obtain path length feature vectors, node type feature vectors, and edge attribute change feature vectors of uniform scale. The three types of feature vectors are aligned and concatenated according to the temporal order of the path to output a set of abnormal associated path feature vectors sorted by time. The present invention will not provide redundant descriptions of the implementation process in excessive detail here.

[0201] The following description continues to illustrate the exemplary structure of the big data processing device 255 in the application scenario provided in this application embodiment as a software module. In some embodiments, such as... Figure 2 As shown, the software module in the skill release device 255 stored in the virtual scene of the memory 450 may include: The data acquisition module 2551 is used to acquire timestamped associated data entries from multiple different data sources. These associated data entries contain interaction records and attribute descriptions between different entity objects. The network construction module 2552 is used to construct an entity association network for the associated data entries based on the unique identifier information of the entity objects, generating a heterogeneous association network containing multiple types of entity nodes and attributed association edges. The attributed association edges contain interaction time features and interaction strength features. The feature extraction module 2553 is used to perform multi-path parallel traversal analysis on the heterogeneous association network, extracting abnormal association path features in the network. These abnormal association path features include path length features, node type sequence features, and edge attribute change features. The recombination mapping module 2554 is used to input the abnormal association path features into a preset deep feature fusion model, perform cross-dimensional feature recombination and nonlinear mapping processing, and generate an abnormal evaluation feature vector containing multi-dimensional abnormal evaluation parameters. The matching analysis module 2555 is used to output a comprehensive evaluation result containing anomaly degree quantification and anomaly type identifier based on the matching analysis results between the abnormal evaluation feature vector and a preset benchmark feature template set.

[0202] In some embodiments, the computer-readable storage medium may be a read-only memory (ROM), random access memory (RAM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), flash memory, magnetic surface memory, optical disk, or CD-ROM, etc.; or it may be a device that includes one or any combination of the above-mentioned memories.

[0203] The above description is merely an embodiment of this application and is not intended to limit the scope of protection of this application. Any modifications, equivalent substitutions, and improvements made within the spirit and scope of this application are included within the scope of protection of this application.

Claims

1. A big data processing method, characterized in that, The method includes: Retrieve timestamped associated data entries from multiple different data sources, wherein the associated data entries contain interaction records and attribute description information between different entity objects; Based on the unique identification information of entity objects, an entity association network is constructed for the associated data entries, generating a heterogeneous association network containing multiple types of entity nodes and attributed association edges. The attributed association edges include interaction time features and interaction intensity features. Multi-path parallel traversal analysis is performed on the heterogeneous network to extract the abnormal association path features in the network. The abnormal association path features include path length features, node type sequence features, and edge attribute change features. The abnormal correlation path features are input into a preset deep feature fusion model, and cross-dimensional feature recombination and nonlinear mapping processing are performed to generate an abnormal evaluation feature vector containing multi-dimensional abnormal evaluation parameters. Based on the matching analysis results between the anomaly assessment feature vector and the preset benchmark feature template set, a comprehensive assessment result including anomaly degree quantification value and anomaly type identifier is output.

2. The big data processing method according to claim 1, characterized in that, The entity association network is constructed based on the unique identifier information of the entity object for the associated data entries, generating a heterogeneous association network containing multiple types of entity nodes and attributed association edges, including: Extract the time series of entity interactions from the associated data entries, group the interaction records with consecutive time intervals into the same cluster, and output the time cluster associated data entry group. Each time cluster associated data entry group contains entity interaction records with similar time intervals and corresponding attribute description information. Bind the entity attribute description information in each time cluster-associated data entry group with the corresponding time cluster label, attach the time cluster imprint to the attribute information, and output the attribute-time cluster binding set. Each set entry contains the entity attribute and the corresponding time cluster label. Extract the interaction records between entities from the time cluster associated data entry group, convert the interaction records between entities into temporary edges connecting entity nodes, add corresponding time cluster labels to the temporary edges, and output a set of temporary edges with time labels, with each temporary edge associated with two entity nodes and a time cluster label; Temporary edges with time labels belonging to the same entity node are concatenated according to the chronological order of time clusters. Temporary edges from different time clusters are concatenated according to the time sequence to output a set of temporally ordered entity connection sequences, where each sequence contains cross-time cluster connection paths of entity nodes. Perform cross-cluster cross-association on temporally sequenced entity connection sequences, merge connection sequences involving the same entity in different time clusters, retain the entity connection relationships across time clusters, and output a set of cross-cluster merged connection sequences, each sequence containing cross-cluster entity connection relationships; The cross-cluster merged connection sequence is transformed into a structured network with entities as nodes and cross-cluster merged connections as edges. Temporal clusters and interaction feature attributes are added to the edges, and the output is a heterogeneous association network containing multiple types of entity nodes and attributed association edges.

3. The big data processing method according to claim 2, characterized in that, The process of transforming cross-cluster merged connection sequences into a structured network, with entities as nodes and cross-cluster merged connections as edges, adds time clusters and interaction feature attributes to the edges, and outputs a heterogeneous association network containing multiple types of entity nodes and attributed association edges, including: Extract the cross-cluster connection frequency of each entity node from the cross-cluster merged connection sequence set, bind the cross-cluster connection frequency to the corresponding entity node, and output the node-cross-cluster connection frequency binding set. Each set entry contains the entity node identifier and the corresponding cross-cluster connection frequency. Entity nodes are divided according to the time span of cross-cluster connections. Entity nodes with similar time spans are grouped into the same group, and the time span node group set is output. Each group contains entity nodes with similar time spans and corresponding attribute information. Filter the cross-cluster merged connection sequences for each time span node group, retain the cross-cluster connections whose connection intervals conform to the time span range, and output a time-series filtered cross-cluster connection sequence set, where each sequence contains cross-cluster connections that conform to the time span. Associate the temporal filtering cross-cluster connection sequence with the corresponding time span node group, take the entities in the node group as nodes and the temporal filtering connection as edges, generate dynamic sub-networks, and output a set of dynamic sub-networks. Each sub-network contains entity nodes and connection edges of the same time span. Spatiotemporal alignment is performed on the subnetworks in the dynamic subnetwork set. The time cluster labels of different subnetworks are uniformly mapped to a continuous time axis, the time dimension of the subnetworks is aligned, and the spatiotemporally aligned dynamic subnetwork set is output, with the time axis of each subnetwork being unified. The spatiotemporally aligned dynamic subnetworks are integrated, the entity connection relationships between the subnetworks are preserved, and time clusters and interaction feature attributes are added to the edges, resulting in a heterogeneous association network containing multiple types of entity nodes and attributed associated edges.

4. The big data processing method according to claim 3, characterized in that, The process involves integrating spatiotemporally aligned dynamic subnetworks, preserving entity connections between subnetworks, adding temporal clusters and interaction feature attributes to edges, and outputting a heterogeneous association network containing multiple types of entity nodes and attributed associated edges, including: Extract all entity pairs that are not directly connected but share at least three adjacent entity nodes from the spatiotemporally aligned dynamic subnetwork set, treat these entity pairs as objects with potential connections, and output a set of potentially associated entity pairs, each entry containing two entities that are not directly connected but share neighboring nodes; Bind potential related entity pairs to their common neighboring entity nodes, using the common neighboring nodes as the supporting basis for potential associations, and output a potential association-common neighboring node binding set, with each entry containing a potential related entity pair and its corresponding common neighboring node; Based on the interaction time order of common neighbor nodes and potential associated entity pairs, generate time constraints for potential associations to ensure that potential associations conform to the logic of interaction time sequence, and output a set of potential association time constraints, with each entry containing the potential association and the corresponding time constraint. Based on the potential association time constraint, retain the potential association entity pairs that meet the time constraint, and output the verified set of potential association entity pairs, with each entry containing a reasonable potential association entity pair; The verified potential related entity pairs are transformed into implicit connection edges. Common neighbor node support and time constraint imprints are added to the implicit edges. The implicit edges are added to the spatiotemporally aligned dynamic sub-network, and the output is a heterogeneous related network with implicit edges, including explicit edges and implicit edges. Redundancy cleanup is performed on heterogeneous interconnected networks with implicit edges. Duplicate implicit edges and implicit edges that completely overlap with explicit edges are removed, while implicit edges with unique connection significance are retained. The result is an expanded heterogeneous interconnected network containing multiple types of entity nodes, explicit edges, and implicit edges.

5. The big data processing method according to claim 1, characterized in that, The step of performing multi-path parallel traversal analysis on the heterogeneous interconnected network to extract the features of abnormal interconnected paths in the network includes: From the heterogeneous association network, select entity nodes that involve interactions in at least three different time clusters as traversal starting nodes, and output a set of cross-cluster starting nodes, each node containing interaction records and attribute information across multiple time clusters; Starting from each cross-cluster starting node, traverse along the path where the edge attributes change continuously, track the complete path of the edge attributes from the initial state to the changed state, generate attribute evolution traversal path, and output attribute evolution traversal path set, each path containing node sequence and corresponding edge attribute change trajectory. Extract the total number of entity nodes contained in each attribute evolution traversal path as the path length content, extract the category identifier of each entity node in the path as the node type sequence content, extract the continuous change trajectory of edge attributes in the path as the edge attribute change content, and output the basic feature set of the path. Each path feature in the basic path feature set is compared with the path features generated by all starting nodes of the same type. The content that deviates from the majority of path features is identified, and a set of path feature deviation comparison results is output. Each entry contains the path feature and the corresponding deviation content. Paths whose deviation content covers three types of features—path length, node type sequence, and edge attribute change—are selected from the path feature deviation comparison result set and used as differentiated paths. A set of differentiated evolution paths is output, with each path containing three types of feature deviation content. The path length, node type sequence, and edge attribute change content are extracted from the differential evolution path set. These three types of features are integrated into a unified format to output the abnormal associated path features in the network, which contain the three complete feature contents.

6. The big data processing method according to claim 5, characterized in that, The process involves extracting path length, node type sequence, and edge attribute variation from the differentiated evolution path set, integrating these three types of features into a unified format, and outputting the abnormal associated path features in the network. This output includes three complete feature sets: Extract all neighboring nodes of each entity node in each path from the set of differentiated evolution paths, bind the neighboring nodes to the corresponding paths, and output the path-neighboring node binding set. Each entry contains the path identifier and all neighboring nodes of the corresponding node. Associate the node type sequence of the path with the neighbor node categories of the corresponding node, add the neighbor node categories of each node to the node type sequence, generate an extended node type sequence, and output a set of extended node type sequences, each sequence containing the original node type and the neighbor node categories; Extract the occurrence frequency of node categories from the extended node type sequence set, bind the category frequency with the corresponding path, and output the path-category frequency binding set, where each entry contains the path identifier and the corresponding node category frequency; Associate the frequency content in the path-category frequency binding set with the path length content and the edge attribute change content, associate and bind the three types of features, generate extended anomaly associated path features, and output extended anomaly associated path feature set, each feature containing length, type frequency and attribute change; The extended anomaly path feature set is integrated by arranging the three types of features in a fixed order to ensure that the structure of each feature is consistent, and outputting an extended anomaly path feature set with a unified structure, where each feature has a consistent structure. The extended abnormal path features with unified structure are organized, duplicate feature content is removed, unique abnormal associated path features are retained, and the optimized abnormal associated path features are output, including complete features of path length, node type sequence and edge attribute change.

7. The big data processing method according to claim 6, characterized in that, The process involves organizing the structurally unified extended abnormal path features, removing duplicate features, retaining only unique abnormal associated path features, and outputting optimized abnormal associated path features. These features include path length, node type sequence, and complete edge attribute change features, including: Extract the edge attribute change trajectory of each path from the unified extended abnormal path feature set, bind the edge attribute change trajectory with the corresponding path, and output the path-attribute change trajectory binding set. Each entry contains the path identifier and the corresponding edge attribute change trajectory. The path edge attribute change trajectory is associated with the path length and extended node type sequence, and the trajectory change period is matched with the path length and node type to generate time-series linkage anomaly associated path features. The time-series linkage anomaly associated path feature set is output, and each feature contains three types of time-series linkage content. Extract the fluctuation range of the change trajectory from the feature set of the time-series linkage anomaly associated path, bind the fluctuation range with the corresponding path, and output the path-fluctuation range binding set. Each entry contains the path identifier and the corresponding attribute change fluctuation range. Associate the fluctuation range content in the path-fluctuation range binding set with the path length and extended node type sequence content to generate fluctuation-related abnormal path features, and output a fluctuation-related abnormal path feature set, where each feature contains fluctuation range, length and type sequence; Deduplication is performed on the set of fluctuation-related abnormal path features, removing duplicate fluctuation-related features, and the deduplicated set of fluctuation-related abnormal path features is output. The deduplicated fluctuation-related abnormal path features are organized, retaining the complete content of path length, node type sequence and edge attribute changes, and outputting the optimized abnormal path features, which include three types of complete feature content.

8. The big data processing method according to claim 1, characterized in that, The step of inputting the abnormal correlation path features into a preset deep feature fusion model, performing cross-dimensional feature recombination and nonlinear mapping processing, and generating an abnormal evaluation feature vector containing multi-dimensional abnormal evaluation parameters includes: The path length, node type sequence, and edge attribute change content of the abnormal associated path features are arranged in chronological order according to the path. The three types of features are concatenated in chronological order to output a set of abnormal associated path features sorted by time. Each entry contains three types of features in chronological order. Interleave the different path features in the time-sorted abnormal associated path feature set, and concatenate the time-series segments of each path with the time-series segments of other paths to generate interleaved features. Output the interleaved feature set, where each feature contains time-series segments of different paths. The interlaced features are input into a preset deep feature fusion model, and the interlaced features are input into the feature processing chain to generate initial fusion features and output an initial fusion feature set, where each feature contains fusion content with multiple interlaced paths. Cross-temporal association is performed on the features in the initial fusion feature set, the feature content of different time segments is associated and bound, cross-temporal feature association relationships are mined, and a cross-temporal associated fusion feature set is output, where each feature contains cross-temporal associated content; The cross-temporal correlation fusion features are non-linearly mapped to convert the correlation fusion features into high-dimensional vector form, generating intermediate anomaly evaluation feature vectors, and outputting a set of intermediate anomaly evaluation feature vectors, where each vector contains multi-dimensional feature content. The intermediate anomaly assessment feature vector set is integrated, and the multi-dimensional features of different vectors are uniformly organized to output anomaly assessment feature vectors containing multi-dimensional anomaly assessment parameters.

9. A big data processing device, characterized in that, include: The data acquisition module is used to acquire timestamped associated data entries from multiple different data sources. The associated data entries include interaction records and attribute description information between different entity objects. The network construction module is used to construct an entity association network for the associated data entries based on the unique identification information of the entity objects, and generate a heterogeneous association network containing multiple types of entity nodes and attributed association edges, wherein the attributed association edges contain interaction time features and interaction intensity features. The feature extraction module is used to perform multi-path parallel traversal analysis on the heterogeneous network and extract abnormal association path features in the network. The abnormal association path features include path length features, node type sequence features, and edge attribute change features. The recombination mapping module is used to input the abnormal correlation path features into a preset deep feature fusion model, perform cross-dimensional feature recombination and nonlinear mapping processing, and generate an abnormal evaluation feature vector containing multi-dimensional abnormal evaluation parameters. The matching analysis module is used to output a comprehensive evaluation result, including a quantitative value of the degree of abnormality and an abnormality type identifier, based on the matching analysis results of the anomaly evaluation feature vector and the preset benchmark feature template set.

10. A management system, characterized in that, include: Memory is used to store executable instructions or computer programs. A processor, when executing computer-executable instructions or computer programs stored in the memory, implements the big data processing method according to any one of claims 1 to 9.

Images